@open-mercato/core 0.7.1-develop.7193.1.910a5b0a1e → 0.7.1-develop.7194.1.ab4fc81f82

package/dist/modules/workflows/api/definitions/[id]/context-schema/route.js

@@ -0,0 +1,134 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveOrganizationScopeFilter } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
+import {
+  computeDefinitionContextLedger,
+  narrowLedgerToStep,
+  resolveDefinitionDataForLedger,
+  warmContextLedgerResolvers
+} from "../../../../lib/definition-context-schema.js";
+import {
+  workflowsTag,
+  workflowErrorSchema,
+  workflowContextSchemaResponseSchema
+} from "../../../openapi.js";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+const logger = createLogger("workflows");
+const metadata = {
+  requireAuth: true,
+  requireFeatures: ["workflows.definitions.view"]
+};
+function respondWithLedger(definition, stepId) {
+  const ledger = computeDefinitionContextLedger(definition);
+  if (stepId === null) {
+    return NextResponse.json({ steps: ledger.steps });
+  }
+  const stepView = narrowLedgerToStep(ledger, stepId);
+  if (!stepView) {
+    return NextResponse.json(
+      { error: "Step not found in workflow definition" },
+      { status: 404 }
+    );
+  }
+  return NextResponse.json({ steps: { [stepId]: stepView } });
+}
+async function GET(request, context) {
+  try {
+    const params = await context.params;
+    const container = await createRequestContainer();
+    const em = container.resolve("em");
+    const auth = await getAuthFromRequest(request);
+    if (!auth || !auth.sub) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+    const scope = await resolveOrganizationScopeForRequest({ container, auth, request });
+    const tenantId = auth.tenantId;
+    const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+    if (!tenantId) {
+      return NextResponse.json({ error: "Missing tenant context" }, { status: 400 });
+    }
+    const rbacService = container.resolve("rbacService");
+    const hasPermission = await rbacService.userHasAllFeatures(
+      auth.sub,
+      ["workflows.definitions.view"],
+      { tenantId, organizationId }
+    );
+    if (!hasPermission) {
+      return NextResponse.json({ error: "Insufficient permissions" }, { status: 403 });
+    }
+    const stepId = new URL(request.url).searchParams.get("stepId");
+    await warmContextLedgerResolvers(container);
+    const orgFilter = resolveOrganizationScopeFilter(scope, auth);
+    const definitionData = await resolveDefinitionDataForLedger(em, params.id, {
+      tenantId,
+      organizationWhere: orgFilter.where
+    });
+    if (!definitionData) {
+      return NextResponse.json({ error: "Workflow definition not found" }, { status: 404 });
+    }
+    return respondWithLedger(definitionData, stepId);
+  } catch (error) {
+    logger.error("Error computing workflow context schema", { err: error });
+    return NextResponse.json(
+      { error: "Failed to compute workflow context schema" },
+      { status: 500 }
+    );
+  }
+}
+const openApi = {
+  tag: workflowsTag,
+  summary: "Workflow definition per-step context ledger",
+  pathParams: z.object({
+    id: z.string().describe('UUID for DB definitions, or "code:<workflowId>" for code-based definitions')
+  }),
+  methods: {
+    GET: {
+      summary: "Get the per-step context ledger",
+      description: 'Computes what context paths are available at each step of the workflow definition, with type, presence (always/maybe), and producer source. Presence degrades to "maybe" at joins unless the entry arrives on every incoming route. Use ?stepId=<id> to narrow the response to one step.',
+      query: z.object({
+        stepId: z.string().optional().describe("Narrow the response to this step (404 when the step does not exist)")
+      }),
+      responses: [
+        {
+          status: 200,
+          description: "Per-step context ledger",
+          schema: workflowContextSchemaResponseSchema,
+          example: {
+            steps: {
+              approve: {
+                entries: [
+                  {
+                    path: "orderId",
+                    type: "text",
+                    presence: "always",
+                    source: { kind: "contextSchema", label: "contextSchema.input" }
+                  },
+                  {
+                    path: "discount",
+                    type: "number",
+                    presence: "maybe",
+                    source: { kind: "userTask", stepId: "review", label: "userTask:review" }
+                  }
+                ]
+              }
+            }
+          }
+        }
+      ],
+      errors: [
+        { status: 400, description: "Missing tenant context", schema: workflowErrorSchema },
+        { status: 403, description: "Insufficient permissions", schema: workflowErrorSchema },
+        { status: 404, description: "Workflow definition or requested step not found", schema: workflowErrorSchema }
+      ]
+    }
+  }
+};
+export {
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/workflows/api/definitions/[id]/context-schema/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/workflows/api/definitions/%5Bid%5D/context-schema/route.ts"],
+  "sourcesContent": ["/**\n * Workflow Definition Context-Schema API (spec \u00A73.1 context ledger)\n *\n * Endpoints:\n * - GET /api/workflows/definitions/[id]/context-schema - Per-step context ledger\n *\n * Serves the SERVER-computed context ledger for a workflow definition: for\n * every step, the entries describing what context paths are available when the\n * step runs, with type/presence/source metadata. Computed on the server\n * because only the server runtime has the full activity registry and command\n * registry (UPDATE_ENTITY output schemas resolve through\n * `resolveServerOutputContract`); the browser-side editor consumes this\n * response instead of resolving contracts locally.\n *\n * Supports the same id forms as the sibling definition GET: a DB UUID\n * (tenant/org-scoped), \"code:<workflowId>\" for code-based definitions, and the\n * synthetic codeWorkflowUuid(workflowId) fallback used by instances started\n * from unpersisted code definitions. `?stepId=<id>` narrows the response to a\n * single step and 404s when the step does not exist in the definition.\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport type { EntityManager } from '@mikro-orm/core'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveOrganizationScopeFilter } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { type WorkflowDefinitionData } from '../../../../data/entities'\nimport {\n  computeDefinitionContextLedger,\n  narrowLedgerToStep,\n  resolveDefinitionDataForLedger,\n  warmContextLedgerResolvers,\n} from '../../../../lib/definition-context-schema'\nimport {\n  workflowsTag,\n  workflowErrorSchema,\n  workflowContextSchemaResponseSchema,\n} from '../../../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.view'],\n}\n\ninterface RouteContext {\n  params: Promise<{\n    id: string\n  }>\n}\n\nfunction respondWithLedger(definition: WorkflowDefinitionData, stepId: string | null) {\n  const ledger = computeDefinitionContextLedger(definition)\n  if (stepId === null) {\n    return NextResponse.json({ steps: ledger.steps })\n  }\n  const stepView = narrowLedgerToStep(ledger, stepId)\n  if (!stepView) {\n    return NextResponse.json(\n      { error: 'Step not found in workflow definition' },\n      { status: 404 },\n    )\n  }\n  return NextResponse.json({ steps: { [stepId]: stepView } })\n}\n\n/**\n * GET /api/workflows/definitions/[id]/context-schema\n *\n * Compute and return the per-step context ledger for a workflow definition.