@open-mercato/core 0.7.1-develop.7193.1.910a5b0a1e → 0.7.1-develop.7194.1.ab4fc81f82

package/src/modules/auth/i18n/de.json

@@ -13,6 +13,27 @@
   "auth.acl.deps.orphaned.restore": "\"{dependency}\" wiederherstellen",
   "auth.acl.deps.orphaned.title": "Entfernung einer Berechtigung, die andere gewährte Berechtigungen benötigen:",
   "auth.acl.deps.unknown.title": "Einige deklarierte Abhängigkeiten passen zu keiner bekannten Berechtigung:",
+  "auth.acl.features.agent_orchestrator.agents.manage": "Manage agent presentation settings",
+  "auth.acl.features.agent_orchestrator.agents.run": "Run agents directly (Playground, evals, diagnostics)",
+  "auth.acl.features.agent_orchestrator.agents.view": "View agents and runs",
+  "auth.acl.features.agent_orchestrator.context.read": "View agent context bundles",
+  "auth.acl.features.agent_orchestrator.eval.export": "Export the agent eval-case set",
+  "auth.acl.features.agent_orchestrator.eval.manage": "Manage evaluation cases and assertions",
+  "auth.acl.features.agent_orchestrator.eval.run": "Run agent evaluations",
+  "auth.acl.features.agent_orchestrator.guardrail.manage": "Manage guardrail sets",
+  "auth.acl.features.agent_orchestrator.guardrail.read": "View guardrail checks",
+  "auth.acl.features.agent_orchestrator.identity.manage": "Manage agent principals (provision agent users + scoped roles)",
+  "auth.acl.features.agent_orchestrator.identity.read": "View agent principals",
+  "auth.acl.features.agent_orchestrator.identity.tokens": "Manage external agent tokens and delegation grants",
+  "auth.acl.features.agent_orchestrator.processes.manage": "Create and configure process definitions",
+  "auth.acl.features.agent_orchestrator.processes.run": "Start a process run",
+  "auth.acl.features.agent_orchestrator.processes.view": "View agent processes, process definitions and run history",
+  "auth.acl.features.agent_orchestrator.proposals.dispose": "Dispose proposals (approve/edit/reject)",
+  "auth.acl.features.agent_orchestrator.proposals.view": "View proposals",
+  "auth.acl.features.agent_orchestrator.trace.correct": "Record agent corrections",
+  "auth.acl.features.agent_orchestrator.trace.view": "View agent run traces",
+  "auth.acl.features.agent_orchestrator.web_fetch": "Use agent web fetch (retrieve an arbitrary URL)",
+  "auth.acl.features.agent_orchestrator.web_search": "Use agent web search",
   "auth.acl.features.ai_assistant.conversations.manage": "Manage AI Assistant Conversations",
   "auth.acl.features.ai_assistant.conversations.share": "Share AI Assistant Conversations",
   "auth.acl.features.ai_assistant.mcp.serve": "Start MCP Server",
@@ -322,18 +343,28 @@
   "auth.acl.features.workflows.definitions.create": "Create workflow definitions",
   "auth.acl.features.workflows.definitions.delete": "Delete workflow definitions",
   "auth.acl.features.workflows.definitions.edit": "Edit workflow definitions",
+  "auth.acl.features.workflows.definitions.grant_features": "Grant execution features to workflow definitions",
+  "auth.acl.features.workflows.definitions.publish": "Publish workflow definition versions",
+  "auth.acl.features.workflows.definitions.test_run": "Test workflow definition steps",
   "auth.acl.features.workflows.definitions.view": "View workflow definitions",
   "auth.acl.features.workflows.events.view": "View workflow events",
+  "auth.acl.features.workflows.instances.bulk_ops": "Bulk retry or cancel workflow instances",
   "auth.acl.features.workflows.instances.cancel": "Cancel workflow instances",
   "auth.acl.features.workflows.instances.create": "Start workflow instances",
+  "auth.acl.features.workflows.instances.rerun_step": "Rerun a workflow instance from a step",
   "auth.acl.features.workflows.instances.retry": "Retry workflow instances",
   "auth.acl.features.workflows.instances.signal": "Signal workflow instances",
+  "auth.acl.features.workflows.instances.update_context": "Update workflow instance context",
   "auth.acl.features.workflows.instances.view": "View workflow instances",
   "auth.acl.features.workflows.manage": "Manage workflows",
+  "auth.acl.features.workflows.metrics.view": "View workflow operational metrics",
   "auth.acl.features.workflows.signals.send": "Send workflow signals",
   "auth.acl.features.workflows.tasks.claim": "Claim workflow tasks",
   "auth.acl.features.workflows.tasks.complete": "Complete workflow tasks",
+  "auth.acl.features.workflows.tasks.manage": "Administer workflow tasks",
+  "auth.acl.features.workflows.tasks.reassign": "Reassign workflow tasks",
   "auth.acl.features.workflows.tasks.view": "View user tasks",
+  "auth.acl.features.workflows.tasks.view_all": "View all workflow tasks",
   "auth.acl.features.workflows.view": "View workflows",
   "auth.acl.features.workflows.view_logs": "View workflow logs",
   "auth.acl.features.workflows.view_tasks": "View workflow tasks",

