@open-mercato/core 0.7.1-develop.7193.1.910a5b0a1e → 0.7.1-develop.7194.1.ab4fc81f82

package/dist/modules/workflows/lib/definition-context-schema.js

@@ -0,0 +1,56 @@
+import { getDeclaredEvents } from "@open-mercato/shared/modules/events";
+import { WorkflowDefinition } from "../data/entities.js";
+import {
+  buildTriggerPayloadContracts,
+  computeContextLedger
+} from "./context-ledger.js";
+import { ensureWorkflowEndpointCatalog } from "./endpoint-catalog.js";
+import {
+  ensureWorkflowAgentOutcomeContracts,
+  resolveServerOutputContract
+} from "./server-output-contract.js";
+import { getCodeWorkflow, getAllCodeWorkflows } from "./code-registry.js";
+import { codeWorkflowUuid } from "./find-definition.js";
+async function warmContextLedgerResolvers(container) {
+  await ensureWorkflowEndpointCatalog();
+  await ensureWorkflowAgentOutcomeContracts(container);
+}
+function computeDefinitionContextLedger(definition) {
+  const ledgerDefinition = definition;
+  return computeContextLedger(ledgerDefinition, {
+    resolveOutputContract: resolveServerOutputContract,
+    triggerPayloadContracts: buildTriggerPayloadContracts(
+      ledgerDefinition.triggers ?? [],
+      getDeclaredEvents()
+    )
+  });
+}
+function narrowLedgerToStep(ledger, stepId) {
+  return ledger.steps[stepId] ?? null;
+}
+async function resolveDefinitionDataForLedger(em, id, scope) {
+  if (id.startsWith("code:")) {
+    const codeDef2 = getCodeWorkflow(id.slice(5));
+    if (!codeDef2) return null;
+    return codeDef2.definition;
+  }
+  const definition = await em.findOne(WorkflowDefinition, {
+    id,
+    tenantId: scope.tenantId,
+    ...scope.organizationWhere,
+    deletedAt: null
+  });
+  if (definition) return definition.definition;
+  const codeDef = getAllCodeWorkflows().find(
+    (workflow) => codeWorkflowUuid(workflow.workflowId) === id
+  );
+  if (codeDef) return codeDef.definition;
+  return null;
+}
+export {
+  computeDefinitionContextLedger,
+  narrowLedgerToStep,
+  resolveDefinitionDataForLedger,
+  warmContextLedgerResolvers
+};
+//# sourceMappingURL=definition-context-schema.js.map

package/dist/modules/workflows/lib/definition-context-schema.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/workflows/lib/definition-context-schema.ts"],
+  "sourcesContent": ["/**\n * Shared context-ledger resolution for a workflow definition.\n *\n * Extracted verbatim from `api/definitions/[id]/context-schema/route.ts` so the\n * REST route and the `workflows.get_context_schema` AI tool serve the SAME\n * ledger from the SAME id forms. The output-contract seam stays single-sourced:\n * both callers reach `resolveServerOutputContract` through\n * {@link computeDefinitionContextLedger} and never resolve contracts a second\n * way (the browser editor deliberately pins the seam to `'unknown'` and\n * consumes this response instead).\n */\n\nimport type { EntityManager } from '@mikro-orm/core'\nimport { getDeclaredEvents } from '@open-mercato/shared/modules/events'\nimport { WorkflowDefinition, type WorkflowDefinitionData } from '../data/entities'\nimport {\n  buildTriggerPayloadContracts,\n  computeContextLedger,\n  type ContextLedger,\n  type LedgerStepView,\n  type LedgerWorkflowDefinition,\n} from './context-ledger'\nimport { ensureWorkflowEndpointCatalog } from './endpoint-catalog'\nimport {\n  ensureWorkflowAgentOutcomeContracts,\n  resolveServerOutputContract,\n} from './server-output-contract'\nimport { getCodeWorkflow, getAllCodeWorkflows } from './code-registry'\nimport { codeWorkflowUuid } from './find-definition'\n\nexport type DefinitionLookupScope = {\n  tenantId: string\n  /**\n   * Organization where-clause fragment. The route passes\n   * `resolveOrganizationScopeFilter(...).where`; other callers pass\n   * `{ organizationId }` (or `{}` when the caller is tenant-wide).\n   */\n  organizationWhere: Record<string, unknown>\n}\n\n/**\n * Warm the two sync-lookup caches the server output-contract seam reads.\n * MUST run before {@link computeDefinitionContextLedger} or CALL_API and\n * INVOKE_AGENT contracts silently degrade to `'unknown'`.\n */\nexport async function warmContextLedgerResolvers(container: {\n  resolve: <T>(name: string) => T\n}): Promise<void> {\n  await ensureWorkflowEndpointCatalog()\n  await ensureWorkflowAgentOutcomeContracts(container)\n}\n\nexport function computeDefinitionContextLedger(definition: WorkflowDefinitionData): ContextLedger {\n  const ledgerDefinition = definition as unknown as LedgerWorkflowDefinition\n  return computeContextLedger(ledgerDefinition, {\n    resolveOutputContract: resolveServerOutputContract,\n    triggerPayloadContracts: buildTriggerPayloadContracts(\n      ledgerDefinition.triggers ?? [],\n      getDeclaredEvents(),\n    ),\n  })\n}\n\nexport function narrowLedgerToStep(ledger: ContextLedger, stepId: string): LedgerStepView | null {\n  return ledger.steps[stepId] ?? null\n}\n\n/**\n * Resolve a definition's `definition` JSON from any of the three id forms the\n * context-schema route accepts: `code:<workflowId>`, a tenant/org-scoped DB\n * UUID, and the synthetic `codeWorkflowUuid(workflowId)` fallback.\n *\n * Tenant scoping is not optional \u2014 a definition outside `scope.tenantId` is\n * INVISIBLE (returns `null`, indistinguishable from \"does not exist\"), never\n * merely unauthorized.\n */\nexport async function resolveDefinitionDataForLedger(\n  em: EntityManager,\n  id: string,\n  scope: DefinitionLookupScope,\n): Promise<WorkflowDefinitionData | null> {\n  if (id.startsWith('code:')) {\n    const codeDef = getCodeWorkflow(id.slice(5))\n    if (!codeDef) return null\n    return codeDef.definition as unknown as WorkflowDefinitionData\n  }\n\n  const definition = (await em.findOne(WorkflowDefinition, {\n    id,\n    tenantId: scope.tenantId,\n    ...scope.organizationWhere,\n    deletedAt: null,\n  })) as WorkflowDefinition | null\n\n  if (definition) return definition.definition\n\n  const codeDef = getAllCodeWorkflows().find(\n    (workflow) => codeWorkflowUuid(workflow.workflowId) === id,\n  )\n  if (codeDef) return codeDef.definition as unknown as WorkflowDefinitionData\n\n  return null\n}\n"],
+  "mappings": "AAaA,SAAS,yBAAyB;AAClC,SAAS,0BAAuD;AAChE;AAAA,EACE;AAAA,EACA;AAAA,OAIK;AACP,SAAS,qCAAqC;AAC9C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,iBAAiB,2BAA2B;AACrD,SAAS,wBAAwB;AAiBjC,eAAsB,2BAA2B,WAE/B;AAChB,QAAM,8BAA8B;AACpC,QAAM,oCAAoC,SAAS;AACrD;AAEO,SAAS,+BAA+B,YAAmD;AAChG,QAAM,mBAAmB;AACzB,SAAO,qBAAqB,kBAAkB;AAAA,IAC5C,uBAAuB;AAAA,IACvB,yBAAyB;AAAA,MACvB,iBAAiB,YAAY,CAAC;AAAA,MAC9B,kBAAkB;AAAA,IACpB;AAAA,EACF,CAAC;AACH;AAEO,SAAS,mBAAmB,QAAuB,QAAuC;AAC/F,SAAO,OAAO,MAAM,MAAM,KAAK;AACjC;AAWA,eAAsB,+BACpB,IACA,IACA,OACwC;AACxC,MAAI,GAAG,WAAW,OAAO,GAAG;AAC1B,UAAMA,WAAU,gBAAgB,GAAG,MAAM,CAAC,CAAC;AAC3C,QAAI,CAACA,SAAS,QAAO;AACrB,WAAOA,SAAQ;AAAA,EACjB;AAEA,QAAM,aAAc,MAAM,GAAG,QAAQ,oBAAoB;AAAA,IACvD;AAAA,IACA,UAAU,MAAM;AAAA,IAChB,GAAG,MAAM;AAAA,IACT,WAAW;AAAA,EACb,CAAC;AAED,MAAI,WAAY,QAAO,WAAW;AAElC,QAAM,UAAU,oBAAoB,EAAE;AAAA,IACpC,CAAC,aAAa,iBAAiB,SAAS,UAAU,MAAM;AAAA,EAC1D;AACA,MAAI,QAAS,QAAO,QAAQ;AAE5B,SAAO;AACT;",
+  "names": ["codeDef"]
+}