\n */\nexport async function GET(\n  request: NextRequest,\n  context: RouteContext,\n) {\n  try {\n    const params = await context.params\n    const container = await createRequestContainer()\n    const em = container.resolve('em') as EntityManager\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth || !auth.sub) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n\n    if (!tenantId) {\n      return NextResponse.json({ error: 'Missing tenant context' }, { status: 400 })\n    }\n\n    const rbacService = container.resolve('rbacService') as {\n      userHasAllFeatures: (\n        userId: string,\n        features: string[],\n        scope: { tenantId: string | null; organizationId: string | null },\n      ) => Promise<boolean>\n    }\n    const hasPermission = await rbacService.userHasAllFeatures(\n      auth.sub,\n      ['workflows.definitions.view'],\n      { tenantId, organizationId },\n    )\n\n    if (!hasPermission) {\n      return NextResponse.json({ error: 'Insufficient permissions' }, { status: 403 })\n    }\n\n    const stepId = new URL(request.url).searchParams.get('stepId')\n\n    await warmContextLedgerResolvers(container)\n\n    const orgFilter = resolveOrganizationScopeFilter(scope, auth)\n    const definitionData = await resolveDefinitionDataForLedger(em, params.id, {\n      tenantId,\n      organizationWhere: orgFilter.where,\n    })\n\n    if (!definitionData) {\n      return NextResponse.json({ error: 'Workflow definition not found' }, { status: 404 })\n    }\n\n    return respondWithLedger(definitionData, stepId)\n  } catch (error) {\n    logger.error('Error computing workflow context schema', { err: error })\n    return NextResponse.json(\n      { error: 'Failed to compute workflow context schema' },\n      { status: 500 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'Workflow definition per-step context ledger',\n  pathParams: z.object({\n    id: z.string().describe('UUID for DB definitions, or \"code:<workflowId>\" for code-based definitions'),\n  }),\n  methods: {\n    GET: {\n      summary: 'Get the per-step context ledger',\n      description: 'Computes what context paths are available at each step of the workflow definition, with type, presence (always/maybe), and producer source. Presence degrades to \"maybe\" at joins unless the entry arrives on every incoming route. Use ?stepId=<id> to narrow the response to one step.',\n      query: z.object({\n        stepId: z.string().optional().describe('Narrow the response to this step (404 when the step does not exist)'),\n      }),\n      responses: [\n        {\n          status: 200,\n          description: 'Per-step context ledger',\n          schema: workflowContextSchemaResponseSchema,\n          example: {\n            steps: {\n              approve: {\n                entries: [\n                  {\n                    path: 'orderId',\n                    type: 'text',\n                    presence: 'always',\n                    source: { kind: 'contextSchema', label: 'contextSchema.input' },\n                  },\n                  {\n                    path: 'discount',\n                    type: 'number',\n                    presence: 'maybe',\n                    source: { kind: 'userTask', stepId: 'review', label: 'userTask:review' },\n                  },\n                ],\n              },\n            },\n          },\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Missing tenant context', schema: workflowErrorSchema },\n        { status: 403, description: 'Insufficient permissions', schema: workflowErrorSchema },\n        { status: 404, description: 'Workflow definition or requested step not found', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAqBA,SAAsB,oBAAoB;AAE1C,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,sCAAsC;AAE/C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,4BAA4B;AAChD;AAQA,SAAS,kBAAkB,YAAoC,QAAuB;AACpF,QAAM,SAAS,+BAA+B,UAAU;AACxD,MAAI,WAAW,MAAM;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,OAAO,MAAM,CAAC;AAAA,EAClD;AACA,QAAM,WAAW,mBAAmB,QAAQ,MAAM;AAClD,MAAI,CAAC,UAAU;AACb,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,wCAAwC;AAAA,MACjD,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,SAAO,aAAa,KAAK,EAAE,OAAO,EAAE,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;AAC5D;AAOA,eAAsB,IACpB,SACA,SACA;AACA,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ;AAC7B,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,QAAQ,CAAC,KAAK,KAAK;AACtB,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAE1D,QAAI,CAAC,UAAU;AACb,aAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/E;AAEA,UAAM,cAAc,UAAU,QAAQ,aAAa;AAOnD,UAAM,gBAAgB,MAAM,YAAY;AAAA,MACtC,KAAK;AAAA,MACL,CAAC,4BAA4B;AAAA,MAC7B,EAAE,UAAU,eAAe;AAAA,IAC7B;AAEA,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjF;AAEA,UAAM,SAAS,IAAI,IAAI,QAAQ,GAAG,EAAE,aAAa,IAAI,QAAQ;AAE7D,UAAM,2BAA2B,SAAS;AAE1C,UAAM,YAAY,+BAA+B,OAAO,IAAI;AAC5D,UAAM,iBAAiB,MAAM,+BAA+B,IAAI,OAAO,IAAI;AAAA,MACzE;AAAA,MACA,mBAAmB,UAAU;AAAA,IAC/B,CAAC;AAED,QAAI,CAAC,gBAAgB;AACnB,aAAO,aAAa,KAAK,EAAE,OAAO,gCAAgC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACtF;AAEA,WAAO,kBAAkB,gBAAgB,MAAM;AAAA,EACjD,SAAS,OAAO;AACd,WAAO,MAAM,2CAA2C,EAAE,KAAK,MAAM,CAAC;AACtE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,4CAA4C;AAAA,MACrD,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY,EAAE,OAAO;AAAA,IACnB,IAAI,EAAE,OAAO,EAAE,SAAS,4EAA4E;AAAA,EACtG,CAAC;AAAA,EACD,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO,EAAE,OAAO;AAAA,QACd,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,qEAAqE;AAAA,MAC9G,CAAC;AAAA,MACD,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,OAAO;AAAA,cACL,SAAS;AAAA,gBACP,SAAS;AAAA,kBACP;AAAA,oBACE,MAAM;AAAA,oBACN,MAAM;AAAA,oBACN,UAAU;AAAA,oBACV,QAAQ,EAAE,MAAM,iBAAiB,OAAO,sBAAsB;AAAA,kBAChE;AAAA,kBACA;AAAA,oBACE,MAAM;AAAA,oBACN,MAAM;AAAA,oBACN,UAAU;AAAA,oBACV,QAAQ,EAAE,MAAM,YAAY,QAAQ,UAAU,OAAO,kBAAkB;AAAA,kBACzE;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,oBAAoB;AAAA,QAClF,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,mDAAmD,QAAQ,oBAAoB;AAAA,MAC7G;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/workflows/api/definitions/[id]/customize/route.js

@@ -6,6 +6,7 @@ import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/d
 import { validateCrudMutationGuard, runCrudMutationGuardAfterSuccess } from "@open-mercato/shared/lib/crud/mutation-guard";
 import { WorkflowDefinition } from "../../../../data/entities.js";
 import { serializeWorkflowDefinition } from "../../serialize.js";
+import { workflowDefinitionMutationResponseSchema, workflowErrorSchema } from "../../../openapi.js";
 import { getCodeWorkflow } from "../../../../lib/code-registry.js";
 import { invalidateTriggerCache } from "../../../../lib/event-trigger-service.js";
 import { createLogger } from "@open-mercato/shared/lib/logger";
@@ -53,7 +54,7 @@ async function POST(request, context) {
     const existingOverride = await em.findOne(WorkflowDefinition, {
       workflowId: codeDef.workflowId,
       tenantId
-    });
+    }, { orderBy: { version: "DESC" } });
     let saved;
     if (existingOverride) {
       existingOverride.deletedAt = null;
@@ -144,6 +145,7 @@ const openApi = {
         {
           status: 200,
           description: "Workflow definition customized successfully",
+          schema: workflowDefinitionMutationResponseSchema,
           example: {
             data: {
               id: "123e4567-e89b-12d3-a456-426614174000",
@@ -157,11 +159,13 @@ const openApi = {
         {
           status: 400,
           description: "Not a code-based id",
+          schema: workflowErrorSchema,
           example: { error: "Customize is only supported for code-based workflow definitions" }
         },
         {
           status: 404,
           description: "Code workflow not found",
+          schema: workflowErrorSchema,
           example: { error: "Workflow definition not found" }
         }
       ]

package/dist/modules/workflows/api/definitions/[id]/customize/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/workflows/api/definitions/%5Bid%5D/customize/route.ts"],
