@open-mercato/core 0.7.1-develop.7193.1.910a5b0a1e → 0.7.1-develop.7194.1.ab4fc81f82

package/dist/modules/workflows/api/tasks/serialize.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/workflows/api/tasks/serialize.ts"],
+  "sourcesContent": ["import type { z } from 'zod'\nimport type { UserTask } from '../../data/entities'\nimport type { userTaskRowSchema } from '../openapi'\n\n/**\n * Work-inbox row projection for `UserTask`.\n *\n * The list endpoint used to hand the ORM entities straight to `NextResponse.json`,\n * so anything a consumer needed that was not a column stayed buried in the\n * authored `formSchema` blob: the enterprise \"Review proposal\" row action reads\n * `row.proposalId`, which lives at `formSchema.proposalId`, and therefore never\n * fired. This projects those work-item fields to the top level.\n *\n * It is a strict SUPERSET of the previous payload \u2014 every column the entity dump\n * carried is still emitted, with dates in the same ISO form `JSON.stringify`\n * produced (BACKWARD_COMPATIBILITY.md \u00A77: never remove a response field).\n */\n\nexport const USER_TASK_INBOX_KIND = 'user_task'\n\nexport type SerializedUserTask = z.infer<typeof userTaskRowSchema>\n\nfunction asRecord(value: unknown): Record<string, unknown> | null {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) return null\n  return value as Record<string, unknown>\n}\n\nfunction readProposalId(task: UserTask): string | null {\n  for (const source of [task.formSchema, task.formData]) {\n    const record = asRecord(source)\n    const value = record?.proposalId ?? record?.proposal_id\n    if (typeof value === 'string' && value.length > 0) return value\n  }\n  return null\n}\n\n/**\n * Both readers prefer the real column and fall back to the authored\n * `formSchema` blob. The column is authoritative from the moment task creation\n * resolves it; the fallback keeps every row written before the column existed\n * \u2014 and every third party that stuffed the value into `formSchema` \u2014 reading\n * exactly as it read before.\n */\nfunction readPriority(task: UserTask): string | number | null {\n  if (typeof task.priority === 'string' && task.priority.length > 0) return task.priority\n  const value = asRecord(task.formSchema)?.priority\n  if (typeof value === 'string' && value.length > 0) return value\n  if (typeof value === 'number' && Number.isFinite(value)) return value\n  return null\n}\n\nfunction readEntityBindings(task: UserTask): unknown[] | null {\n  if (Array.isArray(task.entityBindings)) return task.entityBindings\n  const value = asRecord(task.formSchema)?.entityBindings\n  return Array.isArray(value) ? value : null\n}\n\n/**\n * The stored denormalization when there is one, otherwise derived from the\n * bindings the row actually carries. The fallback is what keeps a row written\n * before the column existed reporting the same set the work-inbox projection\n * computes for it \u2014 the two must never disagree, because that disagreement is\n * exactly a task hidden by the SQL gate and shown by the JS one.\n */\nfunction readEntityTypes(task: UserTask): string[] | null {\n  if (Array.isArray(task.entityTypes)) return task.entityTypes\n  const bindings = readEntityBindings(task)\n  if (!bindings) return null\n  const types = new Set<string>()\n  for (const binding of bindings) {\n    const entityType = asRecord(binding)?.entityType\n    if (typeof entityType === 'string' && entityType.length > 0) types.add(entityType)\n  }\n  return types.size > 0 ? [...types] : null\n}\n\nfunction toIso(value: Date | null | undefined): string | null {\n  return value ? value.toISOString() : null\n}\n\nexport function serializeUserTask(task: UserTask): SerializedUserTask {\n  return {\n    id: task.id,\n    workflowInstanceId: task.workflowInstanceId,\n    stepInstanceId: task.stepInstanceId,\n    branchInstanceId: task.branchInstanceId ?? null,\n    taskName: task.taskName,\n    description: task.description ?? null,\n    status: task.status,\n    formSchema: task.formSchema ?? null,\n    formData: task.formData ?? null,\n    assignedTo: task.assignedTo ?? null,\n    // Defaulted rather than coalesced to null: the column is NOT NULL precisely\n    // so no branch has to handle an absent discriminator, and a row read through\n    // a stale projection is a backoffice task like every row that predates it.\n    assigneeKind: task.assigneeKind ?? 'user',\n    assignedToRoles: task.assignedToRoles ?? null,\n    entityTypes: readEntityTypes(task),\n    claimedBy: task.claimedBy ?? null,\n    claimedAt: toIso(task.claimedAt),\n    dueDate: toIso(task.dueDate),\n    escalatedAt: toIso(task.escalatedAt),\n    escalatedTo: task.escalatedTo ?? null,\n    completedBy: task.completedBy ?? null,\n    completedAt: toIso(task.completedAt),\n    comments: task.comments ?? null,\n    reassignedBy: task.reassignedBy ?? null,\n    reassignedAt: toIso(task.reassignedAt),\n    reassignReason: task.reassignReason ?? null,\n    tenantId: task.tenantId,\n    organizationId: task.organizationId,\n    createdAt: task.createdAt.toISOString(),\n    updatedAt: task.updatedAt.toISOString(),\n    kind: USER_TASK_INBOX_KIND,\n    proposalId: readProposalId(task),\n    priority: readPriority(task),\n    entityBindings: readEntityBindings(task),\n  }\n}\n"],
