@open-mercato/core 0.6.6-develop.6205.1.109e4b6a84 → 0.6.6-develop.6228.1.cf483c68b5

package/src/modules/messages/components/message-detail/hooks/useMessageDetailsActions.ts

@@ -5,6 +5,7 @@ import type { UseQueryResult } from '@tanstack/react-query'
 import type { TranslateFn } from '@open-mercato/shared/lib/i18n/context'
 import type { MessageActionsProps, MessageContentProps } from '@open-mercato/shared/modules/messages/types'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
+import { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'
 import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
 import type {
   ActionResult,
@@ -21,6 +22,13 @@ type RequestAndRefreshOptions = {
 
 type ConversationActionKind = 'archiveConversation' | 'deleteConversation' | 'markAllUnread'
 
+type MessageDetailMutationContext = {
+  resourceKind: 'message' | 'conversation'
+  messageId: string
+  action: string
+  retryLastMutation: () => Promise<boolean>
+}
+
 type UseMessageDetailsActionsInput = {
   id: string
   t: TranslateFn
@@ -51,6 +59,10 @@ export function useMessageDetailsActions({
   const [deleteConfirmationOpen, setDeleteConfirmationOpen] = React.useState(false)
   const [activeConversationAction, setActiveConversationAction] = React.useState<ConversationActionKind | null>(null)
 
+  const { runMutation, retryLastMutation } = useGuardedMutation<MessageDetailMutationContext>({
+    contextId: 'messages-detail-actions',
+  })
+
   const requestAndRefresh = React.useCallback(async (
     url: string,
     method: 'PUT' | 'DELETE',
@@ -58,18 +70,24 @@ export function useMessageDetailsActions({
   ) => {
     setUpdatingState(true)
     try {
-      const call = await apiCall<{ ok?: boolean }>(url, { method })
-      if (!call.ok) {
-        throw new Error(
-          toErrorMessage(call.result)
-          ?? t('messages.errors.stateChangeFailed', 'Failed to update message state.'),
-        )
-      }
-      if (options?.skipDetailAutoMarkRead) {
-        await refreshDetailWithoutAutoMarkRead()
-      } else {
-        await detailQuery.refetch()
-      }
+      await runMutation({
+        operation: async () => {
+          const call = await apiCall<{ ok?: boolean }>(url, { method })
+          if (!call.ok) {
+            throw new Error(
+              toErrorMessage(call.result)
+              ?? t('messages.errors.stateChangeFailed', 'Failed to update message state.'),
+            )
+          }
+          if (options?.skipDetailAutoMarkRead) {
+            await refreshDetailWithoutAutoMarkRead()
+          } else {
+            await detailQuery.refetch()
+          }
+        },
+        context: { resourceKind: 'message', messageId: id, action: 'state-change', retryLastMutation },
+        mutationPayload: { messageId: id, action: 'state-change', url, method },
+      })
     } catch (err) {
       flash(
         err instanceof Error
@@ -80,17 +98,23 @@ export function useMessageDetailsActions({
     } finally {
       setUpdatingState(false)
     }
-  }, [detailQuery, refreshDetailWithoutAutoMarkRead, t])
+  }, [detailQuery, id, refreshDetailWithoutAutoMarkRead, retryLastMutation, runMutation, t])
 
   const handleDelete = React.useCallback(async () => {
     setUpdatingState(true)
     try {
-      const call = await apiCall<{ ok?: boolean }>(`/api/messages/${encodeURIComponent(id)}`, {
-        method: 'DELETE',
+      await runMutation({
+        operation: async () => {
+          const call = await apiCall<{ ok?: boolean }>(`/api/messages/${encodeURIComponent(id)}`, {
+            method: 'DELETE',
+          })
+          if (!call.ok) {
+            throw new Error(toErrorMessage(call.result) ?? t('messages.errors.deleteFailed', 'Failed to delete message.'))
+          }
+        },
+        context: { resourceKind: 'message', messageId: id, action: 'delete', retryLastMutation },
+        mutationPayload: { messageId: id, action: 'delete' },
       })
-      if (!call.ok) {
-        throw new Error(toErrorMessage(call.result) ?? t('messages.errors.deleteFailed', 'Failed to delete message.'))
-      }
       flash(t('messages.flash.deleted', 'Message deleted.'), 'success')
       onDeleted()
     } catch (err) {
@@ -103,7 +127,7 @@ export function useMessageDetailsActions({
     } finally {
       setUpdatingState(false)
     }
-  }, [id, onDeleted, t])
+  }, [id, onDeleted, retryLastMutation, runMutation, t])
 
