@open-mercato/core 0.7.1-develop.7193.1.910a5b0a1e → 0.7.1-develop.7194.1.ab4fc81f82

package/dist/modules/workflows/api/definitions/[id]/publish/route.js

@@ -0,0 +1,207 @@
+import { randomUUID } from "node:crypto";
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { validateCrudMutationGuard, runCrudMutationGuardAfterSuccess } from "@open-mercato/shared/lib/crud/mutation-guard";
+import { WorkflowDefinition } from "../../../../data/entities.js";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { serializeWorkflowDefinition } from "../../serialize.js";
+import { findSubWorkflowCallers } from "../../../../lib/caller-graph.js";
+import {
+  authorizeWorkflowGrantChange,
+  normalizeGrantedFeatures,
+  syncWorkflowDefinitionPrincipal
+} from "../../../../lib/definition-grant.js";
+const logger = createLogger("workflows").child({ component: "definition-publish-api" });
+const metadata = {
+  requireAuth: true,
+  requireFeatures: ["workflows.definitions.publish"]
+};
+const publishInputSchema = z.object({
+  acknowledgeBreakingChanges: z.boolean().optional()
+});
+async function POST(request, context) {
+  try {
+    const params = await context.params;
+    const container = await createRequestContainer();
+    const em = container.resolve("em");
+    const auth = await getAuthFromRequest(request);
+    if (!auth) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+    const scope = await resolveOrganizationScopeForRequest({ container, auth, request });
+    const tenantId = auth.tenantId;
+    const organizationId = scope?.selectedId ?? auth.orgId;
+    if (!tenantId || !organizationId) {
+      return NextResponse.json({ error: "Missing tenant or organization context" }, { status: 400 });
+    }
+    const body = await request.json().catch(() => ({}));
+    const parsed = publishInputSchema.safeParse(body);
+    if (!parsed.success) {
+      return NextResponse.json({ error: "Validation failed", details: parsed.error.issues }, { status: 400 });
+    }
+    const guardResult = await validateCrudMutationGuard(container, {
+      tenantId,
+      organizationId,
+      userId: auth.sub ?? "",
+      resourceKind: "workflows.definition",
+      resourceId: params.id,
+      operation: "custom",
+      requestMethod: "POST",
+      requestHeaders: request.headers
+    });
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status });
+    }
+    const source = await em.findOne(WorkflowDefinition, {
+      id: params.id,
+      tenantId,
+      organizationId,
+      deletedAt: null
+    });
+    if (!source) {
+      return NextResponse.json({ error: "Workflow definition not found" }, { status: 404 });
+    }
+    const ports = source.definition?.io || {};
+    const breakingChanges = await findSubWorkflowCallers(em, {
+      subWorkflowId: source.workflowId,
+      tenantId,
+      organizationId,
+      ports
+    });
+    if (breakingChanges.length > 0 && !parsed.data.acknowledgeBreakingChanges) {
+      return NextResponse.json(
+        {
+          error: "Publishing would break existing sub-workflow mappings",
+          breakingChanges
+        },
+        { status: 409 }
+      );
+    }
+    const latest = await em.findOne(
+      WorkflowDefinition,
+      { workflowId: source.workflowId, tenantId },
+      { orderBy: { version: "DESC" } }
+    );
+    const nextVersion = (latest?.version ?? source.version) + 1;
+    const grantedFeatures = normalizeGrantedFeatures(source.grantedFeatures);
+    const grantFailure = await authorizeWorkflowGrantChange(
+      container.resolve("rbacService"),
+      {
+        userId: auth.sub,
+        scope: { tenantId, organizationId },
+        requested: grantedFeatures,
+        current: []
+      }
+    );
+    if (grantFailure) {
+      return NextResponse.json(grantFailure.body, { status: grantFailure.status });
+    }
+    const published = em.create(WorkflowDefinition, {
+      id: randomUUID(),
+      workflowId: source.workflowId,
+      codeWorkflowId: source.codeWorkflowId ?? null,
+      workflowName: source.workflowName,
+      description: source.description ?? null,
+      version: nextVersion,
+      definition: source.definition,
+      metadata: source.metadata ?? null,
+      enabled: true,
+      kind: source.kind,
+      lifecycle: "published",
+      grantedFeatures: grantedFeatures.length ? grantedFeatures : null,
+      tenantId,
+      organizationId,
+      createdBy: auth.sub,
+      updatedBy: auth.sub,
+      createdAt: /* @__PURE__ */ new Date(),
+      updatedAt: /* @__PURE__ */ new Date()
+    });
+    await syncWorkflowDefinitionPrincipal(container, published);
+    em.persist(published);
+    await em.flush();
+    if (guardResult?.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(container, {
+        tenantId,
+        organizationId,
+        userId: auth.sub ?? "",
+        resourceKind: "workflows.definition",
+        resourceId: String(published.id),
+        operation: "custom",
+        requestMethod: "POST",
+        requestHeaders: request.headers,
+        metadata: guardResult.metadata
+      });
+    }
+    try {
+      const eventBus = container.resolve("eventBus");
+      if (eventBus && typeof eventBus.emitEvent === "function") {
+        await eventBus.emitEvent(
+          "workflows.definition.published",
+          {
+            id: published.id,
+            workflowId: published.workflowId,
+            version: published.version,
+            tenantId: published.tenantId,
+            organizationId: published.organizationId,
+            userId: auth.sub ?? null
+          },
+          { tenantId: published.tenantId, organizationId: published.organizationId, persistent: true }
+        );
+      }
+    } catch (eventError) {
+      logger.error("failed to emit workflows.definition.published event", {
+        error: eventError instanceof Error ? eventError.message : String(eventError)
+      });
+    }
+    return NextResponse.json({
+      data: serializeWorkflowDefinition(published),
+      breakingChanges,
+      message: "Workflow definition published successfully"
+    });
+  } catch (error) {
+    logger.error("error publishing workflow definition", {
+      error: error instanceof Error ? error.message : String(error)
+    });
+    return NextResponse.json({ error: "Failed to publish workflow definition" }, { status: 500 });
+  }
+}
+const openApi = {
+  methods: {
+    POST: {
+      summary: "Publish a new workflow definition version",
+      description: "Mints a frozen published version snapshotting the definition and its IO port contract. Returns affected sub-workflow callers; pass acknowledgeBreakingChanges=true to publish despite breaking changes.",
+      tags: ["Workflows"],
+      pathParams: z.object({ id: z.string().describe("Workflow definition id") }),
+      requestBody: publishInputSchema,
+      responses: [
+        {
