@objectstack/plugin-approvals 16.0.0-rc.0 → 16.0.0-rc.1

package/.turbo/turbo-build.log

@@ -1,5 +1,5 @@
 
-> @objectstack/plugin-approvals@16.0.0-rc.0 build /home/runner/work/framework/framework/packages/plugins/plugin-approvals
+> @objectstack/plugin-approvals@16.0.0-rc.1 build /home/runner/work/framework/framework/packages/plugins/plugin-approvals
 > tsup --config ../../../tsup.config.ts
 
 CLI Building entry: src/index.ts
@@ -10,13 +10,13 @@
 CLI Cleaning output folder
 ESM Build start
 CJS Build start
-CJS dist/index.js     157.00 KB
-CJS dist/index.js.map 274.68 KB
-CJS ⚡️ Build success in 322ms
-ESM dist/index.mjs     155.17 KB
-ESM dist/index.mjs.map 273.43 KB
-ESM ⚡️ Build success in 327ms
+ESM dist/index.mjs     156.89 KB
+ESM dist/index.mjs.map 275.84 KB
+ESM ⚡️ Build success in 231ms
+CJS dist/index.js     158.72 KB
+CJS dist/index.js.map 277.08 KB
+CJS ⚡️ Build success in 235ms
 DTS Build start
-DTS ⚡️ Build success in 26515ms
-DTS dist/index.d.mts 417.29 KB
-DTS dist/index.d.ts  417.29 KB
+DTS ⚡️ Build success in 21940ms
+DTS dist/index.d.mts 418.30 KB
+DTS dist/index.d.ts  418.30 KB

package/CHANGELOG.md

@@ -1,5 +1,68 @@
 # @objectstack/plugin-approvals
 
+## 16.0.0-rc.1
+
+### Minor Changes
+
+- e412fb6: feat(approvals): declare file attachments on approve/reject decisions
+
+  The declared `approval_approve` / `approval_reject` actions on
+  `sys_approval_request` gain an optional multi-file `attachments` param
+  (`type: 'file'`, `multiple`). The console renders `type:'file'` action params
+  through the shared upload widget (objectui ADR-0059) and POSTs the resolved
+  `attachments: string[]`, so a reviewer can attach supporting files to a
+  decision through the generic declared-action dialog — letting the approvals
+  inbox retire its hand-wired attachment composer (objectui#2698).
+
+  Purely additive metadata: the decision route already forwards
+  `body.attachments` to `ApprovalService.decide`, and the
+  `sys_approval_action.attachments` column (file, multiple) already persists them
+  (#3266/#3274). No service or route change.
+
+- 8efa395: feat(approvals): server-computed `viewer` capability for precise decision-action gating
+
+  `getRequest` / `listRequests` now attach a per-viewer block —
+  `viewer: { can_act, is_submitter }` — computed from the caller's context
+  (`ApprovalRequestRow.viewer`):
+
+  - `can_act` — the caller is a _current pending approver_ (their user id is in the
+    request's resolved `pending_approvers` while it is still `pending`). This is
+    the same check the decision methods authorize with, so it already reflects
+    position/team/manager resolution — strictly more accurate than a client-side
+    identity guess.
+  - `is_submitter` — the caller submitted the request.
+
+  The declared decision actions on `sys_approval_request` now gate on it: approver
+  actions (approve/reject/reassign/send-back/request-info) use
+  `record.viewer.can_act`; submitter levers (remind/recall/resubmit) use
+  `record.viewer.is_submitter`. Previously approver actions only trimmed the
+  non-pending case, so a submitter viewing their own pending request saw buttons
+  they couldn't use (the backend 403'd); a position-addressed approver could be
+  wrongly hidden by the old client heuristic. Where `viewer` is absent (a row
+  surfaced outside a service read with a user context), the predicate fails closed.
+
+### Patch Changes
+
+- 62a2117: **Split the overloaded `managedBy: 'system'` bucket with an explicit `engine-owned` value (ADR-0103 addendum, #3343).** ADR-0103 deferred the enum split ("revisitable later as a rename") because a new `managedBy` value would fall through to the fully-editable `platform` default on deployed Console clients. Both reasons against it are now retired — the server-side write guard / `apiMethods` reconciliation / `/me/permissions` clamp make that fallthrough cosmetic (the write is rejected regardless of what the client renders), and objectui#2712 closed the UI union — so v16 lands it, **additively**.
+
+  - **New enum value `engine-owned`** with the same all-locked default affordance row as `system` (`create/import/edit/delete: false`, `exportCsv: true`). It joins `ENGINE_OWNED_BUCKETS` (the engine write guard) and `GUARDED_WRITE_BUCKETS` (the `/me/permissions` clamp); the guard, `reconcileManagedApiMethods`, and the clamp mechanisms are unchanged — `engine-owned` is an explicit member of the set they already covered by resolved affordance.
+  - **20 objects relabelled `system → engine-owned`** — the ones the engine owns end to end and that declared no write-opening `userActions` (the metadata store, jobs, approval runtime rows, sharing rows, `sys_automation_run`, the messaging delivery/receipt pipeline, `sys_secret`, settings). One-line, behaviour-identical per object.
+  - **8 admin/user-writable objects keep `managedBy: 'system'`** (the RBAC link tables, `sys_user_preference`, `sys_approval_delegation`, the messaging config grids) — `system` now reads as "engine-managed schema, writable via `userActions`".
+
+  Behaviour-, enforcement- and wire-identical: resolved affordances, the guard verdict, the 405 `apiMethods` reconciliation, and the permissions clamp are the same before and after — this is a self-documenting relabel, not a policy change. No data migration (`managedBy` is schema metadata) and no code branches on the `'system'` literal. Retiring the overloaded `system` entirely (moving the 8 writable objects to a dedicated bucket) is a breaking rename deferred to v17.
+
+- Updated dependencies [6289ec3]
+- Updated dependencies [8efa395]
+- Updated dependencies [bfa3c3f]
+- Updated dependencies [7125007]
+- Updated dependencies [62a2117]
+- Updated dependencies [06ff734]
+  - @objectstack/spec@16.0.0-rc.1
+  - @objectstack/platform-objects@16.0.0-rc.1
+  - @objectstack/formula@16.0.0-rc.1
+  - @objectstack/metadata-core@16.0.0-rc.1
+  - @objectstack/core@16.0.0-rc.1
+
 ## 16.0.0-rc.0
 
