@open-mercato/core 0.6.6-develop.6460.1.f94c74174c → 0.6.6-develop.6465.1.019f0fb26f

package/dist/modules/workflows/api/instances/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/workflows/api/instances/route.ts"],
-  "sourcesContent": ["/**\n * Workflow Instances API\n *\n * Endpoints:\n * - GET /api/workflows/instances - List workflow instances\n * - POST /api/workflows/instances - Start a new workflow instance\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveOrganizationScopeFilter } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { WorkflowInstance } from '../../data/entities'\nimport {\n  startWorkflowInputSchema,\n  type StartWorkflowApiInput,\n  workflowInstanceStatusSchema,\n} from '../../data/validators'\nimport {\n  workflowInstanceResponseSchema,\n  workflowBackgroundStartSchema,\n  paginationSchema,\n} from '../openapi'\nimport * as workflowExecutor from '../../lib/workflow-executor'\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.instances.view'],\n}\n\n/**\n * GET /api/workflows/instances\n *\n * List workflow instances with optional filters\n */\nexport async function GET(request: NextRequest) {\n  try {\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const orgFilter = resolveOrganizationScopeFilter(scope, auth)\n\n    if (!tenantId) {\n      return NextResponse.json(\n        { error: 'Missing tenant context' },\n        { status: 400 }\n      )\n    }\n\n    const { searchParams } = new URL(request.url)\n    const workflowId = searchParams.get('workflowId')\n    const status = searchParams.get('status')\n    const correlationKey = searchParams.get('correlationKey')\n    const entityType = searchParams.get('entityType')\n    const entityId = searchParams.get('entityId')\n    const limit = parseInt(searchParams.get('limit') || '50')\n    const offset = parseInt(searchParams.get('offset') || '0')\n\n    // Build where clause with tenant scoping\n    const where: any = {\n      tenantId,\n      ...orgFilter.where,\n    }\n\n    if (workflowId) {\n      where.workflowId = workflowId\n    }\n\n    if (status) {\n      // Support comma-separated status values (e.g., \"RUNNING,PAUSED,WAITING_FOR_ACTIVITIES\")\n      const statuses = status.split(',').map(s => s.trim()).filter(Boolean)\n      if (statuses.length === 1) {\n        where.status = statuses[0]\n      } else if (statuses.length > 1) {\n        where.status = { $in: statuses }\n      }\n    }\n\n    if (correlationKey) {\n      where.correlationKey = correlationKey\n    }\n\n    // For JSONB metadata filtering, use $contains with explicit key-value pairs\n    // MikroORM's dot notation creates table joins, not JSON access\n    if (entityType || entityId) {\n      where.$and = where.$and || []\n      if (entityType) {\n        where.$and.push({\n          metadata: { $contains: { entityType: entityType } }\n        })\n      }\n      if (entityId) {\n        where.$and.push({\n          metadata: { $contains: { entityId: entityId } }\n        })\n      }\n    }\n\n    const [instances, total] = await em.findAndCount(\n      WorkflowInstance,\n      where,\n      {\n        orderBy: { createdAt: 'DESC' },\n        limit,\n        offset,\n      }\n    )\n\n    return NextResponse.json({\n      data: instances,\n      pagination: {\n        total,\n        limit,\n        offset,\n        hasMore: offset + limit < total,\n      },\n    })\n  } catch (error) {\n    console.error('Error listing workflow instances:', error)\n    return NextResponse.json(\n      { error: 'Failed to list workflow instances' },\n      { status: 500 }\n    )\n  }\n}\n\n/**\n * POST /api/workflows/instances\n *\n * Start a new workflow instance\n */\nexport async function POST(request: NextRequest) {\n  try {\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = scope?.selectedId ?? auth.orgId\n\n    if (!tenantId || !organizationId) {\n      return NextResponse.json(\n        { error: 'Missing tenant or organization context' },\n        { status: 400 }\n      )\n    }\n\n    // Check create permission\n    const rbacService = container.resolve('rbacService')\n    const hasPermission = await rbacService.userHasAllFeatures(\n      auth.sub,\n      ['workflows.instances.create'],\n      {\n        tenantId,\n        organizationId,\n      }\n    )\n\n    if (!hasPermission) {\n      return NextResponse.json(\n        { error: 'Insufficient permissions' },\n        { status: 403 }\n      )\n    }\n\n    const body = await request.json()\n\n    // Validate input\n    const validation = startWorkflowInputSchema.safeParse(body)\n    if (!validation.success) {\n      return NextResponse.json(\n        {\n          error: 'Validation failed',\n          details: validation.error.issues,\n        },\n        { status: 400 }\n      )\n    }\n\n    const input: StartWorkflowApiInput = validation.data\n\n    // Inject metadata.initiatedBy if not provided\n    const metadata = {\n      ...input.metadata,\n      initiatedBy: input.metadata?.initiatedBy || auth.sub,\n    }\n\n    // Start workflow\n    const instance = await workflowExecutor.startWorkflow(em, {\n      workflowId: input.workflowId,\n      version: input.version,\n      initialContext: input.initialContext || {},\n      correlationKey: input.correlationKey,\n      metadata,\n      tenantId,\n      organizationId,\n    })\n\n    // Execute workflow in background (non-blocking for demo visibility)\n    // This allows the frontend to see step-by-step progress via polling\n    setImmediate(async () => {\n      try {\n        // Create new container and EM for background execution\n        const bgContainer = await createRequestContainer()\n        const bgEm = bgContainer.resolve('em')\n        await workflowExecutor.executeWorkflow(bgEm, bgContainer, instance.id)\n      } catch (error) {\n        console.error('Background workflow execution error:', error)\n      }\n    })\n\n    return NextResponse.json(\n      {\n        data: {\n          instance,\n          execution: {\n            status: instance.status,\n            currentStep: instance.currentStepId,\n            message: 'Workflow execution started in background',\n          },\n        },\n        message: 'Workflow started successfully',\n      },\n      { status: 201 }\n    )\n  } catch (error) {\n    console.error('Error starting workflow:', error)\n\n    // Handle specific errors\n    if (error instanceof