   const runConversationAction = React.useCallback(async (
     action: ConversationActionKind,
@@ -117,13 +141,19 @@ export function useMessageDetailsActions({
   ) => {
     setActiveConversationAction(action)
     try {
-      const call = await apiCall<{ ok?: boolean; affectedCount?: number }>(options.url, { method: options.method })
-      if (!call.ok) {
-        throw new Error(
-          toErrorMessage(call.result)
-          ?? t('messages.errors.conversationActionFailed', 'Failed to update conversation.'),
-        )
-      }
+      await runMutation({
+        operation: async () => {
+          const call = await apiCall<{ ok?: boolean; affectedCount?: number }>(options.url, { method: options.method })
+          if (!call.ok) {
+            throw new Error(
+              toErrorMessage(call.result)
+              ?? t('messages.errors.conversationActionFailed', 'Failed to update conversation.'),
+            )
+          }
+        },
+        context: { resourceKind: 'conversation', messageId: id, action, retryLastMutation },
+        mutationPayload: { messageId: id, action, url: options.url, method: options.method },
+      })
 
       flash(options.successMessage, 'success')
 
@@ -147,7 +177,7 @@ export function useMessageDetailsActions({
     } finally {
       setActiveConversationAction(null)
     }
-  }, [detailQuery, refreshDetailWithoutAutoMarkRead, t])
+  }, [detailQuery, id, refreshDetailWithoutAutoMarkRead, retryLastMutation, runMutation, t])
 
   const archiveConversation = React.useCallback(async (messageId?: string) => {
     const targetMessageId = messageId ?? id
@@ -194,21 +224,29 @@ export function useMessageDetailsActions({
   const executeAction = React.useCallback(async (action: MessageAction, payload?: Record<string, unknown>) => {
     setExecutingActionId(action.id)
     try {
-      const call = await apiCall<ActionResult>(
-        `/api/messages/${encodeURIComponent(id)}/actions/${encodeURIComponent(action.id)}`,
-        {
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify(payload ?? {}),
+      const call = await runMutation({
+        operation: async () => {
+          const result = await apiCall<ActionResult>(
+            `/api/messages/${encodeURIComponent(id)}/actions/${encodeURIComponent(action.id)}`,
+            {
+              method: 'POST',
+              headers: { 'Content-Type': 'application/json' },
+              body: JSON.stringify(payload ?? {}),
+            },
+          )
+
+          if (!result.ok) {
+            throw new Error(
+              toErrorMessage(result.result)
+              ?? t('messages.errors.actionFailed', 'Failed to execute action.'),
+            )
+          }
+
+          return result
         },
-      )
-
-      if (!call.ok) {
-        throw new Error(
-          toErrorMessage(call.result)
-          ?? t('messages.errors.actionFailed', 'Failed to execute action.'),
-        )
-      }
+        context: { resourceKind: 'message', messageId: id, action: 'execute-action', retryLastMutation },
+        mutationPayload: { messageId: id, action: 'execute-action', actionId: action.id },
+      })
 
       flash(t('messages.flash.actionSuccess', 'Action completed.'), 'success')
 
@@ -233,7 +271,7 @@ export function useMessageDetailsActions({
     } finally {
       setExecutingActionId(null)
     }
-  }, [detailQuery, id, t])
+  }, [detailQuery, id, retryLastMutation, runMutation, t])
 
   const handleExecuteAction = React.useCallback(async (action: MessageAction, payload?: Record<string, unknown>) => {
     if (executingActionId || detail?.actionTaken) return

package/src/modules/notifications/frontend/NotificationSettingsPageClient.tsx

@@ -3,6 +3,7 @@
 import * as React from 'react'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { apiCall, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { Button } from '@open-mercato/ui/primitives/button'
 import { Input } from '@open-mercato/ui/primitives/input'
@@ -35,6 +36,8 @@ const emptySettings: NotificationDeliveryConfig = {
   },
 }
 