 ### Minor Changes

package/dist/index.d.mts

@@ -220,7 +220,7 @@ declare const SysApprovalRequest: Omit<{
     pluralLabel?: string | undefined;
     description?: string | undefined;
     icon?: string | undefined;
-    managedBy?: "platform" | "system" | "config" | "append-only" | "better-auth" | undefined;
+    managedBy?: "platform" | "system" | "config" | "engine-owned" | "append-only" | "better-auth" | undefined;
     ownership?: "none" | "org" | "user" | undefined;
     userActions?: {
         create?: boolean | undefined;
@@ -833,7 +833,7 @@ declare const SysApprovalRequest: Omit<{
     readonly pluralLabel: "Approval Requests";
     readonly icon: "inbox";
     readonly isSystem: true;
-    readonly managedBy: "system";
+    readonly managedBy: "engine-owned";
     readonly description: "Live approval instance tracked per submission";
     readonly displayNameField: "id";
     readonly nameField: "id";
@@ -3349,8 +3349,14 @@ declare const SysApprovalRequest: Omit<{
             readonly label: "Comment";
             readonly type: "textarea";
             readonly required: false;
+        }, {
+            readonly name: "attachments";
+            readonly label: "Attachments";
+            readonly type: "file";
+            readonly multiple: true;
+            readonly required: false;
         }];
-        readonly visible: "record.status == \"pending\"";
+        readonly visible: "record.viewer.can_act";
         readonly locations: ["record_section", "list_item"];
         readonly successMessage: "Approved.";
         readonly refreshAfter: true;
@@ -3366,8 +3372,14 @@ declare const SysApprovalRequest: Omit<{
             readonly label: "Comment";
             readonly type: "textarea";
             readonly required: false;
+        }, {
+            readonly name: "attachments";
+            readonly label: "Attachments";
+            readonly type: "file";
+            readonly multiple: true;
+            readonly required: false;
         }];
-        readonly visible: "record.status == \"pending\"";
+        readonly visible: "record.viewer.can_act";
         readonly confirmText: "Reject this request? A rejection is final for every approver.";
         readonly locations: ["record_section", "list_item"];
         readonly successMessage: "Rejected.";
@@ -3391,7 +3403,7 @@ declare const SysApprovalRequest: Omit<{
             readonly type: "textarea";
             readonly required: false;
         }];
-        readonly visible: "record.status == \"pending\"";
+        readonly visible: "record.viewer.can_act";
         readonly locations: ["record_section"];
         readonly successMessage: "Reassigned.";
         readonly refreshAfter: true;
@@ -3408,7 +3420,7 @@ declare const SysApprovalRequest: Omit<{
             readonly type: "textarea";
             readonly required: false;
         }];
-        readonly visible: "record.status == \"pending\"";
+        readonly visible: "record.viewer.can_act";
         readonly locations: ["record_section"];
         readonly successMessage: "Sent back for revision.";
         readonly refreshAfter: true;
@@ -3425,7 +3437,7 @@ declare const SysApprovalRequest: Omit<{
             readonly type: "textarea";
             readonly required: true;
         }];
-        readonly visible: "record.status == \"pending\"";
+        readonly visible: "record.viewer.can_act";
         readonly locations: ["record_section"];
         readonly successMessage: "Information requested.";
         readonly refreshAfter: true;
@@ -3442,7 +3454,7 @@ declare const SysApprovalRequest: Omit<{
             readonly type: "textarea";
             readonly required: false;
         }];
-        readonly visible: "record.status == \"pending\" && record.submitter_id == ctx.user.id";
+        readonly visible: "record.status == \"pending\" && record.viewer.is_submitter";
         readonly locations: ["record_section"];
         readonly successMessage: "Reminder sent.";
