@open-mercato/core 0.6.4-develop.4382.1.6b4f656b77 → 0.6.4

package/src/modules/staff/components/TeamMemberForm.tsx

@@ -32,6 +32,7 @@ export type TeamMemberFormValues = {
   roleIds?: string[]
   tags?: string[]
   isActive?: boolean
+  updatedAt?: string | null
 } & Record<string, unknown>
 
 export type TeamMemberFormProps = {
@@ -183,6 +184,32 @@ export function TeamMemberForm(props: TeamMemberFormProps) {
     return () => { cancelled = true }
   }, [scopeVersion])
 
+  React.useEffect(() => {
+    if (!resolvedTeamId) return
+    if (teamOptions.some((option) => option.value === resolvedTeamId)) return
+    const selectedTeamId = resolvedTeamId
+    let cancelled = false
+    async function loadSelectedTeam() {
+      try {
+        const call = await apiCall<TeamsResponse>(`/api/staff/teams?ids=${encodeURIComponent(selectedTeamId)}&pageSize=1`)
+        const entry = Array.isArray(call.result?.items) ? call.result.items[0] : null
+        const entryId = typeof entry?.id === 'string' ? entry.id : null
+        const entryName = typeof entry?.name === 'string' ? entry.name : null
+        if (!entryId || !entryName) return
+        if (!cancelled) {
+          setTeamOptions((prev) => {
+            if (prev.some((option) => option.value === entryId)) return prev
+            return [{ value: entryId, label: entryName }, ...prev]
+          })
+        }
+      } catch {
+        if (!cancelled) setTeamOptions((prev) => prev)
+      }
+    }
+    loadSelectedTeam()
+    return () => { cancelled = true }
+  }, [resolvedTeamId, teamOptions])
+
   React.useEffect(() => {
     if (!resolvedUserId) return
     const userId = resolvedUserId
@@ -282,6 +309,8 @@ export function TeamMemberForm(props: TeamMemberFormProps) {
         type: 'custom',
         component: ({ value, setValue, setFormValue, values, disabled }) => {
           const currentValue = typeof value === 'string' ? value : ''
+          const selectedOption = teamOptions.find((option) => option.value === currentValue)
+          const optionsKey = teamOptions.map((option) => `${option.value}:${option.label}`).join('\0')
           return (
             <div className="space-y-2">
               <div className="flex items-center justify-between gap-3">
@@ -300,7 +329,8 @@ export function TeamMemberForm(props: TeamMemberFormProps) {
                 </Button>
               </div>
               <Select
-                value={currentValue || undefined}
+                key={`team:${currentValue}:${optionsKey}`}
+                value={currentValue}
                 onValueChange={(value) => {
                   const nextValue = value || undefined
                   const nextTeamId = value || null
@@ -319,7 +349,9 @@ export function TeamMemberForm(props: TeamMemberFormProps) {
                 disabled={disabled}
               >
                 <SelectTrigger data-crud-focus-target="">
-                  <SelectValue placeholder={translate('ui.forms.select.emptyOption', '—')} />
+                  <SelectValue placeholder={translate('ui.forms.select.emptyOption', '—')}>
+                    {selectedOption?.label}
+                  </SelectValue>
                 </SelectTrigger>
                 <SelectContent>
                   {teamOptions.map((option) => (
@@ -343,7 +375,7 @@ export function TeamMemberForm(props: TeamMemberFormProps) {
         id: 'description',
         label: translate('staff.teamMembers.form.fields.description', 'Description'),
         type: 'richtext',
-        editor: 'html',
+        editor: 'uiw',
       },
       {
         id: 'roleIds',
@@ -515,6 +547,7 @@ export function TeamMemberForm(props: TeamMemberFormProps) {
       groups={groups}
       entityId={E.staff.staff_team_member}
       initialValues={initialValues}
+      optimisticLockUpdatedAt={initialValues.updatedAt}
       onSubmit={onSubmit}
       onDelete={onDelete}
       isLoading={isLoading}

package/src/modules/staff/components/TeamRoleForm.tsx

@@ -14,6 +14,7 @@ export type TeamRoleFormValues = {
   name: string
   description?: string | null
   appearance?: { icon?: string | null; color?: string | null }
+  updatedAt?: string | null
 } & Record<string, unknown>
 
 export type TeamRoleOption = {
@@ -96,7 +97,7 @@ export function TeamRoleForm(props: TeamRoleFormProps) {
 
