@haneinfo/assignment 0.4.2 → 0.5.0

package/README.md

@@ -1,33 +1,63 @@
-# @haneinfo/assignment
-
-See [agent-guide.md](agent-guide.md) for integration details.
-
-## Instance readers and stored query values
-
-Every task creation (including initial-state entry, later rounds and self-entry) grants its
-assignee permanent read access to that instance in the same transaction. Assignment injects the
-state-machine-owned `StateMachineReaderGrants` service instead of writing another package's table.
-It requires state-machine 0.6 or later and the App's reader-table migration/backfill. OPEN,
-RESPONDED, CLOSED and CANCELLED tasks all retain their reader grants; there is no revoke operation.
-The grant is instance-specific and covers comments, following, lists and exports.
-
-After creating the reader table, Apps must backfill every existing task, regardless of status:
-
-```sql
-INSERT INTO state_machine_instance_readers (instance_id, user_id, reason)
-SELECT DISTINCT instance_id, assignee_id, 'ASSIGNED'
-FROM assignment_tasks
-ON CONFLICT (instance_id, user_id) DO NOTHING;
-```
-
-## Date comparisons
-
-GT/GTE/LT/LTE compare numbers, valid calendar dates (YYYY-MM-DD), or timezone-qualified datetimes
-(YYYY-MM-DDTHH:mm:ss with optional fractional seconds and Z or +/-HH:mm). Both operands must have
-the same category. Dates use calendar order; datetimes compare UTC instants at millisecond precision.
-Invalid dates, mixed categories and empty operands yield false. EQ/NEQ/IN retain strict scalar equality;
-matching instants with different textual offsets are still unequal for those operators.
-
-## Instance privacy boundary
-
-Task reads and responses first check task ownership and return identical TASK_NOT_FOUND/404 for another person's or a missing task. Every assignee receives a permanent state-machine reader grant on task creation, so the internal runtime snapshot read is restricted to an already authorized reader. `tasksOf` is a trusted internal API, not an HTTP/MCP instance lookup. USER transitions outside task responses apply state-machine's read-before-write checks; Assignment triggers keep their existing authorization.
+# @haneinfo/assignment
+
+See [agent-guide.md](agent-guide.md) for integration details.
+
+## Instance readers and stored query values
+
+Every task creation (including initial-state entry, later rounds and self-entry) grants its
+assignee permanent read access to that instance in the same transaction. Assignment injects the
+state-machine-owned `StateMachineReaderGrants` service instead of writing another package's table.
+It requires state-machine 0.6 or later and the App's reader-table migration/backfill. OPEN,
+RESPONDED, CLOSED and CANCELLED tasks all retain their reader grants; there is no revoke operation.
+The grant is instance-specific and covers comments, following, lists and exports.
+
+After creating the reader table, Apps must backfill every existing task, regardless of status:
+
+```sql
+INSERT INTO state_machine_instance_readers (instance_id, user_id, reason)
+SELECT DISTINCT instance_id, assignee_id, 'ASSIGNED'
+FROM assignment_tasks
+ON CONFLICT (instance_id, user_id) DO NOTHING;
+```
+
+## Date comparisons
+
+GT/GTE/LT/LTE compare numbers, valid calendar dates (YYYY-MM-DD), or timezone-qualified datetimes
+(YYYY-MM-DDTHH:mm:ss with optional fractional seconds and Z or +/-HH:mm). Both operands must have
+the same category. Dates use calendar order; datetimes compare UTC instants at millisecond precision.
+Invalid dates, mixed categories and empty operands yield false. EQ/NEQ/IN retain strict scalar equality;
+matching instants with different textual offsets are still unequal for those operators.
+
+## Instance privacy boundary
+
+Task reads and responses first check task ownership and return identical TASK_NOT_FOUND/404 for another person's or a missing task. Every assignee receives a permanent state-machine reader grant on task creation, so the internal runtime snapshot read is restricted to an already authorized reader. `tasksOf` is a trusted internal API, not an HTTP/MCP instance lookup. USER transitions outside task responses apply state-machine's read-before-write checks; Assignment triggers keep their existing authorization.
+
+## Period delegation (draft implementation)
+
+With the optional delegation resolver, original tasks remain and delegates receive separate tasks
+with nullable onBehalfOfId and delegationId. Proxy titles start with [Delegate]. Task creation grants
+permanent instance readership in the same transaction. No resolver means the existing behavior.
+Migrate the two nullable assignment_tasks columns before deploying; no backfill of those columns is
+needed for older tasks. Upgrade state-machine for optional actingUserId/onBehalfOfId history output.
+
+ANY_ONE/SINGLE completes on the first original or delegated response. JOINT counts one vote per
+original assignee; the first response closes that vote's other tasks and does not add votes. A
+proxy never expands into another proxy. A delegate already present in the round is not duplicated;
+when several originals share a delegate, deterministic delegation-id order picks one represented
+original. Other originals keep their own required votes.
+
+Delegation registers internal effects for immediate, idempotent backfill of original OPEN tasks and
+transactional revocation cancellation. Future periods do not backfill tasks open before the start.
+Expired OPEN proxy tasks are hidden in GET /assignments/mine and list_my_assignments; a response
+commits CANCELLED and then raises DELEGATION_ENDED/409. Revocation cancels OPEN proxies in its own
+transaction. Permanent readers survive both. GET /assignments/:id returns no response choices for
+an expired OPEN proxy. Task ownership still hides other people's tasks as TASK_NOT_FOUND/404.
