@open-mercato/core 0.7.1-develop.7193.1.910a5b0a1e → 0.7.1-develop.7194.1.ab4fc81f82

package/dist/modules/sales/events.js

@@ -1,4 +1,15 @@
 import { createModuleEvents } from "@open-mercato/shared/modules/events";
+const totalsCalculatedPayloadSchema = {
+  fields: [
+    { path: "documentKind", type: "text" },
+    { path: "documentId", type: "text" },
+    { path: "organizationId", type: "text" },
+    { path: "tenantId", type: "text" },
+    { path: "customerId", type: "text", optional: true },
+    { path: "totals", type: "object" },
+    { path: "lineCount", type: "number" }
+  ]
+};
 const events = [
   // Orders
   { id: "sales.order.created", label: "Sales Order Created", entity: "order", category: "crud" },
@@ -44,7 +55,7 @@ const events = [
   { id: "sales.channel.updated", label: "Sales Channel Updated", entity: "channel", category: "crud" },
   { id: "sales.channel.deleted", label: "Sales Channel Deleted", entity: "channel", category: "crud" },
   // Lifecycle events - Document calculations
-  { id: "sales.document.totals.calculated", label: "Document Totals Calculated", category: "lifecycle" },
+  { id: "sales.document.totals.calculated", label: "Document Totals Calculated", category: "lifecycle", payloadSchema: totalsCalculatedPayloadSchema },
   { id: "sales.document.calculate.before", label: "Before Document Calculate", category: "lifecycle", excludeFromTriggers: true },
   { id: "sales.document.calculate.after", label: "After Document Calculate", category: "lifecycle", excludeFromTriggers: true },
   // Lifecycle events - Line calculations