   const fields = React.useMemo<CrudField[]>(() => {
     const base: CrudField[] = []
-    if (teamOptions && teamOptions.length) {
+    if (teamOptions) {
       base.push({
         id: 'teamId',
         label: t('staff.teamRoles.form.fields.team', 'Team'),
@@ -110,7 +111,7 @@ export function TeamRoleForm(props: TeamRoleFormProps) {
     }
     base.push(
       { id: 'name', label: t('staff.teamRoles.form.fields.name', 'Name'), type: 'text', required: true },
-      { id: 'description', label: t('staff.teamRoles.form.fields.description', 'Description'), type: 'richtext', editor: 'html' },
+      { id: 'description', label: t('staff.teamRoles.form.fields.description', 'Description'), type: 'richtext', editor: 'uiw' },
       {
         id: 'appearance',
         label: t('staff.teamRoles.form.appearance.label', 'Appearance'),
@@ -135,7 +136,7 @@ export function TeamRoleForm(props: TeamRoleFormProps) {
   }, [appearanceLabels, t, teamOptions])
 
   const groups = React.useMemo<CrudFormGroup[]>(() => [
-    { id: 'details', fields: teamOptions && teamOptions.length ? ['teamId', 'name', 'description', 'appearance'] : ['name', 'description', 'appearance'] },
+    { id: 'details', fields: teamOptions ? ['teamId', 'name', 'description', 'appearance'] : ['name', 'description', 'appearance'] },
     { id: 'custom', title: t('entities.customFields.title', 'Custom Attributes'), column: 2, kind: 'customFields' },
   ], [t, teamOptions])
 
@@ -152,6 +153,7 @@ export function TeamRoleForm(props: TeamRoleFormProps) {
       groups={groups}
       entityId={E.staff.staff_team_role}
       initialValues={initialValues}
+      optimisticLockUpdatedAt={initialValues.updatedAt}
       onSubmit={onSubmit}
       onDelete={onDelete}
       isLoading={isLoading}

package/src/modules/staff/components/detail/JobHistorySection.tsx

@@ -9,6 +9,7 @@ import { LoadingMessage, ErrorMessage, TabEmptyState } from '@open-mercato/ui/ba
 import { readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
 import { createCrud, updateCrud, deleteCrud } from '@open-mercato/ui/backend/utils/crud'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
+import { surfaceRecordConflict } from '@open-mercato/ui/backend/conflicts'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'
 
@@ -19,6 +20,7 @@ type JobHistoryRecord = {
   description: string | null
   startDate: string | null
   endDate: string | null
+  updatedAt: string | undefined
 }
 
 type JobHistoryResponse = {
@@ -54,6 +56,7 @@ export function JobHistorySection({ memberId }: { memberId: string | null }) {
     errorLoad: t('staff.teamMembers.detail.jobHistory.errorLoad', 'Failed to load job history.'),
     errorSave: t('staff.teamMembers.detail.jobHistory.errorSave', 'Failed to save job history.'),
     errorDelete: t('staff.teamMembers.detail.jobHistory.errorDelete', 'Failed to delete job history.'),
+    conflict: t('staff.teamMembers.detail.jobHistory.conflict', 'This record was modified by someone else. Refresh and try again.'),
     loading: t('staff.teamMembers.detail.jobHistory.loading', 'Loading job history...'),
     saved: t('staff.teamMembers.detail.jobHistory.saved', 'Job history saved.'),
     updated: t('staff.teamMembers.detail.jobHistory.updated', 'Job history updated.'),
@@ -137,7 +140,11 @@ export function JobHistorySection({ memberId }: { memberId: string | null }) {
     if (!memberId) return
     const payload = buildJobHistoryPayload(values)
     if (dialogMode === 'edit' && activeRecord) {
-      await updateCrud('staff/job-histories', { id: activeRecord.id, ...payload }, { errorMessage: labels.errorSave })
+      // Let any error (including the optimistic-lock 409) propagate so the
+      // enclosing CrudForm surfaces the unified "Record changed" conflict bar
+      // via surfaceRecordConflict. Catching it here and routing it to a flash
+      // toast would hide the conflict bar (see TC-LOCK-OSS-036).
+      await updateCrud('staff/job-histories', { id: activeRecord.id, updatedAt: activeRecord.updatedAt, ...payload }, { errorMessage: labels.errorSave })
       flash(labels.updated, 'success')
     } else {
       await createCrud('staff/job-histories', { entityId: memberId, ...payload }, { errorMessage: labels.errorSave })
@@ -145,7 +152,7 @@ export function JobHistorySection({ memberId }: { memberId: string | null }) {
     }
     closeDialog()
     setReloadToken((prev) => prev + 1)
-  }, [activeRecord, closeDialog, dialogMode, labels.errorSave, labels.saved, labels.updated, memberId])
+  }, [activeRecord, closeDialog, dialogMode, labels.conflict, labels.errorSave, labels.saved, labels.updated, memberId])
 
