@open-mercato/core 0.6.8-develop.7079.1.dbf29dd6a1 → 0.6.8-develop.7082.1.f2a845b020

package/src/modules/customers/backend/hooks/useEmailDuplicateCheck.ts

@@ -40,16 +40,24 @@ export function useEmailDuplicateCheck(
     }
 
     const normalized = trimmed.toLowerCase()
+    const excludedId = typeof recordId === 'string' && recordId.trim().length ? recordId.trim() : null
     let cancelled = false
     const controller = new AbortController()
     const timer = window.setTimeout(async () => {
       setChecking(true)
       try {
-        const queryParam =
+        const params = [
           matchMode === 'prefix'
             ? `emailStartsWith=${encodeURIComponent(normalized)}`
-            : `email=${encodeURIComponent(normalized)}`
-        const call = await apiCall<{ items?: unknown[] }>(`/api/customers/people?${queryParam}&pageSize=5&page=1`, {
+            : `email=${encodeURIComponent(normalized)}`,
+          'pageSize=5',
+          'page=1',
+        ]
+        // The record being edited is never its own duplicate (#5534). Excluding it in the
+        // query — not only in the client-side scan below — also stops it from consuming one
+        // of the five returned slots and hiding a genuine duplicate.
+        if (excludedId) params.push(`excludeIds=${encodeURIComponent(excludedId)}`)
+        const call = await apiCall<{ items?: unknown[] }>(`/api/customers/people?${params.join('&')}`, {
           signal: controller.signal,
         })
         if (!call.ok) {
@@ -72,7 +80,7 @@ export function useEmailDuplicateCheck(
             })
             .filter((entry: EmailDuplicateMatch | null): entry is EmailDuplicateMatch => !!entry)
             .find((entry: EmailDuplicateMatch) => {
-              if (entry.id === recordId) return false
+              if (excludedId && entry.id === excludedId) return false
               return matchMode === 'prefix'
                 ? entry.email.startsWith(normalized)
                 : entry.email === normalized

package/src/modules/devices/AGENTS.md

@@ -23,6 +23,14 @@ delivery logic** (sender, providers, delivery rows, workers live in the `push_no
   — they carry undo snapshots, query-index side effects, and domain events.
 - Treat `push_token` as a secret: **never** include it in list/response field sets. Only
   `push_provider` and `push_token_updated_at` are exposed.
+- Serialize every GET response in **camelCase**, like every other module. The list routes run
+  `transformDeviceListItem` (`api/deviceList.ts`) over the query engine's raw projection and the admin
+  detail route uses `serializeDeviceDetail` (`api/deviceSerialization.ts`). Both also emit the legacy
+  snake_case keys as **deprecated aliases** via `toDeprecatedSnakeCaseAliases`, kept for one minor
+  version per `BACKWARD_COMPATIBILITY.md` § 7 and pinned by `TC-DEV-007`; when the bridge is dropped,
+  remove the alias spread from those two functions and the deprecated keys from `deviceListItemSchema`
+  / `deviceDetailItemSchema`. Adding a column means adding it to `deviceListFields`, the transform, and
+  the schemas. See `.ai/specs/2026-08-24-devices-api-camelcase-responses.md` (#5513).
 - Honor the `pushToken` tri-state on `PUT`: absent key = leave unchanged; explicit `null` = clear
   (revoked OS permission) and bump `push_token_updated_at`. The command uses own-property presence.
 - Keep the list route's CRUD cache tag aligned with the command's `resourceKind`. The list reads

package/src/modules/devices/api/admin/devices/[id]/route.ts

@@ -15,6 +15,8 @@ import { updateDeviceSchema } from '../../../../data/validators'
 import { isOrganizationReadAccessAllowed } from '@open-mercato/core/modules/directory/utils/organizationScopeGuard'
 import { resolveDeviceActorUserId } from '../../../auth'
 import { executeUpdate, executeDeactivate, type DeviceMutationContext } from '../../../deviceOps'
+import { serializeDeviceDetail, deviceDetailItemSchema } from '../../../deviceSerialization'
+import { DEPRECATED_SNAKE_CASE_NOTICE } from '../../../openapi'
 
 const logger = createLogger('devices')
 
