@open-mercato/core 0.6.8-develop.6924.1.a8d208fcdc → 0.6.8-develop.6930.1.1e5976efc3

package/dist/modules/sales/migrations/Migration20260806120000_sales_tag_assignment_document_idx.js

@@ -0,0 +1,17 @@
+import { Migration } from "@mikro-orm/migrations";
+class Migration20260806120000_sales_tag_assignment_document_idx extends Migration {
+  isTransactional() {
+    return false;
+  }
+  up() {
+    this.addSql(`drop index concurrently if exists "sales_document_tag_assignments_document_idx";`);
+    this.addSql(`create index concurrently "sales_document_tag_assignments_document_idx" on "sales_document_tag_assignments" ("document_id");`);
+  }
+  down() {
+    this.addSql(`drop index concurrently if exists "sales_document_tag_assignments_document_idx";`);
+  }
+}
+export {
+  Migration20260806120000_sales_tag_assignment_document_idx
+};
+//# sourceMappingURL=Migration20260806120000_sales_tag_assignment_document_idx.js.map

package/dist/modules/sales/migrations/Migration20260806120000_sales_tag_assignment_document_idx.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/sales/migrations/Migration20260806120000_sales_tag_assignment_document_idx.ts"],
+  "sourcesContent": ["import { Migration } from '@mikro-orm/migrations';\n\n// sales_document_tag_assignments had no index whose leading column is\n// document_id: the table carries PK(id), (organization_id, tenant_id) and the\n// unique (tag_id, document_id, document_kind) \u2014 and the unique index leads with\n// tag_id, which a document-scoped predicate never supplies. Every read and\n// write that resolves a document's tags therefore degraded to a sequential scan\n// as the table grew: syncSalesDocumentTags' per-save delete\n// (commands/documents.ts) and the order/quote grid's\n// `left join ... on id = document_id` (api/documents/factory.ts) alike. On a\n// 2.85M-row / 868MB production table the delete measured 139.9 ms \u2014 a full\n// table scan to remove the two rows belonging to one order.\n//\n// document_kind is deliberately omitted. sales_orders.id and sales_quotes.id\n// are both gen_random_uuid() from their own tables, so a document_id already\n// determines its kind; the second column adds no selectivity for ~30% more\n// index and document_kind is simply rechecked over the rows the seek returns.\n// The unique (tag_id, document_id, document_kind) index stays as-is \u2014 its\n// leading tag_id is load-bearing for sales.tags.delete (commands/tags.ts), for\n// the grid's tag filter and for the foreign-key check. Both column orders are\n// needed; two indexes is correct.\n//\n// The table is high-churn, so the index is built CONCURRENTLY to avoid blocking\n// writes during the build. CREATE INDEX CONCURRENTLY cannot run inside a\n// transaction, hence isTransactional() => false; the migration runner applies\n// migrations one-by-one, so this opt-out is safe. Drop first so retrying a\n// failed concurrent build removes PostgreSQL's invalid index stub instead of\n// letting IF NOT EXISTS silently accept it: a half-built concurrent index is\n// left INVALID, the planner ignores it, and IF NOT EXISTS would report success\n// while the table stays unindexed.\n//\n// Both halves follow Migration20260731105052_query_index, which builds\n// concurrently and drops first for the same reason. The earlier\n// Migration20260611103000_query_index builds concurrently but uses IF NOT\n// EXISTS without the drop \u2014 cited here only so a reader comparing the two knows\n// the divergence is deliberate rather than an oversight.\n//\n// On a database that does not have the index yet \u2014 every fresh install \u2014 the\n// drop is a no-op and there is no window without it. An operator who already\n// created this index out of band should expect it to be rebuilt here, and the\n// document-scoped scans to fall back to their pre-index cost until the\n// concurrent build finishes; on a large table, run this while the writers that\n// depend on it are paused.\nexport class Migration20260806120000_sales_tag_assignment_document_idx extends Migration {\n\n  override isTransactional(): boolean {\n    return false;\n  }\n\n  override up(): void | Promise<void> {\n    this.addSql(`drop index concurrently if exists \"sales_document_tag_assignments_document_idx\";`);\n    this.addSql(`create index concurrently \"sales_document_tag_assignments_document_idx\" on \"sales_document_tag_assignments\" (\"document_id\");`);\n  }\n\n  override down(): void | Promise<void> {\n    this.addSql(`drop index concurrently if exists \"sales_document_tag_assignments_document_idx\";`);\n  }\n\n}\n"],
+  "mappings": "AAAA,SAAS,iBAAiB;AA2CnB,MAAM,kEAAkE,UAAU;AAAA,EAE9E,kBAA2B;AAClC,WAAO;AAAA,EACT;AAAA,EAES,KAA2B;AAClC,SAAK,OAAO,kFAAkF;AAC9F,SAAK,OAAO,8HAA8H;AAAA,EAC5I;AAAA,EAES,OAA6B;AACpC,SAAK,OAAO,kFAAkF;AAAA,EAChG;AAEF;",
+  "names": []
+}