   const handleDelete = React.useCallback(async (record: JobHistoryRecord) => {
     const confirmed = await confirmDialog({
@@ -153,10 +160,19 @@ export function JobHistorySection({ memberId }: { memberId: string | null }) {
       variant: 'destructive',
     })
     if (!confirmed) return
-    await deleteCrud('staff/job-histories', { id: record.id, errorMessage: labels.errorDelete })
-    flash(labels.deleted, 'success')
-    setReloadToken((prev) => prev + 1)
-  }, [labels.deleteConfirm, labels.deleted, labels.errorDelete, confirmDialog])
+    try {
+      await deleteCrud('staff/job-histories', {
+        id: record.id,
+        body: { id: record.id, updatedAt: record.updatedAt },
+        errorMessage: labels.errorDelete,
+      })
+      flash(labels.deleted, 'success')
+      setReloadToken((prev) => prev + 1)
+    } catch (error) {
+      if (surfaceRecordConflict(error, t)) return
+      flash(labels.errorDelete, 'error')
+    }
+  }, [labels.deleteConfirm, labels.deleted, labels.errorDelete, confirmDialog, t])
 
   const dialogTitle = dialogMode === 'edit' ? labels.edit : labels.add
 
@@ -240,6 +256,7 @@ export function JobHistorySection({ memberId }: { memberId: string | null }) {
           <CrudForm<JobHistoryFormValues>
             fields={fields}
             initialValues={initialValues}
+            optimisticLockUpdatedAt={activeRecord?.updatedAt ?? null}
             onSubmit={handleSubmit}
             submitLabel={dialogMode === 'edit' ? labels.update : labels.save}
             extraActions={(
@@ -290,6 +307,11 @@ function normalizeJobHistoryItems(items?: Record<string, unknown>[]): JobHistory
           : typeof record.endDate === 'string'
             ? record.endDate
             : null,
+        updatedAt: typeof record.updated_at === 'string'
+          ? record.updated_at
+          : typeof record.updatedAt === 'string'
+            ? record.updatedAt
+            : undefined,
       }
     })
     .filter((value): value is JobHistoryRecord => value !== null)

package/src/modules/staff/data/validators.ts

@@ -10,6 +10,11 @@ const projectColorSchema = z
 
 const tagsSchema = z.array(z.string().min(1)).optional().default([])
 
+export const optimisticUpdatedAtSchema = z.string().refine(
+  (value) => !Number.isNaN(new Date(value).getTime()),
+  { message: 'Invalid datetime' },
+)
+
 const scopedCreateFields = {
   tenantId: z.string().uuid(),
   organizationId: z.string().uuid(),
@@ -121,6 +126,7 @@ export const staffTeamMemberJobHistoryCreateSchema = z.object({
 export const staffTeamMemberJobHistoryUpdateSchema = z
   .object({
     id: z.string().uuid(),
+    updatedAt: optimisticUpdatedAtSchema.optional(),
   })
   .merge(staffTeamMemberJobHistoryCreateSchema.partial())
 

package/src/modules/staff/i18n/de.json

@@ -702,6 +702,7 @@
   "staff.teamMembers.detail.inline.urlInvalid": "Geben Sie eine gültige URL ein",
   "staff.teamMembers.detail.jobHistory.add": "Job hinzufügen",
   "staff.teamMembers.detail.jobHistory.cancel": "Abbrechen",
+  "staff.teamMembers.detail.jobHistory.conflict": "Dieser Datensatz wurde von jemand anderem geändert. Bitte aktualisieren und erneut versuchen.",
   "staff.teamMembers.detail.jobHistory.deleteConfirm": "Diesen Eintrag im Beschäftigungsverlauf löschen?",
   "staff.teamMembers.detail.jobHistory.deleted": "Beschäftigungsverlauf gelöscht.",
   "staff.teamMembers.detail.jobHistory.edit": "Job bearbeiten",
@@ -1020,6 +1021,7 @@
   "staff.timesheets.nav.projects": "Projects",
   "staff.timesheets.projects.actions.add": "Add Project",
   "staff.timesheets.projects.actions.addFirst": "+ Add first project",
+  "staff.timesheets.projects.actions.backToList": "Zurück zu Projekten",
   "staff.timesheets.projects.actions.delete": "Delete",
   "staff.timesheets.projects.actions.deleteConfirm": "Delete project \"{{name}}\"?",
   "staff.timesheets.projects.actions.refresh": "Refresh",