workflowExecutor.WorkflowExecutionError) {\n      if (error.code === 'DEFINITION_NOT_FOUND') {\n        return NextResponse.json(\n          { error: error.message },\n          { status: 404 }\n        )\n      }\n      if (error.code === 'DEFINITION_DISABLED') {\n        return NextResponse.json(\n          { error: error.message },\n          { status: 400 }\n        )\n      }\n      if (error.code === 'INVALID_DEFINITION') {\n        return NextResponse.json(\n          { error: error.message },\n          { status: 400 }\n        )\n      }\n      if (error.code === 'START_PRE_CONDITIONS_FAILED') {\n        return NextResponse.json(\n          {\n            error: error.message,\n            code: error.code,\n            details: error.details,\n          },\n          { status: 422 }\n        )\n      }\n    }\n\n    return NextResponse.json(\n      { error: 'Failed to start workflow' },\n      { status: 500 }\n    )\n  }\n}\n\nexport const openApi = {\n  methods: {\n    GET: {\n      summary: 'List workflow instances',\n      description: 'Get a list of workflow instances with optional filters. Supports pagination and filtering by status, workflowId, correlationKey, etc.',\n      tags: ['Workflows'],\n      query: z.object({\n        workflowId: z.string().optional(),\n        status: workflowInstanceStatusSchema.optional(),\n        correlationKey: z.string().optional(),\n        entityType: z.string().optional(),\n        entityId: z.string().optional(),\n        limit: z.number().int().positive().default(50).optional(),\n        offset: z.number().int().min(0).default(0).optional(),\n      }),\n      responses: [\n        {\n          status: 200,\n          description: 'List of workflow instances',\n          schema: z.object({\n            data: z.array(workflowInstanceResponseSchema),\n            pagination: paginationSchema,\n          }),\n        },\n        {\n          status: 401,\n          description: 'Unauthorized',\n          schema: z.object({ error: z.string() }),\n        },\n        {\n          status: 500,\n          description: 'Internal server error',\n          schema: z.object({ error: z.string() }),\n        },\n      ],\n    },\n    POST: {\n      summary: 'Start workflow instance',\n      description: 'Start a new workflow instance from a workflow definition. The workflow will execute immediately.',\n      tags: ['Workflows'],\n      requestBody: {\n        contentType: 'application/json',\n        schema: startWorkflowInputSchema,\n        description: 'Workflow instance configuration including workflowId, initial context, and metadata.',\n      },\n      responses: [\n        {\n          status: 201,\n          description: 'Workflow started successfully',\n          schema: z.object({\n            data: z.object({\n              instance: workflowInstanceResponseSchema,\n              execution: workflowBackgroundStartSchema,\n            }),\n            message: z.string(),\n          }),\n        },\n        {\n          status: 400,\n          description: 'Bad request - Validation failed or definition disabled/invalid',\n          schema: z.object({\n            error: z.string(),\n            details: z.any().optional(),\n          }),\n        },\n        {\n          status: 401,\n          description: 'Unauthorized',\n          schema: z.object({ error: z.string() }),\n        },\n        {\n          status: 403,\n          description: 'Forbidden - Insufficient permissions',\n          schema: z.object({ error: z.string() }),\n        },\n        {\n          status: 404,\n          description: 'Workflow definition not found',\n          schema: z.object({ error: z.string() }),\n        },\n        {\n          status: 500,\n          description: 'Internal server error',\n          schema: z.object({ error: z.string() }),\n        },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAQA,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,sCAAsC;AAC/C,SAAS,wBAAwB;AACjC;AAAA,EACE;AAAA,EAEA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,YAAY,sBAAsB;AAE3B,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,0BAA0B;AAC9C;AAOA,eAAsB,IAAI,SAAsB;AAC9C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,YAAY,+BAA+B,OAAO,IAAI;AAE5D,QAAI,CAAC,UAAU;AACb,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,yBAAyB;AAAA,QAClC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,EAAE,aAAa,IAAI,IAAI,IAAI,QAAQ,GAAG;AAC5C,UAAM,aAAa,aAAa,IAAI,YAAY;AAChD,UAAM,SAAS,aAAa,IAAI,QAAQ;AACxC,UAAM,iBAAiB,aAAa,IAAI,gBAAgB;AACxD,UAAM,aAAa,aAAa,IAAI,YAAY;AAChD,UAAM,WAAW,aAAa,IAAI,UAAU;AAC5C,UAAM,QAAQ,SAAS,aAAa,IAAI,OAAO,KAAK,IAAI;AACxD,UAAM,SAAS,SAAS,aAAa,IAAI,QAAQ,KAAK,GAAG;AAGzD,UAAM,QAAa;AAAA,MACjB;AAAA,MACA,GAAG,UAAU;AAAA,IACf;AAEA,QAAI,YAAY;AACd,YAAM,aAAa;AAAA,IACrB;AAEA,QAAI,QAAQ;AAEV,YAAM,WAAW,OAAO,MAAM,GAAG,EAAE,IAAI,OAAK,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO;AACpE,UAAI,SAAS,WAAW,GAAG;AACzB,cAAM,SAAS,SAAS,CAAC;AAAA,MAC3B,WAAW,SAAS,SAAS,GAAG;AAC9B,cAAM,SAAS,EAAE,KAAK,SAAS;AAAA,MACjC;AAAA,IACF;AAEA,QAAI,gBAAgB;AAClB,YAAM,iBAAiB;AAAA,IACzB;AAIA,QAAI,cAAc,UAAU;AAC1B,YAAM,OAAO,MAAM,QAAQ,CAAC;AAC5B,UAAI,YAAY;AACd,cAAM,KAAK,KAAK;AAAA,UACd,UAAU,EAAE,WAAW,EAAE,WAAuB,EAAE;AAAA,QACpD,CAAC;AAAA,MACH;AACA,UAAI,UAAU;AACZ,cAAM,KAAK,KAAK;AAAA,UACd,UAAU,EAAE,WAAW,EAAE,SAAmB,EAAE;AAAA,QAChD,CAAC;AAAA,MACH;AAAA,IACF;AAEA,UAAM,CAAC,WAAW,KAAK,IAAI,MAAM,GAAG;AAAA,MAClC;AAAA,MACA;AAAA,MACA;AAAA,QACE,SAAS,EAAE,WAAW,OAAO;AAAA,QAC7B;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,MAAM;AAAA,MACN,YAAY;AAAA,QACV;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS,SAAS,QAAQ;AAAA,MAC5B;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,YAAQ,MAAM,qCAAqC,KAAK;AACxD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,oCAAoC;AAAA,MAC7C,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAOA,eAAsB,KAAK,SAAsB;AAC/C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,cAAc,KAAK;AAEjD,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,yCAAyC;AAAA,QAClD,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAGA,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,UAAM,gBAAgB,MAAM,YAAY;AAAA,MACtC,KAAK;AAAA,MACL,CAAC,4BAA4B;AAAA,MAC7B;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,2BAA2B;AAAA,QACpC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,OAAO,MAAM,QAAQ,KAAK;AAGhC,UAAM,aAAa,yBAAyB,UAAU,IAAI;AAC1D,QAAI,CAAC,WAAW,SAAS;AACvB,