package/dist/modules/workflows/lib/definition-edit-safety.js

@@ -0,0 +1,123 @@
+const ACTIVE_WORKFLOW_INSTANCE_STATUSES = [
+  "RUNNING",
+  "PAUSED",
+  "WAITING_FOR_ACTIVITIES",
+  "FORKED",
+  "COMPENSATING"
+];
+const STRUCTURAL_EDIT_CONFLICT_CODE = "WORKFLOW_STRUCTURAL_EDIT_REQUIRES_NEW_VERSION";
+function asRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+}
+function asArray(value) {
+  return Array.isArray(value) ? value : [];
+}
+function readString(source, key) {
+  const value = source[key];
+  return typeof value === "string" && value.length > 0 ? value : null;
+}
+function stepSignatures(definition) {
+  const signatures = /* @__PURE__ */ new Map();
+  const document = asRecord(definition);
+  if (!document) return signatures;
+  for (const entry of asArray(document.steps)) {
+    const step = asRecord(entry);
+    if (!step) continue;
+    const stepId = readString(step, "stepId");
+    if (!stepId) continue;
+    const config = asRecord(step.config);
+    signatures.set(stepId, {
+      stepType: readString(step, "stepType") ?? "",
+      joinStepId: config ? readString(config, "joinStepId") : null,
+      forkStepId: config ? readString(config, "forkStepId") : null
+    });
+  }
+  return signatures;
+}
+function transitionSignatures(definition) {
+  const signatures = /* @__PURE__ */ new Map();
+  const document = asRecord(definition);
+  if (!document) return signatures;
+  for (const entry of asArray(document.transitions)) {
+    const transition = asRecord(entry);
+    if (!transition) continue;
+    const transitionId = readString(transition, "transitionId");
+    if (!transitionId) continue;
+    signatures.set(transitionId, {
+      fromStepId: readString(transition, "fromStepId") ?? "",
+      toStepId: readString(transition, "toStepId") ?? "",
+      kind: readString(transition, "kind") ?? "normal"
+    });
+  }
+  return signatures;
+}
+function diffDefinitionStructure(previous, next) {
+  const changes = [];
+  const previousSteps = stepSignatures(previous);
+  const nextSteps = stepSignatures(next);
+  for (const [stepId, signature] of nextSteps) {
+    const before = previousSteps.get(stepId);
+    if (!before) {
+      changes.push({ kind: "stepAdded", id: stepId });
+      continue;
+    }
+    if (before.stepType !== signature.stepType) {
+      changes.push({ kind: "stepTypeChanged", id: stepId });
+      continue;
+    }
+    if (before.joinStepId !== signature.joinStepId || before.forkStepId !== signature.forkStepId) {
+      changes.push({ kind: "stepWiringChanged", id: stepId });
+    }
+  }
+  for (const stepId of previousSteps.keys()) {
+    if (!nextSteps.has(stepId)) changes.push({ kind: "stepRemoved", id: stepId });
+  }
+  const previousTransitions = transitionSignatures(previous);
+  const nextTransitions = transitionSignatures(next);
+  for (const [transitionId, signature] of nextTransitions) {
+    const before = previousTransitions.get(transitionId);
+    if (!before) {
+      changes.push({ kind: "transitionAdded", id: transitionId });
+      continue;
+    }
+    if (before.fromStepId !== signature.fromStepId || before.toStepId !== signature.toStepId) {
+      changes.push({ kind: "transitionRetargeted", id: transitionId });
+      continue;
+    }
+    if (before.kind !== signature.kind) {
+      changes.push({ kind: "transitionKindChanged", id: transitionId });
+    }
+  }
+  for (const transitionId of previousTransitions.keys()) {
+    if (!nextTransitions.has(transitionId)) {
+      changes.push({ kind: "transitionRemoved", id: transitionId });
+    }
+  }
+  return changes;
+}
+function isStructuralDefinitionChange(previous, next) {
+  return diffDefinitionStructure(previous, next).length > 0;
+}
+function buildStructuralEditConflictBody(params) {
+  return {
+    error: "Structural changes require a new version while instances are still running",
+    code: STRUCTURAL_EDIT_CONFLICT_CODE,
+    definitionId: params.definitionId,
+    activeInstanceCount: params.activeInstanceCount,
+    activeStatuses: ACTIVE_WORKFLOW_INSTANCE_STATUSES,
+    changes: params.changes,
+    remedy: {
+      action: "createVersion",
+      method: "POST",
+      endpoint: `/api/workflows/definitions/${params.definitionId}/publish`
+    }
+  };
+}
+export {
+  ACTIVE_WORKFLOW_INSTANCE_STATUSES,
+  STRUCTURAL_EDIT_CONFLICT_CODE,
+  buildStructuralEditConflictBody,
+  diffDefinitionStructure,
+  isStructuralDefinitionChange
+};
+//# sourceMappingURL=definition-edit-safety.js.map

