@open-mercato/core 0.7.1-develop.7193.1.910a5b0a1e → 0.7.1-develop.7195.1.b5efd1d51a

package/dist/modules/workflows/lib/task-sla.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/workflows/lib/task-sla.ts"],
+  "sourcesContent": ["/**\n * Task SLA scheduler \u2014 reminders and deadline breach for USER_TASK steps.\n *\n * `dueDate` has been display-only until now: nothing ever read it back, and the\n * authored `escalationRules` were dead config. This module makes the deadline\n * real, and it does so on the queue rather than with a poller \u2014 reusing the\n * Phase-3a absolute-deadline backstop the WAIT_FOR_CONDITION step already\n * relies on:\n *\n *   - every job is enqueued ONCE, at task creation, with a delay;\n *   - `deadlineAt` is ABSOLUTE and rides on the payload, so a queue running\n *     behind cannot silently extend the deadline the author configured;\n *   - the handler is IDEMPOTENT \u2014 a completed, cancelled or already-breached\n *     task makes the job a no-op, and the breach is claimed with a conditional\n *     UPDATE so at-least-once delivery still fires it exactly once.\n *\n * `computeTaskSlaSchedule` is PURE (no ORM, DI or registry imports) so the\n * scheduling arithmetic is unit-testable without a workflow.\n */\n\nimport type { EntityManager } from '@mikro-orm/core'\nimport type { AwilixContainer } from 'awilix'\nimport { StepInstance, UserTask, WorkflowInstance } from '../data/entities'\nimport type { TaskOnBreach, TaskReminder } from '../data/validators'\nimport { parseDuration } from './duration'\nimport { resolveTaskBreachHandling, type TaskBreachHandling } from './breach-routing'\nimport {\n  findAgentReviewConfig,\n  resolveAgentReviewBreachHandling,\n  INVOKE_AGENT_ACTIVITY_TYPE,\n  type AgentReviewBreachHandling,\n  type AgentReviewStepLike,\n} from './agent-review'\nimport { findDefinitionForInstance } from './find-definition'\nimport { emitWorkflowsEvent } from '../events'\nimport type * as stepHandlerModule from './step-handler'\nimport type * as transitionHandlerModule from './transition-handler'\nimport type * as workflowExecutorModule from './workflow-executor'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('workflows')\n\nexport type TaskSlaPhase = 'reminder' | 'breach'\n\nexport interface TaskSlaScheduleEntry {\n  phase: TaskSlaPhase\n  /** Absolute time this job should run. */\n  fireAt: string\n  /** Delay from `now`; never negative. */\n  delayMs: number\n}\n\nexport interface TaskSlaSchedule {\n  entries: TaskSlaScheduleEntry[]\n  /** Reminder offsets that could not be parsed, so the caller can log them. */\n  invalidOffsets: string[]\n}\n\n/** Statuses a task is still workable in \u2014 anything else makes an SLA job moot. */\nconst OPEN_TASK_STATUSES = ['PENDING', 'IN_PROGRESS'] as const\n\n/**\n * Resolve the jobs to enqueue for one task.\n *\n * A task with no deadline schedules NOTHING \u2014 reminders without a deadline have\n * nothing to count back from, so they are silently irrelevant rather than an\n * error. A reminder whose moment has already passed is dropped: firing it at\n * creation time would be noise, not a nudge. A reminder offset at or beyond the\n * whole deadline is likewise dropped \u2014 the breach job already speaks for that\n * moment.\n */\nexport function computeTaskSlaSchedule(options: {\n  dueDate: Date | null | undefined\n  reminders?: TaskReminder[] | null\n  now?: Date\n}): TaskSlaSchedule {\n  const { dueDate } = options\n  if (!dueDate || Number.isNaN(dueDate.getTime())) return { entries: [], invalidOffsets: [] }\n\n  const nowMs = (options.now ?? new Date()).getTime()\n  const deadlineMs = dueDate.getTime()\n  const entries: TaskSlaScheduleEntry[] = []\n  const invalidOffsets: string[] = []\n\n  for (const reminder of options.reminders ?? []) {\n    const offset = reminder?.offset\n    if (typeof offset !== 'string' || !offset.length) continue\n\n    let offsetMs: number\n    try {\n      offsetMs = parseDuration(offset)\n    } catch {\n      invalidOffsets.push(offset)\n      continue\n    }\n\n    if (offsetMs <= 0) continue\n    const remindAtMs = deadlineMs - offsetMs\n    if (remindAtMs <= nowMs || remindAtMs >= deadlineMs) continue\n\n    entries.push({\n      phase: 'reminder',\n      fireAt: new Date(remindAtMs).toISOString(),\n      delayMs: remindAtMs - nowMs,\n    })\n  }\n\n  entries.push({\n    phase: 'breach',\n    fireAt: dueDate.toISOString(),\n    delayMs: Math.max(0, deadlineMs - nowMs),\n  })\n\n  entries.sort((left, right) => left.delayMs - right.delayMs)\n\n  return { entries, invalidOffsets }\n}\n\nexport interface ScheduleUserTaskSlaOptions {\n  workflowInstanceId: string\n  stepInstanceId: string\n  branchInstanceId?: string | null\n  userTaskId: string\n  dueDate: Date | null | undefined\n  reminders?: TaskReminder[] | null\n  tenantId: string\n  organizationId: string\n  userId?: string\n  now?: Date\n}\n\n/**\n * Enqueue every SLA job a freshly created task needs.\n *\n * Best-effort by contract: a queue failure must never break the workflow step\n * that created the task, exactly as the assignment event's emission does not.\n */\nexport async function scheduleUserTaskSla(\n  options: ScheduleUserTaskSlaOptions\n): Promise<string[]> {\n  const schedule = computeTaskSlaSchedule({\n    dueDate: options.dueDate,\n    reminders: options.reminders,\n    now: options.now,\n  })\n\n  if (schedule.invalidOffsets.length) {\n    logger.warn('Task reminder offsets skipped because they are not valid durations', {\n      component: 'task-sla',\n      taskId: options.userTaskId,\n      invalidOffsets: schedule.invalidOffsets,\n    })\n  }\n\n  if (schedule.entries.length === 0) return []\n\n  const deadlineAt = options.dueDate ? options.dueDate.toISOString() : null\n  if (!deadlineAt) return []\n\n  const jobIds: string[] = []\n  try {\n    const { enqueueTaskSlaJob } = await import('./activity-executor')\n    for (const entry of schedule.entries) {\n      const jobId = await enqueueTaskSlaJob({\n        workflowInstanceId: options.workflowInstanceId,\n        stepInstanceId: options.stepInstanceId,\n        branchInstanceId: options.branchInstanceId ?? null,\n        userTaskId: options.userTaskId,\n        phase: entry.phase,\n        deadlineAt,\n        fireAt: entry.fireAt,\n        delayMs: entry.delayMs,\n        tenantId: options.tenantId,\n        organizationId: options.organizationId,\n        userId: options.userId,\n      })\n      jobIds.push(jobId)\n    }\n  } catch (error) {\n    logger.error('Failed to schedule task SLA jobs', {\n      component: 'task-sla',\n      taskId: options.userTaskId,\n      err: error,\n    })\n  }\n\n  return jobIds\n}\n\nexport type TaskSlaOutcome = 'noop' | 'reminded' | 'breached'\n\nexport interface RunTaskSlaJobOptions {\n  userTaskId: string\n  stepInstanceId: string\n  workflowInstanceId: string\n  branchInstanceId?: string | null\n  phase: TaskSlaPhase\n  deadlineAt: string\n  tenantId: string\n  organizationId: string\n  userId?: string\n}\n\n/**\n * Run one SLA job.\n *\n * Every early return is a deliberate no-op rather than an error: the queue\n * retries, and a task that was completed in the meantime is the ordinary case,\n * not a failure.\n */\nexport async function runTaskSlaJob(\n  em: EntityManager,\n  container: AwilixContainer,\n  options: RunTaskSlaJobOptions\n): Promise<TaskSlaOutcome> {\n  const { tenantId, organizationId } = options\n\n  const task = await em.findOne(UserTask, {\n    id: options.userTaskId,\n    tenantId,\n    organizationId,\n  })\n\n  if (!task) return 'noop'\n  if (!OPEN_TASK_STATUSES.includes(task.status as (typeof OPEN_TASK_STATUSES)[number])) return 'noop'\n\n  const deadlineMs = Date.parse(options.deadlineAt)\n  if (Number.isNaN(deadlineMs)) return 'noop'\n\n  if (options.phase === 'reminder') {\n    // A reminder that arrives after the deadline has nothing left to warn\n    // about, and one for an already-breached task is strictly noise.\n    if (task.escalatedAt) return 'noop'\n    if (Date.now() >= deadlineMs) return 'noop'\n\n    await logTaskSlaEvent(em, container, options, 'USER_TASK_REMINDER_DUE', {\n      taskId: task.id,\n      taskName: task.taskName,\n      dueDate: options.deadlineAt,\n    })\n\n    await emitTaskSlaEvent(em, 'workflows.task.reminder_due', task, options)\n    return 'reminded'\n  }\n\n  // Claim the breach with a conditional UPDATE rather than a read-then-write:\n  // the queue delivers at least once, and two deliveries reading `escalated_at\n  // IS NULL` would both fire. The loser updates zero rows and no-ops.\n  const now = new Date()\n  const claimed = await em.nativeUpdate(\n    UserTask,\n    {\n      id: task.id,\n      tenantId,\n      organizationId,\n      status: { $in: [...OPEN_TASK_STATUSES] },\n      escalatedAt: null,\n    },\n    { escalatedAt: now, updatedAt: now }\n  )\n\n  if (claimed === 0) return 'noop'\n\n  task.escalatedAt = now\n  task.updatedAt = now\n\n  // WHICH path the breach took is part of the audit trail, not an implementation\n  // detail: \"the deadline passed\" and \"the deadline passed and the run was\n  // routed away from this task\" are different facts about the same instant.\n  const handling = await applyBreachHandling(em, container, task, options, now)\n\n  await logTaskSlaEvent(em, container, options, 'USER_TASK_DEADLINE_BREACHED', {\n    taskId: task.id,\n    taskName: task.taskName,\n    dueDate: options.deadlineAt,\n    breachedAt: now.toISOString(),\n    onBreach: handling.outcome,\n    ...(handling.detail ?? {}),\n  })\n\n  await emitTaskSlaEvent(em, 'workflows.task.deadline_breached', task, options)\n\n  // A reassignment only means anything once the new owner is told about it, and\n  // the assignment event is the one path that already reaches both an individual\n  // and a role queue.