package/generated/entities/eudr_due_diligence_statement/index.ts

@@ -0,0 +1,22 @@
+export const id = "id";
+export const organization_id = "organization_id";
+export const tenant_id = "tenant_id";
+export const title = "title";
+export const commodity = "commodity";
+export const reference_number = "reference_number";
+export const verification_number = "verification_number";
+export const status = "status";
+export const activity_type = "activity_type";
+export const actor_role = "actor_role";
+export const referenced_statements = "referenced_statements";
+export const quantity_kg = "quantity_kg";
+export const supplementary_unit = "supplementary_unit";
+export const supplementary_quantity = "supplementary_quantity";
+export const order_id = "order_id";
+export const submitted_at = "submitted_at";
+export const reference_issued_at = "reference_issued_at";
+export const order_snapshot = "order_snapshot";
+export const notes = "notes";
+export const created_at = "created_at";
+export const updated_at = "updated_at";
+export const deleted_at = "deleted_at";

package/generated/entities/eudr_evidence_submission/index.ts

@@ -0,0 +1,24 @@
+export const id = "id";
+export const organization_id = "organization_id";
+export const tenant_id = "tenant_id";
+export const supplier_entity_id = "supplier_entity_id";
+export const supplier_snapshot = "supplier_snapshot";
+export const commodity = "commodity";
+export const product_mapping_id = "product_mapping_id";
+export const statement_id = "statement_id";
+export const origin_country = "origin_country";
+export const geolocation = "geolocation";
+export const quantity_kg = "quantity_kg";
+export const batch_number = "batch_number";
+export const harvest_from = "harvest_from";
+export const harvest_to = "harvest_to";
+export const producer_name = "producer_name";
+export const attachment_ids = "attachment_ids";
+export const plot_ids = "plot_ids";
+export const status = "status";
+export const completeness_score = "completeness_score";
+export const missing_fields = "missing_fields";
+export const notes = "notes";
+export const created_at = "created_at";
+export const updated_at = "updated_at";
+export const deleted_at = "deleted_at";

package/generated/entities/eudr_mitigation_action/index.ts

@@ -0,0 +1,14 @@
+export const id = "id";
+export const organization_id = "organization_id";
+export const tenant_id = "tenant_id";
+export const risk_assessment_id = "risk_assessment_id";
+export const action_type = "action_type";
+export const title = "title";
+export const description = "description";
+export const status = "status";
+export const due_date = "due_date";
+export const completed_at = "completed_at";
+export const notes = "notes";
+export const created_at = "created_at";
+export const updated_at = "updated_at";
+export const deleted_at = "deleted_at";

package/generated/entities/eudr_plot/index.ts

@@ -0,0 +1,18 @@
+export const id = "id";
+export const organization_id = "organization_id";
+export const tenant_id = "tenant_id";
+export const supplier_entity_id = "supplier_entity_id";
+export const supplier_snapshot = "supplier_snapshot";
+export const name = "name";
+export const external_id = "external_id";
+export const description = "description";
+export const origin_country = "origin_country";
+export const plot_type = "plot_type";
+export const geometry = "geometry";
+export const area_ha = "area_ha";
+export const validation_warnings = "validation_warnings";
+export const producer_name = "producer_name";
+export const is_active = "is_active";
+export const created_at = "created_at";
+export const updated_at = "updated_at";
+export const deleted_at = "deleted_at";

