@open-mercato/core 0.6.7-develop.6795.1.8a3f27921c → 0.6.7-develop.6824.1.21fff90682

package/src/modules/customers/components/detail/CompanyDetailTabs.tsx

@@ -13,6 +13,8 @@ import {
   Plus,
 } from 'lucide-react'
 import type { SectionAction } from '@open-mercato/ui/backend/detail'
+import { registerComponent } from '@open-mercato/shared/modules/widgets/component-registry'
+import { useRegisteredComponent } from '@open-mercato/ui/backend/injection/useRegisteredComponent'
 import { useDealsAccess } from './useDealsAccess'
 
 export type CompanyTabId =
@@ -30,10 +32,13 @@ type TabDef = {
   count?: React.ReactNode
 }
 
-type CompanyDetailTabsProps = {
+export const COMPANY_DETAIL_TABS_COMPONENT_ID = 'section:customers.companies.detailTabs'
+
+export type CompanyDetailTabsProps = {
   activeTab: CompanyTabId
   onTabChange: (tab: CompanyTabId) => void
   injectedTabs?: Array<{ id: string; label: string; priority?: number }>
+  hiddenTabIds?: string[]
   peopleCount?: number
   dealsCount?: number
   activitiesCount?: number
@@ -63,10 +68,11 @@ function formatTabCount(count: number): string | number | undefined {
   return count > 999 ? '999+' : count
 }
 
-export function CompanyDetailTabs({
+function DefaultCompanyDetailTabs({
   activeTab,
   onTabChange,
   injectedTabs = [],
+  hiddenTabIds = [],
   peopleCount = 0,
   dealsCount = 0,
   activitiesCount = 0,
@@ -117,16 +123,16 @@ export function CompanyDetailTabs({
     [t, canViewDeals, peopleCount, dealsCount, activitiesCount, filesCount],
   )
 
-  const allTabs: TabDef[] = React.useMemo(
-    () => [
+  const allTabs: TabDef[] = React.useMemo(() => {
+    const hidden = new Set(hiddenTabIds)
+    return [
       ...builtInTabs,
       ...injectedTabs.map((tab) => ({
         id: tab.id as CompanyTabId,
         label: tab.label,
       })),
-    ],
-    [builtInTabs, injectedTabs],
-  )
+    ].filter((tab) => !hidden.has(tab.id))
+  }, [builtInTabs, hiddenTabIds, injectedTabs])
 
   return (
     <div>
@@ -170,3 +176,20 @@ export function CompanyDetailTabs({
     </div>
   )
 }
+
+registerComponent<CompanyDetailTabsProps>({
+  id: COMPANY_DETAIL_TABS_COMPONENT_ID,
+  component: DefaultCompanyDetailTabs,
+  metadata: {
+    module: 'customers',
+    description: 'Company detail tab navigation and content.',
+  },
+})
+
+export function CompanyDetailTabs(props: CompanyDetailTabsProps) {
+  const ResolvedTabs = useRegisteredComponent<CompanyDetailTabsProps>(
+    COMPANY_DETAIL_TABS_COMPONENT_ID,
+    DefaultCompanyDetailTabs,
+  )
+  return <ResolvedTabs {...props} />
+}

package/src/modules/customers/components/detail/DealDetailTabs.tsx

@@ -3,6 +3,8 @@
 import * as React from 'react'
 import { Activity, Building2, History, NotebookPen, Paperclip, Users } from 'lucide-react'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
+import { registerComponent } from '@open-mercato/shared/modules/widgets/component-registry'
+import { useRegisteredComponent } from '@open-mercato/ui/backend/injection/useRegisteredComponent'
 import { Tabs, TabsList, TabsTrigger } from '@open-mercato/ui/primitives/tabs'
 
 export type DealTabId =
@@ -21,10 +23,13 @@ type TabDef = {
   count?: React.ReactNode
 }
 
-type DealDetailTabsProps = {
+export const DEAL_DETAIL_TABS_COMPONENT_ID = 'section:customers.deals.detailTabs'
+
+export type DealDetailTabsProps = {
   activeTab: DealTabId
   onTabChange: (tab: DealTabId) => void
   injectedTabs?: Array<{ id: string; label: string }>
+  hiddenTabIds?: string[]
   peopleCount?: number
   companiesCount?: number
   children: React.ReactNode
@@ -32,9 +37,11 @@ type DealDetailTabsProps = {
 
 const SUPPORTED_TAB_IDS = new Set<DealTabId>(['activities', 'people', 'companies', 'notes', 'files', 'changelog'])
 