+
+Task reads add optional onBehalfOfId and onBehalfOfName. Names use one authorized-page batch through
+identity-store.findActiveNamesByIds; missing/inactive/older providers yield null. MCP names are
+$userContent. A successful proxy response records actual actingUserId, and notifies the original
+with assignment-response:<taskId>. Appointment notifications belong to delegation; task notification
+keys remain assignment:<taskId>. Missing inbox capability skips notifications as before.
+
+See @haneinfo/delegation's agent guide for period rules, human management and read-only MCP. There
+is no MCP response, creation, revocation, per-task reassignment or delegation frontend.

package/agent-guide.md

@@ -1,146 +1,176 @@
-# @haneinfo/assignment — Agent Guide
-
-## Purpose
-
-The assignment mechanism (decision `202610-00b3`, first batch; details in its own decision). An
-`Assignment` definition says: when an instance of a StateMachine **enters a state**, these people
-get a task, and their **response takes a transition**. It covers approvals, read-and-acknowledge
-steps and task hand-offs.
-
-```json
-{
-  "kind": "Assignment",
-  "schemaVersion": 1,
-  "metadata": { "code": "equipment-manager-approval", "name": "Approve equipment loan" },
-  "spec": {
-    "stateMachine": { "kind": "StateMachine", "code": "equipment-loan-flow" },
-    "onEnter": "SUBMITTED",
-    "assignees": [{ "type": "ROLE", "role": "EQUIPMENT_MANAGER" }],
-    "policy": "ANY_ONE",
-    "responses": [
-      { "key": "approve", "label": "Approve", "transition": "approve" },
-      { "key": "reject", "label": "Reject", "transition": "reject" }
-    ],
-    "dueIn": "P2D"
-  }
-}
-```
-
-## When to use it, and when not
-
-Use it whenever a person must act before a business object moves on. Do not use it for plain
-notifications (that is a Timer `NOTIFY` action or the notification inbox) or for decisions a rule
-could make (use a CHOICE state).
-
-## Kind and example definition
-
-- `stateMachine`, `onEnter`: the machine and the state that opens the tasks. Not a FINAL or CHOICE state.
-- `assignees`: person resolvers — `SPECIFIC_USER` (`userIds`), `ROLE` (role machine name, resolved
-  through RBAC), `FORM_FIELD_USER` (a `user_select` field of the machine's subject Form, by id),
-  `SUBMITTER`, `DIRECT_SUPERVISOR`, `DEPARTMENT_HEAD`, `DIVISION_HEAD` (the last three require org-directory). Resolving to nobody makes the transition into `onEnter` fail with
-  `ASSIGNEE_UNRESOLVED` — fix the role membership or the field.
-- `policy`: `ANY_ONE` (first response decides; use it for roles), `SINGLE` (same, but you expect
-  exactly one person — a warning if the resolvers can produce several), `JOINT` (everybody must give
-  the one non-`decisive` response; one `decisive` response — e.g. reject — decides at once).
-- `responses[]`: `key`, `label`, `transition` (must leave `onEnter`), `decisive` (JOINT only).
-- `dueIn`: ISO 8601 duration (`P2D`, `PT4H`); it only sets the task's due time. What happens when
-  it passes is a Timer with an `ASSIGNMENT_DUE` anchor.
-- `title`: shown to the assignees; defaults to `metadata.name`.
-- Permissions: `assignment:definition:read|write|publish`.
-
-Instances pin the published assignments of their machine when they start; re-entering the state
-opens a new round. Leaving the state any other way (a Timer, a person) cancels open tasks.
-
-Self-transitions also cancel the old round before opening the next. A deciding response leaves
-the responding task `RESPONDED` and other open tasks `CLOSED`; an external state change uses
-`CANCELLED`. PostgreSQL responses lock the instance before reading/writing the round, so concurrent
-JOINT votes see committed earlier votes. Round evaluation reads every task, without a 500-row cap.
-
-Example: `examples/definitions/equipment-loan/equipment-manager-approval.assignment.json`.
-
-## MCP tools
-
-| Tool | Scope | Use |
-| --- | --- | --- |
-| `list_my_assignments` | `<namespace>:assignment:read` (read only) | Tasks of the person the connection acts for, with responses and instance data (as `$userContent`) |
-
-There is no tool to respond: a response takes a transition (approve, reject) and stays a human
-step in the App. Register from the App: `assignmentMcpTools.registerInto(registry, { scopeNamespace })`.
-
-The scope is required at listing and invocation by the MCP host. No definition-read permission is
-required to see your own tasks: the acting user must own them. The client cannot select another
-user. Invalid status input returns `INVALID_INPUT`; a credential without an acting user is refused.
-
-## HTTP API (people)
-
-| Route | Purpose |
-| --- | --- |
-| `GET /assignments/mine?status=OPEN` | Your tasks |
-| `GET /assignments/:id` | One of your tasks with the instance |
-| `POST /assignments/:id/respond` `{ response, comment? }` | Respond; may take the transition |
-
-## Events
-
-`assignment.opened` (`assignmentCode`, `round`, `dueAt`, `assigneeIds`) and `assignment.closed`
-(`assignmentCode`, `round`, `outcome`: the response key or `CANCELLED`), on the state-machine
-runtime's event channel. Timer uses them for `ASSIGNMENT_DUE`.
-
-## Adapters
-
-None. Roles resolve through `haneinfo.rbac-policy` (`userIdsWithRole`); assignees are notified through
-`haneinfo.notification-inbox` when it is installed.