+  "mappings": "AAkBO,MAAM,uBAAuB;AAIpC,SAAS,SAAS,OAAgD;AAChE,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AACxE,SAAO;AACT;AAEA,SAAS,eAAe,MAA+B;AACrD,aAAW,UAAU,CAAC,KAAK,YAAY,KAAK,QAAQ,GAAG;AACrD,UAAM,SAAS,SAAS,MAAM;AAC9B,UAAM,QAAQ,QAAQ,cAAc,QAAQ;AAC5C,QAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAAG,QAAO;AAAA,EAC5D;AACA,SAAO;AACT;AASA,SAAS,aAAa,MAAwC;AAC5D,MAAI,OAAO,KAAK,aAAa,YAAY,KAAK,SAAS,SAAS,EAAG,QAAO,KAAK;AAC/E,QAAM,QAAQ,SAAS,KAAK,UAAU,GAAG;AACzC,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAAG,QAAO;AAC1D,MAAI,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,EAAG,QAAO;AAChE,SAAO;AACT;AAEA,SAAS,mBAAmB,MAAkC;AAC5D,MAAI,MAAM,QAAQ,KAAK,cAAc,EAAG,QAAO,KAAK;AACpD,QAAM,QAAQ,SAAS,KAAK,UAAU,GAAG;AACzC,SAAO,MAAM,QAAQ,KAAK,IAAI,QAAQ;AACxC;AASA,SAAS,gBAAgB,MAAiC;AACxD,MAAI,MAAM,QAAQ,KAAK,WAAW,EAAG,QAAO,KAAK;AACjD,QAAM,WAAW,mBAAmB,IAAI;AACxC,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,QAAQ,oBAAI,IAAY;AAC9B,aAAW,WAAW,UAAU;AAC9B,UAAM,aAAa,SAAS,OAAO,GAAG;AACtC,QAAI,OAAO,eAAe,YAAY,WAAW,SAAS,EAAG,OAAM,IAAI,UAAU;AAAA,EACnF;AACA,SAAO,MAAM,OAAO,IAAI,CAAC,GAAG,KAAK,IAAI;AACvC;AAEA,SAAS,MAAM,OAA+C;AAC5D,SAAO,QAAQ,MAAM,YAAY,IAAI;AACvC;AAEO,SAAS,kBAAkB,MAAoC;AACpE,SAAO;AAAA,IACL,IAAI,KAAK;AAAA,IACT,oBAAoB,KAAK;AAAA,IACzB,gBAAgB,KAAK;AAAA,IACrB,kBAAkB,KAAK,oBAAoB;AAAA,IAC3C,UAAU,KAAK;AAAA,IACf,aAAa,KAAK,eAAe;AAAA,IACjC,QAAQ,KAAK;AAAA,IACb,YAAY,KAAK,cAAc;AAAA,IAC/B,UAAU,KAAK,YAAY;AAAA,IAC3B,YAAY,KAAK,cAAc;AAAA;AAAA;AAAA;AAAA,IAI/B,cAAc,KAAK,gBAAgB;AAAA,IACnC,iBAAiB,KAAK,mBAAmB;AAAA,IACzC,aAAa,gBAAgB,IAAI;AAAA,IACjC,WAAW,KAAK,aAAa;AAAA,IAC7B,WAAW,MAAM,KAAK,SAAS;AAAA,IAC/B,SAAS,MAAM,KAAK,OAAO;AAAA,IAC3B,aAAa,MAAM,KAAK,WAAW;AAAA,IACnC,aAAa,KAAK,eAAe;AAAA,IACjC,aAAa,KAAK,eAAe;AAAA,IACjC,aAAa,MAAM,KAAK,WAAW;AAAA,IACnC,UAAU,KAAK,YAAY;AAAA,IAC3B,cAAc,KAAK,gBAAgB;AAAA,IACnC,cAAc,MAAM,KAAK,YAAY;AAAA,IACrC,gBAAgB,KAAK,kBAAkB;AAAA,IACvC,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,WAAW,KAAK,UAAU,YAAY;AAAA,IACtC,WAAW,KAAK,UAAU,YAAY;AAAA,IACtC,MAAM;AAAA,IACN,YAAY,eAAe,IAAI;AAAA,IAC/B,UAAU,aAAa,IAAI;AAAA,IAC3B,gBAAgB,mBAAmB,IAAI;AAAA,EACzC;AACF;",
+  "names": []
+}

package/dist/modules/workflows/api/templates/route.js

@@ -0,0 +1,69 @@
+import { NextResponse } from "next/server";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { loadWorkflowTemplates } from "../../lib/workflow-templates.js";
+import { workflowsTag, workflowErrorSchema, workflowTemplateListResponseSchema } from "../openapi.js";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+const logger = createLogger("workflows");
+const metadata = {
+  requireAuth: true,
+  requireFeatures: ["workflows.definitions.view"]
+};
+async function GET(request) {
+  try {
+    const container = await createRequestContainer();
+    const auth = await getAuthFromRequest(request);
+    if (!auth) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+    const scope = await resolveOrganizationScopeForRequest({ container, auth, request });
+    const tenantId = auth.tenantId;
+    const organizationId = scope?.selectedId ?? auth.orgId;
+    if (!tenantId) {
+      return NextResponse.json({ error: "Missing tenant context" }, { status: 400 });
+    }
+    const rbacService = container.resolve("rbacService");
+    const hasPermission = await rbacService.userHasAllFeatures(
+      auth.sub,
+      ["workflows.definitions.view"],
+      { tenantId, organizationId }
+    );
+    if (!hasPermission) {
+      return NextResponse.json({ error: "Insufficient permissions" }, { status: 403 });
+    }
+    const items = loadWorkflowTemplates();
+    return NextResponse.json({ items });
+  } catch (error) {
+    logger.error("Error listing workflow templates", { err: error });
+    return NextResponse.json(
+      { error: "Failed to list workflow templates" },
+      { status: 500 }
+    );
+  }
+}
+const openApi = {
+  tag: workflowsTag,
+  summary: "List workflow templates",
+  methods: {
+    GET: {
+      summary: "List seeded workflow templates",
+      description: "Returns the shipped workflow template gallery: metadata (id, i18n name/description keys, category, icon) plus the complete workflow definition each template seeds.",
+      responses: [
+        { status: 200, description: "Available workflow templates", schema: workflowTemplateListResponseSchema }
+      ],
+      errors: [
+        { status: 400, description: "Missing tenant context", schema: workflowErrorSchema },
+        { status: 401, description: "Unauthorized", schema: workflowErrorSchema },
+        { status: 403, description: "Insufficient permissions", schema: workflowErrorSchema },
+        { status: 500, description: "Internal server error", schema: workflowErrorSchema }
+      ]
+    }
+  }
+};
+export {
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/workflows/api/templates/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/workflows/api/templates/route.ts"],