-export function resolveLegacyTab(tab: string | null | undefined): DealTabId {
+export function resolveLegacyTab(tab: string | null | undefined, knownTabIds?: Iterable<string>): DealTabId {
   if (!tab) return 'activities'
-  return SUPPORTED_TAB_IDS.has(tab as DealTabId) ? (tab as DealTabId) : 'activities'
+  if (SUPPORTED_TAB_IDS.has(tab as DealTabId)) return tab as DealTabId
+  if (knownTabIds && new Set(knownTabIds).has(tab)) return tab
+  return 'activities'
 }
 
 function formatTabCount(count: number): string | number | undefined {
@@ -42,10 +49,11 @@ function formatTabCount(count: number): string | number | undefined {
   return count > 999 ? '999+' : count
 }
 
-export function DealDetailTabs({
+function DefaultDealDetailTabs({
   activeTab,
   onTabChange,
   injectedTabs = [],
+  hiddenTabIds = [],
   peopleCount = 0,
   companiesCount = 0,
   children,
@@ -91,16 +99,16 @@ export function DealDetailTabs({
     [companiesCount, peopleCount, t],
   )
 
-  const allTabs = React.useMemo<TabDef[]>(
-    () => [
+  const allTabs = React.useMemo<TabDef[]>(() => {
+    const hidden = new Set(hiddenTabIds)
+    return [
       ...builtInTabs,
       ...injectedTabs.map((tab) => ({
         id: tab.id as DealTabId,
         label: tab.label,
       })),
-    ],
-    [builtInTabs, injectedTabs],
-  )
+    ].filter((tab) => !hidden.has(tab.id))
+  }, [builtInTabs, hiddenTabIds, injectedTabs])
 
   return (
     <div>
@@ -127,3 +135,20 @@ export function DealDetailTabs({
     </div>
   )
 }
+
+registerComponent<DealDetailTabsProps>({
+  id: DEAL_DETAIL_TABS_COMPONENT_ID,
+  component: DefaultDealDetailTabs,
+  metadata: {
+    module: 'customers',
+    description: 'Deal detail tab navigation and content.',
+  },
+})
+
+export function DealDetailTabs(props: DealDetailTabsProps) {
+  const ResolvedTabs = useRegisteredComponent<DealDetailTabsProps>(
+    DEAL_DETAIL_TABS_COMPONENT_ID,
+    DefaultDealDetailTabs,
+  )
+  return <ResolvedTabs {...props} />
+}

package/src/modules/customers/components/detail/PersonDetailTabs.tsx

@@ -16,6 +16,8 @@ import {
   MapPin,
 } from 'lucide-react'
 import type { SectionAction } from '@open-mercato/ui/backend/detail'
+import { registerComponent } from '@open-mercato/shared/modules/widgets/component-registry'
+import { useRegisteredComponent } from '@open-mercato/ui/backend/injection/useRegisteredComponent'
 
 export type PersonTabId =
   | 'activities'
@@ -35,10 +37,13 @@ type TabDef = {
   count?: React.ReactNode
 }
 
-type PersonDetailTabsProps = {
+export const PERSON_DETAIL_TABS_COMPONENT_ID = 'section:customers.people.detailTabs'
+
+export type PersonDetailTabsProps = {
   activeTab: PersonTabId
   onTabChange: (tab: PersonTabId) => void
   injectedTabs?: Array<{ id: string; label: string }>
+  hiddenTabIds?: string[]
   activitiesCount?: number
   dealsCount?: number
   companiesCount?: number
@@ -51,9 +56,11 @@ type PersonDetailTabsProps = {
 
 const SUPPORTED_TAB_IDS = new Set<PersonTabId>(['activities', 'emails', 'deals', 'companies', 'addresses', 'tasks', 'changelog', 'files'])
 