package/generated/entities/eudr_product_mapping/index.ts

@@ -0,0 +1,14 @@
+export const id = "id";
+export const organization_id = "organization_id";
+export const tenant_id = "tenant_id";
+export const product_id = "product_id";
+export const product_snapshot = "product_snapshot";
+export const commodity = "commodity";
+export const hs_code = "hs_code";
+export const species_scientific_name = "species_scientific_name";
+export const species_common_name = "species_common_name";
+export const is_in_scope = "is_in_scope";
+export const notes = "notes";
+export const created_at = "created_at";
+export const updated_at = "updated_at";
+export const deleted_at = "deleted_at";

package/generated/entities/eudr_risk_assessment/index.ts

@@ -0,0 +1,16 @@
+export const id = "id";
+export const organization_id = "organization_id";
+export const tenant_id = "tenant_id";
+export const statement_id = "statement_id";
+export const country_risks = "country_risks";
+export const overall_tier = "overall_tier";
+export const criteria = "criteria";
+export const conclusion = "conclusion";
+export const is_simplified = "is_simplified";
+export const assessed_at = "assessed_at";
+export const assessed_by_name = "assessed_by_name";
+export const review_due_at = "review_due_at";
+export const notes = "notes";
+export const created_at = "created_at";
+export const updated_at = "updated_at";
+export const deleted_at = "deleted_at";

package/generated/entities/role/index.ts

@@ -1,6 +1,7 @@
 export const id = "id";
 export const name = "name";
 export const tenant_id = "tenant_id";
+export const min_active_holders = "min_active_holders";
 export const created_at = "created_at";
 export const updated_at = "updated_at";
 export const deleted_at = "deleted_at";

package/generated/entities.ids.generated.ts

@@ -35,6 +35,7 @@ export const M = {
     "inbox_ops": "inbox_ops",
     "payment_gateways": "payment_gateways",
     "shipping_carriers": "shipping_carriers",
+    "eudr": "eudr",
     "customer_accounts": "customer_accounts",
     "portal": "portal"
   } as const, E = {
@@ -290,6 +291,14 @@ export const M = {
       "carrier_webhook_processed_event": "shipping_carriers:carrier_webhook_processed_event",
       "carrier_shipment_idempotency_key": "shipping_carriers:carrier_shipment_idempotency_key"
     },
+    "eudr": {
+      "eudr_product_mapping": "eudr:eudr_product_mapping",
+      "eudr_plot": "eudr:eudr_plot",
+      "eudr_evidence_submission": "eudr:eudr_evidence_submission",
+      "eudr_due_diligence_statement": "eudr:eudr_due_diligence_statement",
+      "eudr_risk_assessment": "eudr:eudr_risk_assessment",
+      "eudr_mitigation_action": "eudr:eudr_mitigation_action"
+    },
     "customer_accounts": {
       "customer_user": "customer_accounts:customer_user",
       "customer_role": "customer_accounts:customer_role",