+  "sourcesContent": ["/**\n * Workflow Templates API\n *\n * Endpoint:\n * - GET /api/workflows/templates - List seeded workflow templates for the gallery\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { loadWorkflowTemplates } from '../../lib/workflow-templates'\nimport { workflowsTag, workflowErrorSchema, workflowTemplateListResponseSchema } from '../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.view'],\n}\n\n/**\n * GET /api/workflows/templates\n *\n * List the shipped workflow templates (gallery metadata + full definitions).\n */\nexport async function GET(request: NextRequest) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = scope?.selectedId ?? auth.orgId\n\n    if (!tenantId) {\n      return NextResponse.json({ error: 'Missing tenant context' }, { status: 400 })\n    }\n\n    const rbacService = container.resolve('rbacService')\n    const hasPermission = await rbacService.userHasAllFeatures(\n      auth.sub,\n      ['workflows.definitions.view'],\n      { tenantId, organizationId }\n    )\n\n    if (!hasPermission) {\n      return NextResponse.json({ error: 'Insufficient permissions' }, { status: 403 })\n    }\n\n    const items = loadWorkflowTemplates()\n\n    return NextResponse.json({ items })\n  } catch (error) {\n    logger.error('Error listing workflow templates', { err: error })\n    return NextResponse.json(\n      { error: 'Failed to list workflow templates' },\n      { status: 500 }\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'List workflow templates',\n  methods: {\n    GET: {\n      summary: 'List seeded workflow templates',\n      description: 'Returns the shipped workflow template gallery: metadata (id, i18n name/description keys, category, icon) plus the complete workflow definition each template seeds.',\n      responses: [\n        { status: 200, description: 'Available workflow templates', schema: workflowTemplateListResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing tenant context', schema: workflowErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: workflowErrorSchema },\n        { status: 403, description: 'Insufficient permissions', schema: workflowErrorSchema },\n        { status: 500, description: 'Internal server error', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAOA,SAAsB,oBAAoB;AAE1C,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,6BAA6B;AACtC,SAAS,cAAc,qBAAqB,0CAA0C;AACtF,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,4BAA4B;AAChD;AAOA,eAAsB,IAAI,SAAsB;AAC9C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,cAAc,KAAK;AAEjD,QAAI,CAAC,UAAU;AACb,aAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/E;AAEA,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,UAAM,gBAAgB,MAAM,YAAY;AAAA,MACtC,KAAK;AAAA,MACL,CAAC,4BAA4B;AAAA,MAC7B,EAAE,UAAU,eAAe;AAAA,IAC7B;AAEA,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjF;AAEA,UAAM,QAAQ,sBAAsB;AAEpC,WAAO,aAAa,KAAK,EAAE,MAAM,CAAC;AAAA,EACpC,SAAS,OAAO;AACd,WAAO,MAAM,oCAAoC,EAAE,KAAK,MAAM,CAAC;AAC/D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,oCAAoC;AAAA,MAC7C,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,mCAAmC;AAAA,MACzG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,oBAAoB;AAAA,QAClF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/workflows/api/work-inbox/next/route.js

@@ -0,0 +1,129 @@
+import { NextResponse } from "next/server";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { USER_TASK_INBOX_KIND } from "../../tasks/serialize.js";
+import { serializeWorkInboxRow } from "../../../lib/work-inbox/provider.js";
+import { parseWorkInboxQuery } from "../../../lib/work-inbox/query.js";
+import { toUserTaskWorkInboxRow } from "../../../lib/work-inbox/user-task-source.js";
+import {
+  collectScopedTaskEntityTypes,
+  resolveTaskVisibilityForRequest
+} from "../../../lib/task-visibility-request.js";
+import { UserTask } from "../../../data/entities.js";
+import {
+  workflowsTag,
+  workInboxClaimNextResponseSchema,
+  workflowErrorSchema
+} from "../../openapi.js";
+const logger = createLogger("workflows");
+const RACE_LOST_CODES = /* @__PURE__ */ new Set(["TASK_NOT_FOUND", "TASK_ALREADY_ASSIGNED", "TASK_NOT_ROLE_ASSIGNED"]);
+const metadata = {
+  requireAuth: true,
+  requireFeatures: ["workflows.tasks.claim"]
+};
+function isRaceLost(error) {
+  if (!error || typeof error !== "object") return false;
+  const code = error.code;
+  return typeof code === "string" && RACE_LOST_CODES.has(code);
+}
+async function POST(request) {
+  try {
+    const container = await createRequestContainer();
+    const em = container.resolve("em");
+    const auth = await getAuthFromRequest(request);
+    if (!auth) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+    const organizationScope = await resolveOrganizationScopeForRequest({ container, auth, request });
+    const tenantId = auth.tenantId;
+    const organizationId = organizationScope?.selectedId ?? auth.orgId;
+    if (!tenantId || !organizationId) {
+      return NextResponse.json(
+        { error: "Missing tenant or organization context" },
+        { status: 400 }
+      );
+    }
+    const roles = auth.roles ?? [];
+    const query = parseWorkInboxQuery(new URL(request.url).searchParams, /* @__PURE__ */ new Date());
+    const workInboxService = container.resolve("workInboxService");
+    const organizationIds = [organizationId];
+    const visibility = await resolveTaskVisibilityForRequest({
+      container,
+      em,
+      auth: { userId: auth.sub, tenantId, roleNames: roles },
+      organizationIds,
+      aclOrganizationId: organizationId,
+      entityTypes: await collectScopedTaskEntityTypes(em, { tenantId, organizationIds })
+    });
+    const candidates = await workInboxService.listClaimableWorkInbox(
+      {
+        ...query,
+        kinds: [USER_TASK_INBOX_KIND],
+        roles,
+        statuses: ["PENDING"],
+        myWork: false
+      },
+      {
+        scope: { tenantId, organizationIds, userId: auth.sub, roles, visibility },
+        resolve: (name) => container.resolve(name)
+      }
+    );
+    const taskHandler = container.resolve("taskHandler");
