@open-mercato/core 0.7.1-develop.7193.1.910a5b0a1e → 0.7.1-develop.7195.1.b5efd1d51a

package/dist/modules/workflows/api/definitions/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/workflows/api/definitions/route.ts"],
-  "sourcesContent": ["/**\n * Workflow Definitions API\n *\n * Endpoints:\n * - GET /api/workflows/definitions - List workflow definitions\n * - POST /api/workflows/definitions - Create workflow definition\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveOrganizationScopeFilter } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { WorkflowDefinition } from '../../data/entities'\nimport {\n  createWorkflowDefinitionInputSchema,\n  type CreateWorkflowDefinitionApiInput,\n} from '../../data/validators'\nimport { serializeWorkflowDefinition, serializeCodeWorkflowDefinition } from './serialize'\nimport { invalidateTriggerCache } from '../../lib/event-trigger-service'\nimport { getAllCodeWorkflows } from '../../lib/code-registry'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.view'],\n}\n\nconst WORKFLOW_ID_TENANT_UNIQUE_CONSTRAINT = 'workflow_definitions_workflow_id_tenant_id_unique'\n\nfunction isWorkflowIdUniqueConstraintError(error: unknown): boolean {\n  if (!error || typeof error !== 'object') {\n    return false\n  }\n\n  const value = error as Record<string, unknown>\n  const constraint = value.constraint\n  const code = value.code\n  const message = typeof value.message === 'string' ? value.message : ''\n  const detail = typeof value.detail === 'string' ? value.detail : ''\n\n  if (constraint === WORKFLOW_ID_TENANT_UNIQUE_CONSTRAINT) {\n    return true\n  }\n\n  if (code === '23505' && detail.includes('(workflow_id, tenant_id)')) {\n    return true\n  }\n\n  return message.includes(WORKFLOW_ID_TENANT_UNIQUE_CONSTRAINT)\n}\n\n/**\n * GET /api/workflows/definitions\n *\n * List workflow definitions with optional filters\n */\nexport async function GET(request: NextRequest) {\n  try {\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const orgFilter = resolveOrganizationScopeFilter(scope, auth)\n\n    const { searchParams } = new URL(request.url)\n    const enabled = searchParams.get('enabled')\n    const workflowId = searchParams.get('workflowId')\n    const search = searchParams.get('search')\n    const limit = parseInt(searchParams.get('limit') || '50')\n    const offset = parseInt(searchParams.get('offset') || '0')\n\n    // Build where clause with tenant scoping\n    const where: any = {\n      tenantId,\n      ...orgFilter.where,\n      deletedAt: null,\n    }\n\n    if (enabled !== null) {\n      where.enabled = enabled === 'true'\n    }\n\n    if (workflowId) {\n      where.workflowId = workflowId\n    }\n\n    if (search) {\n      where.$or = [\n        { workflowId: { $ilike: `%${escapeLikePattern(search)}%` } },\n        { workflowName: { $ilike: `%${escapeLikePattern(search)}%` } },\n      ]\n    }\n\n    // Determine which code workflows are shadowed by a DB row (so we can\n    // exclude them from the code-only list) without loading all DB rows.\n    const enabledFilter = enabled !== null ? enabled === 'true' : null\n    const searchLower = search ? search.toLowerCase() : null\n    const allCodeIds = getAllCodeWorkflows().map((cw) => cw.workflowId)\n    const shadowed = allCodeIds.length > 0\n      ? new Set(\n          (\n            await em.find(\n              WorkflowDefinition,\n              { ...where, workflowId: { $in: allCodeIds } },\n              { fields: ['workflowId'] as const },\n            )\n          ).map((d: WorkflowDefinition) => d.workflowId),\n        )\n      : new Set<string>()\n\n    const codeOnly = getAllCodeWorkflows()\n      .filter((cw) => !shadowed.has(cw.workflowId))\n      .filter((cw) => {\n        if (searchLower) {\n          const matches =\n            cw.workflowId.toLowerCase().includes(searchLower) ||\n            cw.workflowName.toLowerCase().includes(searchLower)\n          if (!matches) return false\n        }\n        if (enabledFilter !== null && cw.enabled !== enabledFilter) return false\n        if (workflowId && cw.workflowId !== workflowId) return false\n        return true\n      })\n      .map((cw) => serializeCodeWorkflowDefinition(cw, `code:${cw.workflowId}`))\n\n    const dbCount = await em.count(WorkflowDefinition, where)\n    const total = dbCount + codeOnly.length\n\n    // Fetch only the prefix of DB rows we might need to fill the requested\n    // page after merging with the (already-filtered) code-only list.\n    const dbWindowLimit = offset + limit\n    const dbWindow = dbWindowLimit > 0\n      ? await em.find(WorkflowDefinition, where, {\n          orderBy: { workflowName: 'ASC' },\n          limit: dbWindowLimit,\n        })\n      : []\n\n    const serializedDb = dbWindow.map(serializeWorkflowDefinition)\n\n    const merged = [...serializedDb, ...codeOnly].sort((a, b) =>\n      a.workflowName.localeCompare(b.workflowName),\n    )\n\n    const paginated = merged.slice(offset, offset + limit)\n\n    return NextResponse.json({\n      data: paginated,\n      pagination: {\n        total,\n        limit,\n        offset,\n        hasMore: offset + limit < total,\n      },\n    })\n  } catch (error) {\n    logger.error('Error listing workflow definitions', { err: error })\n    return NextResponse.json(\n      { error: 'Failed to list workflow definitions' },\n      { status: 500 }\n    )\n  }\n}\n\n/**\n * POST /api/workflows/definitions\n *\n * Create a new workflow definition\n */\nexport async function POST(request: NextRequest) {\n  try {\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = scope?.selectedId ?? auth.orgId\n\n    // Check create permission\n    const rbacService = container.resolve('rbacService')\n    const hasPermission = await rbacService.userHasAllFeatures(\n      auth.sub,\n      ['workflows.definitions.create'],\n      {\n        tenantId,\n        organizationId,\n      }\n    )\n\n    if (!hasPermission) {\n      return NextResponse.json(\n        { error: 'Insufficient permissions' },\n        { status: 403 }\n      )\n    }\n\n    const body = await request.json()\n\n    // Validate input\n    const validation = createWorkflowDefinitionInputSchema.safeParse(body)\n    if (!validation.success) {\n      return NextResponse.json(\n        {\n          error: 'Validation failed',\n          details: validation.error.issues,\n        },\n        { status: 400 }\n      )\n    }\n\n    const input: CreateWorkflowDefinitionApiInput = validation.data\n\n    // workflow_id is unique per tenant; check upfront to return 409 instead of DB error.\n    const existing = await em.findOne(WorkflowDefinition, {\n      workflowId: input.workflowId,\n      tenantId,\n    })\n\n    if (existing) {\n      return NextResponse.json(\n        {\n          error: `Workflow definition with ID \"${input.workflowId}\" already exists`,\n        },\n        { status: 409 }\n      )\n    }\n\n    // Create workflow definition\n    const definition = em.create(WorkflowDefinition, {\n      workflowId: input.workflowId,\n      workflowName: input.workflowName,\n      description: input.description,\n      version: input.version,\n      definition: input.definition,\n      metadata: input.metadata,\n      enabled: input.enabled ?? true,\n      tenantId,\n      organizationId,\n      createdAt: new Date(),\n      updatedAt: new Date(),\n    })\n\n    await em.persist(definition).flush()\n\n    // Newly-created embedded triggers must be visible to the wildcard event\n    // subscriber immediately; invalidate the in-memory trigger cache so the\n    // next event reload picks up this definition.\n    if (tenantId) invalidateTriggerCache(tenantId, organizationId ?? undefined)\n\n    return NextResponse.json(\n      {\n        data: serializeWorkflowDefinition(definition),\n        message: 'Workflow definition created successfully',\n      },\n      { status: 201 }\n    )\n  } catch (error) {\n    if (isWorkflowIdUniqueConstraintError(error)) {\n      return NextResponse.json(\n        { error: 'Workflow definition with this ID already exists' },\n        { status: 409 }\n      )\n    }\n\n    logger.error('Error creating workflow definition', { err: error })\n    return NextResponse.json(\n      { error: 'Failed to create workflow definition' },\n      { status: 500 }\n    )\n  }\n}\n\nexport const openApi = {\n  methods: {\n    GET: {\n      summary: 'List workflow definitions',\n      description: 'Get a list of workflow definitions with optional filters. Supports pagination and search.',\n      tags: ['Workflows'],\n      query: createWorkflowDefinitionInputSchema.pick({ workflowId: true }).extend({\n        enabled: z.boolean().optional(),\n        search: z.string().optional(),\n        limit: z.number().int().positive().default(50).optional(),\n        offset: z.number().int().min(0).default(0).optional(),\n      }),\n      responses: [\n        {\n          status: 200,\n          description: 'List of workflow definitions with pagination',\n          example: {\n            data: [\n              {\n                id: '123e4567-e89b-12d3-a456-426614174000',\n                workflowId: 'checkout-flow',\n                workflowName: 'Checkout Flow',\n                description: 'Complete checkout workflow for processing orders',\n                version: 1,\n                definition: {\n                  steps: [\n                    {\n                      stepId: 'start',\n                      stepName: 'Start',\n                      stepType: 'START',\n                    },\n                    {\n                      stepId: 'validate-cart',\n                      stepName: 'Validate Cart',\n                      stepType: 'AUTOMATED',\n                    },\n                    {\n                      stepId: 'end',\n                      stepName: 'End',\n                      stepType: 'END',\n                    },\n                  ],\n                  transitions: [\n                    {\n                      transitionId: 'start-to-validate',\n                      fromStepId: 'start',\n                      toStepId: 'validate-cart',\n                      trigger: 'auto',\n                    },\n                    {\n                      transitionId: 'validate-to-end',\n                      fromStepId: 'validate-cart',\n                      toStepId: 'end',\n                      trigger: 'auto',\n                    },\n                  ],\n                },\n                enabled: true,\n                tenantId: '123e4567-e89b-12d3-a456-426614174001',\n                organizationId: '123e4567-e89b-12d3-a456-426614174002',\n                createdAt: '2025-12-08T10:00:00.000Z',\n                updatedAt: '2025-12-08T10:00:00.000Z',\n              },\n            ],\n            pagination: {\n              total: 1,\n              limit: 50,\n              offset: 0,\n              hasMore: false,\n            },\n          },\n        },\n      ],\n    },\n    POST: {\n      summary: 'Create workflow definition',\n      description: 'Create a new workflow definition. The definition must include at least START and END steps with at least one transition connecting them.',\n      tags: ['Workflows'],\n      requestBody: {\n        schema: createWorkflowDefinitionInputSchema,\n        example: {\n          workflowId: 'checkout-flow',\n          workflowName: 'Checkout Flow',\n          description: 'Complete checkout workflow for processing orders',\n          version: 1,\n          definition: {\n            steps: [\n              {\n                stepId: 'start',\n                stepName: 'Start',\n                stepType: 'START',\n              },\n              {\n                stepId: 'validate-cart',\n                stepName: 'Validate Cart',\n                stepType: 'AUTOMATED',\n                description: 'Validate cart items and check inventory',\n              },\n              {\n                stepId: 'payment',\n                stepName: 'Process Payment',\n                stepType: 'AUTOMATED',\n                description: 'Charge payment method',\n                retryPolicy: {\n                  maxAttempts: 3,\n                  backoffMs: 1000,\n                },\n              },\n              {\n                stepId: 'end',\n                stepName: 'End',\n                stepType: 'END',\n              },\n            ],\n            transitions: [\n              {\n                transitionId: 'start-to-validate',\n                fromStepId: 'start',\n                toStepId: 'validate-cart',\n                trigger: 'auto',\n              },\n              {\n                transitionId: 'validate-to-payment',\n                fromStepId: 'validate-cart',\n                toStepId: 'payment',\n                trigger: 'auto',\n              },\n              {\n                transitionId: 'payment-to-end',\n                fromStepId: 'payment',\n                toStepId: 'end',\n                trigger: 'auto',\n                activities: [\n                  {\n                    activityName: 'Send Order Confirmation',\n                    activityType: 'SEND_EMAIL',\n                    config: {\n                      to: '{{context.customerEmail}}',\n                      subject: 'Order Confirmation #{{context.orderId}}',\n                      template: 'order_confirmation',\n                    },\n                  },\n                ],\n              },\n            ],\n          },\n          enabled: true,\n        },\n      },\n      responses: [\n        {\n          status: 201,\n          description: 'Workflow definition created successfully',\n          example: {\n            data: {\n              id: '123e4567-e89b-12d3-a456-426614174000',\n              workflowId: 'checkout-flow',\n              workflowName: 'Checkout Flow',\n              description: 'Complete checkout workflow for processing orders',\n              version: 1,\n              definition: {\n                steps: [\n                  { stepId: 'start', stepName: 'Start', stepType: 'START' },\n                  {\n                    stepId: 'validate-cart',\n                    stepName: 'Validate Cart',\n                    stepType: 'AUTOMATED',\n                  },\n                  {\n                    stepId: 'payment',\n                    stepName: 'Process Payment',\n                    stepType: 'AUTOMATED',\n                  },\n                  { stepId: 'end', stepName: 'End', stepType: 'END' },\n                ],\n                transitions: [\n                  {\n                    transitionId: 'start-to-validate',\n                    fromStepId: 'start',\n                    toStepId: 'validate-cart',\n                    trigger: 'auto',\n                  },\n                  {\n                    transitionId: 'validate-to-payment',\n                    fromStepId: 'validate-cart',\n                    toStepId: 'payment',\n                    trigger: 'auto',\n                  },\n                  {\n                    transitionId: 'payment-to-end',\n                    fromStepId: 'payment',\n                    toStepId: 'end',\n                    trigger: 'auto',\n                  },\n                ],\n              },\n              enabled: true,\n              tenantId: '123e4567-e89b-12d3-a456-426614174001',\n              organizationId: '123e4567-e89b-12d3-a456-426614174002',\n              createdAt: '2025-12-08T10:00:00.000Z',\n              updatedAt: '2025-12-08T10:00:00.000Z',\n            },\n            message: 'Workflow definition created successfully',\n          },\n        },\n        {\n          status: 400,\n          description: 'Validation error - invalid workflow structure',\n          example: {\n            error: 'Validation failed',\n            details: [\n              {\n                code: 'invalid_type',\n                message: 'Workflow must have at least START and END steps',\n                path: ['definition', 'steps'],\n              },\n            ],\n          },\n        },\n        {\n          status: 409,\n          description: 'Conflict - workflow with same ID and version already exists',\n          example: {\n            error: 'Workflow definition with ID \"checkout-flow\" and version 1 already exists',\n          },\n        },\n      ],\n    },\n  },\n}\n\n// Full OpenAPI documentation (kept for reference but not used by type system)\nexport const _openApiDetailedDocs = {\n  get: {\n    summary: 'List workflow definitions',\n    description: 'Get a list of workflow definitions with optional filters',\n    tags: ['Workflows'],\n    parameters: [\n      {\n        name: 'enabled',\n        in: 'query',\n        description: 'Filter by enabled status',\n        schema: { type: 'boolean' },\n      },\n      {\n        name: 'workflowId',\n        in: 'query',\n        description: 'Filter by workflow ID',\n        schema: { type: 'string' },\n      },\n      {\n        name: 'search',\n        in: 'query',\n        description: 'Search in workflow ID and name',\n        schema: { type: 'string' },\n      },\n      {\n        name: 'limit',\n        in: 'query',\n        description: 'Number of results to return',\n        schema: { type: 'integer', default: 50 },\n      },\n      {\n        name: 'offset',\n        in: 'query',\n        description: 'Offset for pagination',\n        schema: { type: 'integer', default: 0 },\n      },\n    ],\n    responses: {\n      200: {\n        description: 'List of workflow definitions',\n        content: {\n          'application/json': {\n            schema: {\n              type: 'object',\n              properties: {\n                data: {\n                  type: 'array',\n                  items: { $ref: '#/components/schemas/WorkflowDefinition' },\n                },\n                pagination: {\n                  type: 'object',\n                  properties: {\n                    total: { type: 'integer' },\n                    limit: { type: 'integer' },\n                    offset: { type: 'integer' },\n                    hasMore: { type: 'boolean' },\n                  },\n                },\n              },\n            },\n          },\n        },\n      },\n    },\n  },\n  post: {\n    summary: 'Create workflow definition',\n    description: 'Create a new workflow definition',\n    tags: ['Workflows'],\n    requestBody: {\n      required: true,\n      content: {\n        'application/json': {\n          schema: { $ref: '#/components/schemas/CreateWorkflowDefinition' },\n        },\n      },\n    },\n    responses: {\n      201: {\n        description: 'Workflow definition created',\n        content: {\n          'application/json': {\n            schema: {\n              type: 'object',\n              properties: {\n                data: { $ref: '#/components/schemas/WorkflowDefinition' },\n                message: { type: 'string' },\n              },\n            },\n          },\n        },\n      },\n      400: {\n        description: 'Validation error',\n      },\n      409: {\n        description: 'Workflow definition already exists',\n      },\n    },\n  },\n}\n"],
-  "mappings": "AAQA,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,yBAAyB;AAClC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,sCAAsC;AAC/C,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,OAEK;AACP,SAAS,6BAA6B,uCAAuC;AAC7E,SAAS,8BAA8B;AACvC,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,4BAA4B;AAChD;AAEA,MAAM,uCAAuC;AAE7C,SAAS,kCAAkC,OAAyB;AAClE,MAAI,CAAC,SAAS,OAAO,UAAU,UAAU;AACvC,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ;AACd,QAAM,aAAa,MAAM;AACzB,QAAM,OAAO,MAAM;AACnB,QAAM,UAAU,OAAO,MAAM,YAAY,WAAW,MAAM,UAAU;AACpE,QAAM,SAAS,OAAO,MAAM,WAAW,WAAW,MAAM,SAAS;AAEjE,MAAI,eAAe,sCAAsC;AACvD,WAAO;AAAA,EACT;AAEA,MAAI,SAAS,WAAW,OAAO,SAAS,0BAA0B,GAAG;AACnE,WAAO;AAAA,EACT;AAEA,SAAO,QAAQ,SAAS,oCAAoC;AAC9D;AAOA,eAAsB,IAAI,SAAsB;AAC9C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,YAAY,+BAA+B,OAAO,IAAI;AAE5D,UAAM,EAAE,aAAa,IAAI,IAAI,IAAI,QAAQ,GAAG;AAC5C,UAAM,UAAU,aAAa,IAAI,SAAS;AAC1C,UAAM,aAAa,aAAa,IAAI,YAAY;AAChD,UAAM,SAAS,aAAa,IAAI,QAAQ;AACxC,UAAM,QAAQ,SAAS,aAAa,IAAI,OAAO,KAAK,IAAI;AACxD,UAAM,SAAS,SAAS,aAAa,IAAI,QAAQ,KAAK,GAAG;AAGzD,UAAM,QAAa;AAAA,MACjB;AAAA,MACA,GAAG,UAAU;AAAA,MACb,WAAW;AAAA,IACb;AAEA,QAAI,YAAY,MAAM;AACpB,YAAM,UAAU,YAAY;AAAA,IAC9B;AAEA,QAAI,YAAY;AACd,YAAM,aAAa;AAAA,IACrB;AAEA,QAAI,QAAQ;AACV,YAAM,MAAM;AAAA,QACV,EAAE,YAAY,EAAE,QAAQ,IAAI,kBAAkB,MAAM,CAAC,IAAI,EAAE;AAAA,QAC3D,EAAE,cAAc,EAAE,QAAQ,IAAI,kBAAkB,MAAM,CAAC,IAAI,EAAE;AAAA,MAC/D;AAAA,IACF;AAIA,UAAM,gBAAgB,YAAY,OAAO,YAAY,SAAS;AAC9D,UAAM,cAAc,SAAS,OAAO,YAAY,IAAI;AACpD,UAAM,aAAa,oBAAoB,EAAE,IAAI,CAAC,OAAO,GAAG,UAAU;AAClE,UAAM,WAAW,WAAW,SAAS,IACjC,IAAI;AAAA,OAEA,MAAM,GAAG;AAAA,QACP;AAAA,QACA,EAAE,GAAG,OAAO,YAAY,EAAE,KAAK,WAAW,EAAE;AAAA,QAC5C,EAAE,QAAQ,CAAC,YAAY,EAAW;AAAA,MACpC,GACA,IAAI,CAAC,MAA0B,EAAE,UAAU;AAAA,IAC/C,IACA,oBAAI,IAAY;AAEpB,UAAM,WAAW,oBAAoB,EAClC,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,GAAG,UAAU,CAAC,EAC3C,OAAO,CAAC,OAAO;AACd,UAAI,aAAa;AACf,cAAM,UACJ,GAAG,WAAW,YAAY,EAAE,SAAS,WAAW,KAChD,GAAG,aAAa,YAAY,EAAE,SAAS,WAAW;AACpD,YAAI,CAAC,QAAS,QAAO;AAAA,MACvB;AACA,UAAI,kBAAkB,QAAQ,GAAG,YAAY,cAAe,QAAO;AACnE,UAAI,cAAc,GAAG,eAAe,WAAY,QAAO;AACvD,aAAO;AAAA,IACT,CAAC,EACA,IAAI,CAAC,OAAO,gCAAgC,IAAI,QAAQ,GAAG,UAAU,EAAE,CAAC;AAE3E,UAAM,UAAU,MAAM,GAAG,MAAM,oBAAoB,KAAK;AACxD,UAAM,QAAQ,UAAU,SAAS;AAIjC,UAAM,gBAAgB,SAAS;AAC/B,UAAM,WAAW,gBAAgB,IAC7B,MAAM,GAAG,KAAK,oBAAoB,OAAO;AAAA,MACvC,SAAS,EAAE,cAAc,MAAM;AAAA,MAC/B,OAAO;AAAA,IACT,CAAC,IACD,CAAC;AAEL,UAAM,eAAe,SAAS,IAAI,2BAA2B;AAE7D,UAAM,SAAS,CAAC,GAAG,cAAc,GAAG,QAAQ,EAAE;AAAA,MAAK,CAAC,GAAG,MACrD,EAAE,aAAa,cAAc,EAAE,YAAY;AAAA,IAC7C;AAEA,UAAM,YAAY,OAAO,MAAM,QAAQ,SAAS,KAAK;AAErD,WAAO,aAAa,KAAK;AAAA,MACvB,MAAM;AAAA,MACN,YAAY;AAAA,QACV;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS,SAAS,QAAQ;AAAA,MAC5B;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,sCAAsC,EAAE,KAAK,MAAM,CAAC;AACjE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,sCAAsC;AAAA,MAC/C,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAOA,eAAsB,KAAK,SAAsB;AAC/C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,cAAc,KAAK;AAGjD,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,UAAM,gBAAgB,MAAM,YAAY;AAAA,MACtC,KAAK;AAAA,MACL,CAAC,8BAA8B;AAAA,MAC/B;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,2BAA2B;AAAA,QACpC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,OAAO,MAAM,QAAQ,KAAK;AAGhC,UAAM,aAAa,oCAAoC,UAAU,IAAI;AACrE,QAAI,CAAC,WAAW,SAAS;AACvB,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO;AAAA,UACP,SAAS,WAAW,MAAM;AAAA,QAC5B;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,QAA0C,WAAW;AAG3D,UAAM,WAAW,MAAM,GAAG,QAAQ,oBAAoB;AAAA,MACpD,YAAY,MAAM;AAAA,MAClB;AAAA,IACF,CAAC;AAED,QAAI,UAAU;AACZ,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO,gCAAgC,MAAM,UAAU;AAAA,QACzD;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAGA,UAAM,aAAa,GAAG,OAAO,oBAAoB;AAAA,MAC/C,YAAY,MAAM;AAAA,MAClB,cAAc,MAAM;AAAA,MACpB,aAAa,MAAM;AAAA,MACnB,SAAS,MAAM;AAAA,MACf,YAAY,MAAM;AAAA,MAClB,UAAU,MAAM;AAAA,MAChB,SAAS,MAAM,WAAW;AAAA,MAC1B;AAAA,MACA;AAAA,MACA,WAAW,oBAAI,KAAK;AAAA,MACpB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AAED,UAAM,GAAG,QAAQ,UAAU,EAAE,MAAM;AAKnC,QAAI,SAAU,wBAAuB,UAAU,kBAAkB,MAAS;AAE1E,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,MAAM,4BAA4B,UAAU;AAAA,QAC5C,SAAS;AAAA,MACX;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF,SAAS,OAAO;AACd,QAAI,kCAAkC,KAAK,GAAG;AAC5C,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,kDAAkD;AAAA,QAC3D,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,WAAO,MAAM,sCAAsC,EAAE,KAAK,MAAM,CAAC;AACjE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,uCAAuC;AAAA,MAChD,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,MAAM,CAAC,WAAW;AAAA,MAClB,OAAO,oCAAoC,KAAK,EAAE,YAAY,KAAK,CAAC,EAAE,OAAO;AAAA,QAC3E,SAAS,EAAE,QAAQ,EAAE,SAAS;AAAA,QAC9B,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,QAC5B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,SAAS;AAAA,QACxD,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,MACtD,CAAC;AAAA,MACD,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,SAAS;AAAA,YACP,MAAM;AAAA,cACJ;AAAA,gBACE,IAAI;AAAA,gBACJ,YAAY;AAAA,gBACZ,cAAc;AAAA,gBACd,aAAa;AAAA,gBACb,SAAS;AAAA,gBACT,YAAY;AAAA,kBACV,OAAO;AAAA,oBACL;AAAA,sBACE,QAAQ;AAAA,sBACR,UAAU;AAAA,sBACV,UAAU;AAAA,oBACZ;AAAA,oBACA;AAAA,sBACE,QAAQ;AAAA,sBACR,UAAU;AAAA,sBACV,UAAU;AAAA,oBACZ;AAAA,oBACA;AAAA,sBACE,QAAQ;AAAA,sBACR,UAAU;AAAA,sBACV,UAAU;AAAA,oBACZ;AAAA,kBACF;AAAA,kBACA,aAAa;AAAA,oBACX;AAAA,sBACE,cAAc;AAAA,sBACd,YAAY;AAAA,sBACZ,UAAU;AAAA,sBACV,SAAS;AAAA,oBACX;AAAA,oBACA;AAAA,sBACE,cAAc;AAAA,sBACd,YAAY;AAAA,sBACZ,UAAU;AAAA,sBACV,SAAS;AAAA,oBACX;AAAA,kBACF;AAAA,gBACF;AAAA,gBACA,SAAS;AAAA,gBACT,UAAU;AAAA,gBACV,gBAAgB;AAAA,gBAChB,WAAW;AAAA,gBACX,WAAW;AAAA,cACb;AAAA,YACF;AAAA,YACA,YAAY;AAAA,cACV,OAAO;AAAA,cACP,OAAO;AAAA,cACP,QAAQ;AAAA,cACR,SAAS;AAAA,YACX;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,MAAM,CAAC,WAAW;AAAA,MAClB,aAAa;AAAA,QACX,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,aAAa;AAAA,UACb,SAAS;AAAA,UACT,YAAY;AAAA,YACV,OAAO;AAAA,cACL;AAAA,gBACE,QAAQ;AAAA,gBACR,UAAU;AAAA,gBACV,UAAU;AAAA,cACZ;AAAA,cACA;AAAA,gBACE,QAAQ;AAAA,gBACR,UAAU;AAAA,gBACV,UAAU;AAAA,gBACV,aAAa;AAAA,cACf;AAAA,cACA;AAAA,gBACE,QAAQ;AAAA,gBACR,UAAU;AAAA,gBACV,UAAU;AAAA,gBACV,aAAa;AAAA,gBACb,aAAa;AAAA,kBACX,aAAa;AAAA,kBACb,WAAW;AAAA,gBACb;AAAA,cACF;AAAA,cACA;AAAA,gBACE,QAAQ;AAAA,gBACR,UAAU;AAAA,gBACV,UAAU;AAAA,cACZ;AAAA,YACF;AAAA,YACA,aAAa;AAAA,cACX;AAAA,gBACE,cAAc;AAAA,gBACd,YAAY;AAAA,gBACZ,UAAU;AAAA,gBACV,SAAS;AAAA,cACX;AAAA,cACA;AAAA,gBACE,cAAc;AAAA,gBACd,YAAY;AAAA,gBACZ,UAAU;AAAA,gBACV,SAAS;AAAA,cACX;AAAA,cACA;AAAA,gBACE,cAAc;AAAA,gBACd,YAAY;AAAA,gBACZ,UAAU;AAAA,gBACV,SAAS;AAAA,gBACT,YAAY;AAAA,kBACV;AAAA,oBACE,cAAc;AAAA,oBACd,cAAc;AAAA,oBACd,QAAQ;AAAA,sBACN,IAAI;AAAA,sBACJ,SAAS;AAAA,sBACT,UAAU;AAAA,oBACZ;AAAA,kBACF;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,UACA,SAAS;AAAA,QACX;AAAA,MACF;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,SAAS;AAAA,YACP,MAAM;AAAA,cACJ,IAAI;AAAA,cACJ,YAAY;AAAA,cACZ,cAAc;AAAA,cACd,aAAa;AAAA,cACb,SAAS;AAAA,cACT,YAAY;AAAA,gBACV,OAAO;AAAA,kBACL,EAAE,QAAQ,SAAS,UAAU,SAAS,UAAU,QAAQ;AAAA,kBACxD;AAAA,oBACE,QAAQ;AAAA,oBACR,UAAU;AAAA,oBACV,UAAU;AAAA,kBACZ;AAAA,kBACA;AAAA,oBACE,QAAQ;AAAA,oBACR,UAAU;AAAA,oBACV,UAAU;AAAA,kBACZ;AAAA,kBACA,EAAE,QAAQ,OAAO,UAAU,OAAO,UAAU,MAAM;AAAA,gBACpD;AAAA,gBACA,aAAa;AAAA,kBACX;AAAA,oBACE,cAAc;AAAA,oBACd,YAAY;AAAA,oBACZ,UAAU;AAAA,oBACV,SAAS;AAAA,kBACX;AAAA,kBACA;AAAA,oBACE,cAAc;AAAA,oBACd,YAAY;AAAA,oBACZ,UAAU;AAAA,oBACV,SAAS;AAAA,kBACX;AAAA,kBACA;AAAA,oBACE,cAAc;AAAA,oBACd,YAAY;AAAA,oBACZ,UAAU;AAAA,oBACV,SAAS;AAAA,kBACX;AAAA,gBACF;AAAA,cACF;AAAA,cACA,SAAS;AAAA,cACT,UAAU;AAAA,cACV,gBAAgB;AAAA,cAChB,WAAW;AAAA,cACX,WAAW;AAAA,YACb;AAAA,YACA,SAAS;AAAA,UACX;AAAA,QACF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,SAAS;AAAA,YACP,OAAO;AAAA,YACP,SAAS;AAAA,cACP;AAAA,gBACE,MAAM;AAAA,gBACN,SAAS;AAAA,gBACT,MAAM,CAAC,cAAc,OAAO;AAAA,cAC9B;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,SAAS;AAAA,YACP,OAAO;AAAA,UACT;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAGO,MAAM,uBAAuB;AAAA,EAClC,KAAK;AAAA,IACH,SAAS;AAAA,IACT,aAAa;AAAA,IACb,MAAM,CAAC,WAAW;AAAA,IAClB,YAAY;AAAA,MACV;AAAA,QACE,MAAM;AAAA,QACN,IAAI;AAAA,QACJ,aAAa;AAAA,QACb,QAAQ,EAAE,MAAM,UAAU;AAAA,MAC5B;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