package/dist/modules/sales/events.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/sales/events.ts"],
-  "sourcesContent": ["import { createModuleEvents } from '@open-mercato/shared/modules/events'\n\n/**\n * Sales Module Events\n *\n * Declares all events that can be emitted by the sales module.\n */\nconst events = [\n  // Orders\n  { id: 'sales.order.created', label: 'Sales Order Created', entity: 'order', category: 'crud' },\n  { id: 'sales.order.updated', label: 'Sales Order Updated', entity: 'order', category: 'crud' },\n  { id: 'sales.order.deleted', label: 'Sales Order Deleted', entity: 'order', category: 'crud' },\n  { id: 'sales.order.confirmed', label: 'Sales Order Confirmed', entity: 'order', category: 'lifecycle' },\n  { id: 'sales.order.cancelled', label: 'Sales Order Cancelled', entity: 'order', category: 'lifecycle' },\n\n  // Quotes\n  { id: 'sales.quote.created', label: 'Quote Created', entity: 'quote', category: 'crud' },\n  { id: 'sales.quote.updated', label: 'Quote Updated', entity: 'quote', category: 'crud' },\n  { id: 'sales.quote.deleted', label: 'Quote Deleted', entity: 'quote', category: 'crud' },\n  { id: 'sales.quote.expiring', label: 'Quote Expiring', entity: 'quote', category: 'lifecycle' },\n\n  // Invoices\n  { id: 'sales.invoice.created', label: 'Invoice Created', entity: 'invoice', category: 'crud' },\n  { id: 'sales.invoice.updated', label: 'Invoice Updated', entity: 'invoice', category: 'crud' },\n  { id: 'sales.invoice.deleted', label: 'Invoice Deleted', entity: 'invoice', category: 'crud' },\n\n  // Credit Memos\n  { id: 'sales.credit_memo.created', label: 'Credit Memo Created', entity: 'credit_memo', category: 'crud' },\n  { id: 'sales.credit_memo.updated', label: 'Credit Memo Updated', entity: 'credit_memo', category: 'crud' },\n  { id: 'sales.credit_memo.deleted', label: 'Credit Memo Deleted', entity: 'credit_memo', category: 'crud' },\n\n  // Order Lines\n  { id: 'sales.line.created', label: 'Order Line Created', entity: 'line', category: 'crud' },\n  { id: 'sales.line.updated', label: 'Order Line Updated', entity: 'line', category: 'crud' },\n  { id: 'sales.line.deleted', label: 'Order Line Deleted', entity: 'line', category: 'crud' },\n\n  // Payments\n  { id: 'sales.payment.created', label: 'Payment Created', entity: 'payment', category: 'crud' },\n  { id: 'sales.payment.updated', label: 'Payment Updated', entity: 'payment', category: 'crud' },\n  { id: 'sales.payment.deleted', label: 'Payment Deleted', entity: 'payment', category: 'crud' },\n\n  // Shipments\n  { id: 'sales.shipment.created', label: 'Shipment Created', entity: 'shipment', category: 'crud' },\n  { id: 'sales.shipment.updated', label: 'Shipment Updated', entity: 'shipment', category: 'crud' },\n  { id: 'sales.shipment.deleted', label: 'Shipment Deleted', entity: 'shipment', category: 'crud' },\n\n  // Returns\n  { id: 'sales.return.created', label: 'Return Created', entity: 'return', category: 'crud' },\n  { id: 'sales.return.updated', label: 'Return Updated', entity: 'return', category: 'crud' },\n  { id: 'sales.return.deleted', label: 'Return Deleted', entity: 'return', category: 'crud' },\n\n  // Notes\n  { id: 'sales.note.created', label: 'Note Created', entity: 'note', category: 'crud' },\n  { id: 'sales.note.updated', label: 'Note Updated', entity: 'note', category: 'crud' },\n  { id: 'sales.note.deleted', label: 'Note Deleted', entity: 'note', category: 'crud' },\n\n  // Sales Channels\n  { id: 'sales.channel.created', label: 'Sales Channel Created', entity: 'channel', category: 'crud' },\n  { id: 'sales.channel.updated', label: 'Sales Channel Updated', entity: 'channel', category: 'crud' },\n  { id: 'sales.channel.deleted', label: 'Sales Channel Deleted', entity: 'channel', category: 'crud' },\n\n  // Lifecycle events - Document calculations\n  { id: 'sales.document.totals.calculated', label: 'Document Totals Calculated', category: 'lifecycle' },\n  { id: 'sales.document.calculate.before', label: 'Before Document Calculate', category: 'lifecycle', excludeFromTriggers: true },\n  { id: 'sales.document.calculate.after', label: 'After Document Calculate', category: 'lifecycle', excludeFromTriggers: true },\n\n  // Lifecycle events - Line calculations\n  { id: 'sales.line.calculate.before', label: 'Before Line Calculate', category: 'lifecycle', excludeFromTriggers: true },\n  { id: 'sales.line.calculate.after', label: 'After Line Calculate', category: 'lifecycle', excludeFromTriggers: true },\n\n  // Lifecycle events - Tax calculations\n  { id: 'sales.tax.calculate.before', label: 'Before Tax Calculate', category: 'lifecycle', excludeFromTriggers: true },\n  { id: 'sales.tax.calculate.after', label: 'After Tax Calculate', category: 'lifecycle', excludeFromTriggers: true },\n\n  // Lifecycle events - Shipping adjustments\n  { id: 'sales.shipping.adjustments.apply.before', label: 'Before Shipping Adjustments', category: 'lifecycle', excludeFromTriggers: true },\n  { id: 'sales.shipping.adjustments.apply.after', label: 'After Shipping Adjustments', category: 'lifecycle', excludeFromTriggers: true },\n\n  // Lifecycle events - Payment adjustments\n  { id: 'sales.payment.adjustments.apply.before', label: 'Before Payment Adjustments', category: 'lifecycle', excludeFromTriggers: true },\n  { id: 'sales.payment.adjustments.apply.after', label: 'After Payment Adjustments', category: 'lifecycle', excludeFromTriggers: true },\n] as const\n\nexport const eventsConfig = createModuleEvents({\n  moduleId: 'sales',\n  events,\n})\n\n/** Type-safe event emitter for sales module */\nexport const emitSalesEvent = eventsConfig.emit\n\n/** Event IDs that can be emitted by the sales module */\nexport type SalesEventId = typeof events[number]['id']\n\nexport default eventsConfig\n"],
-  "mappings": "AAAA,SAAS,0BAA0B;AAOnC,MAAM,SAAS;AAAA;AAAA,EAEb,EAAE,IAAI,uBAAuB,OAAO,uBAAuB,QAAQ,SAAS,UAAU,OAAO;AAAA,EAC7F,EAAE,IAAI,uBAAuB,OAAO,uBAAuB,QAAQ,SAAS,UAAU,OAAO;AAAA,EAC7F,EAAE,IAAI,uBAAuB,OAAO,uBAAuB,QAAQ,SAAS,UAAU,OAAO;AAAA,EAC7F,EAAE,IAAI,yBAAyB,OAAO,yBAAyB,QAAQ,SAAS,UAAU,YAAY;AAAA,EACtG,EAAE,IAAI,yBAAyB,OAAO,yBAAyB,QAAQ,SAAS,UAAU,YAAY;AAAA;AAAA,EAGtG,EAAE,IAAI,uBAAuB,OAAO,iBAAiB,QAAQ,SAAS,UAAU,OAAO;AAAA,EACvF,EAAE,IAAI,uBAAuB,OAAO,iBAAiB,QAAQ,SAAS,UAAU,OAAO;AAAA,EACvF,EAAE,IAAI,uBAAuB,OAAO,iBAAiB,QAAQ,SAAS,UAAU,OAAO;AAAA,EACvF,EAAE,IAAI,wBAAwB,OAAO,kBAAkB,QAAQ,SAAS,UAAU,YAAY;AAAA;AAAA,EAG9F,EAAE,IAAI,yBAAyB,OAAO,mBAAmB,QAAQ,WAAW,UAAU,OAAO;AAAA,EAC7F,EAAE,IAAI,yBAAyB,OAAO,mBAAmB,QAAQ,WAAW,UAAU,OAAO;AAAA,EAC7F,EAAE,IAAI,yBAAyB,OAAO,mBAAmB,QAAQ,WAAW,UAAU,OAAO;AAAA;AAAA,EAG7F,EAAE,IAAI,6BAA6B,OAAO,uBAAuB,QAAQ,eAAe,UAAU,OAAO;AAAA,EACzG,EAAE,IAAI,6BAA6B,OAAO,uBAAuB,QAAQ,eAAe,UAAU,OAAO;AAAA,EACzG,EAAE,IAAI,6BAA6B,OAAO,uBAAuB,QAAQ,eAAe,UAAU,OAAO;AAAA;AAAA,EAGzG,EAAE,IAAI,sBAAsB,OAAO,sBAAsB,QAAQ,QAAQ,UAAU,OAAO;AAAA,EAC1F,EAAE,IAAI,sBAAsB,OAAO,sBAAsB,QAAQ,QAAQ,UAAU,OAAO;AAAA,EAC1F,EAAE,IAAI,sBAAsB,OAAO,sBAAsB,QAAQ,QAAQ,UAAU,OAAO;AAAA;AAAA,EAG1F,EAAE,IAAI,yBAAyB,OAAO,mBAAmB,QAAQ,WAAW,UAAU,OAAO;AAAA,EAC7F,EAAE,IAAI,yBAAyB,OAAO,mBAAmB,QAAQ,WAAW,UAAU,OAAO;AAAA,EAC7F,EAAE,IAAI,yBAAyB,OAAO,mBAAmB,QAAQ,WAAW,UAAU,OAAO;AAAA;AAAA,EAG7F,EAAE,IAAI,0BAA0B,OAAO,oBAAoB,QAAQ,YAAY,UAAU,OAAO;AAAA,EAChG,EAAE,IAAI,0BAA0B,OAAO,oBAAoB,QAAQ,YAAY,UAAU,OAAO;AAAA,EAChG,EAAE,IAAI,0BAA0B,OAAO,oBAAoB,QAAQ,YAAY,UAAU,OAAO;AAAA;AAAA,EAGhG,EAAE,IAAI,wBAAwB,OAAO,kBAAkB,QAAQ,UAAU,UAAU,OAAO;AAAA,EAC1F,EAAE,IAAI,wBAAwB,OAAO,kBAAkB,QAAQ,UAAU,UAAU,OAAO;AAAA,EAC1F,EAAE,IAAI,wBAAwB,OAAO,kBAAkB,QAAQ,UAAU,UAAU,OAAO;AAAA;AAAA,EAG1F,EAAE,IAAI,sBAAsB,OAAO,gBAAgB,QAAQ,QAAQ,UAAU,OAAO;AAAA,EACpF,EAAE,IAAI,sBAAsB,OAAO,gBAAgB,QAAQ,QAAQ,UAAU,OAAO;AAAA,EACpF,EAAE,IAAI,sBAAsB,OAAO,gBAAgB,QAAQ,QAAQ,UAAU,OAAO;AAAA;AAAA,EAGpF,EAAE,IAAI,yBAAyB,OAAO,yBAAyB,QAAQ,WAAW,UAAU,OAAO;AAAA,EACnG,EAAE,IAAI,yBAAyB,OAAO,yBAAyB,QAAQ,WAAW,UAAU,OAAO;AAAA,EACnG,EAAE,IAAI,yBAAyB,OAAO,yBAAyB,QAAQ,WAAW,UAAU,OAAO;AAAA;AAAA,EAGnG,EAAE,IAAI,oCAAoC,OAAO,8BAA8B,UAAU,YAAY;AAAA,EACrG,EAAE,IAAI,mCAAmC,OAAO,6BAA6B,UAAU,aAAa,qBAAqB,KAAK;AAAA,EAC9H,EAAE,IAAI,kCAAkC,OAAO,4BAA4B,UAAU,aAAa,qBAAqB,KAAK;AAAA;AAAA,EAG5H,EAAE,IAAI,+BAA+B,OAAO,yBAAyB,UAAU,aAAa,qBAAqB,KAAK;AAAA,EACtH,EAAE,IAAI,8BAA8B,OAAO,wBAAwB,UAAU,aAAa,qBAAqB,KAAK;AAAA;AAAA,EAGpH,EAAE,IAAI,8BAA8B,OAAO,wBAAwB,UAAU,aAAa,qBAAqB,KAAK;AAAA,EACpH,EAAE,IAAI,6BAA6B,OAAO,uBAAuB,UAAU,aAAa,qBAAqB,KAAK;AAAA;AAAA,EAGlH,EAAE,IAAI,2CAA2C,OAAO,+BAA+B,UAAU,aAAa,qBAAqB,KAAK;AAAA,EACxI,EAAE,IAAI,0CAA0C,OAAO,8BAA8B,UAAU,aAAa,qBAAqB,KAAK;AAAA;AAAA,EAGtI,EAAE,IAAI,0CAA0C,OAAO,8BAA8B,UAAU,aAAa,qBAAqB,KAAK;AAAA,EACtI,EAAE,IAAI,yCAAyC,OAAO,6BAA6B,UAAU,aAAa,qBAAqB,KAAK;AACtI;AAEO,MAAM,eAAe,mBAAmB;AAAA,EAC7C,UAAU;AAAA,EACV;AACF,CAAC;AAGM,MAAM,iBAAiB,aAAa;AAK3C,IAAO,iBAAQ;",