+          status: 200,
+          description: "Published",
+          example: {
+            data: { id: "\u2026", workflowId: "verify-policy", version: 2, lifecycle: "published" },
+            breakingChanges: [],
+            message: "Workflow definition published successfully"
+          }
+        },
+        {
+          status: 409,
+          description: "Breaking changes not acknowledged",
+          example: {
+            error: "Publishing would break existing sub-workflow mappings",
+            breakingChanges: [{ workflowId: "order-flow", version: 1, stepId: "sub", brokenMappings: ["input:orderId"] }]
+          }
+        },
+        { status: 404, description: "Not found", example: { error: "Workflow definition not found" } }
+      ]
+    }
+  }
+};
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/workflows/api/definitions/[id]/publish/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/workflows/api/definitions/%5Bid%5D/publish/route.ts"],
+  "sourcesContent": ["/**\n * Publish Workflow Definition Version\n *\n * POST /api/workflows/definitions/[id]/publish\n *\n * Mints a new frozen, published version of a workflow definition (snapshotting\n * its current data + IO port contract). Runs breaking-change detection against\n * callers of the workflow as a sub-workflow; when callers would break, the\n * caller must pass `acknowledgeBreakingChanges: true`. Emits\n * `workflows.definition.published`.\n */\n\nimport { randomUUID } from 'node:crypto'\nimport { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { validateCrudMutationGuard, runCrudMutationGuardAfterSuccess } from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { WorkflowDefinition } from '../../../../data/entities'\nimport type { WorkflowIoContract } from '../../../../data/validators'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { serializeWorkflowDefinition } from '../../serialize'\nimport { findSubWorkflowCallers } from '../../../../lib/caller-graph'\nimport {\n  authorizeWorkflowGrantChange,\n  normalizeGrantedFeatures,\n  syncWorkflowDefinitionPrincipal,\n} from '../../../../lib/definition-grant'\n\nconst logger = createLogger('workflows').child({ component: 'definition-publish-api' })\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.publish'],\n}\n\nconst publishInputSchema = z.object({\n  acknowledgeBreakingChanges: z.boolean().optional(),\n})\n\ninterface RouteContext {\n  params: Promise<{ id: string }>\n}\n\nexport async function POST(request: NextRequest, context: RouteContext) {\n  try {\n    const params = await context.params\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = scope?.selectedId ?? auth.orgId\n\n    if (!tenantId || !organizationId) {\n      return NextResponse.json({ error: 'Missing tenant or organization context' }, { status: 400 })\n    }\n\n    const body = await request.json().catch(() => ({}))\n    const parsed = publishInputSchema.safeParse(body)\n    if (!parsed.success) {\n      return NextResponse.json({ error: 'Validation failed', details: parsed.error.issues }, { status: 400 })\n    }\n\n    const guardResult = await validateCrudMutationGuard(container, {\n      tenantId,\n      organizationId,\n      userId: auth.sub ?? '',\n      resourceKind: 'workflows.definition',\n      resourceId: params.id,\n      operation: 'custom',\n      requestMethod: 'POST',\n      requestHeaders: request.headers,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    const source = await em.findOne(WorkflowDefinition, {\n      id: params.id,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })\n    if (!source) {\n      return NextResponse.json({ error: 'Workflow definition not found' }, { status: 404 })\n    }\n\n    // Breaking-change detection: diff this definition's published port contract\n    // against every caller that invokes it as a sub-workflow.\n    const ports: WorkflowIoContract = (source.definition as { io?: WorkflowIoContract })?.io || {}\n    const breakingChanges = await findSubWorkflowCallers(em, {\n      subWorkflowId: source.workflowId,\n      tenantId,\n      organizationId,\n      ports,\n    })\n\n    if (breakingChanges.length > 0 && !parsed.data.acknowledgeBreakingChanges) {\n      return NextResponse.json(\n        {\n          error: 'Publishing would break existing sub-workflow mappings',\n          breakingChanges,\n        },\n        { status: 409 },\n      )\n    }\n\n    // Next version = max existing version for this workflowId/tenant + 1.\n    const latest = await em.findOne(\n      WorkflowDefinition,\n      { workflowId: source.workflowId, tenantId },\n      { orderBy: { version: 'DESC' } },\n    )\n    const nextVersion = (latest?.version ?? source.version) + 1\n\n    // The grant is per VERSION, so publishing mints a NEW execution principal\n    // from the source's grant \u2014 a new identity carrying those powers. It is\n    // therefore re-authorised against the PUBLISHER (`current: []` forces the\n    // check even though the feature list is unchanged): a user who may publish\n    // must not be able to bring a higher-privileged author's grant forward.\n    const grantedFeatures = normalizeGrantedFeatures(source.grantedFeatures)\n    const grantFailure = await authorizeWorkflowGrantChange(\n      container.resolve('rbacService') as Parameters<typeof authorizeWorkflowGrantChange>[0],\n      {\n        userId: auth.sub,\n        scope: { tenantId, organizationId },\n        requested: grantedFeatures,\n        current: [],\n      },\n    )\n    if (grantFailure) {\n      return NextResponse.json(grantFailure.body, { status: grantFailure.status })\n    }\n\n    // Assign the PK up front so it is available before flush (MikroORM does not\n    // generate UUIDs client-side).\n    const published = em.create(WorkflowDefinition, {\n      id: randomUUID(),\n      workflowId: source.workflowId,\n      codeWorkflowId: source.codeWorkflowId ?? null,\n      workflowName: source.workflowName,\n      description: source.description ?? null,\n      version: nextVersion,\n      definition: source.definition,\n      metadata: source.metadata ?? null,\n      enabled: true,\n      kind: source.kind,\n      lifecycle: 'published',\n      grantedFeatures: grantedFeatures.length ? grantedFeatures : null,\n      tenantId,\n      organizationId,\n      createdBy: auth.sub,\n      updatedBy: auth.sub,\n      createdAt: new Date(),\n      updatedAt: new Date(),\n    })\n    await syncWorkflowDefinitionPrincipal(container, published)\n    em.persist(published)\n    await em.flush()\n\n    if (guardResult?.