+const SETTINGS_CONTEXT_ID = 'notifications-settings'
+
 export function NotificationSettingsPageClient() {
   const t = useT()
   const [settings, setSettings] = React.useState<NotificationDeliveryConfig | null>(null)
@@ -42,6 +45,15 @@ export function NotificationSettingsPageClient() {
   const [saving, setSaving] = React.useState(false)
   const [error, setError] = React.useState<string | null>(null)
 
+  const { runMutation, retryLastMutation } = useGuardedMutation<{
+    formId: string
+    resourceKind: string
+    retryLastMutation: () => Promise<boolean>
+  }>({
+    contextId: SETTINGS_CONTEXT_ID,
+    blockedMessage: t('ui.forms.flash.saveBlocked', 'Save blocked by validation'),
+  })
+
   const fetchSettings = React.useCallback(async () => {
     setLoading(true)
     setError(null)
@@ -96,10 +108,15 @@ export function NotificationSettingsPageClient() {
     if (!settings) return
     setSaving(true)
     try {
-      const response = await apiCall<SettingsResponse>('/api/notifications/settings', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify(settings),
+      const response = await runMutation({
+        operation: () =>
+          apiCall<SettingsResponse>('/api/notifications/settings', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(settings),
+          }),
+        context: { formId: SETTINGS_CONTEXT_ID, resourceKind: 'notifications.settings', retryLastMutation },
+        mutationPayload: { settings },
       })
       if (!response.ok) {
         const message = response.result?.error || t('notifications.settings.saveError', 'Failed to save notification settings')

package/src/modules/payment_gateways/api/cancel/route.ts

@@ -5,6 +5,13 @@ import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
 import { cancelSchema } from '../../data/validators'
 import type { PaymentGatewayService } from '../../lib/gateway-service'
 import { paymentGatewaysTag } from '../openapi'
+import {
+  resolveUserFeatures,
+  runPaymentGatewayMutationGuardAfterSuccess,
+  runPaymentGatewayMutationGuards,
+} from '../guards'
+
+const gatewayTransactionResourceKind = 'payment_gateways.gateway_transaction'
 
 export const metadata = {
   path: '/payment_gateways/cancel',
@@ -24,6 +31,28 @@ export async function POST(req: Request) {
   }
 
   const container = await createRequestContainer()
+  const guardResult = await runPaymentGatewayMutationGuards(
+    container,
+    {
+      tenantId: auth.tenantId,
+      organizationId: auth.orgId,
+      userId: auth.sub ?? '',
+      resourceKind: gatewayTransactionResourceKind,
+      resourceId: parsed.data.transactionId,
+      operation: 'update',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: parsed.data as Record<string, unknown>,
+    },
+    resolveUserFeatures(auth),
+  )
+  if (!guardResult.ok) {
+    return NextResponse.json(
+      guardResult.errorBody ?? { error: 'Operation blocked by guard' },
+      { status: guardResult.errorStatus ?? 422 },
+    )
+  }
+
   const service = container.resolve('paymentGatewayService') as PaymentGatewayService
 
   try {
@@ -32,6 +61,16 @@ export async function POST(req: Request) {
       parsed.data.reason,
       { organizationId: auth.orgId as string, tenantId: auth.tenantId },
     )
+    await runPaymentGatewayMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {
+      tenantId: auth.tenantId,
+      organizationId: auth.orgId,
+      userId: auth.sub ?? '',
+      resourceKind: gatewayTransactionResourceKind,
+      resourceId: parsed.data.transactionId,
+      operation: 'update',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+    })
     return NextResponse.json(result)
   } catch (err: unknown) {
     const message = err instanceof Error ? err.message : 'Cancel failed'

package/src/modules/payment_gateways/api/capture/route.ts

@@ -5,6 +5,13 @@ import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
 import { captureSchema } from '../../data/validators'
 import type { PaymentGatewayService } from '../../lib/gateway-service'
 import { paymentGatewaysTag } from '../openapi'
+import {
+  resolveUserFeatures,
+  runPaymentGatewayMutationGuardAfterSuccess,
+  runPaymentGatewayMutationGuards,
+} from '../guards'
+
+const gatewayTransactionResourceKind = 'payment_gateways.gateway_transaction'
 
 export const metadata = {
   path: '/payment_gateways/capture',
@@ -24,6 +31,28 @@ export async function POST(req: Request) {
   }
 