package/src/modules/auth/i18n/en.json

@@ -13,6 +13,27 @@
   "auth.acl.deps.orphaned.restore": "Restore \"{dependency}\"",
   "auth.acl.deps.orphaned.title": "Removing a permission that other granted permissions need:",
   "auth.acl.deps.unknown.title": "Some declared dependencies do not match any known permission:",
+  "auth.acl.features.agent_orchestrator.agents.manage": "Manage agent presentation settings",
+  "auth.acl.features.agent_orchestrator.agents.run": "Run agents directly (Playground, evals, diagnostics)",
+  "auth.acl.features.agent_orchestrator.agents.view": "View agents and runs",
+  "auth.acl.features.agent_orchestrator.context.read": "View agent context bundles",
+  "auth.acl.features.agent_orchestrator.eval.export": "Export the agent eval-case set",
+  "auth.acl.features.agent_orchestrator.eval.manage": "Manage evaluation cases and assertions",
+  "auth.acl.features.agent_orchestrator.eval.run": "Run agent evaluations",
+  "auth.acl.features.agent_orchestrator.guardrail.manage": "Manage guardrail sets",
+  "auth.acl.features.agent_orchestrator.guardrail.read": "View guardrail checks",
+  "auth.acl.features.agent_orchestrator.identity.manage": "Manage agent principals (provision agent users + scoped roles)",
+  "auth.acl.features.agent_orchestrator.identity.read": "View agent principals",
+  "auth.acl.features.agent_orchestrator.identity.tokens": "Manage external agent tokens and delegation grants",
+  "auth.acl.features.agent_orchestrator.processes.manage": "Create and configure process definitions",
+  "auth.acl.features.agent_orchestrator.processes.run": "Start a process run",
+  "auth.acl.features.agent_orchestrator.processes.view": "View agent processes, process definitions and run history",
+  "auth.acl.features.agent_orchestrator.proposals.dispose": "Dispose proposals (approve/edit/reject)",
+  "auth.acl.features.agent_orchestrator.proposals.view": "View proposals",
+  "auth.acl.features.agent_orchestrator.trace.correct": "Record agent corrections",
+  "auth.acl.features.agent_orchestrator.trace.view": "View agent run traces",
+  "auth.acl.features.agent_orchestrator.web_fetch": "Use agent web fetch (retrieve an arbitrary URL)",
+  "auth.acl.features.agent_orchestrator.web_search": "Use agent web search",
   "auth.acl.features.ai_assistant.conversations.manage": "Manage AI Assistant Conversations",
   "auth.acl.features.ai_assistant.conversations.share": "Share AI Assistant Conversations",
   "auth.acl.features.ai_assistant.mcp.serve": "Start MCP Server",
@@ -322,18 +343,28 @@
   "auth.acl.features.workflows.definitions.create": "Create workflow definitions",
   "auth.acl.features.workflows.definitions.delete": "Delete workflow definitions",
   "auth.acl.features.workflows.definitions.edit": "Edit workflow definitions",
+  "auth.acl.features.workflows.definitions.grant_features": "Grant execution features to workflow definitions",
+  "auth.acl.features.workflows.definitions.publish": "Publish workflow definition versions",
+  "auth.acl.features.workflows.definitions.test_run": "Test workflow definition steps",
   "auth.acl.features.workflows.definitions.view": "View workflow definitions",
   "auth.acl.features.workflows.events.view": "View workflow events",
+  "auth.acl.features.workflows.instances.bulk_ops": "Bulk retry or cancel workflow instances",
   "auth.acl.features.workflows.instances.cancel": "Cancel workflow instances",
   "auth.acl.features.workflows.instances.create": "Start workflow instances",
+  "auth.acl.features.workflows.instances.rerun_step": "Rerun a workflow instance from a step",
   "auth.acl.features.workflows.instances.retry": "Retry workflow instances",
   "auth.acl.features.workflows.instances.signal": "Signal workflow instances",
+  "auth.acl.features.workflows.instances.update_context": "Update workflow instance context",
   "auth.acl.features.workflows.instances.view": "View workflow instances",
   "auth.acl.features.workflows.manage": "Manage workflows",
+  "auth.acl.features.workflows.metrics.view": "View workflow operational metrics",
   "auth.acl.features.workflows.signals.send": "Send workflow signals",
   "auth.acl.features.workflows.tasks.claim": "Claim workflow tasks",
   "auth.acl.features.workflows.tasks.complete": "Complete workflow tasks",
+  "auth.acl.features.workflows.tasks.manage": "Administer workflow tasks",
+  "auth.acl.features.workflows.tasks.reassign": "Reassign workflow tasks",
   "auth.acl.features.workflows.tasks.view": "View user tasks",
+  "auth.acl.features.workflows.tasks.view_all": "View all workflow tasks",
   "auth.acl.features.workflows.view": "View workflows",
   "auth.acl.features.workflows.view_logs": "View workflow logs",
   "auth.acl.features.workflows.view_tasks": "View workflow tasks",