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId,\n        organizationId,\n        userId: auth.sub ?? '',\n        resourceKind: 'workflows.definition',\n        resourceId: String(published.id),\n        operation: 'custom',\n        requestMethod: 'POST',\n        requestHeaders: request.headers,\n        metadata: guardResult.metadata,\n      })\n    }\n\n    try {\n      const eventBus = container.resolve('eventBus') as\n        | { emitEvent(event: string, payload: unknown, options?: unknown): Promise<void> }\n        | undefined\n      if (eventBus && typeof eventBus.emitEvent === 'function') {\n        await eventBus.emitEvent(\n          'workflows.definition.published',\n          {\n            id: published.id,\n            workflowId: published.workflowId,\n            version: published.version,\n            tenantId: published.tenantId,\n            organizationId: published.organizationId,\n            userId: auth.sub ?? null,\n          },\n          { tenantId: published.tenantId, organizationId: published.organizationId, persistent: true },\n        )\n      }\n    } catch (eventError) {\n      logger.error('failed to emit workflows.definition.published event', {\n        error: eventError instanceof Error ? eventError.message : String(eventError),\n      })\n    }\n\n    return NextResponse.json({\n      data: serializeWorkflowDefinition(published),\n      breakingChanges,\n      message: 'Workflow definition published successfully',\n    })\n  } catch (error) {\n    logger.error('error publishing workflow definition', {\n      error: error instanceof Error ? error.message : String(error),\n    })\n    return NextResponse.json({ error: 'Failed to publish workflow definition' }, { status: 500 })\n  }\n}\n\nexport const openApi = {\n  methods: {\n    POST: {\n      summary: 'Publish a new workflow definition version',\n      description:\n        'Mints a frozen published version snapshotting the definition and its IO port contract. Returns affected sub-workflow callers; pass acknowledgeBreakingChanges=true to publish despite breaking changes.',\n      tags: ['Workflows'],\n      pathParams: z.object({ id: z.string().describe('Workflow definition id') }),\n      requestBody: publishInputSchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Published',\n          example: {\n            data: { id: '\u2026', workflowId: 'verify-policy', version: 2, lifecycle: 'published' },\n            breakingChanges: [],\n            message: 'Workflow definition published successfully',\n          },\n        },\n        {\n          status: 409,\n          description: 'Breaking changes not acknowledged',\n          example: {\n            error: 'Publishing would break existing sub-workflow mappings',\n            breakingChanges: [{ workflowId: 'order-flow', version: 1, stepId: 'sub', brokenMappings: ['input:orderId'] }],\n          },\n        },\n        { status: 404, description: 'Not found', example: { error: 'Workflow definition not found' } },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAYA,SAAS,kBAAkB;AAC3B,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,2BAA2B,wCAAwC;AAC5E,SAAS,0BAA0B;AAEnC,SAAS,oBAAoB;AAC7B,SAAS,mCAAmC;AAC5C,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,WAAW,EAAE,MAAM,EAAE,WAAW,yBAAyB,CAAC;AAE/E,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,+BAA+B;AACnD;AAEA,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,4BAA4B,EAAE,QAAQ,EAAE,SAAS;AACnD,CAAC;AAMD,eAAsB,KAAK,SAAsB,SAAuB;AACtE,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ;AAC7B,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,cAAc,KAAK;AAEjD,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,aAAO,aAAa,KAAK,EAAE,OAAO,yCAAyC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/F;AAEA,UAAM,OAAO,MAAM,QAAQ,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAClD,UAAM,SAAS,mBAAmB,UAAU,IAAI;AAChD,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,OAAO,MAAM,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxG;AAEA,UAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,MAC7D;AAAA,MACA;AAAA,MACA,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,WAAW;AAAA,MACX,eAAe;AAAA,MACf,gBAAgB,QAAQ;AAAA,IAC1B,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,UAAM,SAAS,MAAM,GAAG,QAAQ,oBAAoB;AAAA,MAClD,IAAI,OAAO;AAAA,MACX;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,QAAQ;AACX,aAAO,aAAa,KAAK,EAAE,OAAO,gCAAgC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACtF;AAIA,UAAM,QAA6B,OAAO,YAA4C,MAAM,CAAC;AAC7F,UAAM,kBAAkB,MAAM,uBAAuB,IAAI;AAAA,MACvD,eAAe,OAAO;AAAA,MACtB;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAED,QAAI,gBAAgB,SAAS,KAAK,CAAC,OAAO,KAAK,4BAA4B;AACzE,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO;AAAA,UACP;AAAA,QACF;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAGA,UAAM,SAAS,MAAM,GAAG;AAAA,MACtB;AAAA,MACA,EAAE,YAAY,OAAO,YAAY,SAAS;AAAA,MAC1C,EAAE,SAAS,EAAE,SAAS,OAAO,EAAE;AAAA,IACjC;AACA,UAAM,eAAe,QAAQ,WAAW,OAAO,WAAW;AAO1D,UAAM,kBAAkB,yBAAyB,OAAO,eAAe;AACvE,UAAM,eAAe,MAAM;AAAA,MACzB,UAAU,QAAQ,aAAa;AAAA,MAC/B;AAAA,QACE,QAAQ,KAAK;AAAA,QACb,OAAO,EAAE,UAAU,eAAe;AAAA,QAClC,WAAW;AAAA,QACX,SAAS,CAAC;AAAA,MACZ;AAAA,IACF;AACA,QAAI,cAAc;AAChB,aAAO,aAAa,KAAK,aAAa,MAAM,EAAE,QAAQ,aAAa,OAAO,CAAC;AAAA,IAC7E;AAIA,UAAM,YAAY,GAAG,OAAO,oBAAoB;AAAA,MAC9C,IAAI,WAAW;AAAA,MACf,YAAY,OAAO;AAAA,MACnB,gBAAgB,OAAO,kBAAkB;AAAA,MACzC,cAAc,OAAO;AAAA,MACrB,aAAa,OAAO,eAAe;AAAA,MACnC,SAAS;AAAA,MACT,YAAY,OAAO;AAAA,MACnB,UAAU,OAAO,YAAY;AAAA,MAC7B,SAAS;AAAA,MACT,MAAM,OAAO;AAAA,MACb,WAAW;AAAA,MACX,iBAAiB,gBAAgB,SAAS,kBAAkB;AAAA,MAC5D;AAAA,MACA;AAAA,MACA,WAAW,KAAK;AAAA,MAChB,WAAW,KAAK;AAAA,MAChB,WAAW,oBAAI,KAAK;AAAA,MACpB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AACD,UAAM,gCAAgC,WAAW,SAAS;AAC1D,OAAG,QAAQ,SAAS;AACpB,UAAM,GAAG,MAAM;AAEf,QAAI,aAAa,uBAAuB;AACtC,YAAM,iCAAiC,WAAW;AAAA,QAChD;AAAA,QACA;AAAA,QACA,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc;AAAA,QACd,YAAY,OAAO,UAAU,EAAE;AAAA,QAC/B,WAAW;AAAA,QACX,eAAe;AAAA,QACf,gBAAgB,QAAQ;AAAA,QACxB,UAAU,YAAY;AAAA,MACxB,CAAC;AAAA,IACH;AAEA,QAAI;AACF,YAAM,WAAW,UAAU,QAAQ,UAAU;AAG7C,UAAI,YAAY,OAAO,SAAS,cAAc,YAAY;AACxD,cAAM,SAAS;AAAA,UACb;AAAA,UACA;AAAA,YACE,IAAI,UAAU;AAAA,YACd,YAAY,UAAU;AAAA,YACtB,SAAS,UAAU;AAAA,YACnB,UAAU,UAAU;AAAA,YACpB,gBAAgB,UAAU;AAAA,YAC1B,QAAQ,KAAK,OAAO;AAAA,UACtB;AAAA,UACA,EAAE,UAAU,UAAU,UAAU,gBAAgB,UAAU,gBAAgB,YAAY,KAAK;AAAA,QAC7F;AAAA,MACF;AAAA,IACF,SAAS,YAAY;AACnB,aAAO,MAAM,uDAAuD;AAAA,QAClE,OAAO,sBAAsB,QAAQ,WAAW,UAAU,OAAO,UAAU;AAAA,MAC7E,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,MAAM,4BAA4B,SAAS;AAAA,MAC3C;AAAA,MACA,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,wCAAwC;AAAA,MACnD,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAC9D,CAAC;AACD,WAAO,aAAa,KAAK,EAAE,OAAO,wCAAwC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9F;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,MAAM,CAAC,WAAW;AAAA,MAClB,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,wBAAwB,EAAE,CAAC;AAAA,MAC1E,aAAa;AAAA,MACb,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,SAAS;AAAA,YACP,MAAM,EAAE,IAAI,UAAK,YAAY,iBAAiB,SAAS,GAAG,WAAW,YAAY;AAAA,YACjF,iBAAiB,CAAC;AAAA,YAClB,SAAS;AAAA,UACX;AAAA,QACF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,SAAS;AAAA,YACP,OAAO;AAAA,YACP,iBAAiB,CAAC,EAAE,YAAY,cAAc,SAAS,GAAG,QAAQ,OAAO,gBAAgB,CAAC,eAAe,EAAE,CAAC;AAAA,UAC9G;AAAA,QACF;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,aAAa,SAAS,EAAE,OAAO,gCAAgC,EAAE;AAAA,MAC/F;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/workflows/api/definitions/[id]/reset-to-code/route.js