,IAAI;AAAA,QACJ,aAAa;AAAA,QACb,QAAQ,EAAE,MAAM,SAAS;AAAA,MAC3B;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,IAAI;AAAA,QACJ,aAAa;AAAA,QACb,QAAQ,EAAE,MAAM,SAAS;AAAA,MAC3B;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,IAAI;AAAA,QACJ,aAAa;AAAA,QACb,QAAQ,EAAE,MAAM,WAAW,SAAS,GAAG;AAAA,MACzC;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,IAAI;AAAA,QACJ,aAAa;AAAA,QACb,QAAQ,EAAE,MAAM,WAAW,SAAS,EAAE;AAAA,MACxC;AAAA,IACF;AAAA,IACA,WAAW;AAAA,MACT,KAAK;AAAA,QACH,aAAa;AAAA,QACb,SAAS;AAAA,UACP,oBAAoB;AAAA,YAClB,QAAQ;AAAA,cACN,MAAM;AAAA,cACN,YAAY;AAAA,gBACV,MAAM;AAAA,kBACJ,MAAM;AAAA,kBACN,OAAO,EAAE,MAAM,0CAA0C;AAAA,gBAC3D;AAAA,gBACA,YAAY;AAAA,kBACV,MAAM;AAAA,kBACN,YAAY;AAAA,oBACV,OAAO,EAAE,MAAM,UAAU;AAAA,oBACzB,OAAO,EAAE,MAAM,UAAU;AAAA,oBACzB,QAAQ,EAAE,MAAM,UAAU;AAAA,oBAC1B,SAAS,EAAE,MAAM,UAAU;AAAA,kBAC7B;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM;AAAA,IACJ,SAAS;AAAA,IACT,aAAa;AAAA,IACb,MAAM,CAAC,WAAW;AAAA,IAClB,aAAa;AAAA,MACX,UAAU;AAAA,MACV,SAAS;AAAA,QACP,oBAAoB;AAAA,UAClB,QAAQ,EAAE,MAAM,gDAAgD;AAAA,QAClE;AAAA,MACF;AAAA,IACF;AAAA,IACA,WAAW;AAAA,MACT,KAAK;AAAA,QACH,aAAa;AAAA,QACb,SAAS;AAAA,UACP,oBAAoB;AAAA,YAClB,QAAQ;AAAA,cACN,MAAM;AAAA,cACN,YAAY;AAAA,gBACV,MAAM,EAAE,MAAM,0CAA0C;AAAA,gBACxD,SAAS,EAAE,MAAM,SAAS;AAAA,cAC5B;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,MACA,KAAK;AAAA,QACH,aAAa;AAAA,MACf;AAAA,MACA,KAAK;AAAA,QACH,aAAa;AAAA,MACf;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * Workflow Definitions API\n *\n * Endpoints:\n * - GET /api/workflows/definitions - List workflow definitions\n * - POST /api/workflows/definitions - Create workflow definition\n */\n\nimport { randomUUID } from 'node:crypto'\nimport { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveOrganizationScopeFilter } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { WorkflowDefinition } from '../../data/entities'\nimport {\n  createWorkflowDefinitionInputSchema,\n  createWorkflowDefinitionInputCheckedSchema,\n  type CreateWorkflowDefinitionApiInput,\n} from '../../data/validators'\nimport { serializeWorkflowDefinition, serializeCodeWorkflowDefinition } from './serialize'\nimport {\n  workflowDefinitionListResponseSchema,\n  workflowDefinitionMutationResponseSchema,\n  workflowErrorSchema,\n} from '../openapi'\nimport { invalidateTriggerCache } from '../../lib/event-trigger-service'\nimport { normalizeDefinitionValidationIssues } from '../../lib/definition-error-body'\nimport { getAllCodeWorkflows } from '../../lib/code-registry'\nimport {\n  authorizeWorkflowGrantChange,\n  normalizeGrantedFeatures,\n  syncWorkflowDefinitionPrincipal,\n} from '../../lib/definition-grant'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.view'],\n}\n\n// Post-versioning the unique constraint is (workflow_id, version, tenant_id);\n// the legacy name is still matched so the check survives a partially-migrated DB.\nconst WORKFLOW_ID_TENANT_UNIQUE_CONSTRAINT = 'workflow_definitions_workflow_id_tenant_id_unique'\nconst WORKFLOW_ID_VERSION_TENANT_UNIQUE_CONSTRAINT = 'workflow_definitions_workflow_id_version_tenant_id_unique'\n\nfunction isWorkflowIdUniqueConstraintError(error: unknown): boolean {\n  if (!error || typeof error !== 'object') {\n    return false\n  }\n\n  const value = error as Record<string, unknown>\n  const constraint = value.constraint\n  const code = value.code\n  const message = typeof value.message === 'string' ? value.message : ''\n  const detail = typeof value.detail === 'string' ? value.detail : ''\n\n  if (constraint === WORKFLOW_ID_TENANT_UNIQUE_CONSTRAINT || constraint === WORKFLOW_ID_VERSION_TENANT_UNIQUE_CONSTRAINT) {\n    return true\n  }\n\n  if (code === '23505' && (detail.includes('(workflow_id, tenant_id)') || detail.includes('(workflow_id, version, tenant_id)'))) {\n    return true\n  }\n\n  return message.includes(WORKFLOW_ID_TENANT_UNIQUE_CONSTRAINT) || message.includes(WORKFLOW_ID_VERSION_TENANT_UNIQUE_CONSTRAINT)\n}\n\n/**\n * GET /api/workflows/definitions\n *\n * List workflow definitions with optional filters\n */\nexport async function GET(request: NextRequest) {\n  try {\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const orgFilter = resolveOrganizationScopeFilter(scope, auth)\n\n    const { searchParams } = new URL(request.url)\n    const enabled = searchParams.get('enabled')\n    const workflowId = searchParams.get('workflowId')\n    const search = searchParams.get('search')\n    const kind = searchParams.get('kind')\n    const lifecycle = searchParams.get('lifecycle')\n    const versionParam = searchParams.get('version')\n    const version = versionParam !== null && /^\\d+$/.test(versionParam) ? parseInt(versionParam, 10) : null\n    const limit = parseInt(searchParams.get('limit') || '50')\n    const offset = parseInt(searchParams.get('offset') || '0')\n\n    // Build where clause with tenant scoping\n    const where: any = {\n      tenantId,\n      ...orgFilter.where,\n      deletedAt: null,\n    }\n\n    if (enabled !== null) {\n      where.enabled = enabled === 'true'\n    }\n\n    if (workflowId) {\n      where.workflowId = workflowId\n    }\n\n    if (kind) {\n      where.kind = kind\n    }\n\n    if (lifecycle) {\n      where.lifecycle = lifecycle\n    }\n\n    if (version !== null) {\n      where.version = version\n    }\n\n    if (search) {\n      where.$or = [\n        { workflowId: { $ilike: `%${escapeLikePattern(search)}%` } },\n        { workflowName: { $ilike: `%${escapeLikePattern(search)}%` } },\n      ]\n    }\n\n    // Determine which code workflows are shadowed by a DB row (so we can\n    // exclude them from the code-only list) without loading all DB rows.