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO;AAAA,UACP,SAAS,WAAW,MAAM;AAAA,QAC5B;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,QAA+B,WAAW;AAGhD,UAAMA,YAAW;AAAA,MACf,GAAG,MAAM;AAAA,MACT,aAAa,MAAM,UAAU,eAAe,KAAK;AAAA,IACnD;AAGA,UAAM,WAAW,MAAM,iBAAiB,cAAc,IAAI;AAAA,MACxD,YAAY,MAAM;AAAA,MAClB,SAAS,MAAM;AAAA,MACf,gBAAgB,MAAM,kBAAkB,CAAC;AAAA,MACzC,gBAAgB,MAAM;AAAA,MACtB,UAAAA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAID,iBAAa,YAAY;AACvB,UAAI;AAEF,cAAM,cAAc,MAAM,uBAAuB;AACjD,cAAM,OAAO,YAAY,QAAQ,IAAI;AACrC,cAAM,iBAAiB,gBAAgB,MAAM,aAAa,SAAS,EAAE;AAAA,MACvE,SAAS,OAAO;AACd,gBAAQ,MAAM,wCAAwC,KAAK;AAAA,MAC7D;AAAA,IACF,CAAC;AAED,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,MAAM;AAAA,UACJ;AAAA,UACA,WAAW;AAAA,YACT,QAAQ,SAAS;AAAA,YACjB,aAAa,SAAS;AAAA,YACtB,SAAS;AAAA,UACX;AAAA,QACF;AAAA,QACA,SAAS;AAAA,MACX;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,4BAA4B,KAAK;AAG/C,QAAI,iBAAiB,iBAAiB,wBAAwB;AAC5D,UAAI,MAAM,SAAS,wBAAwB;AACzC,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,MAAM,QAAQ;AAAA,UACvB,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,UAAI,MAAM,SAAS,uBAAuB;AACxC,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,MAAM,QAAQ;AAAA,UACvB,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,UAAI,MAAM,SAAS,sBAAsB;AACvC,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,MAAM,QAAQ;AAAA,UACvB,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,UAAI,MAAM,SAAS,+BAA+B;AAChD,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,OAAO,MAAM;AAAA,YACb,MAAM,MAAM;AAAA,YACZ,SAAS,MAAM;AAAA,UACjB;AAAA,UACA,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAEA,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,2BAA2B;AAAA,MACpC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,MAAM,CAAC,WAAW;AAAA,MAClB,OAAO,EAAE,OAAO;AAAA,QACd,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,QAChC,QAAQ,6BAA6B,SAAS;AAAA,QAC9C,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,QACpC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,QAChC,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,QAC9B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,SAAS;AAAA,QACxD,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,MACtD,CAAC;AAAA,MACD,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,MAAM,EAAE,MAAM,8BAA8B;AAAA,YAC5C,YAAY;AAAA,UACd,CAAC;AAAA,QACH;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,MAAM,CAAC,WAAW;AAAA,MAClB,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,QACR,aAAa;AAAA,MACf;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,MAAM,EAAE,OAAO;AAAA,cACb,UAAU;AAAA,cACV,WAAW;AAAA,YACb,CAAC;AAAA,YACD,SAAS,EAAE,OAAO;AAAA,UACpB,CAAC;AAAA,QACH;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,OAAO,EAAE,OAAO;AAAA,YAChB,SAAS,EAAE,IAAI,EAAE,SAAS;AAAA,UAC5B,CAAC;AAAA,QACH;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * Workflow Instances API\n *\n * Endpoints:\n * - GET /api/workflows/instances - List workflow instances\n * - POST /api/workflows/instances - Start a new workflow instance\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveOrganizationScopeFilter } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { WorkflowInstance } from '../../data/entities'\nimport {\n  startWorkflowInputSchema,\n  type StartWorkflowApiInput,\n  workflowInstanceStatusSchema,\n} from '../../data/validators'\nimport {\n  workflowInstanceResponseSchema,\n  workflowBackgroundStartSchema,\n  paginationSchema,\n} from '../openapi'\nimport * as workflowExecutor from '../../lib/workflow-executor'\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.instances.view'],\n}\n\n/**\n * GET /api/workflows/instances\n *\n * List workflow instances with optional filters\n */\nexport async function GET(request: NextRequest) {\n  try {\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const orgFilter = resolveOrganizationScopeFilter(scope, auth)\n\n    if (!tenantId) {\n      return NextResponse.json(\n        { error: 'Missing tenant context' },\n        { status: 400 }\n      )\n    }\n\n    const { searchParams } = new URL(request.url)\n    const workflowId = searchParams.get('workflowId')\n    const status = searchParams.get('status')\n    const correlationKey = searchParams.get('correlationKey')\n    const entityType = searchParams.get('entityType')\n    const entityId = searchParams.get('entityId')\n    const limit = parseInt(searchParams.get('limit') || '50')\n    const offset = parseInt(searchParams.get('offset') || '0')\n\n    // Build where clause with tenant scoping\n    const where: any = {\n      tenantId,\n      ...orgFilter.where,\n    }\n\n    if (workflowId) {\n      where.workflowId = workflowId\n    }\n\n    if (status) {\n      // Support comma-separated status values (e.g., \"RUNNING,PAUSED,WAITING_FOR_ACTIVITIES\")\n      const statuses = status.split(',').map(s => s.trim()).filter(Boolean)\n      if (statuses.length === 1) {\n        where.status = statuses[0]\n      } else if (statuses.length > 1) {\n        where.status = { $in: statuses }\n      }\n    }\n\n    if (correlationKey) {\n      where.correlationKey = correlationKey\n    }\n\n    // For JSONB metadata filtering, use $contains with explicit key-value pairs\n    // MikroORM's dot notation creates table joins, not JSON access\n    if (entityType || entityId) {\n      where.$and = where.$and || []\n      if (entityType) {\n        where.$and.push({\n          metadata: { $contains: { entityType: entityType } }\n        })\n      }\n      if (entityId) {\n        where.