@@ -6,6 +6,7 @@ import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/d
 import { validateCrudMutationGuard, runCrudMutationGuardAfterSuccess } from "@open-mercato/shared/lib/crud/mutation-guard";
 import { WorkflowDefinition, WorkflowInstance } from "../../../../data/entities.js";
 import { serializeCodeWorkflowDefinition } from "../../serialize.js";
+import { workflowDefinitionResetResponseSchema, workflowErrorSchema } from "../../../openapi.js";
 import { getCodeWorkflow } from "../../../../lib/code-registry.js";
 import { invalidateTriggerCache } from "../../../../lib/event-trigger-service.js";
 import { createLogger } from "@open-mercato/shared/lib/logger";
@@ -165,6 +166,7 @@ const openApi = {
         {
           status: 200,
           description: "Workflow definition reset to code version",
+          schema: workflowDefinitionResetResponseSchema,
           example: {
             data: {
               id: "code:checkout-flow",
@@ -181,6 +183,7 @@ const openApi = {
         {
           status: 400,
           description: "Definition is not a code-based override",
+          schema: workflowErrorSchema,
           example: {
             error: "This workflow definition is not a code-based override and cannot be reset"
           }
@@ -188,6 +191,7 @@ const openApi = {
         {
           status: 404,
           description: "Workflow definition not found",
+          schema: workflowErrorSchema,
           example: {
             error: "Workflow definition not found"
           }
@@ -195,6 +199,7 @@ const openApi = {
         {
           status: 409,
           description: "Cannot reset - active workflow instances exist",
+          schema: workflowErrorSchema,
           example: {
             error: "Cannot reset workflow definition with 3 active instance(s)"
           }

package/dist/modules/workflows/api/definitions/[id]/reset-to-code/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/workflows/api/definitions/%5Bid%5D/reset-to-code/route.ts"],
-  "sourcesContent": ["/**\n * Reset Customized Workflow Definition to Code\n *\n * POST /api/workflows/definitions/[id]/reset-to-code\n *\n * Deletes the DB override row for a code-based workflow definition,\n * reverting it back to the original code registry version.\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { validateCrudMutationGuard, runCrudMutationGuardAfterSuccess } from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { WorkflowDefinition, WorkflowInstance } from '../../../../data/entities'\nimport { serializeCodeWorkflowDefinition } from '../../serialize'\nimport { getCodeWorkflow } from '../../../../lib/code-registry'\nimport { invalidateTriggerCache } from '../../../../lib/event-trigger-service'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.edit'],\n}\n\ninterface RouteContext {\n  params: Promise<{\n    id: string\n  }>\n}\n\n/**\n * POST /api/workflows/definitions/[id]/reset-to-code\n *\n * Reset a customized code workflow definition back to its original code version.\n */\nexport async function POST(\n  request: NextRequest,\n  context: RouteContext\n) {\n  try {\n    const params = await context.params\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = scope?.selectedId ?? auth.orgId\n\n    // Check edit permission\n    const rbacService = container.resolve('rbacService')\n    const hasPermission = await rbacService.userHasAllFeatures(\n      auth.sub,\n      ['workflows.definitions.edit'],\n      {\n        tenantId,\n        organizationId,\n      }\n    )\n\n    if (!hasPermission) {\n      return NextResponse.json(\n        { error: 'Insufficient permissions' },\n        { status: 403 }\n      )\n    }\n\n    // Find existing definition\n    const definition = await em.findOne(WorkflowDefinition, {\n      id: params.id,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })\n\n    if (!definition) {\n      return NextResponse.json(\n        { error: 'Workflow definition not found' },\n        { status: 404 }\n      )\n    }\n\n    // Verify this is a code-based override\n    if (!definition.codeWorkflowId) {\n      return NextResponse.json(\n        { error: 'This workflow definition is not a code-based override and cannot be reset' },\n        { status: 400 }\n      )\n    }\n\n    // Check if there are active workflow instances using this definition\n    const activeInstances = await em.count(WorkflowInstance, {\n      definitionId: definition.id,\n      status: { $in: ['RUNNING', 'WAITING'] },\n    })\n\n    if (activeInstances > 0) {\n      return NextResponse.json(\n        {\n          error: `Cannot reset workflow definition with ${activeInstances} active instance(s)`,\n        },\n        { status: 409 }\n      )\n    }\n\n    const guardResult = await validateCrudMutationGuard(container, {\n      tenantId: tenantId ?? '',\n      organizationId: organizationId ?? null,\n      userId: auth.sub ?? '',\n      resourceKind: 'workflows.definition',\n      resourceId: String(definition.id),\n      operation: 'custom',\n      requestMethod: 'POST',\n      requestHeaders: request.headers,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    // Look up the original code definition before deleting\n    const codeDef = getCodeWorkflow(definition.codeWorkflowId)\n\n    // Snapshot identifying fields before remove() detaches the entity\n    const removedSnapshot = {\n      id: String(definition.id),\n      workflowId: definition.workflowId,\n      codeWorkflowId: definition.codeWorkflowId,\n      tenantId: definition.tenantId,\n      organizationId: definition.organizationId,\n    }\n\n    // Hard-delete the DB override row\n    em.remove(definition)\n    await em.flush()\n\n    // Trigger ownership falls back to the code registry, so the cached snapshot\n    // still holds the embedded triggers of a row that no longer exists (#4425).\n    if (removedSnapshot.tenantId) {\n      invalidateTriggerCache(removedSnapshot.tenantId, removedSnapshot.organizationId ?? undefined)\n    }\n\n    if (guardResult?.