-
-## Common error codes and fixes
-
-| Code | Fix |
-| --- | --- |
-| `UNKNOWN_STATE` / `ASSIGNMENT_ON_FINAL_STATE` | `onEnter` must be a non-FINAL state of the machine |
-| `UNKNOWN_TRANSITION` / `TRANSITION_NOT_FROM_STATE` | A response's transition must leave `onEnter` |
-| `JOINT_NEEDS_ONE_AGREEMENT` | Mark all but one JOINT response as `decisive` |
-| `SINGLE_MAY_RESOLVE_MANY` (warning) | Use `ANY_ONE` for roles |
-| `NOT_A_USER_FIELD` / `NO_SUBJECT_FORM` | `FORM_FIELD_USER` needs a `user_select` field of the subject Form |
-| `INVALID_DURATION` | `dueIn` is a positive duration without months or years |
-| `ASSIGNEE_UNRESOLVED` (runtime) | The resolvers produced nobody; see `details.unresolved` |
-| `TASK_NOT_OPEN` (runtime) | Someone else already decided, or the instance moved on |
-
-## Conditional activation
-
-Optional spec.when uses the shared Form evaluateCondition function and PREDICATE/GROUP syntax,
-including CONTEXT SUBMITTER_ID. False skips this assignment with no tasks or notifications and does
-not block other transitions, even when every assignment is skipped. Empty inputs are errors.
-
-The prepareStateEntry listener fixes when and assignee results before entry writes. Each matching
-assignment resolves its people once and uses that exact result to open tasks. Any unresolved resolver
-blocks entry, including partially resolved lists; details.unresolved preserves organization reasons
-and unit information. A CHOICE stays in CHOICE and records/notifies the failure; other transitions
-roll back to their original state and report the failure. Existing tasks keep their assignees.
-
-## Instance readers and stored query values
-
-Every task creation (including initial-state entry, later rounds and self-entry) grants its
-assignee permanent read access to that instance in the same transaction. Assignment injects the
-state-machine-owned `StateMachineReaderGrants` service instead of writing another package's table.
-It requires state-machine 0.6 or later and the App's reader-table migration/backfill. OPEN,
-RESPONDED, CLOSED and CANCELLED tasks all retain their reader grants; there is no revoke operation.
-The grant is instance-specific and covers comments, following, lists and exports.
-
-After creating the reader table, Apps must backfill every existing task, regardless of status:
-
-```sql
-INSERT INTO state_machine_instance_readers (instance_id, user_id, reason)
-SELECT DISTINCT instance_id, assignee_id, 'ASSIGNED'
-FROM assignment_tasks
-ON CONFLICT (instance_id, user_id) DO NOTHING;
-```
-
-## Date comparisons
-
-GT/GTE/LT/LTE compare numbers, valid calendar dates (YYYY-MM-DD), or timezone-qualified datetimes
-(YYYY-MM-DDTHH:mm:ss with optional fractional seconds and Z or +/-HH:mm). Both operands must have
-the same category. Dates use calendar order; datetimes compare UTC instants at millisecond precision.
-Invalid dates, mixed categories and empty operands yield false. EQ/NEQ/IN retain strict scalar equality;
-matching instants with different textual offsets are still unequal for those operators.
-
-## Instance privacy boundary
-
-Task reads and responses first check task ownership and return identical TASK_NOT_FOUND/404 for another person's or a missing task. Every assignee receives a permanent state-machine reader grant on task creation, so the internal runtime snapshot read is restricted to an already authorized reader. `tasksOf` is a trusted internal API, not an HTTP/MCP instance lookup. USER transitions outside task responses apply state-machine's read-before-write checks; Assignment triggers keep their existing authorization.
+# @haneinfo/assignment — Agent Guide
+
+## Purpose
+
+The assignment mechanism (decision `202610-00b3`, first batch; details in its own decision). An
+`Assignment` definition says: when an instance of a StateMachine **enters a state**, these people
+get a task, and their **response takes a transition**. It covers approvals, read-and-acknowledge
+steps and task hand-offs.
+
+```json
+{
+  "kind": "Assignment",
+  "schemaVersion": 1,
+  "metadata": { "code": "equipment-manager-approval", "name": "Approve equipment loan" },
+  "spec": {
+    "stateMachine": { "kind": "StateMachine", "code": "equipment-loan-flow" },
+    "onEnter": "SUBMITTED",
+    "assignees": [{ "type": "ROLE", "role": "EQUIPMENT_MANAGER" }],
+    "policy": "ANY_ONE",
+    "responses": [
+      { "key": "approve", "label": "Approve", "transition": "approve" },
+      { "key": "reject", "label": "Reject", "transition": "reject" }
+    ],
+    "dueIn": "P2D"
+  }
+}
+```
+
+## When to use it, and when not
+
+Use it whenever a person must act before a business object moves on. Do not use it for plain
+notifications (that is a Timer `NOTIFY` action or the notification inbox) or for decisions a rule
+could make (use a CHOICE state).
+
+## Kind and example definition
+
+- `stateMachine`, `onEnter`: the machine and the state that opens the tasks. Not a FINAL or CHOICE state.
+- `assignees`: person resolvers — `SPECIFIC_USER` (`userIds`), `ROLE` (role machine name, resolved
+  through RBAC), `FORM_FIELD_USER` (a `user_select` field of the machine's subject Form, by id),
+  `SUBMITTER`, `DIRECT_SUPERVISOR`, `DEPARTMENT_HEAD`, `DIVISION_HEAD` (the last three require org-directory). Resolving to nobody makes the transition into `onEnter` fail with
+  `ASSIGNEE_UNRESOLVED` — fix the role membership or the field.