@@ -38,23 +40,6 @@ async function loadDevice(
   return findOneWithDecryption(em, UserDevice, { id, tenantId, deletedAt: null }, undefined, { tenantId })
 }
 
-// push_token is a secret and is never returned.
-function serializeDevice(device: UserDevice) {
-  return {
-    id: device.id,
-    user_id: device.userId,
-    device_id: device.deviceId,
-    platform: device.platform,
-    client_app_version: device.clientAppVersion ?? null,
-    os_version: device.osVersion ?? null,
-    push_provider: device.pushProvider ?? null,
-    push_token_updated_at: device.pushTokenUpdatedAt ? device.pushTokenUpdatedAt.toISOString() : null,
-    last_seen_at: device.lastSeenAt ? device.lastSeenAt.toISOString() : null,
-    created_at: device.createdAt ? device.createdAt.toISOString() : null,
-    updated_at: device.updatedAt ? device.updatedAt.toISOString() : null,
-  }
-}
-
 export async function GET(req: Request, { params }: { params: { id: string } }) {
   const { translate } = await resolveTranslations()
   try {
@@ -76,7 +61,7 @@ export async function GET(req: Request, { params }: { params: { id: string } })
     if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId: device.organizationId ?? null })) {
       return NextResponse.json({ error: translate('devices.errors.forbidden', 'Access denied') }, { status: 403 })
     }
-    return NextResponse.json({ item: serializeDevice(device) })
+    return NextResponse.json({ item: serializeDeviceDetail(device) })
   } catch (err) {
     if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status })
@@ -177,21 +162,7 @@ export async function DELETE(req: Request, { params }: { params: { id: string }
 
 const okResponseSchema = z.object({ ok: z.literal(true), id: z.string().uuid().optional() })
 const errorResponseSchema = z.object({ error: z.string() })
-const detailResponseSchema = z.object({
-  item: z.object({
-    id: z.string().uuid(),
-    user_id: z.string().uuid(),
-    device_id: z.string(),
-    platform: z.enum(['ios', 'android', 'web']),
-    client_app_version: z.string().nullable(),
-    os_version: z.string().nullable(),
-    push_provider: z.string().nullable(),
-    push_token_updated_at: z.string().nullable(),
-    last_seen_at: z.string().nullable(),
-    created_at: z.string().nullable(),
-    updated_at: z.string().nullable(),
-  }),
-})
+const detailResponseSchema = z.object({ item: deviceDetailItemSchema })
 
 export const openApi: OpenApiRouteDoc = {
   tag: 'Devices (admin)',
@@ -199,7 +170,7 @@ export const openApi: OpenApiRouteDoc = {
   methods: {
     GET: {
       summary: 'Get any device',
-      description: 'Admin: fetch a single device by id (push_token is never returned).',
+      description: `Admin: fetch a single device by id (push_token is never returned). ${DEPRECATED_SNAKE_CASE_NOTICE}`,
       responses: [{ status: 200, description: 'Device', schema: detailResponseSchema }],
       errors: [
         { status: 400, description: 'Invalid id', schema: errorResponseSchema },