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId: tenantId ?? '',\n        organizationId: organizationId ?? null,\n        userId: auth.sub ?? '',\n        resourceKind: 'workflows.definition',\n        resourceId: removedSnapshot.id,\n        operation: 'custom',\n        requestMethod: 'POST',\n        requestHeaders: request.headers,\n        metadata: guardResult.metadata,\n      })\n    }\n\n    try {\n      const eventBus = container.resolve('eventBus') as\n        | { emitEvent(event: string, payload: unknown, options?: unknown): Promise<void> }\n        | undefined\n      if (eventBus && typeof eventBus.emitEvent === 'function') {\n        await eventBus.emitEvent(\n          'workflows.definition.reset_to_code',\n          {\n            id: removedSnapshot.id,\n            workflowId: removedSnapshot.workflowId,\n            codeWorkflowId: removedSnapshot.codeWorkflowId,\n            tenantId: removedSnapshot.tenantId,\n            organizationId: removedSnapshot.organizationId,\n            userId: auth.sub ?? null,\n          },\n          {\n            tenantId: removedSnapshot.tenantId,\n            organizationId: removedSnapshot.organizationId,\n            persistent: true,\n          },\n        )\n      }\n    } catch (eventError) {\n      logger.error('Failed to emit workflows.definition.reset_to_code event', { err: eventError })\n    }\n\n    if (!codeDef) {\n      return NextResponse.json({\n        message: 'Workflow definition reset to code version (code definition no longer registered)',\n        data: null,\n      })\n    }\n\n    const syntheticId = `code:${codeDef.workflowId}`\n\n    return NextResponse.json({\n      data: serializeCodeWorkflowDefinition(codeDef, syntheticId),\n      message: 'Workflow definition reset to code version',\n    })\n  } catch (error) {\n    logger.error('Error resetting workflow definition to code', { err: error })\n    return NextResponse.json(\n      { error: 'Failed to reset workflow definition to code' },\n      { status: 500 }\n    )\n  }\n}\n\nexport const openApi = {\n  methods: {\n    POST: {\n      summary: 'Reset workflow definition to code version',\n      description: 'Deletes the DB override for a code-based workflow definition, reverting it to the original code registry version. Cannot be reset if there are active instances.',\n      tags: ['Workflows'],\n      pathParams: z.object({\n        id: z.string().uuid(),\n      }),\n      responses: [\n        {\n          status: 200,\n          description: 'Workflow definition reset to code version',\n          example: {\n            data: {\n              id: 'code:checkout-flow',\n              workflowId: 'checkout-flow',\n              workflowName: 'Checkout Flow',\n              description: 'Code-defined checkout workflow',\n              version: 1,\n              source: 'code',\n              isCodeBased: true,\n            },\n            message: 'Workflow definition reset to code version',\n          },\n        },\n        {\n          status: 400,\n          description: 'Definition is not a code-based override',\n          example: {\n            error: 'This workflow definition is not a code-based override and cannot be reset',\n          },\n        },\n        {\n          status: 404,\n          description: 'Workflow definition not found',\n          example: {\n            error: 'Workflow definition not found',\n          },\n        },\n        {\n          status: 409,\n          description: 'Cannot reset - active workflow instances exist',\n          example: {\n            error: 'Cannot reset workflow definition with 3 active instance(s)',\n          },\n        },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AASA,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,2BAA2B,wCAAwC;AAC5E,SAAS,oBAAoB,wBAAwB;AACrD,SAAS,uCAAuC;AAChD,SAAS,uBAAuB;AAChC,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,4BAA4B;AAChD;AAaA,eAAsB,KACpB,SACA,SACA;AACA,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ;AAC7B,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,cAAc,KAAK;AAGjD,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,UAAM,gBAAgB,MAAM,YAAY;AAAA,MACtC,KAAK;AAAA,MACL,CAAC,4BAA4B;AAAA,MAC7B;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,2BAA2B;AAAA,QACpC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAGA,UAAM,aAAa,MAAM,GAAG,QAAQ,oBAAoB;AAAA,MACtD,IAAI,OAAO;AAAA,MACX;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AAED,QAAI,CAAC,YAAY;AACf,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,gCAAgC;AAAA,QACzC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAGA,QAAI,CAAC,WAAW,gBAAgB;AAC9B,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,4EAA4E;AAAA,QACrF,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAGA,UAAM,kBAAkB,MAAM,GAAG,MAAM,kBAAkB;AAAA,MACvD,cAAc,WAAW;AAAA,MACzB,QAAQ,EAAE,KAAK,CAAC,WAAW,SAAS,EAAE;AAAA,IACxC,CAAC;AAED,QAAI,kBAAkB,GAAG;AACvB,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO,yCAAyC,eAAe;AAAA,QACjE;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,MAC7D,UAAU,YAAY;AAAA,MACtB,gBAAgB,kBAAkB;AAAA,MAClC,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY,OAAO,WAAW,EAAE;AAAA,MAChC,WAAW;AAAA,MACX,eAAe;AAAA,MACf,gBAAgB,QAAQ;AAAA,IAC1B,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAGA,UAAM,UAAU,gBAAgB,WAAW,cAAc;AAGzD,UAAM,kBAAkB;AAAA,MACtB,IAAI,OAAO,WAAW,EAAE;AAAA,MACxB,YAAY,WAAW;AAAA,MACvB,gBAAgB,WAAW;AAAA,MAC3B,UAAU,WAAW;AAAA,MACrB,gBAAgB,WAAW;AAAA,IAC7B;AAGA,OAAG,OAAO,UAAU;AACpB,UAAM,GAAG,MAAM;AAIf,QAAI,gBAAgB,UAAU;AAC5B,6BAAuB,gBAAgB,UAAU,gBAAgB,kBAAkB,MAAS;AAAA,IAC9F;AAEA,QAAI,aAAa,uBAAuB;AACtC,YAAM,iCAAiC,WAAW;AAAA,QAChD,UAAU,YAAY;AAAA,QACtB,gBAAgB,kBAAkB;AAAA,QAClC,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc;AAAA,QACd,YAAY,gBAAgB;AAAA,QAC5B,WAAW;AAAA,QACX,eAAe;AAAA,QACf,gBAAgB,QAAQ;AAAA,QACxB,UAAU,YAAY;AAAA,MACxB,CAAC;AAAA,IACH;AAEA,QAAI;AACF,YAAM,WAAW,UAAU,QAAQ,UAAU;AAG7C,UAAI,YAAY,OAAO,SAAS,cAAc,YAAY;AACxD,cAAM,SAAS;AAAA,UACb;AAAA,UACA;AAAA,YACE,IAAI,gBAAgB;AAAA,YACpB,YAAY,gBAAgB;AAAA,YAC5B,gBAAgB,gBAAgB;AAAA,YAChC,UAAU,gBAAgB;AAAA,YAC1B,gBAAgB,gBAAgB;AAAA,YAChC,QAAQ,KAAK,OAAO;AAAA,UACtB;AAAA,UACA;AAAA,YACE,UAAU,gBAAgB;AAAA,YAC1B,gBAAgB,gBAAgB;AAAA,YAChC,YAAY;AAAA,UACd;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,YAAY;AACnB,aAAO,MAAM,2DAA2D,EAAE,KAAK,WAAW,CAAC;AAAA,IAC7F;AAEA,QAAI,CAAC,SAAS;AACZ,aAAO,aAAa,KAAK;AAAA,QACvB,SAAS;AAAA,QACT,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAEA,UAAM,cAAc,QAAQ,QAAQ,UAAU;AAE9C,WAAO,aAAa,KAAK;AAAA,MACvB,MAAM,gCAAgC,SAAS,WAAW;AAAA,MAC1D,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,+CAA+C,EAAE,KAAK,MAAM,CAAC;AAC1E,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,8CAA8C;AAAA,MACvD,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,MAAM,CAAC,WAAW;AAAA,MAClB,YAAY,EAAE,OAAO;AAAA,QACnB,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,MACtB,CAAC;AAAA,MACD,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,SAAS;AAAA,YACP,MAAM;AAAA,cACJ,IAAI;AAAA,cACJ,YAAY;AAAA,cACZ,cAAc;AAAA,cACd,aAAa;AAAA,cACb,SAAS;AAAA,cACT,QAAQ;AAAA,cACR,aAAa;AAAA,YACf;AAAA,YACA,SAAS;AAAA,UACX;AAAA,QACF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,SAAS;AAAA,YACP,OAAO;AAAA,UACT;AAAA,QACF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,SAAS;AAAA,YACP,OAAO;AAAA,UACT;AAAA,QACF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,SAAS;AAAA,YACP,OAAO;AAAA,UACT;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * Reset Customized Workflow Definition to Code\n *\n * POST /api/workflows/definitions/[id]/reset-to-code\n *\n * Deletes the DB override row for a code-based workflow definition,\n * reverting it back to the original code registry version.