@open-mercato/core 0.6.6-develop.6229.1.ebe6706732 → 0.6.6-develop.6241.1.47c01ad4ed

package/src/modules/communication_channels/widgets/injection/channel-payload-renderer/widget.client.tsx

@@ -3,13 +3,15 @@
 import * as React from 'react'
 import type { InjectionWidgetComponentProps } from '@open-mercato/shared/modules/widgets/injection'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
-import { sanitizeChannelHtml } from '../../../lib/sanitize-channel-html'
 
 type ChannelPayloadEnrichment = {
   channelContentType: string | null
   channelPayload: Record<string, unknown> | null
   interactiveState: Record<string, unknown> | null
   channelMetadata: Record<string, unknown> | null
+  // Email HTML is sanitized server-side by the channel-payload enricher and
+  // delivered here ready to render — the client never imports `sanitize-html`.
+  sanitizedHtml: string | null
 }
 
 type MessageWithPayload = Record<string, unknown> & {
@@ -24,11 +26,10 @@ export default function ChannelPayloadRendererWidget({
   const payload = data?._channelPayload ?? null
   if (!payload || !payload.channelContentType) return null
 
-  const { channelContentType, channelPayload } = payload
+  const { channelContentType, channelPayload, sanitizedHtml } = payload
 
-  // Email / HTML — sanitize, then render.
-  if (channelContentType.startsWith('email/') && typeof channelPayload?.html === 'string') {
-    const sanitized = sanitizeChannelHtml(channelPayload.html as string)
+  // Email / HTML — render the HTML the server already sanitized.
+  if (channelContentType.startsWith('email/') && typeof sanitizedHtml === 'string') {
     return (
       <section
         className="rounded-md border bg-card p-4 text-sm"
@@ -37,7 +38,7 @@ export default function ChannelPayloadRendererWidget({
           'Channel payload — email',
         )}
       >
-        <div dangerouslySetInnerHTML={{ __html: sanitized }} />
+        <div dangerouslySetInnerHTML={{ __html: sanitizedHtml }} />
       </section>
     )
   }

package/src/modules/communication_channels/widgets/injection/channel-payload-renderer/widget.ts

@@ -6,8 +6,11 @@ import ChannelPayloadRendererWidget from './widget.client'
  * (Slack Block Kit, WhatsApp interactive, email MIME, etc.) below the body in the
  * messages detail page (`detail:messages:message:body:after`).
  *
- * For `email/*` content types, HTML is sanitized via `sanitizeChannelHtml` before
- * being passed to `dangerouslySetInnerHTML` — see SPEC-045d §4.6.
+ * For `email/*` content types, HTML is sanitized server-side by the
+ * channel-payload enricher (`data/enrichers.ts`, via `sanitizeChannelHtml`) and
+ * delivered as `_channelPayload.sanitizedHtml`, which this widget renders with
+ * `dangerouslySetInnerHTML` — keeping `sanitize-html` off the client bundle.
+ * See SPEC-045d §4.6.
  *
  * Provider packages override this via UMES component replacement (handle
  * `widget:communication_channels.injection.channel-payload-renderer`) to render

package/src/modules/customers/api/pipeline-stages/reorder/route.ts

@@ -8,8 +8,14 @@ import { pipelineStageReorderSchema, type PipelineStageReorderInput } from '../.
 import { withScopedPayload } from '../../utils'
 import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard,
+} from '@open-mercato/shared/lib/crud/mutation-guard'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 
+const PIPELINE_STAGE_RESOURCE_KIND = 'customers.pipelineStage'
+
 export const metadata = {
   POST: { requireAuth: true, requireFeatures: ['customers.pipelines.manage'] },
 }
@@ -29,15 +35,49 @@ export async function POST(req: Request) {
       organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
       request: req,
     }
+    const organizationId = scope?.selectedId ?? auth.orgId ?? null
+    const tenantId = auth.tenantId ?? null
+    if (!organizationId || !tenantId) {
+      return NextResponse.json({ error: translate('customers.errors.context_required', 'Organization and tenant context required') }, { status: 400 })
+    }
 