+    for (const candidate of candidates) {
+      try {
+        await taskHandler.claimUserTask(
+          em,
+          candidate.id,
+          auth.sub,
+          { tenantId, organizationId },
+          roles
+        );
+      } catch (error) {
+        if (isRaceLost(error)) continue;
+        throw error;
+      }
+      const task = await em.findOne(UserTask, { id: candidate.id, tenantId, organizationId });
+      const claimed = task ? toUserTaskWorkInboxRow(task, query.now) : candidate;
+      return NextResponse.json({
+        data: serializeWorkInboxRow(claimed),
+        message: "Task claimed successfully"
+      });
+    }
+    return NextResponse.json({ data: null, message: "No claimable work available" });
+  } catch (error) {
+    logger.error("Error claiming the next work item", { err: error });
+    return NextResponse.json(
+      {
+        error: "Failed to claim the next work item",
+        details: error instanceof Error ? error.message : String(error)
+      },
+      { status: 500 }
+    );
+  }
+}
+const openApi = {
+  tag: workflowsTag,
+  summary: "Claim the next work item",
+  methods: {
+    POST: {
+      summary: "Claim the top claimable item from the work inbox",
+      description: "Walks the caller's claimable queue in inbox order and claims the first item it wins. The claim is a conditional update, so concurrent callers never receive the same item \u2014 a caller that loses the race moves on to the next candidate. Returns null data when nothing is claimable.",
+      responses: [
+        { status: 200, description: "The claimed item, or null when nothing was claimable", schema: workInboxClaimNextResponseSchema }
+      ],
+      errors: [
+        { status: 400, description: "Missing tenant or organization context", schema: workflowErrorSchema },
+        { status: 401, description: "Unauthorized", schema: workflowErrorSchema },
+        { status: 500, description: "Internal server error", schema: workflowErrorSchema }
+      ]
+    }
+  }
+};
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/workflows/api/work-inbox/next/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/workflows/api/work-inbox/next/route.ts"],
+  "sourcesContent": ["/**\n * Work Inbox \u2014 claim-next (spec \u00A76.2: \"a one-click claim-next affordance \u2026\n * keeps frontline flow\").\n *\n * Endpoints:\n * - POST /api/workflows/work-inbox/next \u2014 claim the top claimable item\n *\n * Atomicity: the candidate list is a plain read and is expected to be stale by\n * the time it is used. The claim itself is `taskHandler.claimUserTask`, which\n * takes the row with a conditional `UPDATE \u2026 WHERE status = 'PENDING' AND\n * claimed_by IS NULL`. Two operators pressing the button at the same instant\n * therefore see the same candidate list and the loser's update affects zero\n * rows, at which point this handler moves on to the next candidate instead of\n * failing. Nothing about the claim is re-implemented here (module MUST #1).\n *\n * Phase 1 claims workflow tasks only: `taskHandler` is the claim seam for the\n * `user_task` kind, and a provider-generic claim would need each source to\n * expose a server-side claim of its own. Other kinds stay claimable through\n * their own endpoints, which the row's `actions` already advertise.\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport type { EntityManager } from '@mikro-orm/core'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { USER_TASK_INBOX_KIND } from '../../tasks/serialize'\nimport { serializeWorkInboxRow } from '../../../lib/work-inbox/provider'\nimport { parseWorkInboxQuery } from '../../../lib/work-inbox/query'\nimport { toUserTaskWorkInboxRow } from '../../../lib/work-inbox/user-task-source'\nimport type { WorkInboxService } from '../../../lib/work-inbox/service'\nimport type { TaskHandlerService } from '../../../lib/task-handler'\nimport {\n  collectScopedTaskEntityTypes,\n  resolveTaskVisibilityForRequest,\n} from '../../../lib/task-visibility-request'\nimport { UserTask } from '../../../data/entities'\nimport {\n  workflowsTag,\n  workInboxClaimNextResponseSchema,\n  workflowErrorSchema,\n} from '../../openapi'\n\nconst logger = createLogger('workflows')\n\n/** Codes that mean \"someone else got there first\" \u2014 try the next candidate. */\nconst RACE_LOST_CODES = new Set(['TASK_NOT_FOUND', 'TASK_ALREADY_ASSIGNED', 'TASK_NOT_ROLE_ASSIGNED'])\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.tasks.claim'],\n}\n\nfunction isRaceLost(error: unknown): boolean {\n  if (!error || typeof error !== 'object') return false\n  const code = (error as { code?: unknown }).code\n  return typeof code === 'string' && RACE_LOST_CODES.has(code)\n}\n\nexport async function POST(request: NextRequest) {\n  try {\n    const container = await createRequestContainer()\n    const em = container.resolve<EntityManager>('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const organizationScope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = organizationScope?.selectedId ?? auth.orgId\n\n    if (!tenantId || !organizationId) {\n      return NextResponse.json(\n        { error: 'Missing tenant or organization context' },\n        { status: 400 },\n      )\n    }\n\n    const roles = auth.roles ?? []\n    const query = parseWorkInboxQuery(new URL(request.url).searchParams, new Date())\n    const workInboxService = container.resolve<WorkInboxService>('workInboxService')\n\n    // The candidate list is a READ, so it is subject to the same \u00A76.4 rule as\n    // every other read. Claiming is gated again by `taskHandler`, which owns\n    // queue membership and the compare-and-set.