+- `policy`: `ANY_ONE` (first response decides; use it for roles), `SINGLE` (same, but you expect
+  exactly one person — a warning if the resolvers can produce several), `JOINT` (everybody must give
+  the one non-`decisive` response; one `decisive` response — e.g. reject — decides at once).
+- `responses[]`: `key`, `label`, `transition` (must leave `onEnter`), `decisive` (JOINT only).
+- `dueIn`: ISO 8601 duration (`P2D`, `PT4H`); it only sets the task's due time. What happens when
+  it passes is a Timer with an `ASSIGNMENT_DUE` anchor.
+- `title`: shown to the assignees; defaults to `metadata.name`.
+- Permissions: `assignment:definition:read|write|publish`.
+
+Instances pin the published assignments of their machine when they start; re-entering the state
+opens a new round. Leaving the state any other way (a Timer, a person) cancels open tasks.
+
+Self-transitions also cancel the old round before opening the next. A deciding response leaves
+the responding task `RESPONDED` and other open tasks `CLOSED`; an external state change uses
+`CANCELLED`. PostgreSQL responses lock the instance before reading/writing the round, so concurrent
+JOINT votes see committed earlier votes. Round evaluation reads every task, without a 500-row cap.
+
+Example: `examples/definitions/equipment-loan/equipment-manager-approval.assignment.json`.
+
+## MCP tools
+
+| Tool | Scope | Use |
+| --- | --- | --- |
+| `list_my_assignments` | `<namespace>:assignment:read` (read only) | Tasks of the person the connection acts for, with responses and instance data (as `$userContent`) |
+
+There is no tool to respond: a response takes a transition (approve, reject) and stays a human
+step in the App. Register from the App: `assignmentMcpTools.registerInto(registry, { scopeNamespace })`.
+
+The scope is required at listing and invocation by the MCP host. No definition-read permission is
+required to see your own tasks: the acting user must own them. The client cannot select another
+user. Invalid status input returns `INVALID_INPUT`; a credential without an acting user is refused.
+
+## HTTP API (people)
+
+| Route | Purpose |
+| --- | --- |
+| `GET /assignments/mine?status=OPEN` | Your tasks |
+| `GET /assignments/:id` | One of your tasks with the instance |
+| `POST /assignments/:id/respond` `{ response, comment? }` | Respond; may take the transition |
+
+## Events
+
+`assignment.opened` (`assignmentCode`, `round`, `dueAt`, `assigneeIds`) and `assignment.closed`
+(`assignmentCode`, `round`, `outcome`: the response key or `CANCELLED`), on the state-machine
+runtime's event channel. Timer uses them for `ASSIGNMENT_DUE`.
+
+## Adapters
+
+None. Roles resolve through `haneinfo.rbac-policy` (`userIdsWithRole`); assignees are notified through
+`haneinfo.notification-inbox` when it is installed.
+
+## Common error codes and fixes
+
+| Code | Fix |
+| --- | --- |
+| `UNKNOWN_STATE` / `ASSIGNMENT_ON_FINAL_STATE` | `onEnter` must be a non-FINAL state of the machine |
+| `UNKNOWN_TRANSITION` / `TRANSITION_NOT_FROM_STATE` | A response's transition must leave `onEnter` |
+| `JOINT_NEEDS_ONE_AGREEMENT` | Mark all but one JOINT response as `decisive` |
+| `SINGLE_MAY_RESOLVE_MANY` (warning) | Use `ANY_ONE` for roles |
+| `NOT_A_USER_FIELD` / `NO_SUBJECT_FORM` | `FORM_FIELD_USER` needs a `user_select` field of the subject Form |
+| `INVALID_DURATION` | `dueIn` is a positive duration without months or years |
+| `ASSIGNEE_UNRESOLVED` (runtime) | The resolvers produced nobody; see `details.unresolved` |
+| `TASK_NOT_OPEN` (runtime) | Someone else already decided, or the instance moved on |
+
+## Conditional activation
+
+Optional spec.when uses the shared Form evaluateCondition function and PREDICATE/GROUP syntax,
+including CONTEXT SUBMITTER_ID. False skips this assignment with no tasks or notifications and does
+not block other transitions, even when every assignment is skipped. Empty inputs are errors.
+
+The prepareStateEntry listener fixes when and assignee results before entry writes. Each matching
+assignment resolves its people once and uses that exact result to open tasks. Any unresolved resolver
+blocks entry, including partially resolved lists; details.unresolved preserves organization reasons
+and unit information. A CHOICE stays in CHOICE and records/notifies the failure; other transitions
+roll back to their original state and report the failure. Existing tasks keep their assignees.
+
+## Instance readers and stored query values
+
+Every task creation (including initial-state entry, later rounds and self-entry) grants its
+assignee permanent read access to that instance in the same transaction. Assignment injects the
+state-machine-owned `StateMachineReaderGrants` service instead of writing another package's table.
+It requires state-machine 0.6 or later and the App's reader-table migration/backfill. OPEN,
+RESPONDED, CLOSED and CANCELLED tasks all retain their reader grants; there is no revoke operation.
+The grant is instance-specific and covers comments, following, lists and exports.