package/src/modules/auth/i18n/es.json

@@ -13,6 +13,27 @@
   "auth.acl.deps.orphaned.restore": "Restaurar \"{dependency}\"",
   "auth.acl.deps.orphaned.title": "Eliminando un permiso que otros permisos otorgados necesitan:",
   "auth.acl.deps.unknown.title": "Algunas dependencias declaradas no coinciden con ningún permiso conocido:",
+  "auth.acl.features.agent_orchestrator.agents.manage": "Manage agent presentation settings",
+  "auth.acl.features.agent_orchestrator.agents.run": "Run agents directly (Playground, evals, diagnostics)",
+  "auth.acl.features.agent_orchestrator.agents.view": "View agents and runs",
+  "auth.acl.features.agent_orchestrator.context.read": "View agent context bundles",
+  "auth.acl.features.agent_orchestrator.eval.export": "Export the agent eval-case set",
+  "auth.acl.features.agent_orchestrator.eval.manage": "Manage evaluation cases and assertions",
+  "auth.acl.features.agent_orchestrator.eval.run": "Run agent evaluations",
+  "auth.acl.features.agent_orchestrator.guardrail.manage": "Manage guardrail sets",
+  "auth.acl.features.agent_orchestrator.guardrail.read": "View guardrail checks",
+  "auth.acl.features.agent_orchestrator.identity.manage": "Manage agent principals (provision agent users + scoped roles)",
+  "auth.acl.features.agent_orchestrator.identity.read": "View agent principals",
+  "auth.acl.features.agent_orchestrator.identity.tokens": "Manage external agent tokens and delegation grants",
+  "auth.acl.features.agent_orchestrator.processes.manage": "Create and configure process definitions",
+  "auth.acl.features.agent_orchestrator.processes.run": "Start a process run",
+  "auth.acl.features.agent_orchestrator.processes.view": "View agent processes, process definitions and run history",
+  "auth.acl.features.agent_orchestrator.proposals.dispose": "Dispose proposals (approve/edit/reject)",
+  "auth.acl.features.agent_orchestrator.proposals.view": "View proposals",
+  "auth.acl.features.agent_orchestrator.trace.correct": "Record agent corrections",
+  "auth.acl.features.agent_orchestrator.trace.view": "View agent run traces",
+  "auth.acl.features.agent_orchestrator.web_fetch": "Use agent web fetch (retrieve an arbitrary URL)",
+  "auth.acl.features.agent_orchestrator.web_search": "Use agent web search",
   "auth.acl.features.ai_assistant.conversations.manage": "Manage AI Assistant Conversations",
   "auth.acl.features.ai_assistant.conversations.share": "Share AI Assistant Conversations",
   "auth.acl.features.ai_assistant.mcp.serve": "Start MCP Server",
@@ -322,18 +343,28 @@
   "auth.acl.features.workflows.definitions.create": "Create workflow definitions",
   "auth.acl.features.workflows.definitions.delete": "Delete workflow definitions",
   "auth.acl.features.workflows.definitions.edit": "Edit workflow definitions",
+  "auth.acl.features.workflows.definitions.grant_features": "Grant execution features to workflow definitions",
+  "auth.acl.features.workflows.definitions.publish": "Publish workflow definition versions",
+  "auth.acl.features.workflows.definitions.test_run": "Test workflow definition steps",
   "auth.acl.features.workflows.definitions.view": "View workflow definitions",
   "auth.acl.features.workflows.events.view": "View workflow events",
+  "auth.acl.features.workflows.instances.bulk_ops": "Bulk retry or cancel workflow instances",
   "auth.acl.features.workflows.instances.cancel": "Cancel workflow instances",
   "auth.acl.features.workflows.instances.create": "Start workflow instances",
+  "auth.acl.features.workflows.instances.rerun_step": "Rerun a workflow instance from a step",
   "auth.acl.features.workflows.instances.retry": "Retry workflow instances",
   "auth.acl.features.workflows.instances.signal": "Signal workflow instances",
+  "auth.acl.features.workflows.instances.update_context": "Update workflow instance context",
   "auth.acl.features.workflows.instances.view": "View workflow instances",
   "auth.acl.features.workflows.manage": "Manage workflows",
+  "auth.acl.features.workflows.metrics.view": "View workflow operational metrics",
   "auth.acl.features.workflows.signals.send": "Send workflow signals",
   "auth.acl.features.workflows.tasks.claim": "Claim workflow tasks",
   "auth.acl.features.workflows.tasks.complete": "Complete workflow tasks",
+  "auth.acl.features.workflows.tasks.manage": "Administer workflow tasks",
+  "auth.acl.features.workflows.tasks.reassign": "Reassign workflow tasks",
   "auth.acl.features.workflows.tasks.view": "View user tasks",
+  "auth.acl.features.workflows.tasks.view_all": "View all workflow tasks",
   "auth.acl.features.workflows.view": "View workflows",
   "auth.acl.features.workflows.view_logs": "View workflow logs",
   "auth.acl.features.workflows.view_tasks": "View workflow tasks",