package/generated/entity-fields-registry.ts

@@ -1184,6 +1184,126 @@ export const entityFieldsRegistry: Record<string, Record<string, string>> = {
       "created_at": "created_at",
       "updated_at": "updated_at"
     },
+    "eudr_due_diligence_statement": {
+      "id": "id",
+      "organization_id": "organization_id",
+      "tenant_id": "tenant_id",
+      "title": "title",
+      "commodity": "commodity",
+      "reference_number": "reference_number",
+      "verification_number": "verification_number",
+      "status": "status",
+      "activity_type": "activity_type",
+      "actor_role": "actor_role",
+      "referenced_statements": "referenced_statements",
+      "quantity_kg": "quantity_kg",
+      "supplementary_unit": "supplementary_unit",
+      "supplementary_quantity": "supplementary_quantity",
+      "order_id": "order_id",
+      "submitted_at": "submitted_at",
+      "reference_issued_at": "reference_issued_at",
+      "order_snapshot": "order_snapshot",
+      "notes": "notes",
+      "created_at": "created_at",
+      "updated_at": "updated_at",
+      "deleted_at": "deleted_at"
+    },
+    "eudr_evidence_submission": {
+      "id": "id",
+      "organization_id": "organization_id",
+      "tenant_id": "tenant_id",
+      "supplier_entity_id": "supplier_entity_id",
+      "supplier_snapshot": "supplier_snapshot",
+      "commodity": "commodity",
+      "product_mapping_id": "product_mapping_id",
+      "statement_id": "statement_id",
+      "origin_country": "origin_country",
+      "geolocation": "geolocation",
+      "quantity_kg": "quantity_kg",
+      "batch_number": "batch_number",
+      "harvest_from": "harvest_from",
+      "harvest_to": "harvest_to",
+      "producer_name": "producer_name",
+      "attachment_ids": "attachment_ids",
+      "plot_ids": "plot_ids",
+      "status": "status",
+      "completeness_score": "completeness_score",
+      "missing_fields": "missing_fields",
+      "notes": "notes",
+      "created_at": "created_at",
+      "updated_at": "updated_at",
+      "deleted_at": "deleted_at"
+    },
+    "eudr_mitigation_action": {
+      "id": "id",
+      "organization_id": "organization_id",
+      "tenant_id": "tenant_id",
+      "risk_assessment_id": "risk_assessment_id",
+      "action_type": "action_type",
+      "title": "title",
+      "description": "description",
+      "status": "status",
+      "due_date": "due_date",
+      "completed_at": "completed_at",
+      "notes": "notes",
+      "created_at": "created_at",
+      "updated_at": "updated_at",
+      "deleted_at": "deleted_at"
+    },
+    "eudr_plot": {
+      "id": "id",
+      "organization_id": "organization_id",
+      "tenant_id": "tenant_id",
+      "supplier_entity_id": "supplier_entity_id",
+      "supplier_snapshot": "supplier_snapshot",
+      "name": "name",
+      "external_id": "external_id",
+      "description": "description",
+      "origin_country": "origin_country",
+      "plot_type": "plot_type",
+      "geometry": "geometry",
+      "area_ha": "area_ha",
+      "validation_warnings": "validation_warnings",
+      "producer_name": "producer_name",
+      "is_active": "is_active",
+      "created_at": "created_at",
+      "updated_at": "updated_at",
+      "deleted_at": "deleted_at"
+    },
+    "eudr_product_mapping": {
+      "id": "id",
+      "organization_id": "organization_id",
+      "tenant_id": "tenant_id",
+      "product_id": "product_id",
+      "product_snapshot": "product_snapshot",
+      "commodity": "commodity",
+      "hs_code": "hs_code",
+      "species_scientific_name": "species_scientific_name",
+      "species_common_name": "species_common_name",
+      "is_in_scope": "is_in_scope",
+      "notes": "notes",
+      "created_at": "created_at",
+      "updated_at": "updated_at",
+      "deleted_at": "deleted_at"
+    },
+    "eudr_risk_assessment": {
+      "id": "id",
+      "organization_id": "organization_id",
+      "tenant_id": "tenant_id",
+      "statement_id": "statement_id",
+      "country_risks": "country_risks",
+      "overall_tier": "overall_tier",
+      "criteria": "criteria",
+      "conclusion": "conclusion",
+      "is_simplified": "is_simplified",
+      "assessed_at": "assessed_at",
+      "assessed_by_name": "assessed_by_name",
+      "review_due_at": "review_due_at",
+      "notes": "notes",
+      "created_at": "created_at",
+      "updated_at": "updated_at",
+      "deleted_at": "deleted_at"
+    },
     "exchange_rate": {
       "id": "id",
       "organization_id": "organization_id",
@@ -1873,6 +1993,7 @@ export const entityFieldsRegistry: Record<string, Record<string, string>> = {
       "id": "id",
       "name": "name",
       "tenant_id": "tenant_id",
+      "min_active_holders": "min_active_holders",
       "created_at": "created_at",
       "updated_at": "updated_at",
       "deleted_at": "deleted_at"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.6.8-develop.6924.1.a8d208fcdc",
+  "version": "0.6.8-develop.6930.1.1e5976efc3",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -254,16 +254,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.6.8-develop.6924.1.a8d208fcdc",
-    "@open-mercato/shared": "0.6.8-develop.6924.1.a8d208fcdc",
-    "@open-mercato/ui": "0.6.8-develop.6924.1.a8d208fcdc",
+    "@open-mercato/ai-assistant": "0.6.8-develop.6930.1.1e5976efc3",
+    "@open-mercato/shared": "0.6.8-develop.6930.1.1e5976efc3",
+    "@open-mercato/ui": "0.6.8-develop.6930.1.1e5976efc3",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.6.8-develop.6924.1.a8d208fcdc",
-    "@open-mercato/shared": "0.6.8-develop.6924.1.a8d208fcdc",
-    "@open-mercato/ui": "0.6.8-develop.6924.1.a8d208fcdc",
+    "@open-mercato/ai-assistant": "0.6.8-develop.6930.1.1e5976efc3",
+    "@open-mercato/shared": "0.6.8-develop.6930.1.1e5976efc3",
+    "@open-mercato/ui": "0.6.8-develop.6930.1.1e5976efc3",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^7.0.0",
     "@testing-library/react": "^16.3.1",