+
+After creating the reader table, Apps must backfill every existing task, regardless of status:
+
+```sql
+INSERT INTO state_machine_instance_readers (instance_id, user_id, reason)
+SELECT DISTINCT instance_id, assignee_id, 'ASSIGNED'
+FROM assignment_tasks
+ON CONFLICT (instance_id, user_id) DO NOTHING;
+```
+
+## Date comparisons
+
+GT/GTE/LT/LTE compare numbers, valid calendar dates (YYYY-MM-DD), or timezone-qualified datetimes
+(YYYY-MM-DDTHH:mm:ss with optional fractional seconds and Z or +/-HH:mm). Both operands must have
+the same category. Dates use calendar order; datetimes compare UTC instants at millisecond precision.
+Invalid dates, mixed categories and empty operands yield false. EQ/NEQ/IN retain strict scalar equality;
+matching instants with different textual offsets are still unequal for those operators.
+
+## Instance privacy boundary
+
+Task reads and responses first check task ownership and return identical TASK_NOT_FOUND/404 for another person's or a missing task. Every assignee receives a permanent state-machine reader grant on task creation, so the internal runtime snapshot read is restricted to an already authorized reader. `tasksOf` is a trusted internal API, not an HTTP/MCP instance lookup. USER transitions outside task responses apply state-machine's read-before-write checks; Assignment triggers keep their existing authorization.
+
+## Period delegation (draft implementation)
+
+With the optional delegation resolver, original tasks remain and delegates receive separate tasks
+with nullable onBehalfOfId and delegationId. Proxy titles start with [Delegate]. Task creation grants
+permanent instance readership in the same transaction. No resolver means the existing behavior.
+Migrate the two nullable assignment_tasks columns before deploying; no backfill of those columns is
+needed for older tasks. Upgrade state-machine for optional actingUserId/onBehalfOfId history output.
+
+ANY_ONE/SINGLE completes on the first original or delegated response. JOINT counts one vote per
+original assignee; the first response closes that vote's other tasks and does not add votes. A
+proxy never expands into another proxy. A delegate already present in the round is not duplicated;
+when several originals share a delegate, deterministic delegation-id order picks one represented
+original. Other originals keep their own required votes.
+
+Delegation registers internal effects for immediate, idempotent backfill of original OPEN tasks and
+transactional revocation cancellation. Future periods do not backfill tasks open before the start.
+Expired OPEN proxy tasks are hidden in GET /assignments/mine and list_my_assignments; a response
+commits CANCELLED and then raises DELEGATION_ENDED/409. Revocation cancels OPEN proxies in its own
+transaction. Permanent readers survive both. GET /assignments/:id returns no response choices for
+an expired OPEN proxy. Task ownership still hides other people's tasks as TASK_NOT_FOUND/404.
+
+Task reads add optional onBehalfOfId and onBehalfOfName. Names use one authorized-page batch through
+identity-store.findActiveNamesByIds; missing/inactive/older providers yield null. MCP names are
+$userContent. A successful proxy response records actual actingUserId, and notifies the original
+with assignment-response:<taskId>. Appointment notifications belong to delegation; task notification
+keys remain assignment:<taskId>. Missing inbox capability skips notifications as before.
+
+See @haneinfo/delegation's agent guide for period rules, human management and read-only MCP. There
+is no MCP response, creation, revocation, per-task reassignment or delegation frontend.

package/dist/assignment.controller.d.ts

@@ -11,6 +11,7 @@ export declare class AssignmentController {
     respond(user: InteractivePrincipal, id: string, body: unknown): Promise<{
         completed: boolean;
         task: {
+            actingUserId: string;
             status: "RESPONDED";
             response: string;
             comment: string | null;
@@ -21,6 +22,8 @@ export declare class AssignmentController {
             assignmentVersion: number;
             round: number;
             assigneeId: string;
+            onBehalfOfId?: string | null;
+            delegationId?: string | null;
             title: string;
             dueAt: Date | null;
             createdAt: Date;
@@ -29,6 +32,7 @@ export declare class AssignmentController {
     } | {
         completed: boolean;
         task: {
+            actingUserId: string;
             status: "RESPONDED";
             response: string;
             comment: string | null;
@@ -39,6 +43,8 @@ export declare class AssignmentController {
             assignmentVersion: number;
             round: number;
             assigneeId: string;
+            onBehalfOfId?: string | null;
+            delegationId?: string | null;
             title: string;