     const body = await req.json().catch(() => ({}))
     const scoped = withScopedPayload(body, ctx, translate)
+    const input = pipelineStageReorderSchema.parse(scoped)
+
+    const guardResult = await validateCrudMutationGuard(ctx.container, {
+      tenantId,
+      organizationId,
+      userId: auth.sub,
+      resourceKind: PIPELINE_STAGE_RESOURCE_KIND,
+      resourceId: organizationId,
+      operation: 'custom',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: input,
+    })
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status })
+    }
 
     const commandBus = (ctx.container.resolve('commandBus') as CommandBus)
     await commandBus.execute<PipelineStageReorderInput, void>(
       'customers.pipeline-stages.reorder',
-      { input: pipelineStageReorderSchema.parse(scoped), ctx },
+      { input, ctx },
     )
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(ctx.container, {
+        tenantId,
+        organizationId,
+        userId: auth.sub,
+        resourceKind: PIPELINE_STAGE_RESOURCE_KIND,
+        resourceId: organizationId,
+        operation: 'custom',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null,
+      })
+    }
     return NextResponse.json({ ok: true })
   } catch (err) {
     if (isCrudHttpError(err)) {

package/src/modules/customers/api/pipeline-stages/route.ts

@@ -18,8 +18,14 @@ import { withScopedPayload } from '../utils'
 import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard,
+} from '@open-mercato/shared/lib/crud/mutation-guard'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 
+const PIPELINE_STAGE_RESOURCE_KIND = 'customers.pipelineStage'
+
 export const metadata = {
   GET: { requireAuth: true, requireFeatures: ['customers.pipelines.view'] },
   POST: { requireAuth: true, requireFeatures: ['customers.pipelines.manage'] },
@@ -29,7 +35,7 @@ export const metadata = {
 
 async function buildContext(
   req: Request
-): Promise<{ ctx: CommandRuntimeContext; organizationId: string | null; tenantId: string | null }> {
+): Promise<{ ctx: CommandRuntimeContext; organizationId: string | null; tenantId: string | null; translate: (key: string, fallback?: string) => string }> {
   const container = await createRequestContainer()
   const auth = await getAuthFromRequest(req)
   const { translate } = await resolveTranslations()
@@ -45,14 +51,14 @@ async function buildContext(
   }
   const organizationId = scope?.selectedId ?? auth.orgId ?? null
   const tenantId = auth.tenantId ?? null
-  return { ctx, organizationId, tenantId }
+  return { ctx, organizationId, tenantId, translate }
 }
 
 export async function GET(req: Request) {
   try {
-    const { ctx, organizationId, tenantId } = await buildContext(req)
+    const { ctx, organizationId, tenantId, translate } = await buildContext(req)
     if (!organizationId || !tenantId) {
-      return NextResponse.json({ error: 'Organization and tenant context required' }, { status: 400 })
+      return NextResponse.json({ error: translate('customers.errors.context_required', 'Organization and tenant context required') }, { status: 400 })
     }
     const url = new URL(req.url)
     const pipelineId = url.searchParams.get('pipelineId')
@@ -102,16 +108,47 @@ export async function GET(req: Request) {
 
 export async function POST(req: Request) {
   try {
-    const { ctx } = await buildContext(req)
+    const { ctx, organizationId, tenantId, translate } = await buildContext(req)
+    if (!organizationId || !tenantId) {
+      return NextResponse.json({ error: translate('customers.errors.context_required', 'Organization and tenant context required') }, { status: 400 })
+    }
     const body = await req.json().catch(() => ({}))
-    const { translate } = await resolveTranslations()
     const scoped = withScopedPayload(body, ctx, translate)
+    const input = pipelineStageCreateSchema.parse(scoped)
+
+    const guardResult = await validateCrudMutationGuard(ctx.container, {
+      tenantId,
+      organizationId,
+      userId: ctx.auth!.sub,
+      resourceKind: PIPELINE_STAGE_RESOURCE_KIND,
+      resourceId: organizationId,
+      operation: 'create',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: input,
+    })
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status })
+    }
 