package/src/modules/devices/api/admin/devices/route.ts

@@ -2,6 +2,7 @@ import type { EntityManager } from '@mikro-orm/postgresql'
 import { NextResponse } from 'next/server'
 import { z } from 'zod'
 import { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'
+import { toHeaderLabel } from '@open-mercato/shared/lib/crud/exporters'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
@@ -21,7 +22,14 @@ import {
 } from '../../../data/validators'
 import { resolveDeviceActorUserId } from '../../auth'
 import { createDevicesCrudOpenApi, createPagedListResponseSchema } from '../../openapi'
-import { deviceListSchema, deviceListFields, deviceListSortFieldMap, deviceListItemSchema } from '../../deviceList'
+import {
+  deviceListSchema,
+  deviceListFields,
+  deviceListSortFieldMap,
+  deviceListItemSchema,
+  deviceExportColumnFields,
+  transformDeviceListItem,
+} from '../../deviceList'
 import { executeRegister, type DeviceMutationContext } from '../../deviceOps'
 
 const logger = createLogger('devices')
@@ -55,6 +63,11 @@ const crud = makeCrudRoute({
     entityId: E.devices.user_device,
     fields: deviceListFields,
     sortFieldMap: deviceListSortFieldMap,
+    // The query engine projects raw column names; expose them in camelCase like every other module.
+    transformItem: transformDeviceListItem,
+    // Without an explicit column set the factory's default export spreads each item, so the deprecated
+    // snake_case aliases would double every column in the CSV/JSON/XML export.
+    export: { columns: deviceExportColumnFields.map((field) => ({ field, header: toHeaderLabel(field) })) },
     // Tenant + org scope is enforced by the factory (orm.tenantField + orm.orgField); only the optional
     // userId/platform narrowing is left to do here.
     buildFilters: async (query) => {

package/src/modules/devices/api/deviceList.ts

@@ -30,25 +30,149 @@ export const deviceListFields: string[] = [
   'updated_at',
 ]
 
+// The admin list enables exports, and the factory's default export derives its columns by spreading
+// each item — which would emit both spellings of every aliased key. Pin the canonical camelCase set
+// so the export stays single-spelled and does not change shape when the aliases are dropped.
+export const deviceExportColumnFields: string[] = [
+  'id',
+  'tenantId',
+  'organizationId',
+  'userId',
+  'deviceId',
+  'platform',
+  'clientAppVersion',
+  'osVersion',
+  'locale',
+  'pushProvider',
+  'pushTokenUpdatedAt',
+  'lastSeenAt',
+  'createdAt',
+  'updatedAt',
+]
+
 export const deviceListSortFieldMap: Record<string, string> = {
   lastSeenAt: 'last_seen_at',
   createdAt: 'created_at',
   updatedAt: 'updated_at',
 }
 