+  "sourcesContent": ["import { createModuleEvents, type EventPayloadSchema } from '@open-mercato/shared/modules/events'\n\n/**\n * Sales Module Events\n *\n * Declares all events that can be emitted by the sales module.\n */\n\n/**\n * Payload emitted by `commands/documents.ts` (`emitTotalsCalculated`) for\n * `sales.document.totals.calculated`. Fields mirror the emit call exactly;\n * `totals` is the calculation result object, declared as `object`.\n */\nconst totalsCalculatedPayloadSchema: EventPayloadSchema = {\n  fields: [\n    { path: 'documentKind', type: 'text' },\n    { path: 'documentId', type: 'text' },\n    { path: 'organizationId', type: 'text' },\n    { path: 'tenantId', type: 'text' },\n    { path: 'customerId', type: 'text', optional: true },\n    { path: 'totals', type: 'object' },\n    { path: 'lineCount', type: 'number' },\n  ],\n}\n\nconst events = [\n  // Orders\n  { id: 'sales.order.created', label: 'Sales Order Created', entity: 'order', category: 'crud' },\n  { id: 'sales.order.updated', label: 'Sales Order Updated', entity: 'order', category: 'crud' },\n  { id: 'sales.order.deleted', label: 'Sales Order Deleted', entity: 'order', category: 'crud' },\n  { id: 'sales.order.confirmed', label: 'Sales Order Confirmed', entity: 'order', category: 'lifecycle' },\n  { id: 'sales.order.cancelled', label: 'Sales Order Cancelled', entity: 'order', category: 'lifecycle' },\n\n  // Quotes\n  { id: 'sales.quote.created', label: 'Quote Created', entity: 'quote', category: 'crud' },\n  { id: 'sales.quote.updated', label: 'Quote Updated', entity: 'quote', category: 'crud' },\n  { id: 'sales.quote.deleted', label: 'Quote Deleted', entity: 'quote', category: 'crud' },\n  { id: 'sales.quote.expiring', label: 'Quote Expiring', entity: 'quote', category: 'lifecycle' },\n\n  // Invoices\n  { id: 'sales.invoice.created', label: 'Invoice Created', entity: 'invoice', category: 'crud' },\n  { id: 'sales.invoice.updated', label: 'Invoice Updated', entity: 'invoice', category: 'crud' },\n  { id: 'sales.invoice.deleted', label: 'Invoice Deleted', entity: 'invoice', category: 'crud' },\n\n  // Credit Memos\n  { id: 'sales.credit_memo.created', label: 'Credit Memo Created', entity: 'credit_memo', category: 'crud' },\n  { id: 'sales.credit_memo.updated', label: 'Credit Memo Updated', entity: 'credit_memo', category: 'crud' },\n  { id: 'sales.credit_memo.deleted', label: 'Credit Memo Deleted', entity: 'credit_memo', category: 'crud' },\n\n  // Order Lines\n  { id: 'sales.line.created', label: 'Order Line Created', entity: 'line', category: 'crud' },\n  { id: 'sales.line.updated', label: 'Order Line Updated', entity: 'line', category: 'crud' },\n  { id: 'sales.line.deleted', label: 'Order Line Deleted', entity: 'line', category: 'crud' },\n\n  // Payments\n  { id: 'sales.payment.created', label: 'Payment Created', entity: 'payment', category: 'crud' },\n  { id: 'sales.payment.updated', label: 'Payment Updated', entity: 'payment', category: 'crud' },\n  { id: 'sales.payment.deleted', label: 'Payment Deleted', entity: 'payment', category: 'crud' },\n\n  // Shipments\n  { id: 'sales.shipment.created', label: 'Shipment Created', entity: 'shipment', category: 'crud' },\n  { id: 'sales.shipment.updated', label: 'Shipment Updated', entity: 'shipment', category: 'crud' },\n  { id: 'sales.shipment.deleted', label: 'Shipment Deleted', entity: 'shipment', category: 'crud' },\n\n  // Returns\n  { id: 'sales.return.created', label: 'Return Created', entity: 'return', category: 'crud' },\n  { id: 'sales.return.updated', label: 'Return Updated', entity: 'return', category: 'crud' },\n  { id: 'sales.return.deleted', label: 'Return Deleted', entity: 'return', category: 'crud' },\n\n  // Notes\n  { id: 'sales.note.created', label: 'Note Created', entity: 'note', category: 'crud' },\n  { id: 'sales.note.updated', label: 'Note Updated', entity: 'note', category: 'crud' },\n  { id: 'sales.note.deleted', label: 'Note Deleted', entity: 'note', category: 'crud' },\n\n  // Sales Channels\n  { id: 'sales.channel.created', label: 'Sales Channel Created', entity: 'channel', category: 'crud' },\n  { id: 'sales.channel.updated', label: 'Sales Channel Updated', entity: 'channel', category: 'crud' },\n  { id: 'sales.channel.deleted', label: 'Sales Channel Deleted', entity: 'channel', category: 'crud' },\n\n  // Lifecycle events - Document calculations\n  { id: 'sales.document.totals.calculated', label: 'Document Totals Calculated', category: 'lifecycle', payloadSchema: totalsCalculatedPayloadSchema },\n  { id: 'sales.document.calculate.before', label: 'Before Document Calculate', category: 'lifecycle', excludeFromTriggers: true },\n  { id: 'sales.document.calculate.after', label: 'After Document Calculate', category: 'lifecycle', excludeFromTriggers: true },\n\n  // Lifecycle events - Line calculations\n  { id: 'sales.line.calculate.before', label: 'Before Line Calculate', category: 'lifecycle', excludeFromTriggers: true },\n  { id: 'sales.line.calculate.after', label: 'After Line Calculate', category: 'lifecycle', excludeFromTriggers: true },\n\n  // Lifecycle events - Tax calculations\n  { id: 'sales.tax.calculate.before', label: 'Before Tax Calculate', category: 'lifecycle', excludeFromTriggers: true },\n  { id: 'sales.tax.calculate.after', label: 'After Tax Calculate', category: 'lifecycle', excludeFromTriggers: true },\n\n  // Lifecycle events - Shipping adjustments\n  { id: 'sales.shipping.adjustments.apply.before', label: 'Before Shipping Adjustments', category: 'lifecycle', excludeFromTriggers: true },\n  { id: 'sales.shipping.adjustments.apply.after', label: 'After Shipping Adjustments', category: 'lifecycle', excludeFromTriggers: true },\n\n  // Lifecycle events - Payment adjustments\n  { id: 'sales.payment.adjustments.apply.before', label: 'Before Payment Adjustments', category: 'lifecycle', excludeFromTriggers: true },\n  { id: 'sales.payment.adjustments.apply.after', label: 'After Payment Adjustments', category: 'lifecycle', excludeFromTriggers: true },\n] as const\n\nexport const eventsConfig = createModuleEvents({\n  moduleId: 'sales',\n  events,\n})\n\n/** Type-safe event emitter for sales module */\nexport const emitSalesEvent = eventsConfig.emit\n\n/** Event IDs that can be emitted by the sales module */\nexport type SalesEventId = typeof events[number]['id']\n\nexport default eventsConfig\n"],
+  "mappings": "AAAA,SAAS,0BAAmD;AAa5D,MAAM,gCAAoD;AAAA,EACxD,QAAQ;AAAA,IACN,EAAE,MAAM,gBAAgB,MAAM,OAAO;AAAA,IACrC,EAAE,MAAM,cAAc,MAAM,OAAO;AAAA,IACnC,EAAE,MAAM,kBAAkB,MAAM,OAAO;AAAA,IACvC,EAAE,MAAM,YAAY,MAAM,OAAO;AAAA,IACjC,EAAE,MAAM,cAAc,MAAM,QAAQ,UAAU,KAAK;AAAA,IACnD,EAAE,MAAM,UAAU,MAAM,SAAS;AAAA,IACjC,EAAE,MAAM,aAAa,MAAM,SAAS;AAAA,EACtC;AACF;AAEA,MAAM,SAAS;AAAA;AAAA,EAEb,EAAE,IAAI,uBAAuB,OAAO,uBAAuB,QAAQ,SAAS,UAAU,OAAO;AAAA,EAC7F,EAAE,IAAI,uBAAuB,OAAO,uBAAuB,QAAQ,SAAS,UAAU,OAAO;AAAA,EAC7F,EAAE,IAAI,uBAAuB,OAAO,uBAAuB,QAAQ,SAAS,UAAU,OAAO;AAAA,EAC7F,EAAE,IAAI,yBAAyB,OAAO,yBAAyB,QAAQ,SAAS,UAAU,YAAY;AAAA,EACtG,EAAE,IAAI,yBAAyB,OAAO,yBAAyB,QAAQ,SAAS,UAAU,YAAY;AAAA;AAAA,EAGtG,EAAE,IAAI,uBAAuB,OAAO,iBAAiB,QAAQ,SAAS,UAAU,OAAO;AAAA,EACvF,EAAE,IAAI,uBAAuB,OAAO,iBAAiB,QAAQ,SAAS,UAAU,OAAO;AAAA,EACvF,EAAE,IAAI,uBAAuB,OAAO,iBAAiB,QAAQ,SAAS,UAAU,OAAO;AAAA,EACvF,EAAE,IAAI,wBAAwB,OAAO,kBAAkB,QAAQ,SAAS,UAAU,YAAY;AAAA;AAAA,EAG9F,EAAE,IAAI,yBAAyB,OAAO,mBAAmB,QAAQ,WAAW,UAAU,OAAO;AAAA,EAC7F,EAAE,IAAI,yBAAyB,OAAO,mBAAmB,QAAQ,WAAW,UAAU,OAAO;AAAA,EAC7F,EAAE,IAAI,yBAAyB,OAAO,mBAAmB,QAAQ,WAAW,UAAU,OAAO;AAAA;AAAA,EAG7F,EAAE,IAAI,6BAA6B,OAAO,uBAAuB,QAAQ,eAAe,UAAU,OAAO;AAAA,EACzG,EAAE,IAAI,6BAA6B,OAAO,uBAAuB,QAAQ,eAAe,UAAU,OAAO;AAAA,EACzG,EAAE,IAAI,6BAA6B,OAAO,uBAAuB,QAAQ,eAAe,UAAU,OAAO;AAAA;AAAA,EAGzG,EAAE,IAAI,sBAAsB,OAAO,sBAAsB,QAAQ,QAAQ,UAAU,OAAO;AAAA,EAC1F,EAAE,IAAI,sBAAsB,OAAO,sBAAsB,QAAQ,QAAQ,UAAU,OAAO;AAAA,EAC1F,EAAE,IAAI,sBAAsB,OAAO,sBAAsB,QAAQ,QAAQ,UAAU,OAAO;AAAA;AAAA,EAG1F,EAAE,IAAI,yBAAyB,OAAO,mBAAmB,QAAQ,WAAW,UAAU,OAAO;AAAA,EAC7F,EAAE,IAAI,yBAAyB,OAAO,mBAAmB,QAAQ,WAAW,UAAU,OAAO;AAAA,EAC7F,EAAE,IAAI,yBAAyB,OAAO,mBAAmB,QAAQ,WAAW,UAAU,OAAO;AAAA;AAAA,EAG7F,EAAE,IAAI,0BAA0B,OAAO,oBAAoB,QAAQ,YAAY,UAAU,OAAO;AAAA,EAChG,EAAE,IAAI,0BAA0B,OAAO,oBAAoB,QAAQ,YAAY,UAAU,OAAO;AAAA,EAChG,EAAE,IAAI,0BAA0B,OAAO,oBAAoB,QAAQ,YAAY,UAAU,OAAO;AAAA;AAAA,EAGhG,EAAE,IAAI,wBAAwB,OAAO,kBAAkB,QAAQ,UAAU,UAAU,OAAO;AAAA,EAC1F,EAAE,IAAI,wBAAwB,OAAO,kBAAkB,QAAQ,UAAU,UAAU,OAAO;AAAA,EAC1F,EAAE,IAAI,wBAAwB,OAAO,kBAAkB,QAAQ,UAAU,UAAU,OAAO;AAAA;AAAA,EAG1F,EAAE,IAAI,sBAAsB,OAAO,gBAAgB,QAAQ,QAAQ,UAAU,OAAO;AAAA,EACpF,EAAE,IAAI,sBAAsB,OAAO,gBAAgB,QAAQ,QAAQ,UAAU,OAAO;AAAA,EACpF,EAAE,IAAI,sBAAsB,OAAO,gBAAgB,QAAQ,QAAQ,UAAU,OAAO;AAAA;AAAA,EAGpF,EAAE,IAAI,yBAAyB,OAAO,yBAAyB,QAAQ,WAAW,UAAU,OAAO;AAAA,EACnG,EAAE,IAAI,yBAAyB,OAAO,yBAAyB,QAAQ,WAAW,UAAU,OAAO;AAAA,EACnG,EAAE,IAAI,yBAAyB,OAAO,yBAAyB,QAAQ,WAAW,UAAU,OAAO;AAAA;AAAA,EAGnG,EAAE,IAAI,oCAAoC,OAAO,8BAA8B,UAAU,aAAa,eAAe,8BAA8B;AAAA,EACnJ,EAAE,IAAI,mCAAmC,OAAO,6BAA6B,UAAU,aAAa,qBAAqB,KAAK;AAAA,EAC9H,EAAE,IAAI,kCAAkC,OAAO,4BAA4B,UAAU,aAAa,qBAAqB,KAAK;AAAA;AAAA,EAG5H,EAAE,IAAI,+BAA+B,OAAO,yBAAyB,UAAU,aAAa,qBAAqB,KAAK;AAAA,EACtH,EAAE,IAAI,8BAA8B,OAAO,wBAAwB,UAAU,aAAa,qBAAqB,KAAK;AAAA;AAAA,EAGpH,EAAE,IAAI,8BAA8B,OAAO,wBAAwB,UAAU,aAAa,qBAAqB,KAAK;AAAA,EACpH,EAAE,IAAI,6BAA6B,OAAO,uBAAuB,UAAU,aAAa,qBAAqB,KAAK;AAAA;AAAA,EAGlH,EAAE,IAAI,2CAA2C,OAAO,+BAA+B,UAAU,aAAa,qBAAqB,KAAK;AAAA,EACxI,EAAE,IAAI,0CAA0C,OAAO,8BAA8B,UAAU,aAAa,qBAAqB,KAAK;AAAA;AAAA,EAGtI,EAAE,IAAI,0CAA0C,OAAO,8BAA8B,UAAU,aAAa,qBAAqB,KAAK;AAAA,EACtI,EAAE,IAAI,yCAAyC,OAAO,6BAA6B,UAAU,aAAa,qBAAqB,KAAK;AACtI;AAEO,MAAM,eAAe,mBAAmB;AAAA,EAC7C,UAAU;AAAA,EACV;AACF,CAAC;AAGM,MAAM,iBAAiB,aAAa;AAK3C,IAAO,iBAAQ;",
   "names": []
 }