\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { validateCrudMutationGuard, runCrudMutationGuardAfterSuccess } from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { WorkflowDefinition, WorkflowInstance } from '../../../../data/entities'\nimport { serializeCodeWorkflowDefinition } from '../../serialize'\nimport { workflowDefinitionResetResponseSchema, workflowErrorSchema } from '../../../openapi'\nimport { getCodeWorkflow } from '../../../../lib/code-registry'\nimport { invalidateTriggerCache } from '../../../../lib/event-trigger-service'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.edit'],\n}\n\ninterface RouteContext {\n  params: Promise<{\n    id: string\n  }>\n}\n\n/**\n * POST /api/workflows/definitions/[id]/reset-to-code\n *\n * Reset a customized code workflow definition back to its original code version.\n */\nexport async function POST(\n  request: NextRequest,\n  context: RouteContext\n) {\n  try {\n    const params = await context.params\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = scope?.selectedId ?? auth.orgId\n\n    // Check edit permission\n    const rbacService = container.resolve('rbacService')\n    const hasPermission = await rbacService.userHasAllFeatures(\n      auth.sub,\n      ['workflows.definitions.edit'],\n      {\n        tenantId,\n        organizationId,\n      }\n    )\n\n    if (!hasPermission) {\n      return NextResponse.json(\n        { error: 'Insufficient permissions' },\n        { status: 403 }\n      )\n    }\n\n    // Find existing definition\n    const definition = await em.findOne(WorkflowDefinition, {\n      id: params.id,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })\n\n    if (!definition) {\n      return NextResponse.json(\n        { error: 'Workflow definition not found' },\n        { status: 404 }\n      )\n    }\n\n    // Verify this is a code-based override\n    if (!definition.codeWorkflowId) {\n      return NextResponse.json(\n        { error: 'This workflow definition is not a code-based override and cannot be reset' },\n        { status: 400 }\n      )\n    }\n\n    // Check if there are active workflow instances using this definition\n    const activeInstances = await em.count(WorkflowInstance, {\n      definitionId: definition.id,\n      status: { $in: ['RUNNING', 'WAITING'] },\n    })\n\n    if (activeInstances > 0) {\n      return NextResponse.json(\n        {\n          error: `Cannot reset workflow definition with ${activeInstances} active instance(s)`,\n        },\n        { status: 409 }\n      )\n    }\n\n    const guardResult = await validateCrudMutationGuard(container, {\n      tenantId: tenantId ?? '',\n      organizationId: organizationId ?? null,\n      userId: auth.sub ?? '',\n      resourceKind: 'workflows.definition',\n      resourceId: String(definition.id),\n      operation: 'custom',\n      requestMethod: 'POST',\n      requestHeaders: request.headers,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    // Look up the original code definition before deleting\n    const codeDef = getCodeWorkflow(definition.codeWorkflowId)\n\n    // Snapshot identifying fields before remove() detaches the entity\n    const removedSnapshot = {\n      id: String(definition.id),\n      workflowId: definition.workflowId,\n      codeWorkflowId: definition.codeWorkflowId,\n      tenantId: definition.tenantId,\n      organizationId: definition.organizationId,\n    }\n\n    // Hard-delete the DB override row\n    em.remove(definition)\n    await em.flush()\n\n    // Trigger ownership falls back to the code registry, so the cached snapshot\n    // still holds the embedded triggers of a row that no longer exists (#4425).\n    if (removedSnapshot.tenantId) {\n      invalidateTriggerCache(removedSnapshot.tenantId, removedSnapshot.organizationId ?? undefined)\n    }\n\n    if (guardResult?.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId: tenantId ?? '',\n        organizationId: organizationId ?? null,\n        userId: auth.sub ?? '',\n        resourceKind: 'workflows.definition',\n        resourceId: removedSnapshot.id,\n        operation: 'custom',\n        requestMethod: 'POST',\n        requestHeaders: request.headers,\n        metadata: guardResult.metadata,\n      })\n    }\n\n    try {\n      const eventBus = container.resolve('eventBus') as\n        | { emitEvent(event: string, payload: unknown, options?: unknown): Promise<void> }\n        | undefined\n      if (eventBus && typeof eventBus.emitEvent === 'function') {\n        await eventBus.emitEvent(\n          'workflows.definition.reset_to_code',\n          {\n            id: removedSnapshot.id,\n            workflowId: removedSnapshot.workflowId,\n            codeWorkflowId: removedSnapshot.codeWorkflowId,\n            tenantId: removedSnapshot.tenantId,\n            organizationId: removedSnapshot.organizationId,\n            userId: auth.sub ?? null,\n          },\n          {\n            tenantId: removedSnapshot.tenantId,\n            organizationId: removedSnapshot.organizationId,\n            persistent: true,\n          },\n        )\n      }\n    } catch (eventError) {\n      logger.error('Failed to emit workflows.definition.reset_to_code event', { err: eventError })\n    }\n\n    if (!codeDef) {\n      return NextResponse.json({\n        message: 'Workflow definition reset to code version (code definition no longer registered)',\n        data: null,\n      })\n    }\n\n    const syntheticId = `code:${codeDef.workflowId}`\n\n    return NextResponse.json({\n      data: serializeCodeWorkflowDefinition(codeDef, syntheticId),\n      message: 'Workflow definition reset to code version',\n    })\n  } catch (error) {\n    logger.error('Error resetting workflow definition to code', { err: error })\n    return NextResponse.json(\n      { error: 'Failed to reset workflow definition to code' },\n      { status: 500 }\n    )\n  }\n}\n\nexport const openApi = {\n  methods: {\n    POST: {\n      summary: 'Reset workflow definition to code version',\n      description: 'Deletes the DB override for a code-based workflow definition, reverting it to the original code registry version. Cannot be reset if there are active instances.',\n      tags: ['Workflows'],\n      pathParams: z.object({\n        id: z.string().uuid(),\n      }),\n      responses: [\n        {\n          status: 200,\n          description: 'Workflow definition reset to code version',\n          schema: workflowDefinitionResetResponseSchema,\n          example: {\n            data: {\n              id: 'code:checkout-flow',\n              