+// The query engine projects the raw column names listed in `deviceListFields`. Every other module
+// serializes its list items in camelCase (`sales/orders` → `orderNumber`, `warranty_claims` →
+// `claimNumber`), so the list routes run this transform to expose the platform convention (#5513).
+// The snake_case keys stay alongside as deprecated aliases for one minor version, per the
+// deprecation protocol in BACKWARD_COMPATIBILITY.md § 7 (API Route URLs — response fields).
+export function transformDeviceListItem(item: unknown): unknown {
+  const record = toRecord(item)
+  if (!Object.keys(record).length) return item
+  const camel = {
+    id: readString(record, 'id', 'id'),
+    tenantId: readString(record, 'tenant_id', 'tenantId'),
+    organizationId: readString(record, 'organization_id', 'organizationId'),
+    userId: readString(record, 'user_id', 'userId'),
+    deviceId: readString(record, 'device_id', 'deviceId'),
+    platform: readString(record, 'platform', 'platform'),
+    clientAppVersion: readString(record, 'client_app_version', 'clientAppVersion'),
+    osVersion: readString(record, 'os_version', 'osVersion'),
+    locale: readString(record, 'locale', 'locale'),
+    pushProvider: readString(record, 'push_provider', 'pushProvider'),
+    pushTokenUpdatedAt: toIso(record.push_token_updated_at ?? record.pushTokenUpdatedAt),
+    lastSeenAt: toIso(record.last_seen_at ?? record.lastSeenAt),
+    createdAt: toIso(record.created_at ?? record.createdAt),
+    updatedAt: toIso(record.updated_at ?? record.updatedAt),
+  }
+  // Spread the raw record first so anything the projection carries beyond the declared field set
+  // (custom-field keys, future columns) survives; the aliases then restate the snake_case keys with
+  // the same normalized values as their camelCase counterparts.
+  return { ...record, ...camel, ...toDeprecatedSnakeCaseAliases(camel) }
+}
+
+/**
+ * @deprecated Snake_case device response keys are superseded by the camelCase keys and are removed in
+ * the next minor release. Read `deviceId`, `userId`, `lastSeenAt`, … instead. See UPGRADE_NOTES.md.
+ */
+export function toDeprecatedSnakeCaseAliases(item: DeviceResponseItem): Record<string, unknown> {
+  const aliases: Record<string, unknown> = {
+    tenant_id: item.tenantId,
+    organization_id: item.organizationId,
+    user_id: item.userId,
+    device_id: item.deviceId,
+    client_app_version: item.clientAppVersion,
+    os_version: item.osVersion,
+    push_provider: item.pushProvider,
+    push_token_updated_at: item.pushTokenUpdatedAt,
+    last_seen_at: item.lastSeenAt,
+    created_at: item.createdAt,
+    updated_at: item.updatedAt,
+  }
+  // The detail response never carried tenant/org, so an absent camelCase source must not grow a new
+  // key here — only keys the caller actually supplied get an alias.
+  for (const key of Object.keys(aliases)) {
+    if (aliases[key] === undefined) delete aliases[key]
+  }
+  return aliases
+}
+
+export type DeviceResponseItem = {
+  tenantId?: string | null
+  organizationId?: string | null
+  userId: string | null
+  deviceId: string | null
+  clientAppVersion: string | null
+  osVersion: string | null
+  pushProvider: string | null
+  pushTokenUpdatedAt?: string | null
+  lastSeenAt?: string | null
+  createdAt?: string | null
+  updatedAt: string | null
+}
+
+function toRecord(value: unknown): Record<string, unknown> {
+  return value && typeof value === 'object' && !Array.isArray(value) ? (value as Record<string, unknown>) : {}
+}
+
+function readString(record: Record<string, unknown>, snakeKey: string, camelKey: string): string | null {
+  const value = record[snakeKey] ?? record[camelKey]
+  return typeof value === 'string' ? value : null
+}
+
+export function toIso(value: unknown): string | null {
+  if (value instanceof Date) return Number.isNaN(value.getTime()) ? null : value.toISOString()
+  if (typeof value === 'string') {
+    const date = new Date(value)
+    return Number.isNaN(date.getTime()) ? value : date.toISOString()
+  }
+  return null
+}
+
+// In-code contract markers. The shared zodToJsonSchema converter does not currently emit per-property
+// descriptions for object schemas, so the rendered deprecation notice lives on the endpoint description
+// (`DEPRECATED_SNAKE_CASE_NOTICE` in ./openapi); these become visible for free if that changes.
+const deprecatedAlias = (of: string) => `Deprecated alias for \`${of}\`; removed in the next minor release.`
+
 export const deviceListItemSchema = z.object({
   id: z.string().uuid(),
-  tenant_id: z.string().uuid(),
-  organization_id: z.string().uuid().nullable().optional(),
-  user_id: z.string().uuid(),
-  device_id: z.string(),
+  tenantId: z.string().uuid(),
+  organizationId: z.string().uuid().nullable().optional(),
+  userId: z.string().uuid(),
+  deviceId: z.string(),
   platform: z.enum(['ios', 'android', 'web']),
-  client_app_version: z.string().nullable().optional(),
-  os_version: z.string().nullable().optional(),
+  clientAppVersion: z.string().nullable().optional(),
+  osVersion: z.string().nullable().optional(),
   locale: z.string().nullable().optional(),
-  push_provider: z.string().nullable().optional(),
-  push_token_updated_at: z.string().nullable().optional(),
-  last_seen_at: z.string().nullable().optional(),
-  created_at: z.string().nullable().optional(),
-  updated_at: z.string().nullable().optional(),
+  pushProvider: z.string().nullable().optional(),
+  pushTokenUpdatedAt: z.string().nullable().optional(),
+  lastSeenAt: z.string().nullable().optional(),
+  createdAt: z.string().nullable().optional(),
+  updatedAt: z.string().nullable().optional(),
+  tenant_id: z.string().uuid().describe(deprecatedAlias('tenantId')),
+  organization_id: z.string().uuid().nullable().optional().describe(deprecatedAlias('organizationId')),
+  user_id: z.string().uuid().describe(deprecatedAlias('userId')),
+  device_id: z.string().describe(deprecatedAlias('deviceId')),
+  client_app_version: z.string().nullable().optional().describe(deprecatedAlias('clientAppVersion')),
+  os_version: z.string().nullable().optional().describe(deprecatedAlias('osVersion')),
+  push_provider: z.string().nullable().optional().describe(deprecatedAlias('pushProvider')),
+  push_token_updated_at: z.string().nullable().optional().describe(deprecatedAlias('pushTokenUpdatedAt')),
+  last_seen_at: z.string().nullable().optional().describe(deprecatedAlias('lastSeenAt')),
+  created_at: z.string().nullable().optional().describe(deprecatedAlias('createdAt')),
+  updated_at: z.string().nullable().optional().describe(deprecatedAlias('updatedAt')),
 })