             dueAt: Date | null;
             createdAt: Date;

package/dist/assignment.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assignment.controller.d.ts","sourceRoot":"","sources":["../src/assignment.controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,oBAAoB,EAAkB,MAAM,sBAAsB,CAAC;AAajF,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAwBzD,0GAA0G;AAC1G,qBAEa,oBAAoB;IACnB,OAAO,CAAC,QAAQ,CAAC,WAAW;gBAAX,WAAW,EAAE,iBAAiB;IAG3D,IAAI,CAAgB,IAAI,EAAE,oBAAoB,EAAW,KAAK,EAAE,OAAO;;;IAUvE,GAAG,CAAgB,IAAI,EAAE,oBAAoB,EAAe,EAAE,EAAE,MAAM;IAKtE,OAAO,CACU,IAAI,EAAE,oBAAoB,EAC5B,EAAE,EAAE,MAAM,EACf,IAAI,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYxB"}
+{"version":3,"file":"assignment.controller.d.ts","sourceRoot":"","sources":["../src/assignment.controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,oBAAoB,EAAkB,MAAM,sBAAsB,CAAC;AAajF,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAwBzD,0GAA0G;AAC1G,qBAEa,oBAAoB;IACnB,OAAO,CAAC,QAAQ,CAAC,WAAW;gBAAX,WAAW,EAAE,iBAAiB;IAG3D,IAAI,CAAgB,IAAI,EAAE,oBAAoB,EAAW,KAAK,EAAE,OAAO;;;IAUvE,GAAG,CAAgB,IAAI,EAAE,oBAAoB,EAAe,EAAE,EAAE,MAAM;IAKtE,OAAO,CACU,IAAI,EAAE,oBAAoB,EAC5B,EAAE,EAAE,MAAM,EACf,IAAI,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYxB"}

package/dist/assignment.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assignment.module.d.ts","sourceRoot":"","sources":["../src/assignment.module.ts"],"names":[],"mappings":"AACA,OAAO,EAAuB,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACxF,OAAO,EAA8B,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAQ/E,qBACa,0BAA2B,YAAW,YAAY;IACpB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,sBAAsB;IAE1F,YAAY;CAGb;AAED,qBAca,gBAAgB;CAAG"}
+{"version":3,"file":"assignment.module.d.ts","sourceRoot":"","sources":["../src/assignment.module.ts"],"names":[],"mappings":"AACA,OAAO,EAAuB,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACxF,OAAO,EAA8B,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAQ/E,qBACa,0BAA2B,YAAW,YAAY;IACpB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,sBAAsB;IAE1F,YAAY;CAGb;AAED,qBAea,gBAAgB;CAAG"}

package/dist/assignment.module.js

@@ -43,6 +43,7 @@ exports.AssignmentModule = AssignmentModule = __decorate([
     (0, common_2.Module)({
         controllers: [assignment_controller_1.AssignmentController],
         providers: [
+            { provide: assignment_service_1.ASSIGNMENT_CLOCK, useValue: () => new Date() },
             AssignmentKindRegistration,
             {
                 provide: store_1.ASSIGNMENT_STORE,

package/dist/assignment.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"assignment.module.js","sourceRoot":"","sources":["../src/assignment.module.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,6CAAiD;AACjD,qDAAwF;AACxF,2CAA+E;AAC/E,mEAA+D;AAC/D,6DAAyD;AACzD,iCAAkD;AAClD,2CAAiD;AACjD,iDAAuD;AACvD,mCAA2C;AAGpC,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IACrC,YAA0D,QAAgC;QAAhC,aAAQ,GAAR,QAAQ,CAAwB;IAAG,CAAC;IAE9F,YAAY;QACV,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,+BAAwB,CAAC,CAAC;IACvD,CAAC;CACF,CAAA;AANY,gEAA0B;qCAA1B,0BAA0B;IADtC,IAAA,mBAAU,GAAE;IAEE,WAAA,IAAA,eAAM,EAAC,gCAAmB,CAAC,CAAA;;GAD7B,0BAA0B,CAMtC;AAgBM,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;CAAG,CAAA;AAAnB,4CAAgB;2BAAhB,gBAAgB;IAd5B,IAAA,eAAM,EAAC;QACN,WAAW,EAAE,CAAC,4CAAoB,CAAC;QACnC,SAAS,EAAE;YACT,0BAA0B;YAC1B;gBACE,OAAO,EAAE,wBAAgB;gBACzB,UAAU,EAAE,CAAC,MAAqB,EAAE,EAAE,CAAC,IAAI,oCAAqB,CAAC,MAAM,CAAC;gBACxE,MAAM,EAAE,CAAC,sBAAa,CAAC;aACxB;YACD,sCAAiB;YACjB,8BAAkB;SACnB;QACD,OAAO,EAAE,CAAC,sCAAiB,EAAE,8BAAkB,CAAC;KACjD,CAAC;GACW,gBAAgB,CAAG"}
+{"version":3,"file":"assignment.module.js","sourceRoot":"","sources":["../src/assignment.module.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,6CAAiD;AACjD,qDAAwF;AACxF,2CAA+E;AAC/E,mEAA+D;AAC/D,6DAA2E;AAC3E,iCAAkD;AAClD,2CAAiD;AACjD,iDAAuD;AACvD,mCAA2C;AAGpC,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IACrC,YAA0D,QAAgC;QAAhC,aAAQ,GAAR,QAAQ,CAAwB;IAAG,CAAC;IAE9F,YAAY;QACV,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,+BAAwB,CAAC,CAAC;IACvD,CAAC;CACF,CAAA;AANY,gEAA0B;qCAA1B,0BAA0B;IADtC,IAAA,mBAAU,GAAE;IAEE,WAAA,IAAA,eAAM,EAAC,gCAAmB,CAAC,CAAA;;GAD7B,0BAA0B,CAMtC;AAiBM,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;CAAG,CAAA;AAAnB,4CAAgB;2BAAhB,gBAAgB;IAf5B,IAAA,eAAM,EAAC;QACN,WAAW,EAAE,CAAC,4CAAoB,CAAC;QACnC,SAAS,EAAE;YACT,EAAE,OAAO,EAAE,qCAAgB,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,EAAE;YACzD,0BAA0B;YAC1B;gBACE,OAAO,EAAE,wBAAgB;gBACzB,UAAU,EAAE,CAAC,MAAqB,EAAE,EAAE,CAAC,IAAI,oCAAqB,CAAC,MAAM,CAAC;gBACxE,MAAM,EAAE,CAAC,sBAAa,CAAC;aACxB;YACD,sCAAiB;YACjB,8BAAkB;SACnB;QACD,OAAO,EAAE,CAAC,sCAAiB,EAAE,8BAAkB,CAAC;KACjD,CAAC;GACW,gBAAgB,CAAG"}

package/dist/assignment.service.d.ts

@@ -10,7 +10,7 @@
  * transaction, with an ASSIGNMENT trigger (which skips the transition's person permission: the
  * assignment itself is the authorization).