-  "sourcesContent": ["/**\n * Customize Code-Based Workflow Definition\n *\n * POST /api/workflows/definitions/[id]/customize\n *\n * Creates a DB override row for a code-based workflow definition, seeded from\n * the current code registry values. The id param must be of the form\n * \"code:<workflowId>\".\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { validateCrudMutationGuard, runCrudMutationGuardAfterSuccess } from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { WorkflowDefinition } from '../../../../data/entities'\nimport { serializeWorkflowDefinition } from '../../serialize'\nimport { getCodeWorkflow } from '../../../../lib/code-registry'\nimport { invalidateTriggerCache } from '../../../../lib/event-trigger-service'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.edit'],\n}\n\ninterface RouteContext {\n  params: Promise<{\n    id: string\n  }>\n}\n\nexport async function POST(request: NextRequest, context: RouteContext) {\n  try {\n    const params = await context.params\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = scope?.selectedId ?? auth.orgId\n\n    if (!params.id.startsWith('code:')) {\n      return NextResponse.json(\n        { error: 'Customize is only supported for code-based workflow definitions' },\n        { status: 400 },\n      )\n    }\n\n    const workflowId = params.id.slice(5)\n    const codeDef = getCodeWorkflow(workflowId)\n    if (!codeDef) {\n      return NextResponse.json({ error: 'Workflow definition not found' }, { status: 404 })\n    }\n\n    const guardResult = await validateCrudMutationGuard(container, {\n      tenantId: tenantId ?? '',\n      organizationId: organizationId ?? null,\n      userId: auth.sub ?? '',\n      resourceKind: 'workflows.definition',\n      resourceId: params.id,\n      operation: 'custom',\n      requestMethod: 'POST',\n      requestHeaders: request.headers,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    const existingOverride = await em.findOne(WorkflowDefinition, {\n      workflowId: codeDef.workflowId,\n      tenantId,\n    })\n\n    let saved: WorkflowDefinition\n    if (existingOverride) {\n      existingOverride.deletedAt = null\n      existingOverride.workflowName = codeDef.workflowName\n      existingOverride.description = codeDef.description\n      existingOverride.version = codeDef.version\n      existingOverride.definition = codeDef.definition\n      existingOverride.metadata = codeDef.metadata ?? null\n      existingOverride.enabled = codeDef.enabled\n      existingOverride.codeWorkflowId = codeDef.workflowId\n      existingOverride.updatedBy = auth.sub\n      existingOverride.updatedAt = new Date()\n      await em.flush()\n      saved = existingOverride\n    } else {\n      const override = em.create(WorkflowDefinition, {\n        workflowId: codeDef.workflowId,\n        workflowName: codeDef.workflowName,\n        description: codeDef.description,\n        version: codeDef.version,\n        definition: codeDef.definition,\n        metadata: codeDef.metadata,\n        enabled: codeDef.enabled,\n        codeWorkflowId: codeDef.workflowId,\n        tenantId,\n        organizationId,\n        createdBy: auth.sub,\n        updatedBy: auth.sub,\n        createdAt: new Date(),\n        updatedAt: new Date(),\n      })\n      em.persist(override)\n      await em.flush()\n      saved = override\n    }\n\n    // Materializing the override moves trigger ownership from the code registry\n    // to the new `workflow_definitions` row, so the cached snapshot the wildcard\n    // subscriber reads is stale until TRIGGER_CACHE_TTL expires (#4425). Scope\n    // the invalidation to the saved row's own organization: reviving an existing\n    // override belonging to a sibling organization changes triggers for THAT\n    // organization, not for the caller's.\n    if (saved.tenantId) invalidateTriggerCache(saved.tenantId, saved.organizationId ?? undefined)\n\n    if (guardResult?.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId: tenantId ?? '',\n        organizationId: organizationId ?? null,\n        userId: auth.sub ?? '',\n        resourceKind: 'workflows.definition',\n        resourceId: String(saved.id),\n        operation: 'custom',\n        requestMethod: 'POST',\n        requestHeaders: request.headers,\n        metadata: guardResult.metadata,\n      })\n    }\n\n    try {\n      const eventBus = container.resolve('eventBus') as\n        | { emitEvent(event: string, payload: unknown, options?: unknown): Promise<void> }\n        | undefined\n      if (eventBus && typeof eventBus.emitEvent === 'function') {\n        await eventBus.emitEvent(\n          'workflows.definition.customized',\n          {\n            id: saved.id,\n            workflowId: saved.workflowId,\n            codeWorkflowId: saved.codeWorkflowId ?? null,\n            tenantId: saved.tenantId,\n            organizationId: saved.organizationId,\n            userId: auth.sub ?? null,\n          },\n          { tenantId: saved.tenantId, organizationId: saved.organizationId, persistent: true },\n        )\n      }\n    } catch (eventError) {\n      logger.error('Failed to emit workflows.definition.customized event', { err: eventError })\n    }\n\n    return NextResponse.json({\n      data: serializeWorkflowDefinition(saved),\n      message: 'Workflow definition customized successfully',\n    })\n  } catch (error) {\n    logger.error('Error customizing workflow definition', { err: error })\n    return NextResponse.json({ error: 'Failed to customize workflow definition' }, { status: 500 })\n  }\n}\n\nexport const openApi = {\n  methods: {\n    POST: {\n      summary: 'Customize code-based workflow definition',\n      description: 'Creates a DB override for a code-based workflow definition, seeded from the current code registry values. The id param must be of the form \"code:<workflowId>\".',\n      tags: ['Workflows'],\n      pathParams: z.object({\n        id: z.string().describe('Must be of the form \"code:<workflowId>\"'),\n      }),\n      responses: [\n        {\n          status: 200,\n          description: 'Workflow definition customized successfully',\n          example: {\n            data: {\n              id: '123e4567-e89b-12d3-a456-426614174000',\n              workflowId: 'workflows.simple-approval',\n              workflowName: 'Simple Approval Workflow',\n              source: 'code_override',\n            },\n            message: 'Workflow definition customized successfully',\n          },\n        },\n        {\n          status: 400,\n          description: 'Not a code-based id',\n          example: { error: 'Customize is only supported for code-based workflow definitions' },\n        },\n        {\n          status: 404,\n          description: 'Code workflow not found',\n          example: { error: 'Workflow definition not found' },\n        },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAUA,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,2BAA2B,wCAAwC;AAC5E,SAAS,0BAA0B;AACnC,SAAS,mCAAmC;AAC5C,SAAS,uBAAuB;AAChC,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,4BAA4B;AAChD;AAQA,eAAsB,KAAK,SAAsB,SAAuB;AACtE,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ;AAC7B,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,cAAc,KAAK;AAEjD,QAAI,CAAC,OAAO,GAAG,WAAW,OAAO,GAAG;AAClC,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,kEAAkE;AAAA,QAC3E,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,aAAa,OAAO,GAAG,MAAM,CAAC;AACpC,UAAM,UAAU,gBAAgB,UAAU;AAC1C,QAAI,CAAC,SAAS;AACZ,aAAO,aAAa,KAAK,EAAE,OAAO,gCAAgC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACtF;AAEA,UAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,MAC7D,UAAU,YAAY;AAAA,MACtB,gBAAgB,kBAAkB;AAAA,MAClC,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,WAAW;AAAA,MACX,eAAe;AAAA,MACf,gBAAgB,QAAQ;AAAA,IAC1B,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,UAAM,mBAAmB,MAAM,GAAG,QAAQ,oBAAoB;AAAA,MAC5D,YAAY,QAAQ;AAAA,MACpB;AAAA,IACF,CAAC;AAED,QAAI;AACJ,QAAI,kBAAkB;AACpB,uBAAiB,YAAY;AAC7B,uBAAiB,eAAe,QAAQ;AACxC,uBAAiB,cAAc,QAAQ;AACvC,uBAAiB,UAAU,QAAQ;AACnC,uBAAiB,aAAa,QAAQ;AACtC,uBAAiB,WAAW,QAAQ,YAAY;AAChD,uBAAiB,UAAU,QAAQ;AACnC,uBAAiB,iBAAiB,QAAQ;AAC1C,uBAAiB,YAAY,KAAK;AAClC,uBAAiB,YAAY,oBAAI,KAAK;AACtC,YAAM,GAAG,MAAM;AACf,cAAQ;AAAA,IACV,OAAO;AACL,YAAM,WAAW,GAAG,OAAO,oBAAoB;AAAA,QAC7C,YAAY,QAAQ;AAAA,QACpB,cAAc,QAAQ;AAAA,QACtB,aAAa,QAAQ;AAAA,QACrB,SAAS,QAAQ;AAAA,QACjB,YAAY,QAAQ;AAAA,QACpB,UAAU,QAAQ;AAAA,QAClB,SAAS,QAAQ;AAAA,QACjB,gBAAgB,QAAQ;AAAA,QACxB;AAAA,QACA;AAAA,QACA,WAAW,KAAK;AAAA,QAChB,WAAW,KAAK;AAAA,QAChB,WAAW,oBAAI,KAAK;AAAA,QACpB,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAC;AACD,SAAG,QAAQ,QAAQ;AACnB,YAAM,GAAG,MAAM;AACf,cAAQ;AAAA,IACV;AAQA,QAAI,MAAM,SAAU,wBAAuB,MAAM,UAAU,MAAM,kBAAkB,MAAS;AAE5F,QAAI,aAAa,uBAAuB;AACtC,YAAM,iCAAiC,WAAW;AAAA,QAChD,UAAU,YAAY;AAAA,QACtB,gBAAgB,kBAAkB;AAAA,QAClC,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc;AAAA,QACd,YAAY,OAAO,MAAM,EAAE;AAAA,QAC3B,WAAW;AAAA,QACX,eAAe;AAAA,QACf,gBAAgB,QAAQ;AAAA,QACxB,UAAU,YAAY;AAAA,MACxB,CAAC;AAAA,IACH;AAEA,QAAI;AACF,YAAM,WAAW,UAAU,QAAQ,UAAU;AAG7C,UAAI,YAAY,OAAO,SAAS,cAAc,YAAY;AACxD,cAAM,SAAS;AAAA,UACb;AAAA,UACA;AAAA,YACE,IAAI,MAAM;AAAA,YACV,YAAY,MAAM;AAAA,YAClB,gBAAgB,MAAM,kBAAkB;AAAA,YACxC,UAAU,MAAM;AAAA,YAChB,gBAAgB,MAAM;AAAA,YACtB,QAAQ,KAAK,OAAO;AAAA,UACtB;AAAA,UACA,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,gBAAgB,YAAY,KAAK;AAAA,QACrF;AAAA,MACF;AAAA,IACF,SAAS,YAAY;AACnB,aAAO,MAAM,wDAAwD,EAAE,KAAK,WAAW,CAAC;AAAA,IAC1F;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,MAAM,4BAA4B,KAAK;AAAA,MACvC,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,yCAAyC,EAAE,KAAK,MAAM,CAAC;AACpE,WAAO,aAAa,KAAK,EAAE,OAAO,0CAA0C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChG;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,MAAM,CAAC,WAAW;AAAA,MAClB,YAAY,EAAE,OAAO;AAAA,QACnB,IAAI,EAAE,OAAO,EAAE,SAAS,yCAAyC;AAAA,MACnE,CAAC;AAAA,MACD,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,SAAS;AAAA,YACP,MAAM;AAAA,cACJ,IAAI;AAAA,cACJ,YAAY;AAAA,cACZ,cAAc;AAAA,cACd,QAAQ;AAAA,YACV;AAAA,YACA,SAAS;AAAA,UACX;AAAA,QACF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,SAAS,EAAE,OAAO,kEAAkE;AAAA,QACtF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,SAAS,EAAE,OAAO,gCAAgC;AAAA,QACpD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * Customize Code-Based Workflow Definition\n *\n * POST /api/workflows/definitions/[id]/customize\n *\n * Creates a DB override row for a code-based workflow definition, seeded from\n * the current code registry values. The id param must be of the form\n * \"code:<workflowId>\".