package/src/modules/devices/api/deviceSerialization.ts

@@ -0,0 +1,50 @@
+import { z } from 'zod'
+import type { UserDevice } from '../data/entities'
+import { toDeprecatedSnakeCaseAliases, toIso } from './deviceList'
+
+// Detail contract for `GET /api/devices/admin/devices/:id`. Keys are camelCase like every other
+// module's responses (#5513); the snake_case keys stay alongside as deprecated aliases for one minor
+// version, per the deprecation protocol in BACKWARD_COMPATIBILITY.md § 7.
+// push_token is a secret and is never returned.
+export function serializeDeviceDetail(device: UserDevice): Record<string, unknown> {
+  const camel = {
+    id: device.id,
+    userId: device.userId,
+    deviceId: device.deviceId,
+    platform: device.platform,
+    clientAppVersion: device.clientAppVersion ?? null,
+    osVersion: device.osVersion ?? null,
+    pushProvider: device.pushProvider ?? null,
+    pushTokenUpdatedAt: toIso(device.pushTokenUpdatedAt),
+    lastSeenAt: toIso(device.lastSeenAt),
+    createdAt: toIso(device.createdAt),
+    updatedAt: toIso(device.updatedAt),
+  }
+  return { ...camel, ...toDeprecatedSnakeCaseAliases(camel) }
+}
+
+// See the note in ./deviceList — the rendered deprecation notice lives on the endpoint description.
+const deprecatedAlias = (of: string) => `Deprecated alias for \`${of}\`; removed in the next minor release.`
+
+export const deviceDetailItemSchema = z.object({
+  id: z.string().uuid(),
+  userId: z.string().uuid(),
+  deviceId: z.string(),
+  platform: z.enum(['ios', 'android', 'web']),
+  clientAppVersion: z.string().nullable(),
+  osVersion: z.string().nullable(),
+  pushProvider: z.string().nullable(),
+  pushTokenUpdatedAt: z.string().nullable(),
+  lastSeenAt: z.string().nullable(),
+  createdAt: z.string().nullable(),
+  updatedAt: z.string().nullable(),
+  user_id: z.string().uuid().describe(deprecatedAlias('userId')),
+  device_id: z.string().describe(deprecatedAlias('deviceId')),
+  client_app_version: z.string().nullable().describe(deprecatedAlias('clientAppVersion')),
+  os_version: z.string().nullable().describe(deprecatedAlias('osVersion')),
+  push_provider: z.string().nullable().describe(deprecatedAlias('pushProvider')),
+  push_token_updated_at: z.string().nullable().describe(deprecatedAlias('pushTokenUpdatedAt')),
+  last_seen_at: z.string().nullable().describe(deprecatedAlias('lastSeenAt')),
+  created_at: z.string().nullable().describe(deprecatedAlias('createdAt')),
+  updated_at: z.string().nullable().describe(deprecatedAlias('updatedAt')),
+})