$and.push({\n          metadata: { $contains: { entityId: entityId } }\n        })\n      }\n    }\n\n    const [instances, total] = await em.findAndCount(\n      WorkflowInstance,\n      where,\n      {\n        orderBy: { createdAt: 'DESC' },\n        limit,\n        offset,\n      }\n    )\n\n    return NextResponse.json({\n      data: instances,\n      pagination: {\n        total,\n        limit,\n        offset,\n        hasMore: offset + limit < total,\n      },\n    })\n  } catch (error) {\n    console.error('Error listing workflow instances:', error)\n    return NextResponse.json(\n      { error: 'Failed to list workflow instances' },\n      { status: 500 }\n    )\n  }\n}\n\n/**\n * POST /api/workflows/instances\n *\n * Start a new workflow instance\n */\nexport async function POST(request: NextRequest) {\n  try {\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = scope?.selectedId ?? auth.orgId\n\n    if (!tenantId || !organizationId) {\n      return NextResponse.json(\n        { error: 'Missing tenant or organization context' },\n        { status: 400 }\n      )\n    }\n\n    // Check create permission\n    const rbacService = container.resolve('rbacService')\n    const hasPermission = await rbacService.userHasAllFeatures(\n      auth.sub,\n      ['workflows.instances.create'],\n      {\n        tenantId,\n        organizationId,\n      }\n    )\n\n    if (!hasPermission) {\n      return NextResponse.json(\n        { error: 'Insufficient permissions' },\n        { status: 403 }\n      )\n    }\n\n    const body = await request.json()\n\n    // Validate input\n    const validation = startWorkflowInputSchema.safeParse(body)\n    if (!validation.success) {\n      return NextResponse.json(\n        {\n          error: 'Validation failed',\n          details: validation.error.issues,\n        },\n        { status: 400 }\n      )\n    }\n\n    const input: StartWorkflowApiInput = validation.data\n\n    // User-started instances must always record the authenticated caller.\n    const metadata = {\n      ...input.metadata,\n      initiatedBy: auth.sub,\n    }\n\n    // Start workflow\n    const instance = await workflowExecutor.startWorkflow(em, {\n      workflowId: input.workflowId,\n      version: input.version,\n      initialContext: input.initialContext || {},\n      correlationKey: input.correlationKey,\n      metadata,\n      tenantId,\n      organizationId,\n    })\n\n    // Execute workflow in background (non-blocking for demo visibility)\n    // This allows the frontend to see step-by-step progress via polling\n    setImmediate(async () => {\n      try {\n        // Create new container and EM for background execution\n        const bgContainer = await createRequestContainer()\n        const bgEm = bgContainer.resolve('em')\n        await workflowExecutor.executeWorkflow(bgEm, bgContainer, instance.id)\n      } catch (error) {\n        console.error('Background workflow execution error:', error)\n      }\n    })\n\n    return NextResponse.json(\n      {\n        data: {\n          instance,\n          execution: {\n            status: instance.status,\n            currentStep: instance.currentStepId,\n            message: 'Workflow execution started in background',\n          },\n        },\n        message: 'Workflow started successfully',\n      },\n      { status: 201 }\n    )\n  } catch (error) {\n    console.error('Error starting workflow:', error)\n\n    // Handle specific errors\n    if (error instanceof workflowExecutor.WorkflowExecutionError) {\n      if (error.code === 'DEFINITION_NOT_FOUND') {\n        return NextResponse.json(\n          { error: error.message },\n          { status: 404 }\n        )\n      }\n      if (error.code === 'DEFINITION_DISABLED') {\n        return NextResponse.json(\n          { error: error.message },\n          { status: 400 }\n        )\n      }\n      if (error.code === 'INVALID_DEFINITION') {\n        return NextResponse.json(\n          { error: error.message },\n          { status: 400 }\n        )\n      }\n      if (error.code === 'START_PRE_CONDITIONS_FAILED') {\n        return NextResponse.json(\n          {\n            error: error.message,\n            code: error.code,\n            details: error.details,\n          },\n          { status: 422 }\n        )\n      }\n    }\n\n    return NextResponse.json(\n      { error: 'Failed to start workflow' },\n      { status: 500 }\n    )\n  }\n}\n\nexport const openApi = {\n  methods: {\n    GET: {\n      summary: 'List workflow instances',\n      description: 'Get a list of workflow instances with optional filters. Supports pagination and filtering by status, workflowId, correlationKey, etc.',\n      tags: ['Workflows'],\n      query: z.object({\n        workflowId: z.string().optional(),\n        status: workflowInstanceStatusSchema.optional(),\n        correlationKey: z.string().optional(),\n        entityType: z.string().optional(),\n        entityId: z.string().optional(),\n        limit: z.number().int().positive().default(50).optional(),\n        offset: z.number().int().min(0).default(0).optional(),\n      }),\n      responses: [\n        {\n          status: 200,\n          description: 'List of workflow instances',\n          schema: z.object({\n            data: z.array(workflowInstanceResponseSchema),\n            pagination: paginationSchema,\n          }),\n        },\n        {\n          status: 401,\n          description: 'Unauthorized',\n          schema: z.object({ error: z.string() }),\n        },\n        {\n          status: 500,\n          description: 'Internal server error',\n          schema: z.object({ error: z.string() }),\n        },\n      ],\n    },\n    POST: {\n      summary: 'Start workflow instance',\n      description: 'Start a new workflow instance from a workflow definition. The workflow will execute immediately.',\n      tags: ['Workflows'],\n      requestBody: {\n        contentType: 'application/json',\n        schema: startWorkflowInputSchema,\n        description: 'Workflow instance configuration including workflowId, initial context, and metadata.',\n      },\n      responses: [\n        {\n          status: 201,\n          description: 'Workflow started successfully',\n          schema: z.object({\n            data: z.object({\n              instance: workflowInstanceResponseSchema,\n              execution: workflowBackgroundStartSchema,\n            }),\n            message: z.string(),\n          }),\n        },\n        {\n          status: 400,\n          description: 'Bad request - Validation failed or definition disabled/invalid',\n          schema: z.object({\n            error: z.string(),\n            details: z.any().optional(),\n          }),\n        },\n        {\n          status: 401,\n          description: 'Unauthorized',\n          schema: z.object({ error: z.string() }),\n        },\n        {\n          status: 403,\n          description: 'Forbidden - Insufficient permissions',\n          schema: z.object({ error: z.string() }),\n        },\n        {\n          status: 404,\n          description: 'Workflow definition not found',\n          schema: z.object({ error: z.string() }),\n        },\n        {\n          status: 500,\n          description: 'Internal server error',\n          schema: z.object({ error: z.string() }),\n        },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAQA,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,sCAAsC;AAC/C,SAAS,wBAAwB;AACjC;AAAA,EACE;AAAA,EAEA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,YAAY,sBAAsB;AAE3B,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,0BAA0B;AAC9C;AAOA,eAAsB,IAAI,SAAsB;AAC9C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,YAAY,+BAA+B,OAAO,IAAI;AAE5D,QAAI,CAAC,UAAU;AACb,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,yBAAyB;AAAA,QAClC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,EAAE,aAAa,IAAI,IAAI,IAAI,QAAQ,GAAG;AAC5C,UAAM,aAAa,aAAa,IAAI,YAAY;AAChD,UAAM,SAAS,aAAa,IAAI,QAAQ;AACxC,UAAM,iBAAiB,aAAa,IAAI,gBAAgB;AACxD,UAAM,aAAa,aAAa,IAAI,YAAY;AAChD,UAAM,WAAW,aAAa,IAAI,UAAU;AAC5C,UAAM,QAAQ,SAAS,aAAa,IAAI,OAAO,KAAK,IAAI;AACxD,UAAM,SAAS,SAAS,aAAa,IAAI,QAAQ,KAAK,GAAG;AAGzD,UAAM,QAAa;AAAA,MACjB;AAAA,MACA,GAAG,UAAU;AAAA,IACf;AAEA,QAAI,YAAY;AACd,YAAM,aAAa;AAAA,IACrB;AAEA,QAAI,QAAQ;AAEV,YAAM,WAAW,OAAO,MAAM,GAAG,EAAE,IAAI,OAAK,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO;AACpE,UAAI,SAAS,WAAW,GAAG;AACzB,cAAM,SAAS,SAAS,CAAC;AAAA,MAC3B,WAAW,SAAS,SAAS,GAAG;AAC9B,cAAM,SAAS,EAAE,KAAK,SAAS;AAAA,MACjC;AAAA,IACF;AAEA,QAAI,gBAAgB;AAClB,YAAM,iBAAiB;AAAA,IACzB;AAIA,QAAI,cAAc,UAAU;AAC1B,YAAM,OAAO,MAAM,QAAQ,CAAC;AAC5B,UAAI,YAAY;AACd,cAAM,KAAK,KAAK;AAAA,UACd,UAAU,EAAE,WAAW,EAAE,WAAuB,EAAE;AAAA,QACpD,CAAC;AAAA,MACH;AACA,UAAI,UAAU;AACZ,cAAM,KAAK,KAAK;AAAA,UACd,UAAU,EAAE,WAAW,EAAE,SAAmB,EAAE;AAAA,QAChD,CAAC;AAAA,MACH;AAAA,IACF;AAEA,UAAM,CAAC,WAAW,KAAK,IAAI,MAAM,GAAG;AAAA,MAClC;AAAA,MACA;AAAA,MACA;AAAA,QACE,SAAS,EAAE,WAAW,OAAO;AAAA,QAC7B;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,MAAM;AAAA,MACN,YAAY;AAAA,QACV;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS,SAAS,QAAQ;AAAA,MAC5B;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,YAAQ,MAAM,qCAAqC,KAAK;AACxD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,oCAAoC;AAAA,MAC7C,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAOA,eAAsB,KAAK,SAAsB;AAC/C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,cAAc,KAAK;AAEjD,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,yCAAyC;AAAA,QAClD,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAGA,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,UAAM,gBAAgB,MAAM,YAAY;AAAA,MACtC,KAAK;AAAA,MACL,CAAC,4BAA4B;AAAA,MAC7B;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,2BAA2B;AAAA,QACpC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,OAAO,MAAM,QAAQ,KAAK;AAGhC,UAAM,aAAa,yBAAyB,UAAU,IAAI;AAC1D,QAAI,CAAC,WAAW,SAAS;AACvB,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO;AAAA,UACP,SAAS,WAAW,MAAM;AAAA,QAC5B;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,QAA+B,WAAW;AAGhD,UAAMA,YAAW;AAAA,MACf,GAAG,MAAM;AAAA,MACT,aAAa,KAAK;AAAA,IACpB;AAGA,UAAM,WAAW,MAAM,iBAAiB,cAAc,IAAI;AAAA,MACxD,YAAY,MAAM;AAAA,MAClB,SAAS,MAAM;AAAA,MACf,gBAAgB,MAAM,kBAAkB,CAAC;AAAA,MACzC,gBAAgB,MAAM;AAAA,MACtB,UAAAA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAID,iBAAa,YAAY;AACvB,UAAI;AAEF,cAAM,cAAc,MAAM,uBAAuB;AACjD,cAAM,OAAO,YAAY,QAAQ,IAAI;AACrC,cAAM,iBAAiB,gBAAgB,MAAM,aAAa,SAAS,EAAE;AAAA,MACvE,SAAS,OAAO;AACd,gBAAQ,MAAM,wCAAwC,KAAK;AAAA,MAC7D;AAAA,IACF,CAAC;AAED,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,MAAM;AAAA,UACJ;AAAA,UACA,WAAW;AAAA,YACT,QAAQ,SAAS;AAAA,YACjB,aAAa,SAAS;AAAA,YACtB,SAAS;AAAA,UACX;AAAA,QACF;AAAA,QACA,SAAS;AAAA,MACX;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,4BAA4B,KAAK;AAG/C,QAAI,iBAAiB,iBAAiB,wBAAwB;AAC5D,UAAI,MAAM,SAAS,wBAAwB;AACzC,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,MAAM,QAAQ;AAAA,UACvB,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,UAAI,MAAM,SAAS,uBAAuB;AACxC,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,MAAM,QAAQ;AAAA,UACvB,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,UAAI,MAAM,SAAS,sBAAsB;AACvC,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,MAAM,QAAQ;AAAA,UACvB,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,UAAI,MAAM,SAAS,+BAA+B;AAChD,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,OAAO,MAAM;AAAA,YACb,MAAM,MAAM;AAAA,YACZ,SAAS,MAAM;AAAA,UACjB;AAAA,UACA,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAEA,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,2BAA2B;AAAA,MACpC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,MAAM,CAAC,WAAW;AAAA,MAClB,OAAO,EAAE,OAAO;AAAA,QACd,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,QAChC,QAAQ,6BAA6B,SAAS;AAAA,QAC9C,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,QACpC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,QAChC,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,QAC9B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,SAAS;AAAA,QACxD,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,MACtD,CAAC;AAAA,MACD,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,MAAM,EAAE,MAAM,8BAA8B;AAAA,YAC5C,YAAY;AAAA,UACd,CAAC;AAAA,QACH;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,MAAM,CAAC,WAAW;AAAA,MAClB,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,QACR,aAAa;AAAA,MACf;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,MAAM,EAAE,OAAO;AAAA,cACb,UAAU;AAAA,cACV,WAAW;AAAA,YACb,CAAC;AAAA,YACD,SAAS,EAAE,OAAO;AAAA,UACpB,CAAC;AAAA,QACH;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,OAAO,EAAE,OAAO;AAAA,YAChB,SAAS,EAAE,IAAI,EAAE,SAAS;AAAA,UAC5B,CAAC;AAAA,QACH;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": ["metadata"]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.6.6-develop.6460.1.f94c74174c",
+  "version": "0.6.6-develop.6465.1.019f0fb26f",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -253,16 +253,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.6.6-develop.6460.1.f94c74174c",
-    "@open-mercato/shared": "0.6.6-develop.6460.1.f94c74174c",
-    "@open-mercato/ui": "0.6.6-develop.6460.1.f94c74174c",
+    "@open-mercato/ai-assistant": "0.6.6-develop.6465.1.019f0fb26f",
+    "@open-mercato/shared": "0.6.6-develop.6465.1.019f0fb26f",
+    "@open-mercato/ui": "0.6.6-develop.6465.1.019f0fb26f",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.6.6-develop.6460.1.f94c74174c",
-    "@open-mercato/shared": "0.6.6-develop.6460.1.f94c74174c",
-    "@open-mercato/ui": "0.6.6-develop.6460.1.f94c74174c",
+    "@open-mercato/ai-assistant": "0.6.6-develop.6465.1.019f0fb26f",
+    "@open-mercato/shared": "0.6.6-develop.6465.1.019f0fb26f",
+    "@open-mercato/ui": "0.6.6-develop.6465.1.019f0fb26f",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.1",