package/dist/modules/sales/workflows.js

@@ -1,7 +1,18 @@
 import { defineWorkflow, createWorkflowsModuleConfig } from "@open-mercato/shared/modules/workflows";
 import { registerWorkflowSafeCommands } from "@open-mercato/core/modules/workflows/lib/workflow-safe-commands";
 registerWorkflowSafeCommands([
-  { commandId: "sales.orders.update", requiredFeatures: ["sales.orders.manage"] }
+  {
+    commandId: "sales.orders.update",
+    requiredFeatures: ["sales.orders.manage"],
+    labelKey: "sales.workflows.commands.orders.update",
+    // GRANDFATHERED: the only command reachable by UPDATE_ENTITY before the
+    // tenant enablement setting existed, and the one `sales.order-approval`
+    // (shipped above, and as a gallery template) runs on every transition. A
+    // tenant that never opens the settings page must keep executing it, so this
+    // flag is what makes the gate ship without changing anybody's behaviour.
+    // New candidates MUST NOT copy it — see workflow-safe-commands.ts.
+    defaultEnabled: true
+  }
 ]);
 const orderApproval = defineWorkflow({
   workflowId: "sales.order-approval",

package/dist/modules/sales/workflows.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/sales/workflows.ts"],
-  "sourcesContent": ["/**\n * Sales Module \u2014 Code-Based Workflow Definitions\n *\n * Order approval workflow shipped with the sales module.\n */\n\nimport { defineWorkflow, createWorkflowsModuleConfig } from '@open-mercato/shared/modules/workflows'\nimport { registerWorkflowSafeCommands } from '@open-mercato/core/modules/workflows/lib/workflow-safe-commands'\n\nregisterWorkflowSafeCommands([\n  { commandId: 'sales.orders.update', requiredFeatures: ['sales.orders.manage'] },\n])\n\nconst orderApproval = defineWorkflow({\n  workflowId: 'sales.order-approval',\n  workflowName: 'Sales Order Approval Workflow',\n  description: 'Approval workflow for sales orders requiring authorization before processing',\n  metadata: { category: 'Sales', tags: ['sales', 'approval', 'order'], icon: 'check-circle' },\n  steps: [\n    { stepId: 'start', stepName: 'Start', stepType: 'START', description: 'Initialize order approval workflow' },\n    {\n      stepId: 'pending_approval',\n      stepName: 'Pending Approval',\n      stepType: 'USER_TASK',\n      description: 'Order awaiting approval decision',\n      userTaskConfig: {\n        formSchema: {\n          type: 'object',\n          required: ['decision'],\n          properties: {\n            comments: { type: 'string', title: 'Comments', description: 'Optional comments for the decision' },\n            decision: { enum: ['approve', 'reject'], type: 'string', title: 'Decision', description: 'Approve or reject the order' },\n          },\n        },\n        slaDuration: 'PT24H',\n      },\n    },\n    { stepId: 'approved', stepName: 'Approved', stepType: 'AUTOMATED', description: 'Order has been approved' },\n    { stepId: 'rejected', stepName: 'Rejected', stepType: 'AUTOMATED', description: 'Order has been rejected' },\n    { stepId: 'end', stepName: 'Complete', stepType: 'END', description: 'Workflow complete' },\n  ] as const,\n  transitions: [\n    {\n      transitionId: 'start_to_pending',\n      transitionName: 'Submit for Approval',\n      fromStepId: 'start',\n      toStepId: 'pending_approval',\n      trigger: 'auto',\n      priority: 100,\n      continueOnActivityFailure: true,\n      activities: [\n        {\n          activityId: 'set_pending_status',\n          activityName: 'Set Order to Pending Approval',\n          activityType: 'UPDATE_ENTITY',\n          async: false,\n          config: {\n            commandId: 'sales.orders.update',\n            statusDictionary: 'sales.order_status',\n            input: { id: '{{context.orderId}}', statusValue: 'pending_approval' },\n          },\n          retryPolicy: { maxAttempts: 3, initialIntervalMs: 1000, backoffCoefficient: 2, maxIntervalMs: 10000 },\n        },\n        {\n          activityId: 'emit_approval_requested',\n          activityName: 'Emit Approval Requested Event',\n          activityType: 'EMIT_EVENT',\n          async: true,\n          config: {\n            eventName: 'sales.order.approval.requested',\n            payload: { orderId: '{{context.orderId}}', workflowInstanceId: '{{workflow.instanceId}}' },\n          },\n        },\n      ],\n    },\n    {\n      transitionId: 'pending_approval_to_approved',\n      transitionName: 'Approve Order',\n      fromStepId: 'pending_approval',\n      toStepId: 'approved',\n      trigger: 'auto',\n      priority: 100,\n      preConditions: [{ ruleId: 'workflow_order_approval_check_approved', required: true }],\n      continueOnActivityFailure: true,\n      activities: [\n        {\n          activityId: 'set_approved_status',\n          activityName: 'Set Order to Approved',\n          activityType: 'UPDATE_ENTITY',\n          async: false,\n          config: {\n            commandId: 'sales.orders.update',\n            statusDictionary: 'sales.order_status',\n            input: { id: '{{context.orderId}}', statusValue: 'approved' },\n          },\n          retryPolicy: { maxAttempts: 3, initialIntervalMs: 1000, backoffCoefficient: 2, maxIntervalMs: 10000 },\n        },\n        {\n          activityId: 'emit_order_approved',\n          activityName: 'Emit Order Approved Event',\n          activityType: 'EMIT_EVENT',\n          async: true,\n          config: {\n            eventName: 'sales.order.approval.approved',\n            payload: {\n              orderId: '{{context.orderId}}',\n              workflowInstanceId: '{{workflow.instanceId}}',\n              approvedBy: '{{context.completedBy}}',\n              comments: '{{context.comments}}',\n            },\n          },\n        },\n      ],\n    },\n    {\n      transitionId: 'pending_approval_to_rejected',\n      transitionName: 'Reject Order',\n      fromStepId: 'pending_approval',\n      toStepId: 'rejected',\n      trigger: 'auto',\n      priority: 90,\n      preConditions: [{ ruleId: 'workflow_order_approval_check_rejected', required: true }],\n      continueOnActivityFailure: true,\n      activities: [\n        {\n          activityId: 'set_rejected_status',\n          activityName: 'Set Order to Rejected',\n          activityType: 'UPDATE_ENTITY',\n          async: false,\n          config: {\n            commandId: 'sales.orders.update',\n            statusDictionary: 'sales.order_status',\n            input: { id: '{{context.orderId}}', statusValue: 'rejected' },\n          },\n          retryPolicy: { maxAttempts: 3, initialIntervalMs: 1000, backoffCoefficient: 2, maxIntervalMs: 10000 },\n        },\n        {\n          activityId: 'emit_order_rejected',\n          activityName: 'Emit Order Rejected Event',\n          activityType: 'EMIT_EVENT',\n          async: true,\n          config: {\n            eventName: 'sales.order.approval.rejected',\n            payload: {\n              orderId: '{{context.orderId}}',\n              workflowInstanceId: '{{workflow.instanceId}}',\n              rejectedBy: '{{context.completedBy}}',\n              comments: '{{context.comments}}',\n            },\n          },\n        },\n      ],\n    },\n    {\n      transitionId: 'approved_to_end',\n      transitionName: 'Complete After Approval',\n      fromStepId: 'approved',\n      toStepId: 'end',\n      trigger: 'auto',\n      priority: 100,\n      continueOnActivityFailure: true,\n    },\n    {\n      transitionId: 'rejected_to_end',\n      transitionName: 'Complete After Rejection',\n      fromStepId: 'rejected',\n      toStepId: 'end',\n      trigger: 'auto',\n      priority: 100,\n      continueOnActivityFailure: true,\n    },\n  ],\n  triggers: [{\n    triggerId: 'order_approval_trigger',\n    name: 'Order Approval Trigger',\n    description: 'Triggers when a new sales order is created',\n    eventPattern: 'sales.order.created',\n    config: {\n      entityType: 'SalesOrder',\n      contextMapping: [{ targetKey: 'orderId', sourceExpression: 'id' }],\n    },\n    enabled: true,\n    priority: 0,\n  }],\n})\n\nexport const workflowsConfig = createWorkflowsModuleConfig({\n  moduleId: 'sales',\n  workflows: [orderApproval],\n})\n\nexport default workflowsConfig\n"],
-  "mappings": "AAMA,SAAS,gBAAgB,mCAAmC;AAC5D,SAAS,oCAAoC;AAE7C,6BAA6B;AAAA,EAC3B,EAAE,WAAW,uBAAuB,kBAAkB,CAAC,qBAAqB,EAAE;AAChF,CAAC;AAED,MAAM,gBAAgB,eAAe;AAAA,EACnC,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,aAAa;AAAA,EACb,UAAU,EAAE,UAAU,SAAS,MAAM,CAAC,SAAS,YAAY,OAAO,GAAG,MAAM,eAAe;AAAA,EAC1F,OAAO;AAAA,IACL,EAAE,QAAQ,SAAS,UAAU,SAAS,UAAU,SAAS,aAAa,qCAAqC;AAAA,IAC3G;AAAA,MACE,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,UAAU;AAAA,MACV,aAAa;AAAA,MACb,gBAAgB;AAAA,QACd,YAAY;AAAA,UACV,MAAM;AAAA,UACN,UAAU,CAAC,UAAU;AAAA,UACrB,YAAY;AAAA,YACV,UAAU,EAAE,MAAM,UAAU,OAAO,YAAY,aAAa,qCAAqC;AAAA,YACjG,UAAU,EAAE,MAAM,CAAC,WAAW,QAAQ,GAAG,MAAM,UAAU,OAAO,YAAY,aAAa,8BAA8B;AAAA,UACzH;AAAA,QACF;AAAA,QACA,aAAa;AAAA,MACf;AAAA,IACF;AAAA,IACA,EAAE,QAAQ,YAAY,UAAU,YAAY,UAAU,aAAa,aAAa,0BAA0B;AAAA,IAC1G,EAAE,QAAQ,YAAY,UAAU,YAAY,UAAU,aAAa,aAAa,0BAA0B;AAAA,IAC1G,EAAE,QAAQ,OAAO,UAAU,YAAY,UAAU,OAAO,aAAa,oBAAoB;AAAA,EAC3F;AAAA,EACA,aAAa;AAAA,IACX;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,MACV,2BAA2B;AAAA,MAC3B,YAAY;AAAA,QACV;AAAA,UACE,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,cAAc;AAAA,UACd,OAAO;AAAA,UACP,QAAQ;AAAA,YACN,WAAW;AAAA,YACX,kBAAkB;AAAA,YAClB,OAAO,EAAE,IAAI,uBAAuB,aAAa,mBAAmB;AAAA,UACtE;AAAA,UACA,aAAa,EAAE,aAAa,GAAG,mBAAmB,KAAM,oBAAoB,GAAG,eAAe,IAAM;AAAA,QACtG;AAAA,QACA;AAAA,UACE,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,cAAc;AAAA,UACd,OAAO;AAAA,UACP,QAAQ;AAAA,YACN,WAAW;AAAA,YACX,SAAS,EAAE,SAAS,uBAAuB,oBAAoB,0BAA0B;AAAA,UAC3F;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,MACV,eAAe,CAAC,EAAE,QAAQ,0CAA0C,UAAU,KAAK,CAAC;AAAA,MACpF,2BAA2B;AAAA,MAC3B,YAAY;AAAA,QACV;AAAA,UACE,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,cAAc;AAAA,UACd,OAAO;AAAA,UACP,QAAQ;AAAA,YACN,WAAW;AAAA,YACX,kBAAkB;AAAA,YAClB,OAAO,EAAE,IAAI,uBAAuB,aAAa,WAAW;AAAA,UAC9D;AAAA,UACA,aAAa,EAAE,aAAa,GAAG,mBAAmB,KAAM,oBAAoB,GAAG,eAAe,IAAM;AAAA,QACtG;AAAA,QACA;AAAA,UACE,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,cAAc;AAAA,UACd,OAAO;AAAA,UACP,QAAQ;AAAA,YACN,WAAW;AAAA,YACX,SAAS;AAAA,cACP,SAAS;AAAA,cACT,oBAAoB;AAAA,cACpB,YAAY;AAAA,cACZ,UAAU;AAAA,YACZ;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,MACV,eAAe,CAAC,EAAE,QAAQ,0CAA0C,UAAU,KAAK,CAAC;AAAA,MACpF,2BAA2B;AAAA,MAC3B,YAAY;AAAA,QACV;AAAA,UACE,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,cAAc;AAAA,UACd,OAAO;AAAA,UACP,QAAQ;AAAA,YACN,WAAW;AAAA,YACX,kBAAkB;AAAA,YAClB,OAAO,EAAE,IAAI,uBAAuB,aAAa,WAAW;AAAA,UAC9D;AAAA,UACA,aAAa,EAAE,aAAa,GAAG,mBAAmB,KAAM,oBAAoB,GAAG,eAAe,IAAM;AAAA,QACtG;AAAA,QACA;AAAA,UACE,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,cAAc;AAAA,UACd,OAAO;AAAA,UACP,QAAQ;AAAA,YACN,WAAW;AAAA,YACX,SAAS;AAAA,cACP,SAAS;AAAA,cACT,oBAAoB;AAAA,cACpB,YAAY;AAAA,cACZ,UAAU;AAAA,YACZ;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,MACV,2BAA2B;AAAA,IAC7B;AAAA,IACA;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,MACV,2BAA2B;AAAA,IAC7B;AAAA,EACF;AAAA,EACA,UAAU,CAAC;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,aAAa;AAAA,IACb,cAAc;AAAA,IACd,QAAQ;AAAA,MACN,YAAY;AAAA,MACZ,gBAAgB,CAAC,EAAE,WAAW,WAAW,kBAAkB,KAAK,CAAC;AAAA,IACnE;AAAA,IACA,SAAS;AAAA,IACT,UAAU;AAAA,EACZ,CAAC;AACH,CAAC;AAEM,MAAM,kBAAkB,4BAA4B;AAAA,EACzD,UAAU;AAAA,EACV,WAAW,CAAC,aAAa;AAC3B,CAAC;AAED,IAAO,oBAAQ;",
+  "sourcesContent": ["/**\n * Sales Module \u2014 Code-Based Workflow Definitions\n *\n * Order approval workflow shipped with the sales module.\n */\n\nimport { defineWorkflow, createWorkflowsModuleConfig } from '@open-mercato/shared/modules/workflows'\nimport { registerWorkflowSafeCommands } from '@open-mercato/core/modules/workflows/lib/workflow-safe-commands'\n\nregisterWorkflowSafeCommands([\n  {\n    commandId: 'sales.orders.update',\n    requiredFeatures: ['sales.orders.manage'],\n    labelKey: 'sales.workflows.commands.orders.update',\n    // GRANDFATHERED: the only command reachable by UPDATE_ENTITY before the\n    // tenant enablement setting existed, and the one `sales.order-approval`\n    // (shipped above, and as a gallery template) runs on every transition. A\n    // tenant that never opens the settings page must keep executing it, so this\n    // flag is what makes the gate ship without changing anybody's behaviour.\n    // New candidates MUST NOT copy it \u2014 see workflow-safe-commands.ts.\n    defaultEnabled: true,\n  },\n])\n\nconst orderApproval = defineWorkflow({\n  workflowId: 'sales.order-approval',\n  workflowName: 'Sales Order Approval Workflow',\n  description: 'Approval workflow for sales orders requiring authorization before processing',\n  metadata: { category: 'Sales', tags: ['sales', 'approval', 'order'], icon: 'check-circle' },\n  steps: [\n    { stepId: 'start', stepName: 'Start', stepType: 'START', description: 'Initialize order approval workflow' },\n    {\n      stepId: 'pending_approval',\n      stepName: 'Pending Approval',\n      stepType: 'USER_TASK',\n      description: 'Order awaiting approval decision',\n      userTaskConfig: {\n        formSchema: {\n          type: 'object',\n          required: ['decision'],\n          properties: {\n            comments: { type: 'string', title: 'Comments', description: 'Optional comments for the decision' },\n            decision: { enum: ['approve', 'reject'], type: 'string', title: 'Decision', description: 'Approve or reject the order' },\n          },\n        },\n        slaDuration: 'PT24H',\n      },\n    },\n    { stepId: 'approved', stepName: 'Approved', stepType: 'AUTOMATED', description: 'Order has been approved' },\n    { stepId: 'rejected', stepName: 'Rejected', stepType: 'AUTOMATED', description: 'Order has been rejected' },\n    { stepId: 'end', stepName: 'Complete', stepType: 'END', description: 'Workflow complete' },\n  ] as const,\n  transitions: [\n    {\n      transitionId: 'start_to_pending',\n      transitionName: 'Submit for Approval',\n      fromStepId: 'start',\n      toStepId: 'pending_approval',\n      trigger: 'auto',\n      priority: 100,\n      continueOnActivityFailure: true,\n      activities: [\n        {\n          activityId: 'set_pending_status',\n          activityName: 'Set Order to Pending Approval',\n          activityType: 'UPDATE_ENTITY',\n          async: false,\n          config: {\n            commandId: 'sales.orders.update',\n            statusDictionary: 'sales.order_status',\n            input: { id: '{{context.orderId}}', statusValue: 'pending_approval' },\n          },\n          retryPolicy: { maxAttempts: 3, initialIntervalMs: 1000, backoffCoefficient: 2, maxIntervalMs: 10000 },\n        },\n        {\n          activityId: 'emit_approval_requested',\n          activityName: 'Emit Approval Requested Event',\n          activityType: 'EMIT_EVENT',\n          async: true,\n          config: {\n            eventName: 'sales.order.approval.requested',\n            payload: { orderId: '{{context.orderId}}', workflowInstanceId: '{{workflow.instanceId}}' },\n          },\n        },\n      ],\n    },\n    {\n      transitionId: 'pending_approval_to_approved',\n      transitionName: 'Approve Order',\n      fromStepId: 'pending_approval',\n      toStepId: 'approved',\n      trigger: 'auto',\n      priority: 100,\n      preConditions: [{ ruleId: 'workflow_order_approval_check_approved', required: true }],\n      continueOnActivityFailure: true,\n      activities: [\n        {\n          activityId: 'set_approved_status',\n          activityName: 'Set Order to Approved',\n          activityType: 'UPDATE_ENTITY',\n          async: false,\n          config: {\n            commandId: 'sales.orders.update',\n            statusDictionary: 'sales.order_status',\n            input: { id: '{{context.orderId}}', statusValue: 'approved' },\n          },\n          retryPolicy: { maxAttempts: 3, initialIntervalMs: 1000, backoffCoefficient: 2, maxIntervalMs: 10000 },\n        },\n        {\n          activityId: 'emit_order_approved',\n          activityName: 'Emit Order Approved Event',\n          activityType: 'EMIT_EVENT',\n          async: true,\n          config: {\n            eventName: 'sales.order.approval.approved',\n            payload: {\n              orderId: '{{context.orderId}}',\n              workflowInstanceId: '{{workflow.instanceId}}',\n              approvedBy: '{{context.completedBy}}',\n              comments: '{{context.comments}}',\n            },\n          },\n        },\n      ],\n    },\n    {\n      transitionId: 'pending_approval_to_rejected',\n      transitionName: 'Reject Order',\n      fromStepId: 'pending_approval',\n      toStepId: 'rejected',\n      trigger: 'auto',\n      priority: 90,\n      preConditions: [{ ruleId: 'workflow_order_approval_check_rejected', required: true }],\n      continueOnActivityFailure: true,\n      activities: [\n        {\n          activityId: 'set_rejected_status',\n          activityName: 'Set Order to Rejected',\n          activityType: 'UPDATE_ENTITY',\n          async: false,\n          config: {\n            commandId: 'sales.orders.update',\n            statusDictionary: 'sales.order_status',\n            input: { id: '{{context.orderId}}', statusValue: 'rejected' },\n          },\n          retryPolicy: { maxAttempts: 3, initialIntervalMs: 1000, backoffCoefficient: 2, maxIntervalMs: 10000 },\n        },\n        {\n          activityId: 'emit_order_rejected',\n          activityName: 'Emit Order Rejected Event',\n          activityType: 'EMIT_EVENT',\n          async: true,\n          config: {\n            eventName: 'sales.order.approval.rejected',\n            payload: {\n              orderId: '{{context.orderId}}',\n              workflowInstanceId: '{{workflow.instanceId}}',\n              rejectedBy: '{{context.completedBy}}',\n              comments: '{{context.comments}}',\n            },\n          },\n        },\n      ],\n    },\n    {\n      transitionId: 'approved_to_end',\n      transitionName: 'Complete After Approval',\n      fromStepId: 'approved',\n      toStepId: 'end',\n      trigger: 'auto',\n      priority: 100,\n      continueOnActivityFailure: true,\n    },\n    {\n      transitionId: 'rejected_to_end',\n      transitionName: 'Complete After Rejection',\n      fromStepId: 'rejected',\n      toStepId: 'end',\n      trigger: 'auto',\n      priority: 100,\n      continueOnActivityFailure: true,\n    },\n  ],\n  triggers: [{\n    triggerId: 'order_approval_trigger',\n    name: 'Order Approval Trigger',\n    description: 'Triggers when a new sales order is created',\n    eventPattern: 'sales.order.created',\n    config: {\n      entityType: 'SalesOrder',\n      contextMapping: [{ targetKey: 'orderId', sourceExpression: 'id' }],\n    },\n    enabled: true,\n    priority: 0,\n  }],\n})\n\nexport const workflowsConfig = createWorkflowsModuleConfig({\n  moduleId: 'sales',\n  workflows: [orderApproval],\n})\n\nexport default workflowsConfig\n"],
+  "mappings": "AAMA,SAAS,gBAAgB,mCAAmC;AAC5D,SAAS,oCAAoC;AAE7C,6BAA6B;AAAA,EAC3B;AAAA,IACE,WAAW;AAAA,IACX,kBAAkB,CAAC,qBAAqB;AAAA,IACxC,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOV,gBAAgB;AAAA,EAClB;AACF,CAAC;AAED,MAAM,gBAAgB,eAAe;AAAA,EACnC,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,aAAa;AAAA,EACb,UAAU,EAAE,UAAU,SAAS,MAAM,CAAC,SAAS,YAAY,OAAO,GAAG,MAAM,eAAe;AAAA,EAC1F,OAAO;AAAA,IACL,EAAE,QAAQ,SAAS,UAAU,SAAS,UAAU,SAAS,aAAa,qCAAqC;AAAA,IAC3G;AAAA,MACE,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,UAAU;AAAA,MACV,aAAa;AAAA,MACb,gBAAgB;AAAA,QACd,YAAY;AAAA,UACV,MAAM;AAAA,UACN,UAAU,CAAC,UAAU;AAAA,UACrB,YAAY;AAAA,YACV,UAAU,EAAE,MAAM,UAAU,OAAO,YAAY,aAAa,qCAAqC;AAAA,YACjG,UAAU,EAAE,MAAM,CAAC,WAAW,QAAQ,GAAG,MAAM,UAAU,OAAO,YAAY,aAAa,8BAA8B;AAAA,UACzH;AAAA,QACF;AAAA,QACA,aAAa;AAAA,MACf;AAAA,IACF;AAAA,IACA,EAAE,QAAQ,YAAY,UAAU,YAAY,UAAU,aAAa,aAAa,0BAA0B;AAAA,IAC1G,EAAE,QAAQ,YAAY,UAAU,YAAY,UAAU,aAAa,aAAa,0BAA0B;AAAA,IAC1G,EAAE,QAAQ,OAAO,UAAU,YAAY,UAAU,OAAO,aAAa,oBAAoB;AAAA,EAC3F;AAAA,EACA,aAAa;AAAA,IACX;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,MACV,2BAA2B;AAAA,MAC3B,YAAY;AAAA,QACV;AAAA,UACE,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,cAAc;AAAA,UACd,OAAO;AAAA,UACP,QAAQ;AAAA,YACN,WAAW;AAAA,YACX,kBAAkB;AAAA,YAClB,OAAO,EAAE,IAAI,uBAAuB,aAAa,mBAAmB;AAAA,UACtE;AAAA,UACA,aAAa,EAAE,aAAa,GAAG,mBAAmB,KAAM,oBAAoB,GAAG,eAAe,IAAM;AAAA,QACtG;AAAA,QACA;AAAA,UACE,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,cAAc;AAAA,UACd,OAAO;AAAA,UACP,QAAQ;AAAA,YACN,WAAW;AAAA,YACX,SAAS,EAAE,SAAS,uBAAuB,oBAAoB,0BAA0B;AAAA,UAC3F;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,MACV,eAAe,CAAC,EAAE,QAAQ,0CAA0C,UAAU,KAAK,CAAC;AAAA,MACpF,2BAA2B;AAAA,MAC3B,YAAY;AAAA,QACV;AAAA,UACE,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,cAAc;AAAA,UACd,OAAO;AAAA,UACP,QAAQ;AAAA,YACN,WAAW;AAAA,YACX,kBAAkB;AAAA,YAClB,OAAO,EAAE,IAAI,uBAAuB,aAAa,WAAW;AAAA,UAC9D;AAAA,UACA,aAAa,EAAE,aAAa,GAAG,mBAAmB,KAAM,oBAAoB,GAAG,eAAe,IAAM;AAAA,QACtG;AAAA,QACA;AAAA,UACE,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,cAAc;AAAA,UACd,OAAO;AAAA,UACP,QAAQ;AAAA,YACN,WAAW;AAAA,YACX,SAAS;AAAA,cACP,SAAS;AAAA,cACT,oBAAoB;AAAA,cACpB,YAAY;AAAA,cACZ,UAAU;AAAA,YACZ;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,MACV,eAAe,CAAC,EAAE,QAAQ,0CAA0C,UAAU,KAAK,CAAC;AAAA,MACpF,2BAA2B;AAAA,MAC3B,YAAY;AAAA,QACV;AAAA,UACE,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,cAAc;AAAA,UACd,OAAO;AAAA,UACP,QAAQ;AAAA,YACN,WAAW;AAAA,YACX,kBAAkB;AAAA,YAClB,OAAO,EAAE,IAAI,uBAAuB,aAAa,WAAW;AAAA,UAC9D;AAAA,UACA,aAAa,EAAE,aAAa,GAAG,mBAAmB,KAAM,oBAAoB,GAAG,eAAe,IAAM;AAAA,QACtG;AAAA,QACA;AAAA,UACE,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,cAAc;AAAA,UACd,OAAO;AAAA,UACP,QAAQ;AAAA,YACN,WAAW;AAAA,YACX,SAAS;AAAA,cACP,SAAS;AAAA,cACT,oBAAoB;AAAA,cACpB,YAAY;AAAA,cACZ,UAAU;AAAA,YACZ;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,MACV,2BAA2B;AAAA,IAC7B;AAAA,IACA;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,MACV,2BAA2B;AAAA,IAC7B;AAAA,EACF;AAAA,EACA,UAAU,CAAC;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,aAAa;AAAA,IACb,cAAc;AAAA,IACd,QAAQ;AAAA,MACN,YAAY;AAAA,MACZ,gBAAgB,CAAC,EAAE,WAAW,WAAW,kBAAkB,KAAK,CAAC;AAAA,IACnE;AAAA,IACA,SAAS;AAAA,IACT,UAAU;AAAA,EACZ,CAAC;AACH,CAAC;AAEM,MAAM,kBAAkB,4BAA4B;AAAA,EACzD,UAAU;AAAA,EACV,WAAW,CAAC,aAAa;AAC3B,CAAC;AAED,IAAO,oBAAQ;",
   "names": []
 }