\n    const enabledFilter = enabled !== null ? enabled === 'true' : null\n    const searchLower = search ? search.toLowerCase() : null\n    const allCodeIds = getAllCodeWorkflows().map((cw) => cw.workflowId)\n    const shadowed = allCodeIds.length > 0\n      ? new Set(\n          (\n            await em.find(\n              WorkflowDefinition,\n              { ...where, workflowId: { $in: allCodeIds } },\n              { fields: ['workflowId'] as const },\n            )\n          ).map((d: WorkflowDefinition) => d.workflowId),\n        )\n      : new Set<string>()\n\n    const codeOnly = getAllCodeWorkflows()\n      .filter((cw) => !shadowed.has(cw.workflowId))\n      .filter((cw) => {\n        // Code-based definitions are always kind=workflow / lifecycle=published.\n        if (kind && kind !== 'workflow') return false\n        if (lifecycle && lifecycle !== 'published') return false\n        if (version !== null && cw.version !== version) return false\n        if (searchLower) {\n          const matches =\n            cw.workflowId.toLowerCase().includes(searchLower) ||\n            cw.workflowName.toLowerCase().includes(searchLower)\n          if (!matches) return false\n        }\n        if (enabledFilter !== null && cw.enabled !== enabledFilter) return false\n        if (workflowId && cw.workflowId !== workflowId) return false\n        return true\n      })\n      .map((cw) => serializeCodeWorkflowDefinition(cw, `code:${cw.workflowId}`))\n\n    const dbCount = await em.count(WorkflowDefinition, where)\n    const total = dbCount + codeOnly.length\n\n    // Fetch only the prefix of DB rows we might need to fill the requested\n    // page after merging with the (already-filtered) code-only list.\n    const dbWindowLimit = offset + limit\n    const dbWindow = dbWindowLimit > 0\n      ? await em.find(WorkflowDefinition, where, {\n          orderBy: { workflowName: 'ASC' },\n          limit: dbWindowLimit,\n        })\n      : []\n\n    const serializedDb = dbWindow.map(serializeWorkflowDefinition)\n\n    const merged = [...serializedDb, ...codeOnly].sort((a, b) =>\n      a.workflowName.localeCompare(b.workflowName),\n    )\n\n    const paginated = merged.slice(offset, offset + limit)\n\n    return NextResponse.json({\n      data: paginated,\n      pagination: {\n        total,\n        limit,\n        offset,\n        hasMore: offset + limit < total,\n      },\n    })\n  } catch (error) {\n    logger.error('Error listing workflow definitions', { err: error })\n    return NextResponse.json(\n      { error: 'Failed to list workflow definitions' },\n      { status: 500 }\n    )\n  }\n}\n\n/**\n * POST /api/workflows/definitions\n *\n * Create a new workflow definition\n */\nexport async function POST(request: NextRequest) {\n  try {\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = scope?.selectedId ?? auth.orgId\n\n    // Check create permission\n    const rbacService = container.resolve('rbacService')\n    const hasPermission = await rbacService.userHasAllFeatures(\n      auth.sub,\n      ['workflows.definitions.create'],\n      {\n        tenantId,\n        organizationId,\n      }\n    )\n\n    if (!hasPermission) {\n      return NextResponse.json(\n        { error: 'Insufficient permissions' },\n        { status: 403 }\n      )\n    }\n\n    const body = await request.json()\n\n    // Validate input\n    const validation = createWorkflowDefinitionInputCheckedSchema.safeParse(body)\n    if (!validation.success) {\n      return NextResponse.json(\n        {\n          error: 'Validation failed',\n          details: normalizeDefinitionValidationIssues(validation.error),\n        },\n        { status: 400 }\n      )\n    }\n\n    const input: CreateWorkflowDefinitionApiInput = validation.data\n\n    // New definitions default to strict interpolation (spec \u00A73.6). The default\n    // lives on the create path only \u2014 a schema-level default would flip\n    // existing lenient definitions on their next full-body update.\n    const definitionData = input.definition.interpolation\n      ? input.definition\n      : { ...input.definition, interpolation: 'strict' as const }\n\n    // Create always mints version 1. A workflowId that already exists (any\n    // version) is a conflict \u2014 new versions are produced via the publish flow,\n    // not by re-creating. orderBy keeps the existence check deterministic now\n    // that multiple versions can coexist.\n    const existing = await em.findOne(WorkflowDefinition, {\n      workflowId: input.workflowId,\n      tenantId,\n    }, { orderBy: { version: 'DESC' } })\n\n    if (existing) {\n      return NextResponse.json(\n        {\n          error: `Workflow definition with ID \"${input.workflowId}\" already exists`,\n        },\n        { status: 409 }\n      )\n    }\n\n    const grantedFeatures = normalizeGrantedFeatures(input.grantedFeatures)\n    const grantFailure = await authorizeWorkflowGrantChange(rbacService, {\n      userId: auth.sub,\n      scope: { tenantId, organizationId },\n      requested: grantedFeatures,\n      current: [],\n    })\n    if (grantFailure) {\n      return NextResponse.json(grantFailure.body, { status: grantFailure.status })\n    }\n\n    // Create workflow definition.