package/src/modules/auth/i18n/ko.json

@@ -13,6 +13,27 @@
   "auth.acl.deps.orphaned.restore": "\"{dependency}\" 복원",
   "auth.acl.deps.orphaned.title": "다른 부여된 권한에 필요한 권한을 제거하고 있습니다:",
   "auth.acl.deps.unknown.title": "일부 선언된 종속성이 알려진 권한과 일치하지 않습니다:",
+  "auth.acl.features.agent_orchestrator.agents.manage": "Manage agent presentation settings",
+  "auth.acl.features.agent_orchestrator.agents.run": "Run agents directly (Playground, evals, diagnostics)",
+  "auth.acl.features.agent_orchestrator.agents.view": "View agents and runs",
+  "auth.acl.features.agent_orchestrator.context.read": "View agent context bundles",
+  "auth.acl.features.agent_orchestrator.eval.export": "Export the agent eval-case set",
+  "auth.acl.features.agent_orchestrator.eval.manage": "Manage evaluation cases and assertions",
+  "auth.acl.features.agent_orchestrator.eval.run": "Run agent evaluations",
+  "auth.acl.features.agent_orchestrator.guardrail.manage": "Manage guardrail sets",
+  "auth.acl.features.agent_orchestrator.guardrail.read": "View guardrail checks",
+  "auth.acl.features.agent_orchestrator.identity.manage": "Manage agent principals (provision agent users + scoped roles)",
+  "auth.acl.features.agent_orchestrator.identity.read": "View agent principals",
+  "auth.acl.features.agent_orchestrator.identity.tokens": "Manage external agent tokens and delegation grants",
+  "auth.acl.features.agent_orchestrator.processes.manage": "Create and configure process definitions",
+  "auth.acl.features.agent_orchestrator.processes.run": "Start a process run",
+  "auth.acl.features.agent_orchestrator.processes.view": "View agent processes, process definitions and run history",
+  "auth.acl.features.agent_orchestrator.proposals.dispose": "Dispose proposals (approve/edit/reject)",
+  "auth.acl.features.agent_orchestrator.proposals.view": "View proposals",
+  "auth.acl.features.agent_orchestrator.trace.correct": "Record agent corrections",
+  "auth.acl.features.agent_orchestrator.trace.view": "View agent run traces",
+  "auth.acl.features.agent_orchestrator.web_fetch": "Use agent web fetch (retrieve an arbitrary URL)",
+  "auth.acl.features.agent_orchestrator.web_search": "Use agent web search",
   "auth.acl.features.ai_assistant.conversations.manage": "Manage AI Assistant Conversations",
   "auth.acl.features.ai_assistant.conversations.share": "Share AI Assistant Conversations",
   "auth.acl.features.ai_assistant.mcp.serve": "Start MCP Server",
@@ -322,18 +343,28 @@
   "auth.acl.features.workflows.definitions.create": "Create workflow definitions",
   "auth.acl.features.workflows.definitions.delete": "Delete workflow definitions",
   "auth.acl.features.workflows.definitions.edit": "Edit workflow definitions",
+  "auth.acl.features.workflows.definitions.grant_features": "Grant execution features to workflow definitions",
+  "auth.acl.features.workflows.definitions.publish": "Publish workflow definition versions",
+  "auth.acl.features.workflows.definitions.test_run": "Test workflow definition steps",
   "auth.acl.features.workflows.definitions.view": "View workflow definitions",
   "auth.acl.features.workflows.events.view": "View workflow events",
+  "auth.acl.features.workflows.instances.bulk_ops": "Bulk retry or cancel workflow instances",
   "auth.acl.features.workflows.instances.cancel": "Cancel workflow instances",
   "auth.acl.features.workflows.instances.create": "Start workflow instances",
+  "auth.acl.features.workflows.instances.rerun_step": "Rerun a workflow instance from a step",
   "auth.acl.features.workflows.instances.retry": "Retry workflow instances",
   "auth.acl.features.workflows.instances.signal": "Signal workflow instances",
+  "auth.acl.features.workflows.instances.update_context": "Update workflow instance context",
   "auth.acl.features.workflows.instances.view": "View workflow instances",
   "auth.acl.features.workflows.manage": "Manage workflows",
+  "auth.acl.features.workflows.metrics.view": "View workflow operational metrics",
   "auth.acl.features.workflows.signals.send": "Send workflow signals",
   "auth.acl.features.workflows.tasks.claim": "Claim workflow tasks",
   "auth.acl.features.workflows.tasks.complete": "Complete workflow tasks",
+  "auth.acl.features.workflows.tasks.manage": "Administer workflow tasks",
+  "auth.acl.features.workflows.tasks.reassign": "Reassign workflow tasks",
   "auth.acl.features.workflows.tasks.view": "View user tasks",
+  "auth.acl.features.workflows.tasks.view_all": "View all workflow tasks",
   "auth.acl.features.workflows.view": "View workflows",
   "auth.acl.features.workflows.view_logs": "View workflow logs",
   "auth.acl.features.workflows.view_tasks": "View workflow tasks",