\n  if (handling.outcome === 'reassigned') {\n    await emitTaskSlaEvent(em, 'workflows.task.assigned', task, options)\n  }\n\n  if (handling.resumeInstance) {\n    await resumeAfterBreachRoute(em, container, task, options, handling.resumeInstance)\n  }\n\n  return 'breached'\n}\n\ntype BreachOutcome =\n  | 'none'\n  | 'notified'\n  | 'reassigned'\n  | 'routed'\n  | 'route_skipped_branch'\n  | 'attention'\n\ninterface AppliedBreachHandling {\n  outcome: BreachOutcome\n  detail?: Record<string, unknown>\n  resumeInstance?: { stepId: string; toStepId: string; transitionId?: string }\n}\n\ntype BreachResolution = TaskBreachHandling | AgentReviewBreachHandling\n\n/**\n * A step whose breached task is an agent DISPOSITION task rather than an\n * authored USER_TASK. Recognised structurally from the compiled step (an\n * AUTOMATED step carrying an INVOKE_AGENT activity), which is the same shape\n * `graph-utils` round-trips the node from.\n */\nfunction isInvokeAgentStepDef(step: AgentReviewStepLike | undefined): boolean {\n  return (step?.activities ?? []).some(\n    (activity) => activity?.activityType === INVOKE_AGENT_ACTIVITY_TYPE\n  )\n}\n\n/**\n * Apply the resolver's answer to the task row. Routing itself is deferred to\n * `resumeAfterBreachRoute` so the workflow only advances after the breach has\n * been recorded and announced.\n *\n * Which resolver answers depends on WHAT the task is. An authored USER_TASK\n * keeps the full \u00A76.1 vocabulary, including \"follow a route\". An agent\n * disposition task (\u00A77.5) gets the escalate-only one: notify, reassign, or mark\n * the run for attention. It can reach neither a verdict nor a route, because\n * both would resolve a pending proposal without a human \u2014 routing the run past\n * a proposal nobody answered silently drops the mutation the agent proposed,\n * which is a rejection in everything but name. A hand-authored `kind:'slaBreach'`\n * transition on an agent step therefore cannot fire either: the branch below is\n * taken from the STEP's shape, not from the config the author supplied.\n */\nasync function applyBreachHandling(\n  em: EntityManager,\n  container: AwilixContainer,\n  task: UserTask,\n  options: RunTaskSlaJobOptions,\n  now: Date\n): Promise<AppliedBreachHandling> {\n  let resolution: BreachResolution = { kind: 'none' }\n  let stepId: string | null = null\n  let instance: WorkflowInstance | null = null\n\n  try {\n    const stepInstance = await em.findOne(StepInstance, {\n      id: options.stepInstanceId,\n      tenantId: options.tenantId,\n      organizationId: options.organizationId,\n    })\n    stepId = stepInstance?.stepId ?? null\n\n    instance = await em.findOne(WorkflowInstance, {\n      id: options.workflowInstanceId,\n      tenantId: options.tenantId,\n      organizationId: options.organizationId,\n    })\n\n    if (stepId && instance) {\n      const definition = await findDefinitionForInstance(em, instance)\n      const stepDef = (definition?.definition?.steps ?? []).find(\n        (step: { stepId?: string }) => step.stepId === stepId\n      ) as\n        | ({ userTaskConfig?: { onBreach?: TaskOnBreach | null } } & AgentReviewStepLike)\n        | undefined\n\n      resolution = isInvokeAgentStepDef(stepDef)\n        ? resolveAgentReviewBreachHandling(findAgentReviewConfig(stepDef)?.onBreach ?? null)\n        : resolveTaskBreachHandling(\n            definition?.definition ?? null,\n            stepId,\n            stepDef?.userTaskConfig?.onBreach ?? null\n          )\n    }\n  } catch (error) {\n    // A definition the engine can no longer read must not strand the breach:\n    // the task is already marked escalated and the event still fires.\n    logger.error('Failed to resolve breach handling; falling back to notify-only', {\n      component: 'task-sla',\n      taskId: task.id,\n      err: error,\n    })\n    return { outcome: 'none' }\n  }\n\n  if (resolution.kind === 'notify') return { outcome: 'notified' }\n\n  if (resolution.kind === 'attention') {\n    if (!instance) return { outcome: 'none' }\n    await markInstanceForAttention(em, instance, stepId, task, now)\n    return { outcome: 'attention', detail: { stepId } }\n  }\n\n  if (resolution.kind === 'reassign') {\n    task.assignedTo = resolution.assignedTo\n    task.assignedToRoles = resolution.assignedToRoles\n    task.claimedBy = null\n    task.claimedAt = null\n    task.status = 'PENDING'\n    task.escalatedTo = resolution.assignedTo ?? resolution.assignedToRoles?.[0] ?? null\n    task.reassignedAt = now\n    task.reassignReason = 'sla_breach'\n    task.updatedAt = now\n    await em.flush()\n    return {\n      outcome: 'reassigned',\n      detail: {\n        reassignedTo: resolution.assignedTo,\n        reassignedToRoles: resolution.assignedToRoles,\n      },\n    }\n  }\n\n  if (resolution.kind === 'route') {\n    const toStepId = resolution.transition.toStepId\n    if (!stepId || !toStepId) return { outcome: 'none' }\n\n    // A branch-scoped task does NOT follow its breach route, for the same\n    // reason a decision button does not select a route inside a branch\n    // (`completeUserTask`): a branch advances through `resumeBranch` with its\n    // own token, and overriding that is a parallel-execution change rather than\n    // a task-surface one.\n    if (options.branchInstanceId) {\n      return { outcome: 'route_skipped_branch', detail: { transitionId: resolution.transition.transitionId } }\n    }\n\n    // The task is superseded by the route, not abandoned: `ESCALATED` is an\n    // existing `UserTaskStatus`, so no state machine changes.\n    task.status = 'ESCALATED'\n    task.updatedAt = now\n    await em.flush()\n\n    return {\n      outcome: 'routed',\n      detail: { transitionId: resolution.transition.transitionId, toStepId },\n      resumeInstance: { stepId, toStepId, transitionId: resolution.transition.transitionId },\n    }\n  }\n\n  return { outcome: 'none' }\n}\n\n/**\n * Mark a run for triage without touching its state machine.\n *\n * The instance is ALREADY paused \u2014 an agent step parks on the proposal-ready\n * signal \u2014 so this writes only the engine-owned `metadata.attention` marker the\n * failure queue already uses (`GET /api/workflows/instances?attention=true`\n * lists it). Deliberately no status write, no `errorMessage`: the run is not\n * failing, it is waiting on a person who is late, and the proposal is still\n * pending for whoever picks it up.\n */\nasync function markInstanceForAttention(\n  em: EntityManager,\n  instance: WorkflowInstance,\n  stepId: string | null,\n  task: UserTask,\n  now: Date\n): Promise<void> {\n  instance.metadata = {\n    ...(instance.metadata || {}),\n    attention: {\n      reason: 'DISPOSITION_SLA_BREACH',\n      ...(stepId ? { stepId } : {}),\n      at: now.toISOString(),\n    },\n  }\n  instance.updatedAt = now\n  await em.flush()\n\n  logger.warn('Agent disposition deadline passed; run marked for attention', {\n    component: 'task-sla',\n    taskId: task.id,\n    workflowInstanceId: instance.id,\n    stepId,\n  })\n}\n\n/**\n * Follow the breach route: exit the task's step and drive the run onward,\n * mirroring how `fireTimer` resumes a run parked on a WAIT_FOR_TIMER step.\n *\n * Best-effort: a routing failure leaves the run exactly where it was, with the\n * breach already recorded, rather than throwing the queue job into a retry loop\n * that would re-announce a breach that has already fired.\n */\nasync function resumeAfterBreachRoute(\n  em: EntityManager,\n  container: AwilixContainer,\n  task: UserTask,\n  options: RunTaskSlaJobOptions,\n  route: { stepId: string; toStepId: string; transitionId?: string }\n): Promise<void> {\n  try {\n    const instance = await em.findOne(WorkflowInstance, {\n      id: options.workflowInstanceId,\n      tenantId: options.tenantId,\n      organizationId: options.organizationId,\n    })\n    if (!instance) return\n\n    const stepHandler = container.resolve<typeof stepHandlerModule>('stepHandler')\n    const transitionHandler = container.resolve<typeof transitionHandlerModule>('transitionHandler')\n    const workflowExecutor = container.resolve<typeof workflowExecutorModule>('workflowExecutor')\n\n    const stepInstance = await em.findOne(StepInstance, {\n      id: options.stepInstanceId,\n      status: 'ACTIVE',\n    })\n    if (stepInstance) {\n      await stepHandler.exitStep(em, stepInstance, {\n        userTaskId: task.id,\n        slaBreached: true,\n      })\n    }\n\n    const transitionResult = await transitionHandler.executeTransition(\n      em,\n      container,\n      instance,\n      route.stepId,\n      route.toStepId,\n      {\n        workflowContext: instance.context,\n        userId: options.userId,\n        transitionId: route.transitionId,\n      },\n    )\n\n    if (!transitionResult.success) {\n      logger.error('SLA-breach transition failed', {\n        component: 'task-sla',\n        taskId: task.id,\n        err: transitionResult.error,\n      })\n      return\n    }\n\n    await workflowExecutor.executeWorkflow(em, container, instance.id, { userId: options.userId })\n  } catch (error) {\n    logger.error('Failed to follow the SLA-breach route', {\n      component: 'task-sla',\n      taskId: task.id,\n      err: error,\n    })\n  }\n}\n\nasync function logTaskSlaEvent(\n  em: EntityManager,\n  container: AwilixContainer,\n  options: RunTaskSlaJobOptions,\n  eventType: string,\n  eventData: Record<string, unknown>\n): Promise<void> {\n  try {\n    const eventLogger = container.resolve<{\n      logWorkflowEvent: (\n        em: EntityManager,\n        event: Record<string, unknown>\n      ) => Promise<unknown>\n    }>('eventLogger')\n\n    await eventLogger.logWorkflowEvent(em, {\n      workflowInstanceId: options.workflowInstanceId,\n      stepInstanceId: options.stepInstanceId,\n      ...(options.branchInstanceId ? { branchInstanceId: options.branchInstanceId } : {}),\n      eventType,\n      eventData,\n      userId: options.userId,\n      tenantId: options.tenantId,\n      organizationId: options.organizationId,\n    })\n  } catch (error) {\n    logger.error('Failed to log task SLA workflow event', {\n      component: 'task-sla',\n      taskId: options.userTaskId,\n      eventType,\n      err: error,\n    })\n  }\n}\n\nasync function emitTaskSlaEvent(\n  em: EntityManager,\n  eventId: 'workflows.task.reminder_due' | 'workflows.task.deadline_breached' | 'workflows.task.assigned',\n  task: UserTask,\n  options: RunTaskSlaJobOptions\n): Promise<void> {\n  try {\n    const instance = await em.findOne(WorkflowInstance, {\n      id: options.workflowInstanceId,\n      tenantId: options.tenantId,\n      organizationId: options.organizationId,\n    })\n\n    await emitWorkflowsEvent(\n      eventId,\n      {\n        taskId: task.id,\n        taskName: task.taskName,\n        workflowInstanceId: options.workflowInstanceId,\n        workflowId: instance?.workflowId ?? null,\n        workflowName: instance?.workflowId ?? '',\n        assignedUserId: task.claimedBy ?? task.assignedTo ?? null,\n        assignedToRoles: task.assignedToRoles ?? null,\n        dueDate: options.deadlineAt,\n        entityBindings: task.entityBindings ?? null,\n        tenantId: options.tenantId,\n        organizationId: options.organizationId,\n      },\n      { persistent: true }\n    )\n  } catch (error) {\n    logger.error('Failed to emit task SLA event', {\n      component: 'task-sla',\n      taskId: task.id,\n      eventId,\n      err: error,\n    })\n  }\n}\n"],