   const container = await createRequestContainer()
+  const guardResult = await runPaymentGatewayMutationGuards(
+    container,
+    {
+      tenantId: auth.tenantId,
+      organizationId: auth.orgId,
+      userId: auth.sub ?? '',
+      resourceKind: gatewayTransactionResourceKind,
+      resourceId: parsed.data.transactionId,
+      operation: 'update',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: parsed.data as Record<string, unknown>,
+    },
+    resolveUserFeatures(auth),
+  )
+  if (!guardResult.ok) {
+    return NextResponse.json(
+      guardResult.errorBody ?? { error: 'Operation blocked by guard' },
+      { status: guardResult.errorStatus ?? 422 },
+    )
+  }
+
   const service = container.resolve('paymentGatewayService') as PaymentGatewayService
 
   try {
@@ -32,6 +61,16 @@ export async function POST(req: Request) {
       parsed.data.amount,
       { organizationId: auth.orgId as string, tenantId: auth.tenantId },
     )
+    await runPaymentGatewayMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {
+      tenantId: auth.tenantId,
+      organizationId: auth.orgId,
+      userId: auth.sub ?? '',
+      resourceKind: gatewayTransactionResourceKind,
+      resourceId: parsed.data.transactionId,
+      operation: 'update',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+    })
     return NextResponse.json(result)
   } catch (err: unknown) {
     const message = err instanceof Error ? err.message : 'Capture failed'

package/src/modules/payment_gateways/api/guards.ts

@@ -0,0 +1,59 @@
+import type { AwilixContainer } from 'awilix'
+import {
+  bridgeLegacyGuard,
+  runMutationGuards,
+  type MutationGuard,
+  type MutationGuardInput,
+} from '@open-mercato/shared/lib/crud/mutation-guard-registry'
+
+type GuardAfterCallback = {
+  guard: MutationGuard
+  metadata: Record<string, unknown> | null
+}
+
+export function resolveUserFeatures(auth: unknown): string[] {
+  const features = (auth as { features?: unknown })?.features
+  if (!Array.isArray(features)) return []
+  return features.filter((value): value is string => typeof value === 'string')
+}
+
+export async function runPaymentGatewayMutationGuards(
+  container: AwilixContainer,
+  input: MutationGuardInput,
+  userFeatures: string[],
+): Promise<{
+  ok: boolean
+  errorBody?: Record<string, unknown>
+  errorStatus?: number
+  modifiedPayload?: Record<string, unknown>
+  afterSuccessCallbacks: GuardAfterCallback[]
+}> {
+  const legacyGuard = bridgeLegacyGuard(container)
+  if (!legacyGuard) {
+    return { ok: true, afterSuccessCallbacks: [] }
+  }
+
+  return runMutationGuards([legacyGuard], input, { userFeatures })
+}
+
+export async function runPaymentGatewayMutationGuardAfterSuccess(
+  callbacks: GuardAfterCallback[],
+  input: {
+    tenantId: string
+    organizationId: string | null
+    userId: string
+    resourceKind: string
+    resourceId: string
+    operation: 'create' | 'update' | 'delete'
+    requestMethod: string
+    requestHeaders: Headers
+  },
+): Promise<void> {
+  for (const callback of callbacks) {
+    if (!callback.guard.afterSuccess) continue
+    await callback.guard.afterSuccess({
+      ...input,
+      metadata: callback.metadata ?? null,
+    })
+  }
+}

package/src/modules/payment_gateways/api/refund/route.ts

@@ -5,6 +5,13 @@ import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
 import { refundSchema } from '../../data/validators'
 import type { PaymentGatewayService } from '../../lib/gateway-service'
 import { paymentGatewaysTag } from '../openapi'
+import {
+  resolveUserFeatures,
+  runPaymentGatewayMutationGuardAfterSuccess,
+  runPaymentGatewayMutationGuards,
+} from '../guards'
+
+const gatewayTransactionResourceKind = 'payment_gateways.gateway_transaction'
 
 export const metadata = {
   path: '/payment_gateways/refund',
@@ -24,6 +31,28 @@ export async function POST(req: Request) {
   }
 