\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { validateCrudMutationGuard, runCrudMutationGuardAfterSuccess } from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { WorkflowDefinition } from '../../../../data/entities'\nimport { serializeWorkflowDefinition } from '../../serialize'\nimport { workflowDefinitionMutationResponseSchema, workflowErrorSchema } from '../../../openapi'\nimport { getCodeWorkflow } from '../../../../lib/code-registry'\nimport { invalidateTriggerCache } from '../../../../lib/event-trigger-service'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.edit'],\n}\n\ninterface RouteContext {\n  params: Promise<{\n    id: string\n  }>\n}\n\nexport async function POST(request: NextRequest, context: RouteContext) {\n  try {\n    const params = await context.params\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = scope?.selectedId ?? auth.orgId\n\n    if (!params.id.startsWith('code:')) {\n      return NextResponse.json(\n        { error: 'Customize is only supported for code-based workflow definitions' },\n        { status: 400 },\n      )\n    }\n\n    const workflowId = params.id.slice(5)\n    const codeDef = getCodeWorkflow(workflowId)\n    if (!codeDef) {\n      return NextResponse.json({ error: 'Workflow definition not found' }, { status: 404 })\n    }\n\n    const guardResult = await validateCrudMutationGuard(container, {\n      tenantId: tenantId ?? '',\n      organizationId: organizationId ?? null,\n      userId: auth.sub ?? '',\n      resourceKind: 'workflows.definition',\n      resourceId: params.id,\n      operation: 'custom',\n      requestMethod: 'POST',\n      requestHeaders: request.headers,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    // Pin to the latest version so the override targets a deterministic row.\n    const existingOverride = await em.findOne(WorkflowDefinition, {\n      workflowId: codeDef.workflowId,\n      tenantId,\n    }, { orderBy: { version: 'DESC' } })\n\n    let saved: WorkflowDefinition\n    if (existingOverride) {\n      existingOverride.deletedAt = null\n      existingOverride.workflowName = codeDef.workflowName\n      existingOverride.description = codeDef.description\n      existingOverride.version = codeDef.version\n      existingOverride.definition = codeDef.definition\n      existingOverride.metadata = codeDef.metadata ?? null\n      existingOverride.enabled = codeDef.enabled\n      existingOverride.codeWorkflowId = codeDef.workflowId\n      existingOverride.updatedBy = auth.sub\n      existingOverride.updatedAt = new Date()\n      await em.flush()\n      saved = existingOverride\n    } else {\n      const override = em.create(WorkflowDefinition, {\n        workflowId: codeDef.workflowId,\n        workflowName: codeDef.workflowName,\n        description: codeDef.description,\n        version: codeDef.version,\n        definition: codeDef.definition,\n        metadata: codeDef.metadata,\n        enabled: codeDef.enabled,\n        codeWorkflowId: codeDef.workflowId,\n        tenantId,\n        organizationId,\n        createdBy: auth.sub,\n        updatedBy: auth.sub,\n        createdAt: new Date(),\n        updatedAt: new Date(),\n      })\n      em.persist(override)\n      await em.flush()\n      saved = override\n    }\n\n    // Materializing the override moves trigger ownership from the code registry\n    // to the new `workflow_definitions` row, so the cached snapshot the wildcard\n    // subscriber reads is stale until TRIGGER_CACHE_TTL expires (#4425). Scope\n    // the invalidation to the saved row's own organization: reviving an existing\n    // override belonging to a sibling organization changes triggers for THAT\n    // organization, not for the caller's.\n    if (saved.tenantId) invalidateTriggerCache(saved.tenantId, saved.organizationId ?? undefined)\n\n    if (guardResult?.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId: tenantId ?? '',\n        organizationId: organizationId ?? null,\n        userId: auth.sub ?? '',\n        resourceKind: 'workflows.definition',\n        resourceId: String(saved.id),\n        operation: 'custom',\n        requestMethod: 'POST',\n        requestHeaders: request.headers,\n        metadata: guardResult.metadata,\n      })\n    }\n\n    try {\n      const eventBus = container.resolve('eventBus') as\n        | { emitEvent(event: string, payload: unknown, options?: unknown): Promise<void> }\n        | undefined\n      if (eventBus && typeof eventBus.emitEvent === 'function') {\n        await eventBus.emitEvent(\n          'workflows.definition.customized',\n          {\n            id: saved.id,\n            workflowId: saved.workflowId,\n            codeWorkflowId: saved.codeWorkflowId ?? null,\n            tenantId: saved.tenantId,\n            organizationId: saved.organizationId,\n            userId: auth.sub ?? null,\n          },\n          { tenantId: saved.tenantId, organizationId: saved.organizationId, persistent: true },\n        )\n      }\n    } catch (eventError) {\n      logger.error('Failed to emit workflows.definition.customized event', { err: eventError })\n    }\n\n    return NextResponse.json({\n      data: serializeWorkflowDefinition(saved),\n      message: 'Workflow definition customized successfully',\n    })\n  } catch (error) {\n    logger.error('Error customizing workflow definition', { err: error })\n    return NextResponse.json({ error: 'Failed to customize workflow definition' }, { status: 500 })\n  }\n}\n\nexport const openApi = {\n  methods: {\n    POST: {\n      summary: 'Customize code-based workflow definition',\n      description: 'Creates a DB override for a code-based workflow definition, seeded from the current code registry values. The id param must be of the form \"code:<workflowId>\".',\n      tags: ['Workflows'],\n      pathParams: z.object({\n        id: z.string().describe('Must be of the form \"code:<workflowId>\"'),\n      }),\n      responses: [\n        {\n          status: 200,\n          description: 'Workflow definition customized successfully',\n          schema: workflowDefinitionMutationResponseSchema,\n          example: {\n            data: {\n              id: '123e4567-e89b-12d3-a456-426614174000',\n              workflowId: 'workflows.simple-approval',\n              workflowName: 'Simple Approval Workflow',\n              source: 'code_override',\n            },\n            message: 'Workflow definition customized successfully',\n          },\n        },\n        {\n          status: 400,\n          description: 'Not a code-based id',\n          schema: workflowErrorSchema,\n          example: { error: 'Customize is only supported for code-based workflow definitions' },\n        },\n        {\n          status: 404,\n          description: 'Code workflow not found',\n          schema: workflowErrorSchema,\n          example: { error: 'Workflow definition not found' },\n        },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAUA,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,2BAA2B,wCAAwC;AAC5E,SAAS,0BAA0B;AACnC,SAAS,mCAAmC;AAC5C,SAAS,0CAA0C,2BAA2B;AAC9E,SAAS,uBAAuB;AAChC,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,4BAA4B;AAChD;AAQA,eAAsB,KAAK,SAAsB,SAAuB;AACtE,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ;AAC7B,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,cAAc,KAAK;AAEjD,QAAI,CAAC,OAAO,GAAG,WAAW,OAAO,GAAG;AAClC,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,kEAAkE;AAAA,QAC3E,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,aAAa,OAAO,GAAG,MAAM,CAAC;AACpC,UAAM,UAAU,gBAAgB,UAAU;AAC1C,QAAI,CAAC,SAAS;AACZ,aAAO,aAAa,KAAK,EAAE,OAAO,gCAAgC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACtF;AAEA,UAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,MAC7D,UAAU,YAAY;AAAA,MACtB,gBAAgB,kBAAkB;AAAA,MAClC,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,WAAW;AAAA,MACX,eAAe;AAAA,MACf,gBAAgB,QAAQ;AAAA,IAC1B,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAGA,UAAM,mBAAmB,MAAM,GAAG,QAAQ,oBAAoB;AAAA,MAC5D,YAAY,QAAQ;AAAA,MACpB;AAAA,IACF,GAAG,EAAE,SAAS,EAAE,SAAS,OAAO,EAAE,CAAC;AAEnC,QAAI;AACJ,QAAI,kBAAkB;AACpB,uBAAiB,YAAY;AAC7B,uBAAiB,eAAe,QAAQ;AACxC,uBAAiB,cAAc,QAAQ;AACvC,uBAAiB,UAAU,QAAQ;AACnC,uBAAiB,aAAa,QAAQ;AACtC,uBAAiB,WAAW,QAAQ,YAAY;AAChD,uBAAiB,UAAU,QAAQ;AACnC,uBAAiB,iBAAiB,QAAQ;AAC1C,uBAAiB,YAAY,KAAK;AAClC,uBAAiB,YAAY,oBAAI,KAAK;AACtC,YAAM,GAAG,MAAM;AACf,cAAQ;AAAA,IACV,OAAO;AACL,YAAM,WAAW,GAAG,OAAO,oBAAoB;AAAA,QAC7C,YAAY,QAAQ;AAAA,QACpB,cAAc,QAAQ;AAAA,QACtB,aAAa,QAAQ;AAAA,QACrB,SAAS,QAAQ;AAAA,QACjB,YAAY,QAAQ;AAAA,QACpB,UAAU,QAAQ;AAAA,QAClB,SAAS,QAAQ;AAAA,QACjB,gBAAgB,QAAQ;AAAA,QACxB;AAAA,QACA;AAAA,QACA,WAAW,KAAK;AAAA,QAChB,WAAW,KAAK;AAAA,QAChB,WAAW,oBAAI,KAAK;AAAA,QACpB,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAC;AACD,SAAG,QAAQ,QAAQ;AACnB,YAAM,GAAG,MAAM;AACf,cAAQ;AAAA,IACV;AAQA,QAAI,MAAM,SAAU,wBAAuB,MAAM,UAAU,MAAM,kBAAkB,MAAS;AAE5F,QAAI,aAAa,uBAAuB;AACtC,YAAM,iCAAiC,WAAW;AAAA,QAChD,UAAU,YAAY;AAAA,QACtB,gBAAgB,kBAAkB;AAAA,QAClC,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc;AAAA,QACd,YAAY,OAAO,MAAM,EAAE;AAAA,QAC3B,WAAW;AAAA,QACX,eAAe;AAAA,QACf,gBAAgB,QAAQ;AAAA,QACxB,UAAU,YAAY;AAAA,MACxB,CAAC;AAAA,IACH;AAEA,QAAI;AACF,YAAM,WAAW,UAAU,QAAQ,UAAU;AAG7C,UAAI,YAAY,OAAO,SAAS,cAAc,YAAY;AACxD,cAAM,SAAS;AAAA,UACb;AAAA,UACA;AAAA,YACE,IAAI,MAAM;AAAA,YACV,YAAY,MAAM;AAAA,YAClB,gBAAgB,MAAM,kBAAkB;AAAA,YACxC,UAAU,MAAM;AAAA,YAChB,gBAAgB,MAAM;AAAA,YACtB,QAAQ,KAAK,OAAO;AAAA,UACtB;AAAA,UACA,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,gBAAgB,YAAY,KAAK;AAAA,QACrF;AAAA,MACF;AAAA,IACF,SAAS,YAAY;AACnB,aAAO,MAAM,wDAAwD,EAAE,KAAK,WAAW,CAAC;AAAA,IAC1F;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,MAAM,4BAA4B,KAAK;AAAA,MACvC,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,yCAAyC,EAAE,KAAK,MAAM,CAAC;AACpE,WAAO,aAAa,KAAK,EAAE,OAAO,0CAA0C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChG;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,MAAM,CAAC,WAAW;AAAA,MAClB,YAAY,EAAE,OAAO;AAAA,QACnB,IAAI,EAAE,OAAO,EAAE,SAAS,yCAAyC;AAAA,MACnE,CAAC;AAAA,MACD,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,MAAM;AAAA,cACJ,IAAI;AAAA,cACJ,YAAY;AAAA,cACZ,cAAc;AAAA,cACd,QAAQ;AAAA,YACV;AAAA,YACA,SAAS;AAAA,UACX;AAAA,QACF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS,EAAE,OAAO,kEAAkE;AAAA,QACtF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS,EAAE,OAAO,gCAAgC;AAAA,QACpD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/workflows/api/definitions/[id]/draft/route.js

@@ -0,0 +1,286 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { runRouteMutationGuards } from "@open-mercato/shared/lib/crud/route-mutation-guard";
+import { WorkflowDefinition, WorkflowDefinitionDraft } from "../../../../data/entities.js";
+import {
+  upsertWorkflowDefinitionDraftInputSchema
+} from "../../../../data/validators.js";
+import {
+  workflowsTag,
+  workflowErrorSchema,
+  workflowDefinitionDraftDetailResponseSchema,
+  workflowDefinitionDraftMutationResponseSchema,
+  workflowDefinitionDraftDeleteResponseSchema
+} from "../../../openapi.js";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+const logger = createLogger("workflows");
+const DRAFT_RESOURCE_KIND = "workflows.definition_draft";
+const draftIdSchema = z.uuid();
+const metadata = {
+  requireAuth: true,
+  requireFeatures: ["workflows.definitions.edit"]
+};
+async function resolveDraftContext(request, context) {
+  const params = await context.params;
+  const container = await createRequestContainer();
+  const em = container.resolve("em");
+  const auth = await getAuthFromRequest(request);
+  if (!auth || !auth.sub) {
+    return { ok: false, response: NextResponse.json({ error: "Unauthorized" }, { status: 401 }) };
+  }
+  const idValidation = draftIdSchema.safeParse(params.id);
+  if (!idValidation.success) {
+    return {
+      ok: false,
+      response: NextResponse.json(
+        { error: "Drafts are only available for saved workflow definitions" },
+        { status: 400 }
+      )
+    };
+  }
+  const scope = await resolveOrganizationScopeForRequest({ container, auth, request });
+  const tenantId = auth.tenantId;
+  const organizationId = scope?.selectedId ?? auth.orgId;
+  if (!tenantId) {
+    return { ok: false, response: NextResponse.json({ error: "Missing tenant context" }, { status: 400 }) };
+  }
+  if (!organizationId) {
+    return { ok: false, response: NextResponse.json({ error: "Missing organization context" }, { status: 400 }) };
+  }
+  const rbacService = container.resolve("rbacService");
+  const hasPermission = await rbacService.userHasAllFeatures(
+    auth.sub,
+    ["workflows.definitions.edit"],
+    { tenantId, organizationId }
+  );
+  if (!hasPermission) {
+    return { ok: false, response: NextResponse.json({ error: "Insufficient permissions" }, { status: 403 }) };
+  }
+  return {
+    ok: true,
+    container,
+    em,
+    auth: { sub: auth.sub, tenantId: auth.tenantId ?? null, orgId: auth.orgId ?? null },
+    userId: auth.sub,
+    tenantId,
+    organizationId,
+    definitionId: idValidation.data
+  };
+}
+function serializeWorkflowDefinitionDraft(draft) {
+  return {
+    id: draft.id,
+    definitionId: draft.definitionId ?? null,
+    definition: draft.definition,
+    metadata: draft.metadata ?? null,
+    baseUpdatedAt: draft.baseUpdatedAt ? draft.baseUpdatedAt.toISOString() : null,
+    createdAt: draft.createdAt ? draft.createdAt.toISOString() : null,
+    updatedAt: draft.updatedAt ? draft.updatedAt.toISOString() : null
+  };
+}
+async function GET(request, context) {
+  try {
+    const resolved = await resolveDraftContext(request, context);
+    if (!resolved.ok) return resolved.response;
+    const { em, userId, tenantId, organizationId, definitionId } = resolved;
+    const draft = await em.findOne(WorkflowDefinitionDraft, {
+      definitionId,
+      userId,
+      tenantId,
+      organizationId,
+      deletedAt: null
+    });
+    if (!draft) {
+      return NextResponse.json({ error: "Workflow definition draft not found" }, { status: 404 });
+    }
+    return NextResponse.json({ data: serializeWorkflowDefinitionDraft(draft) });
+  } catch (error) {
+    logger.error("Error getting workflow definition draft", { err: error });
+    return NextResponse.json({ error: "Failed to get workflow definition draft" }, { status: 500 });
+  }
+}
+async function PUT(request, context) {
+  try {
+    const resolved = await resolveDraftContext(request, context);
+    if (!resolved.ok) return resolved.response;
+    const { container, em, userId, tenantId, organizationId, definitionId } = resolved;
+    const body = await request.json();
+    const validation = upsertWorkflowDefinitionDraftInputSchema.safeParse(body);
+    if (!validation.success) {
+      return NextResponse.json(
+        { error: "Validation failed", details: validation.error.issues },
+        { status: 400 }
+      );
+    }
+    const input = validation.data;
+    const definition = await em.findOne(WorkflowDefinition, {
+      id: definitionId,
+      tenantId,
+      organizationId,
+      deletedAt: null
+    });
+    if (!definition) {
+      return NextResponse.json({ error: "Workflow definition not found" }, { status: 404 });
+    }
+    const guarded = await runRouteMutationGuards({
+      container,
+      req: request,
+      auth: { userId, tenantId, organizationId },
+      input: {
+        resourceKind: DRAFT_RESOURCE_KIND,
+        resourceId: definitionId,
+        operation: "update",
+        mutationPayload: input
+      }
+    });
+    if (!guarded.ok) {
+      return NextResponse.json(guarded.errorBody, { status: guarded.errorStatus });
+    }
+    const existingDraft = await em.findOne(WorkflowDefinitionDraft, {
+      definitionId,
+      userId,
+      tenantId
+    });
+    let savedDraft;
+    if (existingDraft) {
