@open-mercato/core 0.6.6-develop.6229.1.ebe6706732 → 0.6.6-develop.6245.1.2be3b151f8

package/dist/modules/customers/components/calendar/UpcomingCards.js

@@ -1,7 +1,6 @@
 "use client";
 import { jsx, jsxs } from "react/jsx-runtime";
 import { differenceInCalendarDays } from "date-fns/differenceInCalendarDays";
-import { format } from "date-fns/format";
 import { AlertTriangle, ChevronDown, Clock } from "lucide-react";
 import { Button } from "@open-mercato/ui/primitives/button";
 import { IconButton } from "@open-mercato/ui/primitives/icon-button";
@@ -12,10 +11,11 @@ import {
   PopoverContent,
   PopoverTrigger
 } from "@open-mercato/ui/primitives/popover";
-import { useT } from "@open-mercato/shared/lib/i18n/context";
-function formatTimeRange(item, allDayLabel) {
+import { useLocale, useT } from "@open-mercato/shared/lib/i18n/context";
+import { formatDateLabel, formatTimeRangeLabel } from "../../lib/calendar/format.js";
+function formatTimeRange(locale, item, allDayLabel) {
   if (item.allDay) return allDayLabel;
-  return `${format(item.start, "h:mm a")} \u2013 ${format(item.end, "h:mm a")}`;
+  return formatTimeRangeLabel(locale, item.start, item.end);
 }
 function canJoin(item) {
   return item.locationKind === "url" || item.locationKind === "platform";
@@ -26,6 +26,7 @@ function UpcomingCardStatus({
   onSeeConflict
 }) {
   const t = useT();
+  const locale = useLocale();
   const { item, kind, conflictCount } = card;
   if (kind === "today") {
     return /* @__PURE__ */ jsxs("div", { className: "flex w-full items-center gap-1.5 rounded-lg bg-status-success-bg py-2 pl-2 pr-3", children: [
@@ -67,14 +68,14 @@ function UpcomingCardStatus({
     return /* @__PURE__ */ jsxs("div", { className: "flex w-full items-center gap-1.5 rounded-lg bg-status-error-bg py-2 pl-2 pr-3", children: [
       /* @__PURE__ */ jsx(Clock, { className: "size-4 shrink-0 text-status-error-icon", "aria-hidden": "true" }),
       /* @__PURE__ */ jsx("span", { className: "min-w-0 flex-1 truncate text-xs font-medium text-foreground", children: t("customers.calendar.cards.cancelled", "Cancelled") }),
-      /* @__PURE__ */ jsx("span", { className: "shrink-0 text-xs text-muted-foreground", children: format(item.start, "MMM dd, yyyy") })
+      /* @__PURE__ */ jsx("span", { className: "shrink-0 text-xs text-muted-foreground", children: formatDateLabel(locale, item.start) })
     ] });
   }
   const daysLater = Math.max(0, differenceInCalendarDays(item.start, /* @__PURE__ */ new Date()));
   return /* @__PURE__ */ jsxs("div", { className: "flex w-full items-center gap-1.5 rounded-lg bg-muted py-2 pl-2 pr-3", children: [
     /* @__PURE__ */ jsx(Clock, { className: "size-4 shrink-0 text-muted-foreground", "aria-hidden": "true" }),
     /* @__PURE__ */ jsx("span", { className: "min-w-0 flex-1 truncate text-xs text-muted-foreground", children: daysLater === 1 ? t("customers.calendar.cards.dayLater", "1 day later") : t("customers.calendar.cards.daysLater", "{days} days later", { days: daysLater }) }),
-    /* @__PURE__ */ jsx("span", { className: "shrink-0 text-xs text-muted-foreground", children: format(item.start, "MMM dd, yyyy") })
+    /* @__PURE__ */ jsx("span", { className: "shrink-0 text-xs text-muted-foreground", children: formatDateLabel(locale, item.start) })
   ] });
 }
 function UpcomingCardItem({
@@ -87,12 +88,13 @@ function UpcomingCardItem({
   onCancel
 }) {
   const t = useT();
+  const locale = useLocale();
   const { item } = card;
   return /* @__PURE__ */ jsxs("article", { className: "flex w-[260px] shrink-0 snap-start flex-col gap-3 rounded-xl border bg-card px-2 pb-2 pt-4 shadow-xs sm:w-auto sm:shrink", children: [
     /* @__PURE__ */ jsxs("div", { className: "flex items-start gap-2 px-2", children: [
       /* @__PURE__ */ jsxs("div", { className: "flex min-w-0 flex-1 flex-col gap-1", children: [
         /* @__PURE__ */ jsx("p", { className: "truncate text-sm font-medium text-foreground", children: item.title }),
-        /* @__PURE__ */ jsx("p", { className: "truncate text-xs text-muted-foreground", children: formatTimeRange(item, t("customers.calendar.cards.allDay", "All day")) })
+        /* @__PURE__ */ jsx("p", { className: "truncate text-xs text-muted-foreground", children: formatTimeRange(locale, item, t("customers.calendar.cards.allDay", "All day")) })
       ] }),
       /* @__PURE__ */ jsxs(Popover, { children: [
         /* @__PURE__ */ jsx(PopoverTrigger, { asChild: true, children: /* @__PURE__ */ jsx(

package/dist/modules/customers/components/calendar/UpcomingCards.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/customers/components/calendar/UpcomingCards.tsx"],
-  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport { differenceInCalendarDays } from 'date-fns/differenceInCalendarDays'\nimport { format } from 'date-fns/format'\nimport { AlertTriangle, ChevronDown, Clock } from 'lucide-react'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { IconButton } from '@open-mercato/ui/primitives/icon-button'\nimport { LinkButton } from '@open-mercato/ui/primitives/link-button'\nimport {\n  Popover,\n  PopoverClose,\n  PopoverContent,\n  PopoverTrigger,\n} from '@open-mercato/ui/primitives/popover'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport type { CalendarItem, UpcomingCard, UpcomingCardsProps } from './types'\n\nfunction formatTimeRange(item: CalendarItem, allDayLabel: string): string {\n  if (item.allDay) return allDayLabel\n  return `${format(item.start, 'h:mm a')} \u2013 ${format(item.end, 'h:mm a')}`\n}\n\nfunction canJoin(item: CalendarItem): boolean {\n  return item.locationKind === 'url' || item.locationKind === 'platform'\n}\n\ntype CardCallbacks = Pick<UpcomingCardsProps, 'canManage' | 'onJoin' | 'onSeeConflict' | 'onOpen' | 'onEdit' | 'onCancel'>\n\nfunction UpcomingCardStatus({\n  card,\n  onJoin,\n  onSeeConflict,\n}: {\n  card: UpcomingCard\n  onJoin: UpcomingCardsProps['onJoin']\n  onSeeConflict: UpcomingCardsProps['onSeeConflict']\n}) {\n  const t = useT()\n  const { item, kind, conflictCount } = card\n\n  if (kind === 'today') {\n    return (\n      <div className=\"flex w-full items-center gap-1.5 rounded-lg bg-status-success-bg py-2 pl-2 pr-3\">\n        <Clock className=\"size-4 shrink-0 text-status-success-icon\" aria-hidden=\"true\" />\n        <span className=\"min-w-0 flex-1 truncate text-xs font-medium text-foreground\">\n          {t('customers.calendar.cards.today', 'Today')}\n        </span>\n        {canJoin(item) ? (\n          <LinkButton\n            variant=\"gray\"\n            size=\"sm\"\n            underline=\"always\"\n            onClick={() => onJoin(item)}\n            className=\"shrink-0\"\n          >\n            {t('customers.calendar.cards.join', 'Join Meeting')}\n          </LinkButton>\n        ) : null}\n      </div>\n    )\n  }\n\n  if (kind === 'conflicted') {\n    return (\n      <div className=\"flex w-full items-center gap-1.5 rounded-lg bg-status-warning-bg py-2 pl-2 pr-3\">\n        <AlertTriangle className=\"size-4 shrink-0 text-status-warning-icon\" aria-hidden=\"true\" />\n        <span className=\"min-w-0 flex-1 truncate text-xs font-medium text-foreground\">\n          {t('customers.calendar.cards.conflictedCount', '{count} Conflicted', {\n            