package/src/modules/auth/i18n/pl.json

@@ -13,6 +13,27 @@
   "auth.acl.deps.orphaned.restore": "Przywróć \"{dependency}\"",
   "auth.acl.deps.orphaned.title": "Usuwasz uprawnienie wymagane przez inne przyznane uprawnienia:",
   "auth.acl.deps.unknown.title": "Niektóre zadeklarowane zależności nie pasują do żadnego znanego uprawnienia:",
+  "auth.acl.features.agent_orchestrator.agents.manage": "Zarządzaj ustawieniami prezentacji agentów",
+  "auth.acl.features.agent_orchestrator.agents.run": "Uruchamiaj agentów bezpośrednio (Playground, ewaluacje, diagnostyka)",
+  "auth.acl.features.agent_orchestrator.agents.view": "Wyświetl agentów i uruchomienia",
+  "auth.acl.features.agent_orchestrator.context.read": "Wyświetl pakiety kontekstu agentów",
+  "auth.acl.features.agent_orchestrator.eval.export": "Eksportuj zestaw przypadków ewaluacji agentów",
+  "auth.acl.features.agent_orchestrator.eval.manage": "Zarządzaj przypadkami ewaluacji i asercjami",
+  "auth.acl.features.agent_orchestrator.eval.run": "Uruchamiaj ewaluacje agentów",
+  "auth.acl.features.agent_orchestrator.guardrail.manage": "Zarządzaj zestawami guardrail",
+  "auth.acl.features.agent_orchestrator.guardrail.read": "Wyświetl kontrole guardrail",
+  "auth.acl.features.agent_orchestrator.identity.manage": "Zarządzaj tożsamościami agentów (twórz użytkowników agentów i role o ograniczonym zakresie)",
+  "auth.acl.features.agent_orchestrator.identity.read": "Wyświetl tożsamości agentów",
+  "auth.acl.features.agent_orchestrator.identity.tokens": "Zarządzaj zewnętrznymi tokenami agentów i uprawnieniami delegowania",
+  "auth.acl.features.agent_orchestrator.processes.manage": "Twórz i konfiguruj definicje procesów",
+  "auth.acl.features.agent_orchestrator.processes.run": "Uruchamiaj procesy",
+  "auth.acl.features.agent_orchestrator.processes.view": "Wyświetl procesy agentów, definicje procesów i historię uruchomień",
+  "auth.acl.features.agent_orchestrator.proposals.dispose": "Rozstrzygaj propozycje (zatwierdź/edytuj/odrzuć)",
+  "auth.acl.features.agent_orchestrator.proposals.view": "Wyświetl propozycje",
+  "auth.acl.features.agent_orchestrator.trace.correct": "Zapisuj korekty agentów",
+  "auth.acl.features.agent_orchestrator.trace.view": "Wyświetl ślady uruchomień agentów",
+  "auth.acl.features.agent_orchestrator.web_fetch": "Korzystaj z pobierania stron przez agenta (dowolny adres URL)",
+  "auth.acl.features.agent_orchestrator.web_search": "Korzystaj z wyszukiwania w sieci przez agenta",
   "auth.acl.features.ai_assistant.conversations.manage": "Zarządzaj rozmowami Asystenta AI",
   "auth.acl.features.ai_assistant.conversations.share": "Udostępniaj rozmowy Asystenta AI",
   "auth.acl.features.ai_assistant.mcp.serve": "Uruchamiaj serwer MCP",
@@ -322,18 +343,28 @@
   "auth.acl.features.workflows.definitions.create": "Twórz definicje przepływów pracy",
   "auth.acl.features.workflows.definitions.delete": "Usuwaj definicje przepływów pracy",
   "auth.acl.features.workflows.definitions.edit": "Edytuj definicje przepływów pracy",
+  "auth.acl.features.workflows.definitions.grant_features": "Nadawaj uprawnienia wykonawcze definicjom przepływów pracy",
+  "auth.acl.features.workflows.definitions.publish": "Publikuj wersje definicji przepływów pracy",
+  "auth.acl.features.workflows.definitions.test_run": "Testuj kroki definicji przepływów pracy",
   "auth.acl.features.workflows.definitions.view": "Wyświetl definicje przepływów pracy",
   "auth.acl.features.workflows.events.view": "Wyświetl zdarzenia przepływów pracy",
+  "auth.acl.features.workflows.instances.bulk_ops": "Masowo ponawiaj lub anuluj instancje przepływów pracy",
   "auth.acl.features.workflows.instances.cancel": "Anuluj instancje przepływów pracy",
   "auth.acl.features.workflows.instances.create": "Uruchamiaj instancje przepływów pracy",
+  "auth.acl.features.workflows.instances.rerun_step": "Uruchamiaj ponownie instancję przepływu pracy od wybranego kroku",
   "auth.acl.features.workflows.instances.retry": "Ponawiaj instancje przepływów pracy",
   "auth.acl.features.workflows.instances.signal": "Wysyłaj sygnały do instancji przepływów pracy",
+  "auth.acl.features.workflows.instances.update_context": "Aktualizuj kontekst instancji przepływu pracy",
   "auth.acl.features.workflows.instances.view": "Wyświetl instancje przepływów pracy",
   "auth.acl.features.workflows.manage": "Zarządzaj przepływami pracy",
+  "auth.acl.features.workflows.metrics.view": "Wyświetl metryki operacyjne przepływów pracy",
   "auth.acl.features.workflows.signals.send": "Wysyłaj sygnały przepływów pracy",
   "auth.acl.features.workflows.tasks.claim": "Podejmuj zadania przepływów pracy",
   "auth.acl.features.workflows.tasks.complete": "Kończ zadania przepływów pracy",
+  "auth.acl.features.workflows.tasks.manage": "Administruj zadaniami przepływów pracy",
+  "auth.acl.features.workflows.tasks.reassign": "Przypisuj ponownie zadania przepływów pracy",
   "auth.acl.features.workflows.tasks.view": "Wyświetl zadania użytkowników",
+  "auth.acl.features.workflows.tasks.view_all": "Wyświetl wszystkie zadania przepływów pracy",
   "auth.acl.features.workflows.view": "Wyświetl przepływy pracy",
   "auth.acl.features.workflows.view_logs": "Wyświetl dzienniki przepływów pracy",
   "auth.acl.features.workflows.view_tasks": "Wyświetl zadania przepływów pracy",