  */
-import { type DefinitionRegistryPort, type NotificationInboxPort, type OrgDirectoryPort, type RbacPolicyPort, type StateMachineInstanceView, type StateMachineListener, type StateMachineRuntimePort } from '@haneinfo/plugin-api';
+import { type DefinitionRegistryPort, type DelegationMatch, type DelegationResolverPort, type IdentityStorePort, type NotificationInboxPort, type OrgDirectoryPort, type RbacPolicyPort, type StateMachineInstanceView, type StateMachineListener, type StateMachineRuntimePort } from '@haneinfo/plugin-api';
 import { StateMachineReaderGrants } from '@haneinfo/state-machine';
 import { type OnModuleInit } from '@nestjs/common';
 import { type AssignmentStore, type TaskRecord } from './store';
@@ -18,6 +18,8 @@ import type { AssignmentResponse, AssignmentSpec } from './types';
 export declare const ASSIGNMENT_CLOCK: unique symbol;
 export declare const ASSIGNMENT_APP_NAME: unique symbol;
 export interface AssignmentTaskView extends TaskRecord {
+    onBehalfOfName?: string | null;
+    actingUserId?: string;
     responses: Pick<AssignmentResponse, 'key' | 'label'>[];
     policy: AssignmentSpec['policy'];
     instance: Pick<StateMachineInstanceView, 'id' | 'machine' | 'state' | 'data' | 'submitterId' | 'revision'> | null;
@@ -31,15 +33,25 @@ export declare class AssignmentService implements OnModuleInit {
     private readonly notifications?;
     private readonly appName;
     private readonly orgDirectory?;
+    private readonly delegation?;
+    private readonly identity?;
     private readonly now;
     private readonly preparedEntries;
     readonly listener: StateMachineListener;
-    constructor(store: AssignmentStore, runtime: StateMachineRuntimePort, registry: DefinitionRegistryPort, readerGrants: StateMachineReaderGrants, rbac?: RbacPolicyPort | undefined, notifications?: NotificationInboxPort | undefined, clock?: () => Date, appName?: string, orgDirectory?: OrgDirectoryPort | undefined);
+    constructor(store: AssignmentStore, runtime: StateMachineRuntimePort, registry: DefinitionRegistryPort, readerGrants: StateMachineReaderGrants, rbac?: RbacPolicyPort | undefined, notifications?: NotificationInboxPort | undefined, clock?: () => Date, appName?: string, orgDirectory?: OrgDirectoryPort | undefined, delegation?: DelegationResolverPort | undefined, identity?: IdentityStorePort | undefined);
     onModuleInit(): void;
     private pin;
     private prepareEntry;
     private cancelOpen;
     private open;
+    private notifyTasks;
+    private expandDelegations;
+    /** Called inside delegation creation; instance locks make retries idempotent. */
+    backfillDelegation(delegation: DelegationMatch, tx: unknown): Promise<void>;
+    /** Joins revocation's transaction. CAS and row locks serialize cancellation with responses. */
+    prepareDelegationRevocation(delegationId: string, tx: unknown): Promise<void>;
+    cancelDelegation(delegationId: string, tx: unknown): Promise<void>;
+    private delegationActive;
     /** A person responds to their task. Human interface only (decision 202610-00b3, point 16 by analogy). */
     respond(input: {
         taskId: string;
@@ -49,6 +61,7 @@ export declare class AssignmentService implements OnModuleInit {
     }): Promise<{
         completed: boolean;
         task: {
+            actingUserId: string;
             status: "RESPONDED";
             response: string;
             comment: string | null;
@@ -59,6 +72,8 @@ export declare class AssignmentService implements OnModuleInit {
             assignmentVersion: number;
             round: number;
             assigneeId: string;
+            onBehalfOfId?: string | null;
+            delegationId?: string | null;
             title: string;
             dueAt: Date | null;
             createdAt: Date;
@@ -67,6 +82,7 @@ export declare class AssignmentService implements OnModuleInit {
     } | {
         completed: boolean;
         task: {
+            actingUserId: string;
             status: "RESPONDED";
             response: string;
             comment: string | null;
@@ -77,6 +93,8 @@ export declare class AssignmentService implements OnModuleInit {
             assignmentVersion: number;
             round: number;
             assigneeId: string;
+            onBehalfOfId?: string | null;
+            delegationId?: string | null;
             title: string;
             dueAt: Date | null;
             createdAt: Date;
@@ -91,6 +109,7 @@ export declare class AssignmentService implements OnModuleInit {
     getMine(userId: string, taskId: string): Promise<AssignmentTaskView>;
     /** Every task of an instance, for its history view. */
     tasksOf(instanceId: string, tx?: unknown): Promise<TaskRecord[]>;