+  "mappings": "AAsBA,SAAS,cAAc,UAAU,wBAAwB;AAEzD,SAAS,qBAAqB;AAC9B,SAAS,iCAA0D;AACnE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AACP,SAAS,iCAAiC;AAC1C,SAAS,0BAA0B;AAInC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAmBvC,MAAM,qBAAqB,CAAC,WAAW,aAAa;AAY7C,SAAS,uBAAuB,SAInB;AAClB,QAAM,EAAE,QAAQ,IAAI;AACpB,MAAI,CAAC,WAAW,OAAO,MAAM,QAAQ,QAAQ,CAAC,EAAG,QAAO,EAAE,SAAS,CAAC,GAAG,gBAAgB,CAAC,EAAE;AAE1F,QAAM,SAAS,QAAQ,OAAO,oBAAI,KAAK,GAAG,QAAQ;AAClD,QAAM,aAAa,QAAQ,QAAQ;AACnC,QAAM,UAAkC,CAAC;AACzC,QAAM,iBAA2B,CAAC;AAElC,aAAW,YAAY,QAAQ,aAAa,CAAC,GAAG;AAC9C,UAAM,SAAS,UAAU;AACzB,QAAI,OAAO,WAAW,YAAY,CAAC,OAAO,OAAQ;AAElD,QAAI;AACJ,QAAI;AACF,iBAAW,cAAc,MAAM;AAAA,IACjC,QAAQ;AACN,qBAAe,KAAK,MAAM;AAC1B;AAAA,IACF;AAEA,QAAI,YAAY,EAAG;AACnB,UAAM,aAAa,aAAa;AAChC,QAAI,cAAc,SAAS,cAAc,WAAY;AAErD,YAAQ,KAAK;AAAA,MACX,OAAO;AAAA,MACP,QAAQ,IAAI,KAAK,UAAU,EAAE,YAAY;AAAA,MACzC,SAAS,aAAa;AAAA,IACxB,CAAC;AAAA,EACH;AAEA,UAAQ,KAAK;AAAA,IACX,OAAO;AAAA,IACP,QAAQ,QAAQ,YAAY;AAAA,IAC5B,SAAS,KAAK,IAAI,GAAG,aAAa,KAAK;AAAA,EACzC,CAAC;AAED,UAAQ,KAAK,CAAC,MAAM,UAAU,KAAK,UAAU,MAAM,OAAO;AAE1D,SAAO,EAAE,SAAS,eAAe;AACnC;AAqBA,eAAsB,oBACpB,SACmB;AACnB,QAAM,WAAW,uBAAuB;AAAA,IACtC,SAAS,QAAQ;AAAA,IACjB,WAAW,QAAQ;AAAA,IACnB,KAAK,QAAQ;AAAA,EACf,CAAC;AAED,MAAI,SAAS,eAAe,QAAQ;AAClC,WAAO,KAAK,sEAAsE;AAAA,MAChF,WAAW;AAAA,MACX,QAAQ,QAAQ;AAAA,MAChB,gBAAgB,SAAS;AAAA,IAC3B,CAAC;AAAA,EACH;AAEA,MAAI,SAAS,QAAQ,WAAW,EAAG,QAAO,CAAC;AAE3C,QAAM,aAAa,QAAQ,UAAU,QAAQ,QAAQ,YAAY,IAAI;AACrE,MAAI,CAAC,WAAY,QAAO,CAAC;AAEzB,QAAM,SAAmB,CAAC;AAC1B,MAAI;AACF,UAAM,EAAE,kBAAkB,IAAI,MAAM,OAAO,qBAAqB;AAChE,eAAW,SAAS,SAAS,SAAS;AACpC,YAAM,QAAQ,MAAM,kBAAkB;AAAA,QACpC,oBAAoB,QAAQ;AAAA,QAC5B,gBAAgB,QAAQ;AAAA,QACxB,kBAAkB,QAAQ,oBAAoB;AAAA,QAC9C,YAAY,QAAQ;AAAA,QACpB,OAAO,MAAM;AAAA,QACb;AAAA,QACA,QAAQ,MAAM;AAAA,QACd,SAAS,MAAM;AAAA,QACf,UAAU,QAAQ;AAAA,QAClB,gBAAgB,QAAQ;AAAA,QACxB,QAAQ,QAAQ;AAAA,MAClB,CAAC;AACD,aAAO,KAAK,KAAK;AAAA,IACnB;AAAA,EACF,SAAS,OAAO;AACd,WAAO,MAAM,oCAAoC;AAAA,MAC/C,WAAW;AAAA,MACX,QAAQ,QAAQ;AAAA,MAChB,KAAK;AAAA,IACP,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAuBA,eAAsB,cACpB,IACA,WACA,SACyB;AACzB,QAAM,EAAE,UAAU,eAAe,IAAI;AAErC,QAAM,OAAO,MAAM,GAAG,QAAQ,UAAU;AAAA,IACtC,IAAI,QAAQ;AAAA,IACZ;AAAA,IACA;AAAA,EACF,CAAC;AAED,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,CAAC,mBAAmB,SAAS,KAAK,MAA6C,EAAG,QAAO;AAE7F,QAAM,aAAa,KAAK,MAAM,QAAQ,UAAU;AAChD,MAAI,OAAO,MAAM,UAAU,EAAG,QAAO;AAErC,MAAI,QAAQ,UAAU,YAAY;AAGhC,QAAI,KAAK,YAAa,QAAO;AAC7B,QAAI,KAAK,IAAI,KAAK,WAAY,QAAO;AAErC,UAAM,gBAAgB,IAAI,WAAW,SAAS,0BAA0B;AAAA,MACtE,QAAQ,KAAK;AAAA,MACb,UAAU,KAAK;AAAA,MACf,SAAS,QAAQ;AAAA,IACnB,CAAC;AAED,UAAM,iBAAiB,IAAI,+BAA+B,MAAM,OAAO;AACvE,WAAO;AAAA,EACT;AAKA,QAAM,MAAM,oBAAI,KAAK;AACrB,QAAM,UAAU,MAAM,GAAG;AAAA,IACvB;AAAA,IACA;AAAA,MACE,IAAI,KAAK;AAAA,MACT;AAAA,MACA;AAAA,MACA,QAAQ,EAAE,KAAK,CAAC,GAAG,kBAAkB,EAAE;AAAA,MACvC,aAAa;AAAA,IACf;AAAA,IACA,EAAE,aAAa,KAAK,WAAW,IAAI;AAAA,EACrC;AAEA,MAAI,YAAY,EAAG,QAAO;AAE1B,OAAK,cAAc;AACnB,OAAK,YAAY;AAKjB,QAAM,WAAW,MAAM,oBAAoB,IAAI,WAAW,MAAM,SAAS,GAAG;AAE5E,QAAM,gBAAgB,IAAI,WAAW,SAAS,+BAA+B;AAAA,IAC3E,QAAQ,KAAK;AAAA,IACb,UAAU,KAAK;AAAA,IACf,SAAS,QAAQ;AAAA,IACjB,YAAY,IAAI,YAAY;AAAA,IAC5B,UAAU,SAAS;AAAA,IACnB,GAAI,SAAS,UAAU,CAAC;AAAA,EAC1B,CAAC;AAED,QAAM,iBAAiB,IAAI,oCAAoC,MAAM,OAAO;AAK5E,MAAI,SAAS,YAAY,cAAc;AACrC,UAAM,iBAAiB,IAAI,2BAA2B,MAAM,OAAO;AAAA,EACrE;AAEA,MAAI,SAAS,gBAAgB;AAC3B,UAAM,uBAAuB,IAAI,WAAW,MAAM,SAAS,SAAS,cAAc;AAAA,EACpF;AAEA,SAAO;AACT;AAwBA,SAAS,qBAAqB,MAAgD;AAC5E,UAAQ,MAAM,cAAc,CAAC,GAAG;AAAA,IAC9B,CAAC,aAAa,UAAU,iBAAiB;AAAA,EAC3C;AACF;AAiBA,eAAe,oBACb,IACA,WACA,MACA,SACA,KACgC;AAChC,MAAI,aAA+B,EAAE,MAAM,OAAO;AAClD,MAAI,SAAwB;AAC5B,MAAI,WAAoC;AAExC,MAAI;AACF,UAAM,eAAe,MAAM,GAAG,QAAQ,cAAc;AAAA,MAClD,IAAI,QAAQ;AAAA,MACZ,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,IAC1B,CAAC;AACD,aAAS,cAAc,UAAU;AAEjC,eAAW,MAAM,GAAG,QAAQ,kBAAkB;AAAA,MAC5C,IAAI,QAAQ;AAAA,MACZ,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,IAC1B,CAAC;AAED,QAAI,UAAU,UAAU;AACtB,YAAM,aAAa,MAAM,0BAA0B,IAAI,QAAQ;AAC/D,YAAM,WAAW,YAAY,YAAY,SAAS,CAAC,GAAG;AAAA,QACpD,CAAC,SAA8B,KAAK,WAAW;AAAA,MACjD;AAIA,mBAAa,qBAAqB,OAAO,IACrC,iCAAiC,sBAAsB,OAAO,GAAG,YAAY,IAAI,IACjF;AAAA,QACE,YAAY,cAAc;AAAA,QAC1B;AAAA,QACA,SAAS,gBAAgB,YAAY;AAAA,MACvC;AAAA,IACN;AAAA,EACF,SAAS,OAAO;AAGd,WAAO,MAAM,kEAAkE;AAAA,MAC7E,WAAW;AAAA,MACX,QAAQ,KAAK;AAAA,MACb,KAAK;AAAA,IACP,CAAC;AACD,WAAO,EAAE,SAAS,OAAO;AAAA,EAC3B;AAEA,MAAI,WAAW,SAAS,SAAU,QAAO,EAAE,SAAS,WAAW;AAE/D,MAAI,WAAW,SAAS,aAAa;AACnC,QAAI,CAAC,SAAU,QAAO,EAAE,SAAS,OAAO;AACxC,UAAM,yBAAyB,IAAI,UAAU,QAAQ,MAAM,GAAG;AAC9D,WAAO,EAAE,SAAS,aAAa,QAAQ,EAAE,OAAO,EAAE;AAAA,EACpD;AAEA,MAAI,WAAW,SAAS,YAAY;AAClC,SAAK,aAAa,WAAW;AAC7B,SAAK,kBAAkB,WAAW;AAClC,SAAK,YAAY;AACjB,SAAK,YAAY;AACjB,SAAK,SAAS;AACd,SAAK,cAAc,WAAW,cAAc,WAAW,kBAAkB,CAAC,KAAK;AAC/E,SAAK,eAAe;AACpB,SAAK,iBAAiB;AACtB,SAAK,YAAY;AACjB,UAAM,GAAG,MAAM;AACf,WAAO;AAAA,MACL,SAAS;AAAA,MACT,QAAQ;AAAA,QACN,cAAc,WAAW;AAAA,QACzB,mBAAmB,WAAW;AAAA,MAChC;AAAA,IACF;AAAA,EACF;AAEA,MAAI,WAAW,SAAS,SAAS;AAC/B,UAAM,WAAW,WAAW,WAAW;AACvC,QAAI,CAAC,UAAU,CAAC,SAAU,QAAO,EAAE,SAAS,OAAO;AAOnD,QAAI,QAAQ,kBAAkB;AAC5B,aAAO,EAAE,SAAS,wBAAwB,QAAQ,EAAE,cAAc,WAAW,WAAW,aAAa,EAAE;AAAA,IACzG;AAIA,SAAK,SAAS;AACd,SAAK,YAAY;AACjB,UAAM,GAAG,MAAM;AAEf,WAAO;AAAA,MACL,SAAS;AAAA,MACT,QAAQ,EAAE,cAAc,WAAW,WAAW,cAAc,SAAS;AAAA,MACrE,gBAAgB,EAAE,QAAQ,UAAU,cAAc,WAAW,WAAW,aAAa;AAAA,IACvF;AAAA,EACF;AAEA,SAAO,EAAE,SAAS,OAAO;AAC3B;AAYA,eAAe,yBACb,IACA,UACA,QACA,MACA,KACe;AACf,WAAS,WAAW;AAAA,IAClB,GAAI,SAAS,YAAY,CAAC;AAAA,IAC1B,WAAW;AAAA,MACT,QAAQ;AAAA,MACR,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,MAC3B,IAAI,IAAI,YAAY;AAAA,IACtB;AAAA,EACF;AACA,WAAS,YAAY;AACrB,QAAM,GAAG,MAAM;AAEf,SAAO,KAAK,+DAA+D;AAAA,IACzE,WAAW;AAAA,IACX,QAAQ,KAAK;AAAA,IACb,oBAAoB,SAAS;AAAA,IAC7B;AAAA,EACF,CAAC;AACH;AAUA,eAAe,uBACb,IACA,WACA,MACA,SACA,OACe;AACf,MAAI;AACF,UAAM,WAAW,MAAM,GAAG,QAAQ,kBAAkB;AAAA,MAClD,IAAI,QAAQ;AAAA,MACZ,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,IAC1B,CAAC;AACD,QAAI,CAAC,SAAU;AAEf,UAAM,cAAc,UAAU,QAAkC,aAAa;AAC7E,UAAM,oBAAoB,UAAU,QAAwC,mBAAmB;AAC/F,UAAM,mBAAmB,UAAU,QAAuC,kBAAkB;AAE5F,UAAM,eAAe,MAAM,GAAG,QAAQ,cAAc;AAAA,MAClD,IAAI,QAAQ;AAAA,MACZ,QAAQ;AAAA,IACV,CAAC;AACD,QAAI,cAAc;AAChB,YAAM,YAAY,SAAS,IAAI,cAAc;AAAA,QAC3C,YAAY,KAAK;AAAA,QACjB,aAAa;AAAA,MACf,CAAC;AAAA,IACH;AAEA,UAAM,mBAAmB,MAAM,kBAAkB;AAAA,MAC/C;AAAA,MACA;AAAA,MACA;AAAA,MACA,MAAM;AAAA,MACN,MAAM;AAAA,MACN;AAAA,QACE,iBAAiB,SAAS;AAAA,QAC1B,QAAQ,QAAQ;AAAA,QAChB,cAAc,MAAM;AAAA,MACtB;AAAA,IACF;AAEA,QAAI,CAAC,iBAAiB,SAAS;AAC7B,aAAO,MAAM,gCAAgC;AAAA,QAC3C,WAAW;AAAA,QACX,QAAQ,KAAK;AAAA,QACb,KAAK,iBAAiB;AAAA,MACxB,CAAC;AACD;AAAA,IACF;AAEA,UAAM,iBAAiB,gBAAgB,IAAI,WAAW,SAAS,IAAI,EAAE,QAAQ,QAAQ,OAAO,CAAC;AAAA,EAC/F,SAAS,OAAO;AACd,WAAO,MAAM,yCAAyC;AAAA,MACpD,WAAW;AAAA,MACX,QAAQ,KAAK;AAAA,MACb,KAAK;AAAA,IACP,CAAC;AAAA,EACH;AACF;AAEA,eAAe,gBACb,IACA,WACA,SACA,WACA,WACe;AACf,MAAI;AACF,UAAM,cAAc,UAAU,QAK3B,aAAa;AAEhB,UAAM,YAAY,iBAAiB,IAAI;AAAA,MACrC,oBAAoB,QAAQ;AAAA,MAC5B,gBAAgB,QAAQ;AAAA,MACxB,GAAI,QAAQ,mBAAmB,EAAE,kBAAkB,QAAQ,iBAAiB,IAAI,CAAC;AAAA,MACjF;AAAA,MACA;AAAA,MACA,QAAQ,QAAQ;AAAA,MAChB,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,IAC1B,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,yCAAyC;AAAA,MACpD,WAAW;AAAA,MACX,QAAQ,QAAQ;AAAA,MAChB;AAAA,MACA,KAAK;AAAA,IACP,CAAC;AAAA,EACH;AACF;AAEA,eAAe,iBACb,IACA,SACA,MACA,SACe;AACf,MAAI;AACF,UAAM,WAAW,MAAM,GAAG,QAAQ,kBAAkB;AAAA,MAClD,IAAI,QAAQ;AAAA,MACZ,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,IAC1B,CAAC;AAED,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,QACE,QAAQ,KAAK;AAAA,QACb,UAAU,KAAK;AAAA,QACf,oBAAoB,QAAQ;AAAA,QAC5B,YAAY,UAAU,cAAc;AAAA,QACpC,cAAc,UAAU,cAAc;AAAA,QACtC,gBAAgB,KAAK,aAAa,KAAK,cAAc;AAAA,QACrD,iBAAiB,KAAK,mBAAmB;AAAA,QACzC,SAAS,QAAQ;AAAA,QACjB,gBAAgB,KAAK,kBAAkB;AAAA,QACvC,UAAU,QAAQ;AAAA,QAClB,gBAAgB,QAAQ;AAAA,MAC1B;AAAA,MACA,EAAE,YAAY,KAAK;AAAA,IACrB;AAAA,EACF,SAAS,OAAO;AACd,WAAO,MAAM,iCAAiC;AAAA,MAC5C,WAAW;AAAA,MACX,QAAQ,KAAK;AAAA,MACb;AAAA,MACA,KAAK;AAAA,IACP,CAAC;AAAA,EACH;AACF;",
+  "names": []
+}

package/dist/modules/workflows/lib/task-visibility-request.js

@@ -0,0 +1,266 @@
+import { hasAllFeatures, hasFeature } from "@open-mercato/shared/security/features";
+import { UserTask as UserTaskEntity } from "../data/entities.js";
+import {
+  collectTaskEntityTypes,
+  resolveTaskEntityAccess
+} from "./task-entity-access.js";
+import {
+  buildTaskVisibilityConditions,
+  currentTaskOwnerId,
+  decideTaskVisibility,
+  resolveTaskAffordances,
+  TASK_ACTIONABLE_STATUSES,
+  WORKFLOWS_TASKS_VIEW_ALL_FEATURE
+} from "./task-visibility.js";
+import {
+  resolveTaskVisibilityPolicy
+} from "./task-permission-settings.js";
+async function resolveTaskVisibilityRequestContext(input) {
+  const scope = {
+    tenantId: input.auth.tenantId,
+    organizationId: input.aclOrganizationId
+  };
+  const scopedEntityTypes = [...new Set(input.entityTypes)];
+  const [access, policy] = await Promise.all([
+    resolveTaskEntityAccess({
+      entityTypes: scopedEntityTypes,