package/src/helpers/integration/auth.ts

@@ -1,4 +1,4 @@
-import { type Page } from '@playwright/test';
+import { type Page, type Response } from '@playwright/test';
 import { readFileSync } from 'fs';
 import { resolve } from 'path';
 
@@ -136,102 +136,194 @@ async function recoverGenericErrorPageIfPresent(page: Page): Promise<void> {
   await dismissGlobalNoticesIfPresent(page);
 }
 
-export async function login(page: Page, role: Role = 'admin'): Promise<void> {
-  const creds = DEFAULT_CREDENTIALS[role];
-  const loginReadySelector = 'form[data-auth-ready="1"]';
-  const hasBackendUrl = (): boolean => /\/backend(?:\/.*)?$/.test(page.url());
-  const waitForBackend = async (timeout: number): Promise<boolean> => {
-    try {
-      await page.waitForURL(/\/backend(?:\/.*)?$/, { timeout });
-      return true;
-    } catch {
-      return hasBackendUrl();
-    }
-  };
+type AuthNavigationTraceEntry = {
+  path: string;
+  status: number;
+  location: string | null;
+};
 
-  await acknowledgeGlobalNotices(page);
-  const apiLoginForm = new URLSearchParams();
-  apiLoginForm.set('email', creds.email);
-  apiLoginForm.set('password', creds.password);
-  // Retry-on-429 against the auth rate limit (5/60s per email). Capped
-  // exponential backoff: 1s, 2s, 4s — worst-case ~7s.
-  let apiLoginResponse: Awaited<ReturnType<typeof page.request.post>> | null = null;
-  for (let retry = 0; retry < 4; retry += 1) {
-    apiLoginResponse = await page.request.post('/api/auth/login', {
-      headers: {
-        'content-type': 'application/x-www-form-urlencoded',
-      },
-      data: apiLoginForm.toString(),
-    }).catch(() => null);
-    if (!apiLoginResponse || apiLoginResponse.status() !== 429) break;
-    await new Promise((resolve) => setTimeout(resolve, 1000 * 2 ** retry));
+function toPathOnly(rawUrl: string): string {
+  try {
+    const url = new URL(rawUrl);
+    return `${url.pathname}${url.search}`;
+  } catch {
+    return '[unparseable-url]';
+  }
+}
+
+function toRedactedLocation(rawLocation: string | undefined): string | null {
+  if (!rawLocation) return null;
+  try {
+    const url = new URL(rawLocation, 'http://integration.local');
+    return `${url.pathname}${url.search}`;
+  } catch {
+    return '[unparseable-location]';
   }
-  if (apiLoginResponse?.ok()) {
-    const apiLoginBody = (await apiLoginResponse.json().catch(() => null)) as { token?: string } | null;
-    const claims = typeof apiLoginBody?.token === 'string' ? decodeJwtClaims(apiLoginBody.token) : null;
-    const baseUrl = process.env.BASE_URL || 'http://localhost:3000';
-    const cookies = [];
-    if (claims?.tenantId) {
-      cookies.push({
-        name: 'om_selected_tenant',
-        value: claims.tenantId,
-        url: baseUrl,
-        sameSite: 'Lax' as const,
+}
+
+function createAuthNavigationTrace(page: Page): {
+  entries: AuthNavigationTraceEntry[];
+  stop: () => void;
+} {
+  const entries: AuthNavigationTraceEntry[] = [];
+  const onResponse = (response: Response) => {
+    const path = toPathOnly(response.url());
+    if (path === '/backend' || path.startsWith('/api/auth/session/refresh')) {
+      entries.push({
+        path,
+        status: response.status(),
+        location: toRedactedLocation(response.headers().location),
       });
     }
-    if (claims?.orgId) {
-      cookies.push({
-        name: 'om_selected_org',
-        value: claims.orgId,
-        url: baseUrl,
-        sameSite: 'Lax' as const,
-      });
+  };
+  page.on('response', onResponse);
+  return {
+    entries,
+    stop: () => page.off('response', onResponse),
+  };
+}
+
+async function formatLoginDiagnostics(
+  page: Page,
+  role: Role,
+  entries: AuthNavigationTraceEntry[],
+): Promise<string> {
+  const cookieNames = Array.from(
+    new Set((await page.context().cookies()).map((cookie) => cookie.name)),
+  ).sort((left, right) => left.localeCompare(right));
+  const traceLines = entries.length
+    ? entries.map((entry) => {
+      const location = entry.location ? ` -> ${entry.location}` : '';
+      return `${entry.status} ${entry.path}${location}`;
+    })
+    : ['none'];
+
+  return [
+    `Login diagnostics for role "${role}":`,
+    `current URL: ${toPathOnly(page.url())}`,
+    `browser cookie names: ${cookieNames.length ? cookieNames.join(', ') : 'none'}`,
+    'backend/refresh trace:',
+    ...traceLines,
+  ].join('\n');
+}
+
+async function throwLoginErrorWithDiagnostics(
+  page: Page,
+  role: Role,
+  entries: AuthNavigationTraceEntry[],
+  error: unknown,
+): Promise<never> {
+  const message = error instanceof Error ? error.message : String(error);
+  throw new Error([
+    `Login did not reach backend for role: ${role}.`,
+    await formatLoginDiagnostics(page, role, entries),
+    `Original error: ${message}`,
+  ].join('\n'));
+}
+
+export async function login(page: Page, role: Role = 'admin'): Promise<void> {
+  const authTrace = createAuthNavigationTrace(page);
+  try {
+    const creds = DEFAULT_CREDENTIALS[role];
+    const loginReadySelector = 'form[data-auth-ready="1"]';
+    const hasBackendUrl = (): boolean => /\/backend(?:\/.*)?$/.test(page.url());
+    const waitForBackend = async (timeout: number): Promise<boolean> => {
+      try {
+        await page.waitForURL(/\/backend(?:\/.*)?$/, { timeout });
+        return true;
+      } catch {
+        return hasBackendUrl();
+      }
+    };
+
+    await acknowledgeGlobalNotices(page);
+    const apiLoginForm = new URLSearchParams();
+    apiLoginForm.set('email', creds.email);
+    apiLoginForm.set('password', creds.password);
+    // Retry-on-429 against the auth rate limit (5/60s per email). Capped
+    // exponential backoff: 1s, 2s, 4s — worst-case ~7s.
+    let apiLoginResponse: Awaited<ReturnType<typeof page.request.post>> | null = null;
+    for (let retry = 0; retry < 4; retry += 1) {
+      apiLoginResponse = await page.request.post('/api/auth/login', {
+        headers: {
+          'content-type': 'application/x-www-form-urlencoded',
+        },
+        data: apiLoginForm.toString(),
+      }).catch(() => null);
+      if (!apiLoginResponse || apiLoginResponse.status() !== 429) break;
+      await new Promise((resolve) => setTimeout(resolve, 1000 * 2 ** retry));
     }
-    if (cookies.length > 0) {
-      await page.context().addCookies(cookies);
+    if (apiLoginResponse?.ok()) {
+      const apiLoginBody = (await apiLoginResponse.json().catch(() => null)) as { token?: string } | null;
+      const claims = typeof apiLoginBody?.token === 'string' ? decodeJwtClaims(apiLoginBody.token) : null;
+      const baseUrl = process.env.BASE_URL || 'http://localhost:3000';
+      const cookies = [];
+      if (claims?.tenantId) {
+        cookies.push({
+          name: 'om_selected_tenant',
+          value: claims.tenantId,
+          url: baseUrl,
+          sameSite: 'Lax' as const,
+        });
+      }
+      if (claims?.orgId) {
+        cookies.push({
+          name: 'om_selected_org',
+          value: claims.orgId,
+          url: baseUrl,
+          sameSite: 'Lax' as const,
+        });
+      }
+      if (cookies.length > 0) {
+        await page.context().addCookies(cookies);
+      }
+      await page.goto('/backend', { waitUntil: 'domcontentloaded' });
+      if (await waitForBackend(8_000)) return;
     }
-    await page.goto('/backend', { waitUntil: 'domcontentloaded' });
-    if (await waitForBackend(8_000)) return;
-  }
 