         readonly refreshAfter: true;
@@ -3459,7 +3471,7 @@ declare const SysApprovalRequest: Omit<{
             readonly type: "textarea";
             readonly required: false;
         }];
-        readonly visible: "(record.status == \"pending\" || record.status == \"returned\") && record.submitter_id == ctx.user.id";
+        readonly visible: "(record.status == \"pending\" || record.status == \"returned\") && record.viewer.is_submitter";
         readonly confirmText: "Recall this request? Approvers can no longer act on it and the record is unlocked.";
         readonly locations: ["record_section"];
         readonly successMessage: "Recalled.";
@@ -3477,7 +3489,7 @@ declare const SysApprovalRequest: Omit<{
             readonly type: "textarea";
             readonly required: false;
         }];
-        readonly visible: "record.status == \"returned\" && record.submitter_id == ctx.user.id";
+        readonly visible: "record.status == \"returned\" && record.viewer.is_submitter";
         readonly locations: ["record_section"];
         readonly successMessage: "Resubmitted.";
         readonly refreshAfter: true;
@@ -3694,7 +3706,7 @@ declare const SysApprovalAction: Omit<{
     pluralLabel?: string | undefined;
     description?: string | undefined;
     icon?: string | undefined;
-    managedBy?: "platform" | "system" | "config" | "append-only" | "better-auth" | undefined;
+    managedBy?: "platform" | "system" | "config" | "engine-owned" | "append-only" | "better-auth" | undefined;
     ownership?: "none" | "org" | "user" | undefined;
     userActions?: {
         create?: boolean | undefined;
@@ -5940,7 +5952,7 @@ declare const SysApprovalApprover: Omit<{
     pluralLabel?: string | undefined;
     description?: string | undefined;
     icon?: string | undefined;
-    managedBy?: "platform" | "system" | "config" | "append-only" | "better-auth" | undefined;
+    managedBy?: "platform" | "system" | "config" | "engine-owned" | "append-only" | "better-auth" | undefined;
     ownership?: "none" | "org" | "user" | undefined;
     userActions?: {
         create?: boolean | undefined;
@@ -6553,7 +6565,7 @@ declare const SysApprovalApprover: Omit<{
     readonly pluralLabel: "Approval Approvers";
     readonly icon: "users";
     readonly isSystem: true;
-    readonly managedBy: "system";
+    readonly managedBy: "engine-owned";
     readonly description: "Normalized pending-approver rows for indexed inbox queries";
     readonly displayNameField: "id";
     readonly nameField: "id";
@@ -7457,7 +7469,7 @@ declare const SysApprovalDelegation: Omit<{
     pluralLabel?: string | undefined;
     description?: string | undefined;
     icon?: string | undefined;
-    managedBy?: "platform" | "system" | "config" | "append-only" | "better-auth" | undefined;
+    managedBy?: "platform" | "system" | "config" | "engine-owned" | "append-only" | "better-auth" | undefined;
     ownership?: "none" | "org" | "user" | undefined;
     userActions?: {
         create?: boolean | undefined;
@@ -9780,6 +9792,16 @@ declare class ApprovalService implements IApprovalService {
      * Display-only and best-effort — errors leave the row untouched.
      */
     private attachDecisionProgress;
+    /**
+     * Attach the per-viewer capability block (#3310) from the caller's context.
+     * `can_act` mirrors the exact authorization the decision methods enforce — the
+     * caller's user id is in the resolved `pending_approvers` while the request is
+     * still `pending` (position/team/manager approvers are already resolved to
+     * concrete user ids at open time, so a plain membership test is faithful).
+     * `is_submitter` is a straight owner check. System/tokenless contexts get a
+     * both-false block. Cheap + synchronous — safe on list reads.
+     */
+    private attachViewers;
     /**
      * Derive approval-step progress from the owning flow's graph (single-read
      * enrichment only — list reads skip it). Walks from the start node