package/dist/modules/workflows/lib/definition-edit-safety.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/workflows/lib/definition-edit-safety.ts"],
+  "sourcesContent": ["/**\n * Workflows Module \u2014 Edit-safety rule for definitions with active instances (pure)\n *\n * Spec \u00A74.1: \"structural edits to a definition with active instances require a\n * new version (running instances keep executing their pinned definition\n * snapshot)\u2026 Re-pointing an edge under a running instance must be impossible,\n * not merely discouraged.\"\n *\n * A `WorkflowInstance` pins `definitionId` \u2014 a specific `(workflowId, version,\n * tenantId)` row \u2014 and the engine re-reads that row on every advance, so a PUT\n * that rewrites the row's `definition` JSONB changes what a running instance\n * executes mid-flight. This module answers the one question the definition PUT\n * needs before it writes: does the incoming definition change the topology the\n * engine navigates?\n *\n * Topology means the parts a mid-flight instance resolves against: which steps\n * exist and what type they are, how forks and joins pair up, and which routes\n * exist with which endpoints. Labels, descriptions, editor positions, activity\n * config, conditions, priorities, triggers and metadata are deliberately NOT\n * structural \u2014 authors must never be blocked from cosmetic or config edits.\n *\n * PURE: no ORM, no DI, no React. The caller supplies both definition documents.\n */\n\nimport type { WorkflowInstanceStatus } from '../data/entities'\n\n/**\n * Instance statuses that still execute (or still resolve) their pinned\n * definition row. `COMPENSATING` is included: the saga walks the definition's\n * activities in reverse, so a topology rewrite corrupts it exactly like a\n * running instance. Terminal statuses (`COMPLETED`, `FAILED`, `CANCELLED`,\n * `COMPENSATED`) never read the definition again and never block an edit.\n */\nexport const ACTIVE_WORKFLOW_INSTANCE_STATUSES: readonly WorkflowInstanceStatus[] = [\n  'RUNNING',\n  'PAUSED',\n  'WAITING_FOR_ACTIVITIES',\n  'FORKED',\n  'COMPENSATING',\n]\n\n/** Machine-readable marker on the 409 body so clients can offer \"Create version\". */\nexport const STRUCTURAL_EDIT_CONFLICT_CODE = 'WORKFLOW_STRUCTURAL_EDIT_REQUIRES_NEW_VERSION'\n\nexport type StructuralChangeKind =\n  | 'stepAdded'\n  | 'stepRemoved'\n  | 'stepTypeChanged'\n  | 'stepWiringChanged'\n  | 'transitionAdded'\n  | 'transitionRemoved'\n  | 'transitionRetargeted'\n  | 'transitionKindChanged'\n\nexport interface StructuralChange {\n  kind: StructuralChangeKind\n  /** `stepId` for step changes, `transitionId` for route changes. */\n  id: string\n}\n\nexport interface StructuralEditConflictBody {\n  error: string\n  code: typeof STRUCTURAL_EDIT_CONFLICT_CODE\n  definitionId: string\n  activeInstanceCount: number\n  activeStatuses: readonly WorkflowInstanceStatus[]\n  changes: StructuralChange[]\n  remedy: {\n    action: 'createVersion'\n    method: 'POST'\n    endpoint: string\n  }\n}\n\ninterface StepSignature {\n  stepType: string\n  joinStepId: string | null\n  forkStepId: string | null\n}\n\ninterface TransitionSignature {\n  fromStepId: string\n  toStepId: string\n  kind: string\n}\n\nfunction asRecord(value: unknown): Record<string, unknown> | null {\n  return typeof value === 'object' && value !== null && !Array.isArray(value)\n    ? (value as Record<string, unknown>)\n    : null\n}\n\nfunction asArray(value: unknown): unknown[] {\n  return Array.isArray(value) ? value : []\n}\n\nfunction readString(source: Record<string, unknown>, key: string): string | null {\n  const value = source[key]\n  return typeof value === 'string' && value.length > 0 ? value : null\n}\n\nfunction stepSignatures(definition: unknown): Map<string, StepSignature> {\n  const signatures = new Map<string, StepSignature>()\n  const document = asRecord(definition)\n  if (!document) return signatures\n\n  for (const entry of asArray(document.steps)) {\n    const step = asRecord(entry)\n    if (!step) continue\n    const stepId = readString(step, 'stepId')\n    if (!stepId) continue\n    const config = asRecord(step.config)\n    signatures.set(stepId, {\n      stepType: readString(step, 'stepType') ?? '',\n      joinStepId: config ? readString(config, 'joinStepId') : null,\n      forkStepId: config ? readString(config, 'forkStepId') : null,\n    })\n  }\n\n  return signatures\n}\n\nfunction transitionSignatures(definition: unknown): Map<string, TransitionSignature> {\n  const signatures = new Map<string, TransitionSignature>()\n  const document = asRecord(definition)\n  if (!document) return signatures\n\n  for (const entry of asArray(document.transitions)) {\n    const transition = asRecord(entry)\n    if (!transition) continue\n    const transitionId = readString(transition, 'transitionId')\n    if (!transitionId) continue\n    signatures.set(transitionId, {\n      fromStepId: readString(transition, 'fromStepId') ?? '',\n      toStepId: readString(transition, 'toStepId') ?? '',\n      kind: readString(transition, 'kind') ?? 'normal',\n    })\n  }\n\n  return signatures\n}\n\n/**\n * Diff the execution topology of two definition documents.\n *\n * Order is deterministic without sorting: step changes in `next` order, then\n * removals in `previous` order, then the same for transitions.\n */\nexport function diffDefinitionStructure(previous: unknown, next: unknown): StructuralChange[] {\n  const changes: StructuralChange[] = []\n\n  const previousSteps = stepSignatures(previous)\n  const nextSteps = stepSignatures(next)\n\n  for (const [stepId, signature] of nextSteps) {\n    const before = previousSteps.get(stepId)\n    if (!before) {\n      changes.push({ kind: 'stepAdded', id: stepId })\n      continue\n    }\n    if (before.stepType !== signature.stepType) {\n      changes.push({ kind: 'stepTypeChanged', id: stepId })\n      continue\n    }\n    if (before.joinStepId !== signature.joinStepId || before.forkStepId !== signature.forkStepId) {\n      changes.push({ kind: 'stepWiringChanged', id: stepId })\n    }\n  }\n\n  for (const stepId of previousSteps.keys()) {\n    if (!nextSteps.has(stepId)) changes.push({ kind: 'stepRemoved', id: stepId })\n  }\n\n  const previousTransitions = transitionSignatures(previous)\n  const nextTransitions = transitionSignatures(next)\n\n  for (const [transitionId, signature] of nextTransitions) {\n    const before = previousTransitions.get(transitionId)\n    if (!before) {\n      changes.push({ kind: 'transitionAdded', id: transitionId })\n      continue\n    }\n    if (before.fromStepId !== signature.fromStepId || before.toStepId !== signature.toStepId) {\n      changes.push({ kind: 'transitionRetargeted', id: transitionId })\n      continue\n    }\n    if (before.kind !== signature.kind) {\n      changes.push({ kind: 'transitionKindChanged', id: transitionId })\n    }\n  }\n\n  for (const transitionId of previousTransitions.keys()) {\n    if (!nextTransitions.has(transitionId)) {\n      changes.push({ kind: 'transitionRemoved', id: transitionId })\n    }\n  }\n\n  return changes\n}\n\n/** True when the incoming definition changes the topology the engine navigates. */\nexport function isStructuralDefinitionChange(previous: unknown, next: unknown): boolean {\n  return diffDefinitionStructure(previous, next).length > 0\n}\n\n/**\n * Structured 409 body. It names the remedy explicitly so the Studio can offer a\n * one-click \"Create version\" instead of leaving the author with a dead end.\n */\nexport function buildStructuralEditConflictBody(params: {\n  definitionId: string\n  activeInstanceCount: number\n  changes: StructuralChange[]\n}): StructuralEditConflictBody {\n  return {\n    error: 'Structural changes require a new version while instances are still running',\n    code: STRUCTURAL_EDIT_CONFLICT_CODE,\n    definitionId: params.definitionId,\n    activeInstanceCount: params.activeInstanceCount,\n    activeStatuses: ACTIVE_WORKFLOW_INSTANCE_STATUSES,\n    changes: params.changes,\n    remedy: {\n      action: 'createVersion',\n      method: 'POST',\n      endpoint: `/api/workflows/definitions/${params.definitionId}/publish`,\n    },\n  }\n}\n"],
+  "mappings": "AAiCO,MAAM,oCAAuE;AAAA,EAClF;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,MAAM,gCAAgC;AA4C7C,SAAS,SAAS,OAAgD;AAChE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK,IACrE,QACD;AACN;AAEA,SAAS,QAAQ,OAA2B;AAC1C,SAAO,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC;AACzC;AAEA,SAAS,WAAW,QAAiC,KAA4B;AAC/E,QAAM,QAAQ,OAAO,GAAG;AACxB,SAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ;AACjE;AAEA,SAAS,eAAe,YAAiD;AACvE,QAAM,aAAa,oBAAI,IAA2B;AAClD,QAAM,WAAW,SAAS,UAAU;AACpC,MAAI,CAAC,SAAU,QAAO;AAEtB,aAAW,SAAS,QAAQ,SAAS,KAAK,GAAG;AAC3C,UAAM,OAAO,SAAS,KAAK;AAC3B,QAAI,CAAC,KAAM;AACX,UAAM,SAAS,WAAW,MAAM,QAAQ;AACxC,QAAI,CAAC,OAAQ;AACb,UAAM,SAAS,SAAS,KAAK,MAAM;AACnC,eAAW,IAAI,QAAQ;AAAA,MACrB,UAAU,WAAW,MAAM,UAAU,KAAK;AAAA,MAC1C,YAAY,SAAS,WAAW,QAAQ,YAAY,IAAI;AAAA,MACxD,YAAY,SAAS,WAAW,QAAQ,YAAY,IAAI;AAAA,IAC1D,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAEA,SAAS,qBAAqB,YAAuD;AACnF,QAAM,aAAa,oBAAI,IAAiC;AACxD,QAAM,WAAW,SAAS,UAAU;AACpC,MAAI,CAAC,SAAU,QAAO;AAEtB,aAAW,SAAS,QAAQ,SAAS,WAAW,GAAG;AACjD,UAAM,aAAa,SAAS,KAAK;AACjC,QAAI,CAAC,WAAY;AACjB,UAAM,eAAe,WAAW,YAAY,cAAc;AAC1D,QAAI,CAAC,aAAc;AACnB,eAAW,IAAI,cAAc;AAAA,MAC3B,YAAY,WAAW,YAAY,YAAY,KAAK;AAAA,MACpD,UAAU,WAAW,YAAY,UAAU,KAAK;AAAA,MAChD,MAAM,WAAW,YAAY,MAAM,KAAK;AAAA,IAC1C,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAQO,SAAS,wBAAwB,UAAmB,MAAmC;AAC5F,QAAM,UAA8B,CAAC;AAErC,QAAM,gBAAgB,eAAe,QAAQ;AAC7C,QAAM,YAAY,eAAe,IAAI;AAErC,aAAW,CAAC,QAAQ,SAAS,KAAK,WAAW;AAC3C,UAAM,SAAS,cAAc,IAAI,MAAM;AACvC,QAAI,CAAC,QAAQ;AACX,cAAQ,KAAK,EAAE,MAAM,aAAa,IAAI,OAAO,CAAC;AAC9C;AAAA,IACF;AACA,QAAI,OAAO,aAAa,UAAU,UAAU;AAC1C,cAAQ,KAAK,EAAE,MAAM,mBAAmB,IAAI,OAAO,CAAC;AACpD;AAAA,IACF;AACA,QAAI,OAAO,eAAe,UAAU,cAAc,OAAO,eAAe,UAAU,YAAY;AAC5F,cAAQ,KAAK,EAAE,MAAM,qBAAqB,IAAI,OAAO,CAAC;AAAA,IACxD;AAAA,EACF;AAEA,aAAW,UAAU,cAAc,KAAK,GAAG;AACzC,QAAI,CAAC,UAAU,IAAI,MAAM,EAAG,SAAQ,KAAK,EAAE,MAAM,eAAe,IAAI,OAAO,CAAC;AAAA,EAC9E;AAEA,QAAM,sBAAsB,qBAAqB,QAAQ;AACzD,QAAM,kBAAkB,qBAAqB,IAAI;AAEjD,aAAW,CAAC,cAAc,SAAS,KAAK,iBAAiB;AACvD,UAAM,SAAS,oBAAoB,IAAI,YAAY;AACnD,QAAI,CAAC,QAAQ;AACX,cAAQ,KAAK,EAAE,MAAM,mBAAmB,IAAI,aAAa,CAAC;AAC1D;AAAA,IACF;AACA,QAAI,OAAO,eAAe,UAAU,cAAc,OAAO,aAAa,UAAU,UAAU;AACxF,cAAQ,KAAK,EAAE,MAAM,wBAAwB,IAAI,aAAa,CAAC;AAC/D;AAAA,IACF;AACA,QAAI,OAAO,SAAS,UAAU,MAAM;AAClC,cAAQ,KAAK,EAAE,MAAM,yBAAyB,IAAI,aAAa,CAAC;AAAA,IAClE;AAAA,EACF;AAEA,aAAW,gBAAgB,oBAAoB,KAAK,GAAG;AACrD,QAAI,CAAC,gBAAgB,IAAI,YAAY,GAAG;AACtC,cAAQ,KAAK,EAAE,MAAM,qBAAqB,IAAI,aAAa,CAAC;AAAA,IAC9D;AAAA,EACF;AAEA,SAAO;AACT;AAGO,SAAS,6BAA6B,UAAmB,MAAwB;AACtF,SAAO,wBAAwB,UAAU,IAAI,EAAE,SAAS;AAC1D;AAMO,SAAS,gCAAgC,QAIjB;AAC7B,SAAO;AAAA,IACL,OAAO;AAAA,IACP,MAAM;AAAA,IACN,cAAc,OAAO;AAAA,IACrB,qBAAqB,OAAO;AAAA,IAC5B,gBAAgB;AAAA,IAChB,SAAS,OAAO;AAAA,IAChB,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,UAAU,8BAA8B,OAAO,YAAY;AAAA,IAC7D;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/workflows/lib/definition-error-body.js