     const commandBus = (ctx.container.resolve('commandBus') as CommandBus)
     const { result, logEntry } = await commandBus.execute<PipelineStageCreateInput, { stageId: string }>(
       'customers.pipeline-stages.create',
-      { input: pipelineStageCreateSchema.parse(scoped), ctx },
+      { input, ctx },
     )
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(ctx.container, {
+        tenantId,
+        organizationId,
+        userId: ctx.auth!.sub,
+        resourceKind: PIPELINE_STAGE_RESOURCE_KIND,
+        resourceId: result?.stageId ?? organizationId,
+        operation: 'create',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null,
+      })
+    }
     const response = NextResponse.json({ id: result?.stageId ?? null }, { status: 201 })
     if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {
       response.headers.set(
@@ -139,16 +176,47 @@ export async function POST(req: Request) {
 
 export async function PUT(req: Request) {
   try {
-    const { ctx } = await buildContext(req)
+    const { ctx, organizationId, tenantId, translate } = await buildContext(req)
+    if (!organizationId || !tenantId) {
+      return NextResponse.json({ error: translate('customers.errors.context_required', 'Organization and tenant context required') }, { status: 400 })
+    }
     const body = await req.json().catch(() => ({}))
-    const { translate } = await resolveTranslations()
     const scoped = withScopedPayload(body, ctx, translate)
+    const input = pipelineStageUpdateSchema.parse(scoped)
+
+    const guardResult = await validateCrudMutationGuard(ctx.container, {
+      tenantId,
+      organizationId,
+      userId: ctx.auth!.sub,
+      resourceKind: PIPELINE_STAGE_RESOURCE_KIND,
+      resourceId: input.id,
+      operation: 'update',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: input,
+    })
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status })
+    }
 
     const commandBus = (ctx.container.resolve('commandBus') as CommandBus)
     const { logEntry } = await commandBus.execute<PipelineStageUpdateInput, void>(
       'customers.pipeline-stages.update',
-      { input: pipelineStageUpdateSchema.parse(scoped), ctx },
+      { input, ctx },
     )
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(ctx.container, {
+        tenantId,
+        organizationId,
+        userId: ctx.auth!.sub,
+        resourceKind: PIPELINE_STAGE_RESOURCE_KIND,
+        resourceId: input.id,
+        operation: 'update',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null,
+      })
+    }
     const response = NextResponse.json({ ok: true })
     if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {
       response.headers.set(
@@ -176,16 +244,47 @@ export async function PUT(req: Request) {
 
 export async function DELETE(req: Request) {
   try {
-    const { ctx } = await buildContext(req)
+    const { ctx, organizationId, tenantId, translate } = await buildContext(req)
+    if (!organizationId || !tenantId) {
+      return NextResponse.json({ error: translate('customers.errors.context_required', 'Organization and tenant context required') }, { status: 400 })
+    }
     const body = await req.json().catch(() => ({}))
-    const { translate } = await resolveTranslations()
     const scoped = withScopedPayload(body, ctx, translate)
+    const input = pipelineStageDeleteSchema.parse(scoped)
+
+    const guardResult = await validateCrudMutationGuard(ctx.container, {
+      tenantId,
+      organizationId,
+      userId: ctx.auth!.sub,
+      resourceKind: PIPELINE_STAGE_RESOURCE_KIND,
+      resourceId: input.id,
+      operation: 'delete',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: input,
+    })
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status })
+    }
 