package/dist/index.d.ts

@@ -220,7 +220,7 @@ declare const SysApprovalRequest: Omit<{
     pluralLabel?: string | undefined;
     description?: string | undefined;
     icon?: string | undefined;
-    managedBy?: "platform" | "system" | "config" | "append-only" | "better-auth" | undefined;
+    managedBy?: "platform" | "system" | "config" | "engine-owned" | "append-only" | "better-auth" | undefined;
     ownership?: "none" | "org" | "user" | undefined;
     userActions?: {
         create?: boolean | undefined;
@@ -833,7 +833,7 @@ declare const SysApprovalRequest: Omit<{
     readonly pluralLabel: "Approval Requests";
     readonly icon: "inbox";
     readonly isSystem: true;
-    readonly managedBy: "system";
+    readonly managedBy: "engine-owned";
     readonly description: "Live approval instance tracked per submission";
     readonly displayNameField: "id";
     readonly nameField: "id";
@@ -3349,8 +3349,14 @@ declare const SysApprovalRequest: Omit<{
             readonly label: "Comment";
             readonly type: "textarea";
             readonly required: false;
+        }, {
+            readonly name: "attachments";
+            readonly label: "Attachments";
+            readonly type: "file";
+            readonly multiple: true;
+            readonly required: false;
         }];
-        readonly visible: "record.status == \"pending\"";
+        readonly visible: "record.viewer.can_act";
         readonly locations: ["record_section", "list_item"];
         readonly successMessage: "Approved.";
         readonly refreshAfter: true;
@@ -3366,8 +3372,14 @@ declare const SysApprovalRequest: Omit<{
             readonly label: "Comment";
             readonly type: "textarea";
             readonly required: false;
+        }, {
+            readonly name: "attachments";
+            readonly label: "Attachments";
+            readonly type: "file";
+            readonly multiple: true;
+            readonly required: false;
         }];
-        readonly visible: "record.status == \"pending\"";
+        readonly visible: "record.viewer.can_act";
         readonly confirmText: "Reject this request? A rejection is final for every approver.";
         readonly locations: ["record_section", "list_item"];
         readonly successMessage: "Rejected.";
@@ -3391,7 +3403,7 @@ declare const SysApprovalRequest: Omit<{
             readonly type: "textarea";
             readonly required: false;
         }];
-        readonly visible: "record.status == \"pending\"";
+        readonly visible: "record.viewer.can_act";
         readonly locations: ["record_section"];
         readonly successMessage: "Reassigned.";
         readonly refreshAfter: true;
@@ -3408,7 +3420,7 @@ declare const SysApprovalRequest: Omit<{
             readonly type: "textarea";
             readonly required: false;
         }];
-        readonly visible: "record.status == \"pending\"";
+        readonly visible: "record.viewer.can_act";
         readonly locations: ["record_section"];
         readonly successMessage: "Sent back for revision.";
         readonly refreshAfter: true;
@@ -3425,7 +3437,7 @@ declare const SysApprovalRequest: Omit<{
             readonly type: "textarea";
             readonly required: true;
         }];
-        readonly visible: "record.status == \"pending\"";
+        readonly visible: "record.viewer.can_act";
         readonly locations: ["record_section"];
         readonly successMessage: "Information requested.";
         readonly refreshAfter: true;
@@ -3442,7 +3454,7 @@ declare const SysApprovalRequest: Omit<{
             readonly type: "textarea";
             readonly required: false;
         }];
-        readonly visible: "record.status == \"pending\" && record.submitter_id == ctx.user.id";
+        readonly visible: "record.status == \"pending\" && record.viewer.is_submitter";
         readonly locations: ["record_section"];
         readonly successMessage: "Reminder sent.";