package/src/modules/devices/api/openapi.ts

@@ -12,10 +12,18 @@ export function createPagedListResponseSchema(itemSchema: ZodTypeAny) {
 
 // createCrudOpenApiFactory already falls back to the shared default create/ok response schemas
 // when omitted, so there is nothing module-specific to re-pass or re-export here.
+// The shared zodToJsonSchema converter does not emit per-property descriptions for object schemas, so
+// the `.describe()` markers on the deprecated keys in deviceList.ts never reach the document. State the
+// deprecation in the endpoint description, which does render (#5513).
+export const DEPRECATED_SNAKE_CASE_NOTICE =
+  'Response keys are camelCase. The snake_case keys (`user_id`, `device_id`, `last_seen_at`, …) are ' +
+  'deprecated aliases of their camelCase counterparts, retained for one minor version and removed in ' +
+  'the next; read `userId`, `deviceId`, `lastSeenAt`, … instead.'
+
 const buildDevicesCrudOpenApi = createCrudOpenApiFactory({
   defaultTag: 'Devices',
   makeListDescription: ({ pluralLower }) =>
-    `Returns the authenticated user's registered ${pluralLower} (admins may list across users).`,
+    `Returns the authenticated user's registered ${pluralLower} (admins may list across users). ${DEPRECATED_SNAKE_CASE_NOTICE}`,
 })
 
 export function createDevicesCrudOpenApi(options: CrudOpenApiOptions): OpenApiRouteDoc {

package/src/modules/devices/api/route.ts

@@ -20,7 +20,13 @@ import {
 } from '../data/validators'
 import { resolveDeviceActorUserId } from './auth'
 import { createDevicesCrudOpenApi, createPagedListResponseSchema } from './openapi'
-import { deviceListSchema, deviceListFields, deviceListSortFieldMap, deviceListItemSchema } from './deviceList'
+import {
+  deviceListSchema,
+  deviceListFields,
+  deviceListSortFieldMap,
+  deviceListItemSchema,
+  transformDeviceListItem,
+} from './deviceList'
 import { executeRegister, type DeviceMutationContext } from './deviceOps'
 
 const logger = createLogger('devices')
@@ -59,6 +65,8 @@ const crud = makeCrudRoute({
     // push_token is a secret and is never exposed via the list API.
     fields: deviceListFields,
     sortFieldMap: deviceListSortFieldMap,
+    // The query engine projects raw column names; expose them in camelCase like every other module.
+    transformItem: transformDeviceListItem,
     // Exports are off for the self-serve list. The factory enables them for every list that does not
     // declare `export` (resolveAvailableExportFormats falls back to csv/json/xml/markdown), and its
     // full-export branch replaces the filters with `{}` instead of calling `buildFilters`

package/src/modules/devices/backend/devices/[id]/page.tsx

@@ -12,13 +12,13 @@ import { useT } from '@open-mercato/shared/lib/i18n/context'
 
 type DeviceDetail = {
   id: string
-  user_id: string
-  device_id: string
+  userId: string
+  deviceId: string
   platform: string
-  client_app_version: string | null
-  os_version: string | null
-  push_provider: string | null
-  updated_at: string | null
+  clientAppVersion: string | null
+  osVersion: string | null
+  pushProvider: string | null
+  updatedAt: string | null
 }
 