+    private withNames;
     private view;
 }
 //# sourceMappingURL=assignment.service.d.ts.map

package/dist/assignment.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assignment.service.d.ts","sourceRoot":"","sources":["../src/assignment.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAEL,KAAK,sBAAsB,EAG3B,KAAK,qBAAqB,EAE1B,KAAK,gBAAgB,EAGrB,KAAK,cAAc,EAGnB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC7B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAsB,KAAK,YAAY,EAAY,MAAM,gBAAgB,CAAC;AAEjF,OAAO,EAEL,KAAK,eAAe,EAGpB,KAAK,UAAU,EAChB,MAAM,SAAS,CAAC;AACjB,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAElE,eAAO,MAAM,gBAAgB,eAA0C,CAAC;AACxE,eAAO,MAAM,mBAAmB,eAA6C,CAAC;AAE9E,MAAM,WAAW,kBAAmB,SAAQ,UAAU;IACpD,SAAS,EAAE,IAAI,CAAC,kBAAkB,EAAE,KAAK,GAAG,OAAO,CAAC,EAAE,CAAC;IACvD,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IACjC,QAAQ,EAAE,IAAI,CACZ,wBAAwB,EACxB,IAAI,GAAG,SAAS,GAAG,OAAO,GAAG,MAAM,GAAG,aAAa,GAAG,UAAU,CACjE,GAAG,IAAI,CAAC;CACV;AAED,qBACa,iBAAkB,YAAW,YAAY;IAqBxB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACjB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAC1B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACpB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;IACf,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAE9B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IA5BnE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAgD;IAEhF,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAcrC;gBAG2C,KAAK,EAAE,eAAe,EACjB,OAAO,EAAE,uBAAuB,EAClC,QAAQ,EAAE,sBAAsB,EAC3B,YAAY,EAAE,wBAAwB,EACvC,IAAI,CAAC,EAAE,cAAc,YAAA,EACd,aAAa,CAAC,EAAE,qBAAqB,YAAA,EACxD,KAAK,CAAC,EAAE,MAAM,IAAI,EACE,OAAO,GAAE,MAAc,EAC7B,YAAY,CAAC,EAAE,gBAAgB,YAAA;IAKrF,YAAY;YAME,GAAG;YAaH,YAAY;YA0CZ,UAAU;YAmBV,IAAI;IAkElB,yGAAyG;IACnG,OAAO,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAgHrF,QAAQ,CACZ,MAAM,EAAE,MAAM,EACd,MAAM,GAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,SAAkB,GAChD,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAO1B,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAS1E,uDAAuD;IACjD,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,OAAO;YAIhC,IAAI;CA4BnB"}
+{"version":3,"file":"assignment.service.d.ts","sourceRoot":"","sources":["../src/assignment.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAGL,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAE3B,KAAK,iBAAiB,EAGtB,KAAK,qBAAqB,EAE1B,KAAK,gBAAgB,EAGrB,KAAK,cAAc,EAGnB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC7B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAsB,KAAK,YAAY,EAAY,MAAM,gBAAgB,CAAC;AAEjF,OAAO,EAEL,KAAK,eAAe,EAGpB,KAAK,UAAU,EAChB,MAAM,SAAS,CAAC;AACjB,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAElE,eAAO,MAAM,gBAAgB,eAA0C,CAAC;AACxE,eAAO,MAAM,mBAAmB,eAA6C,CAAC;AAE9E,MAAM,WAAW,kBAAmB,SAAQ,UAAU;IACpD,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,IAAI,CAAC,kBAAkB,EAAE,KAAK,GAAG,OAAO,CAAC,EAAE,CAAC;IACvD,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IACjC,QAAQ,EAAE,IAAI,CACZ,wBAAwB,EACxB,IAAI,GAAG,SAAS,GAAG,OAAO,GAAG,MAAM,GAAG,aAAa,GAAG,UAAU,CACjE,GAAG,IAAI,CAAC;CACV;AAED,qBACa,iBAAkB,YAAW,YAAY;IAqBxB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACjB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAC1B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACpB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;IACf,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAE9B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IACxB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IA9BhE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAgD;IAEhF,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAcrC;gBAG2C,KAAK,EAAE,eAAe,EACjB,OAAO,EAAE,uBAAuB,EAClC,QAAQ,EAAE,sBAAsB,EAC3B,YAAY,EAAE,wBAAwB,EACvC,IAAI,CAAC,EAAE,cAAc,YAAA,EACd,aAAa,CAAC,EAAE,qBAAqB,YAAA,EACxD,KAAK,CAAC,EAAE,MAAM,IAAI,EACE,OAAO,GAAE,MAAc,EAC7B,YAAY,CAAC,EAAE,gBAAgB,YAAA,EACzB,UAAU,CAAC,EAAE,sBAAsB,YAAA,EACxC,QAAQ,CAAC,EAAE,iBAAiB,YAAA;IAKnF,YAAY;YAWE,GAAG;YAaH,YAAY;YA0CZ,UAAU;YAmBV,IAAI;YA8CJ,WAAW;YAwBX,iBAAiB;IAgD/B,iFAAiF;IAC3E,kBAAkB,CAAC,UAAU,EAAE,eAAe,EAAE,EAAE,EAAE,OAAO;IAuCjE,+FAA+F;IACzF,2BAA2B,CAAC,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO;IAQ7D,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO;YAQ1C,gBAAgB;IAmB9B,yGAAyG;IACnG,OAAO,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA2JrF,QAAQ,CACZ,MAAM,EAAE,MAAM,EACd,MAAM,GAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,SAAkB,GAChD,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAa1B,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAW1E,uDAAuD;IACjD,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,OAAO;YAIhC,SAAS;YAcT,IAAI;CAgCnB"}