package/dist/modules/seeds/cli.js

@@ -0,0 +1,199 @@
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import {
+  decryptSeedEnvelope,
+  encryptSeedDocument,
+  generateSeedKey,
+  resolveSeedKey,
+  SEED_KEY_ENV
+} from "@open-mercato/shared/lib/seed/crypto";
+import { loadSeedDocument } from "@open-mercato/shared/lib/seed/loader";
+import { seedDocumentSchema } from "@open-mercato/shared/lib/seed/types";
+import { createProgressBar } from "@open-mercato/shared/lib/cli/progress";
+function parseArgs(rest) {
+  const args = {};
+  for (let i = 0; i < rest.length; i += 1) {
+    const part = rest[i];
+    if (!part?.startsWith("--")) continue;
+    const [keyRaw, valueRaw] = part.slice(2).split("=");
+    if (!keyRaw) continue;
+    if (valueRaw !== void 0) args[keyRaw] = valueRaw;
+    else if (i + 1 < rest.length && !rest[i + 1].startsWith("--")) args[keyRaw] = rest[i + 1];
+    else args[keyRaw] = "true";
+  }
+  return args;
+}
+function flag(value) {
+  return value === "true" || value === "";
+}
+function printableScopeUsage() {
+  return "Usage: mercato seeds load --in <file.enc.json> [--tenant <tenantId>] [--org <organizationId>] [--plain] [--dry-run] [--key <base64>]";
+}
+function requireSingleRow(rows, label, explicitFlag) {
+  if (rows.length === 1) return rows[0];
+  if (rows.length === 0) {
+    throw new Error(`Cannot auto-detect ${label}: no active ${label} exists. Pass ${explicitFlag}.`);
+  }
+  throw new Error(
+    `Cannot auto-detect ${label}: found multiple active ${label}s. Pass ${explicitFlag}.`
+  );
+}
+async function resolveSeedLoadScope(em, input) {
+  const tenantId = input.tenantId?.trim() || "";
+  const organizationId = input.organizationId?.trim() || "";
+  if (tenantId && organizationId) return { tenantId, organizationId, inferred: false };
+  const conn = em.getConnection();
+  if (organizationId && !tenantId) {
+    const orgRows = await conn.execute(
+      "select id, tenant_id from organizations where id = ? and deleted_at is null and is_active = true limit 1",
+      [organizationId]
+    );
+    const org = requireSingleRow(orgRows, "organization", "--tenant");
+    if (!org.tenant_id) {
+      throw new Error(`Cannot auto-detect tenant: organization ${organizationId} has no tenant_id.`);
+    }
+    return { tenantId: org.tenant_id, organizationId, inferred: true };
+  }
+  const resolvedTenantId = tenantId || requireSingleRow(
+    await conn.execute(
+      "select id from tenants where deleted_at is null and is_active = true order by created_at asc, id asc limit 2"
+    ),
+    "tenant",
+    "--tenant"
+  ).id;
+  const resolvedOrganizationId = organizationId || requireSingleRow(
+    await conn.execute(
+      "select id from organizations where tenant_id = ? and deleted_at is null and is_active = true order by created_at asc, id asc limit 2",
+      [resolvedTenantId]
+    ),
+    "organization",
+    "--org"
+  ).id;
+  return { tenantId: resolvedTenantId, organizationId: resolvedOrganizationId, inferred: true };
+}
+async function readJsonFile(file) {
+  const raw = await fs.readFile(path.resolve(file), "utf8");
+  return JSON.parse(raw);
+}
+const keygen = {
+  command: "keygen",
+  run() {
+    const key = generateSeedKey();
+    console.log(key);
+    console.error(
+      `
+Generated a 32-byte base64 seed key. Distribute it out-of-band and set it for every participant:
+  ${SEED_KEY_ENV}=${key}
+`
+    );
+  }
+};
+const encrypt = {
+  command: "encrypt",
+  async run(rest) {
+    const args = parseArgs(rest);
+    const input = args.in ?? args.input;
+    const output = args.out ?? args.output;
+    if (!input || !output) {
+      console.error(
+        "Usage: mercato seeds encrypt --in <plaintext.json> --out <file.enc.json> [--key <base64>]"
+      );
+      process.exitCode = 1;
+      return;
+    }
+    const key = resolveSeedKey(args.key);
+    const document = seedDocumentSchema.parse(await readJsonFile(input));
+    const envelope = encryptSeedDocument(document, key);
+    await fs.writeFile(path.resolve(output), `${JSON.stringify(envelope, null, 2)}
+`, "utf8");
+    console.log(`Encrypted ${document.records.length} seed record(s) \u2192 ${output}`);
+  }
+};
+const decrypt = {
+  command: "decrypt",
+  async run(rest) {
+    const args = parseArgs(rest);
+    const input = args.in ?? args.input;
+    const output = args.out ?? args.output;
+    if (!input) {
+      console.error(
+        "Usage: mercato seeds decrypt --in <file.enc.json> [--out <plaintext.json>] [--key <base64>]"
+      );
+      process.exitCode = 1;
+      return;
+    }
+    const key = resolveSeedKey(args.key);
+    const document = decryptSeedEnvelope(await readJsonFile(input), key);
+    const json = `${JSON.stringify(document, null, 2)}
+`;
+    if (output) {
+      await fs.writeFile(path.resolve(output), json, "utf8");
+      console.log(`Decrypted \u2192 ${output}`);
+    } else {
+      process.stdout.write(json);
+    }
+  }
+};
+const load = {
+  command: "load",
+  async run(rest) {
+    const args = parseArgs(rest);
+    const input = args.in ?? args.input ?? args.file;
+    const tenantId = String(args.tenant ?? args.tenantId ?? "");
+    const organizationId = String(args.org ?? args.orgId ?? args.organizationId ?? "");
+    const plain = flag(args.plain);
+    const dryRun = flag(args["dry-run"]) || flag(args.dryRun);
+    if (!input) {
+      console.error(printableScopeUsage());
+      process.exitCode = 1;
+      return;
+    }
+    const raw = await readJsonFile(input);
+    let document;
+    if (plain) {
+      document = seedDocumentSchema.parse(raw);
+    } else {
+      const key = resolveSeedKey(args.key);
+      document = decryptSeedEnvelope(raw, key);
+    }
+    const { resolve } = await createRequestContainer();
+    const em = resolve("em");
+    let scope;
+    try {
+      scope = await resolveSeedLoadScope(em, { tenantId, organizationId });
+    } catch (err) {
+      console.error(err instanceof Error ? err.message : String(err));
+      console.error(printableScopeUsage());
+      process.exitCode = 1;
+      return;
+    }
+    if (scope.inferred) {
+      console.log(`Auto-detected seed scope: tenant=${scope.tenantId}, org=${scope.organizationId}`);
+    }
+    let bar = null;
+    const result = await loadSeedDocument(
+      em,
+      document,
+      { tenantId: scope.tenantId, organizationId: scope.organizationId },
+      {
+        dryRun,
+        onProgress: ({ index, total }) => {
+          if (!bar) bar = createProgressBar(dryRun ? "Validating seed" : "Loading seed", total);
+          bar.update(index + 1);
+        }
+      }
+    );
+    bar?.complete();
+    console.log(
+      `${dryRun ? "[dry-run] " : ""}Seed load complete: ${result.created} created, ${result.skipped} skipped (of ${result.total}).`
+    );
+  }
+};
+const seedsCliCommands = [keygen, encrypt, decrypt, load];
+var cli_default = seedsCliCommands;
+export {
+  cli_default as default,
+  resolveSeedLoadScope
+};
+//# sourceMappingURL=cli.js.map