-export function resolveLegacyTab(tab: string | null | undefined): PersonTabId {
+export function resolveLegacyTab(tab: string | null | undefined, knownTabIds?: Iterable<string>): PersonTabId {
   if (!tab) return 'activities'
-  return SUPPORTED_TAB_IDS.has(tab as PersonTabId) ? (tab as PersonTabId) : 'activities'
+  if (SUPPORTED_TAB_IDS.has(tab as PersonTabId)) return tab as PersonTabId
+  if (knownTabIds && new Set(knownTabIds).has(tab)) return tab
+  return 'activities'
 }
 
 function formatTabCount(count: number): string | number | undefined {
@@ -61,10 +68,11 @@ function formatTabCount(count: number): string | number | undefined {
   return count > 999 ? '999+' : count
 }
 
-export function PersonDetailTabs({
+function DefaultPersonDetailTabs({
   activeTab,
   onTabChange,
   injectedTabs = [],
+  hiddenTabIds = [],
   activitiesCount = 0,
   dealsCount = 0,
   companiesCount = 0,
@@ -129,16 +137,16 @@ export function PersonDetailTabs({
     [t, activitiesCount, dealsCount, companiesCount, addressesCount, tasksCount, filesCount],
   )
 
-  const allTabs: TabDef[] = React.useMemo(
-    () => [
+  const allTabs: TabDef[] = React.useMemo(() => {
+    const hidden = new Set(hiddenTabIds)
+    return [
       ...builtInTabs,
       ...injectedTabs.map((tab) => ({
         id: tab.id as PersonTabId,
         label: tab.label,
       })),
-    ],
-    [builtInTabs, injectedTabs],
-  )
+    ].filter((tab) => !hidden.has(tab.id))
+  }, [builtInTabs, hiddenTabIds, injectedTabs])
 
   return (
     <div>
@@ -182,3 +190,20 @@ export function PersonDetailTabs({
     </div>
   )
 }
+
+registerComponent<PersonDetailTabsProps>({
+  id: PERSON_DETAIL_TABS_COMPONENT_ID,
+  component: DefaultPersonDetailTabs,
+  metadata: {
+    module: 'customers',
+    description: 'Person detail tab navigation and content.',
+  },
+})
+
+export function PersonDetailTabs(props: PersonDetailTabsProps) {
+  const ResolvedTabs = useRegisteredComponent<PersonDetailTabsProps>(
+    PERSON_DETAIL_TABS_COMPONENT_ID,
+    DefaultPersonDetailTabs,
+  )
+  return <ResolvedTabs {...props} />
+}

package/src/modules/customers/data/entities.ts

@@ -439,9 +439,14 @@ export class CustomerDealStageTransition {
 @Entity({ tableName: 'customer_deal_people' })
 @Index({ name: 'customer_deal_people_deal_idx', properties: ['deal'] })
 @Index({ name: 'customer_deal_people_person_idx', properties: ['person'] })
+@Index({
+  name: 'customer_deal_people_primary_uq',
+  expression:
+    `create unique index "customer_deal_people_primary_uq" on "customer_deal_people" ("deal_id") where "is_primary"`,
+})
 @Unique({ name: 'customer_deal_people_unique', properties: ['deal', 'person'] })
 export class CustomerDealPersonLink {
-  [OptionalProps]?: 'createdAt'
+  [OptionalProps]?: 'isPrimary' | 'createdAt'
 
   @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })
   id!: string
@@ -449,6 +454,9 @@ export class CustomerDealPersonLink {
   @Property({ name: 'role', type: 'text', nullable: true })
   participantRole?: string | null
 
+  @Property({ name: 'is_primary', type: 'boolean', default: false })
+  isPrimary: boolean = false
+
   @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })
   createdAt: Date = new Date()
 

package/src/modules/customers/data/validators.ts

@@ -184,6 +184,7 @@ export const dealCreateSchema = scopedSchema.extend({
   lossNotes: z.string().max(4000).optional(),
   companyIds: z.array(uuid()).optional(),
   personIds: z.array(uuid()).optional(),
+  primaryPersonEntityId: uuid().nullable().optional(),
 })
 
 export const dealUpdateSchema = z

package/src/modules/customers/i18n/de.json

@@ -1617,6 +1617,7 @@
   "customers.errors.person_not_found": "Person nicht gefunden",
   "customers.errors.person_profile_not_found": "Personenprofil nicht gefunden",
   "customers.errors.person_required": "Personen-ID ist erforderlich",
+  "customers.errors.primaryPersonMustBeLinked": "Die primäre Person muss mit dem Deal verknüpft sein",
   "customers.errors.profile_must_be_object": "Profil muss ein Objekt sein",
   "customers.errors.profile_unsupported_field": "Nicht unterstütztes Profilfeld: {{field}}",
   "customers.errors.role_not_found": "Rolle nicht gefunden",

