@open-mercato/core 0.7.1-develop.7193.1.910a5b0a1e → 0.7.1-develop.7194.1.ab4fc81f82

package/src/modules/workflows/migrations/Migration20260626214855_workflows.ts

@@ -0,0 +1,15 @@
+import { Migration } from '@mikro-orm/migrations';
+
+export class Migration20260626214855_workflows extends Migration {
+
+  override up(): void | Promise<void> {
+    this.addSql(`alter table "workflow_definitions" add "kind" varchar(20) not null default 'workflow', add "lifecycle" varchar(20) not null default 'published';`);
+    this.addSql(`create index "workflow_definitions_kind_idx" on "workflow_definitions" ("kind");`);
+  }
+
+  override down(): void | Promise<void> {
+    this.addSql(`drop index "workflow_definitions_kind_idx";`);
+    this.addSql(`alter table "workflow_definitions" drop column "kind", drop column "lifecycle";`);
+  }
+
+}

package/src/modules/workflows/migrations/Migration20260626222424_workflows.ts

@@ -0,0 +1,17 @@
+import { Migration } from '@mikro-orm/migrations';
+
+export class Migration20260626222424_workflows extends Migration {
+
+  override up(): void | Promise<void> {
+    this.addSql(`alter table "workflow_definitions" drop constraint if exists "workflow_definitions_workflow_id_tenant_id_unique";`);
+    this.addSql(`create index "workflow_definitions_definition_gin_idx" on "workflow_definitions" using gin ("definition");`);
+    this.addSql(`alter table "workflow_definitions" add constraint "workflow_definitions_workflow_id_version_tenant_id_unique" unique ("workflow_id", "version", "tenant_id");`);
+  }
+
+  override down(): void | Promise<void> {
+    this.addSql(`drop index "workflow_definitions_definition_gin_idx";`);
+    this.addSql(`alter table "workflow_definitions" drop constraint if exists "workflow_definitions_workflow_id_version_tenant_id_unique";`);
+    this.addSql(`alter table "workflow_definitions" add constraint "workflow_definitions_workflow_id_tenant_id_unique" unique ("workflow_id", "tenant_id");`);
+  }
+
+}

package/src/modules/workflows/migrations/Migration20260727074335_workflows.ts

@@ -0,0 +1,15 @@
+import { Migration } from '@mikro-orm/migrations';
+
+export class Migration20260727074335_workflows extends Migration {
+
+  override up(): void | Promise<void> {
+    this.addSql(`create table "workflow_definition_drafts" ("id" uuid not null default gen_random_uuid(), "definition_id" uuid null, "user_id" uuid not null, "definition" jsonb not null, "metadata" jsonb null, "base_updated_at" timestamptz null, "tenant_id" uuid not null, "organization_id" uuid not null, "created_at" timestamptz not null, "updated_at" timestamptz not null, "deleted_at" timestamptz null, primary key ("id"));`);
+    this.addSql(`create index "workflow_definition_drafts_tenant_org_idx" on "workflow_definition_drafts" ("tenant_id", "organization_id");`);
+    this.addSql(`alter table "workflow_definition_drafts" add constraint "workflow_definition_drafts_definition_id_user_id__e3189_unique" unique ("definition_id", "user_id", "tenant_id");`);
+  }
+
+  override down(): void | Promise<void> {
+    this.addSql(`drop table if exists "workflow_definition_drafts" cascade;`);
+  }
+
+}

package/src/modules/workflows/migrations/Migration20260728104038_workflows.ts

@@ -0,0 +1,13 @@
+import { Migration } from '@mikro-orm/migrations';
+
+export class Migration20260728104038_workflows extends Migration {
+
+  override up(): void | Promise<void> {
+    this.addSql(`alter table "user_tasks" add "entity_bindings" jsonb null, add "priority" varchar(20) null, add "reassigned_by" varchar(255) null, add "reassigned_at" timestamptz null, add "reassign_reason" text null;`);
+  }
+
+  override down(): void | Promise<void> {
+    this.addSql(`alter table "user_tasks" drop column "entity_bindings", drop column "priority", drop column "reassigned_by", drop column "reassigned_at", drop column "reassign_reason";`);
+  }
+
+}