package/dist/modules/seeds/cli.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/modules/seeds/cli.ts"],
+  "sourcesContent": ["import type { ModuleCli } from '@open-mercato/shared/modules/registry'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { promises as fs } from 'node:fs'\nimport path from 'node:path'\nimport {\n  decryptSeedEnvelope,\n  encryptSeedDocument,\n  generateSeedKey,\n  resolveSeedKey,\n  SEED_KEY_ENV,\n} from '@open-mercato/shared/lib/seed/crypto'\nimport { loadSeedDocument } from '@open-mercato/shared/lib/seed/loader'\nimport { seedDocumentSchema, type SeedDocument } from '@open-mercato/shared/lib/seed/types'\nimport { createProgressBar, type ProgressBar } from '@open-mercato/shared/lib/cli/progress'\n\ntype ScopeRow = { id: string; tenant_id?: string | null }\n\ntype SeedLoadScopeInput = {\n  tenantId?: string\n  organizationId?: string\n}\n\nfunction parseArgs(rest: string[]): Record<string, string> {\n  const args: Record<string, string> = {}\n  for (let i = 0; i < rest.length; i += 1) {\n    const part = rest[i]\n    if (!part?.startsWith('--')) continue\n    const [keyRaw, valueRaw] = part.slice(2).split('=')\n    if (!keyRaw) continue\n    if (valueRaw !== undefined) args[keyRaw] = valueRaw\n    else if (i + 1 < rest.length && !rest[i + 1].startsWith('--')) args[keyRaw] = rest[i + 1]\n    else args[keyRaw] = 'true'\n  }\n  return args\n}\n\nfunction flag(value: string | undefined): boolean {\n  return value === 'true' || value === ''\n}\n\nfunction printableScopeUsage(): string {\n  return 'Usage: mercato seeds load --in <file.enc.json> [--tenant <tenantId>] [--org <organizationId>] [--plain] [--dry-run] [--key <base64>]'\n}\n\nfunction requireSingleRow(rows: ScopeRow[], label: string, explicitFlag: string): ScopeRow {\n  if (rows.length === 1) return rows[0]\n  if (rows.length === 0) {\n    throw new Error(`Cannot auto-detect ${label}: no active ${label} exists. Pass ${explicitFlag}.`)\n  }\n  throw new Error(\n    `Cannot auto-detect ${label}: found multiple active ${label}s. Pass ${explicitFlag}.`,\n  )\n}\n\nexport async function resolveSeedLoadScope(\n  em: EntityManager,\n  input: SeedLoadScopeInput,\n): Promise<{ tenantId: string; organizationId: string; inferred: boolean }> {\n  const tenantId = input.tenantId?.trim() || ''\n  const organizationId = input.organizationId?.trim() || ''\n  if (tenantId && organizationId) return { tenantId, organizationId, inferred: false }\n\n  const conn = em.getConnection()\n  if (organizationId && !tenantId) {\n    const orgRows = (await conn.execute(\n      'select id, tenant_id from organizations where id = ? and deleted_at is null and is_active = true limit 1',\n      [organizationId],\n    )) as ScopeRow[]\n    const org = requireSingleRow(orgRows, 'organization', '--tenant')\n    if (!org.tenant_id) {\n      throw new Error(`Cannot auto-detect tenant: organization ${organizationId} has no tenant_id.`)\n    }\n    return { tenantId: org.tenant_id, organizationId, inferred: true }\n  }\n\n  const resolvedTenantId = tenantId || requireSingleRow(\n    (await conn.execute(\n      'select id from tenants where deleted_at is null and is_active = true order by created_at asc, id asc limit 2',\n    )) as ScopeRow[],\n    'tenant',\n    '--tenant',\n  ).id\n\n  const resolvedOrganizationId = organizationId || requireSingleRow(\n    (await conn.execute(\n      'select id from organizations where tenant_id = ? and deleted_at is null and is_active = true order by created_at asc, id asc limit 2',\n      [resolvedTenantId],\n    )) as ScopeRow[],\n    'organization',\n    '--org',\n  ).id\n\n  return { tenantId: resolvedTenantId, organizationId: resolvedOrganizationId, inferred: true }\n}\n\nasync function readJsonFile(file: string): Promise<unknown> {\n  const raw = await fs.readFile(path.resolve(file), 'utf8')\n  return JSON.parse(raw)\n}\n\nconst keygen: ModuleCli = {\n  command: 'keygen',\n  run() {\n    const key = generateSeedKey()\n    // Key to stdout (capturable); guidance to stderr so it does not pollute the value.\n    console.log(key)\n    console.error(\n      `\\nGenerated a 32-byte base64 seed key. Distribute it out-of-band and set it for every participant:\\n  ${SEED_KEY_ENV}=${key}\\n`,\n    )\n  },\n}\n\nconst encrypt: ModuleCli = {\n  command: 'encrypt',\n  async run(rest) {\n    const args = parseArgs(rest)\n    const input = args.in ?? args.input\n    const output = args.out ?? args.output\n    if (!input || !output) {\n      console.error(\n        'Usage: mercato seeds encrypt --in <plaintext.json> --out <file.enc.json> [--key <base64>]',\n      )\n      process.exitCode = 1\n      return\n    }\n    const key = resolveSeedKey(args.key)\n    const document = seedDocumentSchema.parse(await readJsonFile(input))\n    const envelope = encryptSeedDocument(document, key)\n    await fs.writeFile(path.resolve(output), `${JSON.stringify(envelope, null, 2)}\\n`, 'utf8')\n    console.log(`Encrypted ${document.records.length} seed record(s) \u2192 ${output}`)\n  },\n}\n\nconst decrypt: ModuleCli = {\n  command: 'decrypt',\n  async run(rest) {\n    const args = parseArgs(rest)\n    const input = args.in ?? args.input\n    const output = args.out ?? args.output\n    if (!input) {\n      console.error(\n        'Usage: mercato seeds decrypt --in <file.enc.json> [--out <plaintext.json>] [--key <base64>]',\n      )\n      process.exitCode = 1\n      return\n    }\n    const key = resolveSeedKey(args.key)\n    const document = decryptSeedEnvelope(await readJsonFile(input), key)\n    const json = `${JSON.stringify(document, null, 2)}\\n`\n    if (output) {\n      await fs.writeFile(path.resolve(output), json, 'utf8')\n      console.log(`Decrypted \u2192 ${output}`)\n    } else {\n      process.stdout.write(json)\n    }\n  },\n}\n\nconst load: ModuleCli = {\n  command: 'load',\n  async run(rest) {\n    const args = parseArgs(rest)\n    const input = args.in ?? args.input ?? args.file\n    const tenantId = String(args.tenant ?? args.tenantId ?? '')\n    const organizationId = String(args.org ?? args.orgId ?? args.organizationId ?? '')\n    const plain = flag(args.plain)\n    const dryRun = flag(args['dry-run']) || flag(args.dryRun)\n    if (!input) {\n      console.error(printableScopeUsage())\n      process.exitCode = 1\n      return\n    }\n\n    const raw = await readJsonFile(input)\n    let document: SeedDocument\n    if (plain) {\n      document = seedDocumentSchema.parse(raw)\n    } else {\n      const key = resolveSeedKey(args.key)\n      document = decryptSeedEnvelope(raw, key)\n    }\n\n    const { resolve } = await createRequestContainer()\n    const em = resolve<EntityManager>('em')\n    let scope: { tenantId: string; organizationId: string; inferred: boolean }\n    try {\n      scope = await resolveSeedLoadScope(em, { tenantId, organizationId })\n    } catch (err) {\n      console.error(err instanceof Error ? err.message : String(err))\n      console.error(printableScopeUsage())\n      process.exitCode = 1\n      return\n    }\n    if (scope.inferred) {\n      console.log(`Auto-detected seed scope: tenant=${scope.tenantId}, org=${scope.organizationId}`)\n    }\n    let bar: ProgressBar | null = null\n    const result = await loadSeedDocument(\n      em,\n      document,\n      { tenantId: scope.tenantId, organizationId: scope.organizationId },\n      {\n        dryRun,\n        onProgress: ({ index, total }) => {\n          if (!bar) bar = createProgressBar(dryRun ? 'Validating seed' : 'Loading seed', total)\n          bar.update(index + 1)\n        },\n      },\n    )\n    ;(bar as ProgressBar | null)?.complete()\n    console.log(\n      `${dryRun ? '[dry-run] ' : ''}Seed load complete: ${result.created} created, ${result.skipped} skipped (of ${result.total}).`,\n    )\n  },\n}\n\nconst seedsCliCommands: ModuleCli[] = [keygen, encrypt, decrypt, load]\n\nexport default seedsCliCommands\n"],
+  "mappings": "AACA,SAAS,8BAA8B;AAEvC,SAAS,YAAY,UAAU;AAC/B,OAAO,UAAU;AACjB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,wBAAwB;AACjC,SAAS,0BAA6C;AACtD,SAAS,yBAA2C;AASpD,SAAS,UAAU,MAAwC;AACzD,QAAM,OAA+B,CAAC;AACtC,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK,GAAG;AACvC,UAAM,OAAO,KAAK,CAAC;AACnB,QAAI,CAAC,MAAM,WAAW,IAAI,EAAG;AAC7B,UAAM,CAAC,QAAQ,QAAQ,IAAI,KAAK,MAAM,CAAC,EAAE,MAAM,GAAG;AAClD,QAAI,CAAC,OAAQ;AACb,QAAI,aAAa,OAAW,MAAK,MAAM,IAAI;AAAA,aAClC,IAAI,IAAI,KAAK,UAAU,CAAC,KAAK,IAAI,CAAC,EAAE,WAAW,IAAI,EAAG,MAAK,MAAM,IAAI,KAAK,IAAI,CAAC;AAAA,QACnF,MAAK,MAAM,IAAI;AAAA,EACtB;AACA,SAAO;AACT;AAEA,SAAS,KAAK,OAAoC;AAChD,SAAO,UAAU,UAAU,UAAU;AACvC;AAEA,SAAS,sBAA8B;AACrC,SAAO;AACT;AAEA,SAAS,iBAAiB,MAAkB,OAAe,cAAgC;AACzF,MAAI,KAAK,WAAW,EAAG,QAAO,KAAK,CAAC;AACpC,MAAI,KAAK,WAAW,GAAG;AACrB,UAAM,IAAI,MAAM,sBAAsB,KAAK,eAAe,KAAK,iBAAiB,YAAY,GAAG;AAAA,EACjG;AACA,QAAM,IAAI;AAAA,IACR,sBAAsB,KAAK,2BAA2B,KAAK,WAAW,YAAY;AAAA,EACpF;AACF;AAEA,eAAsB,qBACpB,IACA,OAC0E;AAC1E,QAAM,WAAW,MAAM,UAAU,KAAK,KAAK;AAC3C,QAAM,iBAAiB,MAAM,gBAAgB,KAAK,KAAK;AACvD,MAAI,YAAY,eAAgB,QAAO,EAAE,UAAU,gBAAgB,UAAU,MAAM;AAEnF,QAAM,OAAO,GAAG,cAAc;AAC9B,MAAI,kBAAkB,CAAC,UAAU;AAC/B,UAAM,UAAW,MAAM,KAAK;AAAA,MAC1B;AAAA,MACA,CAAC,cAAc;AAAA,IACjB;AACA,UAAM,MAAM,iBAAiB,SAAS,gBAAgB,UAAU;AAChE,QAAI,CAAC,IAAI,WAAW;AAClB,YAAM,IAAI,MAAM,2CAA2C,cAAc,oBAAoB;AAAA,IAC/F;AACA,WAAO,EAAE,UAAU,IAAI,WAAW,gBAAgB,UAAU,KAAK;AAAA,EACnE;AAEA,QAAM,mBAAmB,YAAY;AAAA,IAClC,MAAM,KAAK;AAAA,MACV;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE;AAEF,QAAM,yBAAyB,kBAAkB;AAAA,IAC9C,MAAM,KAAK;AAAA,MACV;AAAA,MACA,CAAC,gBAAgB;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE;AAEF,SAAO,EAAE,UAAU,kBAAkB,gBAAgB,wBAAwB,UAAU,KAAK;AAC9F;AAEA,eAAe,aAAa,MAAgC;AAC1D,QAAM,MAAM,MAAM,GAAG,SAAS,KAAK,QAAQ,IAAI,GAAG,MAAM;AACxD,SAAO,KAAK,MAAM,GAAG;AACvB;AAEA,MAAM,SAAoB;AAAA,EACxB,SAAS;AAAA,EACT,MAAM;AACJ,UAAM,MAAM,gBAAgB;AAE5B,YAAQ,IAAI,GAAG;AACf,YAAQ;AAAA,MACN;AAAA;AAAA,IAAyG,YAAY,IAAI,GAAG;AAAA;AAAA,IAC9H;AAAA,EACF;AACF;AAEA,MAAM,UAAqB;AAAA,EACzB,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAAO,UAAU,IAAI;AAC3B,UAAM,QAAQ,KAAK,MAAM,KAAK;AAC9B,UAAM,SAAS,KAAK,OAAO,KAAK;AAChC,QAAI,CAAC,SAAS,CAAC,QAAQ;AACrB,cAAQ;AAAA,QACN;AAAA,MACF;AACA,cAAQ,WAAW;AACnB;AAAA,IACF;AACA,UAAM,MAAM,eAAe,KAAK,GAAG;AACnC,UAAM,WAAW,mBAAmB,MAAM,MAAM,aAAa,KAAK,CAAC;AACnE,UAAM,WAAW,oBAAoB,UAAU,GAAG;AAClD,UAAM,GAAG,UAAU,KAAK,QAAQ,MAAM,GAAG,GAAG,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAAA,GAAM,MAAM;AACzF,YAAQ,IAAI,aAAa,SAAS,QAAQ,MAAM,0BAAqB,MAAM,EAAE;AAAA,EAC/E;AACF;AAEA,MAAM,UAAqB;AAAA,EACzB,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAAO,UAAU,IAAI;AAC3B,UAAM,QAAQ,KAAK,MAAM,KAAK;AAC9B,UAAM,SAAS,KAAK,OAAO,KAAK;AAChC,QAAI,CAAC,OAAO;AACV,cAAQ;AAAA,QACN;AAAA,MACF;AACA,cAAQ,WAAW;AACnB;AAAA,IACF;AACA,UAAM,MAAM,eAAe,KAAK,GAAG;AACnC,UAAM,WAAW,oBAAoB,MAAM,aAAa,KAAK,GAAG,GAAG;AACnE,UAAM,OAAO,GAAG,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAAA;AACjD,QAAI,QAAQ;AACV,YAAM,GAAG,UAAU,KAAK,QAAQ,MAAM,GAAG,MAAM,MAAM;AACrD,cAAQ,IAAI,oBAAe,MAAM,EAAE;AAAA,IACrC,OAAO;AACL,cAAQ,OAAO,MAAM,IAAI;AAAA,IAC3B;AAAA,EACF;AACF;AAEA,MAAM,OAAkB;AAAA,EACtB,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAAO,UAAU,IAAI;AAC3B,UAAM,QAAQ,KAAK,MAAM,KAAK,SAAS,KAAK;AAC5C,UAAM,WAAW,OAAO,KAAK,UAAU,KAAK,YAAY,EAAE;AAC1D,UAAM,iBAAiB,OAAO,KAAK,OAAO,KAAK,SAAS,KAAK,kBAAkB,EAAE;AACjF,UAAM,QAAQ,KAAK,KAAK,KAAK;AAC7B,UAAM,SAAS,KAAK,KAAK,SAAS,CAAC,KAAK,KAAK,KAAK,MAAM;AACxD,QAAI,CAAC,OAAO;AACV,cAAQ,MAAM,oBAAoB,CAAC;AACnC,cAAQ,WAAW;AACnB;AAAA,IACF;AAEA,UAAM,MAAM,MAAM,aAAa,KAAK;AACpC,QAAI;AACJ,QAAI,OAAO;AACT,iBAAW,mBAAmB,MAAM,GAAG;AAAA,IACzC,OAAO;AACL,YAAM,MAAM,eAAe,KAAK,GAAG;AACnC,iBAAW,oBAAoB,KAAK,GAAG;AAAA,IACzC;AAEA,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAuB,IAAI;AACtC,QAAI;AACJ,QAAI;AACF,cAAQ,MAAM,qBAAqB,IAAI,EAAE,UAAU,eAAe,CAAC;AAAA,IACrE,SAAS,KAAK;AACZ,cAAQ,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAC9D,cAAQ,MAAM,oBAAoB,CAAC;AACnC,cAAQ,WAAW;AACnB;AAAA,IACF;AACA,QAAI,MAAM,UAAU;AAClB,cAAQ,IAAI,oCAAoC,MAAM,QAAQ,SAAS,MAAM,cAAc,EAAE;AAAA,IAC/F;AACA,QAAI,MAA0B;AAC9B,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,MACA,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,MACjE;AAAA,QACE;AAAA,QACA,YAAY,CAAC,EAAE,OAAO,MAAM,MAAM;AAChC,cAAI,CAAC,IAAK,OAAM,kBAAkB,SAAS,oBAAoB,gBAAgB,KAAK;AACpF,cAAI,OAAO,QAAQ,CAAC;AAAA,QACtB;AAAA,MACF;AAAA,IACF;AACC,IAAC,KAA4B,SAAS;AACvC,YAAQ;AAAA,MACN,GAAG,SAAS,eAAe,EAAE,uBAAuB,OAAO,OAAO,aAAa,OAAO,OAAO,gBAAgB,OAAO,KAAK;AAAA,IAC3H;AAAA,EACF;AACF;AAEA,MAAM,mBAAgC,CAAC,QAAQ,SAAS,SAAS,IAAI;AAErE,IAAO,cAAQ;",
+  "names": []
+}