-  for (let attempt = 0; attempt < 4; attempt += 1) {
-    await page.goto('/login', { waitUntil: 'domcontentloaded' });
-    await dismissGlobalNoticesIfPresent(page);
-    await recoverClientSideErrorPageIfPresent(page);
-    await recoverGenericErrorPageIfPresent(page);
-    await page.waitForSelector(loginReadySelector, { state: 'visible', timeout: 3_000 }).catch(() => null);
-    if (await page.getByLabel('Email').isVisible().catch(() => false)) break;
-    if (attempt === 3) {
-      throw new Error(`Login form is unavailable for role: ${role}; current URL: ${page.url()}`);
+    for (let attempt = 0; attempt < 4; attempt += 1) {
+      await page.goto('/login', { waitUntil: 'domcontentloaded' });
+      await dismissGlobalNoticesIfPresent(page);
+      await recoverClientSideErrorPageIfPresent(page);
+      await recoverGenericErrorPageIfPresent(page);
+      await page.waitForSelector(loginReadySelector, { state: 'visible', timeout: 3_000 }).catch(() => null);
+      if (await page.getByLabel('Email').isVisible().catch(() => false)) break;
+      if (attempt === 3) {
+        throw new Error(`Login form is unavailable for role: ${role}; current URL: ${page.url()}`);
+      }
     }
-  }
-  await page.getByLabel('Email').fill(creds.email);
+    await page.getByLabel('Email').fill(creds.email);
 
-  const passwordInput = page.getByLabel('Password', { exact: true }).first();
-  if (await passwordInput.isVisible().catch(() => false)) {
-    await passwordInput.fill(creds.password);
-    await passwordInput.press('Enter');
-  } else {
-    const submitButton = page.getByRole('button', { name: /login|sign in|continue with sso/i }).first();
-    await submitButton.click();
-  }
+    const passwordInput = page.getByLabel('Password', { exact: true }).first();
+    if (await passwordInput.isVisible().catch(() => false)) {
+      await passwordInput.fill(creds.password);
+      await passwordInput.press('Enter');
+    } else {
+      const submitButton = page.getByRole('button', { name: /login|sign in|continue with sso/i }).first();
+      await submitButton.click();
+    }
 
-  if (await waitForBackend(7_000)) return;
+    if (await waitForBackend(7_000)) return;
 
-  const loginForm = page.locator('form').first();
-  if (await loginForm.isVisible().catch(() => false)) {
-    await loginForm.evaluate((element) => {
-      const form = element as HTMLFormElement
-      form.requestSubmit()
-    }).catch(() => {})
-  }
-  if (await waitForBackend(5_000)) return;
+    const loginForm = page.locator('form').first();
+    if (await loginForm.isVisible().catch(() => false)) {
+      await loginForm.evaluate((element) => {
+        const form = element as HTMLFormElement
+        form.requestSubmit()
+      }).catch(() => {})
+    }
+    if (await waitForBackend(5_000)) return;
 
-  const loginButton = page.getByRole('button', { name: /login|sign in|continue with sso/i }).first();
-  if (await loginButton.isVisible().catch(() => false)) {
-    await loginButton.click({ force: true });
-  }
-  if (await waitForBackend(8_000)) return;
+    const loginButton = page.getByRole('button', { name: /login|sign in|continue with sso/i }).first();
+    if (await loginButton.isVisible().catch(() => false)) {
+      await loginButton.click({ force: true });
+    }
+    if (await waitForBackend(8_000)) return;
 
-  throw new Error(`Login did not reach backend for role: ${role}; current URL: ${page.url()}`);
+    throw new Error(`Login did not reach backend for role: ${role}; current URL: ${page.url()}`);
+  } catch (error) {
+    await throwLoginErrorWithDiagnostics(page, role, authTrace.entries, error);
+  } finally {
+    authTrace.stop();
+  }
 }

package/src/modules/sales/api/document-addresses/route.ts

@@ -1,10 +1,13 @@
 import { z } from 'zod'
-import { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'
+import { makeCrudRoute, type CrudCtx } from '@open-mercato/shared/lib/crud/factory'
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { createSalesCrudOpenApi, createPagedListResponseSchema, defaultOkResponseSchema } from '../openapi'
 import { withScopedPayload } from '../utils'
-import { SalesDocumentAddress } from '../../data/entities'
+import { SalesDocumentAddress, SalesOrder, SalesQuote } from '../../data/entities'
 import {
   documentAddressCreateSchema,
   documentAddressDeleteSchema,
@@ -34,8 +37,131 @@ const routeMetadata = {
 