     const commandBus = (ctx.container.resolve('commandBus') as CommandBus)
     await commandBus.execute<PipelineStageDeleteInput, void>(
       'customers.pipeline-stages.delete',
-      { input: pipelineStageDeleteSchema.parse(scoped), ctx },
+      { input, ctx },
     )
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(ctx.container, {
+        tenantId,
+        organizationId,
+        userId: ctx.auth!.sub,
+        resourceKind: PIPELINE_STAGE_RESOURCE_KIND,
+        resourceId: input.id,
+        operation: 'delete',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null,
+      })
+    }
     return NextResponse.json({ ok: true })
   } catch (err) {
     if (isCrudHttpError(err)) {

package/src/modules/customers/api/pipelines/route.ts

@@ -18,8 +18,14 @@ import { withScopedPayload } from '../utils'
 import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard,
+} from '@open-mercato/shared/lib/crud/mutation-guard'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 
+const PIPELINE_RESOURCE_KIND = 'customers.pipeline'
+
 export const metadata = {
   GET: { requireAuth: true, requireFeatures: ['customers.pipelines.view'] },
   POST: { requireAuth: true, requireFeatures: ['customers.pipelines.manage'] },
@@ -29,7 +35,7 @@ export const metadata = {
 
 async function buildContext(
   req: Request
-): Promise<{ ctx: CommandRuntimeContext; organizationId: string | null; tenantId: string | null }> {
+): Promise<{ ctx: CommandRuntimeContext; organizationId: string | null; tenantId: string | null; translate: (key: string, fallback?: string) => string }> {
   const container = await createRequestContainer()
   const auth = await getAuthFromRequest(req)
   const { translate } = await resolveTranslations()
@@ -45,14 +51,14 @@ async function buildContext(
   }
   const organizationId = scope?.selectedId ?? auth.orgId ?? null
   const tenantId = auth.tenantId ?? null
-  return { ctx, organizationId, tenantId }
+  return { ctx, organizationId, tenantId, translate }
 }
 
 export async function GET(req: Request) {
   try {
-    const { ctx, organizationId, tenantId } = await buildContext(req)
+    const { ctx, organizationId, tenantId, translate } = await buildContext(req)
     if (!organizationId || !tenantId) {
-      return NextResponse.json({ error: 'Organization and tenant context required' }, { status: 400 })
+      return NextResponse.json({ error: translate('customers.errors.context_required', 'Organization and tenant context required') }, { status: 400 })
     }
     const url = new URL(req.url)
     const isDefaultParam = url.searchParams.get('isDefault')
@@ -84,16 +90,47 @@ export async function GET(req: Request) {
 
 export async function POST(req: Request) {
   try {
-    const { ctx } = await buildContext(req)
+    const { ctx, organizationId, tenantId, translate } = await buildContext(req)
+    if (!organizationId || !tenantId) {
+      return NextResponse.json({ error: translate('customers.errors.context_required', 'Organization and tenant context required') }, { status: 400 })
+    }
     const body = await req.json().catch(() => ({}))
-    const { translate } = await resolveTranslations()
     const scoped = withScopedPayload(body, ctx, translate)
+    const input = pipelineCreateSchema.parse(scoped)
+
+    const guardResult = await validateCrudMutationGuard(ctx.container, {
+      tenantId,
+      organizationId,
+      userId: ctx.auth!.sub,
+      resourceKind: PIPELINE_RESOURCE_KIND,
+      resourceId: organizationId,
+      operation: 'create',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: input,
+    })
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status })
+    }
 
     const commandBus = (ctx.container.resolve('commandBus') as CommandBus)
     const { result, logEntry } = await commandBus.execute<PipelineCreateInput, { pipelineId: string }>(
       'customers.pipelines.create',
-      { input: pipelineCreateSchema.parse(scoped), ctx },
+      { input, ctx },
     )
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(ctx.container, {
+        tenantId,
+        organizationId,
+        userId: ctx.auth!.sub,
+        resourceKind: PIPELINE_RESOURCE_KIND,
+        resourceId: result?.pipelineId ?? organizationId,
+        operation: 'create',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null,
+      })
+    }
     const response = NextResponse.json({ id: result?.pipelineId ?? null }, { status: 201 })
     if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {
       response.headers.set(
@@ -121,16 +158,47 @@ export async function POST(req: Request) {
 