   const container = await createRequestContainer()
+  const guardResult = await runPaymentGatewayMutationGuards(
+    container,
+    {
+      tenantId: auth.tenantId,
+      organizationId: auth.orgId,
+      userId: auth.sub ?? '',
+      resourceKind: gatewayTransactionResourceKind,
+      resourceId: parsed.data.transactionId,
+      operation: 'update',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: parsed.data as Record<string, unknown>,
+    },
+    resolveUserFeatures(auth),
+  )
+  if (!guardResult.ok) {
+    return NextResponse.json(
+      guardResult.errorBody ?? { error: 'Operation blocked by guard' },
+      { status: guardResult.errorStatus ?? 422 },
+    )
+  }
+
   const service = container.resolve('paymentGatewayService') as PaymentGatewayService
 
   try {
@@ -33,6 +62,16 @@ export async function POST(req: Request) {
       parsed.data.reason,
       { organizationId: auth.orgId as string, tenantId: auth.tenantId },
     )
+    await runPaymentGatewayMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {
+      tenantId: auth.tenantId,
+      organizationId: auth.orgId,
+      userId: auth.sub ?? '',
+      resourceKind: gatewayTransactionResourceKind,
+      resourceId: parsed.data.transactionId,
+      operation: 'update',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+    })
     return NextResponse.json(result)
   } catch (err: unknown) {
     const message = err instanceof Error ? err.message : 'Refund failed'

package/src/modules/payment_gateways/api/sessions/route.ts

@@ -5,6 +5,13 @@ import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
 import { createSessionSchema } from '../../data/validators'
 import type { PaymentGatewayService } from '../../lib/gateway-service'
 import { paymentGatewaysTag } from '../openapi'
+import {
+  resolveUserFeatures,
+  runPaymentGatewayMutationGuardAfterSuccess,
+  runPaymentGatewayMutationGuards,
+} from '../guards'
+
+const gatewayTransactionResourceKind = 'payment_gateways.gateway_transaction'
 
 export const metadata = {
   path: '/payment_gateways/sessions',
@@ -24,6 +31,28 @@ export async function POST(req: Request) {
   }
 
   const container = await createRequestContainer()
+  const guardResult = await runPaymentGatewayMutationGuards(
+    container,
+    {
+      tenantId: auth.tenantId,
+      organizationId: auth.orgId,
+      userId: auth.sub ?? '',
+      resourceKind: gatewayTransactionResourceKind,
+      resourceId: null,
+      operation: 'create',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: parsed.data as Record<string, unknown>,
+    },
+    resolveUserFeatures(auth),
+  )
+  if (!guardResult.ok) {
+    return NextResponse.json(
+      guardResult.errorBody ?? { error: 'Operation blocked by guard' },
+      { status: guardResult.errorStatus ?? 422 },
+    )
+  }
+
   const service = container.resolve('paymentGatewayService') as PaymentGatewayService
 
   try {
@@ -46,6 +75,17 @@ export async function POST(req: Request) {
     const redirectUrl = session.redirectUrl
       ?? (session.clientSession?.type === 'redirect' ? session.clientSession.redirectUrl : null)
 
+    await runPaymentGatewayMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {
+      tenantId: auth.tenantId,
+      organizationId: auth.orgId,
+      userId: auth.sub ?? '',
+      resourceKind: gatewayTransactionResourceKind,
+      resourceId: transaction.id,
+      operation: 'create',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+    })
+
     return NextResponse.json({
       transactionId: transaction.id,
       sessionId: session.sessionId,

package/src/modules/planner/api/availability-date-specific.ts

@@ -161,6 +161,16 @@ export const openApi = {
         { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },
         { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },
         { status: 403, description: 'Forbidden', schema: z.object({ error: z.string() }) },
+        {
+          status: 409,
+          description: 'Conflict — the subject/date availability was modified by another edit',
+          schema: z.object({
+            error: z.string(),
+            code: z.string(),
+            currentUpdatedAt: z.string(),
+            expectedUpdatedAt: z.string(),
+          }),
+        },
       ],
     },
   },