package/src/modules/auth/lib/executionPrincipal.ts

@@ -0,0 +1,235 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { AwilixContainer } from 'awilix'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { computeEmailHash } from './emailHash'
+import { Role, RoleAcl, User, UserRole, type UserKind } from '../data/entities'
+
+/**
+ * A non-interactive execution principal: a login-less `User` plus a scoped
+ * `Role` whose ACL carries EXACTLY the features that principal may use.
+ *
+ * This lives in `auth` because `User` / `Role` / `RoleAcl` / `UserRole` are this
+ * module's entities. Any module that needs a machine identity to write under —
+ * an agentic task, a workflow definition declaring a grant, a future scheduled
+ * job — provisions one here rather than reimplementing the four find-or-create
+ * steps and the ACL replacement.
+ *
+ * The `enterprise` agent_orchestrator module owns an older copy of this logic
+ * (`lib/identity/agentPrincipalService.ts`), which core MUST NOT import (an
+ * optional peer). The naming knobs below exist so that copy can be migrated onto
+ * this helper WITHOUT changing any provisioned row's identity: calling with
+ * `{ namePrefix: 'agent', kind: 'agent', mergeFeatures: true }` reproduces its
+ * email and role name byte-for-byte.
+ */
+export type ExecutionPrincipalScope = { tenantId: string; organizationId: string }
+
+export type ResolvedExecutionPrincipal = {
+  userId: string
+  roleId: string
+}
+
+export type ProvisionExecutionPrincipalInput = {
+  /**
+   * Namespaced, stable identity key — e.g. `workflow:<definitionId>`. It is the
+   * idempotency key: the deterministic email and role name are both derived from
+   * it, so re-provisioning resolves the same rows instead of creating new ones.
+   */
+  principalKey: string
+  displayName?: string
+  /** The principal's complete feature set. Replaces the role ACL unless `mergeFeatures`. */
+  features: string[]
+  /** Defaults to `service` — a machine principal that is not an AI agent. */
+  kind?: UserKind
+  /** Local-part / role-name prefix. Defaults to `principal`. */
+  namePrefix?: string
+  /**
+   * Merge into the existing ACL instead of replacing it. Default `false`:
+   * merging cannot NARROW a previously over-granted principal, which is the
+   * whole point of re-scoping on every save.
+   */
+  mergeFeatures?: boolean
+}
+
+/**
+ * Non-routable internal domain. An execution principal never receives mail and
+ * never logs in interactively, so this address is an identity key, not a mailbox.
+ */
+const EXECUTION_PRINCIPAL_EMAIL_DOMAIN = 'agent.internal'
+const DEFAULT_NAME_PREFIX = 'principal'
+
+function slugifyPrincipalKey(principalKey: string): string {
+  return principalKey.toLowerCase().replace(/[^a-z0-9._-]+/g, '-')
+}
+
+export function executionPrincipalEmail(
+  principalKey: string,
+  organizationId: string,
+  namePrefix: string = DEFAULT_NAME_PREFIX,
+): string {
+  return `${namePrefix}+${slugifyPrincipalKey(principalKey)}+${organizationId}@${EXECUTION_PRINCIPAL_EMAIL_DOMAIN}`
+}
+
+export function executionPrincipalRoleName(
+  principalKey: string,
+  namePrefix: string = DEFAULT_NAME_PREFIX,
+): string {
+  return `${namePrefix}:${principalKey}`
+}
+
+export function normalizeFeatureList(value: unknown): string[] {
+  if (!Array.isArray(value)) return []
+  const seen = new Set<string>()
+  for (const entry of value) {
+    if (typeof entry !== 'string') continue
+    const trimmed = entry.trim()
+    if (trimmed) seen.add(trimmed)
+  }
+  return Array.from(seen).sort((a, b) => a.localeCompare(b))
+}
+
+/**
+ * Provisions — idempotently — the execution principal for `principalKey` and
+ * pins its role ACL to exactly `features`.
+ *
+ * Non-interactive by construction: `passwordHash = null` + `isConfirmed = false`
+ * leaves the password/SSO flow nothing to authenticate against. `isSuperAdmin`
+ * is always false and the ACL's organization visibility is pinned to the
+ * provisioning organization, so the principal can never out-scope its owner.
+ */
+export async function provisionExecutionPrincipal(
+  container: AwilixContainer,
+  scope: ExecutionPrincipalScope,
+  input: ProvisionExecutionPrincipalInput,
+): Promise<ResolvedExecutionPrincipal> {
+  const { tenantId, organizationId } = scope