package/src/helpers/integration/api.ts

@@ -13,6 +13,19 @@ function resolveUrl(path: string): string {
 const tokenCache = new Map<string, { token: string; mintedAt: number }>();
 const TOKEN_TTL_MS = 45 * 60 * 1000; // 45 min; well under the default 2h session TTL.
 
+/**
+ * Drops cached tokens so the next getAuthToken() mints a fresh session.
+ *
+ * A cached token points at a `sessions` row. Anything that deletes those rows —
+ * deactivating the user, a password change, an explicit session purge — leaves the
+ * cached token resolving to 401 for the rest of the TTL, and `apiRequest` neither
+ * retries nor re-mints. A spec that revokes sessions for an account other specs also
+ * use MUST call this afterwards.
+ */
+export function clearAuthTokenCache(): void {
+  tokenCache.clear();
+}
+
 export async function getAuthToken(
   request: APIRequestContext,
   roleOrEmail: Role | string = 'admin',

package/src/modules/attachments/fields/attachment.tsx

@@ -50,11 +50,13 @@ export const AttachmentInput = ({
   recordId,
   def,
   disabled,
+  onUploaded,
 }: {
   entityId?: string
   recordId?: string
   def?: AttachmentFieldDef
   disabled?: boolean
+  onUploaded?: () => void
 }) => {
   const t = useT()
   const [items, setItems] = React.useState<Array<{ id: string; url: string; fileName: string; fileSize: number }>>([])
@@ -92,6 +94,7 @@ export const AttachmentInput = ({
     if (!files || !entityId || !recordId) return
     setError(null)
     setUploading(true)
+    let uploadedCount = 0
     try {
       for (const file of Array.from(files)) {
         const ext = (file.name || '').split('.').pop()?.toLowerCase() || ''
@@ -119,8 +122,10 @@ export const AttachmentInput = ({
           setError(call.result?.error || t('attachments.library.upload.failed', 'Upload failed.'))
           break
         }
+        uploadedCount += 1
       }
       await load()
+      if (uploadedCount > 0) onUploaded?.()
     } finally {
       setUploading(false)
       if (fileInputRef.current) {

package/src/modules/attachments/lib/crud.ts

@@ -10,6 +10,8 @@ export const attachmentCrudEvents: CrudEventsConfig<Attachment> = {
     id: ctx.identifiers.id,
     organizationId: ctx.identifiers.organizationId,
     tenantId: ctx.identifiers.tenantId,
+    entityId: ctx.entity?.entityId ?? null,
+    recordId: ctx.entity?.recordId ?? null,
   }),
 }
 

package/src/modules/audit_logs/api/audit-logs/actions/redo/route.ts

@@ -4,6 +4,7 @@ import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { resolveFeatureCheckContext, resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 import { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { ActionLogService } from '@open-mercato/core/modules/audit_logs/services/actionLogService'
 import type { CommandRuntimeContext, CommandLogMetadata } from '@open-mercato/shared/lib/commands'
 import { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'
@@ -160,6 +161,12 @@ export async function POST(req: Request) {
     }
     return response
   } catch (err) {
+    // Same contract as undo: a domain refusal carries an already-localized body the
+    // operator can act on, so surface it instead of a generic message.
+    if (isCrudHttpError(err)) {
+      logger.warn('Redo rejected', { err })
+      return NextResponse.json(err.body, { status: err.status })
+    }
     logger.error('Redo failed', { err })
     return NextResponse.json({ error: 'Redo failed' }, { status: 400 })
   }