         readonly refreshAfter: true;
@@ -3459,7 +3471,7 @@ declare const SysApprovalRequest: Omit<{
             readonly type: "textarea";
             readonly required: false;
         }];
-        readonly visible: "(record.status == \"pending\" || record.status == \"returned\") && record.submitter_id == ctx.user.id";
+        readonly visible: "(record.status == \"pending\" || record.status == \"returned\") && record.viewer.is_submitter";
         readonly confirmText: "Recall this request? Approvers can no longer act on it and the record is unlocked.";
         readonly locations: ["record_section"];
         readonly successMessage: "Recalled.";
@@ -3477,7 +3489,7 @@ declare const SysApprovalRequest: Omit<{
             readonly type: "textarea";
             readonly required: false;
         }];
-        readonly visible: "record.status == \"returned\" && record.submitter_id == ctx.user.id";
+        readonly visible: "record.status == \"returned\" && record.viewer.is_submitter";
         readonly locations: ["record_section"];
         readonly successMessage: "Resubmitted.";
         readonly refreshAfter: true;
@@ -3694,7 +3706,7 @@ declare const SysApprovalAction: Omit<{
     pluralLabel?: string | undefined;
     description?: string | undefined;
     icon?: string | undefined;
-    managedBy?: "platform" | "system" | "config" | "append-only" | "better-auth" | undefined;
+    managedBy?: "platform" | "system" | "config" | "engine-owned" | "append-only" | "better-auth" | undefined;
     ownership?: "none" | "org" | "user" | undefined;
     userActions?: {
         create?: boolean | undefined;
@@ -5940,7 +5952,7 @@ declare const SysApprovalApprover: Omit<{
     pluralLabel?: string | undefined;
     description?: string | undefined;
     icon?: string | undefined;
-    managedBy?: "platform" | "system" | "config" | "append-only" | "better-auth" | undefined;
+    managedBy?: "platform" | "system" | "config" | "engine-owned" | "append-only" | "better-auth" | undefined;
     ownership?: "none" | "org" | "user" | undefined;
     userActions?: {
         create?: boolean | undefined;
@@ -6553,7 +6565,7 @@ declare const SysApprovalApprover: Omit<{
     readonly pluralLabel: "Approval Approvers";
     readonly icon: "users";
     readonly isSystem: true;
-    readonly managedBy: "system";
+    readonly managedBy: "engine-owned";
     readonly description: "Normalized pending-approver rows for indexed inbox queries";
     readonly displayNameField: "id";
     readonly nameField: "id";
@@ -7457,7 +7469,7 @@ declare const SysApprovalDelegation: Omit<{
     pluralLabel?: string | undefined;
     description?: string | undefined;
     icon?: string | undefined;
-    managedBy?: "platform" | "system" | "config" | "append-only" | "better-auth" | undefined;
+    managedBy?: "platform" | "system" | "config" | "engine-owned" | "append-only" | "better-auth" | undefined;
     ownership?: "none" | "org" | "user" | undefined;
     userActions?: {
         create?: boolean | undefined;
@@ -9780,6 +9792,16 @@ declare class ApprovalService implements IApprovalService {
      * Display-only and best-effort — errors leave the row untouched.
      */
     private attachDecisionProgress;
+    /**
+     * Attach the per-viewer capability block (#3310) from the caller's context.
+     * `can_act` mirrors the exact authorization the decision methods enforce — the
+     * caller's user id is in the resolved `pending_approvers` while the request is
+     * still `pending` (position/team/manager approvers are already resolved to
+     * concrete user ids at open time, so a plain membership test is faithful).
+     * `is_submitter` is a straight owner check. System/tokenless contexts get a
+     * both-false block. Cheap + synchronous — safe on list reads.
+     */
+    private attachViewers;
     /**
      * Derive approval-step progress from the owning flow's graph (single-read
      * enrichment only — list reads skip it). Walks from the start node