 type FormValues = {
@@ -65,7 +65,7 @@ export default function DeviceAdminEditPage({ params }: { params?: { id?: string
   // Resolve the owner's display name for a link to their profile. Devices admins may not hold
   // auth.users.list, so fall back to the raw id (rendered without a link) instead of redirecting.
   React.useEffect(() => {
-    const userId = device?.user_id
+    const userId = device?.userId
     if (!userId) return
     let cancelled = false
     void (async () => {
@@ -80,7 +80,7 @@ export default function DeviceAdminEditPage({ params }: { params?: { id?: string
       if (label) setUserLabel(label)
     })()
     return () => { cancelled = true }
-  }, [device?.user_id])
+  }, [device?.userId])
 
   const fields = React.useMemo<CrudField[]>(() => [
     { id: 'clientAppVersion', label: t('devices.form.appVersion'), type: 'text' },
@@ -122,7 +122,7 @@ export default function DeviceAdminEditPage({ params }: { params?: { id?: string
             <dl className="grid grid-cols-1 gap-3 rounded-md border bg-muted p-4 text-sm sm:grid-cols-3">
               <div>
                 <dt className="text-xs font-medium text-muted-foreground">{t('devices.form.deviceId')}</dt>
-                <dd className="mt-1"><code className="text-xs">{device.device_id}</code></dd>
+                <dd className="mt-1"><code className="text-xs">{device.deviceId}</code></dd>
               </div>
               <div>
                 <dt className="text-xs font-medium text-muted-foreground">{t('devices.form.platform')}</dt>
@@ -131,20 +131,20 @@ export default function DeviceAdminEditPage({ params }: { params?: { id?: string
               <div>
                 <dt className="text-xs font-medium text-muted-foreground">{t('devices.form.userId')}</dt>
                 <dd className="mt-1">{userLabel ? (
-                  <Link href={`/backend/users/${encodeURIComponent(device.user_id)}/edit`} className="text-primary hover:underline">{userLabel}</Link>
+                  <Link href={`/backend/users/${encodeURIComponent(device.userId)}/edit`} className="text-primary hover:underline">{userLabel}</Link>
                 ) : (
-                  <code className="text-xs">{device.user_id}</code>
+                  <code className="text-xs">{device.userId}</code>
                 )}</dd>
               </div>
             </dl>
           )}
           fields={fields}
           groups={groups}
-          optimisticLockUpdatedAt={device.updated_at}
+          optimisticLockUpdatedAt={device.updatedAt}
           initialValues={{
-            clientAppVersion: device.client_app_version ?? '',
-            osVersion: device.os_version ?? '',
-            pushProvider: device.push_provider ?? '',
+            clientAppVersion: device.clientAppVersion ?? '',
+            osVersion: device.osVersion ?? '',
+            pushProvider: device.pushProvider ?? '',
           }}
           submitLabel={t('common.save')}
           cancelHref="/backend/devices"

package/src/modules/devices/backend/devices/page.tsx

@@ -15,15 +15,15 @@ import type { FilterDef, FilterValues } from '@open-mercato/ui/backend/FilterBar
 
 type Row = {
   id: string
-  user_id: string
-  device_id: string
+  userId: string
+  deviceId: string
   platform: string
-  client_app_version: string | null
-  os_version: string | null
-  push_provider: string | null
-  push_token_updated_at: string | null
-  last_seen_at: string | null
-  created_at: string | null
+  clientAppVersion: string | null
+  osVersion: string | null
+  pushProvider: string | null
+  pushTokenUpdatedAt: string | null
+  lastSeenAt: string | null
+  createdAt: string | null
 }
 
 type ResponsePayload = {
@@ -184,16 +184,16 @@ export default function DevicesAdminListPage() {
 