package/src/modules/workflows/migrations/Migration20260728163001_workflows.ts

@@ -0,0 +1,36 @@
+import { Migration } from '@mikro-orm/migrations';
+
+/**
+ * Task visibility gate columns (spec §6.4, design §2.6 / §7.1).
+ *
+ * Both additive, per BACKWARD_COMPATIBILITY.md §8: a NOT NULL column with a
+ * default and a nullable column. Nothing renamed, nothing dropped.
+ *
+ * - `assignee_kind` discriminates a backoffice user id from a portal principal
+ *   id in `assigned_to`. Existing rows backfill to `'user'` from the default,
+ *   which is correct: every `assigned_to` written before this column existed is
+ *   a backoffice user id.
+ * - `entity_types` denormalizes the distinct authored binding types so the
+ *   entity gate is a `WHERE`, not a JS post-filter — post-filtering makes
+ *   `pagination.total` a lie and returns short pages. Existing rows stay NULL,
+ *   which the predicate reads as "no bindings" and passes vacuously; that is
+ *   what keeps the entire pre-Phase-4 corpus visible to its own assignees.
+ *
+ * The GIN clause is written by hand: `@Index({ type: 'gin' })` is recorded in
+ * the snapshot, but the schema generator emits a plain btree here, and btree
+ * cannot serve the array containment/overlap operators the gate is built from.
+ * Same correction as `workflow_definitions_definition_gin_idx`.
+ */
+export class Migration20260728163001_workflows extends Migration {
+
+  override up(): void | Promise<void> {
+    this.addSql(`alter table "user_tasks" add "assignee_kind" varchar(20) not null default 'user', add "entity_types" text[] null;`);
+    this.addSql(`create index "user_tasks_entity_types_gin_idx" on "user_tasks" using gin ("entity_types");`);
+  }
+
+  override down(): void | Promise<void> {
+    this.addSql(`drop index "user_tasks_entity_types_gin_idx";`);
+    this.addSql(`alter table "user_tasks" drop column "assignee_kind", drop column "entity_types";`);
+  }
+
+}

package/src/modules/workflows/migrations/Migration20260729061736_workflows.ts

@@ -0,0 +1,13 @@
+import { Migration } from '@mikro-orm/migrations';
+
+export class Migration20260729061736_workflows extends Migration {
+
+  override up(): void | Promise<void> {
+    this.addSql(`alter table "workflow_instances" add "is_dry_run" boolean not null default false;`);
+  }
+
+  override down(): void | Promise<void> {
+    this.addSql(`alter table "workflow_instances" drop column "is_dry_run";`);
+  }
+
+}

package/src/modules/workflows/migrations/Migration20260729192652_workflows.ts

@@ -0,0 +1,11 @@
+import { Migration } from '@mikro-orm/migrations';
+
+export class Migration20260729192652_workflows extends Migration {
+
+  override up(): void | Promise<void> {
+    this.addSql(`create table "workflow_definition_metric_rollups" ("id" uuid not null default gen_random_uuid(), "tenant_id" uuid not null, "organization_id" uuid not null, "workflow_id" varchar(100) not null, "window_key" varchar(10) not null, "window_start" timestamptz not null, "window_end" timestamptz not null, "computed_at" timestamptz not null, "metrics" jsonb not null, "created_at" timestamptz not null, primary key ("id"));`);
+    this.addSql(`create index "workflow_definition_metric_rollups_lookup_idx" on "workflow_definition_metric_rollups" ("tenant_id", "organization_id", "workflow_id", "window_key");`);
+    this.addSql(`alter table "workflow_definition_metric_rollups" add constraint "workflow_definition_metric_rollups_bucket_uq" unique ("tenant_id", "organization_id", "workflow_id", "window_key", "window_start");`);
+  }
+
+}