+      em: input.em,
+      rbac: input.rbac,
+      userId: input.auth.userId,
+      scope
+    }),
+    resolveTaskVisibilityPolicy(input.moduleConfigService, input.auth.tenantId)
+  ]);
+  return {
+    principal: {
+      kind: "backoffice",
+      userId: input.auth.userId,
+      tenantId: input.auth.tenantId,
+      organizationIds: input.organizationIds ?? null,
+      roleNames: input.auth.roleNames,
+      grantedFeatures: access.grantedFeatures,
+      isSuperAdmin: access.isSuperAdmin
+    },
+    policy,
+    entityAccess: access.map,
+    scopedEntityTypes
+  };
+}
+const NO_GRANTS_RBAC = { loadAcl: async () => null };
+function resolveOptional(container, name) {
+  try {
+    return container.resolve(name) ?? null;
+  } catch {
+    return null;
+  }
+}
+async function resolveTaskVisibilityForRequest(input) {
+  return resolveTaskVisibilityRequestContext({
+    em: input.em,
+    rbac: resolveOptional(input.container, "rbacService") ?? NO_GRANTS_RBAC,
+    // A config read that cannot happen defaults to the NEW model, never the
+    // permissive one — see `lib/task-permission-settings.ts`.
+    moduleConfigService: resolveOptional(
+      input.container,
+      "moduleConfigService"
+    ),
+    auth: input.auth,
+    organizationIds: input.organizationIds,
+    aclOrganizationId: input.aclOrganizationId,
+    entityTypes: input.entityTypes
+  });
+}
+async function collectScopedTaskEntityTypes(em, scope) {
+  const params = [scope.tenantId];
+  let sql = "SELECT DISTINCT unnest(entity_types) AS entity_type FROM user_tasks WHERE tenant_id = ?";
+  if (scope.organizationIds !== null) {
+    if (scope.organizationIds.length === 0) return [];
+    sql += ` AND organization_id IN (${scope.organizationIds.map(() => "?").join(", ")})`;
+    params.push(...scope.organizationIds);
+  }
+  const rows = await em.getConnection().execute(sql, params);
+  const types = /* @__PURE__ */ new Set();
+  for (const row of rows) {
+    const entityType = row?.entity_type;
+    if (typeof entityType === "string" && entityType.length > 0) types.add(entityType);
+  }
+  return [...types];
+}
+function resolveAllowedTaskEntityTypes(context, candidates = context.scopedEntityTypes) {
+  const allowed = [];
+  for (const entityType of new Set(candidates)) {
+    const decision = context.entityAccess.get(entityType);
+    if (!decision || decision.kind !== "requires") continue;
+    if (!hasAllFeatures(context.principal.grantedFeatures, decision.features)) continue;
+    allowed.push(entityType);
+  }
+  return allowed;
+}
+function buildTaskEntityGateConditions(context) {
+  if (context.principal.isSuperAdmin) return [];
+  if (!context.policy.businessContextEnabled) return [];
+  if (canDiagnoseTaskRefusal(context.principal)) return [];
+  return [
+    {
+      $or: [
+        { entityTypes: null },
+        { entityTypes: { $contained: resolveAllowedTaskEntityTypes(context) } }
+      ]
+    }
+  ];
+}
+function buildTaskVisibilityRequestConditions(context, options = {}) {
+  return [
+    ...buildTaskVisibilityConditions(context.principal, context.policy, options),
+    ...buildTaskEntityGateConditions(context)
+  ];
+}
+function asBindingFacts(value) {
+  if (!Array.isArray(value)) return [];
+  const bindings = [];
+  for (const item of value) {
+    if (!item || typeof item !== "object" || Array.isArray(item)) continue;
+    const record = item;
+    if (typeof record.entityType !== "string" || typeof record.entityId !== "string") continue;
+    bindings.push({ entityType: record.entityType, entityId: record.entityId });
+  }
+  return bindings;
+}
+function toTaskFacts(task, options = {}) {
+  return {
+    id: task.id,
+    tenantId: task.tenantId,
+    organizationId: task.organizationId,
+    status: task.status,
+    assignedTo: task.assignedTo ?? null,
+    assigneeKind: task.assigneeKind ?? "user",
+    assignedToRoles: task.assignedToRoles ?? null,
+    claimedBy: task.claimedBy ?? null,
+    entityBindings: asBindingFacts(task.entityBindings),
+    administrativeQueueFeature: options.administrativeQueueFeature ?? null
+  };
+}
+function collectTaskEntityTypesFromTasks(tasks) {
+  return collectTaskEntityTypes(
+    [...tasks].map((task) => ({ entityBindings: asBindingFacts(task.entityBindings) }))
+  );
+}
+function decideTaskAccess(context, task, options = {}) {
+  return decideTaskVisibility(
+    context.principal,
+    toTaskFacts(task, options),
+    context.entityAccess,
+    context.policy
+  );
+}
+function resolveTaskAffordancesForRequest(context, task, decision, options = {}) {
+  return resolveTaskAffordances(context.principal, toTaskFacts(task, options), decision);
+}
+function filterVisibleTasks(context, tasks, options = {}) {
+  return tasks.filter((task) => decideTaskAccess(context, task, options).visible);
+}
+function partitionTaskPage(context, tasks, options = {}) {
+  const visible = [];
+  const entityHidden = [];
+  const diagnosable = canDiagnoseTaskRefusal(context.principal);
+  for (const task of tasks) {
+    const decision = decideTaskAccess(context, task, options);
+    if (decision.visible) {
+      visible.push(task);
+      continue;
+    }
+    if (!diagnosable) continue;
+    if (decision.reason !== "denied:entity-access" && decision.reason !== "denied:unknown-entity-type") {
+      continue;
+    }
+    entityHidden.push({
+      id: task.id,
+      reason: decision.reason,
+      entityType: decision.blockedEntityType ?? null
+    });
+  }
+  return { visible, entityHidden };
+}
+function canDiagnoseTaskRefusal(principal) {
+  return principal.isSuperAdmin || hasFeature(principal.grantedFeatures, WORKFLOWS_TASKS_VIEW_ALL_FEATURE);
+}
+const TASK_NOT_FOUND_BODY = { error: "Task not found" };
+const TASK_ASSIGNED_TO_ANOTHER_USER_BODY = {
+  error: "Task is assigned to another user",
+  code: "TASK_ASSIGNED_TO_ANOTHER_USER"
+};
+const TASK_NOT_ACTIONABLE_BODY = {
+  error: "Task is not assigned to anyone; reassign it before acting on it",
+  code: "TASK_NOT_ACTIONABLE"
+};
+function resolveTaskActRefusal(context, decision, task, options = {}) {
+  if (!decision.visible) return resolveTaskRefusal(context, decision);
+  if (decision.blockedEntityType) return { status: 404, body: TASK_NOT_FOUND_BODY };
+  if (!options.requireOwnership || decision.actable) return null;
+  const facts = toTaskFacts(task, options);
+  if (!TASK_ACTIONABLE_STATUSES.includes(facts.status)) return null;
+  return currentTaskOwnerId(facts) !== null ? { status: 409, body: TASK_ASSIGNED_TO_ANOTHER_USER_BODY } : { status: 403, body: TASK_NOT_ACTIONABLE_BODY };
+}
+async function gateTaskAction(input) {
+  const task = await input.em.findOne(UserTaskEntity, {
+    id: input.taskId,
+    tenantId: input.auth.tenantId,
+    organizationId: input.organizationId
+  });
+  if (!task) return { allowed: false, refusal: { status: 404, body: TASK_NOT_FOUND_BODY } };
+  const visibility = await resolveTaskVisibilityForRequest({
+    container: input.container,
+    em: input.em,
+    auth: input.auth,
+    organizationIds: [input.organizationId],
+    aclOrganizationId: input.organizationId,
+    entityTypes: collectTaskEntityTypesFromTasks([task])
+  });
+  const options = {
+    administrativeQueueFeature: input.administrativeQueueFeature ?? null,
+    requireOwnership: input.requireOwnership ?? false
+  };
+  const refusal = resolveTaskActRefusal(
+    visibility,
+    decideTaskAccess(visibility, task, options),
+    task,
+    options
+  );
+  return refusal ? { allowed: false, refusal } : { allowed: true, task, visibility };
+}
+function resolveTaskRefusal(context, decision) {
+  const isEntityRefusal = decision.reason === "denied:entity-access" || decision.reason === "denied:unknown-entity-type";
+  if (isEntityRefusal && canDiagnoseTaskRefusal(context.principal)) {
+    return {
+      status: 403,
+      body: {
+        error: "Forbidden",
+        reason: decision.reason,
+        ...decision.blockedEntityType ? { entityType: decision.blockedEntityType } : {}
+      }
+    };
+  }
+  return { status: 404, body: TASK_NOT_FOUND_BODY };
+}
+export {
+  TASK_ASSIGNED_TO_ANOTHER_USER_BODY,
+  TASK_NOT_ACTIONABLE_BODY,
+  TASK_NOT_FOUND_BODY,
+  buildTaskEntityGateConditions,
+  buildTaskVisibilityRequestConditions,
+  canDiagnoseTaskRefusal,
+  collectScopedTaskEntityTypes,
+  collectTaskEntityTypesFromTasks,
+  decideTaskAccess,
+  filterVisibleTasks,
+  gateTaskAction,
+  partitionTaskPage,
+  resolveAllowedTaskEntityTypes,
+  resolveTaskActRefusal,
+  resolveTaskAffordancesForRequest,
+  resolveTaskRefusal,
+  resolveTaskVisibilityForRequest,
+  resolveTaskVisibilityRequestContext,
+  toTaskFacts
+};
+//# sourceMappingURL=task-visibility-request.js.map

package/dist/modules/workflows/lib/task-visibility-request.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/workflows/lib/task-visibility-request.ts"],