package/src/modules/staff/i18n/en.json

@@ -702,6 +702,7 @@
   "staff.teamMembers.detail.inline.urlInvalid": "Enter a valid URL",
   "staff.teamMembers.detail.jobHistory.add": "Add job",
   "staff.teamMembers.detail.jobHistory.cancel": "Cancel",
+  "staff.teamMembers.detail.jobHistory.conflict": "This record was modified by someone else. Refresh and try again.",
   "staff.teamMembers.detail.jobHistory.deleteConfirm": "Delete this job history entry?",
   "staff.teamMembers.detail.jobHistory.deleted": "Job history deleted.",
   "staff.teamMembers.detail.jobHistory.edit": "Edit job",
@@ -1020,6 +1021,7 @@
   "staff.timesheets.nav.projects": "Projects",
   "staff.timesheets.projects.actions.add": "Add Project",
   "staff.timesheets.projects.actions.addFirst": "+ Add first project",
+  "staff.timesheets.projects.actions.backToList": "Back to projects",
   "staff.timesheets.projects.actions.delete": "Delete",
   "staff.timesheets.projects.actions.deleteConfirm": "Delete project \"{{name}}\"?",
   "staff.timesheets.projects.actions.refresh": "Refresh",

package/src/modules/staff/i18n/es.json

@@ -702,6 +702,7 @@
   "staff.teamMembers.detail.inline.urlInvalid": "Introduce una URL válida",
   "staff.teamMembers.detail.jobHistory.add": "Agregar empleo",
   "staff.teamMembers.detail.jobHistory.cancel": "Cancelar",
+  "staff.teamMembers.detail.jobHistory.conflict": "Otro usuario modificó este registro. Actualiza e inténtalo de nuevo.",
   "staff.teamMembers.detail.jobHistory.deleteConfirm": "¿Eliminar esta entrada de historial laboral?",
   "staff.teamMembers.detail.jobHistory.deleted": "Historial laboral eliminado.",
   "staff.teamMembers.detail.jobHistory.edit": "Editar empleo",
@@ -1020,6 +1021,7 @@
   "staff.timesheets.nav.projects": "Projects",
   "staff.timesheets.projects.actions.add": "Add Project",
   "staff.timesheets.projects.actions.addFirst": "+ Add first project",
+  "staff.timesheets.projects.actions.backToList": "Volver a proyectos",
   "staff.timesheets.projects.actions.delete": "Delete",
   "staff.timesheets.projects.actions.deleteConfirm": "Delete project \"{{name}}\"?",
   "staff.timesheets.projects.actions.refresh": "Refresh",

package/src/modules/staff/i18n/pl.json

@@ -702,6 +702,7 @@
   "staff.teamMembers.detail.inline.urlInvalid": "Wprowadź prawidłowy adres URL",
   "staff.teamMembers.detail.jobHistory.add": "Dodaj stanowisko",
   "staff.teamMembers.detail.jobHistory.cancel": "Anuluj",
+  "staff.teamMembers.detail.jobHistory.conflict": "Ten rekord został zmieniony przez inną osobę. Odśwież i spróbuj ponownie.",
   "staff.teamMembers.detail.jobHistory.deleteConfirm": "Usunąć ten wpis historii zatrudnienia?",
   "staff.teamMembers.detail.jobHistory.deleted": "Wpis historii zatrudnienia usunięty.",
   "staff.teamMembers.detail.jobHistory.edit": "Edytuj stanowisko",
@@ -1020,6 +1021,7 @@
   "staff.timesheets.nav.projects": "Projects",
   "staff.timesheets.projects.actions.add": "Add Project",
   "staff.timesheets.projects.actions.addFirst": "+ Add first project",
+  "staff.timesheets.projects.actions.backToList": "Powrót do projektów",
   "staff.timesheets.projects.actions.delete": "Delete",
   "staff.timesheets.projects.actions.deleteConfirm": "Delete project \"{{name}}\"?",
   "staff.timesheets.projects.actions.refresh": "Refresh",