package/src/modules/workflows/migrations/Migration20260730085000_workflows.ts

@@ -0,0 +1,13 @@
+import { Migration } from '@mikro-orm/migrations';
+
+export class Migration20260730085000_workflows extends Migration {
+
+  override up(): void | Promise<void> {
+    this.addSql(`alter table "workflow_definitions" add "granted_features" jsonb null;`);
+  }
+
+  override down(): void | Promise<void> {
+    this.addSql(`alter table "workflow_definitions" drop column "granted_features";`);
+  }
+
+}

package/src/modules/workflows/migrations/Migration20260730092706_workflows.ts

@@ -0,0 +1,13 @@
+import { Migration } from '@mikro-orm/migrations';
+
+export class Migration20260730092706_workflows extends Migration {
+
+  override up(): void | Promise<void> {
+    this.addSql(`alter table "workflow_instances" add "outcome" varchar(30) null;`);
+  }
+
+  override down(): void | Promise<void> {
+    this.addSql(`alter table "workflow_instances" drop column "outcome";`);
+  }
+
+}

package/src/modules/workflows/notifications.ts

@@ -1,5 +1,15 @@
 import type { NotificationTypeDefinition } from '@open-mercato/shared/modules/notifications/types'
 
+const taskDeepLink = '/backend/tasks/{sourceEntityId}'
+
+const viewTaskAction = {
+  id: 'view',
+  labelKey: 'common.view',
+  variant: 'outline' as const,
+  href: taskDeepLink,
+  icon: 'external-link',
+}
+
 export const notificationTypes: NotificationTypeDefinition[] = [
   {
     type: 'workflows.task.assigned',
@@ -10,18 +20,38 @@ export const notificationTypes: NotificationTypeDefinition[] = [
     bodyKey: 'workflows.notifications.task.assigned.body',
     icon: 'clipboard-list',
     severity: 'info',
-    actions: [
-      {
-        id: 'view',
-        labelKey: 'common.view',
-        variant: 'outline',
-        href: '/backend/workflows/tasks/{sourceEntityId}',
-        icon: 'external-link',
-      },
-    ],
-    linkHref: '/backend/workflows/tasks/{sourceEntityId}',
+    actions: [viewTaskAction],
+    linkHref: taskDeepLink,
     expiresAfterHours: 168, // 7 days
   },
+  {
+    type: 'workflows.task.reminder_due',
+    // Same delivery as `workflows.task.assigned`: an SLA reminder or breach is
+    // about the task the operator already gets assignment mail for.
+    channels: ['in_app', 'email'],
+    module: 'workflows',
+    titleKey: 'workflows.notifications.task.reminderDue.title',
+    bodyKey: 'workflows.notifications.task.reminderDue.body',
+    icon: 'alarm-clock',
+    severity: 'warning',
+    actions: [viewTaskAction],
+    linkHref: taskDeepLink,
+    expiresAfterHours: 168,
+  },
+  {
+    type: 'workflows.task.deadline_breached',
+    // Same delivery as `workflows.task.assigned`: an SLA reminder or breach is
+    // about the task the operator already gets assignment mail for.
+    channels: ['in_app', 'email'],
+    module: 'workflows',
+    titleKey: 'workflows.notifications.task.deadlineBreached.title',
+    bodyKey: 'workflows.notifications.task.deadlineBreached.body',
+    icon: 'alert-triangle',
+    severity: 'error',
+    actions: [viewTaskAction],
+    linkHref: taskDeepLink,
+    expiresAfterHours: 168,
+  },
 ]
 