@@ -0,0 +1,33 @@
+const RECEIVED_MESSAGE_PATTERN = /received (.+)$/;
+function normalizeIssuePath(path) {
+  return path.map((segment) => typeof segment === "number" ? segment : String(segment));
+}
+function resolveExpected(issue) {
+  if ("expected" in issue && typeof issue.expected === "string") return issue.expected;
+  if ("values" in issue && Array.isArray(issue.values)) {
+    return issue.values.map((value) => JSON.stringify(value)).join(" | ");
+  }
+  return void 0;
+}
+function resolveGot(issue) {
+  if (issue.code !== "invalid_type") return void 0;
+  const match = RECEIVED_MESSAGE_PATTERN.exec(issue.message);
+  return match ? match[1] : void 0;
+}
+function normalizeDefinitionValidationIssues(error) {
+  return error.issues.map((issue) => {
+    const expected = resolveExpected(issue);
+    const got = resolveGot(issue);
+    return {
+      path: normalizeIssuePath(issue.path),
+      code: typeof issue.code === "string" ? issue.code : "custom",
+      message: issue.message,
+      ...expected !== void 0 ? { expected } : {},
+      ...got !== void 0 ? { got } : {}
+    };
+  });
+}
+export {
+  normalizeDefinitionValidationIssues
+};
+//# sourceMappingURL=definition-error-body.js.map

package/dist/modules/workflows/lib/definition-error-body.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/workflows/lib/definition-error-body.ts"],
+  "sourcesContent": ["import type { z } from 'zod'\n\nexport type DefinitionValidationIssue = {\n  path: Array<string | number>\n  code: string\n  message: string\n  expected?: string\n  got?: string\n}\n\nconst RECEIVED_MESSAGE_PATTERN = /received (.+)$/\n\nfunction normalizeIssuePath(path: ReadonlyArray<PropertyKey>): Array<string | number> {\n  return path.map((segment) => (typeof segment === 'number' ? segment : String(segment)))\n}\n\nfunction resolveExpected(issue: z.core.$ZodIssue): string | undefined {\n  if ('expected' in issue && typeof issue.expected === 'string') return issue.expected\n  if ('values' in issue && Array.isArray(issue.values)) {\n    return issue.values.map((value) => JSON.stringify(value)).join(' | ')\n  }\n  return undefined\n}\n\nfunction resolveGot(issue: z.core.$ZodIssue): string | undefined {\n  if (issue.code !== 'invalid_type') return undefined\n  const match = RECEIVED_MESSAGE_PATTERN.exec(issue.message)\n  return match ? match[1] : undefined\n}\n\nexport function normalizeDefinitionValidationIssues(error: z.ZodError): DefinitionValidationIssue[] {\n  return error.issues.map((issue) => {\n    const expected = resolveExpected(issue)\n    const got = resolveGot(issue)\n    return {\n      path: normalizeIssuePath(issue.path),\n      code: typeof issue.code === 'string' ? issue.code : 'custom',\n      message: issue.message,\n      ...(expected !== undefined ? { expected } : {}),\n      ...(got !== undefined ? { got } : {}),\n    }\n  })\n}\n"],
+  "mappings": "AAUA,MAAM,2BAA2B;AAEjC,SAAS,mBAAmB,MAA0D;AACpF,SAAO,KAAK,IAAI,CAAC,YAAa,OAAO,YAAY,WAAW,UAAU,OAAO,OAAO,CAAE;AACxF;AAEA,SAAS,gBAAgB,OAA6C;AACpE,MAAI,cAAc,SAAS,OAAO,MAAM,aAAa,SAAU,QAAO,MAAM;AAC5E,MAAI,YAAY,SAAS,MAAM,QAAQ,MAAM,MAAM,GAAG;AACpD,WAAO,MAAM,OAAO,IAAI,CAAC,UAAU,KAAK,UAAU,KAAK,CAAC,EAAE,KAAK,KAAK;AAAA,EACtE;AACA,SAAO;AACT;AAEA,SAAS,WAAW,OAA6C;AAC/D,MAAI,MAAM,SAAS,eAAgB,QAAO;AAC1C,QAAM,QAAQ,yBAAyB,KAAK,MAAM,OAAO;AACzD,SAAO,QAAQ,MAAM,CAAC,IAAI;AAC5B;AAEO,SAAS,oCAAoC,OAAgD;AAClG,SAAO,MAAM,OAAO,IAAI,CAAC,UAAU;AACjC,UAAM,WAAW,gBAAgB,KAAK;AACtC,UAAM,MAAM,WAAW,KAAK;AAC5B,WAAO;AAAA,MACL,MAAM,mBAAmB,MAAM,IAAI;AAAA,MACnC,MAAM,OAAO,MAAM,SAAS,WAAW,MAAM,OAAO;AAAA,MACpD,SAAS,MAAM;AAAA,MACf,GAAI,aAAa,SAAY,EAAE,SAAS,IAAI,CAAC;AAAA,MAC7C,GAAI,QAAQ,SAAY,EAAE,IAAI,IAAI,CAAC;AAAA,IACrC;AAAA,EACF,CAAC;AACH;",
+  "names": []
+}