package/src/modules/audit_logs/api/audit-logs/actions/undo/route.ts

@@ -4,6 +4,7 @@ import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { resolveFeatureCheckContext, resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 import { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { ActionLogService } from '@open-mercato/core/modules/audit_logs/services/actionLogService'
 import type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
 import { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'
@@ -121,6 +122,14 @@ export async function POST(req: Request) {
     await commandBus.undo(undoToken, ctx)
     return NextResponse.json({ ok: true, logId: target.id })
   } catch (err) {
+    // A command can refuse an undo for a domain reason the operator can act on — e.g.
+    // reverting a role grant would drop a tenant below a protected role's active-holder
+    // floor. Those arrive as CrudHttpError with an already-localized body, so pass them
+    // through verbatim instead of flattening every failure to a generic message.
+    if (isCrudHttpError(err)) {
+      logger.warn('Undo rejected', { err, logId: target.id })
+      return NextResponse.json(err.body, { status: err.status })
+    }
     // A beforeUndo interceptor that blocked with an explicit status is a deliberate business
     // rejection, not an undo failure — surface its status and message (issue #5045).
     const interceptorRejection = getCommandInterceptorHttpRejection(err)

package/src/modules/audit_logs/backend/audit-logs/page.tsx

@@ -146,11 +146,11 @@ export default function AuditLogsPage() {
     </Button>
   ), [loadWithState, actionsPage, actionsPageSize, accessPage, accessPageSize, loading, t])
 
-  const handleUndoError = React.useCallback(() => {
-    setError(t('audit_logs.error.undo'))
+  const handleUndoError = React.useCallback((reason?: string) => {
+    setError(reason || t('audit_logs.error.undo'))
   }, [t])
-  const handleRedoError = React.useCallback(() => {
-    setError(t('audit_logs.error.redo'))
+  const handleRedoError = React.useCallback((reason?: string) => {
+    setError(reason || t('audit_logs.error.redo'))
   }, [t])
 
   const handleActionsPageChange = React.useCallback((nextPage: number) => {

package/src/modules/audit_logs/components/AuditLogsActions.tsx

@@ -16,6 +16,21 @@ import { createLogger } from '@open-mercato/shared/lib/logger'
 
 const logger = createLogger('audit_logs').child({ component: 'AuditLogsActions' })
 
+/**
+ * `raiseCrudError` prefers the server's `error` body over the fallback message and stamps
+ * `status` on anything it builds from an HTTP response, so a numeric `status` is what
+ * distinguishes a route's refusal from a client-side failure. Without that check an
+ * offline or aborted request would put a raw "Failed to fetch" into the operator's
+ * banner; those keep the generic fallback instead.
+ */
+function resolveServerReason(err: unknown): string | undefined {
+  if (!(err instanceof Error)) return undefined
+  const status = (err as Error & { status?: unknown }).status
+  if (typeof status !== 'number') return undefined
+  const message = err.message?.trim()
+  return message ? message : undefined
+}
+
 export type ActionLogItem = {
   id: string
   commandId: string
@@ -51,8 +66,9 @@ export function AuditLogsActions({
   onRefresh: () => Promise<void>
   isLoading?: boolean
   headerExtras?: React.ReactNode
-  onUndoError?: () => void
-  onRedoError?: () => void
+  /** Receives the server's reason when it sent one, so the page can show why the undo was refused. */
+  onUndoError?: (reason?: string) => void
+  onRedoError?: (reason?: string) => void
   pagination?: PaginationProps
 }) {
   const t = useT()
@@ -109,7 +125,7 @@ export function AuditLogsActions({
       await onRefresh()
     } catch (err) {
       logger.error('Undo action failed', { err })
-      onUndoError?.()
+      onUndoError?.(resolveServerReason(err))
     } finally {
       setUndoingToken(null)
     }
@@ -128,7 +144,7 @@ export function AuditLogsActions({
       await onRefresh()
     } catch (err) {
       logger.error('Redo action failed', { err })
-      onRedoError?.()
+      onRedoError?.(resolveServerReason(err))
     } finally {
       setRedoingId(null)
     }