+      existingDraft.deletedAt = null;
+      existingDraft.organizationId = organizationId;
+      existingDraft.definition = input.definition;
+      if (input.metadata !== void 0) {
+        existingDraft.metadata = input.metadata;
+      }
+      if (input.baseUpdatedAt !== void 0) {
+        existingDraft.baseUpdatedAt = input.baseUpdatedAt;
+      }
+      existingDraft.updatedAt = /* @__PURE__ */ new Date();
+      await em.flush();
+      savedDraft = existingDraft;
+    } else {
+      const draft = em.create(WorkflowDefinitionDraft, {
+        definitionId,
+        userId,
+        definition: input.definition,
+        metadata: input.metadata ?? null,
+        baseUpdatedAt: input.baseUpdatedAt ?? null,
+        tenantId,
+        organizationId,
+        createdAt: /* @__PURE__ */ new Date(),
+        updatedAt: /* @__PURE__ */ new Date()
+      });
+      em.persist(draft);
+      await em.flush();
+      savedDraft = draft;
+    }
+    await guarded.runAfterSuccess();
+    return NextResponse.json({
+      data: serializeWorkflowDefinitionDraft(savedDraft),
+      message: "Workflow definition draft saved"
+    });
+  } catch (error) {
+    logger.error("Error saving workflow definition draft", { err: error });
+    return NextResponse.json({ error: "Failed to save workflow definition draft" }, { status: 500 });
+  }
+}
+async function DELETE(request, context) {
+  try {
+    const resolved = await resolveDraftContext(request, context);
+    if (!resolved.ok) return resolved.response;
+    const { container, em, userId, tenantId, organizationId, definitionId } = resolved;
+    const draft = await em.findOne(WorkflowDefinitionDraft, {
+      definitionId,
+      userId,
+      tenantId,
+      organizationId,
+      deletedAt: null
+    });
+    if (!draft) {
+      return NextResponse.json({ message: "Workflow definition draft discarded" });
+    }
+    const guarded = await runRouteMutationGuards({
+      container,
+      req: request,
+      auth: { userId, tenantId, organizationId },
+      input: {
+        resourceKind: DRAFT_RESOURCE_KIND,
+        resourceId: definitionId,
+        operation: "delete"
+      }
+    });
+    if (!guarded.ok) {
+      return NextResponse.json(guarded.errorBody, { status: guarded.errorStatus });
+    }
+    draft.deletedAt = /* @__PURE__ */ new Date();
+    draft.updatedAt = /* @__PURE__ */ new Date();
+    await em.flush();
+    await guarded.runAfterSuccess();
+    return NextResponse.json({ message: "Workflow definition draft discarded" });
+  } catch (error) {
+    logger.error("Error discarding workflow definition draft", { err: error });
+    return NextResponse.json({ error: "Failed to discard workflow definition draft" }, { status: 500 });
+  }
+}
+const openApi = {
+  tag: workflowsTag,
+  summary: "Per-user workflow definition drafts",
+  pathParams: z.object({
+    id: z.uuid().describe("Workflow definition UUID (server drafts exist only for saved definitions)")
+  }),
+  methods: {
+    GET: {
+      summary: "Get the current user's draft",
+      description: "Returns the authenticated user's autosaved draft for the workflow definition. Drafts are private to the user who saved them.",
+      responses: [
+        { status: 200, description: "Draft found", schema: workflowDefinitionDraftDetailResponseSchema }
+      ],
+      errors: [
+        { status: 400, description: "Invalid definition id (only saved definitions have server drafts)", schema: workflowErrorSchema },
+        { status: 403, description: "Insufficient permissions", schema: workflowErrorSchema },
+        { status: 404, description: "No draft exists for this user and definition", schema: workflowErrorSchema }
+      ]
+    },
+    PUT: {
+      summary: "Save the current user's draft",
+      description: "Creates or updates the authenticated user's draft for the workflow definition. The definition payload is validated shape-only (steps and transitions must be arrays of objects) so a mid-edit, structurally incomplete graph still saves; full validation runs when the draft is promoted via the definition PUT. Draft saves never participate in the definition's optimistic lock.",
+      requestBody: {
+        schema: upsertWorkflowDefinitionDraftInputSchema,
+        example: {
+          definition: {
+            steps: [{ stepId: "start", stepName: "Start", stepType: "START" }],
+            transitions: []
+          },
+          baseUpdatedAt: "2026-07-27T10:00:00.000Z"
+        }
+      },
+      responses: [
+        { status: 200, description: "Draft saved", schema: workflowDefinitionDraftMutationResponseSchema }
+      ],
+      errors: [
+        { status: 400, description: "Malformed draft payload or invalid definition id", schema: workflowErrorSchema },
+        { status: 403, description: "Insufficient permissions", schema: workflowErrorSchema },
+        { status: 404, description: "Workflow definition not found", schema: workflowErrorSchema }
+      ]
+    },
+    DELETE: {
+      summary: "Discard the current user's draft",
+      description: "Deletes the authenticated user's draft for the workflow definition. Idempotent: discarding a non-existent draft succeeds.",
+      responses: [
+        { status: 200, description: "Draft discarded (or no draft existed)", schema: workflowDefinitionDraftDeleteResponseSchema }
+      ],
+      errors: [
+        { status: 400, description: "Invalid definition id", schema: workflowErrorSchema },
+        { status: 403, description: "Insufficient permissions", schema: workflowErrorSchema }
+      ]
+    }
+  }
+};
+export {
+  DELETE,
+  GET,
+  PUT,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/workflows/api/definitions/[id]/draft/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/workflows/api/definitions/%5Bid%5D/draft/route.ts"],
+  "sourcesContent": ["/**\n * Workflow Definition Draft API (spec \u00A74.7 save model)\n *\n * Endpoints:\n * - GET /api/workflows/definitions/[id]/draft - Get the CURRENT USER's draft\n * - PUT /api/workflows/definitions/[id]/draft - Upsert the current user's draft\n * - DELETE /api/workflows/definitions/[id]/draft - Discard the current user's draft (idempotent)\n *\n * Drafts are a per-user autosave layer over a saved definition. They are\n * scoped by tenant + organization + userId from the authenticated principal\n * (never from the body) and deliberately do NOT participate in the\n * definition's optimistic lock \u2014 only the explicit definition PUT does.\n * Server drafts exist only for saved definitions (UUID ids): \"code:*\" and\n * unsaved-definition ids are rejected with 400; drafts for not-yet-saved\n * definitions are the editor's local concern (Step 8.3).\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { WorkflowDefinition, WorkflowDefinitionDraft } from '../../../../data/entities'\nimport {\n  upsertWorkflowDefinitionDraftInputSchema,\n  type UpsertWorkflowDefinitionDraftApiInput,\n} from '../../../../data/validators'\nimport {\n  workflowsTag,\n  workflowErrorSchema,\n  workflowDefinitionDraftDetailResponseSchema,\n  workflowDefinitionDraftMutationResponseSchema,\n  workflowDefinitionDraftDeleteResponseSchema,\n} from '../../../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('workflows')\n\nconst DRAFT_RESOURCE_KIND = 'workflows.definition_draft'\n\nconst draftIdSchema = z.uuid()\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.edit'],\n}\n\ninterface RouteContext {\n  params: Promise<{\n    id: string\n  }>\n}\n\ntype ResolvedDraftContext = {\n  ok: true\n  container: Awaited<ReturnType<typeof createRequestContainer>>\n  em: {\n    findOne: (entity: unknown, where: Record<string, unknown>) => Promise<unknown>\n    create: (entity: unknown, data: Record<string, unknown>) => WorkflowDefinitionDraft\n    persist: (entity: unknown) => unknown\n    flush: () => Promise<void>\n  }\n  auth: { sub: string; tenantId: string | null; orgId: string | null }\n  userId: string\n  tenantId: string\n  organizationId: string\n  definitionId: string\n}\n\ntype RejectedDraftContext = {\n  ok: false\n  response: NextResponse\n}\n\nasync function resolveDraftContext(\n  request: NextRequest,\n  context: RouteContext,\n): Promise<ResolvedDraftContext | RejectedDraftContext> {\n  const params = await context.params\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as ResolvedDraftContext['em']\n  const auth = await getAuthFromRequest(request)\n\n  