package/dist/modules/workflows/lib/definition-evaluation.js

@@ -0,0 +1,79 @@
+import { collectActivityConfigWarnings } from "../data/activity-config-warnings.js";
+import { workflowDefinitionDataSchema } from "../data/validators.js";
+import {
+  collectValidationIssues,
+  countIssuesBySeverity
+} from "./collect-validation-issues.js";
+import {
+  normalizeDefinitionValidationIssues
+} from "./definition-error-body.js";
+import { collectUnresolvedContextRefWarnings } from "./expression-refs.js";
+import { definitionToGraph, validateWorkflowGraph } from "./graph-utils.js";
+const UNRESOLVED_CONTEXT_REF_MESSAGE = {
+  key: "workflows.visualEditor.problems.unresolvedContextRef",
+  fallback: 'Context reference "{path}" is not provided by any earlier step, trigger, or input'
+};
+function interpolateFallback(fallback, params) {
+  return fallback.replace(
+    /\{(\w+)\}/g,
+    (match, name) => Object.prototype.hasOwnProperty.call(params, name) ? params[name] : match
+  );
+}
+function toUnresolvedContextRefIssues(definition, ledger, translate) {
+  return collectUnresolvedContextRefWarnings(definition, ledger).map((warning) => ({
+    path: warning.path,
+    message: translate ? translate(UNRESOLVED_CONTEXT_REF_MESSAGE.key, UNRESOLVED_CONTEXT_REF_MESSAGE.fallback, {
+      path: warning.refPath
+    }) : interpolateFallback(UNRESOLVED_CONTEXT_REF_MESSAGE.fallback, { path: warning.refPath })
+  }));
+}
+function evaluateWorkflowDefinition(definition, options = {}) {
+  const shaped = Array.isArray(definition?.steps) && Array.isArray(definition?.transitions);
+  if (!shaped) {
+    const parsedShape = workflowDefinitionDataSchema.safeParse(definition);
+    const structuralIssues = parsedShape.success ? [] : normalizeDefinitionValidationIssues(parsedShape.error);
+    return {
+      valid: false,
+      errorCount: structuralIssues.length,
+      warningCount: 0,
+      issues: structuralIssues,
+      problems: structuralIssues.map((entry, index) => ({
+        id: `schema-${index}`,
+        severity: "error",
+        message: entry.path.length ? `${entry.path.join(".")} - ${entry.message}` : entry.message
+      }))
+    };
+  }
+  const { nodes, edges } = definitionToGraph(definition, { autoLayout: false });
+  const graphErrors = validateWorkflowGraph(nodes, edges);
+  const parsed = workflowDefinitionDataSchema.safeParse(definition);
+  const zodIssues = parsed.success ? [] : parsed.error.issues;
+  const ledger = options.ledger ?? null;
+  const configWarnings = [
+    ...collectActivityConfigWarnings(definition),
+    ...ledger ? toUnresolvedContextRefIssues(definition, ledger) : []
+  ];
+  const problems = collectValidationIssues({
+    graphErrors,
+    zodIssues,
+    configWarnings,
+    nodes,
+    edges,
+    definition,
+    ledger: ledger ?? void 0
+  });
+  const { errors, warnings } = countIssuesBySeverity(problems);
+  return {
+    valid: errors === 0,
+    errorCount: errors,
+    warningCount: warnings,
+    issues: parsed.success ? [] : normalizeDefinitionValidationIssues(parsed.error),
+    problems
+  };
+}
+export {
+  UNRESOLVED_CONTEXT_REF_MESSAGE,
+  evaluateWorkflowDefinition,
+  toUnresolvedContextRefIssues
+};
+//# sourceMappingURL=definition-evaluation.js.map

package/dist/modules/workflows/lib/definition-evaluation.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/workflows/lib/definition-evaluation.ts"],
+  "sourcesContent": ["/**\n * One evaluation path for a workflow definition.\n *\n * The Studio's Problems panel and the definition API routes historically ran\n * the same checks through two different normalizers: the panel builds\n * `WorkflowValidationIssue[]` via `collectValidationIssues`, the routes build\n * the structured `{path, code, message, expected?, got?}` body via\n * `normalizeDefinitionValidationIssues`. Neither reimplements the checks \u2014 they\n * share `workflowDefinitionDataSchema` \u2014 but nothing composed both.\n *\n * This module composes them, and NOTHING ELSE. Every check below is an existing\n * exported function; a second validator that could disagree with the panel is\n * precisely the failure mode to avoid, so callers that need \"what would the\n * Studio show me?\" MUST come through here rather than re-deriving the recipe.\n */\n\nimport { collectActivityConfigWarnings } from '../data/activity-config-warnings'\nimport { workflowDefinitionDataSchema } from '../data/validators'\nimport type { WorkflowDefinitionData } from '../data/entities'\nimport {\n  collectValidationIssues,\n  countIssuesBySeverity,\n  type WorkflowIssueTranslator,\n  type WorkflowValidationIssue,\n  type ZodIssueLike,\n} from './collect-validation-issues'\nimport type { ContextLedger } from './context-ledger'\nimport {\n  normalizeDefinitionValidationIssues,\n  type DefinitionValidationIssue,\n} from './definition-error-body'\nimport { collectUnresolvedContextRefWarnings } from './expression-refs'\nimport { definitionToGraph, validateWorkflowGraph } from './graph-utils'\n\n/**\n * Problems-panel copy for an unresolved `{{context.*}}` reference. Shared so\n * the Studio and every server-side evaluator emit the identical warning instead\n * of drifting apart on the message text.\n */\nexport const UNRESOLVED_CONTEXT_REF_MESSAGE = {\n  key: 'workflows.visualEditor.problems.unresolvedContextRef',\n  fallback: 'Context reference \"{path}\" is not provided by any earlier step, trigger, or input',\n} as const\n\nfunction interpolateFallback(fallback: string, params: Record<string, string>): string {\n  return fallback.replace(/\\{(\\w+)\\}/g, (match, name: string) =>\n    Object.prototype.hasOwnProperty.call(params, name) ? params[name] : match,\n  )\n}\n\n/**\n * Map unresolved `{{context.*}}` references onto Problems-panel warnings.\n * `translate` is optional \u2014 omit it (server, agent tools) to get the English\n * fallback the panel itself falls back to.\n */\nexport function toUnresolvedContextRefIssues(\n  definition: WorkflowDefinitionData,\n  ledger: ContextLedger,\n  translate?: WorkflowIssueTranslator,\n): ZodIssueLike[] {\n  return collectUnresolvedContextRefWarnings(definition, ledger).map((warning) => ({\n    path: warning.path,\n    message: translate\n      ? translate(UNRESOLVED_CONTEXT_REF_MESSAGE.key, UNRESOLVED_CONTEXT_REF_MESSAGE.fallback, {\n          path: warning.refPath,\n        })\n      : interpolateFallback(UNRESOLVED_CONTEXT_REF_MESSAGE.fallback, { path: warning.refPath }),\n  }))\n}\n\nexport interface EvaluateWorkflowDefinitionOptions {\n  /**\n   * Server-computed context ledger. When supplied, unresolved-reference\n   * warnings join the result exactly as they do in the Studio; when omitted\n   * those warnings are skipped (they are advisory and never blocking).\n   */\n  ledger?: ContextLedger | null\n}\n\nexport interface WorkflowDefinitionEvaluation {\n  /** No blocking errors \u2014 the same bar the Studio's Save handler enforces. */\n  valid: boolean\n  errorCount: number\n  warningCount: number\n  /**\n   * The structured issue format: identical in shape and content to the\n   * `details[]` array the definition create/update routes return on a 400.\n   * Empty when the definition parses.\n   */\n  issues: DefinitionValidationIssue[]\n  /** Exactly what the Studio's Problems panel renders, in its order. */\n  problems: WorkflowValidationIssue[]\n}\n\n/**\n * Run the Studio Problems-panel evaluation plus the API routes' structured-body\n * normalizer over one definition.\n */\nexport function evaluateWorkflowDefinition(\n  definition: WorkflowDefinitionData,\n  options: EvaluateWorkflowDefinitionOptions = {},\n): WorkflowDefinitionEvaluation {\n  // The Studio only ever evaluates well-formed canvas state, but an agent can\n  // hand us anything. A definition whose `steps`/`transitions` are not arrays\n  // cannot be turned into a graph at all, so it answers with the schema issues\n  // alone rather than throwing out of a validation call.\n  const shaped =\n    Array.isArray((definition as { steps?: unknown })?.steps) &&\n    Array.isArray((definition as { transitions?: unknown })?.transitions)\n  if (!shaped) {\n    const parsedShape = workflowDefinitionDataSchema.safeParse(definition)\n    const structuralIssues = parsedShape.success\n      ? []\n      : normalizeDefinitionValidationIssues(parsedShape.error)\n    return {\n      valid: false,\n      errorCount: structuralIssues.length,\n      warningCount: 0,\n      issues: structuralIssues,\n      problems: structuralIssues.map((entry, index) => ({\n        id: `schema-${index}`,\n        severity: 'error' as const,\n        message: entry.path.length ? `${entry.path.join('.')} - ${entry.message}` : entry.message,\n      })),\n    }\n  }\n\n  const { nodes, edges } = definitionToGraph(definition, { autoLayout: false })\n  const graphErrors = validateWorkflowGraph(nodes, edges)\n  const parsed = workflowDefinitionDataSchema.safeParse(definition)\n  const zodIssues: ZodIssueLike[] = parsed.success ? [] : parsed.error.issues\n  const ledger = options.ledger ?? null\n  const configWarnings: ZodIssueLike[] = [\n    ...collectActivityConfigWarnings(definition),\n    ...(ledger ? toUnresolvedContextRefIssues(definition, ledger) : []),\n  ]\n\n  const problems = collectValidationIssues({\n    graphErrors,\n    zodIssues,\n    configWarnings,\n    nodes,\n    edges,\n    definition,\n    ledger: ledger ?? undefined,\n  })\n  const { errors, warnings } = countIssuesBySeverity(problems)\n\n  return {\n    valid: errors === 0,\n    errorCount: errors,\n    warningCount: warnings,\n    issues: parsed.success ? [] : normalizeDefinitionValidationIssues(parsed.error),\n    problems,\n  }\n}\n"],
+  "mappings": "AAgBA,SAAS,qCAAqC;AAC9C,SAAS,oCAAoC;AAE7C;AAAA,EACE;AAAA,EACA;AAAA,OAIK;AAEP;AAAA,EACE;AAAA,OAEK;AACP,SAAS,2CAA2C;AACpD,SAAS,mBAAmB,6BAA6B;AAOlD,MAAM,iCAAiC;AAAA,EAC5C,KAAK;AAAA,EACL,UAAU;AACZ;AAEA,SAAS,oBAAoB,UAAkB,QAAwC;AACrF,SAAO,SAAS;AAAA,IAAQ;AAAA,IAAc,CAAC,OAAO,SAC5C,OAAO,UAAU,eAAe,KAAK,QAAQ,IAAI,IAAI,OAAO,IAAI,IAAI;AAAA,EACtE;AACF;AAOO,SAAS,6BACd,YACA,QACA,WACgB;AAChB,SAAO,oCAAoC,YAAY,MAAM,EAAE,IAAI,CAAC,aAAa;AAAA,IAC/E,MAAM,QAAQ;AAAA,IACd,SAAS,YACL,UAAU,+BAA+B,KAAK,+BAA+B,UAAU;AAAA,MACrF,MAAM,QAAQ;AAAA,IAChB,CAAC,IACD,oBAAoB,+BAA+B,UAAU,EAAE,MAAM,QAAQ,QAAQ,CAAC;AAAA,EAC5F,EAAE;AACJ;AA8BO,SAAS,2BACd,YACA,UAA6C,CAAC,GAChB;AAK9B,QAAM,SACJ,MAAM,QAAS,YAAoC,KAAK,KACxD,MAAM,QAAS,YAA0C,WAAW;AACtE,MAAI,CAAC,QAAQ;AACX,UAAM,cAAc,6BAA6B,UAAU,UAAU;AACrE,UAAM,mBAAmB,YAAY,UACjC,CAAC,IACD,oCAAoC,YAAY,KAAK;AACzD,WAAO;AAAA,MACL,OAAO;AAAA,MACP,YAAY,iBAAiB;AAAA,MAC7B,cAAc;AAAA,MACd,QAAQ;AAAA,MACR,UAAU,iBAAiB,IAAI,CAAC,OAAO,WAAW;AAAA,QAChD,IAAI,UAAU,KAAK;AAAA,QACnB,UAAU;AAAA,QACV,SAAS,MAAM,KAAK,SAAS,GAAG,MAAM,KAAK,KAAK,GAAG,CAAC,MAAM,MAAM,OAAO,KAAK,MAAM;AAAA,MACpF,EAAE;AAAA,IACJ;AAAA,EACF;AAEA,QAAM,EAAE,OAAO,MAAM,IAAI,kBAAkB,YAAY,EAAE,YAAY,MAAM,CAAC;AAC5E,QAAM,cAAc,sBAAsB,OAAO,KAAK;AACtD,QAAM,SAAS,6BAA6B,UAAU,UAAU;AAChE,QAAM,YAA4B,OAAO,UAAU,CAAC,IAAI,OAAO,MAAM;AACrE,QAAM,SAAS,QAAQ,UAAU;AACjC,QAAM,iBAAiC;AAAA,IACrC,GAAG,8BAA8B,UAAU;AAAA,IAC3C,GAAI,SAAS,6BAA6B,YAAY,MAAM,IAAI,CAAC;AAAA,EACnE;AAEA,QAAM,WAAW,wBAAwB;AAAA,IACvC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ,UAAU;AAAA,EACpB,CAAC;AACD,QAAM,EAAE,QAAQ,SAAS,IAAI,sBAAsB,QAAQ;AAE3D,SAAO;AAAA,IACL,OAAO,WAAW;AAAA,IAClB,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,QAAQ,OAAO,UAAU,CAAC,IAAI,oCAAoC,OAAO,KAAK;AAAA,IAC9E;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/workflows/lib/definition-grant.js