+  "sourcesContent": ["/**\n * Per-request wiring for the \u00A76.4 task visibility rule.\n *\n * The pure predicate (`lib/task-visibility.ts`) decides; this module is what\n * every backoffice surface calls to assemble its inputs ONCE and to turn the\n * rule into a `WHERE`. Nothing here decides anything on its own \u2014 a second copy\n * of the rule anywhere is a review failure.\n *\n * ## One ACL load per request, not per row\n *\n * `resolveTaskVisibilityRequestContext` performs exactly one `loadAcl`, one\n * config read and one entity-classification pass, and hands back the principal,\n * the tenant policy and the entity-access map together. A page of 50 tasks with\n * two bindings each costs the same as a page of one.\n *\n * ## Why the entity gate is a whitelist and not a denylist\n *\n * The SQL form is\n *\n *     entity_types IS NULL OR entity_types <@ ARRAY[<types the caller may view>]\n *\n * rather than the superficially cheaper `NOT (entity_types && ARRAY[<denied>])`.\n * The two differ on exactly one row: one carrying a type that was not in the\n * enumerated set \u2014 a task written between the enumeration and the main query, or\n * a type the classifier never answered for. The whitelist EXCLUDES it; the\n * denylist ADMITS it. The predicate treats a missing map key as a resolution\n * failure and denies, so only the whitelist agrees with the predicate, and a\n * disagreement between the SQL gate and the predicate is precisely the state\n * where a row is counted in `pagination.total` and then dropped from the page \u2014\n * the \"short page, lying total\" failure D-2 exists to prevent. Fail-closed wins\n * over an index that neither formulation gets to use anyway (a negation is not\n * GIN-servable either).\n *\n * The `entity_types IS NULL` disjunct is load-bearing and must never be dropped:\n * `NULL <@ ARRAY[\u2026]` is NULL, not true, so without it every row written before\n * the column existed \u2014 the whole pre-Phase-4 corpus \u2014 would vanish from its own\n * assignee's inbox. That is an outage, not a narrowing.\n *\n * ## What the tenant opt-out reaches\n *\n * Only the read filter: `businessContextEnabled: false` drops the relationship\n * clause AND the entity clause from the `WHERE`, and nothing else. `actable` and\n * `claimable` come from the predicate, which computes them by the new rule\n * whatever the flag says.\n */\n\nimport type { EntityManager } from '@mikro-orm/core'\nimport { hasAllFeatures, hasFeature } from '@open-mercato/shared/security/features'\nimport { UserTask as UserTaskEntity, type UserTask } from '../data/entities'\nimport {\n  collectTaskEntityTypes,\n  resolveTaskEntityAccess,\n  type TaskEntityAccessRbacService,\n  type TaskEntityAccessScope,\n} from './task-entity-access'\nimport {\n  buildTaskVisibilityConditions,\n  currentTaskOwnerId,\n  decideTaskVisibility,\n  resolveTaskAffordances,\n  TASK_ACTIONABLE_STATUSES,\n  WORKFLOWS_TASKS_VIEW_ALL_FEATURE,\n  type BackofficeTaskPrincipal,\n  type TaskAffordances,\n  type TaskEntityAccessMap,\n  type TaskEntityBindingFact,\n  type TaskFacts,\n  type TaskVisibilityDecision,\n  type TaskVisibilityFilterOptions,\n  type TaskVisibilityPolicy,\n} from './task-visibility'\nimport {\n  resolveTaskVisibilityPolicy,\n  type TaskPermissionsConfigService,\n} from './task-permission-settings'\n\n/**\n * Everything the rule needs about this request, resolved once.\n *\n * `scopedEntityTypes` is the universe the entity whitelist is drawn from: for a\n * list it is the distinct authored types present in the caller's tenant and\n * organizations, for a single task it is that task's own binding types.\n */\nexport type TaskVisibilityRequestContext = {\n  principal: BackofficeTaskPrincipal\n  policy: TaskVisibilityPolicy\n  entityAccess: TaskEntityAccessMap\n  scopedEntityTypes: readonly string[]\n}\n\nexport type TaskVisibilityAuth = {\n  userId: string\n  tenantId: string\n  roleNames: readonly string[]\n}\n\nexport type ResolveTaskVisibilityRequestContextInput = {\n  em: EntityManager\n  rbac: TaskEntityAccessRbacService\n  moduleConfigService: TaskPermissionsConfigService | null | undefined\n  auth: TaskVisibilityAuth\n  /**\n   * `null`/`undefined` = unrestricted operator, matching what\n   * `resolveOrganizationScopeFilter` returns for the wildcard scope.\n   */\n  organizationIds: readonly string[] | null | undefined\n  /** The organization the ACL is loaded against, as every other route does. */\n  aclOrganizationId: string | null\n  /** Authored binding types the gate must be able to answer for. */\n  entityTypes: Iterable<string>\n}\n\n/**\n * Assemble the request context: one ACL load, one classification pass, one\n * tenant-setting read.\n *\n * Nothing is caught. A resolver that throws must fail the whole request rather\n * than degrade to an empty map \u2014 an empty map denies today, but \"swallow and\n * carry on\" is the shape of bug that later becomes \"swallow and pass\".\n */\nexport async function resolveTaskVisibilityRequestContext(\n  input: ResolveTaskVisibilityRequestContextInput,\n): Promise<TaskVisibilityRequestContext> {\n  const scope: TaskEntityAccessScope = {\n    tenantId: input.auth.tenantId,\n    organizationId: input.aclOrganizationId,\n  }\n  const scopedEntityTypes = [...new Set(input.entityTypes)]\n\n  const [access, policy] = await Promise.all([\n    resolveTaskEntityAccess({\n      entityTypes: scopedEntityTypes,\n      em: input.em,\n      rbac: input.rbac,\n      userId: input.auth.userId,\n      scope,\n    }),\n    resolveTaskVisibilityPolicy(input.moduleConfigService, input.auth.tenantId),\n  ])\n\n  return {\n    principal: {\n      kind: 'backoffice',\n      userId: input.auth.userId,\n      tenantId: input.auth.tenantId,\n      organizationIds: input.organizationIds ?? null,\n      roleNames: input.auth.roleNames,\n      grantedFeatures: access.grantedFeatures,\n      isSuperAdmin: access.isSuperAdmin,\n    },\n    policy,\n    entityAccess: access.map,\n    scopedEntityTypes,\n  }\n}\n\n/** The slice of the DI container the route helper below reaches for. */\nexport type TaskVisibilityContainer = { resolve: <T>(name: string) => T }\n\n/**\n * An ACL that grants nothing.\n *\n * Used when `rbacService` cannot be resolved. Deny-everything is the only safe\n * reading of \"the authorization service is missing\", and it is loud \u2014 an empty\n * inbox is noticed immediately, whereas failing the request open would not be\n * noticed at all.\n */\nconst NO_GRANTS_RBAC: TaskEntityAccessRbacService = { loadAcl: async () => null }\n\nfunction resolveOptional<T>(container: TaskVisibilityContainer, name: string): T | null {\n  try {\n    return container.resolve<T>(name) ?? null\n  } catch {\n    return null\n  }\n}\n\n/** Assemble the context from a request container. */\nexport async function resolveTaskVisibilityForRequest(input: {\n  container: TaskVisibilityContainer\n  em: EntityManager\n  auth: TaskVisibilityAuth\n  organizationIds: readonly string[] | null | undefined\n  aclOrganizationId: string | null\n  entityTypes: Iterable<string>\n}): Promise<TaskVisibilityRequestContext> {\n  return resolveTaskVisibilityRequestContext({\n    em: input.em,\n    rbac: resolveOptional<TaskEntityAccessRbacService>(input.container, 'rbacService') ?? NO_GRANTS_RBAC,\n    // A config read that cannot happen defaults to the NEW model, never the\n    // permissive one \u2014 see `lib/task-permission-settings.ts`.\n    moduleConfigService: resolveOptional<TaskPermissionsConfigService>(\n      input.container,\n      'moduleConfigService',\n    ),\n    auth: input.auth,\n    organizationIds: input.organizationIds,\n    aclOrganizationId: input.aclOrganizationId,\n    entityTypes: input.entityTypes,\n  })\n}\n\nexport type ScopedTaskEntityTypeScope = {\n  tenantId: string\n  organizationIds: readonly string[] | null\n}\n\n/**\n * The distinct authored binding types in the caller's scope.\n *\n * One `SELECT DISTINCT unnest(entity_types)` rather than a whitelist derived\n * from the entity registry: the registry universe is hundreds of ids, each of\n * which would have to be classified (a query apiece for custom entities), while\n * the set a tenant actually binds tasks to is a handful. `unnest` of a NULL\n * array yields no rows, so a tenant whose tasks all predate the column answers\n * with an empty set and the whitelist collapses to \"rows about nothing\", which\n * is every row it has.\n */\nexport async function collectScopedTaskEntityTypes(\n  em: EntityManager,\n  scope: ScopedTaskEntityTypeScope,\n): Promise<string[]> {\n  const params: unknown[] = [scope.tenantId]\n  let sql = 'SELECT DISTINCT unnest(entity_types) AS entity_type FROM user_tasks WHERE tenant_id = ?'\n\n  if (scope.organizationIds !== null) {\n    if (scope.organizationIds.length === 0) return []\n    sql += ` AND organization_id IN (${scope.organizationIds.map(() => '?').join(', ')})`\n    params.push(...scope.organizationIds)\n  }\n\n  const rows = await em\n    .getConnection()\n    .execute<Array<{ entity_type: string | null }>>(sql, params)\n\n  const types = new Set<string>()\n  for (const row of rows) {\n    const entityType = row?.entity_type\n    if (typeof entityType === 'string' && entityType.length > 0) types.add(entityType)\n  }\n  return [...types]\n}\n\n/** The subset of `candidates` this caller may view records of. */\nexport function resolveAllowedTaskEntityTypes(\n  context: TaskVisibilityRequestContext,\n  candidates: Iterable<string> = context.scopedEntityTypes,\n): string[] {\n  const allowed: string[] = []\n  for (const entityType of new Set(candidates)) {\n    const decision = context.entityAccess.get(entityType)\n    // A missing key is a resolution failure, never a pass \u2014 the same rule the\n    // predicate applies, so the two cannot disagree about a row.\n    if (!decision || decision.kind !== 'requires') continue\n    if (!hasAllFeatures(context.principal.grantedFeatures, decision.features)) continue\n    allowed.push(entityType)\n  }\n  return allowed\n}\n\n/**\n * The ENTITY half of the rule as ORM conditions.\n *\n * Empty for a superadmin (who short-circuits the gate in the predicate too),\n * under the tenant opt-out (which skips the entity gate on reads by design),\n * and \u2014 deliberately \u2014 for a principal entitled to a DIAGNOSIS.\n *\n * That last case is the \u00A73.6 rule: a task hidden by the entity gate must never\n * disappear without trace. Excluding the row in SQL is exactly the trace-free\n * disappearance, because an administrator then sees a page that is short by an\n * unexplained number of rows and cannot tell \"no such task\" from \"you cannot see\n * its record\". So the gate is lifted from the `WHERE` for them, the predicate\n * still refuses each row, and the caller reports the refusals as MARKERS \u2014\n * `partitionTaskPage` below. The rows themselves never reach the response body;\n * only their ids and the entity type that blocked them do, which is exactly what\n * \u00A72.7 already entitles a `view_all` holder to on the single-task surface.