package/dist/modules/seeds/examples/sample-seed.json

@@ -0,0 +1,26 @@
+{
+  "format": "om-seed",
+  "version": 1,
+  "records": [
+    {
+      "entity": "customers:customer_entity",
+      "match": ["id"],
+      "data": {
+        "id": "00000000-0000-0000-0000-0000000000a1",
+        "kind": "person",
+        "displayName": "Jane Doe",
+        "primaryEmail": "jane.doe@example.com",
+        "primaryPhone": "+48 600 000 000"
+      }
+    },
+    {
+      "entity": "customers:customer_address",
+      "data": {
+        "name": "Jane Doe",
+        "addressLine1": "ul. Przykładowa 1",
+        "city": "Warszawa",
+        "postalCode": "00-001"
+      }
+    }
+  ]
+}

package/dist/modules/seeds/index.js

@@ -0,0 +1,12 @@
+const metadata = {
+  name: "seeds",
+  title: "Seeds",
+  version: "0.1.0",
+  description: "Encrypted data seeding: encrypt confidential seed files for the repo and load them into a tenant on setup.",
+  author: "Open Mercato Team",
+  license: "MIT"
+};
+export {
+  metadata
+};
+//# sourceMappingURL=index.js.map

package/dist/modules/seeds/index.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/modules/seeds/index.ts"],
+  "sourcesContent": ["import type { ModuleInfo } from '@open-mercato/shared/modules/registry'\n\nexport const metadata: ModuleInfo = {\n  name: 'seeds',\n  title: 'Seeds',\n  version: '0.1.0',\n  description:\n    'Encrypted data seeding: encrypt confidential seed files for the repo and load them into a tenant on setup.',\n  author: 'Open Mercato Team',\n  license: 'MIT',\n}\n"],
+  "mappings": "AAEO,MAAM,WAAuB;AAAA,EAClC,MAAM;AAAA,EACN,OAAO;AAAA,EACP,SAAS;AAAA,EACT,aACE;AAAA,EACF,QAAQ;AAAA,EACR,SAAS;AACX;",
+  "names": []
+}

package/dist/modules/workflows/acl.js

@@ -43,6 +43,30 @@ const features = [
     module: moduleId,
     dependsOn: ["workflows.definitions.view"]
   },
+  {
+    // Declaring a definition's own execution grant is strictly broader than
+    // editing it: the grant decides which ACL features EVERY run of that
+    // version executes with, so folding it into `definitions.edit` would let
+    // any workflow author mint a principal with powers they were never given.
+    // It is additionally bounded at save time — a grant can never exceed the
+    // saving user's own current features.
+    id: "workflows.definitions.grant_features",
+    title: "Grant execution features to workflow definitions",
+    module: moduleId,
+    dependsOn: ["workflows.definitions.edit"]
+  },
+  {
+    id: "workflows.definitions.test_run",
+    title: "Test workflow definition steps",
+    module: moduleId,
+    dependsOn: ["workflows.definitions.edit"]
+  },
+  {
+    id: "workflows.definitions.publish",
+    title: "Publish workflow definition versions",
+    module: moduleId,
+    dependsOn: ["workflows.definitions.edit"]
+  },
   {
     id: "workflows.instances.view",
     title: "View workflow instances",
@@ -73,6 +97,34 @@ const features = [
     module: moduleId,
     dependsOn: ["workflows.instances.view"]
   },
+  {
+    // Writing arbitrary run context is strictly broader than sending a named
+    // signal, so it is deliberately NOT folded into workflows.instances.signal.
+    id: "workflows.instances.update_context",
+    title: "Update workflow instance context",
+    module: moduleId,
+    dependsOn: ["workflows.instances.view"]
+  },
+  {
+    // Spec 8.4 ACL appendix: `workflows.instances.rerun_step` (admins/devs).
+    // Replaying a step re-executes real side effects with possibly EDITED
+    // context, which `workflows.instances.retry` (replay the run as it stands)
+    // does not authorise — hence its own feature rather than an implication.
+    id: "workflows.instances.rerun_step",
+    title: "Rerun a workflow instance from a step",
+    module: moduleId,
+    dependsOn: ["workflows.instances.retry", "workflows.instances.update_context"]
+  },
+  {
+    // Spec 8.4 ACL appendix: `workflows.instances.bulk_ops` (admins). Retrying
+    // or cancelling a page of instances at once is strictly broader than doing
+    // it one row at a time — a misfire re-executes hundreds of real workflows —
+    // so it is its own feature rather than an implication of `retry`/`cancel`.
+    id: "workflows.instances.bulk_ops",
+    title: "Bulk retry or cancel workflow instances",
+    module: moduleId,
+    dependsOn: ["workflows.instances.retry", "workflows.instances.cancel"]
+  },
   {
     id: "workflows.tasks.view",
     title: "View user tasks",
@@ -91,6 +143,38 @@ const features = [
     module: moduleId,
     dependsOn: ["workflows.tasks.view"]
   },
+  {
+    // Administration, per spec §6.4: `workflows.tasks.*` gates viewing OTHER
+    // people's work, never one's own. Reading a task you have no relationship
+    // to still passes the same entity gate — this widens WHOSE rows you see,
+    // not WHICH entities you may see them about. It deliberately grants no act:
+    // an administrator reassigns a task to themselves (audited) before they can
+    // complete it, which is what keeps "who approved this?" answerable.
+    //
+    // `dependsOn: ['workflows.tasks.view']` keeps the older id load-bearing
+    // rather than leaving it a stored-but-unconsulted grant: it still admits a
+    // caller to the task API, and this feature decides which rows come back.
+    id: "workflows.tasks.view_all",
+    title: "View all workflow tasks",
+    module: moduleId,
+    dependsOn: ["workflows.tasks.view"]
+  },
+  {
+    // The ONLY supported route from "I can see this task" to "I can act on it".
+    // Writes the reassignment audit columns plus a WorkflowEvent.
+    id: "workflows.tasks.reassign",
+    title: "Reassign workflow tasks",
+    module: moduleId,
+    dependsOn: ["workflows.tasks.view_all"]
+  },
+  {
+    // Administrative mutations that are not reassignment: force-unclaim, cancel,
+    // bulk operations, and writing the tenant task-permission setting.
+    id: "workflows.tasks.manage",
+    title: "Administer workflow tasks",
+    module: moduleId,
+    dependsOn: ["workflows.tasks.view_all"]
+  },
   {
     id: "workflows.signals.send",
     title: "Send workflow signals",
@@ -102,6 +186,18 @@ const features = [
     title: "View workflow events",
     module: moduleId,
     dependsOn: ["workflows.view"]
+  },
+  {
+    // Spec §8.5 operations KPIs. Its own feature rather than an implication of
+    // `definitions.view`: a rollup states how often a process fails and how
+    // long it takes across every run in the organization, which is an
+    // aggregate over runs the caller may not be entitled to open one by one.
+    // `dependsOn: ['workflows.definitions.view']` because a KPI without the
+    // definition it belongs to names nothing the reader can act on.
+    id: "workflows.metrics.view",
+    title: "View workflow operational metrics",
+    module: moduleId,
+    dependsOn: ["workflows.definitions.view"]
   }
   // Note: Event triggers are now embedded in workflow definitions.
   // Trigger management permissions are covered by workflows.definitions.edit

