admin · customers · security · breaking-change Xentr staff now have a work-focused Overview, a searchable list-first customer directory, and a consistent customer workspace. Global navigation stays in place while each customer opens Overview, Factories, Machines, People, Setup, and Billing views. A map remains available when saved locations are useful; setup and connectivity are never inferred from machine counts. Customer loading now has the API routes it needs. Authorization failures, unavailable records, and temporary service errors have distinct states, and cached customer details are hidden until access is confirmed for the current visit. Factory selection and invitation actions retain their customer context. Machine transfers create a fresh registration at the destination rather than moving operational history. The original registration is retired, its history stays with the source factory, and the destination must be reconnected. Active work and ownership conflicts block unsafe transfers.
Technical details
- Root and pnpm workspace versions advance together to 1.0.1 because the machine mutation and invitation response contracts change. The independent edge projects are not part of this version sequence. - Generic machine PATCH requests no longer accept factoryId. Use POST /api/factories/{sourceFactorySlug}/machines/{machineId}/transfer with destinationFactoryId (a factory slug), destinationCode, reason, and a UUID requestId. An exact retry returns the same destination registration; a different payload needs a new request ID. - Organization administrators can transfer only within the source organization. Xentr account managers must be assigned to both customers for a cross-customer transfer. Current authority is checked inside the transaction after locks are acquired. - DELETE /api/factories/{factorySlug}/machines/{machineId} is staff-only retirement, not historical deletion. A transferred source cannot be reactivated or enrolled again. Edge configuration excludes inactive, unknown-activity, and transferred registrations, with content-aware cache validation. - Invitation lists return management metadata, not invitation tokens. - Customer collection routes and location updates enforce current membership or staff assignment. Mutations preserve their audit records atomically. - The product machine editor uses the same explicit transfer contract. Source and destination collection, machine, and audit caches are invalidated after successful changes. - Collection cell components keep stable identities during background refreshes so action menus and keyboard focus are not discarded. The list owns its keyboard-scroll region, long customer names stay clear of actions on mobile, and optional map instructions match the new workspace navigation. - Deploy the API to both production and staging before promoting the staff frontend. No database migration or new environment variable is required. The staff /api/version endpoint exposes its version and build commit for deployment verification. - CI builds the staff app and runs the customer authorization, location, and machine lifecycle regressions against an isolated PostgreSQL test database. OpenAPI and generated API reference pages accompany this release.