 export default notificationTypes

package/src/modules/workflows/setup.ts

@@ -1,16 +1,144 @@
+import { createHash } from 'node:crypto'
 import type { ModuleSetupConfig } from '@open-mercato/shared/modules/setup'
 import { resolveBusinessRuleDiscoveryCache } from '@open-mercato/core/modules/business_rules/lib/rule-engine'
+import { createLogger } from '@open-mercato/shared/lib/logger'
 import { seedExampleWorkflows } from './lib/seeds'
+import { WORKFLOW_DEFINITION_METRIC_ROLLUP_INTERVAL } from './lib/metrics/rollup-schedule'
+
+const logger = createLogger('workflows')
+
+type SchedulerServiceLike = {
+  register: (registration: {
+    id: string
+    name: string
+    description?: string
+    scopeType: 'system' | 'organization' | 'tenant'
+    organizationId?: string
+    tenantId?: string
+    scheduleType: 'cron' | 'interval'
+    scheduleValue: string
+    timezone?: string
+    targetType: 'queue'
+    targetQueue: string
+    targetPayload?: Record<string, unknown>
+    sourceType?: string
+    sourceModule?: string
+    isEnabled?: boolean
+  }) => Promise<void>
+}
+
+/**
+ * `scheduled_jobs.id` is a uuid column, so a module-owned schedule's stable
+ * registration key must be hashed into a uuid rather than used verbatim — this
+ * keeps `schedulerService.register()` an idempotent upsert across re-runs of
+ * `seedDefaults` instead of trying to insert a raw string into the uuid PK.
+ */
+function stableScheduleUuid(stableKey: string): string {
+  const hex = createHash('sha256').update(stableKey).digest('hex')
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`
+}
+
+/**
+ * Register the per-organization KPI rollup tick (spec §8.5).
+ *
+ * Per ORGANIZATION rather than one system-wide tick that enumerates tenants:
+ * the pass would otherwise need an unscoped read to discover which
+ * organizations exist, and this module's rule is that every query carries both
+ * scope columns. One schedule row per organization is the price of that.
+ *
+ * Best-effort in both directions: `@open-mercato/scheduler` is an optional peer
+ * (no registration in the container ⇒ silent no-op), and a failure to register
+ * must never abort tenant setup — the read API live-computes when no rollup row
+ * exists, so a missing schedule degrades freshness, not correctness.
+ */
+async function ensureMetricRollupSchedule(ctx: {
+  container: { resolve: (name: string) => unknown; hasRegistration?: (name: string) => boolean }
+  tenantId: string
+  organizationId: string
+}): Promise<void> {
+  const cradle = ctx.container as { hasRegistration?: (name: string) => boolean }
+  if (typeof cradle.hasRegistration !== 'function' || !cradle.hasRegistration('schedulerService')) return
+  try {
+    const schedulerService = ctx.container.resolve('schedulerService') as SchedulerServiceLike
+    await schedulerService.register({
+      id: stableScheduleUuid(`workflows:definition-metric-rollup:${ctx.organizationId}`),
+      name: 'Workflow definition metric rollup',
+      description:
+        'Recomputes per-definition run, success-rate, duration-percentile and task-SLA KPIs into workflow_definition_metric_rollups.',
+      scopeType: 'organization',
+      organizationId: ctx.organizationId,
+      tenantId: ctx.tenantId,
+      scheduleType: 'interval',
+      scheduleValue: WORKFLOW_DEFINITION_METRIC_ROLLUP_INTERVAL,
+      timezone: 'UTC',
+      targetType: 'queue',
+      targetQueue: 'workflow-definition-metric-rollup',
+      targetPayload: { scope: { tenantId: ctx.tenantId, organizationId: ctx.organizationId } },
+      sourceType: 'module',
+      sourceModule: 'workflows',
+      isEnabled: true,
+    })
+  } catch (error) {
+    logger.warn('[internal] workflows: failed to register the metric-rollup schedule', { err: error })
+  }
+}
 