if (!auth || !auth.sub) {\n    return { ok: false, response: NextResponse.json({ error: 'Unauthorized' }, { status: 401 }) }\n  }\n\n  const idValidation = draftIdSchema.safeParse(params.id)\n  if (!idValidation.success) {\n    return {\n      ok: false,\n      response: NextResponse.json(\n        { error: 'Drafts are only available for saved workflow definitions' },\n        { status: 400 },\n      ),\n    }\n  }\n\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n  const tenantId = auth.tenantId\n  const organizationId = scope?.selectedId ?? auth.orgId\n\n  if (!tenantId) {\n    return { ok: false, response: NextResponse.json({ error: 'Missing tenant context' }, { status: 400 }) }\n  }\n  if (!organizationId) {\n    return { ok: false, response: NextResponse.json({ error: 'Missing organization context' }, { status: 400 }) }\n  }\n\n  const rbacService = container.resolve('rbacService') as {\n    userHasAllFeatures: (\n      userId: string,\n      features: string[],\n      scope: { tenantId: string | null; organizationId: string | null },\n    ) => Promise<boolean>\n  }\n  const hasPermission = await rbacService.userHasAllFeatures(\n    auth.sub,\n    ['workflows.definitions.edit'],\n    { tenantId, organizationId },\n  )\n\n  if (!hasPermission) {\n    return { ok: false, response: NextResponse.json({ error: 'Insufficient permissions' }, { status: 403 }) }\n  }\n\n  return {\n    ok: true,\n    container,\n    em,\n    auth: { sub: auth.sub, tenantId: auth.tenantId ?? null, orgId: auth.orgId ?? null },\n    userId: auth.sub,\n    tenantId,\n    organizationId,\n    definitionId: idValidation.data,\n  }\n}\n\nfunction serializeWorkflowDefinitionDraft(draft: WorkflowDefinitionDraft) {\n  return {\n    id: draft.id,\n    definitionId: draft.definitionId ?? null,\n    definition: draft.definition,\n    metadata: draft.metadata ?? null,\n    baseUpdatedAt: draft.baseUpdatedAt ? draft.baseUpdatedAt.toISOString() : null,\n    createdAt: draft.createdAt ? draft.createdAt.toISOString() : null,\n    updatedAt: draft.updatedAt ? draft.updatedAt.toISOString() : null,\n  }\n}\n\n/**\n * GET /api/workflows/definitions/[id]/draft\n *\n * Return the current user's draft for the definition, or 404 when none exists.\n */\nexport async function GET(\n  request: NextRequest,\n  context: RouteContext,\n) {\n  try {\n    const resolved = await resolveDraftContext(request, context)\n    if (!resolved.ok) return resolved.response\n    const { em, userId, tenantId, organizationId, definitionId } = resolved\n\n    const draft = (await em.findOne(WorkflowDefinitionDraft, {\n      definitionId,\n      userId,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })) as WorkflowDefinitionDraft | null\n\n    if (!draft) {\n      return NextResponse.json({ error: 'Workflow definition draft not found' }, { status: 404 })\n    }\n\n    return NextResponse.json({ data: serializeWorkflowDefinitionDraft(draft) })\n  } catch (error) {\n    logger.error('Error getting workflow definition draft', { err: error })\n    return NextResponse.json({ error: 'Failed to get workflow definition draft' }, { status: 500 })\n  }\n}\n\n/**\n * PUT /api/workflows/definitions/[id]/draft\n *\n * Upsert the current user's draft for the definition. The body is validated\n * shape-only (a draft may be mid-edit and structurally incomplete); full\n * definition validation happens on explicit Save via the definition PUT.\n */\nexport async function PUT(\n  request: NextRequest,\n  context: RouteContext,\n) {\n  try {\n    const resolved = await resolveDraftContext(request, context)\n    if (!resolved.ok) return resolved.response\n    const { container, em, userId, tenantId, organizationId, definitionId } = resolved\n\n    const body = await request.json()\n    const validation = upsertWorkflowDefinitionDraftInputSchema.safeParse(body)\n    if (!validation.success) {\n      return NextResponse.json(\n        { error: 'Validation failed', details: validation.error.issues },\n        { status: 400 },\n      )\n    }\n\n    const input: UpsertWorkflowDefinitionDraftApiInput = validation.data\n\n    const definition = (await em.findOne(WorkflowDefinition, {\n      id: definitionId,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })) as WorkflowDefinition | null\n\n    if (!definition) {\n      return NextResponse.json({ error: 'Workflow definition not found' }, { status: 404 })\n    }\n\n    const guarded = await runRouteMutationGuards({\n      container,\n      req: request,\n      auth: { userId, tenantId, organizationId },\n      input: {\n        resourceKind: DRAFT_RESOURCE_KIND,\n        resourceId: definitionId,\n        operation: 'update',\n        mutationPayload: input as Record<string, unknown>,\n      },\n    })\n    if (!guarded.ok) {\n      return NextResponse.json(guarded.errorBody, { status: guarded.errorStatus })\n    }\n\n    const existingDraft = (await em.findOne(WorkflowDefinitionDraft, {\n      definitionId,\n      userId,\n      tenantId,\n    })) as WorkflowDefinitionDraft | null\n\n    let savedDraft: WorkflowDefinitionDraft\n    if (existingDraft) {\n      existingDraft.deletedAt = null\n      existingDraft.organizationId = organizationId\n      existingDraft.definition = input.definition\n      if (input.metadata !== undefined) {\n        existingDraft.metadata = input.metadata\n      }\n      if (input.baseUpdatedAt !== undefined) {\n        existingDraft.baseUpdatedAt = input.baseUpdatedAt\n      }\n      existingDraft.updatedAt = new Date()\n      await em.flush()\n      savedDraft = existingDraft\n    } else {\n      const draft = em.create(WorkflowDefinitionDraft, {\n        definitionId,\n        userId,\n        definition: input.definition,\n        metadata: input.metadata ?? null,\n        baseUpdatedAt: input.baseUpdatedAt ?? null,\n        tenantId,\n        organizationId,\n        createdAt: new Date(),\n        updatedAt: new Date(),\n      })\n      em.persist(draft)\n      await em.flush()\n      savedDraft = draft\n    }\n\n    await guarded.runAfterSuccess()\n\n    return NextResponse.json({\n      data: serializeWorkflowDefinitionDraft(savedDraft),\n      message: 'Workflow definition draft saved',\n    })\n  } catch (error) {\n    logger.error('Error saving workflow definition draft', { err: error })\n    return NextResponse.json({ error: 'Failed to save workflow definition draft' }, { status: 500 })\n  }\n}\n\n/**\n * DELETE /api/workflows/definitions/[id]/draft\n *\n * Discard the current user's draft. Idempotent: deleting a non-existent draft\n * succeeds.\n */\nexport async function DELETE(\n  request: NextRequest,\n  context: RouteContext,\n) {\n  try {\n    const resolved = await resolveDraftContext(request, context)\n    if (!resolved.ok) return resolved.response\n    const { container, em, userId, tenantId, organizationId, definitionId } = resolved\n\n    const draft = (await em.findOne(WorkflowDefinitionDraft, {\n      definitionId,\n      userId,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })) as WorkflowDefinitionDraft | null\n\n    if (!draft) {\n      return NextResponse.json({ message: 'Workflow definition draft discarded' })\n    }\n\n    const guarded = await runRouteMutationGuards({\n      container,\n      req: request,\n      auth: { userId, tenantId, organizationId },\n      input: {\n        resourceKind: DRAFT_RESOURCE_KIND,\n        resourceId: definitionId,\n        operation: 'delete',\n      },\n    })\n    if (!guarded.ok) {\n      return NextResponse.json(guarded.errorBody, { status: guarded.errorStatus })\n    }\n\n    draft.deletedAt = new Date()\n    draft.updatedAt = new Date()\n    await em.flush()\n\n    await guarded.runAfterSuccess()\n\n    return NextResponse.json({ message: 'Workflow definition draft discarded' })\n  } catch (error) {\n    logger.error('Error discarding workflow definition draft', { err: error })\n    return NextResponse.json({ error: 'Failed to discard workflow definition draft' }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'Per-user workflow definition drafts',\n  pathParams: z.object({\n    id: z.uuid().describe('Workflow definition UUID (server drafts exist only for saved definitions)'),\n  }),\n  methods: {\n    GET: {\n      summary: 'Get the current user\\'s draft',\n      description: 'Returns the authenticated user\\'s autosaved draft for the workflow definition. Drafts are private to the