workflowId: 'checkout-flow',\n              workflowName: 'Checkout Flow',\n              description: 'Code-defined checkout workflow',\n              version: 1,\n              source: 'code',\n              isCodeBased: true,\n            },\n            message: 'Workflow definition reset to code version',\n          },\n        },\n        {\n          status: 400,\n          description: 'Definition is not a code-based override',\n          schema: workflowErrorSchema,\n          example: {\n            error: 'This workflow definition is not a code-based override and cannot be reset',\n          },\n        },\n        {\n          status: 404,\n          description: 'Workflow definition not found',\n          schema: workflowErrorSchema,\n          example: {\n            error: 'Workflow definition not found',\n          },\n        },\n        {\n          status: 409,\n          description: 'Cannot reset - active workflow instances exist',\n          schema: workflowErrorSchema,\n          example: {\n            error: 'Cannot reset workflow definition with 3 active instance(s)',\n          },\n        },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AASA,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,2BAA2B,wCAAwC;AAC5E,SAAS,oBAAoB,wBAAwB;AACrD,SAAS,uCAAuC;AAChD,SAAS,uCAAuC,2BAA2B;AAC3E,SAAS,uBAAuB;AAChC,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,4BAA4B;AAChD;AAaA,eAAsB,KACpB,SACA,SACA;AACA,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ;AAC7B,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,cAAc,KAAK;AAGjD,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,UAAM,gBAAgB,MAAM,YAAY;AAAA,MACtC,KAAK;AAAA,MACL,CAAC,4BAA4B;AAAA,MAC7B;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,2BAA2B;AAAA,QACpC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAGA,UAAM,aAAa,MAAM,GAAG,QAAQ,oBAAoB;AAAA,MACtD,IAAI,OAAO;AAAA,MACX;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AAED,QAAI,CAAC,YAAY;AACf,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,gCAAgC;AAAA,QACzC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAGA,QAAI,CAAC,WAAW,gBAAgB;AAC9B,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,4EAA4E;AAAA,QACrF,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAGA,UAAM,kBAAkB,MAAM,GAAG,MAAM,kBAAkB;AAAA,MACvD,cAAc,WAAW;AAAA,MACzB,QAAQ,EAAE,KAAK,CAAC,WAAW,SAAS,EAAE;AAAA,IACxC,CAAC;AAED,QAAI,kBAAkB,GAAG;AACvB,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO,yCAAyC,eAAe;AAAA,QACjE;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,MAC7D,UAAU,YAAY;AAAA,MACtB,gBAAgB,kBAAkB;AAAA,MAClC,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY,OAAO,WAAW,EAAE;AAAA,MAChC,WAAW;AAAA,MACX,eAAe;AAAA,MACf,gBAAgB,QAAQ;AAAA,IAC1B,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAGA,UAAM,UAAU,gBAAgB,WAAW,cAAc;AAGzD,UAAM,kBAAkB;AAAA,MACtB,IAAI,OAAO,WAAW,EAAE;AAAA,MACxB,YAAY,WAAW;AAAA,MACvB,gBAAgB,WAAW;AAAA,MAC3B,UAAU,WAAW;AAAA,MACrB,gBAAgB,WAAW;AAAA,IAC7B;AAGA,OAAG,OAAO,UAAU;AACpB,UAAM,GAAG,MAAM;AAIf,QAAI,gBAAgB,UAAU;AAC5B,6BAAuB,gBAAgB,UAAU,gBAAgB,kBAAkB,MAAS;AAAA,IAC9F;AAEA,QAAI,aAAa,uBAAuB;AACtC,YAAM,iCAAiC,WAAW;AAAA,QAChD,UAAU,YAAY;AAAA,QACtB,gBAAgB,kBAAkB;AAAA,QAClC,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc;AAAA,QACd,YAAY,gBAAgB;AAAA,QAC5B,WAAW;AAAA,QACX,eAAe;AAAA,QACf,gBAAgB,QAAQ;AAAA,QACxB,UAAU,YAAY;AAAA,MACxB,CAAC;AAAA,IACH;AAEA,QAAI;AACF,YAAM,WAAW,UAAU,QAAQ,UAAU;AAG7C,UAAI,YAAY,OAAO,SAAS,cAAc,YAAY;AACxD,cAAM,SAAS;AAAA,UACb;AAAA,UACA;AAAA,YACE,IAAI,gBAAgB;AAAA,YACpB,YAAY,gBAAgB;AAAA,YAC5B,gBAAgB,gBAAgB;AAAA,YAChC,UAAU,gBAAgB;AAAA,YAC1B,gBAAgB,gBAAgB;AAAA,YAChC,QAAQ,KAAK,OAAO;AAAA,UACtB;AAAA,UACA;AAAA,YACE,UAAU,gBAAgB;AAAA,YAC1B,gBAAgB,gBAAgB;AAAA,YAChC,YAAY;AAAA,UACd;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,YAAY;AACnB,aAAO,MAAM,2DAA2D,EAAE,KAAK,WAAW,CAAC;AAAA,IAC7F;AAEA,QAAI,CAAC,SAAS;AACZ,aAAO,aAAa,KAAK;AAAA,QACvB,SAAS;AAAA,QACT,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAEA,UAAM,cAAc,QAAQ,QAAQ,UAAU;AAE9C,WAAO,aAAa,KAAK;AAAA,MACvB,MAAM,gCAAgC,SAAS,WAAW;AAAA,MAC1D,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,+CAA+C,EAAE,KAAK,MAAM,CAAC;AAC1E,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,8CAA8C;AAAA,MACvD,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,MAAM,CAAC,WAAW;AAAA,MAClB,YAAY,EAAE,OAAO;AAAA,QACnB,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,MACtB,CAAC;AAAA,MACD,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,MAAM;AAAA,cACJ,IAAI;AAAA,cACJ,YAAY;AAAA,cACZ,cAAc;AAAA,cACd,aAAa;AAAA,cACb,SAAS;AAAA,cACT,QAAQ;AAAA,cACR,aAAa;AAAA,YACf;AAAA,YACA,SAAS;AAAA,UACX;AAAA,QACF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,OAAO;AAAA,UACT;AAAA,QACF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,OAAO;AAAA,UACT;AAAA,QACF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,OAAO;AAAA,UACT;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/workflows/api/definitions/[id]/route.js

@@ -4,14 +4,32 @@ import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
 import { resolveOrganizationScopeFilter } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
-import { WorkflowDefinition } from "../../../data/entities.js";
+import { WorkflowDefinition, WorkflowInstance } from "../../../data/entities.js";
 import {
-  updateWorkflowDefinitionInputSchema
+  updateWorkflowDefinitionInputSchema,
+  updateWorkflowDefinitionInputCheckedSchema
 } from "../../../data/validators.js";
 import { serializeWorkflowDefinition, serializeCodeWorkflowDefinition } from "../serialize.js";
+import {
+  workflowDefinitionDetailResponseSchema,
+  workflowDefinitionMutationResponseSchema,
+  workflowDefinitionDeleteResponseSchema,
+  workflowErrorSchema
+} from "../../openapi.js";
 import { invalidateTriggerCache } from "../../../lib/event-trigger-service.js";
+import { normalizeDefinitionValidationIssues } from "../../../lib/definition-error-body.js";
 import { getCodeWorkflow, getAllCodeWorkflows } from "../../../lib/code-registry.js";
 import { codeWorkflowUuid } from "../../../lib/find-definition.js";
+import {
+  ACTIVE_WORKFLOW_INSTANCE_STATUSES,
+  buildStructuralEditConflictBody,
+  diffDefinitionStructure
+} from "../../../lib/definition-edit-safety.js";
+import {
+  authorizeWorkflowGrantChange,
+  normalizeGrantedFeatures,
+  syncWorkflowDefinitionPrincipal
+} from "../../../lib/definition-grant.js";
 import { createGenericOptimisticLockReader } from "@open-mercato/shared/lib/crud/optimistic-lock";
 import { registerOptimisticLockReaderIfAbsent } from "@open-mercato/shared/lib/crud/optimistic-lock-store";
 import { validateCrudMutationGuard, runCrudMutationGuardAfterSuccess } from "@open-mercato/shared/lib/crud/mutation-guard";
@@ -114,12 +132,12 @@ async function PUT(request, context) {
       );
     }
     const body = await request.json();
-    const validation = updateWorkflowDefinitionInputSchema.safeParse(body);