\n    const organizationIds = [organizationId]\n    const visibility = await resolveTaskVisibilityForRequest({\n      container,\n      em,\n      auth: { userId: auth.sub, tenantId, roleNames: roles },\n      organizationIds,\n      aclOrganizationId: organizationId,\n      entityTypes: await collectScopedTaskEntityTypes(em, { tenantId, organizationIds }),\n    })\n\n    const candidates = await workInboxService.listClaimableWorkInbox(\n      {\n        ...query,\n        kinds: [USER_TASK_INBOX_KIND],\n        roles,\n        statuses: ['PENDING'],\n        myWork: false,\n      },\n      {\n        scope: { tenantId, organizationIds, userId: auth.sub, roles, visibility },\n        resolve: <T,>(name: string): T => container.resolve<T>(name),\n      },\n    )\n\n    const taskHandler = container.resolve<TaskHandlerService>('taskHandler')\n\n    for (const candidate of candidates) {\n      try {\n        await taskHandler.claimUserTask(\n          em,\n          candidate.id,\n          auth.sub,\n          { tenantId, organizationId },\n          roles,\n        )\n      } catch (error) {\n        if (isRaceLost(error)) continue\n        throw error\n      }\n\n      const task = await em.findOne(UserTask, { id: candidate.id, tenantId, organizationId })\n      const claimed = task ? toUserTaskWorkInboxRow(task, query.now) : candidate\n\n      return NextResponse.json({\n        data: serializeWorkInboxRow(claimed),\n        message: 'Task claimed successfully',\n      })\n    }\n\n    return NextResponse.json({ data: null, message: 'No claimable work available' })\n  } catch (error) {\n    logger.error('Error claiming the next work item', { err: error })\n    return NextResponse.json(\n      {\n        error: 'Failed to claim the next work item',\n        details: error instanceof Error ? error.message : String(error),\n      },\n      { status: 500 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'Claim the next work item',\n  methods: {\n    POST: {\n      summary: 'Claim the top claimable item from the work inbox',\n      description:\n        'Walks the caller\\'s claimable queue in inbox order and claims the first item it wins. The claim is a conditional update, so concurrent callers never receive the same item \u2014 a caller that loses the race moves on to the next candidate. Returns null data when nothing is claimable.',\n      responses: [\n        { status: 200, description: 'The claimed item, or null when nothing was claimable', schema: workInboxClaimNextResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing tenant or organization context', schema: workflowErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: workflowErrorSchema },\n        { status: 500, description: 'Internal server error', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAqBA,SAAsB,oBAAoB;AAG1C,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,oBAAoB;AAC7B,SAAS,4BAA4B;AACrC,SAAS,6BAA6B;AACtC,SAAS,2BAA2B;AACpC,SAAS,8BAA8B;AAGvC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,gBAAgB;AACzB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,WAAW;AAGvC,MAAM,kBAAkB,oBAAI,IAAI,CAAC,kBAAkB,yBAAyB,wBAAwB,CAAC;AAE9F,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,uBAAuB;AAC3C;AAEA,SAAS,WAAW,OAAyB;AAC3C,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,OAAQ,MAA6B;AAC3C,SAAO,OAAO,SAAS,YAAY,gBAAgB,IAAI,IAAI;AAC7D;AAEA,eAAsB,KAAK,SAAsB;AAC/C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAuB,IAAI;AAChD,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,oBAAoB,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AAC/F,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,mBAAmB,cAAc,KAAK;AAE7D,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,yCAAyC;AAAA,QAClD,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,QAAQ,KAAK,SAAS,CAAC;AAC7B,UAAM,QAAQ,oBAAoB,IAAI,IAAI,QAAQ,GAAG,EAAE,cAAc,oBAAI,KAAK,CAAC;AAC/E,UAAM,mBAAmB,UAAU,QAA0B,kBAAkB;AAK/E,UAAM,kBAAkB,CAAC,cAAc;AACvC,UAAM,aAAa,MAAM,gCAAgC;AAAA,MACvD;AAAA,MACA;AAAA,MACA,MAAM,EAAE,QAAQ,KAAK,KAAK,UAAU,WAAW,MAAM;AAAA,MACrD;AAAA,MACA,mBAAmB;AAAA,MACnB,aAAa,MAAM,6BAA6B,IAAI,EAAE,UAAU,gBAAgB,CAAC;AAAA,IACnF,CAAC;AAED,UAAM,aAAa,MAAM,iBAAiB;AAAA,MACxC;AAAA,QACE,GAAG;AAAA,QACH,OAAO,CAAC,oBAAoB;AAAA,QAC5B;AAAA,QACA,UAAU,CAAC,SAAS;AAAA,QACpB,QAAQ;AAAA,MACV;AAAA,MACA;AAAA,QACE,OAAO,EAAE,UAAU,iBAAiB,QAAQ,KAAK,KAAK,OAAO,WAAW;AAAA,QACxE,SAAS,CAAK,SAAoB,UAAU,QAAW,IAAI;AAAA,MAC7D;AAAA,IACF;AAEA,UAAM,cAAc,UAAU,QAA4B,aAAa;AAEvE,eAAW,aAAa,YAAY;AAClC,UAAI;AACF,cAAM,YAAY;AAAA,UAChB;AAAA,UACA,UAAU;AAAA,UACV,KAAK;AAAA,UACL,EAAE,UAAU,eAAe;AAAA,UAC3B;AAAA,QACF;AAAA,MACF,SAAS,OAAO;AACd,YAAI,WAAW,KAAK,EAAG;AACvB,cAAM;AAAA,MACR;AAEA,YAAM,OAAO,MAAM,GAAG,QAAQ,UAAU,EAAE,IAAI,UAAU,IAAI,UAAU,eAAe,CAAC;AACtF,YAAM,UAAU,OAAO,uBAAuB,MAAM,MAAM,GAAG,IAAI;AAEjE,aAAO,aAAa,KAAK;AAAA,QACvB,MAAM,sBAAsB,OAAO;AAAA,QACnC,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK,EAAE,MAAM,MAAM,SAAS,8BAA8B,CAAC;AAAA,EACjF,SAAS,OAAO;AACd,WAAO,MAAM,qCAAqC,EAAE,KAAK,MAAM,CAAC;AAChE,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,OAAO;AAAA,QACP,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAChE;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wDAAwD,QAAQ,iCAAiC;AAAA,MAC/H;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0CAA0C,QAAQ,oBAAoB;AAAA,QAClG,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/workflows/api/work-inbox/route.js