package/src/modules/staff/lib/leaveRequestHelpers.ts

@@ -18,6 +18,8 @@ export type LeaveRequestRecord = {
   decision_comment?: string | null
   decidedAt?: string | null
   decided_at?: string | null
+  updatedAt?: string | null
+  updated_at?: string | null
 } & Record<string, unknown>
 
 export type NormalizedLeaveRequest = {
@@ -33,6 +35,7 @@ export type NormalizedLeaveRequest = {
   note: string | null
   decisionComment: string | null
   decidedAt: string | null
+  updatedAt: string | null
 } & Record<string, unknown>
 
 export function normalizeLeaveRequest(record: LeaveRequestRecord): NormalizedLeaveRequest {
@@ -50,6 +53,7 @@ export function normalizeLeaveRequest(record: LeaveRequestRecord): NormalizedLea
     note: record.note ?? null,
     decisionComment: record.decisionComment ?? record.decision_comment ?? null,
     decidedAt: record.decidedAt ?? record.decided_at ?? null,
+    updatedAt: record.updatedAt ?? record.updated_at ?? null,
   }
 }
 

package/src/modules/translations/api/[entityType]/[entityId]/route.ts

@@ -69,7 +69,15 @@ export async function PUT(req: Request, ctx: { params?: { entityType?: string; e
       entityId: ctx.params?.entityId,
     })
 
-    const rawBody = await req.json().catch(() => ({}))
+    const rawText = await req.text()
+    let rawBody: unknown = {}
+    if (rawText.trim().length > 0) {
+      try {
+        rawBody = JSON.parse(rawText)
+      } catch {
+        return NextResponse.json({ error: 'Invalid JSON body' }, { status: 400 })
+      }
+    }
     const translations = translationBodySchema.parse(rawBody)
 
     const commandBus = context.container.resolve('commandBus') as CommandBus

package/src/modules/translations/components/TranslationManager.tsx

@@ -7,7 +7,8 @@ import { Input } from '@open-mercato/ui/primitives/input'
 import { ComboboxInput } from '@open-mercato/ui/backend/inputs'
 import { LoadingMessage, ErrorMessage } from '@open-mercato/ui/backend/detail'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
-import { apiCall, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { apiCall, readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { useCustomFieldDefs } from '@open-mercato/ui/backend/utils/customFieldDefs'
 import { Save, Plus, X } from 'lucide-react'
 import { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'
@@ -238,13 +239,16 @@ export function TranslationManager({
         console.warn('[translations] Save skipped: payload is empty — no locale contains any non-empty field')
         throw new Error(t('translations.manager.errors.nothingToSave', 'Nothing to save — enter a translation first'))
       }
-      const res = await apiCall(
-        `/api/translations/${encodeURIComponent(entityType)}/${encodeURIComponent(recordId)}`,
-        {
-          method: 'PUT',
-          headers: { 'content-type': 'application/json' },
-          body: JSON.stringify(body),
-        },
+      const res = await withScopedApiRequestHeaders(
+        buildOptimisticLockHeader(translationData?.updatedAt),
+        () => apiCall(
+          `/api/translations/${encodeURIComponent(entityType)}/${encodeURIComponent(recordId)}`,
+          {
+            method: 'PUT',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify(body),
+          },
+        ),
       )
       if (!res.ok) {
         throw new Error(t('translations.manager.errors.save', 'Failed to save translations'))
@@ -539,6 +543,7 @@ export function LocaleManager() {
 
   const mutation = useMutation({
     mutationFn: async (updatedLocales: string[]) => {
+      // optimistic-lock-exempt: single-row tenant supported-locales settings list — no per-record version / concurrent record edit
       const res = await apiCall<{ locales: string[] }>('/api/translations/locales', {
         method: 'PUT',
         headers: { 'content-type': 'application/json' },

package/src/modules/workflows/acl.ts

@@ -2,23 +2,108 @@ const moduleId = 'workflows'
 