 export const setup: ModuleSetupConfig = {
   seedDefaults: async (ctx) => {
     const scope = { tenantId: ctx.tenantId, organizationId: ctx.organizationId }
     const cache = resolveBusinessRuleDiscoveryCache(ctx.container.resolve.bind(ctx.container))
     await seedExampleWorkflows(ctx.em, scope, { cache })
+    await ensureMetricRollupSchedule({
+      container: ctx.container as never,
+      tenantId: ctx.tenantId,
+      organizationId: ctx.organizationId,
+    })
+  },
+
+  /**
+   * Portal grants for the §6.4 portal task surface.
+   *
+   * Declared HERE rather than in `customer_accounts` because a module ships its
+   * own portal features the same way it ships its own backoffice ones —
+   * `syncDefaultCustomerRoleAcls` collects `defaultCustomerRoleFeatures` from
+   * every enabled module and merges them into the seeded customer roles.
+   * Workflows is the first shipped consumer of that seam.
+   *
+   * `portal_admin` is deliberately absent: it already carries `portal.*`, and a
+   * wildcard is exactly what the portal branch of the predicate refuses to treat
+   * as ownership. Granting it explicitly would suggest the wildcard means
+   * something it does not.
+   *
+   * Two rollout caveats, neither a bug:
+   * - The merge is additive into EXISTING roles and runs during tenant setup,
+   *   so an already-provisioned tenant picks these up only after
+   *   `mercato customer_accounts sync-customer-role-acls`.
+   * - `CustomerRbacService` caches ACLs for 5 minutes, so a fresh grant is not
+   *   immediately visible to a signed-in portal user.
+   */
+  defaultCustomerRoleFeatures: {
+    buyer: ['portal.tasks.view', 'portal.tasks.complete'],
+    viewer: ['portal.tasks.view'],
   },
 
   defaultRoleFeatures: {
+    // `workflows.*` already grants every concrete id, including the spec §8.4
+    // recovery features `workflows.instances.rerun_step` and
+    // `workflows.instances.bulk_ops`, the spec §8.5 ops feature
+    // `workflows.metrics.view`, and the execution-identity feature
+    // `workflows.definitions.grant_features` (safe to hold under a wildcard: a
+    // grant can never exceed the granting user's OWN current features, so an
+    // admin can only delegate powers they already have). Existing tenants pick
+    // up newly declared features only after `yarn mercato auth sync-role-acls`.
     admin: ['workflows.*'],
+    employee: [
+      'workflows.view',
+      'workflows.view_tasks',
+      'workflows.tasks.view',
+      'workflows.tasks.claim',
+      'workflows.tasks.complete',
+      'workflows.instances.view',
+    ],
   },
 }
 

package/src/modules/workflows/subscribers/task-assigned-notification.ts

@@ -1,10 +1,14 @@
-import type { EntityManager } from '@mikro-orm/postgresql'
-import { resolveNotificationService } from '../../notifications/lib/notificationService'
-import { buildNotificationFromType } from '../../notifications/lib/notificationBuilder'
 import { notificationTypes } from '../notifications'
-import { createLogger } from '@open-mercato/shared/lib/logger'
-
-const logger = createLogger('workflows')
+import {
+  notifyTaskLifecycleEvent,
+  type TaskLifecycleNotificationPayload,
+  type TaskNotificationResolverContext,
+} from '../lib/task-notifications'
+import {
+  buildTaskQuickActions,
+  resolveTaskPrimaryActionId,
+  type TaskQuickActionInput,
+} from '../lib/task-quick-action'
 
 export const metadata = {
   event: 'workflows.task.assigned',
@@ -12,45 +16,32 @@ export const metadata = {
   id: 'workflows:task-assigned-notification',
 }
 
-type TaskAssignedPayload = {
-  taskId: string
-  taskName: string
-  workflowName: string
-  assignedUserId: string
-  dueDate?: string | null
-  tenantId: string
-  organizationId?: string | null
-}
-
-type ResolverContext = {
-  resolve: <T = unknown>(name: string) => T
+type TaskAssignedPayload = TaskLifecycleNotificationPayload & {
+  /**
+   * Present only when the emitter knows the task's decision/form shape. Absent
+   * means unknown, and the notification falls back to the deep link — a quick
+   * action is never offered on a guess.
+   */
+  quickAction?: TaskQuickActionInput | null
 }
 