@@ -0,0 +1,119 @@
+import { NextResponse } from "next/server";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveOrganizationScopeFilter } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { serializeWorkInboxRow } from "../../lib/work-inbox/provider.js";
+import { parseWorkInboxQuery } from "../../lib/work-inbox/query.js";
+import {
+  collectScopedTaskEntityTypes,
+  resolveTaskVisibilityForRequest
+} from "../../lib/task-visibility-request.js";
+import {
+  workflowsTag,
+  workInboxListQuerySchema,
+  workInboxListResponseSchema,
+  workflowErrorSchema
+} from "../openapi.js";
+const logger = createLogger("workflows");
+const metadata = {
+  requireAuth: true,
+  requireFeatures: ["workflows.tasks.view"]
+};
+async function GET(request) {
+  try {
+    const container = await createRequestContainer();
+    const auth = await getAuthFromRequest(request);
+    if (!auth) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+    const tenantId = auth.tenantId;
+    if (!tenantId) {
+      return NextResponse.json({ error: "Missing tenant context" }, { status: 400 });
+    }
+    const organizationScope = await resolveOrganizationScopeForRequest({ container, auth, request });
+    const orgFilter = resolveOrganizationScopeFilter(organizationScope, auth);
+    const { searchParams } = new URL(request.url);
+    const query = parseWorkInboxQuery(searchParams, /* @__PURE__ */ new Date());
+    const em = container.resolve("em");
+    const organizationIds = orgFilter.organizationIds ?? null;
+    const visibility = await resolveTaskVisibilityForRequest({
+      container,
+      em,
+      auth: { userId: auth.sub, tenantId, roleNames: auth.roles ?? [] },
+      organizationIds,
+      aclOrganizationId: orgFilter.rbacOrganizationId,
+      entityTypes: await collectScopedTaskEntityTypes(em, { tenantId, organizationIds })
+    });
+    const workInboxService = container.resolve("workInboxService");
+    const result = await workInboxService.listWorkInbox(query, {
+      scope: {
+        tenantId,
+        organizationIds,
+        userId: auth.sub,
+        roles: auth.roles ?? [],
+        visibility
+      },
+      resolve: (name) => container.resolve(name)
+    });
+    const body = {
+      data: result.rows.map(serializeWorkInboxRow),
+      pagination: {
+        total: result.total,
+        limit: query.limit,
+        offset: query.offset,
+        hasMore: query.offset + result.rows.length < result.total
+      },
+      meta: {
+        kinds: result.kinds,
+        degradedKinds: result.degradedKinds
+      },
+      // Only ever populated for a caller who already knows the rows are there —
+      // a `workflows.tasks.view_all` holder or a superadmin. Its absence for
+      // everyone else discloses nothing, because the entity gate removed those
+      // rows in SQL before the query ran (design §3.6).
+      ...result.entityHidden.length > 0 ? {
+        diagnostics: {
+          entityHidden: result.entityHidden,
+          entityHiddenCount: result.entityHidden.length
+        }
+      } : {}
+    };
+    return NextResponse.json(body);
+  } catch (error) {
+    logger.error("Error listing the work inbox", { err: error });
+    return NextResponse.json(
+      {
+        error: "Failed to list the work inbox",
+        details: error instanceof Error ? error.message : String(error)
+      },
+      { status: 500 }
+    );
+  }
+}
+const openApi = {
+  tag: workflowsTag,
+  summary: "Work inbox",
+  methods: {
+    GET: {
+      summary: "List work items across every registered source",
+      description: "Merges every registered work-inbox source (workflow user tasks, plus any module that registers a provider) into one queue, filtered by kind/module/entity type/role/priority/status/overdue and ordered by priority, then due date, then age.",
+      query: workInboxListQuerySchema,
+      responses: [
+        { status: 200, description: "Merged work items with pagination", schema: workInboxListResponseSchema }
+      ],
+      errors: [
+        { status: 400, description: "Missing tenant context", schema: workflowErrorSchema },
+        { status: 401, description: "Unauthorized", schema: workflowErrorSchema },
+        { status: 500, description: "Internal server error", schema: workflowErrorSchema }
+      ]
+    }
+  }
+};
+export {
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/workflows/api/work-inbox/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/workflows/api/work-inbox/route.ts"],