@@ -0,0 +1,90 @@
+import { hasFeature } from "@open-mercato/shared/security/features";
+import {
+  normalizeFeatureList,
+  provisionExecutionPrincipal,
+  resolveExecutionPrincipalUserId
+} from "../../auth/lib/executionPrincipal.js";
+function workflowPrincipalKey(definitionId) {
+  return `workflow:${definitionId}`;
+}
+function normalizeGrantedFeatures(value) {
+  return normalizeFeatureList(value);
+}
+function definitionDeclaresGrant(definition) {
+  return normalizeGrantedFeatures(definition?.grantedFeatures).length > 0;
+}
+function findUngrantableFeatures(requested, granted) {
+  return normalizeGrantedFeatures(requested).filter((feature) => !hasFeature(granted, feature));
+}
+const WORKFLOW_GRANT_FEATURE = "workflows.definitions.grant_features";
+async function authorizeWorkflowGrantChange(rbacService, params) {
+  const requested = normalizeGrantedFeatures(params.requested);
+  const current = normalizeGrantedFeatures(params.current);
+  if (requested.length === current.length && requested.every((feature, index) => feature === current[index])) {
+    return null;
+  }
+  const mayGrant = await rbacService.userHasAllFeatures(params.userId, [WORKFLOW_GRANT_FEATURE], params.scope);
+  if (!mayGrant) {
+    return {
+      status: 403,
+      body: { error: "Insufficient permissions", code: "WORKFLOW_GRANT_FEATURE_REQUIRED" }
+    };
+  }
+  if (!requested.length) return null;
+  const withinOwnGrants = await rbacService.userHasAllFeatures(params.userId, requested, params.scope);
+  if (withinOwnGrants) return null;
+  const granted = rbacService.getGrantedFeatures ? await rbacService.getGrantedFeatures(params.userId, params.scope) : [];
+  return {
+    status: 403,
+    body: {
+      error: "Insufficient permissions",
+      code: "WORKFLOW_GRANT_EXCEEDS_GRANTOR_FEATURES",
+      details: { missingFeatures: findUngrantableFeatures(requested, granted) }
+    }
+  };
+}
+class WorkflowExecutionPrincipalMissingError extends Error {
+  constructor(definitionId) {
+    super(
+      `[internal] workflow definition ${definitionId} declares granted features but its execution principal is not provisioned; refusing to fall back to the starting user`
+    );
+    this.definitionId = definitionId;
+    this.code = "EXECUTION_PRINCIPAL_MISSING";
+    this.name = "WorkflowExecutionPrincipalMissingError";
+  }
+}
+async function syncWorkflowDefinitionPrincipal(container, definition, options) {
+  const features = normalizeGrantedFeatures(definition.grantedFeatures);
+  const previous = normalizeGrantedFeatures(options?.previousFeatures);
+  if (!features.length && !previous.length) return;
+  await provisionExecutionPrincipal(
+    container,
+    { tenantId: definition.tenantId, organizationId: definition.organizationId },
+    {
+      principalKey: workflowPrincipalKey(definition.id),
+      displayName: `Workflow ${definition.workflowId ?? definition.id}`,
+      features
+    }
+  );
+}
+async function resolveWorkflowDefinitionExecutionUserId(em, definition, fallbackUserId) {
+  if (!definition || !definitionDeclaresGrant(definition)) return fallbackUserId ?? null;
+  const userId = await resolveExecutionPrincipalUserId(em, workflowPrincipalKey(definition.id), {
+    tenantId: definition.tenantId,
+    organizationId: definition.organizationId
+  });
+  if (!userId) throw new WorkflowExecutionPrincipalMissingError(definition.id);
+  return userId;
+}
+export {
+  WORKFLOW_GRANT_FEATURE,
+  WorkflowExecutionPrincipalMissingError,
+  authorizeWorkflowGrantChange,
+  definitionDeclaresGrant,
+  findUngrantableFeatures,
+  normalizeGrantedFeatures,
+  resolveWorkflowDefinitionExecutionUserId,
+  syncWorkflowDefinitionPrincipal,
+  workflowPrincipalKey
+};
+//# sourceMappingURL=definition-grant.js.map