package/dist/index.js

@@ -880,7 +880,7 @@ var SysApprovalRequest = import_data.ObjectSchema.create({
   pluralLabel: "Approval Requests",
   icon: "inbox",
   isSystem: true,
-  managedBy: "system",
+  managedBy: "engine-owned",
   description: "Live approval instance tracked per submission",
   displayNameField: "id",
   nameField: "id",
@@ -1068,8 +1068,12 @@ var SysApprovalRequest = import_data.ObjectSchema.create({
   // (and their params) ship as metadata, not as hand-written buttons. Each
   // targets the existing approvals REST route; `{id}` resolves from the row
   // and `actorId` defaults to the caller server-side. The service remains the
-  // authority on who may act (pending-approver check) — `visible` only trims
-  // the obvious non-pending case.
+  // authority on who may act; `visible` gates on the server-computed
+  // per-viewer block (#3310): approver actions on `record.viewer.can_act`
+  // (the caller is a current pending approver — same check the service
+  // authorizes a decision with, so position/team approvers resolve correctly),
+  // submitter actions on `record.viewer.is_submitter`. `viewer` is attached by
+  // getRequest/listRequests; where it is absent the predicate fails closed.
   actions: [
     {
       name: "approval_approve",
@@ -1079,9 +1083,13 @@ var SysApprovalRequest = import_data.ObjectSchema.create({
       method: "POST",
       target: "/api/v1/approvals/requests/{id}/approve",
       params: [
-        { name: "comment", label: "Comment", type: "textarea", required: false }
+        { name: "comment", label: "Comment", type: "textarea", required: false },
+        // Decision attachments (#3266). The console renders `type:'file'` params
+        // through the shared upload widget and POSTs the resolved `attachments:
+        // string[]`; the decision route persists them on `sys_approval_action`.
+        { name: "attachments", label: "Attachments", type: "file", multiple: true, required: false }
       ],
-      visible: 'record.status == "pending"',
+      visible: "record.viewer.can_act",
       locations: ["record_section", "list_item"],
       successMessage: "Approved.",
       refreshAfter: true
@@ -1094,9 +1102,10 @@ var SysApprovalRequest = import_data.ObjectSchema.create({
       method: "POST",
       target: "/api/v1/approvals/requests/{id}/reject",
       params: [
-        { name: "comment", label: "Comment", type: "textarea", required: false }
+        { name: "comment", label: "Comment", type: "textarea", required: false },
+        { name: "attachments", label: "Attachments", type: "file", multiple: true, required: false }
       ],
-      visible: 'record.status == "pending"',
+      visible: "record.viewer.can_act",
       confirmText: "Reject this request? A rejection is final for every approver.",
       locations: ["record_section", "list_item"],
       successMessage: "Rejected.",
@@ -1118,15 +1127,15 @@ var SysApprovalRequest = import_data.ObjectSchema.create({
         { field: "submitter_id", name: "to", label: "New approver", required: true, helpText: "User to hand this step to" },
         { name: "comment", label: "Comment", type: "textarea", required: false }
       ],
-      visible: 'record.status == "pending"',
+      visible: "record.viewer.can_act",
       locations: ["record_section"],
       successMessage: "Reassigned.",
       refreshAfter: true
     },
     // ── Approver secondary decisions ────────────────────────────────
     // Send back for revision / request more info (ADR-0044). Both are approver
-    // actions on a pending request; the service is the authority on who may act,
-    // so `visible` only trims the non-pending case (matching approve/reject).
+    // actions, so `visible` gates on `record.viewer.can_act` (a current pending
+    // approver) — same as approve/reject. The service stays the authority.
     {
       name: "approval_send_back",
       label: "Send back",
@@ -1137,7 +1146,7 @@ var SysApprovalRequest = import_data.ObjectSchema.create({
       params: [
         { name: "comment", label: "Reason", type: "textarea", required: false }
       ],
-      visible: 'record.status == "pending"',
+      visible: "record.viewer.can_act",
       locations: ["record_section"],
       successMessage: "Sent back for revision.",
       refreshAfter: true
@@ -1152,17 +1161,17 @@ var SysApprovalRequest = import_data.ObjectSchema.create({
       params: [
         { name: "comment", label: "What do you need?", type: "textarea", required: true }
       ],
-      visible: 'record.status == "pending"',
+      visible: "record.viewer.can_act",
       locations: ["record_section"],
       successMessage: "Information requested.",
       refreshAfter: true
     },
     // ── Submitter continuity actions ────────────────────────────────