\n */\nexport function buildTaskEntityGateConditions(\n  context: TaskVisibilityRequestContext,\n): Record<string, unknown>[] {\n  if (context.principal.isSuperAdmin) return []\n  if (!context.policy.businessContextEnabled) return []\n  if (canDiagnoseTaskRefusal(context.principal)) return []\n  return [\n    {\n      $or: [\n        { entityTypes: null },\n        { entityTypes: { $contained: resolveAllowedTaskEntityTypes(context) } },\n      ],\n    },\n  ]\n}\n\n/**\n * RELATIONSHIP \u2228 ADMINISTRATIVE plus ENTITY, as conditions to push onto an\n * existing `$and` array. Tenant and organization scoping stay with the caller,\n * which already applies them on every query.\n */\nexport function buildTaskVisibilityRequestConditions(\n  context: TaskVisibilityRequestContext,\n  options: TaskVisibilityFilterOptions = {},\n): Record<string, unknown>[] {\n  return [\n    ...buildTaskVisibilityConditions(context.principal, context.policy, options),\n    ...buildTaskEntityGateConditions(context),\n  ]\n}\n\nfunction asBindingFacts(value: unknown): TaskEntityBindingFact[] {\n  if (!Array.isArray(value)) return []\n  const bindings: TaskEntityBindingFact[] = []\n  for (const item of value) {\n    if (!item || typeof item !== 'object' || Array.isArray(item)) continue\n    const record = item as Record<string, unknown>\n    if (typeof record.entityType !== 'string' || typeof record.entityId !== 'string') continue\n    bindings.push({ entityType: record.entityType, entityId: record.entityId })\n  }\n  return bindings\n}\n\nexport type TaskFactsOptions = {\n  /** Queue feature for the source that produced this row, when it declares one. */\n  administrativeQueueFeature?: string | null\n}\n\n/**\n * Project a `UserTask` row onto the facts the predicate reads.\n *\n * `assigneeKind` is defaulted rather than coalesced: the column is NOT NULL, and\n * a row read through a projection that predates it is a backoffice task like\n * every row before it.\n */\nexport function toTaskFacts(task: UserTask, options: TaskFactsOptions = {}): TaskFacts {\n  return {\n    id: task.id,\n    tenantId: task.tenantId,\n    organizationId: task.organizationId,\n    status: task.status,\n    assignedTo: task.assignedTo ?? null,\n    assigneeKind: task.assigneeKind ?? 'user',\n    assignedToRoles: task.assignedToRoles ?? null,\n    claimedBy: task.claimedBy ?? null,\n    entityBindings: asBindingFacts(task.entityBindings),\n    administrativeQueueFeature: options.administrativeQueueFeature ?? null,\n  }\n}\n\n/**\n * The distinct authored binding types a set of already-loaded tasks references \u2014\n * what a single-task surface feeds `resolveTaskVisibilityRequestContext`.\n */\nexport function collectTaskEntityTypesFromTasks(tasks: Iterable<UserTask>): string[] {\n  return collectTaskEntityTypes(\n    [...tasks].map((task) => ({ entityBindings: asBindingFacts(task.entityBindings) })),\n  )\n}\n\n/** The predicate's answer for one already-loaded row. */\nexport function decideTaskAccess(\n  context: TaskVisibilityRequestContext,\n  task: UserTask,\n  options: TaskFactsOptions = {},\n): TaskVisibilityDecision {\n  return decideTaskVisibility(\n    context.principal,\n    toTaskFacts(task, options),\n    context.entityAccess,\n    context.policy,\n  )\n}\n\n/**\n * The act surfaces a detail response advertises for one already-loaded row.\n *\n * The server has always known this \u2014 `decideTaskAccess` returns `actable` and\n * `claimable` on every request \u2014 and until now it threw the answer away, which\n * is why the backoffice task page rendered a Complete button that 409s for a\n * `workflows.tasks.view_all` administrator. Sending the decision is the fix; a\n * client re-deriving it is the bug coming back.\n */\nexport function resolveTaskAffordancesForRequest(\n  context: TaskVisibilityRequestContext,\n  task: UserTask,\n  decision: TaskVisibilityDecision,\n  options: TaskFactsOptions = {},\n): TaskAffordances {\n  return resolveTaskAffordances(context.principal, toTaskFacts(task, options), decision)\n}\n\n/**\n * The rows of an already-filtered page the predicate agrees are visible.\n *\n * The `WHERE` this module builds IS this rule, so in practice nothing is\n * dropped here and `pagination.total` stays exactly the count of what the caller\n * may see. It runs anyway because the predicate is the single decision point and\n * because the failure direction matters: should the SQL gate and the predicate\n * ever disagree, losing a row from a page is recoverable and leaking one is not.\n */\nexport function filterVisibleTasks(\n  context: TaskVisibilityRequestContext,\n  tasks: readonly UserTask[],\n  options: TaskFactsOptions = {},\n): UserTask[] {\n  return tasks.filter((task) => decideTaskAccess(context, task, options).visible)\n}\n\n/**\n * A row an administrator may know EXISTS but may not read.\n *\n * Three fields and no fourth. The id is what makes the marker actionable (it is\n * the argument to reassignment and to a support conversation), the reason\n * separates an author's typo from a policy refusal, and the entity type names\n * the grant that would fix it. Everything that would say what the task is ABOUT\n * \u2014 its name, description, form schema, form data, bindings, assignee \u2014 is\n * absent by construction rather than by redaction, because a redaction is a\n * field somebody later un-redacts.\n */\nexport type TaskEntityHiddenMarker = {\n  id: string\n  reason: 'denied:entity-access' | 'denied:unknown-entity-type'\n  /** The binding type that blocked it, when the predicate identified one. */\n  entityType: string | null\n}\n\nexport type TaskPagePartition = {\n  /** Rows the caller may read in full. */\n  visible: UserTask[]\n  /**\n   * Rows the entity gate refused to a caller entitled to know they are there.\n   * Always empty for everybody else \u2014 the gate excluded those rows in SQL, so\n   * there is nothing to report and nothing is disclosed.\n   */\n  entityHidden: TaskEntityHiddenMarker[]\n}\n\n/**\n * Split an already-filtered page into what the caller may read and what they may\n * only be told about.\n *\n * This is the counterpart to lifting the entity gate for a diagnosable\n * principal: the SQL returns the rows, the predicate refuses them one by one,\n * and the refusals become markers instead of an unexplained gap in the page. For\n * everybody else the `WHERE` already removed them, `entityHidden` is empty, and\n * the result is byte-identical to `filterVisibleTasks`.\n *\n * A refusal that is NOT an entity refusal (a foreign tenant, an organization the\n * caller cannot see, no relationship at all) is dropped silently, exactly as\n * before: those callers have no legitimate knowledge that the row exists, and a\n * marker would be the disclosure the 404 policy exists to prevent.\n */\nexport function partitionTaskPage(\n  context: TaskVisibilityRequestContext,\n  tasks: readonly UserTask[],\n  options: TaskFactsOptions = {},\n): TaskPagePartition {\n  const visible: UserTask[] = []\n  const entityHidden: TaskEntityHiddenMarker[] = []\n  const diagnosable = canDiagnoseTaskRefusal(context.principal)\n\n  for (const task of tasks) {\n    const decision = decideTaskAccess(context, task, options)\n    if (decision.visible) {\n      visible.push(task)\n      continue\n    }\n    if (!diagnosable) continue\n    if (\n      decision.reason !== 'denied:entity-access' &&\n      decision.reason !== 'denied:unknown-entity-type'\n    ) {\n      continue\n    }\n    entityHidden.push({\n      id: task.id,\n      reason: decision.reason,\n      entityType: decision.blockedEntityType ?? null,\n    })\n  }\n\n  return { visible, entityHidden }\n}\n\n/**\n * Whether this caller is entitled to a diagnosis rather than a bare 404.\n *\n * Only a principal who can already see the row in a list view \u2014 a `view_all`\n * holder or a superadmin \u2014 learns WHICH entity type blocked them. Everybody else\n * gets an answer indistinguishable from \"no such task\", because they have no\n * legitimate knowledge that the row exists at all.\n */\nexport function canDiagnoseTaskRefusal(principal: BackofficeTaskPrincipal): boolean {\n  return (\n    principal.isSuperAdmin || hasFeature(principal.grantedFeatures, WORKFLOWS_TASKS_VIEW_ALL_FEATURE)\n  )\n}\n\nexport type TaskRefusal = {\n  /** 404 hides existence, 403 diagnoses, 409 is the act-path conflict. */\n  status: 403 | 404 | 409\n  body: Record<string, unknown>\n}\n\n/**\n * The generic body every non-diagnosable refusal returns.\n *\n * Byte-identical to the body a genuinely missing id produces \u2014 a cross-tenant\n * id, an organization the caller cannot see, a task they have no relationship\n * to and a random uuid must all be the same answer.\n */\nexport const TASK_NOT_FOUND_BODY: Record<string, unknown> = { error: 'Task not found' }\n\n/**\n * Message and code the task handler already throws when the row belongs to\n * somebody else. Reused verbatim so enforcing ownership one layer earlier does\n * not change what a client sees.\n */\nexport const TASK_ASSIGNED_TO_ANOTHER_USER_BODY: Record<string, unknown> = {\n  error: 'Task is assigned to another user',\n  code: 'TASK_ASSIGNED_TO_ANOTHER_USER',\n}\n\n/**\n * Refusal for a row \u00A76.4 makes nobody's: no assignee, no claim and no role\n * queue. Administration widens seeing, never acting, so the remedy is\n * `workflows.tasks.reassign` rather than a wider grant.\n */\nexport const TASK_NOT_ACTIONABLE_BODY: Record<string, unknown> = {\n  error: 'Task is not assigned to anyone; reassign it before acting on it',\n  code: 'TASK_NOT_ACTIONABLE',\n}\n\nexport type TaskActRefusalOptions = TaskFactsOptions & {\n  /**\n   * Enforce `actable` here rather than leaving it to the task handler.\n   *\n   * ON for **complete**, which is the whole point of the narrowing: holding\n   * `workflows.tasks.complete` must no longer complete anyone else's work, and\n   * the handler deliberately leaves an OWNERLESS row open to anyone the feature\n   * gate admitted \u2014 the pre-change semantics.\n   *\n   * OFF for **claim** and **unclaim**, where the handler is already the precise\n   * authority and answering here would coarsen its codes: an empty role queue is\n   * `TASK_NOT_ROLE_ASSIGNED`, a queue the caller does not belong to is\n   * `TASK_NOT_FOUND`, and unclaiming a row nobody holds is `TASK_NOT_FOUND`.