package/src/modules/customers/i18n/en.json

@@ -1617,6 +1617,7 @@
   "customers.errors.person_not_found": "Person not found",
   "customers.errors.person_profile_not_found": "Person profile not found",
   "customers.errors.person_required": "Person id is required",
+  "customers.errors.primaryPersonMustBeLinked": "Primary person must be linked to the deal",
   "customers.errors.profile_must_be_object": "profile must be an object",
   "customers.errors.profile_unsupported_field": "Unsupported profile field: {{field}}",
   "customers.errors.role_not_found": "Role not found",

package/src/modules/customers/i18n/es.json

@@ -1617,6 +1617,7 @@
   "customers.errors.person_not_found": "Persona no encontrada",
   "customers.errors.person_profile_not_found": "Perfil de persona no encontrado",
   "customers.errors.person_required": "Se requiere el ID de la persona",
+  "customers.errors.primaryPersonMustBeLinked": "La persona principal debe estar vinculada al deal",
   "customers.errors.profile_must_be_object": "el perfil debe ser un objeto",
   "customers.errors.profile_unsupported_field": "Campo de perfil no soportado: {{field}}",
   "customers.errors.role_not_found": "Rol no encontrado",

package/src/modules/customers/i18n/pl.json

@@ -1617,6 +1617,7 @@
   "customers.errors.person_not_found": "Nie znaleziono osoby",
   "customers.errors.person_profile_not_found": "Nie znaleziono profilu osoby",
   "customers.errors.person_required": "Wymagany identyfikator osoby",
+  "customers.errors.primaryPersonMustBeLinked": "Główna osoba musi być powiązana z dealem",
   "customers.errors.profile_must_be_object": "profil musi być obiektem",
   "customers.errors.profile_unsupported_field": "Nieobsługiwane pole profilu: {{field}}",
   "customers.errors.role_not_found": "Nie znaleziono roli",

package/src/modules/customers/migrations/.snapshot-open-mercato.json

@@ -1685,6 +1685,23 @@
           "enumItems": [],
           "mappedType": "uuid"
         },
+        "is_primary": {
+          "name": "is_primary",
+          "type": "boolean",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": false,
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": "false",
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
+          "mappedType": "boolean"
+        },
         "person_entity_id": {
           "name": "person_entity_id",
           "type": "uuid",
@@ -1741,6 +1758,15 @@
           "primary": false,
           "unique": false
         },
+        {
+          "columnNames": [],
+          "composite": false,
+          "constraint": false,
+          "keyName": "customer_deal_people_primary_uq",
+          "primary": false,
+          "unique": false,
+          "expression": "create unique index \"customer_deal_people_primary_uq\" on \"customer_deal_people\" (\"deal_id\") where \"is_primary\""
+        },
         {
           "columnNames": [
             "id"
@@ -6499,4 +6525,4 @@
   ],
   "views": [],
   "nativeEnums": {}
-}
+}

package/src/modules/customers/migrations/Migration20260723210000_customers.ts

@@ -0,0 +1,15 @@
+import { Migration } from '@mikro-orm/migrations';
+
+export class Migration20260723210000_customers extends Migration {
+
+  override up(): void | Promise<void> {
+    this.addSql(`alter table "customer_deal_people" add "is_primary" boolean not null default false;`);
+    this.addSql(`create unique index "customer_deal_people_primary_uq" on "customer_deal_people" ("deal_id") where "is_primary";`);
+  }
+
+  override down(): void | Promise<void> {
+    this.addSql(`drop index "customer_deal_people_primary_uq";`);
+    this.addSql(`alter table "customer_deal_people" drop column "is_primary";`);
+  }
+
+}

package/src/modules/directory/api/tenants/route.ts

@@ -2,7 +2,9 @@ import { NextResponse } from 'next/server'
 import { z } from 'zod'
 import { logCrudAccess, makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { resolveIsSuperAdmin } from '@open-mercato/core/modules/auth/lib/tenantAccess'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+
 import { Tenant } from '@open-mercato/core/modules/directory/data/entities'
 import { tenantCreateSchema, tenantUpdateSchema } from '@open-mercato/core/modules/directory/data/validators'
 import { loadCustomFieldValues, buildCustomFieldFiltersFromQuery } from '@open-mercato/shared/lib/crud/custom-fields'
@@ -94,6 +96,12 @@ export async function GET(req: Request) {
     return NextResponse.json({ items: [], total: 0, page: 1, pageSize: 50, totalPages: 1 }, { status: 401 })
   }
 