package/dist/modules/workflows/acl.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/workflows/acl.ts"],
-  "sourcesContent": ["const moduleId = 'workflows'\n\nexport const features = [\n  { id: 'workflows.view', title: 'View workflows', module: moduleId },\n  {\n    id: 'workflows.manage',\n    title: 'Manage workflows',\n    module: moduleId,\n    dependsOn: ['workflows.view'],\n  },\n  {\n    id: 'workflows.view_logs',\n    title: 'View workflow logs',\n    module: moduleId,\n    dependsOn: ['workflows.view'],\n  },\n  {\n    id: 'workflows.view_tasks',\n    title: 'View workflow tasks',\n    module: moduleId,\n    dependsOn: ['workflows.view'],\n  },\n  {\n    id: 'workflows.definitions.view',\n    title: 'View workflow definitions',\n    module: moduleId,\n    dependsOn: ['workflows.view'],\n  },\n  {\n    id: 'workflows.definitions.create',\n    title: 'Create workflow definitions',\n    module: moduleId,\n    dependsOn: ['workflows.definitions.view'],\n  },\n  {\n    id: 'workflows.definitions.edit',\n    title: 'Edit workflow definitions',\n    module: moduleId,\n    dependsOn: ['workflows.definitions.view'],\n  },\n  {\n    id: 'workflows.definitions.delete',\n    title: 'Delete workflow definitions',\n    module: moduleId,\n    dependsOn: ['workflows.definitions.view'],\n  },\n  {\n    id: 'workflows.instances.view',\n    title: 'View workflow instances',\n    module: moduleId,\n    dependsOn: ['workflows.view'],\n  },\n  {\n    id: 'workflows.instances.create',\n    title: 'Start workflow instances',\n    module: moduleId,\n    dependsOn: ['workflows.instances.view', 'workflows.definitions.view'],\n  },\n  {\n    id: 'workflows.instances.cancel',\n    title: 'Cancel workflow instances',\n    module: moduleId,\n    dependsOn: ['workflows.instances.view'],\n  },\n  {\n    id: 'workflows.instances.retry',\n    title: 'Retry workflow instances',\n    module: moduleId,\n    dependsOn: ['workflows.instances.view'],\n  },\n  {\n    id: 'workflows.instances.signal',\n    title: 'Signal workflow instances',\n    module: moduleId,\n    dependsOn: ['workflows.instances.view'],\n  },\n  {\n    id: 'workflows.tasks.view',\n    title: 'View user tasks',\n    module: moduleId,\n    dependsOn: ['workflows.view'],\n  },\n  {\n    id: 'workflows.tasks.claim',\n    title: 'Claim workflow tasks',\n    module: moduleId,\n    dependsOn: ['workflows.tasks.view'],\n  },\n  {\n    id: 'workflows.tasks.complete',\n    title: 'Complete workflow tasks',\n    module: moduleId,\n    dependsOn: ['workflows.tasks.view'],\n  },\n  {\n    id: 'workflows.signals.send',\n    title: 'Send workflow signals',\n    module: moduleId,\n    dependsOn: ['workflows.view'],\n  },\n  {\n    id: 'workflows.events.view',\n    title: 'View workflow events',\n    module: moduleId,\n    dependsOn: ['workflows.view'],\n  },\n  // Note: Event triggers are now embedded in workflow definitions.\n  // Trigger management permissions are covered by workflows.definitions.edit\n]\n\nexport default features\n"],
-  "mappings": "AAAA,MAAM,WAAW;AAEV,MAAM,WAAW;AAAA,EACtB,EAAE,IAAI,kBAAkB,OAAO,kBAAkB,QAAQ,SAAS;AAAA,EAClE;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,gBAAgB;AAAA,EAC9B;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,gBAAgB;AAAA,EAC9B;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,gBAAgB;AAAA,EAC9B;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,gBAAgB;AAAA,EAC9B;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,4BAA4B;AAAA,EAC1C;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,4BAA4B;AAAA,EAC1C;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,4BAA4B;AAAA,EAC1C;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,gBAAgB;AAAA,EAC9B;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,4BAA4B,4BAA4B;AAAA,EACtE;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,0BAA0B;AAAA,EACxC;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,0BAA0B;AAAA,EACxC;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,0BAA0B;AAAA,EACxC;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,gBAAgB;AAAA,EAC9B;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,sBAAsB;AAAA,EACpC;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,sBAAsB;AAAA,EACpC;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,gBAAgB;AAAA,EAC9B;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,gBAAgB;AAAA,EAC9B;AAAA;AAAA;AAGF;AAEA,IAAO,cAAQ;",
+  "sourcesContent": ["const moduleId = 'workflows'\n\nexport const features = [\n  { id: 'workflows.view', title: 'View workflows', module: moduleId },\n  {\n    id: 'workflows.manage',\n    title: 'Manage workflows',\n    module: moduleId,\n    dependsOn: ['workflows.view'],\n  },\n  {\n    id: 'workflows.view_logs',\n    title: 'View workflow logs',\n    module: moduleId,\n    dependsOn: ['workflows.view'],\n  },\n  {\n    id: 'workflows.view_tasks',\n    title: 'View workflow tasks',\n    module: moduleId,\n    dependsOn: ['workflows.view'],\n  },\n  {\n    id: 'workflows.definitions.view',\n    title: 'View workflow definitions',\n    module: moduleId,\n    dependsOn: ['workflows.view'],\n  },\n  {\n    id: 'workflows.definitions.create',\n    title: 'Create workflow definitions',\n    module: moduleId,\n    dependsOn: ['workflows.definitions.view'],\n  },\n  {\n    id: 'workflows.definitions.edit',\n    title: 'Edit workflow definitions',\n    module: moduleId,\n    dependsOn: ['workflows.definitions.view'],\n  },\n  {\n    id: 'workflows.definitions.delete',\n    title: 'Delete workflow definitions',\n    module: moduleId,\n    dependsOn: ['workflows.definitions.view'],\n  },\n  {\n    // Declaring a definition's own execution grant is strictly broader than\n    // editing it: the grant decides which ACL features EVERY run of that\n    // version executes with, so folding it into `definitions.edit` would let\n    // any workflow author mint a principal with powers they were never given.\n    // It is additionally bounded at save time \u2014 a grant can never exceed the\n    // saving user's own current features.\n    id: 'workflows.definitions.grant_features',\n    title: 'Grant execution features to workflow definitions',\n    module: moduleId,\n    dependsOn: ['workflows.definitions.edit'],\n  },\n  {\n    id: 'workflows.definitions.test_run',\n    title: 'Test workflow definition steps',\n    module: moduleId,\n    dependsOn: ['workflows.definitions.edit'],\n  },\n  {\n    id: 'workflows.definitions.publish',\n    title: 'Publish workflow definition versions',\n    module: moduleId,\n    dependsOn: ['workflows.definitions.edit'],\n  },\n  {\n    id: 'workflows.instances.view',\n    title: 'View workflow instances',\n    module: moduleId,\n    dependsOn: ['workflows.view'],\n  },\n  {\n    id: 'workflows.instances.create',\n    title: 'Start workflow instances',\n    module: moduleId,\n    dependsOn: ['workflows.instances.view', 'workflows.definitions.view'],\n  },\n  {\n    id: 'workflows.instances.cancel',\n    title: 'Cancel workflow instances',\n    module: moduleId,\n    dependsOn: ['workflows.instances.view'],\n  },\n  {\n    id: 'workflows.instances.retry',\n    title: 'Retry workflow instances',\n    module: moduleId,\n    dependsOn: ['workflows.instances.view'],\n  },\n  {\n    id: 'workflows.instances.signal',\n    title: 'Signal workflow instances',\n    module: moduleId,\n    dependsOn: ['workflows.instances.view'],\n  },\n  {\n    // Writing arbitrary run context is strictly broader than sending a named\n    // signal, so it is deliberately NOT folded into workflows.instances.signal.\n    id: 'workflows.instances.update_context',\n    title: 'Update workflow instance context',\n    module: moduleId,\n    dependsOn: ['workflows.instances.view'],\n  },\n  {\n    // Spec 8.4 ACL appendix: `workflows.instances.rerun_step` (admins/devs).\n    // Replaying a step re-executes real side effects with possibly EDITED\n    // context, which `workflows.instances.retry` (replay the run as it stands)\n    // does not authorise \u2014 hence its own feature rather than an implication.\n    id: 'workflows.instances.rerun_step',\n    title: 'Rerun a workflow instance from a step',\n    module: moduleId,\n    dependsOn: ['workflows.instances.retry', 'workflows.instances.update_context'],\n  },\n  {\n    // Spec 8.4 ACL appendix: `workflows.instances.bulk_ops` (admins). Retrying\n    // or cancelling a page of instances at once is strictly broader than doing\n    // it one row at a time \u2014 a misfire re-executes hundreds of real workflows \u2014\n    // so it is its own feature rather than an implication of `retry`/`cancel`.\n    id: 'workflows.instances.bulk_ops',\n    title: 'Bulk retry or cancel workflow instances',\n    module: moduleId,\n    dependsOn: ['workflows.instances.retry', 'workflows.instances.cancel'],\n  },\n  {\n    id: 'workflows.tasks.view',\n    title: 'View user tasks',\n    module: moduleId,\n    dependsOn: ['workflows.view'],\n  },\n  {\n    id: 'workflows.tasks.claim',\n    title: 'Claim workflow tasks',\n    module: moduleId,\n    dependsOn: ['workflows.tasks.view'],\n  },\n  {\n    id: 'workflows.tasks.complete',\n    title: 'Complete workflow tasks',\n    module: moduleId,\n    dependsOn: ['workflows.tasks.view'],\n  },\n  {\n    // Administration, per spec \u00A76.4: `workflows.tasks.*` gates viewing OTHER\n    // people's work, never one's own. Reading a task you have no relationship\n    // to still passes the same entity gate \u2014 this widens WHOSE rows you see,\n    // not WHICH entities you may see them about. It deliberately grants no act:\n    // an administrator reassigns a task to themselves (audited) before they can\n    // complete it, which is what keeps \"who approved this?\" answerable.\n    //\n    // `dependsOn: ['workflows.tasks.view']` keeps the older id load-bearing\n    // rather than leaving it a stored-but-unconsulted grant: it still admits a\n    // caller to the task API, and this feature decides which rows come back.\n    id: 'workflows.tasks.view_all',\n    title: 'View all workflow tasks',\n    module: moduleId,\n    dependsOn: ['workflows.tasks.view'],\n  },\n  {\n    // The ONLY supported route from \"I can see this task\" to \"I can act on it\".\n    // Writes the reassignment audit columns plus a WorkflowEvent.\n    id: 'workflows.tasks.reassign',\n    title: 'Reassign workflow tasks',\n    module: moduleId,\n    dependsOn: ['workflows.tasks.view_all'],\n  },\n  {\n    // Administrative mutations that are not reassignment: force-unclaim, cancel,\n    // bulk operations, and writing the tenant task-permission setting.\n    id: 'workflows.tasks.manage',\n    title: 'Administer workflow tasks',\n    module: moduleId,\n    dependsOn: ['workflows.tasks.view_all'],\n  },\n  {\n    id: 'workflows.signals.send',\n    title: 'Send workflow signals',\n    module: moduleId,\n    dependsOn: ['workflows.view'],\n  },\n  {\n    id: 'workflows.events.view',\n    title: 'View workflow events',\n    module: moduleId,\n    dependsOn: ['workflows.view'],\n  },\n  {\n    // Spec \u00A78.5 operations KPIs. Its own feature rather than an implication of\n    // `definitions.view`: a rollup states how often a process fails and how\n    // long it takes across every run in the organization, which is an\n    // aggregate over runs the caller may not be entitled to open one by one.\n    // `dependsOn: ['workflows.definitions.view']` because a KPI without the\n    // definition it belongs to names nothing the reader can act on.\n    id: 'workflows.metrics.view',\n    title: 'View workflow operational metrics',\n    module: moduleId,\n    dependsOn: ['workflows.definitions.view'],\n  },\n  // Note: Event triggers are now embedded in workflow definitions.\n  // Trigger management permissions are covered by workflows.definitions.edit\n]\n\nexport default features\n"],
+  "mappings": "AAAA,MAAM,WAAW;AAEV,MAAM,WAAW;AAAA,EACtB,EAAE,IAAI,kBAAkB,OAAO,kBAAkB,QAAQ,SAAS;AAAA,EAClE;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,gBAAgB;AAAA,EAC9B;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,gBAAgB;AAAA,EAC9B;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,gBAAgB;AAAA,EAC9B;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,gBAAgB;AAAA,EAC9B;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,4BAA4B;AAAA,EAC1C;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,4BAA4B;AAAA,EAC1C;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,4BAA4B;AAAA,EAC1C;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,4BAA4B;AAAA,EAC1C;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,4BAA4B;AAAA,EAC1C;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,4BAA4B;AAAA,EAC1C;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,gBAAgB;AAAA,EAC9B;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,4BAA4B,4BAA4B;AAAA,EACtE;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,0BAA0B;AAAA,EACxC;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,0BAA0B;AAAA,EACxC;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,0BAA0B;AAAA,EACxC;AAAA,EACA;AAAA;AAAA;AAAA,IAGE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,0BAA0B;AAAA,EACxC;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA,IAKE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,6BAA6B,oCAAoC;AAAA,EAC/E;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA,IAKE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,6BAA6B,4BAA4B;AAAA,EACvE;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,gBAAgB;AAAA,EAC9B;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,sBAAsB;AAAA,EACpC;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,sBAAsB;AAAA,EACpC;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,sBAAsB;AAAA,EACpC;AAAA,EACA;AAAA;AAAA;AAAA,IAGE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,0BAA0B;AAAA,EACxC;AAAA,EACA;AAAA;AAAA;AAAA,IAGE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,0BAA0B;AAAA,EACxC;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,gBAAgB;AAAA,EAC9B;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,gBAAgB;AAAA,EAC9B;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,4BAA4B;AAAA,EAC1C;AAAA;AAAA;AAGF;AAEA,IAAO,cAAQ;",
   "names": []
 }