count: conflictCount,\n          })}\n        </span>\n        <LinkButton\n          variant=\"gray\"\n          size=\"sm\"\n          underline=\"always\"\n          onClick={() => onSeeConflict(item)}\n          className=\"shrink-0\"\n        >\n          {t('customers.calendar.cards.seeConflict', 'See Conflict')}\n        </LinkButton>\n      </div>\n    )\n  }\n\n  if (kind === 'cancelled') {\n    return (\n      <div className=\"flex w-full items-center gap-1.5 rounded-lg bg-status-error-bg py-2 pl-2 pr-3\">\n        <Clock className=\"size-4 shrink-0 text-status-error-icon\" aria-hidden=\"true\" />\n        <span className=\"min-w-0 flex-1 truncate text-xs font-medium text-foreground\">\n          {t('customers.calendar.cards.cancelled', 'Cancelled')}\n        </span>\n        <span className=\"shrink-0 text-xs text-muted-foreground\">\n          {format(item.start, 'MMM dd, yyyy')}\n        </span>\n      </div>\n    )\n  }\n\n  const daysLater = Math.max(0, differenceInCalendarDays(item.start, new Date()))\n  return (\n    <div className=\"flex w-full items-center gap-1.5 rounded-lg bg-muted py-2 pl-2 pr-3\">\n      <Clock className=\"size-4 shrink-0 text-muted-foreground\" aria-hidden=\"true\" />\n      <span className=\"min-w-0 flex-1 truncate text-xs text-muted-foreground\">\n        {daysLater === 1\n          ? t('customers.calendar.cards.dayLater', '1 day later')\n          : t('customers.calendar.cards.daysLater', '{days} days later', { days: daysLater })}\n      </span>\n      <span className=\"shrink-0 text-xs text-muted-foreground\">\n        {format(item.start, 'MMM dd, yyyy')}\n      </span>\n    </div>\n  )\n}\n\nfunction UpcomingCardItem({\n  card,\n  canManage,\n  onJoin,\n  onSeeConflict,\n  onOpen,\n  onEdit,\n  onCancel,\n}: { card: UpcomingCard } & CardCallbacks) {\n  const t = useT()\n  const { item } = card\n\n  return (\n    <article className=\"flex w-[260px] shrink-0 snap-start flex-col gap-3 rounded-xl border bg-card px-2 pb-2 pt-4 shadow-xs sm:w-auto sm:shrink\">\n      <div className=\"flex items-start gap-2 px-2\">\n        <div className=\"flex min-w-0 flex-1 flex-col gap-1\">\n          <p className=\"truncate text-sm font-medium text-foreground\">{item.title}</p>\n          <p className=\"truncate text-xs text-muted-foreground\">\n            {formatTimeRange(item, t('customers.calendar.cards.allDay', 'All day'))}\n          </p>\n        </div>\n        <Popover>\n          <PopoverTrigger asChild>\n            <IconButton\n              variant=\"outline\"\n              size=\"xs\"\n              fullRadius\n              aria-label={t('customers.calendar.cards.menu.label', 'Event actions')}\n            >\n              <ChevronDown aria-hidden=\"true\" />\n            </IconButton>\n          </PopoverTrigger>\n          <PopoverContent align=\"end\" className=\"w-40 min-w-0 p-1\">\n            <PopoverClose asChild>\n              <Button\n                type=\"button\"\n                variant=\"ghost\"\n                size=\"sm\"\n                className=\"w-full justify-start\"\n                onClick={() => onOpen(item)}\n              >\n                {t('customers.calendar.cards.menu.open', 'Open')}\n              </Button>\n            </PopoverClose>\n            {canManage ? (\n              <PopoverClose asChild>\n                <Button\n                  type=\"button\"\n                  variant=\"ghost\"\n                  size=\"sm\"\n                  className=\"w-full justify-start\"\n                  onClick={() => onEdit(item)}\n                >\n                  {t('customers.calendar.cards.menu.edit', 'Edit')}\n                </Button>\n              </PopoverClose>\n            ) : null}\n            {canManage ? (\n              <PopoverClose asChild>\n                <Button\n                  type=\"button\"\n                  variant=\"destructive-ghost\"\n                  size=\"sm\"\n                  className=\"w-full justify-start\"\n                  onClick={() => onCancel(item)}\n                >\n                  {t('customers.calendar.cards.menu.cancel', 'Cancel')}\n                </Button>\n              </PopoverClose>\n            ) : null}\n          </PopoverContent>\n        </Popover>\n      </div>\n      <UpcomingCardStatus card={card} onJoin={onJoin} onSeeConflict={onSeeConflict} />\n    </article>\n  )\n}\n\nexport function UpcomingCards({\n  cards,\n  canManage = true,\n  onJoin,\n  onSeeConflict,\n  onOpen,\n  onEdit,\n  onCancel,\n}: UpcomingCardsProps) {\n  if (cards.length === 0) return null\n  return (\n    <div className=\"flex snap-x snap-mandatory gap-3 overflow-x-auto pb-1 sm:grid sm:snap-none sm:grid-cols-2 sm:gap-4 sm:overflow-visible sm:pb-0 xl:grid-cols-4\">\n      {cards.map((card) => (\n        <UpcomingCardItem\n          key={card.item.id}\n          card={card}\n          canManage={canManage}\n          onJoin={onJoin}\n          onSeeConflict={onSeeConflict}\n          onOpen={onOpen}\n          onEdit={onEdit}\n          onCancel={onCancel}\n        />\n      ))}\n    </div>\n  )\n}\n"],
-  "mappings": ";AA2CM,SACE,KADF;AAxCN,SAAS,gCAAgC;AACzC,SAAS,cAAc;AACvB,SAAS,eAAe,aAAa,aAAa;AAClD,SAAS,cAAc;AACvB,SAAS,kBAAkB;AAC3B,SAAS,kBAAkB;AAC3B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,YAAY;AAGrB,SAAS,gBAAgB,MAAoB,aAA6B;AACxE,MAAI,KAAK,OAAQ,QAAO;AACxB,SAAO,GAAG,OAAO,KAAK,OAAO,QAAQ,CAAC,WAAM,OAAO,KAAK,KAAK,QAAQ,CAAC;AACxE;AAEA,SAAS,QAAQ,MAA6B;AAC5C,SAAO,KAAK,iBAAiB,SAAS,KAAK,iBAAiB;AAC9D;AAIA,SAAS,mBAAmB;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AACF,GAIG;AACD,QAAM,IAAI,KAAK;AACf,QAAM,EAAE,MAAM,MAAM,cAAc,IAAI;AAEtC,MAAI,SAAS,SAAS;AACpB,WACE,qBAAC,SAAI,WAAU,mFACb;AAAA,0BAAC,SAAM,WAAU,4CAA2C,eAAY,QAAO;AAAA,MAC/E,oBAAC,UAAK,WAAU,+DACb,YAAE,kCAAkC,OAAO,GAC9C;AAAA,MACC,QAAQ,IAAI,IACX;AAAA,QAAC;AAAA;AAAA,UACC,SAAQ;AAAA,UACR,MAAK;AAAA,UACL,WAAU;AAAA,UACV,SAAS,MAAM,OAAO,IAAI;AAAA,UAC1B,WAAU;AAAA,UAET,YAAE,iCAAiC,cAAc;AAAA;AAAA,MACpD,IACE;AAAA,OACN;AAAA,EAEJ;AAEA,MAAI,SAAS,cAAc;AACzB,WACE,qBAAC,SAAI,WAAU,mFACb;AAAA,0BAAC,iBAAc,WAAU,4CAA2C,eAAY,QAAO;AAAA,MACvF,oBAAC,UAAK,WAAU,+DACb,YAAE,4CAA4C,sBAAsB;AAAA,QACnE,OAAO;AAAA,MACT,CAAC,GACH;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACC,SAAQ;AAAA,UACR,MAAK;AAAA,UACL,WAAU;AAAA,UACV,SAAS,MAAM,cAAc,IAAI;AAAA,UACjC,WAAU;AAAA,UAET,YAAE,wCAAwC,cAAc;AAAA;AAAA,MAC3D;AAAA,OACF;AAAA,EAEJ;AAEA,MAAI,SAAS,aAAa;AACxB,WACE,qBAAC,SAAI,WAAU,iFACb;AAAA,0BAAC,SAAM,WAAU,0CAAyC,eAAY,QAAO;AAAA,MAC7E,oBAAC,UAAK,WAAU,+DACb,YAAE,sCAAsC,WAAW,GACtD;AAAA,MACA,oBAAC,UAAK,WAAU,0CACb,iBAAO,KAAK,OAAO,cAAc,GACpC;AAAA,OACF;AAAA,EAEJ;AAEA,QAAM,YAAY,KAAK,IAAI,GAAG,yBAAyB,KAAK,OAAO,oBAAI,KAAK,CAAC,CAAC;AAC9E,SACE,qBAAC,SAAI,WAAU,uEACb;AAAA,wBAAC,SAAM,WAAU,yCAAwC,eAAY,QAAO;AAAA,IAC5E,oBAAC,UAAK,WAAU,yDACb,wBAAc,IACX,EAAE,qCAAqC,aAAa,IACpD,EAAE,sCAAsC,qBAAqB,EAAE,MAAM,UAAU,CAAC,GACtF;AAAA,IACA,oBAAC,UAAK,WAAU,0CACb,iBAAO,KAAK,OAAO,cAAc,GACpC;AAAA,KACF;AAEJ;AAEA,SAAS,iBAAiB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAA2C;AACzC,QAAM,IAAI,KAAK;AACf,QAAM,EAAE,KAAK,IAAI;AAEjB,SACE,qBAAC,aAAQ,WAAU,4HACjB;AAAA,yBAAC,SAAI,WAAU,+BACb;AAAA,2BAAC,SAAI,WAAU,sCACb;AAAA,4BAAC,OAAE,WAAU,gDAAgD,eAAK,OAAM;AAAA,QACxE,oBAAC,OAAE,WAAU,0CACV,0BAAgB,MAAM,EAAE,mCAAmC,SAAS,CAAC,GACxE;AAAA,SACF;AAAA,MACA,qBAAC,WACC;AAAA,4BAAC,kBAAe,SAAO,MACrB;AAAA,UAAC;AAAA;AAAA,YACC,SAAQ;AAAA,YACR,MAAK;AAAA,YACL,YAAU;AAAA,YACV,cAAY,EAAE,uCAAuC,eAAe;AAAA,YAEpE,8BAAC,eAAY,eAAY,QAAO;AAAA;AAAA,QAClC,GACF;AAAA,QACA,qBAAC,kBAAe,OAAM,OAAM,WAAU,oBACpC;AAAA,8BAAC,gBAAa,SAAO,MACnB;AAAA,YAAC;AAAA;AAAA,cACC,MAAK;AAAA,cACL,SAAQ;AAAA,cACR,MAAK;AAAA,cACL,WAAU;AAAA,cACV,SAAS,MAAM,OAAO,IAAI;AAAA,cAEzB,YAAE,sCAAsC,MAAM;AAAA;AAAA,UACjD,GACF;AAAA,UACC,YACC,oBAAC,gBAAa,SAAO,MACnB;AAAA,YAAC;AAAA;AAAA,cACC,MAAK;AAAA,cACL,SAAQ;AAAA,cACR,MAAK;AAAA,cACL,WAAU;AAAA,cACV,SAAS,MAAM,OAAO,IAAI;AAAA,cAEzB,YAAE,sCAAsC,MAAM;AAAA;AAAA,UACjD,GACF,IACE;AAAA,UACH,YACC,oBAAC,gBAAa,SAAO,MACnB;AAAA,YAAC;AAAA;AAAA,cACC,MAAK;AAAA,cACL,SAAQ;AAAA,cACR,MAAK;AAAA,cACL,WAAU;AAAA,cACV,SAAS,MAAM,SAAS,IAAI;AAAA,cAE3B,YAAE,wCAAwC,QAAQ;AAAA;AAAA,UACrD,GACF,IACE;AAAA,WACN;AAAA,SACF;AAAA,OACF;AAAA,IACA,oBAAC,sBAAmB,MAAY,QAAgB,eAA8B;AAAA,KAChF;AAEJ;AAEO,SAAS,cAAc;AAAA,EAC5B;AAAA,EACA,YAAY;AAAA,EACZ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAAuB;AACrB,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,SACE,oBAAC,SAAI,WAAU,iJACZ,gBAAM,IAAI,CAAC,SACV;AAAA,IAAC;AAAA;AAAA,MAEC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA;AAAA,IAPK,KAAK,KAAK;AAAA,EAQjB,CACD,GACH;AAEJ;",
+  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport { differenceInCalendarDays } from 'date-fns/differenceInCalendarDays'\nimport { AlertTriangle, ChevronDown, Clock } from 'lucide-react'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { IconButton } from '@open-mercato/ui/primitives/icon-button'\nimport { LinkButton } from '@open-mercato/ui/primitives/link-button'\nimport {\n  Popover,\n  PopoverClose,\n  PopoverContent,\n  PopoverTrigger,\n} from '@open-mercato/ui/primitives/popover'\nimport { useLocale, useT } from '@open-mercato/shared/lib/i18n/context'\nimport { formatDateLabel, formatTimeRangeLabel } from '../../lib/calendar/format'\nimport type { CalendarItem, UpcomingCard, UpcomingCardsProps } from './types'\n\nfunction formatTimeRange(locale: string, item: CalendarItem, allDayLabel: string): string {\n  if (item.allDay) return allDayLabel\n  return formatTimeRangeLabel(locale, item.start, item.end)\n}\n\nfunction canJoin(item: CalendarItem): boolean {\n  return item.locationKind === 'url' || item.locationKind === 'platform'\n}\n\ntype CardCallbacks = Pick<UpcomingCardsProps, 'canManage' | 'onJoin' | 'onSeeConflict' | 'onOpen' | 'onEdit' | 'onCancel'>\n\nfunction UpcomingCardStatus({\n  card,\n  onJoin,\n  onSeeConflict,\n}: {\n  card: UpcomingCard\n  onJoin: UpcomingCardsProps['onJoin']\n  onSeeConflict: UpcomingCardsProps['onSeeConflict']\n}) {\n  const t = useT()\n  const locale = useLocale()\n  const { item, kind, conflictCount } = card\n\n  if (kind === 'today') {\n    return (\n      <div className=\"flex w-full items-center gap-1.5 rounded-lg bg-status-success-bg py-2 pl-2 pr-3\">\n        <Clock className=\"size-4 shrink-0 text-status-success-icon\" aria-hidden=\"true\" />\n        <span className=\"min-w-0 flex-1 truncate text-xs font-medium text-foreground\">\n          {t('customers.calendar.cards.today', 'Today')}\n        </span>\n        {canJoin(item) ? (\n          <LinkButton\n            variant=\"gray\"\n            size=\"sm\"\n            underline=\"always\"\n            onClick={() => onJoin(item)}\n            className=\"shrink-0\"\n          >\n            {t('customers.calendar.cards.join', 'Join Meeting')}\n          </LinkButton>\n        ) : null}\n      </div>\n    )\n  }\n\n  if (kind === 'conflicted') {\n    return (\n      <div className=\"flex w-full items-center gap-1.5 rounded-lg bg-status-warning-bg py-2 pl-2 pr-3\">\n        <AlertTriangle className=\"size-4 shrink-0 text-status-warning-icon\" aria-hidden=\"true\" />\n        <span className=\"min-w-0 flex-1 truncate text-xs font-medium text-foreground\">\n          {t('customers.calendar.cards.conflictedCount', '{count} Conflicted', {\n            count: conflictCount,\n          })}\n        </span>\n        <LinkButton\n          variant=\"gray\"\n          size=\"sm\"\n          underline=\"always\"\n          onClick={() => onSeeConflict(item)}\n          className=\"shrink-0\"\n        >\n          {t('customers.calendar.cards.seeConflict', 'See Conflict')}\n        </LinkButton>\n      </div>\n    )\n  }\n\n  if (kind === 'cancelled') {\n    return (\n      <div className=\"flex w-full items-center gap-1.5 rounded-lg bg-status-error-bg py-2 pl-2 pr-3\">\n        <Clock className=\"size-4 shrink-0 text-status-error-icon\" aria-hidden=\"true\" />\n        <span className=\"min-w-0 flex-1 truncate text-xs font-medium text-foreground\">\n          {t('customers.calendar.cards.cancelled', 'Cancelled')}\n        </span>\n        <span className=\"shrink-0 text-xs text-muted-foreground\">\n          {formatDateLabel(locale, item.start)}\n        </span>\n      </div>\n    )\n  }\n\n  const daysLater = Math.max(0, differenceInCalendarDays(item.start, new Date()))\n  return (\n    <div className=\"flex w-full items-center gap-1.5 rounded-lg bg-muted py-2 pl-2 pr-3\">\n      <Clock className=\"size-4 shrink-0 text-muted-foreground\" aria-hidden=\"true\" />\n      <span className=\"min-w-0 flex-1 truncate text-xs text-muted-foreground\">\n        {daysLater === 1\n          ? t('customers.calendar.cards.dayLater', '1 day later')\n          : t('customers.calendar.cards.daysLater', '{days} days later', { days: daysLater })}\n      </span>\n      <span className=\"shrink-0 text-xs text-muted-foreground\">\n        {formatDateLabel(locale, item.start)}\n      </span>\n    </div>\n  )\n}\n\nfunction UpcomingCardItem({\n  card,\n  canManage,\n  onJoin,\n  onSeeConflict,\n  onOpen,\n  onEdit,\n  onCancel,\n}: { card: UpcomingCard } & CardCallbacks) {\n  const t = useT()\n  const locale = useLocale()\n  const { item } = card\n\n  return (\n    <article className=\"flex w-[260px] shrink-0 snap-start flex-col gap-3 rounded-xl border bg-card px-2 pb-2 pt-4 shadow-xs sm:w-auto sm:shrink\">\n      <div className=\"flex items-start gap-2 px-2\">\n        <div className=\"flex min-w-0 flex-1 flex-col gap-1\">\n          <p className=\"truncate text-sm font-medium text-foreground\">{item.title}</p>\n          <p className=\"truncate text-xs text-muted-foreground\">\n            {formatTimeRange(locale, item, t('customers.calendar.cards.allDay', 'All day'))}\n          </p>\n        </div>\n        <Popover>\n          <PopoverTrigger asChild>\n            <IconButton\n              variant=\"outline\"\n              size=\"xs\"\n              fullRadius\n              aria-label={t('customers.calendar.cards.menu.label', 'Event actions')}\n            >\n              <ChevronDown aria-hidden=\"true\" />\n            </IconButton>\n          </PopoverTrigger>\n          <PopoverContent align=\"end\" className=\"w-40 min-w-0 p-1\">\n            <PopoverClose asChild>\n              <Button\n                type=\"button\"\n                variant=\"ghost\"\n                size=\"sm\"\n                className=\"w-full justify-start\"\n                onClick={() => onOpen(item)}\n              >\n                {t('customers.calendar.cards.menu.open', 'Open')}\n              </Button>\n            </PopoverClose>\n            {canManage ? (\n              <PopoverClose asChild>\n                <Button\n                  type=\"button\"\n                  variant=\"ghost\"\n                  size=\"sm\"\n                  className=\"w-full justify-start\"\n                  onClick={() => onEdit(item)}\n                >\n                  {t('customers.calendar.cards.menu.edit', 'Edit')}\n                </Button>\n              </PopoverClose>\n            ) : null}\n            {canManage ? (\n              <PopoverClose asChild>\n                <Button\n                  type=\"button\"\n                  variant=\"destructive-ghost\"\n                  size=\"sm\"\n                  className=\"w-full justify-start\"\n                  onClick={() => onCancel(item)}\n                >\n                  {t('customers.calendar.cards.menu.cancel', 'Cancel')}\n                </Button>\n              </PopoverClose>\n            ) : null}\n          </PopoverContent>\n        </Popover>\n      </div>\n      <UpcomingCardStatus card={card} onJoin={onJoin} onSeeConflict={onSeeConflict} />\n    </article>\n  )\n}\n\nexport function UpcomingCards({\n  cards,\n  canManage = true,\n  onJoin,\n  onSeeConflict,\n  onOpen,\n  onEdit,\n  onCancel,\n}: UpcomingCardsProps) {\n  if (cards.length === 0) return null\n  return (\n    <div className=\"flex snap-x snap-mandatory gap-3 overflow-x-auto pb-1 sm:grid sm:snap-none sm:grid-cols-2 sm:gap-4 sm:overflow-visible sm:pb-0 xl:grid-cols-4\">\n      {cards.map((card) => (\n        <UpcomingCardItem\n          key={card.item.id}\n          card={card}\n          canManage={canManage}\n          onJoin={onJoin}\n          onSeeConflict={onSeeConflict}\n          onOpen={onOpen}\n          onEdit={onEdit}\n          onCancel={onCancel}\n        />\n      ))}\n    </div>\n  )\n}\n"],
+  "mappings": ";AA4CM,SACE,KADF;AAzCN,SAAS,gCAAgC;AACzC,SAAS,eAAe,aAAa,aAAa;AAClD,SAAS,cAAc;AACvB,SAAS,kBAAkB;AAC3B,SAAS,kBAAkB;AAC3B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,WAAW,YAAY;AAChC,SAAS,iBAAiB,4BAA4B;AAGtD,SAAS,gBAAgB,QAAgB,MAAoB,aAA6B;AACxF,MAAI,KAAK,OAAQ,QAAO;AACxB,SAAO,qBAAqB,QAAQ,KAAK,OAAO,KAAK,GAAG;AAC1D;AAEA,SAAS,QAAQ,MAA6B;AAC5C,SAAO,KAAK,iBAAiB,SAAS,KAAK,iBAAiB;AAC9D;AAIA,SAAS,mBAAmB;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AACF,GAIG;AACD,QAAM,IAAI,KAAK;AACf,QAAM,SAAS,UAAU;AACzB,QAAM,EAAE,MAAM,MAAM,cAAc,IAAI;AAEtC,MAAI,SAAS,SAAS;AACpB,WACE,qBAAC,SAAI,WAAU,mFACb;AAAA,0BAAC,SAAM,WAAU,4CAA2C,eAAY,QAAO;AAAA,MAC/E,oBAAC,UAAK,WAAU,+DACb,YAAE,kCAAkC,OAAO,GAC9C;AAAA,MACC,QAAQ,IAAI,IACX;AAAA,QAAC;AAAA;AAAA,UACC,SAAQ;AAAA,UACR,MAAK;AAAA,UACL,WAAU;AAAA,UACV,SAAS,MAAM,OAAO,IAAI;AAAA,UAC1B,WAAU;AAAA,UAET,YAAE,iCAAiC,cAAc;AAAA;AAAA,MACpD,IACE;AAAA,OACN;AAAA,EAEJ;AAEA,MAAI,SAAS,cAAc;AACzB,WACE,qBAAC,SAAI,WAAU,mFACb;AAAA,0BAAC,iBAAc,WAAU,4CAA2C,eAAY,QAAO;AAAA,MACvF,oBAAC,UAAK,WAAU,+DACb,YAAE,4CAA4C,sBAAsB;AAAA,QACnE,OAAO;AAAA,MACT,CAAC,GACH;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACC,SAAQ;AAAA,UACR,MAAK;AAAA,UACL,WAAU;AAAA,UACV,SAAS,MAAM,cAAc,IAAI;AAAA,UACjC,WAAU;AAAA,UAET,YAAE,wCAAwC,cAAc;AAAA;AAAA,MAC3D;AAAA,OACF;AAAA,EAEJ;AAEA,MAAI,SAAS,aAAa;AACxB,WACE,qBAAC,SAAI,WAAU,iFACb;AAAA,0BAAC,SAAM,WAAU,0CAAyC,eAAY,QAAO;AAAA,MAC7E,oBAAC,UAAK,WAAU,+DACb,YAAE,sCAAsC,WAAW,GACtD;AAAA,MACA,oBAAC,UAAK,WAAU,0CACb,0BAAgB,QAAQ,KAAK,KAAK,GACrC;AAAA,OACF;AAAA,EAEJ;AAEA,QAAM,YAAY,KAAK,IAAI,GAAG,yBAAyB,KAAK,OAAO,oBAAI,KAAK,CAAC,CAAC;AAC9E,SACE,qBAAC,SAAI,WAAU,uEACb;AAAA,wBAAC,SAAM,WAAU,yCAAwC,eAAY,QAAO;AAAA,IAC5E,oBAAC,UAAK,WAAU,yDACb,wBAAc,IACX,EAAE,qCAAqC,aAAa,IACpD,EAAE,sCAAsC,qBAAqB,EAAE,MAAM,UAAU,CAAC,GACtF;AAAA,IACA,oBAAC,UAAK,WAAU,0CACb,0BAAgB,QAAQ,KAAK,KAAK,GACrC;AAAA,KACF;AAEJ;AAEA,SAAS,iBAAiB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAA2C;AACzC,QAAM,IAAI,KAAK;AACf,QAAM,SAAS,UAAU;AACzB,QAAM,EAAE,KAAK,IAAI;AAEjB,SACE,qBAAC,aAAQ,WAAU,4HACjB;AAAA,yBAAC,SAAI,WAAU,+BACb;AAAA,2BAAC,SAAI,WAAU,sCACb;AAAA,4BAAC,OAAE,WAAU,gDAAgD,eAAK,OAAM;AAAA,QACxE,oBAAC,OAAE,WAAU,0CACV,0BAAgB,QAAQ,MAAM,EAAE,mCAAmC,SAAS,CAAC,GAChF;AAAA,SACF;AAAA,MACA,qBAAC,WACC;AAAA,4BAAC,kBAAe,SAAO,MACrB;AAAA,UAAC;AAAA;AAAA,YACC,SAAQ;AAAA,YACR,MAAK;AAAA,YACL,YAAU;AAAA,YACV,cAAY,EAAE,uCAAuC,eAAe;AAAA,YAEpE,8BAAC,eAAY,eAAY,QAAO;AAAA;AAAA,QAClC,GACF;AAAA,QACA,qBAAC,kBAAe,OAAM,OAAM,WAAU,oBACpC;AAAA,8BAAC,gBAAa,SAAO,MACnB;AAAA,YAAC;AAAA;AAAA,cACC,MAAK;AAAA,cACL,SAAQ;AAAA,cACR,MAAK;AAAA,cACL,WAAU;AAAA,cACV,SAAS,MAAM,OAAO,IAAI;AAAA,cAEzB,YAAE,sCAAsC,MAAM;AAAA;AAAA,UACjD,GACF;AAAA,UACC,YACC,oBAAC,gBAAa,SAAO,MACnB;AAAA,YAAC;AAAA;AAAA,cACC,MAAK;AAAA,cACL,SAAQ;AAAA,cACR,MAAK;AAAA,cACL,WAAU;AAAA,cACV,SAAS,MAAM,OAAO,IAAI;AAAA,cAEzB,YAAE,sCAAsC,MAAM;AAAA;AAAA,UACjD,GACF,IACE;AAAA,UACH,YACC,oBAAC,gBAAa,SAAO,MACnB;AAAA,YAAC;AAAA;AAAA,cACC,MAAK;AAAA,cACL,SAAQ;AAAA,cACR,MAAK;AAAA,cACL,WAAU;AAAA,cACV,SAAS,MAAM,SAAS,IAAI;AAAA,cAE3B,YAAE,wCAAwC,QAAQ;AAAA;AAAA,UACrD,GACF,IACE;AAAA,WACN;AAAA,SACF;AAAA,OACF;AAAA,IACA,oBAAC,sBAAmB,MAAY,QAAgB,eAA8B;AAAA,KAChF;AAEJ;AAEO,SAAS,cAAc;AAAA,EAC5B;AAAA,EACA,YAAY;AAAA,EACZ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAAuB;AACrB,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,SACE,oBAAC,SAAI,WAAU,iJACZ,gBAAM,IAAI,CAAC,SACV;AAAA,IAAC;AAAA;AAAA,MAEC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA;AAAA,IAPK,KAAK,KAAK;AAAA,EAQjB,CACD,GACH;AAEJ;",
   "names": []
 }

package/dist/modules/customers/lib/calendar/format.js

@@ -0,0 +1,27 @@
+const DATE_OPTIONS = { day: "numeric", month: "short", year: "numeric" };
+const TIME_OPTIONS = { hour: "numeric", minute: "2-digit" };
+function formatDateLabel(locale, date) {
+  return new Intl.DateTimeFormat(locale, DATE_OPTIONS).format(date);
+}
+function formatDateRangeLabel(locale, from, to) {
+  const formatter = new Intl.DateTimeFormat(locale, DATE_OPTIONS);
+  try {
+    return formatter.formatRange(from, to);
+  } catch {
+    return `${formatter.format(from)} \u2013 ${formatter.format(to)}`;
+  }
+}
+function formatTimeRangeLabel(locale, start, end) {
+  const formatter = new Intl.DateTimeFormat(locale, TIME_OPTIONS);
+  try {
+    return formatter.formatRange(start, end);
+  } catch {
+    return `${formatter.format(start)} \u2013 ${formatter.format(end)}`;
+  }
+}
+export {
+  formatDateLabel,
+  formatDateRangeLabel,
+  formatTimeRangeLabel
+};
+//# sourceMappingURL=format.js.map

package/dist/modules/customers/lib/calendar/format.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/customers/lib/calendar/format.ts"],
+  "sourcesContent": ["const DATE_OPTIONS: Intl.DateTimeFormatOptions = { day: 'numeric', month: 'short', year: 'numeric' }\n\nconst TIME_OPTIONS: Intl.DateTimeFormatOptions = { hour: 'numeric', minute: '2-digit' }\n\nexport function formatDateLabel(locale: string, date: Date): string {\n  return new Intl.DateTimeFormat(locale, DATE_OPTIONS).format(date)\n}\n\nexport function formatDateRangeLabel(locale: string, from: Date, to: Date): string {\n  const formatter = new Intl.DateTimeFormat(locale, DATE_OPTIONS)\n  try {\n    return formatter.formatRange(from, to)\n  } catch {\n    return `${formatter.format(from)} \u2013 ${formatter.format(to)}`\n  }\n}\n\nexport function formatTimeRangeLabel(locale: string, start: Date, end: Date): string {\n  const formatter = new Intl.DateTimeFormat(locale, TIME_OPTIONS)\n  try {\n    return formatter.formatRange(start, end)\n  } catch {\n    return `${formatter.format(start)} \u2013 ${formatter.format(end)}`\n  }\n}\n"],