+  const container = await createRequestContainer()
+  const isSuperAdmin = await resolveIsSuperAdmin({ auth, container })
+  if (!isSuperAdmin) {
+    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+  }
+
   const url = new URL(req.url)
   const parsed = listQuerySchema.safeParse({
     id: url.searchParams.get('id') ?? undefined,
@@ -111,7 +119,6 @@ export async function GET(req: Request) {
     )
   }
 
-  const container = await createRequestContainer()
   const em = container.resolve('em') as EntityManager
 
   const { id, page, pageSize, search, sortField, sortDir, isActive } = parsed.data
@@ -256,6 +263,7 @@ const tenantGetDoc: OpenApiMethodDoc = {
   errors: [
     { status: 400, description: 'Invalid query parameters', schema: directoryErrorSchema },
     { status: 401, description: 'Authentication required', schema: directoryErrorSchema },
+    { status: 403, description: 'Requires super-admin', schema: directoryErrorSchema },
   ],
 }
 

package/src/modules/directory/commands/tenants.ts

@@ -5,6 +5,7 @@ import { Tenant } from '@open-mercato/core/modules/directory/data/entities'
 import type { DataEngine } from '@open-mercato/shared/lib/data/engine'
 import type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { requireSuperAdmin } from '@open-mercato/core/modules/auth/lib/tenantAccess'
 import { E } from '#generated/entities.ids.generated'
 import {
   parseWithCustomFields,
@@ -48,6 +49,7 @@ type SerializedTenant = ReturnType<typeof serializeTenant>
 const createTenantCommand: CommandHandler<TenantPayload, Tenant> = {
   id: 'directory.tenants.create',
   async execute(rawInput, ctx) {
+    await requireSuperAdmin(ctx)
     const { parsed, custom } = parseWithCustomFields(tenantCreateSchema, rawInput)
     const de = (ctx.container.resolve('dataEngine') as DataEngine)
 
@@ -126,6 +128,7 @@ const createTenantCommand: CommandHandler<TenantPayload, Tenant> = {
 const updateTenantCommand: CommandHandler<TenantPayload, Tenant> = {
   id: 'directory.tenants.update',
   async prepare(rawInput, ctx) {
+    await requireSuperAdmin(ctx)
     const { parsed } = parseWithCustomFields(tenantUpdateSchema, rawInput)
     const em = (ctx.container.resolve('em') as EntityManager)
     const current = await em.findOne(Tenant, { id: parsed.id, deletedAt: null })
@@ -133,6 +136,7 @@ const updateTenantCommand: CommandHandler<TenantPayload, Tenant> = {
     return { before: serializeTenant(current) }
   },
   async execute(rawInput, ctx) {
+    await requireSuperAdmin(ctx)
     const { parsed, custom } = parseWithCustomFields(tenantUpdateSchema, rawInput)
     const de = (ctx.container.resolve('dataEngine') as DataEngine)
     const tenant = await de.updateOrmEntity({
@@ -191,12 +195,14 @@ const updateTenantCommand: CommandHandler<TenantPayload, Tenant> = {
 const deleteTenantCommand: CommandHandler<{ body: any; query: Record<string, string> }, Tenant> = {
   id: 'directory.tenants.delete',
   async prepare(input, ctx) {
+    await requireSuperAdmin(ctx)
     const id = requireId(input, 'Tenant id required')
     const em = (ctx.container.resolve('em') as EntityManager)
     const existing = await em.findOne(Tenant, { id, deletedAt: null })
     return existing ? { before: serializeTenant(existing) } : {}
   },
   async execute(rawInput, ctx) {
+    await requireSuperAdmin(ctx)
     const id = requireId(rawInput, 'Tenant id required')
     const de = (ctx.container.resolve('dataEngine') as DataEngine)
     const tenant = await de.deleteOrmEntity({

package/src/modules/entities/api/entity-settings.ts

@@ -3,6 +3,10 @@ import { z } from 'zod'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { beginEntitiesMutationGuard } from './definitions.mutation-guard'
+import { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import type { ModuleConfigService } from '../../configs/lib/module-config-service'
 