 export async function PUT(req: Request) {
   try {
-    const { ctx } = await buildContext(req)
+    const { ctx, organizationId, tenantId, translate } = await buildContext(req)
+    if (!organizationId || !tenantId) {
+      return NextResponse.json({ error: translate('customers.errors.context_required', 'Organization and tenant context required') }, { status: 400 })
+    }
     const body = await req.json().catch(() => ({}))
-    const { translate } = await resolveTranslations()
     const scoped = withScopedPayload(body, ctx, translate)
+    const input = pipelineUpdateSchema.parse(scoped)
+
+    const guardResult = await validateCrudMutationGuard(ctx.container, {
+      tenantId,
+      organizationId,
+      userId: ctx.auth!.sub,
+      resourceKind: PIPELINE_RESOURCE_KIND,
+      resourceId: input.id,
+      operation: 'update',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: input,
+    })
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status })
+    }
 
     const commandBus = (ctx.container.resolve('commandBus') as CommandBus)
     const { logEntry } = await commandBus.execute<PipelineUpdateInput, void>(
       'customers.pipelines.update',
-      { input: pipelineUpdateSchema.parse(scoped), ctx },
+      { input, ctx },
     )
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(ctx.container, {
+        tenantId,
+        organizationId,
+        userId: ctx.auth!.sub,
+        resourceKind: PIPELINE_RESOURCE_KIND,
+        resourceId: input.id,
+        operation: 'update',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null,
+      })
+    }
     const response = NextResponse.json({ ok: true })
     if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {
       response.headers.set(
@@ -158,16 +226,47 @@ export async function PUT(req: Request) {
 
 export async function DELETE(req: Request) {
   try {
-    const { ctx } = await buildContext(req)
+    const { ctx, organizationId, tenantId, translate } = await buildContext(req)
+    if (!organizationId || !tenantId) {
+      return NextResponse.json({ error: translate('customers.errors.context_required', 'Organization and tenant context required') }, { status: 400 })
+    }
     const body = await req.json().catch(() => ({}))
-    const { translate } = await resolveTranslations()
     const scoped = withScopedPayload(body, ctx, translate)
+    const input = pipelineDeleteSchema.parse(scoped)
+
+    const guardResult = await validateCrudMutationGuard(ctx.container, {
+      tenantId,
+      organizationId,
+      userId: ctx.auth!.sub,
+      resourceKind: PIPELINE_RESOURCE_KIND,
+      resourceId: input.id,
+      operation: 'delete',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: input,
+    })
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status })
+    }
 
     const commandBus = (ctx.container.resolve('commandBus') as CommandBus)
     await commandBus.execute<PipelineDeleteInput, void>(
       'customers.pipelines.delete',
-      { input: pipelineDeleteSchema.parse(scoped), ctx },
+      { input, ctx },
     )
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(ctx.container, {
+        tenantId,
+        organizationId,
+        userId: ctx.auth!.sub,
+        resourceKind: PIPELINE_RESOURCE_KIND,
+        resourceId: input.id,
+        operation: 'delete',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null,
+      })
+    }
     return NextResponse.json({ ok: true })
   } catch (err) {
     if (isCrudHttpError(err)) {

package/src/modules/customers/api/settings/address-format/route.ts

@@ -7,12 +7,18 @@ import type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard,
+} from '@open-mercato/shared/lib/crud/mutation-guard'
 import { customerSettingsUpsertSchema, type CustomerSettingsUpsertInput } from '../../../data/validators'
 import { loadCustomerSettings } from '../../../commands/settings'
 import type { CustomerAddressFormat } from '../../../data/entities'
 import { withScopedPayload } from '../../utils'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 
+const SETTINGS_RESOURCE_KIND = 'customers.settings'
+
 export const metadata = {
   GET: { requireAuth: true, requireFeatures: ['customers.settings.manage'] },
   PUT: { requireAuth: true, requireFeatures: ['customers.settings.manage'] },
@@ -78,17 +84,46 @@ export async function GET(req: Request) {
 