 export const features = [
   { id: 'workflows.view', title: 'View workflows', module: moduleId },
-  { id: 'workflows.manage', title: 'Manage workflows', module: moduleId },
-  { id: 'workflows.view_logs', title: 'View workflow logs', module: moduleId },
-  { id: 'workflows.view_tasks', title: 'View workflow tasks', module: moduleId },
-  { id: 'workflows.definitions.view', title: 'View workflow definitions', module: moduleId },
-  { id: 'workflows.definitions.create', title: 'Create workflow definitions', module: moduleId },
-  { id: 'workflows.definitions.edit', title: 'Edit workflow definitions', module: moduleId },
-  { id: 'workflows.definitions.delete', title: 'Delete workflow definitions', module: moduleId },
-  { id: 'workflows.instances.view', title: 'View workflow instances', module: moduleId },
-  { id: 'workflows.instances.create', title: 'Start workflow instances', module: moduleId },
-  { id: 'workflows.instances.cancel', title: 'Cancel workflow instances', module: moduleId },
-  { id: 'workflows.instances.retry', title: 'Retry workflow instances', module: moduleId },
-  { id: 'workflows.instances.signal', title: 'Signal workflow instances', module: moduleId },
-  { id: 'workflows.tasks.view', title: 'View user tasks', module: moduleId },
-  { id: 'workflows.tasks.claim', title: 'Claim workflow tasks', module: moduleId },
-  { id: 'workflows.tasks.complete', title: 'Complete workflow tasks', module: moduleId },
-  { id: 'workflows.signals.send', title: 'Send workflow signals', module: moduleId },
-  { id: 'workflows.events.view', title: 'View workflow events', module: moduleId },
+  {
+    id: 'workflows.manage',
+    title: 'Manage workflows',
+    module: moduleId,
+    dependsOn: ['workflows.view'],
+  },
+  {
+    id: 'workflows.view_logs',
+    title: 'View workflow logs',
+    module: moduleId,
+    dependsOn: ['workflows.view'],
+  },
+  {
+    id: 'workflows.view_tasks',
+    title: 'View workflow tasks',
+    module: moduleId,
+    dependsOn: ['workflows.view'],
+  },
+  {
+    id: 'workflows.definitions.view',
+    title: 'View workflow definitions',
+    module: moduleId,
+    dependsOn: ['workflows.view'],
+  },
+  {
+    id: 'workflows.definitions.create',
+    title: 'Create workflow definitions',
+    module: moduleId,
+    dependsOn: ['workflows.definitions.view'],
+  },
+  {
+    id: 'workflows.definitions.edit',
+    title: 'Edit workflow definitions',
+    module: moduleId,
+    dependsOn: ['workflows.definitions.view'],
+  },
+  {
+    id: 'workflows.definitions.delete',
+    title: 'Delete workflow definitions',
+    module: moduleId,
+    dependsOn: ['workflows.definitions.view'],
+  },
+  {
+    id: 'workflows.instances.view',
+    title: 'View workflow instances',
+    module: moduleId,
+    dependsOn: ['workflows.view'],
+  },
+  {
+    id: 'workflows.instances.create',
+    title: 'Start workflow instances',
+    module: moduleId,
+    dependsOn: ['workflows.instances.view', 'workflows.definitions.view'],
+  },
+  {
+    id: 'workflows.instances.cancel',
+    title: 'Cancel workflow instances',
+    module: moduleId,
+    dependsOn: ['workflows.instances.view'],
+  },
+  {
+    id: 'workflows.instances.retry',
+    title: 'Retry workflow instances',
+    module: moduleId,
+    dependsOn: ['workflows.instances.view'],
+  },
+  {
+    id: 'workflows.instances.signal',
+    title: 'Signal workflow instances',
+    module: moduleId,
+    dependsOn: ['workflows.instances.view'],
+  },
+  {
+    id: 'workflows.tasks.view',
+    title: 'View user tasks',
+    module: moduleId,
+    dependsOn: ['workflows.view'],
+  },
+  {
+    id: 'workflows.tasks.claim',
+    title: 'Claim workflow tasks',
+    module: moduleId,
+    dependsOn: ['workflows.tasks.view'],
+  },
+  {
+    id: 'workflows.tasks.complete',
+    title: 'Complete workflow tasks',
+    module: moduleId,
+    dependsOn: ['workflows.tasks.view'],
+  },
+  {
+    id: 'workflows.signals.send',
+    title: 'Send workflow signals',
+    module: moduleId,
+    dependsOn: ['workflows.view'],
+  },
+  {
+    id: 'workflows.events.view',
+    title: 'View workflow events',
+    module: moduleId,
+    dependsOn: ['workflows.view'],
+  },
   // Note: Event triggers are now embedded in workflow definitions.
   // Trigger management permissions are covered by workflows.definitions.edit
 ]