package/src/modules/auth/api/login.ts

@@ -120,8 +120,15 @@ export async function POST(req: Request) {
   // wrong-password, and multi-tenant cases return an identical 401 with
   // identical latency.
   const ok = await auth.verifyPassword(user, parsed.data.password)
-  if (!user || !ok) {
-    const reason = user?.passwordHash ? 'invalid_password' : 'invalid_credentials'
+  if (!user || !ok || user.isConfirmed === false) {
+    // The 401 body stays identical for every branch so the response never reveals
+    // which one fired. `reason` goes to the audit stream instead, where separating a
+    // deactivated account from a mistyped password is the whole point — otherwise
+    // repeated attempts against a disabled account look like ordinary fat-fingering.
+    let reason: string
+    if (user && user.isConfirmed === false) reason = 'account_deactivated'
+    else if (user?.passwordHash) reason = 'invalid_password'
+    else reason = 'invalid_credentials'
     void emitAuthEvent('auth.login.failed', { email: parsed.data.email, reason }).catch(() => undefined)
     return NextResponse.json({ ok: false, error: translate('auth.login.errors.invalidCredentials', 'Invalid email or password') }, { status: 401 })
   }

package/src/modules/auth/api/users/route.ts

@@ -72,6 +72,7 @@ const userUpdateSchema = z.object({
   password: passwordSchema.optional(),
   organizationId: z.string().uuid().optional(),
   roles: z.array(z.string()).optional(),
+  isConfirmed: z.boolean().optional(),
 })
 
 const userListItemSchema = z.object({
@@ -85,6 +86,7 @@ const userListItemSchema = z.object({
   roles: z.array(z.string()),
   roleIds: z.array(z.string().uuid()).optional(),
   hasPassword: z.boolean().optional(),
+  isConfirmed: z.boolean(),
   updatedAt: z.string().nullable().optional(),
 })
 
@@ -476,6 +478,7 @@ export async function GET(req: Request) {
       roles: roleMap[uid] || [],
       roleIds: roleIdMap[uid] || [],
       ...(id ? { hasPassword: !!u.passwordHash } : {}),
+      isConfirmed: u.isConfirmed !== false,
       updatedAt: u.updatedAt instanceof Date ? u.updatedAt.toISOString() : null,
       ...(cfByUser[uid] || {}),
     }
@@ -662,7 +665,8 @@ export const openApi: OpenApiRouteDoc = {
     },
     PUT: {
       summary: 'Update user',
-      description: 'Updates profile fields including display name, organization assignment, credentials, or role memberships.',
+      description:
+        'Updates profile fields including display name, organization assignment, credentials, or role memberships. Setting isConfirmed=false deactivates the account: the user can no longer sign in and every active session is revoked; isConfirmed=true reactivates it. A tenant cannot drop below a protected role\'s minimum active holder count, so revoking the role from, deactivating, moving, or deleting the last active administrator is rejected.',
       requestBody: {
         contentType: 'application/json',
         schema: userUpdateSchema,
@@ -671,7 +675,7 @@ export const openApi: OpenApiRouteDoc = {
         { status: 200, description: 'User updated', schema: okResponseSchema },
       ],
       errors: [
-        { status: 400, description: 'Invalid payload', schema: errorResponseSchema },
+        { status: 400, description: 'Invalid payload, duplicate email, or the update would remove the last active holder of a protected role', schema: errorResponseSchema },
         { status: 401, description: 'Unauthorized', schema: errorResponseSchema },
         { status: 403, description: 'Attempted to assign privileged roles', schema: errorResponseSchema },
         { status: 404, description: 'User not found', schema: errorResponseSchema },
@@ -679,13 +683,13 @@ export const openApi: OpenApiRouteDoc = {
     },
     DELETE: {
       summary: 'Delete user',
-      description: 'Deletes a user by identifier. Undo support is provided via the command bus.',
+      description: 'Deletes a user by identifier. Rejected when the target is the last active holder of a protected role in the tenant. Undo support is provided via the command bus.',
       query: z.object({ id: z.string().uuid().describe('User identifier') }),
       responses: [
         { status: 200, description: 'User deleted', schema: okResponseSchema },
       ],
       errors: [
-        { status: 400, description: 'User cannot be deleted', schema: errorResponseSchema },
+        { status: 400, description: 'User cannot be deleted, or is the last active holder of a protected role', schema: errorResponseSchema },
         { status: 401, description: 'Unauthorized', schema: errorResponseSchema },
         { status: 404, description: 'User not found', schema: errorResponseSchema },
       ],