 export async function PUT(req: Request) {
   try {
-    const { ctx, translate } = await resolveSettingsContext(req)
+    const { ctx, tenantId, organizationId, translate } = await resolveSettingsContext(req)
     const payload = await req.json().catch(() => ({}))
     const scoped = withScopedPayload(payload, ctx, translate)
     const input = customerSettingsUpsertSchema.parse(scoped)
 
+    const guardResult = await validateCrudMutationGuard(ctx.container, {
+      tenantId,
+      organizationId,
+      userId: ctx.auth!.sub,
+      resourceKind: SETTINGS_RESOURCE_KIND,
+      resourceId: organizationId,
+      operation: 'update',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: input,
+    })
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status })
+    }
+
     const commandBus = (ctx.container.resolve('commandBus') as CommandBus)
     const { result } = await commandBus.execute<CustomerSettingsUpsertInput, { settingsId: string; addressFormat: CustomerAddressFormat }>(
       'customers.settings.save',
       { input, ctx },
     )
 
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(ctx.container, {
+        tenantId,
+        organizationId,
+        userId: ctx.auth!.sub,
+        resourceKind: SETTINGS_RESOURCE_KIND,
+        resourceId: organizationId,
+        operation: 'update',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null,
+      })
+    }
+
     return NextResponse.json({
       addressFormat: result?.addressFormat ?? input.addressFormat,
     })

package/src/modules/customers/api/tags/assign/route.ts

@@ -9,8 +9,14 @@ import { tagAssignmentSchema, type TagAssignmentInput } from '../../../data/vali
 import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { withScopedPayload } from '../../utils'
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard,
+} from '@open-mercato/shared/lib/crud/mutation-guard'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 
+const TAG_ASSIGNMENT_RESOURCE_KIND = 'customers.tagAssignment'
+
 export const metadata = {
   POST: { requireAuth: true, requireFeatures: ['customers.activities.manage'] },
 }
@@ -37,15 +43,48 @@ async function buildContext(
 export async function POST(req: Request) {
   try {
     const { ctx, auth, translate } = await buildContext(req)
+    const tenantId = auth!.tenantId
+    const organizationId = ctx.selectedOrganizationId
+    if (!tenantId || !organizationId) {
+      return NextResponse.json({ error: translate('customers.errors.context_required', 'Organization and tenant context required') }, { status: 400 })
+    }
     const body = await req.json().catch(() => ({}))
     const scoped = withScopedPayload(body, ctx, translate)
     const input = tagAssignmentSchema.parse(scoped)
 
+    const guardResult = await validateCrudMutationGuard(ctx.container, {
+      tenantId,
+      organizationId,
+      userId: auth!.sub,
+      resourceKind: TAG_ASSIGNMENT_RESOURCE_KIND,
+      resourceId: input.entityId,
+      operation: 'custom',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: input,
+    })
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status })
+    }
+
     const commandBus = (ctx.container.resolve('commandBus') as CommandBus)
     const { result, logEntry } = await commandBus.execute<TagAssignmentInput, { assignmentId: string }>(
     'customers.tags.assign',
     { input, ctx },
   )
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(ctx.container, {
+        tenantId,
+        organizationId,
+        userId: auth!.sub,
+        resourceKind: TAG_ASSIGNMENT_RESOURCE_KIND,
+        resourceId: input.entityId,
+        operation: 'custom',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null,
+      })
+    }
     const response = NextResponse.json({ id: result?.assignmentId ?? null }, { status: 201 })
     if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {
       response.headers.set(