 // Tenant-scoped policy: when true, new custom entities are created with
 // `access_restricted = true` unless the create request explicitly sets the flag.
@@ -14,24 +18,10 @@ export const metadata = {
   PUT: { requireAuth: true, requireFeatures: ['entities.definitions.manage'] },
 }
 
-type ModuleConfigServiceLike = {
-  getValue: (
-    moduleId: string,
-    name: string,
-    options?: { defaultValue?: unknown; scope?: { tenantId?: string | null } },
-  ) => Promise<unknown>
-  setValue: (
-    moduleId: string,
-    name: string,
-    value: unknown,
-    scope?: { tenantId?: string | null },
-  ) => Promise<unknown>
-}
-
 async function readPolicy(tenantId: string | null): Promise<boolean> {
   try {
     const { resolve } = await createRequestContainer()
-    const moduleConfigService = resolve('moduleConfigService') as ModuleConfigServiceLike
+    const moduleConfigService = resolve('moduleConfigService') as ModuleConfigService
     const value = await moduleConfigService.getValue(CONFIG_MODULE, NEW_ENTITIES_RESTRICTED_KEY, {
       defaultValue: false,
       scope: { tenantId },
@@ -45,12 +35,20 @@ async function readPolicy(tenantId: string | null): Promise<boolean> {
 export async function GET(req: Request) {
   const auth = await getAuthFromRequest(req)
   if (!auth || !auth.tenantId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-  const newEntitiesRestrictedByDefault = await readPolicy(auth.tenantId ?? null)
-  return NextResponse.json({ newEntitiesRestrictedByDefault })
+  const { resolve } = await createRequestContainer()
+  const moduleConfigService = resolve('moduleConfigService') as ModuleConfigService
+  const record = await moduleConfigService.getRecord(CONFIG_MODULE, NEW_ENTITIES_RESTRICTED_KEY, {
+    tenantId: auth.tenantId ?? null,
+  })
+  return NextResponse.json({
+    newEntitiesRestrictedByDefault: record ? record.value === true : false,
+    updatedAt: record ? record.updatedAt : null,
+  })
 }
 
 const putBodySchema = z.object({
   newEntitiesRestrictedByDefault: z.boolean(),
+  expectedUpdatedAt: z.string().optional(),
 })
 
 export async function PUT(req: Request) {
@@ -62,19 +60,64 @@ export async function PUT(req: Request) {
   if (!parsed.success) {
     return NextResponse.json({ error: 'Validation failed', details: parsed.error.flatten() }, { status: 400 })
   }
-  const { resolve } = await createRequestContainer()
-  const moduleConfigService = resolve('moduleConfigService') as ModuleConfigServiceLike
-  await moduleConfigService.setValue(
+  const container = await createRequestContainer()
+  const { resolve } = container
+  const moduleConfigService = resolve('moduleConfigService') as ModuleConfigService
+
+  const currentRecord = await moduleConfigService.getRecord(
+    CONFIG_MODULE,
+    NEW_ENTITIES_RESTRICTED_KEY,
+    { tenantId: auth.tenantId ?? null },
+  )
+
+  const guard = await beginEntitiesMutationGuard({
+    container,
+    auth,
+    req,
+    resourceKind: 'entities.settings',
+    resourceId: NEW_ENTITIES_RESTRICTED_KEY,
+    operation: currentRecord ? 'update' : 'create',
+    mutationPayload: parsed.data as unknown as Record<string, unknown>,
+  })
+  if (guard.blockedResponse) return guard.blockedResponse
+
+  const ifMatchHeader = req.headers.get('If-Match') || req.headers.get('x-om-ext-optimistic-lock-expected-updated-at')
+  const expectedUpdatedAt = ifMatchHeader || parsed.data.expectedUpdatedAt
+
+  try {
+    await enforceCommandOptimisticLockWithGuards(container, {
+      resourceKind: 'entities.settings',
+      resourceId: NEW_ENTITIES_RESTRICTED_KEY,
+      current: currentRecord ? currentRecord.updatedAt : null,
+      expected: expectedUpdatedAt,
+      request: req,
+    })
+  } catch (lockError) {
+    if (isCrudHttpError(lockError)) {
+      return NextResponse.json(lockError.body, { status: lockError.status })
+    }
+    throw lockError
+  }
+
+  const updatedRecord = await moduleConfigService.setValue(
     CONFIG_MODULE,
     NEW_ENTITIES_RESTRICTED_KEY,
     parsed.data.newEntitiesRestrictedByDefault,
     { tenantId: auth.tenantId ?? null },
   )
-  return NextResponse.json({ ok: true, newEntitiesRestrictedByDefault: parsed.data.newEntitiesRestrictedByDefault })
+
+  await guard.runAfterSuccess()
+
+  return NextResponse.json({
+    ok: true,
+    newEntitiesRestrictedByDefault: parsed.data.newEntitiesRestrictedByDefault,
+    updatedAt: updatedRecord ? updatedRecord.updatedAt : null,
+  })
 }
 