 export const metadata = routeMetadata
 
+type DocumentKind = 'order' | 'quote'
+type DocumentAddressAccess = 'view' | 'manage'
+type Translate = (key: string, fallback?: string) => string
+
+const DOCUMENT_ADDRESS_FEATURES: Record<DocumentKind, Record<DocumentAddressAccess, string>> = {
+  order: { view: 'sales.orders.view', manage: 'sales.orders.manage' },
+  quote: { view: 'sales.quotes.view', manage: 'sales.quotes.manage' },
+}
+
+function toDocumentKind(value: unknown): DocumentKind | null {
+  return value === 'order' || value === 'quote' ? value : null
+}
+
+async function resolveDocumentKindForRead(query: { documentId?: string; documentKind?: DocumentKind }, ctx: CrudCtx) {
+  if (query.documentKind) return query.documentKind
+
+  const tenantId = ctx.auth?.tenantId ?? null
+  const organizationId =
+    ctx.selectedOrganizationId ??
+    ctx.auth?.orgId ??
+    (Array.isArray(ctx.organizationIds) && ctx.organizationIds.length === 1 ? ctx.organizationIds[0] : null)
+  if (!query.documentId || !tenantId || !organizationId) return null
+
+  const em = ctx.container.resolve('em') as EntityManager
+  const scope = { tenantId, organizationId }
+  const order = await findOneWithDecryption(em, SalesOrder, { id: query.documentId, tenantId, organizationId }, {}, scope)
+  if (order) return 'order'
+  const quote = await findOneWithDecryption(em, SalesQuote, { id: query.documentId, tenantId, organizationId }, {}, scope)
+  if (quote) return 'quote'
+  return null
+}
+
+async function ensureDocumentAddressReadAccess(query: { documentId?: string; documentKind?: DocumentKind }, ctx: CrudCtx) {
+  const documentKind = await resolveDocumentKindForRead(query, ctx)
+  const requiredFeatures = documentKind
+    ? [DOCUMENT_ADDRESS_FEATURES[documentKind].view]
+    : [DOCUMENT_ADDRESS_FEATURES.order.view, DOCUMENT_ADDRESS_FEATURES.quote.view]
+  await ensureDocumentAddressAccess(ctx, requiredFeatures)
+  return documentKind
+}
+
+async function resolveExistingAddressKind(
+  ctx: CrudCtx,
+  id: string,
+  scope: { tenantId: string; organizationId: string },
+): Promise<DocumentKind | null> {
+  const em = ctx.container.resolve('em') as EntityManager
+  const address = await findOneWithDecryption(
+    em,
+    SalesDocumentAddress,
+    { id, tenantId: scope.tenantId, organizationId: scope.organizationId },
+    {},
+    scope,
+  )
+  return toDocumentKind(address?.documentKind)
+}
+
+async function ensureDocumentAddressAccess(
+  ctx: CrudCtx,
+  requiredFeatures: string[],
+  translate?: Translate,
+): Promise<void> {
+  const resolvedTranslate = translate ?? (await resolveTranslations()).translate
+  const auth = ctx.auth
+  if (!auth?.sub) {
+    throw new CrudHttpError(401, { error: resolvedTranslate('api.errors.unauthorized', 'Unauthorized') })
+  }
+
+  let rbac: RbacService | null = null
+  try {
+    rbac = ctx.container.resolve('rbacService') as RbacService
+  } catch {
+    rbac = null
+  }
+
+  const ok = rbac
+    ? await rbac.userHasAllFeatures(auth.sub, requiredFeatures, {
+        tenantId: auth.tenantId ?? null,
+        organizationId: ctx.selectedOrganizationId ?? auth.orgId ?? null,
+      })
+    : false
+  if (!ok) {
+    throw new CrudHttpError(403, {
+      error: resolvedTranslate('api.errors.forbidden', 'Forbidden'),
+      requiredFeatures,
+    })
+  }
+}
+
+async function ensureDocumentAddressKindAccess(
+  ctx: CrudCtx,
+  documentKind: DocumentKind,
+  access: DocumentAddressAccess,
+  translate?: Translate,
+): Promise<void> {
+  await ensureDocumentAddressAccess(ctx, [DOCUMENT_ADDRESS_FEATURES[documentKind][access]], translate)
+}
+
+async function ensureDocumentAddressMutationAccess(
+  ctx: CrudCtx,
+  input: { id: string; documentKind: DocumentKind; tenantId: string; organizationId: string },
+  options: { includeTargetKind: boolean; translate?: Translate },
+): Promise<void> {
+  const existingKind = await resolveExistingAddressKind(ctx, input.id, {
+    tenantId: input.tenantId,
+    organizationId: input.organizationId,
+  })
+  const featureKinds = new Set<DocumentKind>()
+  if (existingKind) featureKinds.add(existingKind)
+  if (!existingKind || options.includeTargetKind) featureKinds.add(input.documentKind)
+
+  await ensureDocumentAddressAccess(
+    ctx,
+    [...featureKinds].map((kind) => DOCUMENT_ADDRESS_FEATURES[kind].manage),
+    options.translate,
+  )
+}
+
 const crud = makeCrudRoute({
   metadata: routeMetadata,
+  hooks: {
+    beforeList: async (query, ctx) => {
+      await ensureDocumentAddressReadAccess(query, ctx)
+    },
+  },
   orm: {
     entity: SalesDocumentAddress,
     idField: 'id',
@@ -76,12 +202,13 @@ const crud = makeCrudRoute({
       createdAt: 'created_at',
       updatedAt: 'updated_at',
     },
-    buildFilters: async (query: any) => {
+    buildFilters: async (query: any, ctx) => {
+      const documentKind = await resolveDocumentKindForRead(query, ctx)
       const filters: Record<string, any> = {
         document_id: { $eq: query.documentId },
       }
 
-      if (query.documentKind) filters.document_kind = { $eq: query.documentKind }
+      if (query.documentKind ?? documentKind) filters.document_kind = { $eq: query.documentKind ?? documentKind }
       return filters
     },
   },
@@ -91,7 +218,9 @@ const crud = makeCrudRoute({
       schema: rawBodySchema,
       mapInput: async ({ raw, ctx }) => {
         const { translate } = await resolveTranslations()
-        return documentAddressCreateSchema.parse(withScopedPayload(raw ?? {}, ctx, translate))
+        const input = documentAddressCreateSchema.parse(withScopedPayload(raw ?? {}, ctx, translate))
+        await ensureDocumentAddressKindAccess(ctx, input.documentKind, 'manage', translate)
+        return input
       },
       response: ({ result }) => ({ id: result?.id ?? null }),
       status: 201,
@@ -101,7 +230,9 @@ const crud = makeCrudRoute({
       schema: rawBodySchema,
       mapInput: async ({ raw, ctx }) => {
         const { translate } = await resolveTranslations()
-        return documentAddressUpdateSchema.parse(withScopedPayload(raw ?? {}, ctx, translate))
+        const input = documentAddressUpdateSchema.parse(withScopedPayload(raw ?? {}, ctx, translate))
+        await ensureDocumentAddressMutationAccess(ctx, input, { includeTargetKind: true, translate })
+        return input
       },
       response: () => ({ ok: true }),
     },
@@ -128,7 +259,9 @@ const crud = makeCrudRoute({
             error: translate('sales.documents.detail.error', 'Document not found or inaccessible.'),
           })
         }
-        return documentAddressDeleteSchema.parse(withScopedPayload({ id, documentId, documentKind }, ctx, translate))
+        const input = documentAddressDeleteSchema.parse(withScopedPayload({ id, documentId, documentKind }, ctx, translate))
+        await ensureDocumentAddressMutationAccess(ctx, input, { includeTargetKind: false, translate })
+        return input
       },
       response: () => ({ ok: true }),
     },

package/src/modules/sales/commands/documentAddresses.ts

@@ -104,6 +104,12 @@ function applyDocumentAddressSnapshot(em: EntityManager, entity: SalesDocumentAd
   entity.quote = snapshot.documentKind === 'quote' ? em.getReference(SalesQuote, snapshot.documentId) : null
 }
 
+function assertDocumentAddressParent(entity: SalesDocumentAddress, input: { documentId: string; documentKind: 'order' | 'quote' }): void {
+  if (entity.documentId !== input.documentId || entity.documentKind !== input.documentKind) {
+    throw new CrudHttpError(404, { error: 'sales.document.address.not_found' })
+  }
+}
+
 async function emitDocumentAddressIndexSideEffects(
   ctx: { container: { resolve: (name: string) => unknown } },
   action: 'created' | 'updated' | 'deleted',
@@ -256,6 +262,7 @@ const updateDocumentAddress: CommandHandler<DocumentAddressUpdateInput, { id: st
       'sales.document.address.not_found'
     )
     ensureSameScope(entity, input.organizationId, input.tenantId)
+    assertDocumentAddressParent(entity, input)
     const document = await requireDocument(em, input.documentKind, input.documentId, input.organizationId, input.tenantId)
     if (input.documentKind === 'order') {
       await assertAddressEditable(em, {
@@ -344,6 +351,7 @@ const deleteDocumentAddress: CommandHandler<
       'sales.document.address.not_found'
     )
     ensureSameScope(entity, input.organizationId, input.tenantId)
+    assertDocumentAddressParent(entity, input)
     const document = await requireDocument(em, input.documentKind, input.documentId, input.organizationId, input.tenantId)
     if (input.documentKind === 'order') {
       await assertAddressEditable(em, {