+    const validation = updateWorkflowDefinitionInputCheckedSchema.safeParse(body);
     if (!validation.success) {
       return NextResponse.json(
         {
           error: "Validation failed",
-          details: validation.error.issues
+          details: normalizeDefinitionValidationIssues(validation.error)
         },
         { status: 400 }
       );
@@ -151,7 +169,7 @@ async function PUT(request, context) {
       const existingOverride = await em.findOne(WorkflowDefinition, {
         workflowId: codeDef.workflowId,
         tenantId
-      });
+      }, { orderBy: { version: "DESC" } });
       let savedOverride;
       if (existingOverride) {
         try {
@@ -262,6 +280,28 @@ async function PUT(request, context) {
       }
       throw lockError;
     }
+    if (input.definition !== void 0) {
+      const structuralChanges = diffDefinitionStructure(definition.definition, input.definition);
+      if (structuralChanges.length > 0) {
+        const activeInstanceCount = await em.count(WorkflowInstance, {
+          definitionId: definition.id,
+          status: { $in: [...ACTIVE_WORKFLOW_INSTANCE_STATUSES] },
+          tenantId,
+          organizationId,
+          deletedAt: null
+        });
+        if (activeInstanceCount > 0) {
+          return NextResponse.json(
+            buildStructuralEditConflictBody({
+              definitionId: definition.id,
+              activeInstanceCount,
+              changes: structuralChanges
+            }),
+            { status: 409 }
+          );
+        }
+      }
+    }
     if (input.workflowName !== void 0) {
       definition.workflowName = input.workflowName;
     }
@@ -286,6 +326,22 @@ async function PUT(request, context) {
     if (input.effectiveTo !== void 0) {
       definition.effectiveTo = input.effectiveTo;
     }
+    if (input.grantedFeatures !== void 0) {
+      const requestedGrant = normalizeGrantedFeatures(input.grantedFeatures);
+      const previousGrant = normalizeGrantedFeatures(definition.grantedFeatures);
+      const grantFailure = await authorizeWorkflowGrantChange(rbacService, {
+        userId: auth.sub,
+        scope: { tenantId, organizationId },
+        requested: requestedGrant,
+        current: previousGrant
+      });
+      if (grantFailure) {
+        return NextResponse.json(grantFailure.body, { status: grantFailure.status });
+      }
+      definition.grantedFeatures = requestedGrant.length ? requestedGrant : null;
+      await syncWorkflowDefinitionPrincipal(container, definition, { previousFeatures: previousGrant });
+    }
+    definition.updatedBy = auth.sub;
     definition.updatedAt = /* @__PURE__ */ new Date();
     await em.flush();
     if (guardResult?.shouldRunAfterSuccess) {
@@ -366,8 +422,8 @@ async function DELETE(request, context) {
     if (guardResult && !guardResult.ok) {
       return NextResponse.json(guardResult.body, { status: guardResult.status });
     }
-    const { WorkflowInstance } = await import("../../../data/entities.js");
-    const activeInstances = await em.count(WorkflowInstance, {
+    const { WorkflowInstance: WorkflowInstance2 } = await import("../../../data/entities.js");
+    const activeInstances = await em.count(WorkflowInstance2, {
       definitionId: definition.id,
       status: { $in: ["RUNNING", "WAITING"] }
     });
@@ -420,6 +476,7 @@ const openApi = {
         {
           status: 200,
           description: "Workflow definition found",
+          schema: workflowDefinitionDetailResponseSchema,
           example: {
             data: {
               id: "123e4567-e89b-12d3-a456-426614174000",
@@ -499,6 +556,7 @@ const openApi = {
         {
           status: 404,
           description: "Workflow definition not found",
+          schema: workflowErrorSchema,
           example: {
             error: "Workflow definition not found"
           }
@@ -577,6 +635,7 @@ const openApi = {
         {
           status: 200,
           description: "Workflow definition updated successfully",
+          schema: workflowDefinitionMutationResponseSchema,
           example: {
             data: {
               id: "123e4567-e89b-12d3-a456-426614174000",
@@ -643,13 +702,16 @@ const openApi = {
         {
           status: 400,
           description: "Validation error",
+          schema: workflowErrorSchema,
           example: {
             error: "Validation failed",
             details: [
               {
+                path: ["definition"],
                 code: "invalid_type",
-                message: "Expected object, received string",
-                path: ["definition"]
+                message: "Invalid input: expected object, received string",
+                expected: "object",
+                got: "string"
               }
             ]
           }
@@ -657,9 +719,28 @@ const openApi = {
         {
           status: 404,
           description: "Workflow definition not found",
+          schema: workflowErrorSchema,
           example: {
             error: "Workflow definition not found"
           }
+        },
+        {
+          status: 409,
+          description: "Structural change refused while instances are still running (or optimistic-lock conflict). Publish a new version and apply the change there.",
+          schema: workflowErrorSchema,
+          example: {
+            error: "Structural changes require a new version while instances are still running",
+            code: "WORKFLOW_STRUCTURAL_EDIT_REQUIRES_NEW_VERSION",
+            definitionId: "123e4567-e89b-12d3-a456-426614174000",
+            activeInstanceCount: 3,
+            activeStatuses: ["RUNNING", "PAUSED", "WAITING_FOR_ACTIVITIES", "FORKED", "COMPENSATING"],
+            changes: [{ kind: "transitionRetargeted", id: "t_lz3k9_ab12cd34e" }],
+            remedy: {
+              action: "createVersion",
+              method: "POST",
+              endpoint: "/api/workflows/definitions/123e4567-e89b-12d3-a456-426614174000/publish"
+            }
+          }
         }
       ]
     },
@@ -674,6 +755,7 @@ const openApi = {
         {
           status: 200,
           description: "Workflow definition deleted successfully",
+          schema: workflowDefinitionDeleteResponseSchema,
           example: {
             message: "Workflow definition deleted successfully"
           }
@@ -681,6 +763,7 @@ const openApi = {
         {
           status: 404,
           description: "Workflow definition not found",
+          schema: workflowErrorSchema,
           example: {
             error: "Workflow definition not found"
           }
@@ -688,6 +771,7 @@ const openApi = {
         {
           status: 409,
           description: "Cannot delete - active workflow instances exist",
+          schema: workflowErrorSchema,
           example: {
             error: "Cannot delete workflow definition with 3 active instance(s)"
           }