+  const principalKey = input.principalKey.trim()
+  if (!principalKey) throw new Error('[internal] execution principal requires a principalKey')
+  if (!tenantId || !organizationId) {
+    throw new Error('[internal] execution principal requires a tenant and organization scope')
+  }
+
+  const namePrefix = input.namePrefix ?? DEFAULT_NAME_PREFIX
+  const kind: UserKind = input.kind ?? 'service'
+  const features = normalizeFeatureList(input.features)
+  const roleName = executionPrincipalRoleName(principalKey, namePrefix)
+  const principalEmail = executionPrincipalEmail(principalKey, organizationId, namePrefix)
+
+  const em = (container.resolve('em') as EntityManager).fork()
+
+  return em.transactional(async (trx) => {
+    let role = await findOneWithDecryption(
+      trx,
+      Role,
+      { name: roleName, tenantId },
+      {},
+      { tenantId, organizationId: null },
+    )
+    if (!role) {
+      role = trx.create(Role, { name: roleName, tenantId, minActiveHolders: 0, createdAt: new Date() })
+      trx.persist(role)
+      await trx.flush()
+    }
+
+    const existingAcl = await findOneWithDecryption(
+      trx,
+      RoleAcl,
+      { role, tenantId },
+      {},
+      { tenantId, organizationId: null },
+    )
+    if (!existingAcl) {
+      trx.persist(
+        trx.create(RoleAcl, {
+          role,
+          tenantId,
+          featuresJson: features,
+          isSuperAdmin: false,
+          organizationsJson: [organizationId],
+          createdAt: new Date(),
+        }),
+      )
+      await trx.flush()
+    } else {
+      const current = normalizeFeatureList(existingAcl.featuresJson)
+      const next = input.mergeFeatures ? normalizeFeatureList([...current, ...features]) : features
+      if (
+        existingAcl.isSuperAdmin ||
+        current.length !== next.length ||
+        current.some((feature, index) => feature !== next[index])
+      ) {
+        existingAcl.featuresJson = next
+        existingAcl.isSuperAdmin = false
+        existingAcl.organizationsJson = [organizationId]
+        trx.persist(existingAcl)
+        await trx.flush()
+      }
+    }
+
+    const emailHash = computeEmailHash(principalEmail)
+    let user = await findOneWithDecryption(
+      trx,
+      User,
+      { emailHash, tenantId, deletedAt: null },
+      {},
+      { tenantId, organizationId },
+    )
+    if (!user) {
+      user = trx.create(User, {
+        email: principalEmail,
+        emailHash,
+        passwordHash: null,
+        isConfirmed: false,
+        kind,
+        name: input.displayName ?? principalKey,
+        tenantId,
+        organizationId,
+        createdAt: new Date(),
+      })
+      trx.persist(user)
+      await trx.flush()
+    } else if (user.kind === 'human') {
+      // Defensive: a row resolved by the deterministic principal email must never
+      // be a human account. Never silently repurpose one.
+      throw new Error('[internal] resolved a human User for an execution principal')
+    }
+
+    const existingLink = await findOneWithDecryption(
+      trx,
+      UserRole,
+      { user, role },
+      {},
+      { tenantId, organizationId: null },
+    )
+    if (!existingLink) {
+      trx.persist(trx.create(UserRole, { user, role, createdAt: new Date() }))
+      await trx.flush()
+    }
+
+    return { userId: user.id, roleId: role.id }
+  })
+}
+
+/**
+ * Resolves the `User` id of an already-provisioned execution principal without
+ * writing anything. Returns null when it has not been provisioned (or was
+ * soft-deleted) — callers MUST fail closed rather than fall back to a broader
+ * identity.
+ */
+export async function resolveExecutionPrincipalUserId(
+  em: EntityManager,
+  principalKey: string,
+  scope: ExecutionPrincipalScope,
+  namePrefix: string = DEFAULT_NAME_PREFIX,
+): Promise<string | null> {
+  const { tenantId, organizationId } = scope
+  if (!principalKey || !tenantId || !organizationId) return null
+  const emailHash = computeEmailHash(executionPrincipalEmail(principalKey, organizationId, namePrefix))
+  const user = await findOneWithDecryption(
+    em,
+    User,
+    { emailHash, tenantId, deletedAt: null },
+    {},
+    { tenantId, organizationId },
+  )
+  return user?.id ?? null
+}