+  "sourcesContent": ["/**\n * Work Inbox API \u2014 one queue over every registered source (spec \u00A76.2/\u00A76.3).\n *\n * Endpoints:\n * - GET /api/workflows/work-inbox \u2014 merged, filtered, ordered work items\n *\n * `GET /api/workflows/tasks` is deliberately left untouched: new routes are free\n * (BACKWARD_COMPATIBILITY.md \u00A77) but removing a shipped one is not, and the\n * task list is still what a third party integrates against.\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport type { EntityManager } from '@mikro-orm/core'\nimport type { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveOrganizationScopeFilter } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { serializeWorkInboxRow } from '../../lib/work-inbox/provider'\nimport { parseWorkInboxQuery } from '../../lib/work-inbox/query'\nimport type { WorkInboxService } from '../../lib/work-inbox/service'\nimport {\n  collectScopedTaskEntityTypes,\n  resolveTaskVisibilityForRequest,\n} from '../../lib/task-visibility-request'\nimport {\n  workflowsTag,\n  workInboxListQuerySchema,\n  workInboxListResponseSchema,\n  workflowErrorSchema,\n} from '../openapi'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.tasks.view'],\n}\n\n/**\n * GET /api/workflows/work-inbox\n *\n * Query params: kind, module, entityType, role, priority, status, overdue,\n * myWork (alias myTasks), assignedTo, workflowInstanceId, limit (max 100),\n * offset.\n */\nexport async function GET(request: NextRequest) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const tenantId = auth.tenantId\n    if (!tenantId) {\n      return NextResponse.json({ error: 'Missing tenant context' }, { status: 400 })\n    }\n\n    const organizationScope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const orgFilter = resolveOrganizationScopeFilter(organizationScope, auth)\n\n    const { searchParams } = new URL(request.url)\n    const query = parseWorkInboxQuery(searchParams, new Date())\n\n    // \u00A76.4, resolved ONCE for the whole merged page: one ACL load, one entity\n    // classification pass, one tenant-setting read, whatever a source does with\n    // it.\n    const em = container.resolve<EntityManager>('em')\n    const organizationIds = orgFilter.organizationIds ?? null\n    const visibility = await resolveTaskVisibilityForRequest({\n      container,\n      em,\n      auth: { userId: auth.sub, tenantId, roleNames: auth.roles ?? [] },\n      organizationIds,\n      aclOrganizationId: orgFilter.rbacOrganizationId,\n      entityTypes: await collectScopedTaskEntityTypes(em, { tenantId, organizationIds }),\n    })\n\n    const workInboxService = container.resolve<WorkInboxService>('workInboxService')\n    const result = await workInboxService.listWorkInbox(query, {\n      scope: {\n        tenantId,\n        organizationIds,\n        userId: auth.sub,\n        roles: auth.roles ?? [],\n        visibility,\n      },\n      resolve: <T,>(name: string): T => container.resolve<T>(name),\n    })\n\n    const body: z.infer<typeof workInboxListResponseSchema> = {\n      data: result.rows.map(serializeWorkInboxRow),\n      pagination: {\n        total: result.total,\n        limit: query.limit,\n        offset: query.offset,\n        hasMore: query.offset + result.rows.length < result.total,\n      },\n      meta: {\n        kinds: result.kinds,\n        degradedKinds: result.degradedKinds,\n      },\n      // Only ever populated for a caller who already knows the rows are there \u2014\n      // a `workflows.tasks.view_all` holder or a superadmin. Its absence for\n      // everyone else discloses nothing, because the entity gate removed those\n      // rows in SQL before the query ran (design \u00A73.6).\n      ...(result.entityHidden.length > 0\n        ? {\n            diagnostics: {\n              entityHidden: result.entityHidden,\n              entityHiddenCount: result.entityHidden.length,\n            },\n          }\n        : {}),\n    }\n\n    return NextResponse.json(body)\n  } catch (error) {\n    logger.error('Error listing the work inbox', { err: error })\n    return NextResponse.json(\n      {\n        error: 'Failed to list the work inbox',\n        details: error instanceof Error ? error.message : String(error),\n      },\n      { status: 500 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'Work inbox',\n  methods: {\n    GET: {\n      summary: 'List work items across every registered source',\n      description:\n        'Merges every registered work-inbox source (workflow user tasks, plus any module that registers a provider) into one queue, filtered by kind/module/entity type/role/priority/status/overdue and ordered by priority, then due date, then age.',\n      query: workInboxListQuerySchema,\n      responses: [\n        { status: 200, description: 'Merged work items with pagination', schema: workInboxListResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing tenant context', schema: workflowErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: workflowErrorSchema },\n        { status: 500, description: 'Internal server error', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAWA,SAAsB,oBAAoB;AAI1C,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,sCAAsC;AAC/C,SAAS,oBAAoB;AAC7B,SAAS,6BAA6B;AACtC,SAAS,2BAA2B;AAEpC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,sBAAsB;AAC1C;AASA,eAAsB,IAAI,SAAsB;AAC9C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,WAAW,KAAK;AACtB,QAAI,CAAC,UAAU;AACb,aAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/E;AAEA,UAAM,oBAAoB,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AAC/F,UAAM,YAAY,+BAA+B,mBAAmB,IAAI;AAExE,UAAM,EAAE,aAAa,IAAI,IAAI,IAAI,QAAQ,GAAG;AAC5C,UAAM,QAAQ,oBAAoB,cAAc,oBAAI,KAAK,CAAC;AAK1D,UAAM,KAAK,UAAU,QAAuB,IAAI;AAChD,UAAM,kBAAkB,UAAU,mBAAmB;AACrD,UAAM,aAAa,MAAM,gCAAgC;AAAA,MACvD;AAAA,MACA;AAAA,MACA,MAAM,EAAE,QAAQ,KAAK,KAAK,UAAU,WAAW,KAAK,SAAS,CAAC,EAAE;AAAA,MAChE;AAAA,MACA,mBAAmB,UAAU;AAAA,MAC7B,aAAa,MAAM,6BAA6B,IAAI,EAAE,UAAU,gBAAgB,CAAC;AAAA,IACnF,CAAC;AAED,UAAM,mBAAmB,UAAU,QAA0B,kBAAkB;AAC/E,UAAM,SAAS,MAAM,iBAAiB,cAAc,OAAO;AAAA,MACzD,OAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA,QAAQ,KAAK;AAAA,QACb,OAAO,KAAK,