 const settingsResponseSchema = z.object({
   newEntitiesRestrictedByDefault: z.boolean(),
+  updatedAt: z.string().nullable().optional(),
 })
 
 export const openApi: OpenApiRouteDoc = {
@@ -94,9 +137,10 @@ export const openApi: OpenApiRouteDoc = {
       description: 'Sets the tenant-scoped default-restricted policy for new custom entities.',
       requestBody: { schema: putBodySchema },
       responses: [
-        { status: 200, description: 'Updated settings', schema: z.object({ ok: z.boolean(), newEntitiesRestrictedByDefault: z.boolean() }) },
+        { status: 200, description: 'Updated settings', schema: z.object({ ok: z.boolean(), newEntitiesRestrictedByDefault: z.boolean(), updatedAt: z.string().nullable().optional() }) },
         { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },
         { status: 401, description: 'Missing authentication', schema: z.object({ error: z.string() }) },
+        { status: 409, description: 'Optimistic lock conflict', schema: z.object({ code: z.string(), error: z.string() }) },
       ],
     },
   },

package/src/modules/entities/backend/config/settings/page.meta.ts

@@ -0,0 +1,34 @@
+import React from 'react'
+
+const settingsIcon = React.createElement(
+  'svg',
+  {
+    width: 16,
+    height: 16,
+    viewBox: '0 0 24 24',
+    fill: 'none',
+    stroke: 'currentColor',
+    strokeWidth: 2,
+    strokeLinecap: 'round',
+    strokeLinejoin: 'round',
+  },
+  React.createElement('circle', { cx: 12, cy: 12, r: 3 }),
+  React.createElement('path', {
+    d: 'M19.4 15a1.65 1.65 0 0 0 .33 1.82l.06.06a2 2 0 1 1-2.83 2.83l-.06-.06a1.65 1.65 0 0 0-1.82-.33 1.65 1.65 0 0 0-1 1.51V21a2 2 0 0 1-4 0v-.09A1.65 1.65 0 0 0 9 19.4a1.65 1.65 0 0 0-1.82.33l-.06.06a2 2 0 1 1-2.83-2.83l.06-.06a1.65 1.65 0 0 0 .33-1.82 1.65 1.65 0 0 0-1.51-1H3a2 2 0 0 1 0-4h.09A1.65 1.65 0 0 0 4.6 9a1.65 1.65 0 0 0-.33-1.82l-.06-.06a2 2 0 1 1 2.83-2.83l.06.06a1.65 1.65 0 0 0 1.82.33H9a1.65 1.65 0 0 0 1-1.51V3a2 2 0 0 1 4 0v.09a1.65 1.65 0 0 0 1 1.51 1.65 1.65 0 0 0 1.82-.33l.06-.06a2 2 0 1 1 2.83 2.83l-.06.06a1.65 1.65 0 0 0-.33 1.82V9a1.65 1.65 0 0 0 1.51 1H21a2 2 0 0 1 0 4h-.09a1.65 1.65 0 0 0-1.51 1z'
+  })
+)
+
+export const metadata = {
+  requireAuth: true,
+  requireFeatures: ['entities.definitions.manage'],
+  pageTitle: 'Custom Entities',
+  pageTitleKey: 'entities.settings.title',
+  pageGroup: 'Module Configs',
+  pageGroupKey: 'settings.sections.moduleConfigs',
+  pageOrder: 5,
+  icon: settingsIcon,
+  pageContext: 'settings' as const,
+  breadcrumb: [
+    { label: 'Custom Entities', labelKey: 'entities.settings.title' },
+  ],
+} as const