package/src/modules/auth/migrations/.snapshot-open-mercato.json

@@ -618,6 +618,22 @@
           "enumItems": [],
           "mappedType": "boolean"
         },
+        "kind": {
+          "name": "kind",
+          "type": "varchar(20)",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": false,
+          "unique": false,
+          "length": 20,
+          "precision": null,
+          "scale": null,
+          "default": "'human'",
+          "comment": null,
+          "enumItems": [],
+          "mappedType": "string"
+        },
         "last_login_at": {
           "name": "last_login_at",
           "type": "timestamptz",

package/src/modules/auth/migrations/Migration20260625050000.ts

@@ -0,0 +1,21 @@
+import { Migration } from '@mikro-orm/migrations';
+
+// Add `kind` to `users` so an AI agent can be modeled as a first-class,
+// non-interactive principal (`kind='agent'`) attributed identically to a human
+// on every write (agent identity & on-behalf-of spec, Wave 4 Phase 1). The
+// column is additive and backward-compatible per BACKWARD_COMPATIBILITY.md
+// (DB schema is ADDITIVE-ONLY): NOT NULL with a server-side DEFAULT 'human', so
+// every existing row backfills to 'human' immediately and no existing reader of
+// `auth.User` breaks. The NOT NULL is safe online because the default fills the
+// value for legacy rows during the ALTER.
+export class Migration20260625050000 extends Migration {
+
+  override up(): void | Promise<void> {
+    this.addSql(`alter table "users" add column if not exists "kind" varchar(20) not null default 'human';`);
+  }
+
+  override down(): void | Promise<void> {
+    this.addSql(`alter table "users" drop column if exists "kind";`);
+  }
+
+}