-export default async function handle(payload: TaskAssignedPayload, ctx: ResolverContext) {
-  if (!payload.assignedUserId) return
-
-  try {
-    const notificationService = resolveNotificationService(ctx)
-    const typeDef = notificationTypes.find((type) => type.type === 'workflows.task.assigned')
-    if (!typeDef) return
-
-    const notificationInput = buildNotificationFromType(typeDef, {
-      recipientUserId: payload.assignedUserId,
-      bodyVariables: {
-        taskName: payload.taskName,
-        workflowName: payload.workflowName,
-        dueDate: payload.dueDate ?? '',
-      },
-      sourceEntityType: 'workflows:user_task',
-      sourceEntityId: payload.taskId,
-      linkHref: `/backend/workflows/tasks/${payload.taskId}`,
-    })
-
-    await notificationService.create(notificationInput, {
-      tenantId: payload.tenantId,
-      organizationId: payload.organizationId ?? null,
-    })
-  } catch (err) {
-    logger.error('Failed to create notification', { component: 'task-assigned-notification', err })
-  }
+export default async function handle(
+  payload: TaskAssignedPayload,
+  ctx: TaskNotificationResolverContext
+) {
+  const quickAction = payload?.quickAction ?? null
+
+  await notifyTaskLifecycleEvent({
+    ctx,
+    notificationTypes,
+    notificationType: 'workflows.task.assigned',
+    payload,
+    ...(quickAction
+      ? {
+          actions: buildTaskQuickActions(quickAction),
+          primaryActionId: resolveTaskPrimaryActionId(quickAction),
+        }
+      : {}),
+    component: 'task-assigned-notification',
+  })
 }

package/src/modules/workflows/subscribers/task-deadline-breached-notification.ts

@@ -0,0 +1,31 @@
+import { notificationTypes } from '../notifications'
+import {
+  notifyTaskLifecycleEvent,
+  type TaskLifecycleNotificationPayload,
+  type TaskNotificationResolverContext,
+} from '../lib/task-notifications'
+
+/**
+ * The breach notification is emitted for every breach, whatever the step's
+ * `onBreach` action turns out to be: someone always needs to know the deadline
+ * passed, even when the run has already been routed away from the task.
+ */
+export const metadata = {
+  event: 'workflows.task.deadline_breached',
+  persistent: true,
+  id: 'workflows:task-deadline-breached-notification',
+}
+
+export default async function handle(
+  payload: TaskLifecycleNotificationPayload,
+  ctx: TaskNotificationResolverContext
+) {
+  await notifyTaskLifecycleEvent({
+    ctx,
+    notificationTypes,
+    notificationType: 'workflows.task.deadline_breached',
+    payload,
+    groupByType: true,
+    component: 'task-deadline-breached-notification',
+  })
+}

package/src/modules/workflows/subscribers/task-reminder-notification.ts

@@ -0,0 +1,31 @@
+import { notificationTypes } from '../notifications'
+import {
+  notifyTaskLifecycleEvent,
+  type TaskLifecycleNotificationPayload,
+  type TaskNotificationResolverContext,
+} from '../lib/task-notifications'
+
+/**
+ * A reminder reaches exactly the audience the assignment reached — the named
+ * assignee, or every member of the authored role queue — because both route
+ * through the same recipient resolution.
+ */
+export const metadata = {
+  event: 'workflows.task.reminder_due',
+  persistent: true,
+  id: 'workflows:task-reminder-notification',
+}
+
+export default async function handle(
+  payload: TaskLifecycleNotificationPayload,
+  ctx: TaskNotificationResolverContext
+) {
+  await notifyTaskLifecycleEvent({
+    ctx,
+    notificationTypes,
+    notificationType: 'workflows.task.reminder_due',
+    payload,
+    groupByType: true,
+    component: 'task-reminder-notification',
+  })
+}