user who saved them.',\n      responses: [\n        { status: 200, description: 'Draft found', schema: workflowDefinitionDraftDetailResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid definition id (only saved definitions have server drafts)', schema: workflowErrorSchema },\n        { status: 403, description: 'Insufficient permissions', schema: workflowErrorSchema },\n        { status: 404, description: 'No draft exists for this user and definition', schema: workflowErrorSchema },\n      ],\n    },\n    PUT: {\n      summary: 'Save the current user\\'s draft',\n      description: 'Creates or updates the authenticated user\\'s draft for the workflow definition. The definition payload is validated shape-only (steps and transitions must be arrays of objects) so a mid-edit, structurally incomplete graph still saves; full validation runs when the draft is promoted via the definition PUT. Draft saves never participate in the definition\\'s optimistic lock.',\n      requestBody: {\n        schema: upsertWorkflowDefinitionDraftInputSchema,\n        example: {\n          definition: {\n            steps: [{ stepId: 'start', stepName: 'Start', stepType: 'START' }],\n            transitions: [],\n          },\n          baseUpdatedAt: '2026-07-27T10:00:00.000Z',\n        },\n      },\n      responses: [\n        { status: 200, description: 'Draft saved', schema: workflowDefinitionDraftMutationResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Malformed draft payload or invalid definition id', schema: workflowErrorSchema },\n        { status: 403, description: 'Insufficient permissions', schema: workflowErrorSchema },\n        { status: 404, description: 'Workflow definition not found', schema: workflowErrorSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Discard the current user\\'s draft',\n      description: 'Deletes the authenticated user\\'s draft for the workflow definition. Idempotent: discarding a non-existent draft succeeds.',\n      responses: [\n        { status: 200, description: 'Draft discarded (or no draft existed)', schema: workflowDefinitionDraftDeleteResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid definition id', schema: workflowErrorSchema },\n        { status: 403, description: 'Insufficient permissions', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAiBA,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,8BAA8B;AACvC,SAAS,oBAAoB,+BAA+B;AAC5D;AAAA,EACE;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEvC,MAAM,sBAAsB;AAE5B,MAAM,gBAAgB,EAAE,KAAK;AAEtB,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,4BAA4B;AAChD;AA6BA,eAAe,oBACb,SACA,SACsD;AACtD,QAAM,SAAS,MAAM,QAAQ;AAC7B,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,MAAI,CAAC,QAAQ,CAAC,KAAK,KAAK;AACtB,WAAO,EAAE,IAAI,OAAO,UAAU,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,EAC9F;AAEA,QAAM,eAAe,cAAc,UAAU,OAAO,EAAE;AACtD,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,UAAU,aAAa;AAAA,QACrB,EAAE,OAAO,2DAA2D;AAAA,QACpE,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,QAAM,WAAW,KAAK;AACtB,QAAM,iBAAiB,OAAO,cAAc,KAAK;AAEjD,MAAI,CAAC,UAAU;AACb,WAAO,EAAE,IAAI,OAAO,UAAU,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,EACxG;AACA,MAAI,CAAC,gBAAgB;AACnB,WAAO,EAAE,IAAI,OAAO,UAAU,aAAa,KAAK,EAAE,OAAO,+BAA+B,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,EAC9G;AAEA,QAAM,cAAc,UAAU,QAAQ,aAAa;AAOnD,QAAM,gBAAgB,MAAM,YAAY;AAAA,IACtC,KAAK;AAAA,IACL,CAAC,4BAA4B;AAAA,IAC7B,EAAE,UAAU,eAAe;AAAA,EAC7B;AAEA,MAAI,CAAC,eAAe;AAClB,WAAO,EAAE,IAAI,OAAO,UAAU,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,EAC1G;AAEA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ;AAAA,IACA;AAAA,IACA,MAAM,EAAE,KAAK,KAAK,KAAK,UAAU,KAAK,YAAY,MAAM,OAAO,KAAK,SAAS,KAAK;AAAA,IAClF,QAAQ,KAAK;AAAA,IACb;AAAA,IACA;AAAA,IACA,cAAc,aAAa;AAAA,EAC7B;AACF;AAEA,SAAS,iCAAiC,OAAgC;AACxE,SAAO;AAAA,IACL,IAAI,MAAM;AAAA,IACV,cAAc,MAAM,gBAAgB;AAAA,IACpC,YAAY,MAAM;AAAA,IAClB,UAAU,MAAM,YAAY;AAAA,IAC5B,eAAe,MAAM,gBAAgB,MAAM,cAAc,YAAY,IAAI;AAAA,IACzE,WAAW,MAAM,YAAY,MAAM,UAAU,YAAY,IAAI;AAAA,IAC7D,WAAW,MAAM,YAAY,MAAM,UAAU,YAAY,IAAI;AAAA,EAC/D;AACF;AAOA,eAAsB,IACpB,SACA,SACA;AACA,MAAI;AACF,UAAM,WAAW,MAAM,oBAAoB,SAAS,OAAO;AAC3D,QAAI,CAAC,SAAS,GAAI,QAAO,SAAS;AAClC,UAAM,EAAE,IAAI,QAAQ,UAAU,gBAAgB,aAAa,IAAI;AAE/D,UAAM,QAAS,MAAM,GAAG,QAAQ,yBAAyB;AAAA,MACvD;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AAED,QAAI,CAAC,OAAO;AACV,aAAO,aAAa,KAAK,EAAE,OAAO,sCAAsC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC5F;AAEA,WAAO,aAAa,KAAK,EAAE,MAAM,iCAAiC,KAAK,EAAE,CAAC;AAAA,EAC5E,SAAS,OAAO;AACd,WAAO,MAAM,2CAA2C,EAAE,KAAK,MAAM,CAAC;AACtE,WAAO,aAAa,KAAK,EAAE,OAAO,0CAA0C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChG;AACF;AASA,eAAsB,IACpB,SACA,SACA;AACA,MAAI;AACF,UAAM,WAAW,MAAM,oBAAoB,SAAS,OAAO;AAC3D,QAAI,CAAC,SAAS,GAAI,QAAO,SAAS;AAClC,UAAM,EAAE,WAAW,IAAI,QAAQ,UAAU,gBAAgB,aAAa,IAAI;AAE1E,UAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,UAAM,aAAa,yCAAyC,UAAU,IAAI;AAC1E,QAAI,CAAC,WAAW,SAAS;AACvB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,qBAAqB,SAAS,WAAW,MAAM,OAAO;AAAA,QAC/D,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,QAA+C,WAAW;AAEhE,UAAM,aAAc,MAAM,GAAG,QAAQ,oBAAoB;AAAA,MACvD,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AAED,QAAI,CAAC,YAAY;AACf,aAAO,aAAa,KAAK,EAAE,OAAO,gCAAgC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACtF;AAEA,UAAM,UAAU,MAAM,uBAAuB;AAAA,MAC3C;AAAA,MACA,KAAK;AAAA,MACL,MAAM,EAAE,QAAQ,UAAU,eAAe;AAAA,MACzC,OAAO;AAAA,QACL,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,iBAAiB;AAAA,MACnB;AAAA,IACF,CAAC;AACD,QAAI,CAAC,QAAQ,IAAI;AACf,aAAO,aAAa,KAAK,QAAQ,WAAW,EAAE,QAAQ,QAAQ,YAAY,CAAC;AAAA,IAC7E;AAEA,UAAM,gBAAiB,MAAM,GAAG,QAAQ,yBAAyB;AAAA,MAC/D;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAED,QAAI;AACJ,QAAI,eAAe;AACjB,oBAAc,YAAY;AAC1B,oBAAc,iBAAiB;AAC/B,oBAAc,aAAa,MAAM;AACjC,UAAI,MAAM,aAAa,QAAW;AAChC,sBAAc,WAAW,MAAM;AAAA,MACjC;AACA,UAAI,MAAM,kBAAkB,QAAW;AACrC,sBAAc,gBAAgB,MAAM;AAAA,MACtC;AACA,oBAAc,YAAY,oBAAI,KAAK;AACnC,YAAM,GAAG,MAAM;AACf,mBAAa;AAAA,IACf,OAAO;AACL,YAAM,QAAQ,GAAG,OAAO,yBAAyB;AAAA,QAC/C;AAAA,QACA;AAAA,QACA,YAAY,MAAM;AAAA,QAClB,UAAU,MAAM,YAAY;AAAA,QAC5B,eAAe,MAAM,iBAAiB;AAAA,QACtC;AAAA,QACA;AAAA,QACA,WAAW,oBAAI,KAAK;AAAA,QACpB,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAC;AACD,SAAG,QAAQ,KAAK;AAChB,YAAM,GAAG,MAAM;AACf,mBAAa;AAAA,IACf;AAEA,UAAM,QAAQ,gBAAgB;AAE9B,WAAO,aAAa,KAAK;AAAA,MACvB,MAAM,iCAAiC,UAAU;AAAA,MACjD,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,0CAA0C,EAAE,KAAK,MAAM,CAAC;AACrE,WAAO,aAAa,KAAK,EAAE,OAAO,2CAA2C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjG;AACF;AAQA,eAAsB,OACpB,SACA,SACA;AACA,MAAI;AACF,UAAM,WAAW,MAAM,oBAAoB,SAAS,OAAO;AAC3D,QAAI,CAAC,SAAS,GAAI,QAAO,SAAS;AAClC,UAAM,EAAE,WAAW,IAAI,QAAQ,UAAU,gBAAgB,aAAa,IAAI;AAE1E,UAAM,QAAS,MAAM,GAAG,QAAQ,yBAAyB;AAAA,MACvD;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AAED,QAAI,CAAC,OAAO;AACV,aAAO,aAAa,KAAK,EAAE,SAAS,sCAAsC,CAAC;AAAA,IAC7E;AAEA,UAAM,UAAU,MAAM,uBAAuB;AAAA,MAC3C;AAAA,MACA,KAAK;AAAA,MACL,MAAM,EAAE,QAAQ,UAAU,eAAe;AAAA,MACzC,OAAO;AAAA,QACL,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,WAAW;AAAA,MACb;AAAA,IACF,CAAC;AACD,QAAI,CAAC,QAAQ,IAAI;AACf,aAAO,aAAa,KAAK,QAAQ,WAAW,EAAE,QAAQ,QAAQ,YAAY,CAAC;AAAA,IAC7E;AAEA,UAAM,YAAY,oBAAI,KAAK;AAC3B,UAAM,YAAY,oBAAI,KAAK;AAC3B,UAAM,GAAG,MAAM;AAEf,UAAM,QAAQ,gBAAgB;AAE9B,WAAO,aAAa,KAAK,EAAE,SAAS,sCAAsC,CAAC;AAAA,EAC7E,SAAS,OAAO;AACd,WAAO,MAAM,8CAA8C,EAAE,KAAK,MAAM,CAAC;AACzE,WAAO,aAAa,KAAK,EAAE,OAAO,8CAA8C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpG;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY,EAAE,OAAO;AAAA,IACnB,IAAI,EAAE,KAAK,EAAE,SAAS,2EAA2E;AAAA,EACnG,CAAC;AAAA,EACD,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,eAAe,QAAQ,4CAA4C;AAAA,MACjG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,qEAAqE,QAAQ,oBAAoB;AAAA,QAC7H,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,gDAAgD,QAAQ,oBAAoB;AAAA,MAC1G;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,YAAY;AAAA,YACV,OAAO,CAAC,EAAE,QAAQ,SAAS,UAAU,SAAS,UAAU,QAAQ,CAAC;AAAA,YACjE,aAAa,CAAC;AAAA,UAChB;AAAA,UACA,eAAe;AAAA,QACjB;AAAA,MACF;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,eAAe,QAAQ,8CAA8C;AAAA,MACnG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,oDAAoD,QAAQ,oBAAoB;AAAA,QAC5G,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,oBAAoB;AAAA,MAC3F;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,yCAAyC,QAAQ,4CAA4C;AAAA,MAC3H;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}