+  "mappings": "AAAA,MAAM,eAA2C,EAAE,KAAK,WAAW,OAAO,SAAS,MAAM,UAAU;AAEnG,MAAM,eAA2C,EAAE,MAAM,WAAW,QAAQ,UAAU;AAE/E,SAAS,gBAAgB,QAAgB,MAAoB;AAClE,SAAO,IAAI,KAAK,eAAe,QAAQ,YAAY,EAAE,OAAO,IAAI;AAClE;AAEO,SAAS,qBAAqB,QAAgB,MAAY,IAAkB;AACjF,QAAM,YAAY,IAAI,KAAK,eAAe,QAAQ,YAAY;AAC9D,MAAI;AACF,WAAO,UAAU,YAAY,MAAM,EAAE;AAAA,EACvC,QAAQ;AACN,WAAO,GAAG,UAAU,OAAO,IAAI,CAAC,WAAM,UAAU,OAAO,EAAE,CAAC;AAAA,EAC5D;AACF;AAEO,SAAS,qBAAqB,QAAgB,OAAa,KAAmB;AACnF,QAAM,YAAY,IAAI,KAAK,eAAe,QAAQ,YAAY;AAC9D,MAAI;AACF,WAAO,UAAU,YAAY,OAAO,GAAG;AAAA,EACzC,QAAQ;AACN,WAAO,GAAG,UAAU,OAAO,KAAK,CAAC,WAAM,UAAU,OAAO,GAAG,CAAC;AAAA,EAC9D;AACF;",
+  "names": []
+}

package/dist/modules/entities/api/encryption.js

@@ -4,6 +4,13 @@ import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { EncryptionMap } from "@open-mercato/core/modules/entities/data/entities";
 import { upsertEncryptionMapSchema } from "@open-mercato/core/modules/entities/data/validators";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { enforceCommandOptimisticLock } from "@open-mercato/shared/lib/crud/optimistic-lock-command";
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard
+} from "@open-mercato/shared/lib/crud/mutation-guard";
+const ENCRYPTION_MAP_RESOURCE_KIND = "entities.encryption_map";
 const metadata = {
   GET: { requireAuth: true, requireFeatures: ["entities.definitions.manage"] },
   POST: { requireAuth: true, requireFeatures: ["entities.definitions.manage"] }
@@ -14,6 +21,15 @@ function resolveScope(auth) {
     organizationId: auth.orgId ?? null
   };
 }
+function toIsoOrNull(value) {
+  if (value == null) return null;
+  if (value instanceof Date) {
+    const ms = value.getTime();
+    return Number.isFinite(ms) ? new Date(ms).toISOString() : null;
+  }
+  const trimmed = String(value).trim();
+  return trimmed.length ? trimmed : null;
+}
 async function GET(req) {
   const url = new URL(req.url);
   const entityId = url.searchParams.get("entityId") || "";
@@ -21,8 +37,8 @@ async function GET(req) {
   const auth = await getAuthFromRequest(req);
   if (!auth?.tenantId) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   const { tenantId, organizationId } = resolveScope(auth);
-  const { resolve } = await createRequestContainer();
-  const em = resolve("em");
+  const container = await createRequestContainer();
+  const em = container.resolve("em");
   const repo = em.getRepository(EncryptionMap);
   const candidates = [
     { entityId, tenantId, organizationId },
@@ -42,47 +58,99 @@ async function GET(req) {
     tenantId,
     organizationId,
     fields: record?.fieldsJson ?? [],
-    isActive: record?.isActive ?? true
+    isActive: record?.isActive ?? true,
+    updatedAt: toIsoOrNull(record?.updatedAt)
   });
 }
 async function POST(req) {
-  const body = await req.json().catch(() => ({}));
-  const parsed = upsertEncryptionMapSchema.safeParse(body);
-  if (!parsed.success) {
-    return NextResponse.json({ error: "Invalid payload", details: parsed.error.flatten() }, { status: 400 });
-  }
-  const auth = await getAuthFromRequest(req);
-  if (!auth?.tenantId) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
-  const scope = resolveScope(auth);
-  const payload = parsed.data;
-  const tenantId = scope.tenantId;
-  const organizationId = scope.organizationId;
-  const { resolve } = await createRequestContainer();
-  const em = resolve("em");
-  const repo = em.getRepository(EncryptionMap);
-  const existing = await repo.findOne({ entityId: payload.entityId, tenantId, organizationId, deletedAt: null });
-  if (existing) {
-    existing.fieldsJson = payload.fields;
-    existing.isActive = payload.isActive ?? true;
-    existing.updatedAt = /* @__PURE__ */ new Date();
-    await em.persist(existing).flush();
-  } else {
-    const map = repo.create({
-      entityId: payload.entityId,
+  try {
+    const body = await req.json().catch(() => ({}));
+    const parsed = upsertEncryptionMapSchema.safeParse(body);
+    if (!parsed.success) {
+      return NextResponse.json({ error: "Invalid payload", details: parsed.error.flatten() }, { status: 400 });
+    }
+    const auth = await getAuthFromRequest(req);
+    if (!auth?.tenantId) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    const scope = resolveScope(auth);
+    const payload = parsed.data;
+    const tenantId = auth.tenantId;
+    const organizationId = scope.organizationId;
+    const container = await createRequestContainer();
+    const em = container.resolve("em");
+    const repo = em.getRepository(EncryptionMap);
+    const existing = await repo.findOne({ entityId: payload.entityId, tenantId, organizationId, deletedAt: null });
+    if (existing) {
+      enforceCommandOptimisticLock({
+        resourceKind: ENCRYPTION_MAP_RESOURCE_KIND,
+        resourceId: existing.id,
+        current: existing.updatedAt,
+        request: req
+      });
+    }
+    const guardResult = await validateCrudMutationGuard(container, {
       tenantId,
       organizationId,
-      fieldsJson: payload.fields,
-      isActive: payload.isActive ?? true
+      userId: auth.sub,
+      resourceKind: ENCRYPTION_MAP_RESOURCE_KIND,
+      resourceId: existing?.id ?? payload.entityId,
+      operation: existing ? "update" : "create",
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: payload
     });
-    await em.persist(map).flush();
-  }
-  try {
-    const svc = resolve("tenantEncryptionService");
-    await svc?.invalidateMap?.(payload.entityId, tenantId, organizationId);
-  } catch {
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status });
+    }
+    let saved;
+    if (existing) {
+      existing.fieldsJson = payload.fields;
+      existing.isActive = payload.isActive ?? true;
+      existing.updatedAt = /* @__PURE__ */ new Date();
+      await em.persist(existing).flush();
+      saved = existing;
+    } else {
+      const map = repo.create({
+        entityId: payload.entityId,
+        tenantId,
+        organizationId,
+        fieldsJson: payload.fields,
+        isActive: payload.isActive ?? true
+      });
+      await em.persist(map).flush();
+      saved = map;
+    }
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(container, {
+        tenantId,
+        organizationId,
+        userId: auth.sub,
+        resourceKind: ENCRYPTION_MAP_RESOURCE_KIND,
+        resourceId: saved?.id ?? payload.entityId,
+        operation: existing ? "update" : "create",
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null
+      });
+    }
+    try {
+      const svc = container.resolve("tenantEncryptionService");
+      await svc?.invalidateMap?.(payload.entityId, tenantId, organizationId);
+    } catch {
+    }
+    return NextResponse.json({ ok: true, updatedAt: toIsoOrNull(saved?.updatedAt) });
+  } catch (err) {
+    if (isCrudHttpError(err)) {
+      return NextResponse.json(err.body, { status: err.status });
+    }
+    throw err;
   }
-  return NextResponse.json({ ok: true });
 }
+const conflictResponseSchema = z.object({
+  error: z.string(),
+  code: z.string(),
+  currentUpdatedAt: z.string(),
+  expectedUpdatedAt: z.string()