\n   * Pre-empting those with one generic refusal would lose information the client\n   * has always had.\n   */\n  requireOwnership?: boolean\n}\n\n/**\n * The act gate for claim / unclaim / complete.\n *\n * Deliberately narrow: it answers only what the task handler cannot answer for\n * itself and hands everything else through, so the handler keeps producing the\n * exact error codes it always has (`TASK_NOT_FOUND`, `TASK_ALREADY_ASSIGNED`,\n * `TASK_NOT_ROLE_ASSIGNED`, `TASK_ASSIGNED_TO_ANOTHER_USER`) and keeps taking\n * the row with its own compare-and-set.\n *\n * 1. **Can this caller see the row at all?** Running FIRST is the disclosure fix:\n *    `claimUserTask` reports `TASK_ALREADY_ASSIGNED` before it checks queue\n *    membership, so without this a caller with no relationship to the task could\n *    tell an existing task from a nonexistent one by the status code alone.\n * 2. **Does the entity gate block acting?** Reachable only under the tenant\n *    opt-out, which restores the READ and never the act path. Refused as a plain\n *    404 \u2014 a reason here would leak the binding to a principal the gate just\n *    refused.\n * 3. **Is the row theirs?** Only when `requireOwnership` is set. The owner is\n *    `claimedBy ?? assignedTo`: holding a task's queued role confers the right\n *    to CLAIM an open row, never to finish one a colleague already claimed.\n *\n * A row in a terminal status is always passed through: the handler answers\n * `TASK_NOT_FOUND` for it, exactly as before.\n */\nexport function resolveTaskActRefusal(\n  context: TaskVisibilityRequestContext,\n  decision: TaskVisibilityDecision,\n  task: UserTask,\n  options: TaskActRefusalOptions = {},\n): TaskRefusal | null {\n  if (!decision.visible) return resolveTaskRefusal(context, decision)\n\n  if (decision.blockedEntityType) return { status: 404, body: TASK_NOT_FOUND_BODY }\n\n  if (!options.requireOwnership || decision.actable) return null\n\n  const facts = toTaskFacts(task, options)\n  if (!TASK_ACTIONABLE_STATUSES.includes(facts.status)) return null\n\n  return currentTaskOwnerId(facts) !== null\n    ? { status: 409, body: TASK_ASSIGNED_TO_ANOTHER_USER_BODY }\n    : { status: 403, body: TASK_NOT_ACTIONABLE_BODY }\n}\n\nexport type TaskActionGateResult =\n  | { allowed: true; task: UserTask; visibility: TaskVisibilityRequestContext }\n  | { allowed: false; refusal: TaskRefusal }\n\n/**\n * The whole \u00A76.4 gate for one act route, in the order that keeps existence\n * undisclosed.\n *\n * The lookup carries tenant AND organization, so a foreign id resolves to\n * nothing before the predicate \u2014 and long before any write. That ordering is the\n * point: it is what keeps `claimUserTask`'s conditional `UPDATE` from ever\n * touching another tenant's row.\n */\nexport async function gateTaskAction(input: {\n  container: TaskVisibilityContainer\n  em: EntityManager\n  auth: TaskVisibilityAuth\n  taskId: string\n  organizationId: string\n  administrativeQueueFeature?: string | null\n  /** See `TaskActRefusalOptions.requireOwnership` \u2014 ON for complete only. */\n  requireOwnership?: boolean\n}): Promise<TaskActionGateResult> {\n  const task = await input.em.findOne(UserTaskEntity, {\n    id: input.taskId,\n    tenantId: input.auth.tenantId,\n    organizationId: input.organizationId,\n  })\n\n  if (!task) return { allowed: false, refusal: { status: 404, body: TASK_NOT_FOUND_BODY } }\n\n  const visibility = await resolveTaskVisibilityForRequest({\n    container: input.container,\n    em: input.em,\n    auth: input.auth,\n    organizationIds: [input.organizationId],\n    aclOrganizationId: input.organizationId,\n    entityTypes: collectTaskEntityTypesFromTasks([task]),\n  })\n\n  const options: TaskActRefusalOptions = {\n    administrativeQueueFeature: input.administrativeQueueFeature ?? null,\n    requireOwnership: input.requireOwnership ?? false,\n  }\n  const refusal = resolveTaskActRefusal(\n    visibility,\n    decideTaskAccess(visibility, task, options),\n    task,\n    options,\n  )\n\n  return refusal ? { allowed: false, refusal } : { allowed: true, task, visibility }\n}\n\nexport function resolveTaskRefusal(\n  context: TaskVisibilityRequestContext,\n  decision: TaskVisibilityDecision,\n): TaskRefusal {\n  const isEntityRefusal =\n    decision.reason === 'denied:entity-access' || decision.reason === 'denied:unknown-entity-type'\n\n  if (isEntityRefusal && canDiagnoseTaskRefusal(context.principal)) {\n    return {\n      status: 403,\n      body: {\n        error: 'Forbidden',\n        reason: decision.reason,\n        ...(decision.blockedEntityType ? { entityType: decision.blockedEntityType } : {}),\n      },\n    }\n  }\n\n  return { status: 404, body: TASK_NOT_FOUND_BODY }\n}\n"],
+  "mappings": "AA+CA,SAAS,gBAAgB,kBAAkB;AAC3C,SAAS,YAAY,sBAAqC;AAC1D;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OASK;AACP;AAAA,EACE;AAAA,OAEK;AA8CP,eAAsB,oCACpB,OACuC;AACvC,QAAM,QAA+B;AAAA,IACnC,UAAU,MAAM,KAAK;AAAA,IACrB,gBAAgB,MAAM;AAAA,EACxB;AACA,QAAM,oBAAoB,CAAC,GAAG,IAAI,IAAI,MAAM,WAAW,CAAC;AAExD,QAAM,CAAC,QAAQ,MAAM,IAAI,MAAM,QAAQ,IAAI;AAAA,IACzC,wBAAwB;AAAA,MACtB,aAAa;AAAA,MACb,IAAI,MAAM;AAAA,MACV,MAAM,MAAM;AAAA,MACZ,QAAQ,MAAM,KAAK;AAAA,MACnB;AAAA,IACF,CAAC;AAAA,IACD,4BAA4B,MAAM,qBAAqB,MAAM,KAAK,QAAQ;AAAA,EAC5E,CAAC;AAED,SAAO;AAAA,IACL,WAAW;AAAA,MACT,MAAM;AAAA,MACN,QAAQ,MAAM,KAAK;AAAA,MACnB,UAAU,MAAM,KAAK;AAAA,MACrB,iBAAiB,MAAM,mBAAmB;AAAA,MAC1C,WAAW,MAAM,KAAK;AAAA,MACtB,iBAAiB,OAAO;AAAA,MACxB,cAAc,OAAO;AAAA,IACvB;AAAA,IACA;AAAA,IACA,cAAc,OAAO;AAAA,IACrB;AAAA,EACF;AACF;AAaA,MAAM,iBAA8C,EAAE,SAAS,YAAY,KAAK;AAEhF,SAAS,gBAAmB,WAAoC,MAAwB;AACtF,MAAI;AACF,WAAO,UAAU,QAAW,IAAI,KAAK;AAAA,EACvC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,eAAsB,gCAAgC,OAOZ;AACxC,SAAO,oCAAoC;AAAA,IACzC,IAAI,MAAM;AAAA,IACV,MAAM,gBAA6C,MAAM,WAAW,aAAa,KAAK;AAAA;AAAA;AAAA,IAGtF,qBAAqB;AAAA,MACnB,MAAM;AAAA,MACN;AAAA,IACF;AAAA,IACA,MAAM,MAAM;AAAA,IACZ,iBAAiB,MAAM;AAAA,IACvB,mBAAmB,MAAM;AAAA,IACzB,aAAa,MAAM;AAAA,EACrB,CAAC;AACH;AAkBA,eAAsB,6BACpB,IACA,OACmB;AACnB,QAAM,SAAoB,CAAC,MAAM,QAAQ;AACzC,MAAI,MAAM;AAEV,MAAI,MAAM,oBAAoB,MAAM;AAClC,QAAI,MAAM,gBAAgB,WAAW,EAAG,QAAO,CAAC;AAChD,WAAO,4BAA4B,MAAM,gBAAgB,IAAI,MAAM,GAAG,EAAE,KAAK,IAAI,CAAC;AAClF,WAAO,KAAK,GAAG,MAAM,eAAe;AAAA,EACtC;AAEA,QAAM,OAAO,MAAM,GAChB,cAAc,EACd,QAA+C,KAAK,MAAM;AAE7D,QAAM,QAAQ,oBAAI,IAAY;AAC9B,aAAW,OAAO,MAAM;AACtB,UAAM,aAAa,KAAK;AACxB,QAAI,OAAO,eAAe,YAAY,WAAW,SAAS,EAAG,OAAM,IAAI,UAAU;AAAA,EACnF;AACA,SAAO,CAAC,GAAG,KAAK;AAClB;AAGO,SAAS,8BACd,SACA,aAA+B,QAAQ,mBAC7B;AACV,QAAM,UAAoB,CAAC;AAC3B,aAAW,cAAc,IAAI,IAAI,UAAU,GAAG;AAC5C,UAAM,WAAW,QAAQ,aAAa,IAAI,UAAU;AAGpD,QAAI,CAAC,YAAY,SAAS,SAAS,WAAY;AAC/C,QAAI,CAAC,eAAe,QAAQ,UAAU,iBAAiB,SAAS,QAAQ,EAAG;AAC3E,YAAQ,KAAK,UAAU;AAAA,EACzB;AACA,SAAO;AACT;AAmBO,SAAS,8BACd,SAC2B;AAC3B,MAAI,QAAQ,UAAU,aAAc,QAAO,CAAC;AAC5C,MAAI,CAAC,QAAQ,OAAO,uBAAwB,QAAO,CAAC;AACpD,MAAI,uBAAuB,QAAQ,SAAS,EAAG,QAAO,CAAC;AACvD,SAAO;AAAA,IACL;AAAA,MACE,KAAK;AAAA,QACH,EAAE,aAAa,KAAK;AAAA,QACpB,EAAE,aAAa,EAAE,YAAY,8BAA8B,OAAO,EAAE,EAAE;AAAA,MACxE;AAAA,IACF;AAAA,EACF;AACF;AAOO,SAAS,qCACd,SACA,UAAuC,CAAC,GACb;AAC3B,SAAO;AAAA,IACL,GAAG,8BAA8B,QAAQ,WAAW,QAAQ,QAAQ,OAAO;AAAA,IAC3E,GAAG,8BAA8B,OAAO;AAAA,EAC1C;AACF;AAEA,SAAS,eAAe,OAAyC;AAC/D,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO,CAAC;AACnC,QAAM,WAAoC,CAAC;AAC3C,aAAW,QAAQ,OAAO;AACxB,QAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,MAAM,QAAQ,IAAI,EAAG;AAC9D,UAAM,SAAS;AACf,QAAI,OAAO,OAAO,eAAe,YAAY,OAAO,OAAO,aAAa,SAAU;AAClF,aAAS,KAAK,EAAE,YAAY,OAAO,YAAY,UAAU,OAAO,SAAS,CAAC;AAAA,EAC5E;AACA,SAAO;AACT;AAcO,SAAS,YAAY,MAAgB,UAA4B,CAAC,GAAc;AACrF,SAAO;AAAA,IACL,IAAI,KAAK;AAAA,IACT,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK;AAAA,IACb,YAAY,KAAK,cAAc;AAAA,IAC/B,cAAc,KAAK,gBAAgB;AAAA,IACnC,iBAAiB,KAAK,mBAAmB;AAAA,IACzC,WAAW,KAAK,aAAa;AAAA,IAC7B,gBAAgB,eAAe,KAAK,cAAc;AAAA,IAClD,4BAA4B,QAAQ,8BAA8B;AAAA,EACpE;AACF;AAMO,SAAS,gCAAgC,OAAqC;AACnF,SAAO;AAAA,IACL,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,gBAAgB,eAAe,KAAK,cAAc,EAAE,EAAE;AAAA,EACpF;AACF;AAGO,SAAS,iBACd,SACA,MACA,UAA4B,CAAC,GACL;AACxB,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,YAAY,MAAM,OAAO;AAAA,IACzB,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AACF;AAWO,SAAS,iCACd,SACA,MACA,UACA,UAA4B,CAAC,GACZ;AACjB,SAAO,uBAAuB,QAAQ,WAAW,YAAY,MAAM,OAAO,GAAG,QAAQ;AACvF;AAWO,SAAS,mBACd,SACA,OACA,UAA4B,CAAC,GACjB;AACZ,SAAO,MAAM,OAAO,CAAC,SAAS,iBAAiB,SAAS,MAAM,OAAO,EAAE,OAAO;AAChF;AA8CO,SAAS,kBACd,SACA,OACA,UAA4B,CAAC,GACV;AACnB,QAAM,UAAsB,CAAC;AAC7B,QAAM,eAAyC,CAAC;AAChD,QAAM,cAAc,uBAAuB,QAAQ,SAAS;AAE5D,aAAW,QAAQ,OAAO;AACxB,UAAM,WAAW,iBAAiB,SAAS,MAAM,OAAO;AACxD,QAAI,SAAS,SAAS;AACpB,cAAQ,KAAK,IAAI;AACjB;AAAA,IACF;AACA,QAAI,CAAC,YAAa;AAClB,QACE,SAAS,WAAW,0BACpB,SAAS,WAAW,8BACpB;AACA;AAAA,IACF;AACA,iBAAa,KAAK;AAAA,MAChB,IAAI,KAAK;AAAA,MACT,QAAQ,SAAS;AAAA,MACjB,YAAY,SAAS,qBAAqB;AAAA,IAC5C,CAAC;AAAA,EACH;AAEA,SAAO,EAAE,SAAS,aAAa;AACjC;AAUO,SAAS,uBAAuB,WAA6C;AAClF,SACE,UAAU,gBAAgB,WAAW,UAAU,iBAAiB,gCAAgC;AAEpG;AAeO,MAAM,sBAA+C,EAAE,OAAO,iBAAiB;AAO/E,MAAM,qCAA8D;AAAA,EACzE,OAAO;AAAA,EACP,MAAM;AACR;AAOO,MAAM,2BAAoD;AAAA,EAC/D,OAAO;AAAA,EACP,MAAM;AACR;AA6CO,SAAS,sBACd,SACA,UACA,MACA,UAAiC,CAAC,GACd;AACpB,MAAI,CAAC,SAAS,QAAS,QAAO,mBAAmB,SAAS,QAAQ;AAElE,MAAI,SAAS,kBAAmB,QAAO,EAAE,QAAQ,KAAK,MAAM,oBAAoB;AAEhF,MAAI,CAAC,QAAQ,oBAAoB,SAAS,QAAS,QAAO;AAE1D,QAAM,QAAQ,YAAY,MAAM,OAAO;AACvC,MAAI,CAAC,yBAAyB,SAAS,MAAM,MAAM,EAAG,QAAO;AAE7D,SAAO,mBAAmB,KAAK,MAAM,OACjC,EAAE,QAAQ,KAAK,MAAM,mCAAmC,IACxD,EAAE,QAAQ,KAAK,MAAM,yBAAyB;AACpD;AAeA,eAAsB,eAAe,OASH;AAChC,QAAM,OAAO,MAAM,MAAM,GAAG,QAAQ,gBAAgB;AAAA,IAClD,IAAI,MAAM;AAAA,IACV,UAAU,MAAM,KAAK;AAAA,IACrB,gBAAgB,MAAM;AAAA,EACxB,CAAC;AAED,MAAI,CAAC,KAAM,QAAO,EAAE,SAAS,OAAO,SAAS,EAAE,QAAQ,KAAK,MAAM,oBAAoB,EAAE;AAExF,QAAM,aAAa,MAAM,gCAAgC;AAAA,IACvD,WAAW,MAAM;AAAA,IACjB,IAAI,MAAM;AAAA,IACV,MAAM,MAAM;AAAA,IACZ,iBAAiB,CAAC,MAAM,cAAc;AAAA,IACtC,mBAAmB,MAAM;AAAA,IACzB,aAAa,gCAAgC,CAAC,IAAI,CAAC;AAAA,EACrD,CAAC;AAED,QAAM,UAAiC;AAAA,IACrC,4BAA4B,MAAM,8BAA8B;AAAA,IAChE,kBAAkB,MAAM,oBAAoB;AAAA,EAC9C;AACA,QAAM,UAAU;AAAA,IACd;AAAA,IACA,iBAAiB,YAAY,MAAM,OAAO;AAAA,IAC1C;AAAA,IACA;AAAA,EACF;AAEA,SAAO,UAAU,EAAE,SAAS,OAAO,QAAQ,IAAI,EAAE,SAAS,MAAM,MAAM,WAAW;AACnF;AAEO,SAAS,mBACd,SACA,UACa;AACb,QAAM,kBACJ,SAAS,WAAW,0BAA0B,SAAS,WAAW;AAEpE,MAAI,mBAAmB,uBAAuB,QAAQ,SAAS,GAAG;AAChE,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,MAAM;AAAA,QACJ,OAAO;AAAA,QACP,QAAQ,SAAS;AAAA,QACjB,GAAI,SAAS,oBAAoB,EAAE,YAAY,SAAS,kBAAkB,IAAI,CAAC;AAAA,MACjF;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,QAAQ,KAAK,MAAM,oBAAoB;AAClD;",