package/src/modules/workflows/widgets/injection/pending-work/widget.client.tsx

@@ -0,0 +1,119 @@
+"use client"
+
+/**
+ * "Pending work" on a record page (spec §6.2: *"Record-page surfaces: every
+ * bound entity type gets the injected 'pending work' widget"*).
+ *
+ * Generic by construction: the record it is about comes from the host page's
+ * injection context (`resourceKind` + `resourceId`, which every record-detail
+ * page already publishes), never from per-spot configuration. Wiring it into a
+ * new detail page is therefore one line in `injection-table.ts`.
+ *
+ * Two deliberate properties:
+ *
+ * - **It asks the work inbox, not the tasks table.** The inbox is the merged
+ *   projection over every registered source, so a disposition raised by the
+ *   enterprise agent bridge shows up here for free, and the query's own tenant/
+ *   organization scoping decides what the caller may see.
+ * - **`entityType` is matched across spellings.** Bindings are authored free
+ *   text (`customers:person`) while `resourceKind` uses dots
+ *   (`customers.person`); the filter forwards every known spelling rather than
+ *   asking authors to guess which one the widget wants.
+ */
+
+import * as React from 'react'
+import type { InjectionWidgetComponentProps } from '@open-mercato/shared/modules/widgets/injection'
+import { useQuery } from '@tanstack/react-query'
+import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
+import { useT } from '@open-mercato/shared/lib/i18n/context'
+import {
+  EntityContextPanel,
+  workItemsToEntityContextItems,
+} from '../../../components/work-inbox/EntityContextPanel'
+import type { PendingWorkItem } from '../../../components/work-inbox/EntityContextPanel'
+import { entityTypeQueryValues } from '../../../lib/work-inbox/entity-links'
+
+/** Open statuses only — a record page is about outstanding work, not history. */
+const OPEN_STATUSES = 'PENDING,IN_PROGRESS,ESCALATED'
+
+const MAX_ITEMS = 10
+
+export type RecordContext = {
+  resourceKind?: string | null
+  resourceId?: string | null
+}
+
+export type RecordData = {
+  id?: string | null
+}
+
+type WorkInboxResponse = {
+  data: PendingWorkItem[]
+}
+
+export function resolvePendingWorkTarget(
+  context: RecordContext | null | undefined,
+  data: RecordData | null | undefined,
+): { entityType: string; entityId: string } | null {
+  const entityType = typeof context?.resourceKind === 'string' ? context.resourceKind : null
+  const entityId =
+    (typeof context?.resourceId === 'string' && context.resourceId) ||
+    (typeof data?.id === 'string' && data.id) ||
+    null
+  if (!entityType || !entityId) return null
+  return { entityType, entityId }
+}
+
+export function buildPendingWorkQuery(entityType: string): string {
+  const params = new URLSearchParams()
+  params.set('entityType', entityTypeQueryValues(entityType).join(','))
+  params.set('status', OPEN_STATUSES)
+  params.set('limit', String(MAX_ITEMS))
+  return params.toString()
+}
+
+export default function PendingWorkWidget({
+  context,
+  data,
+}: InjectionWidgetComponentProps<RecordContext, RecordData>) {
+  const t = useT()
+  const target = resolvePendingWorkTarget(context, data)
+
+  const { data: rows, isLoading } = useQuery({
+    queryKey: ['workflows-pending-work', target?.entityType, target?.entityId],
+    enabled: Boolean(target),
+    queryFn: async () => {
+      if (!target) return []
+      const result = await apiCall<WorkInboxResponse>(
+        `/api/workflows/work-inbox?${buildPendingWorkQuery(target.entityType)}`,
+      )
+      if (!result.ok) return []
+      const items = result.result?.data ?? []
+      // The inbox filter narrows by entity TYPE; this record is one of them.
+      return items.filter((item) =>
+        (item as PendingWorkItem & { entityBindings?: Array<{ entityId?: string }> }).entityBindings?.some(
+          (binding) => binding.entityId === target.entityId,
+        ) ?? false,
+      )
+    },
+  })
+
+  if (!target) return null
+
+  return (
+    <EntityContextPanel
+      testId="workflows-pending-work"
+      title={t('workflows.pendingWork.title')}
+      items={workItemsToEntityContextItems(rows, {
+        status: (status) => t(`workflows.tasks.statuses.${status}`, status),
+        priority: (priority) => t(`workflows.workInbox.priorities.${priority}`, priority),
+        overdue: t('workflows.tasks.overdue'),
+        due: (formatted) => `${t('workflows.tasks.fields.dueDate')}: ${formatted}`,
+      })}
+      emptyLabel={t('workflows.pendingWork.empty')}
+      linkLabel={t('workflows.pendingWork.open')}
+      loading={isLoading}
+      loadingLabel={t('workflows.pendingWork.loading')}
+    />
+  )
+}