package/dist/modules/workflows/lib/definition-grant.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/workflows/lib/definition-grant.ts"],
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AwilixContainer } from 'awilix'\nimport { hasFeature } from '@open-mercato/shared/security/features'\nimport {\n  normalizeFeatureList,\n  provisionExecutionPrincipal,\n  resolveExecutionPrincipalUserId,\n} from '../../auth/lib/executionPrincipal'\n\n/**\n * Workflow execution identity (`grantedFeatures`).\n *\n * A workflow needs an acting user to write anything: `executeUpdateEntity`\n * refuses without one and then checks that user's LIVE features against the\n * command's `requiredFeatures`. Historically that user was whoever started the\n * run \u2014 so a workflow started by an admin silently ran with admin powers, and an\n * event-triggered run (whose `initiatedBy` is `trigger:<id>`) had no actor at\n * all and could not write.\n *\n * A definition may instead declare its own least-privilege grant. Two rules,\n * both deliberate:\n *\n *  - **No grant \u21D2 today's behaviour, byte-for-byte.** The run borrows the\n *    starting user's identity. The feature is additive and opt-in; every\n *    pre-existing definition is unaffected.\n *  - **A grant \u21D2 the run ALWAYS acts as its own principal**, regardless of who\n *    started it. That is the point: the grant is a ceiling, not a floor, so a\n *    run started by an admin must not gain the admin's powers. It also gives the\n *    no-actor triggered case a real identity.\n *\n * The grant lives on the definition ROW (a real column), so it is per version:\n * publishing a new version mints a new row, hence a new principal, hence a\n * re-authorised grant.\n */\n\n/** The `auth` execution-principal namespace this module owns. */\nexport function workflowPrincipalKey(definitionId: string): string {\n  return `workflow:${definitionId}`\n}\n\nexport function normalizeGrantedFeatures(value: unknown): string[] {\n  return normalizeFeatureList(value)\n}\n\nexport type WorkflowDefinitionGrantLike = {\n  id: string\n  tenantId: string\n  organizationId: string\n  workflowId?: string\n  grantedFeatures?: string[] | null\n}\n\nexport function definitionDeclaresGrant(definition: WorkflowDefinitionGrantLike | null | undefined): boolean {\n  return normalizeGrantedFeatures(definition?.grantedFeatures).length > 0\n}\n\n/**\n * The features in `requested` that `granted` does not cover.\n *\n * Wildcard-aware on purpose: `workflows.*` in the author's own grants satisfies\n * `workflows.definitions.view` in the request, and a plain `includes()` would\n * refuse a grant the author demonstrably holds. Uses the shared matcher so this\n * agrees with every other ACL decision in the platform.\n */\nexport function findUngrantableFeatures(requested: string[], granted: string[]): string[] {\n  return normalizeGrantedFeatures(requested).filter((feature) => !hasFeature(granted, feature))\n}\n\nexport const WORKFLOW_GRANT_FEATURE = 'workflows.definitions.grant_features'\n\nexport type WorkflowGrantAuthorizationFailure = {\n  status: number\n  body: {\n    error: string\n    code: 'WORKFLOW_GRANT_FEATURE_REQUIRED' | 'WORKFLOW_GRANT_EXCEEDS_GRANTOR_FEATURES'\n    details?: { missingFeatures: string[] }\n  }\n}\n\ntype RbacServiceLike = {\n  userHasAllFeatures: (\n    userId: string,\n    features: string[],\n    scope: { tenantId: string | null; organizationId: string | null },\n  ) => Promise<boolean>\n  getGrantedFeatures?: (\n    userId: string,\n    scope: { tenantId: string | null; organizationId: string | null },\n  ) => Promise<string[]>\n}\n\n/**\n * Authorises a change to a definition's grant. Returns null when the change is\n * allowed, otherwise the response body/status the route should return.\n *\n * Two gates, both required:\n *  1. `workflows.definitions.grant_features` \u2014 declaring an execution identity\n *     is not implied by ordinary `definitions.edit`.\n *  2. The requested grant must be a SUBSET of the saving user's own current\n *     features. `userHasAllFeatures` is the authority (it is the same primitive\n *     every other route uses, so it honours super-admin, wildcards, module\n *     enablement and organization visibility identically); the missing-feature\n *     list in the error body is derived with the shared wildcard-aware matcher,\n *     never `includes()`.\n *\n * A no-op change (`requested` deep-equals `current`) is not a change and needs\n * neither gate \u2014 otherwise every ordinary metadata save of a granted definition\n * would demand the grant feature. Callers that mint a NEW principal from an\n * existing grant (publish) MUST pass `current: []` so the copy is re-authorised.\n */\nexport async function authorizeWorkflowGrantChange(\n  rbacService: RbacServiceLike,\n  params: {\n    userId: string\n    scope: { tenantId: string | null; organizationId: string | null }\n    requested: string[]\n    current: string[]\n  },\n): Promise<WorkflowGrantAuthorizationFailure | null> {\n  const requested = normalizeGrantedFeatures(params.requested)\n  const current = normalizeGrantedFeatures(params.current)\n  if (requested.length === current.length && requested.every((feature, index) => feature === current[index])) {\n    return null\n  }\n\n  const mayGrant = await rbacService.userHasAllFeatures(params.userId, [WORKFLOW_GRANT_FEATURE], params.scope)\n  if (!mayGrant) {\n    return {\n      status: 403,\n      body: { error: 'Insufficient permissions', code: 'WORKFLOW_GRANT_FEATURE_REQUIRED' },\n    }\n  }\n\n  if (!requested.length) return null\n\n  const withinOwnGrants = await rbacService.userHasAllFeatures(params.userId, requested, params.scope)\n  if (withinOwnGrants) return null\n\n  const granted = rbacService.getGrantedFeatures\n    ? await rbacService.getGrantedFeatures(params.userId, params.scope)\n    : []\n  return {\n    status: 403,\n    body: {\n      error: 'Insufficient permissions',\n      code: 'WORKFLOW_GRANT_EXCEEDS_GRANTOR_FEATURES',\n      details: { missingFeatures: findUngrantableFeatures(requested, granted) },\n    },\n  }\n}\n\nexport class WorkflowExecutionPrincipalMissingError extends Error {\n  readonly code = 'EXECUTION_PRINCIPAL_MISSING'\n  constructor(public readonly definitionId: string) {\n    super(\n      `[internal] workflow definition ${definitionId} declares granted features but its execution ` +\n        `principal is not provisioned; refusing to fall back to the starting user`,\n    )\n    this.name = 'WorkflowExecutionPrincipalMissingError'\n  }\n}\n\n/**\n * Provisions (idempotently) the definition's execution principal and re-scopes\n * its role ACL to exactly the declared grant \u2014 on every create, update and\n * publish, so an over-granted principal self-heals instead of lingering.\n *\n * A definition that never declared a grant provisions nothing (the opt-in stays\n * opt-in), but CLEARING a grant re-scopes the existing principal to no features\n * rather than leaving the old ACL behind for anything that still resolves it.\n */\nexport async function syncWorkflowDefinitionPrincipal(\n  container: AwilixContainer,\n  definition: WorkflowDefinitionGrantLike,\n  options?: { previousFeatures?: string[] | null },\n): Promise<void> {\n  const features = normalizeGrantedFeatures(definition.grantedFeatures)\n  const previous = normalizeGrantedFeatures(options?.previousFeatures)\n  // Nothing declared and nothing to revoke \u21D2 no principal, no writes at all.\n  if (!features.length && !previous.length) return\n  await provisionExecutionPrincipal(\n    container,\n    { tenantId: definition.tenantId, organizationId: definition.organizationId },\n    {\n      principalKey: workflowPrincipalKey(definition.id),\n      displayName: `Workflow ${definition.workflowId ?? definition.id}`,\n      features,\n    },\n  )\n}\n\n/**\n * The user id a run of `definition` acts as.\n *\n * Fails CLOSED: a definition that declares a grant whose principal cannot be\n * resolved throws rather than silently reverting to `fallbackUserId`, because\n * that fallback is precisely the escalation the grant exists to prevent.\n */\nexport async function resolveWorkflowDefinitionExecutionUserId(\n  em: EntityManager,\n  definition: WorkflowDefinitionGrantLike | null | undefined,\n  fallbackUserId: string | null | undefined,\n): Promise<string | null> {\n  if (!definition || !definitionDeclaresGrant(definition)) return fallbackUserId ?? null\n  const userId = await resolveExecutionPrincipalUserId(em, workflowPrincipalKey(definition.id), {\n    tenantId: definition.tenantId,\n    organizationId: definition.organizationId,\n  })\n  if (!userId) throw new WorkflowExecutionPrincipalMissingError(definition.id)\n  return userId\n}\n"],
+  "mappings": "AAEA,SAAS,kBAAkB;AAC3B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AA6BA,SAAS,qBAAqB,cAA8B;AACjE,SAAO,YAAY,YAAY;AACjC;AAEO,SAAS,yBAAyB,OAA0B;AACjE,SAAO,qBAAqB,KAAK;AACnC;AAUO,SAAS,wBAAwB,YAAqE;AAC3G,SAAO,yBAAyB,YAAY,eAAe,EAAE,SAAS;AACxE;AAUO,SAAS,wBAAwB,WAAqB,SAA6B;AACxF,SAAO,yBAAyB,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,WAAW,SAAS,OAAO,CAAC;AAC9F;AAEO,MAAM,yBAAyB;AA0CtC,eAAsB,6BACpB,aACA,QAMmD;AACnD,QAAM,YAAY,yBAAyB,OAAO,SAAS;AAC3D,QAAM,UAAU,yBAAyB,OAAO,OAAO;AACvD,MAAI,UAAU,WAAW,QAAQ,UAAU,UAAU,MAAM,CAAC,SAAS,UAAU,YAAY,QAAQ,KAAK,CAAC,GAAG;AAC1G,WAAO;AAAA,EACT;AAEA,QAAM,WAAW,MAAM,YAAY,mBAAmB,OAAO,QAAQ,CAAC,sBAAsB,GAAG,OAAO,KAAK;AAC3G,MAAI,CAAC,UAAU;AACb,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,MAAM,EAAE,OAAO,4BAA4B,MAAM,kCAAkC;AAAA,IACrF;AAAA,EACF;AAEA,MAAI,CAAC,UAAU,OAAQ,QAAO;AAE9B,QAAM,kBAAkB,MAAM,YAAY,mBAAmB,OAAO,QAAQ,WAAW,OAAO,KAAK;AACnG,MAAI,gBAAiB,QAAO;AAE5B,QAAM,UAAU,YAAY,qBACxB,MAAM,YAAY,mBAAmB,OAAO,QAAQ,OAAO,KAAK,IAChE,CAAC;AACL,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,MAAM;AAAA,MACJ,OAAO;AAAA,MACP,MAAM;AAAA,MACN,SAAS,EAAE,iBAAiB,wBAAwB,WAAW,OAAO,EAAE;AAAA,IAC1E;AAAA,EACF;AACF;AAEO,MAAM,+CAA+C,MAAM;AAAA,EAEhE,YAA4B,cAAsB;AAChD;AAAA,MACE,kCAAkC,YAAY;AAAA,IAEhD;AAJ0B;AAD5B,SAAS,OAAO;AAMd,SAAK,OAAO;AAAA,EACd;AACF;AAWA,eAAsB,gCACpB,WACA,YACA,SACe;AACf,QAAM,WAAW,yBAAyB,WAAW,eAAe;AACpE,QAAM,WAAW,yBAAyB,SAAS,gBAAgB;AAEnE,MAAI,CAAC,SAAS,UAAU,CAAC,SAAS,OAAQ;AAC1C,QAAM;AAAA,IACJ;AAAA,IACA,EAAE,UAAU,WAAW,UAAU,gBAAgB,WAAW,eAAe;AAAA,IAC3E;AAAA,MACE,cAAc,qBAAqB,WAAW,EAAE;AAAA,MAChD,aAAa,YAAY,WAAW,cAAc,WAAW,EAAE;AAAA,MAC/D;AAAA,IACF;AAAA,EACF;AACF;AASA,eAAsB,yCACpB,IACA,YACA,gBACwB;AACxB,MAAI,CAAC,cAAc,CAAC,wBAAwB,UAAU,EAAG,QAAO,kBAAkB;AAClF,QAAM,SAAS,MAAM,gCAAgC,IAAI,qBAAqB,WAAW,EAAE,GAAG;AAAA,IAC5F,UAAU,WAAW;AAAA,IACrB,gBAAgB,WAAW;AAAA,EAC7B,CAAC;AACD,MAAI,CAAC,OAAQ,OAAM,IAAI,uCAAuC,WAAW,EAAE;AAC3E,SAAO;AACT;",
+  "names": []
+}