+  "names": []
+}

package/dist/modules/workflows/lib/task-visibility.js

@@ -0,0 +1,194 @@
+import { isOrganizationAccessAllowed } from "@open-mercato/shared/lib/auth/organizationAccess";
+import { hasAllFeatures, hasFeature } from "@open-mercato/shared/security/features";
+const WORKFLOWS_TASKS_VIEW_FEATURE = "workflows.tasks.view";
+const WORKFLOWS_TASKS_VIEW_ALL_FEATURE = "workflows.tasks.view_all";
+const WORKFLOWS_TASKS_REASSIGN_FEATURE = "workflows.tasks.reassign";
+const TASK_ACTIONABLE_STATUSES = ["PENDING", "IN_PROGRESS"];
+function deny(reason, blockedEntityType) {
+  return blockedEntityType ? { visible: false, actable: false, claimable: false, reason, blockedEntityType } : { visible: false, actable: false, claimable: false, reason };
+}
+function hasRoleOverlap(taskRoles, roleNames) {
+  if (!taskRoles || taskRoles.length === 0 || roleNames.length === 0) return false;
+  const held = new Set(roleNames);
+  return taskRoles.some((role) => held.has(role));
+}
+function isUnassignedQueueItem(task) {
+  return task.assignedTo === null && task.claimedBy === null && (task.assignedToRoles === null || task.assignedToRoles.length === 0);
+}
+function evaluateEntityClause(principal, task, entityAccess) {
+  if (principal.isSuperAdmin) return { ok: true };
+  for (const binding of task.entityBindings) {
+    const decision = entityAccess.get(binding.entityType);
+    if (!decision) {
+      return { ok: false, reason: "denied:entity-access", entityType: binding.entityType };
+    }
+    if (decision.kind === "unknown-entity-type") {
+      return { ok: false, reason: "denied:unknown-entity-type", entityType: binding.entityType };
+    }
+    if (decision.kind === "unavailable") {
+      return { ok: false, reason: "denied:entity-access", entityType: binding.entityType };
+    }
+    if (!hasAllFeatures(principal.grantedFeatures, decision.features)) {
+      return { ok: false, reason: "denied:entity-access", entityType: binding.entityType };
+    }
+  }
+  return { ok: true };
+}
+function administrativeQueueFeatureOf(task) {
+  return task.administrativeQueueFeature ?? WORKFLOWS_TASKS_VIEW_ALL_FEATURE;
+}
+function resolveRelationshipReason(principal, task) {
+  if (task.assigneeKind === "user" && task.assignedTo === principal.userId) return "assignee";
+  if (task.claimedBy !== null && task.claimedBy === principal.userId) return "claimant";
+  if (hasRoleOverlap(task.assignedToRoles, principal.roleNames)) return "role-queue";
+  return null;
+}
+function resolveAdministrativeReason(principal, task) {
+  if (principal.isSuperAdmin) return "administrative";
+  if (hasFeature(principal.grantedFeatures, WORKFLOWS_TASKS_VIEW_ALL_FEATURE)) return "administrative";
+  if (isUnassignedQueueItem(task) && hasFeature(principal.grantedFeatures, administrativeQueueFeatureOf(task))) {
+    return "administrative-queue";
+  }
+  return null;
+}
+function currentTaskOwnerId(task) {
+  if (task.claimedBy !== null) return task.claimedBy;
+  if (task.assigneeKind === "user") return task.assignedTo;
+  return null;
+}
+function decideBackoffice(principal, task, entityAccess, policy) {
+  if (task.tenantId !== principal.tenantId) return deny("denied:tenant");
+  if (!isOrganizationAccessAllowed({
+    isSuperAdmin: principal.isSuperAdmin,
+    allowedOrganizationIds: principal.organizationIds,
+    targetOrganizationId: task.organizationId
+  })) {
+    return deny("denied:organization");
+  }
+  const relationshipReason = resolveRelationshipReason(principal, task);
+  const administrativeReason = relationshipReason ? null : resolveAdministrativeReason(principal, task);
+  const admitReason = relationshipReason ?? administrativeReason;
+  const entity = evaluateEntityClause(principal, task, entityAccess);
+  const owner = currentTaskOwnerId(task);
+  const ownsTheRow = owner !== null ? owner === principal.userId : hasRoleOverlap(task.assignedToRoles, principal.roleNames);
+  const actable = entity.ok && ownsTheRow && task.assigneeKind === "user" && TASK_ACTIONABLE_STATUSES.includes(task.status);
+  const claimable = actable && task.assignedTo === null && task.claimedBy === null && task.status === "PENDING" && hasRoleOverlap(task.assignedToRoles, principal.roleNames);
+  if (admitReason && entity.ok) {
+    return { visible: true, actable, claimable, reason: admitReason };
+  }
+  if (!policy.businessContextEnabled && hasFeature(principal.grantedFeatures, WORKFLOWS_TASKS_VIEW_FEATURE)) {
+    return {
+      visible: true,
+      actable,
+      claimable,
+      reason: "legacy-read-filter",
+      // Reported even though the row is admitted: the read came back, the entity
+      // gate did not, and an act surface must be able to tell the difference.
+      ...entity.ok ? {} : { blockedEntityType: entity.entityType }
+    };
+  }
+  if (!admitReason) return deny("denied:no-relationship");
+  if (!entity.ok) return deny(entity.reason, entity.entityType);
+  return deny("denied:no-relationship");
+}
+function decidePortal(principal, task) {
+  if (task.tenantId !== principal.tenantId) return deny("denied:tenant");
+  if (task.organizationId !== principal.organizationId) return deny("denied:organization");
+  if (task.assigneeKind !== "customer") return deny("denied:portal-wrong-assignee-kind");
+  if (task.entityBindings.length === 0) return deny("denied:portal-unbound");
+  const ownsEveryBinding = task.entityBindings.every(
+    (binding) => principal.ownedRecordIds.has(binding.entityId)
+  );
+  if (!ownsEveryBinding) return deny("denied:portal-not-owner");
+  if (task.assignedTo === principal.principalId) {
+    const actable = TASK_ACTIONABLE_STATUSES.includes(task.status);
+    return { visible: true, actable, claimable: false, reason: "portal-assignee" };
+  }
+  if (principal.isPortalAdmin) {
+    return { visible: true, actable: false, claimable: false, reason: "portal-company-admin" };
+  }
+  return deny("denied:portal-not-owner");
+}
+function decideTaskVisibility(principal, task, entityAccess, policy) {
+  if (principal.kind === "portal") return decidePortal(principal, task);
+  return decideBackoffice(principal, task, entityAccess, policy);
+}
+const TASK_REASSIGNABLE_STATUSES = ["PENDING", "IN_PROGRESS"];
+const TASK_RELEASABLE_STATUS = "IN_PROGRESS";
+function resolveTaskAffordances(principal, task, decision) {
+  const entityGateClosed = decision.blockedEntityType !== void 0;
+  const actSurfaceOpen = decision.visible && !entityGateClosed;
+  const canComplete = decision.visible && decision.actable;
+  const canClaim = decision.visible && decision.claimable;
+  const canRelease = actSurfaceOpen && task.status === TASK_RELEASABLE_STATUS && task.claimedBy === principal.userId;
+  const canReassign = actSurfaceOpen && TASK_REASSIGNABLE_STATUSES.includes(task.status) && (principal.isSuperAdmin || hasFeature(principal.grantedFeatures, WORKFLOWS_TASKS_REASSIGN_FEATURE));
+  return {
+    canComplete,
+    canClaim,
+    canRelease,
+    canReassign,
+    actBlockedReason: resolveActBlockReason(principal, task, decision, {
+      canComplete,
+      entityGateClosed
+    })
+  };
+}
+function resolveActBlockReason(principal, task, decision, state) {
+  if (state.canComplete) return null;
+  if (!decision.visible) return null;
+  if (state.entityGateClosed) return "unavailable";
+  if (!TASK_ACTIONABLE_STATUSES.includes(task.status)) return "not-workable";
+  const owner = currentTaskOwnerId(task);
+  if (owner !== null) return owner === principal.userId ? "unavailable" : "owned-by-another";
+  if (task.assignedToRoles !== null && task.assignedToRoles.length > 0) return "not-in-your-queue";
+  return "unowned";
+}
+function buildTaskVisibilityConditions(principal, policy, options = {}) {
+  if (principal.isSuperAdmin) return [];
+  if (hasFeature(principal.grantedFeatures, WORKFLOWS_TASKS_VIEW_ALL_FEATURE)) return [];
+  if (!policy.businessContextEnabled && hasFeature(principal.grantedFeatures, WORKFLOWS_TASKS_VIEW_FEATURE)) {
+    return [];
+  }
+  const arms = [
+    // `assigneeKind` discriminates a backoffice user id from a portal principal
+    // id in the same column, so a customer-assigned row can never match a
+    // backoffice caller whose user id happens to collide.
+    { assignedTo: principal.userId, assigneeKind: "user" },
+    { claimedBy: principal.userId }
+  ];
+  if (principal.roleNames.length > 0) {
+    arms.push({ assignedToRoles: { $overlap: [...principal.roleNames] } });
+  }
+  const queueFeature = options.administrativeQueueFeature;
+  if (queueFeature && hasFeature(principal.grantedFeatures, queueFeature)) {
+    arms.push({
+      assignedTo: null,
+      claimedBy: null,
+      $or: [{ assignedToRoles: null }, { assignedToRoles: { $eq: [] } }]
+    });
+  }
+  return [{ $or: arms }];
+}
+function buildTaskVisibilityFilter(principal, policy, options = {}) {
+  const where = { tenantId: principal.tenantId };
+  if (principal.organizationIds !== null) {
+    where.organizationId = { $in: [...principal.organizationIds] };
+  }
+  const conditions = buildTaskVisibilityConditions(principal, policy, options);
+  if (conditions.length > 0) where.$and = conditions;
+  return where;
+}
+export {
+  TASK_ACTIONABLE_STATUSES,
+  TASK_REASSIGNABLE_STATUSES,
+  TASK_RELEASABLE_STATUS,
+  WORKFLOWS_TASKS_REASSIGN_FEATURE,
+  WORKFLOWS_TASKS_VIEW_ALL_FEATURE,
+  WORKFLOWS_TASKS_VIEW_FEATURE,
+  buildTaskVisibilityConditions,
+  buildTaskVisibilityFilter,
+  currentTaskOwnerId,
+  decideTaskVisibility,
+  resolveTaskAffordances
+};
+//# sourceMappingURL=task-visibility.js.map