     // Remind / recall (pending) and resubmit / recall (returned). These are the
-    // submitter's own levers, so `visible` gates on `submitter_id == ctx.user.id`
-    // — the current user is exposed via the console's predicate scope. The
-    // service re-checks ownership; the predicate keeps a non-submitter from ever
-    // seeing a button they cannot use.
+    // submitter's own levers, so `visible` gates on `record.viewer.is_submitter`
+    // (server-computed on the current viewer). The service re-checks ownership;
+    // the predicate keeps a non-submitter from ever seeing a button they cannot
+    // use.
     {
       name: "approval_remind",
       label: "Send reminder",
@@ -1173,7 +1182,7 @@ var SysApprovalRequest = import_data.ObjectSchema.create({
       params: [
         { name: "comment", label: "Note", type: "textarea", required: false }
       ],
-      visible: 'record.status == "pending" && record.submitter_id == ctx.user.id',
+      visible: 'record.status == "pending" && record.viewer.is_submitter',
       locations: ["record_section"],
       successMessage: "Reminder sent.",
       refreshAfter: true
@@ -1190,7 +1199,7 @@ var SysApprovalRequest = import_data.ObjectSchema.create({
       ],
       // Recall applies while the request is live for the submitter — pending
       // (withdraw) or returned (abandon the revision instead of resubmitting).
-      visible: '(record.status == "pending" || record.status == "returned") && record.submitter_id == ctx.user.id',
+      visible: '(record.status == "pending" || record.status == "returned") && record.viewer.is_submitter',
       confirmText: "Recall this request? Approvers can no longer act on it and the record is unlocked.",
       locations: ["record_section"],
       successMessage: "Recalled.",
@@ -1206,7 +1215,7 @@ var SysApprovalRequest = import_data.ObjectSchema.create({
       params: [
         { name: "comment", label: "What changed?", type: "textarea", required: false }
       ],
-      visible: 'record.status == "returned" && record.submitter_id == ctx.user.id',
+      visible: 'record.status == "returned" && record.viewer.is_submitter',
       locations: ["record_section"],
       successMessage: "Resubmitted.",
       refreshAfter: true
@@ -1344,7 +1353,7 @@ var SysApprovalApprover = import_data3.ObjectSchema.create({
   pluralLabel: "Approval Approvers",
   icon: "users",
   isSystem: true,
-  managedBy: "system",
+  managedBy: "engine-owned",
   description: "Normalized pending-approver rows for indexed inbox queries",
   displayNameField: "id",
   nameField: "id",
@@ -3350,6 +3359,7 @@ var _ApprovalService = class _ApprovalService {
     const rows = await this.engine.find("sys_approval_request", findOpts);
     const list = Array.isArray(rows) ? rows.map(rowFromRequest) : [];
     await this.enrichRows(list);
+    this.attachViewers(list, context);
     return list;
   }
   async countRequests(filter, context) {
@@ -3391,6 +3401,7 @@ var _ApprovalService = class _ApprovalService {
     await this.enrichRows([row]);
     await this.attachFlowSteps(row);
     await this.attachDecisionProgress(row, rows[0]);
+    this.attachViewers([row], context);
     return row;
   }
   /**
@@ -3438,6 +3449,25 @@ var _ApprovalService = class _ApprovalService {
     } catch {
     }
   }
+  /**
+   * Attach the per-viewer capability block (#3310) from the caller's context.
+   * `can_act` mirrors the exact authorization the decision methods enforce — the
+   * caller's user id is in the resolved `pending_approvers` while the request is
+   * still `pending` (position/team/manager approvers are already resolved to
+   * concrete user ids at open time, so a plain membership test is faithful).
+   * `is_submitter` is a straight owner check. System/tokenless contexts get a
+   * both-false block. Cheap + synchronous — safe on list reads.
+   */
+  attachViewers(rows, context) {
+    const uid2 = context?.userId != null ? String(context.userId) : null;
+    for (const row of rows) {
+      const pending = row.pending_approvers ?? [];
+      row.viewer = {
+        can_act: row.status === "pending" && !!uid2 && pending.includes(uid2),
+        is_submitter: !!uid2 && row.submitter_id != null && String(row.submitter_id) === uid2
+      };
+    }
+  }
   /**
    * Derive approval-step progress from the owning flow's graph (single-read
    * enrichment only — list reads skip it). Walks from the start node
@@ -3506,7 +3536,7 @@ var SysApprovalToken = import_data5.ObjectSchema.create({
   pluralLabel: "Approval Action Tokens",
   icon: "key",
   isSystem: true,
-  managedBy: "system",
+  managedBy: "engine-owned",
   description: "Single-use tokens behind actionable approval links",
   displayNameField: "id",
   nameField: "id",