package/src/modules/planner/backend/planner/availability-rulesets/page.tsx

@@ -11,6 +11,7 @@ import { RowActions } from '@open-mercato/ui/backend/RowActions'
 import { Button } from '@open-mercato/ui/primitives/button'
 import { readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
 import { deleteCrud } from '@open-mercato/ui/backend/utils/crud'
+import { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'
 import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { normalizeCrudServerError } from '@open-mercato/ui/backend/utils/serverErrors'
@@ -41,6 +42,23 @@ export default function PlannerAvailabilityRuleSetsPage() {
   const { confirm, ConfirmDialogElement } = useConfirmDialog()
   const router = useRouter()
   const scopeVersion = useOrganizationScopeVersion()
+  const mutationContextId = 'planner-availability-rule-sets'
+  const { runMutation, retryLastMutation } = useGuardedMutation<{
+    formId: string
+    resourceKind: string
+    retryLastMutation: () => Promise<boolean>
+  }>({
+    contextId: mutationContextId,
+    blockedMessage: t('ui.forms.flash.saveBlocked', 'Save blocked by validation'),
+  })
+  const mutationContext = React.useMemo(
+    () => ({
+      formId: mutationContextId,
+      resourceKind: 'planner.availability_rule_set',
+      retryLastMutation,
+    }),
+    [mutationContextId, retryLastMutation],
+  )
   const [rows, setRows] = React.useState<RuleSetRow[]>([])
   const [page, setPage] = React.useState(1)
   const [total, setTotal] = React.useState(0)
@@ -127,10 +145,13 @@ export default function PlannerAvailabilityRuleSetsPage() {
     })
     if (!confirmed) return
     try {
-      const headers = buildOptimisticLockHeader(entry.updatedAt)
-      await withScopedApiRequestHeaders(headers, () => (
-        deleteCrud('planner/availability-rule-sets', entry.id, { errorMessage: labels.errors.delete })
-      ))
+      await runMutation({
+        operation: () => withScopedApiRequestHeaders(buildOptimisticLockHeader(entry.updatedAt), () => (
+          deleteCrud('planner/availability-rule-sets', entry.id, { errorMessage: labels.errors.delete })
+        )),
+        context: mutationContext,
+        mutationPayload: { action: 'delete', id: entry.id },
+      })
       flash(labels.messages.deleted, 'success')
       handleRefresh()
     } catch (error) {
@@ -138,7 +159,7 @@ export default function PlannerAvailabilityRuleSetsPage() {
       const normalized = normalizeCrudServerError(error)
       flash(normalized.message ?? labels.errors.delete, 'error')
     }
-  }, [confirm, handleRefresh, labels.actions.deleteConfirm, labels.errors.delete, labels.messages.deleted])
+  }, [confirm, handleRefresh, labels.actions.deleteConfirm, labels.errors.delete, labels.messages.deleted, mutationContext, runMutation])
 
   const columns = React.useMemo<ColumnDef<RuleSetRow>[]>(() => [
     {

package/src/modules/planner/commands/availability-date-specific.ts

@@ -9,10 +9,28 @@ import {
   type PlannerAvailabilityDateSpecificReplaceInput,
 } from '../data/validators'
 import { ensureOrganizationScope, ensureTenantScope, extractUndoPayload } from './shared'
+import { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
 import type { PlannerAvailabilityKind, PlannerAvailabilitySubjectType } from '../data/entities'
 
 const AVAILABILITY_RULE_RESOURCE_KIND = 'planner.availability.rule'
 
+/**
+ * The date-specific aggregate (the one-off rules for a subject/date) has no
+ * single parent row, so its optimistic-lock version is the latest `updated_at`
+ * of the rules being replaced. The editor sends that token via the extension
+ * header; an empty set means "nothing to clobber" → no current version → the
+ * guard is a no-op (strictly additive, fail-open).
+ */
+function resolveAggregateLockVersion(rules: PlannerAvailabilityRule[]): Date | null {
+  let latest: Date | null = null
+  for (const rule of rules) {
+    const value = rule.updatedAt
+    if (!value || Number.isNaN(value.getTime())) continue
+    if (!latest || value.getTime() > latest.getTime()) latest = value
+  }
+  return latest
+}
+
 type AvailabilityRuleSnapshot = {
   id: string
   tenantId: string
@@ -207,6 +225,12 @@ const replaceDateSpecificAvailabilityCommand: CommandHandler<PlannerAvailability
           if (window.repeat !== 'once') return false
           return dates.has(formatDateKey(window.startAt))
         })
+        enforceCommandOptimisticLock({
+          resourceKind: AVAILABILITY_RULE_RESOURCE_KIND,
+          resourceId: `${parsed.subjectType}:${parsed.subjectId}`,
+          current: resolveAggregateLockVersion(toDelete),
+          request: ctx.request ?? null,
+        })
         toDelete.forEach((rule) => {
           rule.deletedAt = now
           rule.updatedAt = now