+});
 const openApi = {
   tag: "Entities",
   summary: "Manage encryption maps",
@@ -91,13 +159,16 @@ const openApi = {
       summary: "Fetch encryption map",
       description: "Returns the encrypted field map for the current tenant/organization scope.",
       query: z.object({ entityId: z.string() }),
-      responses: [{ status: 200, description: "Map", schema: z.object({ entityId: z.string(), fields: z.array(z.object({ field: z.string(), hashField: z.string().nullable().optional() })), isActive: z.boolean().optional() }) }]
+      responses: [{ status: 200, description: "Map", schema: z.object({ entityId: z.string(), fields: z.array(z.object({ field: z.string(), hashField: z.string().nullable().optional() })), isActive: z.boolean().optional(), updatedAt: z.string().nullable().optional() }) }]
     },
     POST: {
       summary: "Upsert encryption map",
-      description: "Creates or updates the encryption map for the current tenant/organization scope.",
+      description: "Creates or updates the encryption map for the current tenant/organization scope. Enforces optimistic locking when the caller sends the expected version header.",
       requestBody: { contentType: "application/json", schema: upsertEncryptionMapSchema },
-      responses: [{ status: 200, description: "Saved", schema: z.object({ ok: z.boolean() }) }]
+      responses: [
+        { status: 200, description: "Saved", schema: z.object({ ok: z.boolean(), updatedAt: z.string().nullable().optional() }) },
+        { status: 409, description: "Optimistic-lock conflict (stale write)", schema: conflictResponseSchema }
+      ]
     }
   }
 };

package/dist/modules/entities/api/encryption.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/entities/api/encryption.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { EncryptionMap } from '@open-mercato/core/modules/entities/data/entities'\nimport { upsertEncryptionMapSchema } from '@open-mercato/core/modules/entities/data/validators'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['entities.definitions.manage'] },\n  POST: { requireAuth: true, requireFeatures: ['entities.definitions.manage'] },\n}\n\nfunction resolveScope(auth: { tenantId?: string | null; orgId?: string | null }) {\n  return {\n    tenantId: auth.tenantId ?? null,\n    organizationId: auth.orgId ?? null,\n  }\n}\n\nexport async function GET(req: Request) {\n  const url = new URL(req.url)\n  const entityId = url.searchParams.get('entityId') || ''\n  if (!entityId) return NextResponse.json({ error: 'entityId is required' }, { status: 400 })\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const { tenantId, organizationId } = resolveScope(auth)\n\n  const { resolve } = await createRequestContainer()\n  const em = resolve('em') as any\n  const repo = em.getRepository(EncryptionMap)\n  // Prefer tenant+org, then tenant-global, then global\n  const candidates = [\n    { entityId, tenantId, organizationId },\n    { entityId, tenantId, organizationId: null },\n    { entityId, tenantId: null, organizationId: null },\n  ]\n  let record: any = null\n  for (const where of candidates) {\n    // eslint-disable-next-line no-await-in-loop\n    const found = await repo.findOne({ ...where, deletedAt: null })\n    if (found) {\n      record = found\n      break\n    }\n  }\n\n  return NextResponse.json({\n    entityId,\n    tenantId,\n    organizationId,\n    fields: record?.fieldsJson ?? [],\n    isActive: record?.isActive ?? true,\n  })\n}\n\nexport async function POST(req: Request) {\n  const body = await req.json().catch(() => ({}))\n  const parsed = upsertEncryptionMapSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload', details: parsed.error.flatten() }, { status: 400 })\n  }\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const scope = resolveScope(auth)\n  const payload = parsed.data\n  const tenantId = scope.tenantId\n  const organizationId = scope.organizationId\n\n  const { resolve } = await createRequestContainer()\n  const em = resolve('em') as any\n  const repo = em.getRepository(EncryptionMap)\n  const existing = await repo.findOne({ entityId: payload.entityId, tenantId, organizationId, deletedAt: null })\n  if (existing) {\n    existing.fieldsJson = payload.fields\n    existing.isActive = payload.isActive ?? true\n    existing.updatedAt = new Date()\n    await em.persist(existing).flush()\n  } else {\n    const map = repo.create({\n      entityId: payload.entityId,\n      tenantId,\n      organizationId,\n      fieldsJson: payload.fields,\n      isActive: payload.isActive ?? true,\n    })\n    await em.persist(map).flush()\n  }\n\n  try {\n    const svc = resolve('tenantEncryptionService') as { invalidateMap?: (e: string, t: string | null, o: string | null) => Promise<void> }\n    await svc?.invalidateMap?.(payload.entityId, tenantId, organizationId)\n  } catch {\n    // best-effort cache bust\n  }\n\n  return NextResponse.json({ ok: true })\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Entities',\n  summary: 'Manage encryption maps',\n  methods: {\n    GET: {\n      summary: 'Fetch encryption map',\n      description: 'Returns the encrypted field map for the current tenant/organization scope.',\n      query: z.object({ entityId: z.string() }),\n      responses: [{ status: 200, description: 'Map', schema: z.object({ entityId: z.string(), fields: z.array(z.object({ field: z.string(), hashField: z.string().nullable().optional() })), isActive: z.boolean().optional() }) }],\n    },\n    POST: {\n      summary: 'Upsert encryption map',\n      description: 'Creates or updates the encryption map for the current tenant/organization scope.',\n      requestBody: { contentType: 'application/json', schema: upsertEncryptionMapSchema },\n      responses: [{ status: 200, description: 'Saved', schema: z.object({ ok: z.boolean() }) }],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,qBAAqB;AAC9B,SAAS,iCAAiC;AAGnC,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAAA,EAC3E,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC9E;AAEA,SAAS,aAAa,MAA2D;AAC/E,SAAO;AAAA,IACL,UAAU,KAAK,YAAY;AAAA,IAC3B,gBAAgB,KAAK,SAAS;AAAA,EAChC;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,WAAW,IAAI,aAAa,IAAI,UAAU,KAAK;AACrD,MAAI,CAAC,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC1F,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AACxF,QAAM,EAAE,UAAU,eAAe,IAAI,aAAa,IAAI;AAEtD,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,KAAK,QAAQ,IAAI;AACvB,QAAM,OAAO,GAAG,cAAc,aAAa;AAE3C,QAAM,aAAa;AAAA,IACjB,EAAE,UAAU,UAAU,eAAe;AAAA,IACrC,EAAE,UAAU,UAAU,gBAAgB,KAAK;AAAA,IAC3C,EAAE,UAAU,UAAU,MAAM,gBAAgB,KAAK;AAAA,EACnD;AACA,MAAI,SAAc;AAClB,aAAW,SAAS,YAAY;AAE9B,UAAM,QAAQ,MAAM,KAAK,QAAQ,EAAE,GAAG,OAAO,WAAW,KAAK,CAAC;AAC9D,QAAI,OAAO;AACT,eAAS;AACT;AAAA,IACF;AAAA,EACF;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ,QAAQ,cAAc,CAAC;AAAA,IAC/B,UAAU,QAAQ,YAAY;AAAA,EAChC,CAAC;AACH;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAM,SAAS,0BAA0B,UAAU,IAAI;AACvD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AACA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AACxF,QAAM,QAAQ,aAAa,IAAI;AAC/B,QAAM,UAAU,OAAO;AACvB,QAAM,WAAW,MAAM;AACvB,QAAM,iBAAiB,MAAM;AAE7B,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,KAAK,QAAQ,IAAI;AACvB,QAAM,OAAO,GAAG,cAAc,aAAa;AAC3C,QAAM,WAAW,MAAM,KAAK,QAAQ,EAAE,UAAU,QAAQ,UAAU,UAAU,gBAAgB,WAAW,KAAK,CAAC;AAC7G,MAAI,UAAU;AACZ,aAAS,aAAa,QAAQ;AAC9B,aAAS,WAAW,QAAQ,YAAY;AACxC,aAAS,YAAY,oBAAI,KAAK;AAC9B,UAAM,GAAG,QAAQ,QAAQ,EAAE,MAAM;AAAA,EACnC,OAAO;AACL,UAAM,MAAM,KAAK,OAAO;AAAA,MACtB,UAAU,QAAQ;AAAA,MAClB;AAAA,MACA;AAAA,MACA,YAAY,QAAQ;AAAA,MACpB,UAAU,QAAQ,YAAY;AAAA,IAChC,CAAC;AACD,UAAM,GAAG,QAAQ,GAAG,EAAE,MAAM;AAAA,EAC9B;AAEA,MAAI;AACF,UAAM,MAAM,QAAQ,yBAAyB;AAC7C,UAAM,KAAK,gBAAgB,QAAQ,UAAU,UAAU,cAAc;AAAA,EACvE,QAAQ;AAAA,EAER;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AAAA,MACxC,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,OAAO,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,GAAG,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;AAAA,IAC9N;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa,EAAE,aAAa,oBAAoB,QAAQ,0BAA0B;AAAA,MAClF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,SAAS,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AAAA,IAC1F;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { EncryptionMap } from '@open-mercato/core/modules/entities/data/entities'\nimport { upsertEncryptionMapSchema } from '@open-mercato/core/modules/entities/data/validators'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\n\nconst ENCRYPTION_MAP_RESOURCE_KIND = 'entities.encryption_map'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['entities.definitions.manage'] },\n  POST: { requireAuth: true, requireFeatures: ['entities.definitions.manage'] },\n}\n\nfunction resolveScope(auth: { tenantId?: string | null; orgId?: string | null }) {\n  return {\n    tenantId: auth.tenantId ?? null,\n    organizationId: auth.orgId ?? null,\n  }\n}\n\nfunction toIsoOrNull(value: Date | string | null | undefined): string | null {\n  if (value == null) return null\n  if (value instanceof Date) {\n    const ms = value.getTime()\n    return Number.isFinite(ms) ? new Date(ms).toISOString() : null\n  }\n  const trimmed = String(value).trim()\n  return trimmed.length ? trimmed : null\n}\n\nexport async function GET(req: Request) {\n  const url = new URL(req.url)\n  const entityId = url.searchParams.get('entityId') || ''\n  if (!entityId) return NextResponse.json({ error: 'entityId is required' }, { status: 400 })\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const { tenantId, organizationId } = resolveScope(auth)\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as any\n  const repo = em.getRepository(EncryptionMap)\n  // Prefer tenant+org, then tenant-global, then global\n  const candidates = [\n    { entityId, tenantId, organizationId },\n    { entityId, tenantId, organizationId: null },\n    { entityId, tenantId: null, organizationId: null },\n  ]\n  let record: any = null\n  for (const where of candidates) {\n    // eslint-disable-next-line no-await-in-loop\n    const found = await repo.findOne({ ...where, deletedAt: null })\n    if (found) {\n      record = found\n      break\n    }\n  }\n\n  return NextResponse.json({\n    entityId,\n    tenantId,\n    organizationId,\n    fields: record?.fieldsJson ?? [],\n    isActive: record?.isActive ?? true,\n    updatedAt: toIsoOrNull(record?.updatedAt),\n  })\n}\n\nexport async function POST(req: Request) {\n  try {\n    const body = await req.json().catch(() => ({}))\n    const parsed = upsertEncryptionMapSchema.safeParse(body)\n    if (!parsed.success) {\n      return NextResponse.json({ error: 'Invalid payload', details: parsed.error.flatten() }, { status: 400 })\n    }\n    const auth = await getAuthFromRequest(req)\n    if (!auth?.tenantId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    const scope = resolveScope(auth)\n    const payload = parsed.data\n    const tenantId: string = auth.tenantId\n    const organizationId = scope.organizationId\n\n    const container = await createRequestContainer()\n    const em = container.resolve('em') as any\n    const repo = em.getRepository(EncryptionMap)\n    const existing = await repo.findOne({ entityId: payload.entityId, tenantId, organizationId, deletedAt: null })\n\n    // Reject stale writes: a save started from an older tab must not silently\n    // overwrite a newer encryption configuration. No-op when the client did not\n    // send the expected-version header (strictly additive).\n    if (existing) {\n      enforceCommandOptimisticLock({\n        resourceKind: ENCRYPTION_MAP_RESOURCE_KIND,\n        resourceId: existing.id,\n        current: existing.updatedAt,\n        request: req,\n      })\n    }\n\n    // Mutation-guard contract for custom write routes. The resource is the\n    // encryption map for this entity scoped to the tenant/organization.\n    const guardResult = await validateCrudMutationGuard(container, {\n      tenantId,\n      organizationId,\n      userId: auth.sub,\n      resourceKind: ENCRYPTION_MAP_RESOURCE_KIND,\n      resourceId: existing?.id ?? payload.entityId,\n      operation: existing ? 'update' : 'create',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: payload,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    let saved: any\n    if (existing) {\n      existing.fieldsJson = payload.fields\n      existing.isActive = payload.isActive ?? true\n      existing.updatedAt = new Date()\n      await em.persist(existing).flush()\n      saved = existing\n    } else {\n      const map = repo.create({\n        entityId: payload.entityId,\n        tenantId,\n        organizationId,\n        fieldsJson: payload.fields,\n        isActive: payload.isActive ?? true,\n      })\n      await em.persist(map).flush()\n      saved = map\n    }\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId,\n        organizationId,\n        userId: auth.sub,\n        resourceKind: ENCRYPTION_MAP_RESOURCE_KIND,\n        resourceId: saved?.id ?? payload.entityId,\n        operation: existing ? 'update' : 'create',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    try {\n      const svc = container.resolve('tenantEncryptionService') as { invalidateMap?: (e: string, t: string | null, o: string | null) => Promise<void> }\n      await svc?.invalidateMap?.(payload.entityId, tenantId, organizationId)\n    } catch {\n      // best-effort cache bust\n    }\n\n    return NextResponse.json({ ok: true, updatedAt: toIsoOrNull(saved?.updatedAt) })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    throw err\n  }\n}\n\nconst conflictResponseSchema = z.object({\n  error: z.string(),\n  code: z.string(),\n  currentUpdatedAt: z.string(),\n  expectedUpdatedAt: z.string(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Entities',\n  summary: 'Manage encryption maps',\n  methods: {\n    GET: {\n      summary: 'Fetch encryption map',\n      description: 'Returns the encrypted field map for the current tenant/organization scope.',\n      query: z.object({ entityId: z.string() }),\n      responses: [{ status: 200, description: 'Map', schema: z.object({ entityId: z.string(), fields: z.array(z.object({ field: z.string(), hashField: z.string().nullable().optional() })), isActive: z.boolean().optional(), updatedAt: z.string().nullable().optional() }) }],\n    },\n    POST: {\n      summary: 'Upsert encryption map',\n      description: 'Creates or updates the encryption map for the current tenant/organization