   const columns = React.useMemo<ColumnDef<Row>[]>(() => [
     {
-      accessorKey: 'device_id',
+      accessorKey: 'deviceId',
       header: t('devices.list.columns.device'),
-      cell: ({ row }) => <code className="text-xs">{row.original.device_id}</code>,
+      cell: ({ row }) => <code className="text-xs">{row.original.deviceId}</code>,
     },
     { accessorKey: 'platform', header: t('devices.list.columns.platform') },
     {
-      accessorKey: 'user_id',
+      accessorKey: 'userId',
       header: t('devices.list.columns.user'),
       cell: ({ row }) => {
-        const userId = row.original.user_id
+        const userId = row.original.userId
         const label = userLabelById.get(userId)
         return (
           // Stop the click bubbling to the row, whose default action navigates to the device edit page.
@@ -208,24 +208,24 @@ export default function DevicesAdminListPage() {
       },
     },
     {
-      accessorKey: 'client_app_version',
+      accessorKey: 'clientAppVersion',
       header: t('devices.list.columns.appVersion'),
-      cell: ({ row }) => row.original.client_app_version || t('devices.list.noValue'),
+      cell: ({ row }) => row.original.clientAppVersion || t('devices.list.noValue'),
     },
     {
-      accessorKey: 'os_version',
+      accessorKey: 'osVersion',
       header: t('devices.list.columns.osVersion'),
-      cell: ({ row }) => row.original.os_version || t('devices.list.noValue'),
+      cell: ({ row }) => row.original.osVersion || t('devices.list.noValue'),
     },
     {
-      accessorKey: 'push_provider',
+      accessorKey: 'pushProvider',
       header: t('devices.list.columns.pushProvider'),
-      cell: ({ row }) => row.original.push_provider || t('devices.list.noValue'),
+      cell: ({ row }) => row.original.pushProvider || t('devices.list.noValue'),
     },
     {
-      accessorKey: 'last_seen_at',
+      accessorKey: 'lastSeenAt',
       header: t('devices.list.columns.lastSeen'),
-      cell: ({ row }) => formatDate(row.original.last_seen_at, t),
+      cell: ({ row }) => formatDate(row.original.lastSeenAt, t),
     },
   ], [t, userLabelById])
 

package/src/modules/push_notifications/backend/push_notifications/send/page.tsx

@@ -70,7 +70,7 @@ function DeviceField({ value, setValue, setFormValue, values, onState }: CrudCus
     let cancelled = false
     setLoading(true)
     const params = new URLSearchParams({ userId, pageSize: '50' })
-    apiCall<{ items?: Array<{ id: string; device_id: string; platform: string; push_provider?: string | null }> }>(
+    apiCall<{ items?: Array<{ id: string; deviceId: string; platform: string; pushProvider?: string | null }> }>(
       `/api/devices/admin/devices?${params.toString()}`,
       { headers: { 'x-om-forbidden-redirect': '0' } },
       { fallback: null },
@@ -80,9 +80,9 @@ function DeviceField({ value, setValue, setFormValue, values, onState }: CrudCus
         if (cancelled) return
         const items = (call && call.ok ? call.result?.items : []) ?? []
         const opts = items
-          .filter((d): d is { id: string; device_id: string; platform: string; push_provider?: string | null } =>
-            !!d && typeof d.id === 'string' && !!d.push_provider)
-          .map((d) => ({ id: d.id, label: `${d.device_id} · ${d.platform}${d.push_provider ? ` · ${d.push_provider}` : ''}`, platform: d.platform }))
+          .filter((d): d is { id: string; deviceId: string; platform: string; pushProvider?: string | null } =>
+            !!d && typeof d.id === 'string' && !!d.pushProvider)
+          .map((d) => ({ id: d.id, label: `${d.deviceId} · ${d.platform}${d.pushProvider ? ` · ${d.pushProvider}` : ''}`, platform: d.platform }))
         setDevices(opts)
         if (selected && !opts.some((o) => o.id === selected)) setValue('')
       })