package/dist/modules/workflows/lib/definition-json-locations.js

@@ -0,0 +1,139 @@
+function scanTopLevelArrayElements(text) {
+  const steps = [];
+  const transitions = [];
+  let line = 1;
+  let inString = false;
+  let escaped = false;
+  let depth = 0;
+  let pendingKey = null;
+  let currentStringStart = -1;
+  let trackedArray = null;
+  let trackedArrayDepth = -1;
+  let elementIndex = 0;
+  let elementStartLine = -1;
+  let elementDepth = -1;
+  for (let position = 0; position < text.length; position += 1) {
+    const char = text[position];
+    if (char === "\n") {
+      line += 1;
+      inString = false;
+      escaped = false;
+      continue;
+    }
+    if (inString) {
+      if (escaped) {
+        escaped = false;
+      } else if (char === "\\") {
+        escaped = true;
+      } else if (char === '"') {
+        inString = false;
+        const literal = text.slice(currentStringStart, position);
+        let lookahead = position + 1;
+        while (lookahead < text.length && /\s/.test(text[lookahead])) lookahead += 1;
+        if (text[lookahead] === ":") pendingKey = literal;
+      }
+      continue;
+    }
+    if (char === '"') {
+      inString = true;
+      currentStringStart = position + 1;
+      continue;
+    }
+    if (char === "[") {
+      if (depth === 1 && (pendingKey === "steps" || pendingKey === "transitions")) {
+        trackedArray = pendingKey;
+        trackedArrayDepth = depth;
+        elementIndex = 0;
+      }
+      depth += 1;
+      pendingKey = null;
+      continue;
+    }
+    if (char === "{") {
+      if (trackedArray && depth === trackedArrayDepth + 1 && elementStartLine === -1) {
+        elementStartLine = line;
+        elementDepth = depth;
+      }
+      depth += 1;
+      pendingKey = null;
+      continue;
+    }
+    if (char === "}") {
+      depth -= 1;
+      if (trackedArray && elementStartLine !== -1 && depth === elementDepth) {
+        const range = { index: elementIndex, startLine: elementStartLine, endLine: line };
+        if (trackedArray === "steps") steps.push(range);
+        else transitions.push(range);
+        elementIndex += 1;
+        elementStartLine = -1;
+        elementDepth = -1;
+      }
+      pendingKey = null;
+      continue;
+    }
+    if (char === "]") {
+      depth -= 1;
+      if (trackedArray && depth === trackedArrayDepth) {
+        trackedArray = null;
+        trackedArrayDepth = -1;
+        elementStartLine = -1;
+        elementDepth = -1;
+      }
+      pendingKey = null;
+      continue;
+    }
+  }
+  return { steps, transitions };
+}
+function readIdsAt(parsed, key, idField) {
+  if (!parsed || typeof parsed !== "object") return [];
+  const collection = parsed[key];
+  if (!Array.isArray(collection)) return [];
+  return collection.map((element) => {
+    if (!element || typeof element !== "object") return null;
+    const value = element[idField];
+    return typeof value === "string" && value.length > 0 ? value : null;
+  });
+}
+function locateDefinitionJsonEntities(text, parsed) {
+  const scanned = scanTopLevelArrayElements(text);
+  const stepIds = readIdsAt(parsed, "steps", "stepId");
+  const transitionIds = readIdsAt(parsed, "transitions", "transitionId");
+  const steps = /* @__PURE__ */ new Map();
+  for (const element of scanned.steps) {
+    const id = stepIds[element.index];
+    if (id && !steps.has(id)) steps.set(id, { startLine: element.startLine, endLine: element.endLine });
+  }
+  const transitions = /* @__PURE__ */ new Map();
+  for (const element of scanned.transitions) {
+    const id = transitionIds[element.index];
+    if (id && !transitions.has(id)) {
+      transitions.set(id, { startLine: element.startLine, endLine: element.endLine });
+    }
+  }
+  return { steps, transitions };
+}
+function locateIssues(issues, locations) {
+  const located = [];
+  for (const issue of issues) {
+    const range = issue.nodeId ? locations.steps.get(issue.nodeId) : issue.edgeId ? locations.transitions.get(issue.edgeId) : void 0;
+    if (!range) continue;
+    located.push({ issueId: issue.id, severity: issue.severity, line: range.startLine });
+  }
+  return located;
+}
+function severityByLine(located) {
+  const byLine = /* @__PURE__ */ new Map();
+  for (const issue of located) {
+    const existing = byLine.get(issue.line);
+    if (existing === "error") continue;
+    byLine.set(issue.line, issue.severity);
+  }
+  return byLine;
+}
+export {
+  locateDefinitionJsonEntities,
+  locateIssues,
+  severityByLine
+};
+//# sourceMappingURL=definition-json-locations.js.map