scope. Enforces optimistic locking when the caller sends the expected version header.',\n      requestBody: { contentType: 'application/json', schema: upsertEncryptionMapSchema },\n      responses: [\n        { status: 200, description: 'Saved', schema: z.object({ ok: z.boolean(), updatedAt: z.string().nullable().optional() }) },\n        { status: 409, description: 'Optimistic-lock conflict (stale write)', schema: conflictResponseSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,qBAAqB;AAC9B,SAAS,iCAAiC;AAC1C,SAAwB,uBAAuB;AAC/C,SAAS,oCAAoC;AAC7C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAGP,MAAM,+BAA+B;AAE9B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAAA,EAC3E,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC9E;AAEA,SAAS,aAAa,MAA2D;AAC/E,SAAO;AAAA,IACL,UAAU,KAAK,YAAY;AAAA,IAC3B,gBAAgB,KAAK,SAAS;AAAA,EAChC;AACF;AAEA,SAAS,YAAY,OAAwD;AAC3E,MAAI,SAAS,KAAM,QAAO;AAC1B,MAAI,iBAAiB,MAAM;AACzB,UAAM,KAAK,MAAM,QAAQ;AACzB,WAAO,OAAO,SAAS,EAAE,IAAI,IAAI,KAAK,EAAE,EAAE,YAAY,IAAI;AAAA,EAC5D;AACA,QAAM,UAAU,OAAO,KAAK,EAAE,KAAK;AACnC,SAAO,QAAQ,SAAS,UAAU;AACpC;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,WAAW,IAAI,aAAa,IAAI,UAAU,KAAK;AACrD,MAAI,CAAC,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC1F,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AACxF,QAAM,EAAE,UAAU,eAAe,IAAI,aAAa,IAAI;AAEtD,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,OAAO,GAAG,cAAc,aAAa;AAE3C,QAAM,aAAa;AAAA,IACjB,EAAE,UAAU,UAAU,eAAe;AAAA,IACrC,EAAE,UAAU,UAAU,gBAAgB,KAAK;AAAA,IAC3C,EAAE,UAAU,UAAU,MAAM,gBAAgB,KAAK;AAAA,EACnD;AACA,MAAI,SAAc;AAClB,aAAW,SAAS,YAAY;AAE9B,UAAM,QAAQ,MAAM,KAAK,QAAQ,EAAE,GAAG,OAAO,WAAW,KAAK,CAAC;AAC9D,QAAI,OAAO;AACT,eAAS;AACT;AAAA,IACF;AAAA,EACF;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ,QAAQ,cAAc,CAAC;AAAA,IAC/B,UAAU,QAAQ,YAAY;AAAA,IAC9B,WAAW,YAAY,QAAQ,SAAS;AAAA,EAC1C,CAAC;AACH;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,SAAS,0BAA0B,UAAU,IAAI;AACvD,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACzG;AACA,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAI,CAAC,MAAM,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AACxF,UAAM,QAAQ,aAAa,IAAI;AAC/B,UAAM,UAAU,OAAO;AACvB,UAAM,WAAmB,KAAK;AAC9B,UAAM,iBAAiB,MAAM;AAE7B,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,GAAG,cAAc,aAAa;AAC3C,UAAM,WAAW,MAAM,KAAK,QAAQ,EAAE,UAAU,QAAQ,UAAU,UAAU,gBAAgB,WAAW,KAAK,CAAC;AAK7G,QAAI,UAAU;AACZ,mCAA6B;AAAA,QAC3B,cAAc;AAAA,QACd,YAAY,SAAS;AAAA,QACrB,SAAS,SAAS;AAAA,QAClB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAIA,UAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,MAC7D;AAAA,MACA;AAAA,MACA,QAAQ,KAAK;AAAA,MACb,cAAc;AAAA,MACd,YAAY,UAAU,MAAM,QAAQ;AAAA,MACpC,WAAW,WAAW,WAAW;AAAA,MACjC,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,QAAI;AACJ,QAAI,UAAU;AACZ,eAAS,aAAa,QAAQ;AAC9B,eAAS,WAAW,QAAQ,YAAY;AACxC,eAAS,YAAY,oBAAI,KAAK;AAC9B,YAAM,GAAG,QAAQ,QAAQ,EAAE,MAAM;AACjC,cAAQ;AAAA,IACV,OAAO;AACL,YAAM,MAAM,KAAK,OAAO;AAAA,QACtB,UAAU,QAAQ;AAAA,QAClB;AAAA,QACA;AAAA,QACA,YAAY,QAAQ;AAAA,QACpB,UAAU,QAAQ,YAAY;AAAA,MAChC,CAAC;AACD,YAAM,GAAG,QAAQ,GAAG,EAAE,MAAM;AAC5B,cAAQ;AAAA,IACV;AAEA,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,WAAW;AAAA,QAChD;AAAA,QACA;AAAA,QACA,QAAQ,KAAK;AAAA,QACb,cAAc;AAAA,QACd,YAAY,OAAO,MAAM,QAAQ;AAAA,QACjC,WAAW,WAAW,WAAW;AAAA,QACjC,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,QAAI;AACF,YAAM,MAAM,UAAU,QAAQ,yBAAyB;AACvD,YAAM,KAAK,gBAAgB,QAAQ,UAAU,UAAU,cAAc;AAAA,IACvE,QAAQ;AAAA,IAER;AAEA,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,WAAW,YAAY,OAAO,SAAS,EAAE,CAAC;AAAA,EACjF,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM;AAAA,EACR;AACF;AAEA,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,OAAO,EAAE,OAAO;AAAA,EAChB,MAAM,EAAE,OAAO;AAAA,EACf,kBAAkB,EAAE,OAAO;AAAA,EAC3B,mBAAmB,EAAE,OAAO;AAC9B,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AAAA,MACxC,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,OAAO,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,GAAG,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,UAAU,EAAE,QAAQ,EAAE,SAAS,GAAG,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;AAAA,IAC3Q;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa,EAAE,aAAa,oBAAoB,QAAQ,0BAA0B;AAAA,MAClF,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,SAAS,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,GAAG,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,EAAE;AAAA,QACxH,EAAE,QAAQ,KAAK,aAAa,0CAA0C,QAAQ,uBAAuB;AAAA,MACvG;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/entities/components/EncryptionManager.js

@@ -13,8 +13,10 @@ import {
 } from "@open-mercato/ui/primitives/select";
 import { LoadingMessage, ErrorMessage } from "@open-mercato/ui/backend/detail";
 import { flash } from "@open-mercato/ui/backend/FlashMessages";
-import { apiCall, readApiResultOrThrow } from "@open-mercato/ui/backend/utils/apiCall";
+import { apiCall, readApiResultOrThrow, withScopedApiRequestHeaders } from "@open-mercato/ui/backend/utils/apiCall";
 import { raiseCrudError } from "@open-mercato/ui/backend/utils/serverErrors";
+import { useGuardedMutation } from "@open-mercato/ui/backend/injection/useGuardedMutation";
+import { buildOptimisticLockHeader } from "@open-mercato/ui/backend/utils/optimisticLock";
 import { useCustomFieldDefs } from "@open-mercato/ui/backend/utils/customFieldDefs";
 import { Plus, Save, Trash2 } from "lucide-react";
 import { useOrganizationScopeVersion } from "@open-mercato/shared/lib/frontend/useOrganizationScope";
@@ -181,6 +183,7 @@ function EncryptionManager() {
     setHasUserEdited(false);
     lastMapSignatureRef.current = signature;
   }, [mapSignature, map, canonicalOptions, hasUserEdited]);
+  const { runMutation } = useGuardedMutation({ contextId: "entities.encryption-map" });
   const mutation = useMutation({
     mutationFn: async () => {
       const trimmed = fields.map((row) => ({
@@ -196,15 +199,25 @@ function EncryptionManager() {
       if (!trimmed.length) {
         throw new Error(t("entities.encryption.errors.noFields", "Add at least one field to encrypt"));
       }
-      const res = await apiCall("/api/entities/encryption", {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({ entityId: selectedEntityId, fields: trimmed, isActive })
+      const payload = { entityId: selectedEntityId, fields: trimmed, isActive };
+      return runMutation({
+        operation: async () => {
+          const res = await withScopedApiRequestHeaders(
+            buildOptimisticLockHeader(map?.updatedAt ?? null),
+            () => apiCall("/api/entities/encryption", {
+              method: "POST",
+              headers: { "content-type": "application/json" },
+              body: JSON.stringify(payload)
+            })
+          );
+          if (!res.ok) {
+            await raiseCrudError(res.response, t("entities.encryption.errors.save", "Failed to save encryption map"));
+          }
+          return true;
+        },
+        context: {},
+        mutationPayload: payload
       });
-      if (!res.ok) {
-        await raiseCrudError(res.response, t("entities.encryption.errors.save", "Failed to save encryption map"));
-      }
-      return true;
     },
     onSuccess: () => {
       flash(t("entities.encryption.flash.saved", "Encryption map saved"), "success");