SAAS,CAAC;AAAA,QACtB;AAAA,MACF;AAAA,MACA,SAAS,CAAK,SAAoB,UAAU,QAAW,IAAI;AAAA,IAC7D,CAAC;AAED,UAAM,OAAoD;AAAA,MACxD,MAAM,OAAO,KAAK,IAAI,qBAAqB;AAAA,MAC3C,YAAY;AAAA,QACV,OAAO,OAAO;AAAA,QACd,OAAO,MAAM;AAAA,QACb,QAAQ,MAAM;AAAA,QACd,SAAS,MAAM,SAAS,OAAO,KAAK,SAAS,OAAO;AAAA,MACtD;AAAA,MACA,MAAM;AAAA,QACJ,OAAO,OAAO;AAAA,QACd,eAAe,OAAO;AAAA,MACxB;AAAA;AAAA;AAAA;AAAA;AAAA,MAKA,GAAI,OAAO,aAAa,SAAS,IAC7B;AAAA,QACE,aAAa;AAAA,UACX,cAAc,OAAO;AAAA,UACrB,mBAAmB,OAAO,aAAa;AAAA,QACzC;AAAA,MACF,IACA,CAAC;AAAA,IACP;AAEA,WAAO,aAAa,KAAK,IAAI;AAAA,EAC/B,SAAS,OAAO;AACd,WAAO,MAAM,gCAAgC,EAAE,KAAK,MAAM,CAAC;AAC3D,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,OAAO;AAAA,QACP,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAChE;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,qCAAqC,QAAQ,4BAA4B;AAAA,MACvG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,oBAAoB;AAAA,QAClF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/workflows/backend/config/workflows/page.js

@@ -0,0 +1,10 @@
+import { jsx } from "react/jsx-runtime";
+import { Page, PageBody } from "@open-mercato/ui/backend/Page";
+import { CommandSettingsPageClient } from "../../../components/settings/CommandSettingsPageClient.js";
+async function WorkflowCommandSettingsPage() {
+  return /* @__PURE__ */ jsx(Page, { children: /* @__PURE__ */ jsx(PageBody, { children: /* @__PURE__ */ jsx(CommandSettingsPageClient, {}) }) });
+}
+export {
+  WorkflowCommandSettingsPage as default
+};
+//# sourceMappingURL=page.js.map

package/dist/modules/workflows/backend/config/workflows/page.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/workflows/backend/config/workflows/page.tsx"],
+  "sourcesContent": ["import { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { CommandSettingsPageClient } from '../../../components/settings/CommandSettingsPageClient'\n\nexport default async function WorkflowCommandSettingsPage() {\n  return (\n    <Page>\n      <PageBody>\n        <CommandSettingsPageClient />\n      </PageBody>\n    </Page>\n  )\n}\n"],
+  "mappings": "AAOQ;AAPR,SAAS,MAAM,gBAAgB;AAC/B,SAAS,iCAAiC;AAE1C,eAAO,8BAAqD;AAC1D,SACE,oBAAC,QACC,8BAAC,YACC,8BAAC,6BAA0B,GAC7B,GACF;AAEJ;",
+  "names": []
+}

package/dist/modules/workflows/backend/config/workflows/page.meta.js

@@ -0,0 +1,35 @@
+import React from "react";
+const workflowCommandsIcon = React.createElement(
+  "svg",
+  {
+    width: 16,
+    height: 16,
+    viewBox: "0 0 24 24",
+    fill: "none",
+    stroke: "currentColor",
+    strokeWidth: 2,
+    strokeLinecap: "round",
+    strokeLinejoin: "round"
+  },
+  React.createElement("rect", { x: 3, y: 3, width: 7, height: 7, rx: 1 }),
+  React.createElement("rect", { x: 14, y: 14, width: 7, height: 7, rx: 1 }),
+  React.createElement("path", { d: "M10 6.5h4a3 3 0 0 1 3 3V14" })
+);
+const metadata = {
+  requireAuth: true,
+  // Reading the posture rides on definition authoring; the PUT behind this page
+  // is gated separately on `workflows.manage` by the API route.
+  requireFeatures: ["workflows.definitions.view"],
+  pageTitle: "Workflow Commands",
+  pageTitleKey: "workflows.commandSettings.pageTitle",
+  pageGroup: "Module Configs",
+  pageGroupKey: "settings.sections.moduleConfigs",
+  pageOrder: 12,
+  icon: workflowCommandsIcon,
+  pageContext: "settings",
+  breadcrumb: [{ label: "Workflow Commands", labelKey: "workflows.commandSettings.pageTitle" }]
+};
+export {
+  metadata
+};
+//# sourceMappingURL=page.meta.js.map

package/dist/modules/workflows/backend/config/workflows/page.meta.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/workflows/backend/config/workflows/page.meta.ts"],
+  "sourcesContent": ["import React from 'react'\n\nconst workflowCommandsIcon = React.createElement(\n  'svg',\n  {\n    width: 16,\n    height: 16,\n    viewBox: '0 0 24 24',\n    fill: 'none',\n    stroke: 'currentColor',\n    strokeWidth: 2,\n    strokeLinecap: 'round',\n    strokeLinejoin: 'round',\n  },\n  React.createElement('rect', { x: 3, y: 3, width: 7, height: 7, rx: 1 }),\n  React.createElement('rect', { x: 14, y: 14, width: 7, height: 7, rx: 1 }),\n  React.createElement('path', { d: 'M10 6.5h4a3 3 0 0 1 3 3V14' }),\n)\n\nexport const metadata = {\n  requireAuth: true,\n  // Reading the posture rides on definition authoring; the PUT behind this page\n  // is gated separately on `workflows.manage` by the API route.\n  requireFeatures: ['workflows.definitions.view'],\n  pageTitle: 'Workflow Commands',\n  pageTitleKey: 'workflows.commandSettings.pageTitle',\n  pageGroup: 'Module Configs',\n  pageGroupKey: 'settings.sections.moduleConfigs',\n  pageOrder: 12,\n  icon: workflowCommandsIcon,\n  pageContext: 'settings' as const,\n  breadcrumb: [{ label: 'Workflow Commands', labelKey: 'workflows.commandSettings.pageTitle' }],\n} as const\n"],
+  "mappings": "AAAA,OAAO,WAAW;AAElB,MAAM,uBAAuB,MAAM;AAAA,EACjC;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,eAAe;AAAA,IACf,gBAAgB;AAAA,EAClB;AAAA,EACA,MAAM,cAAc,QAAQ,EAAE,GAAG,GAAG,GAAG,GAAG,OAAO,GAAG,QAAQ,GAAG,IAAI,EAAE,CAAC;AAAA,EACtE,MAAM,cAAc,QAAQ,EAAE,GAAG,IAAI,GAAG,IAAI,OAAO,GAAG,QAAQ,GAAG,IAAI,EAAE,CAAC;AAAA,EACxE,MAAM,cAAc,QAAQ,EAAE,GAAG,6BAA6B,CAAC;AACjE;AAEO,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA;AAAA;AAAA,EAGb,iBAAiB,CAAC,4BAA4B;AAAA,EAC9C,WAAW;AAAA,EACX,cAAc;AAAA,EACd,WAAW;AAAA,EACX,cAAc;AAAA,EACd,WAAW;AAAA,EACX,MAAM;AAAA,EACN,aAAa;AAAA,EACb,YAAY,CAAC,EAAE,OAAO,qBAAqB,UAAU,sCAAsC,CAAC;AAC9F;",
+  "names": []
+}