\n    //\n    // The PK is minted up front (MikroORM does not generate UUIDs client-side)\n    // so the execution principal \u2014 whose identity key is the definition id \u2014 can\n    // be provisioned BEFORE the row claiming the grant is persisted. A failed\n    // provisioning then leaves no definition pointing at a principal that does\n    // not exist.\n    //\n    // `createdBy` is recorded here for the first time. It was never set on this\n    // path, which silently disabled the definition-author fallback CALL_API and\n    // INVOKE_AGENT rely on for event-triggered runs.\n    const definition = em.create(WorkflowDefinition, {\n      id: randomUUID(),\n      workflowId: input.workflowId,\n      workflowName: input.workflowName,\n      description: input.description,\n      version: input.version,\n      definition: definitionData,\n      metadata: input.metadata,\n      enabled: input.enabled ?? true,\n      grantedFeatures: grantedFeatures.length ? grantedFeatures : null,\n      tenantId,\n      organizationId,\n      createdBy: auth.sub,\n      updatedBy: auth.sub,\n      createdAt: new Date(),\n      updatedAt: new Date(),\n    })\n\n    await syncWorkflowDefinitionPrincipal(container, definition)\n\n    await em.persist(definition).flush()\n\n    // Newly-created embedded triggers must be visible to the wildcard event\n    // subscriber immediately; invalidate the in-memory trigger cache so the\n    // next event reload picks up this definition.\n    if (tenantId) invalidateTriggerCache(tenantId, organizationId ?? undefined)\n\n    return NextResponse.json(\n      {\n        data: serializeWorkflowDefinition(definition),\n        message: 'Workflow definition created successfully',\n      },\n      { status: 201 }\n    )\n  } catch (error) {\n    if (isWorkflowIdUniqueConstraintError(error)) {\n      return NextResponse.json(\n        { error: 'Workflow definition with this ID already exists' },\n        { status: 409 }\n      )\n    }\n\n    logger.error('Error creating workflow definition', { err: error })\n    return NextResponse.json(\n      { error: 'Failed to create workflow definition' },\n      { status: 500 }\n    )\n  }\n}\n\nexport const openApi = {\n  methods: {\n    GET: {\n      summary: 'List workflow definitions',\n      description: 'Get a list of workflow definitions with optional filters. Supports pagination and search.',\n      tags: ['Workflows'],\n      query: createWorkflowDefinitionInputSchema.pick({ workflowId: true }).extend({\n        enabled: z.boolean().optional(),\n        search: z.string().optional(),\n        limit: z.number().int().positive().default(50).optional(),\n        offset: z.number().int().min(0).default(0).optional(),\n      }),\n      responses: [\n        {\n          status: 200,\n          description: 'List of workflow definitions with pagination',\n          schema: workflowDefinitionListResponseSchema,\n          example: {\n            data: [\n              {\n                id: '123e4567-e89b-12d3-a456-426614174000',\n                workflowId: 'checkout-flow',\n                workflowName: 'Checkout Flow',\n                description: 'Complete checkout workflow for processing orders',\n                version: 1,\n                definition: {\n                  steps: [\n                    {\n                      stepId: 'start',\n                      stepName: 'Start',\n                      stepType: 'START',\n                    },\n                    {\n                      stepId: 'validate-cart',\n                      stepName: 'Validate Cart',\n                      stepType: 'AUTOMATED',\n                    },\n                    {\n                      stepId: 'end',\n                      stepName: 'End',\n                      stepType: 'END',\n                    },\n                  ],\n                  transitions: [\n                    {\n                      transitionId: 'start-to-validate',\n                      fromStepId: 'start',\n                      toStepId: 'validate-cart',\n                      trigger: 'auto',\n                    },\n                    {\n                      transitionId: 'validate-to-end',\n                      fromStepId: 'validate-cart',\n                      toStepId: 'end',\n                      trigger: 'auto',\n                    },\n                  ],\n                },\n                enabled: true,\n                tenantId: '123e4567-e89b-12d3-a456-426614174001',\n                organizationId: '123e4567-e89b-12d3-a456-426614174002',\n                createdAt: '2025-12-08T10:00:00.000Z',\n                updatedAt: '2025-12-08T10:00:00.000Z',\n              },\n            ],\n            pagination: {\n              total: 1,\n              limit: 50,\n              offset: 0,\n              hasMore: false,\n            },\n          },\n        },\n      ],\n    },\n    POST: {\n      summary: 'Create workflow definition',\n      description: 'Create a new workflow definition. The definition must include at least START and END steps with at least one transition connecting them.',\n      tags: ['Workflows'],\n      requestBody: {\n        schema: createWorkflowDefinitionInputSchema,\n        example: {\n          workflowId: 'checkout-flow',\n          workflowName: 'Checkout Flow',\n          description: 'Complete checkout workflow for processing orders',\n          version: 1,\n          definition: {\n            steps: [\n              {\n                stepId: 'start',\n                stepName: 'Start',\n                stepType: 'START',\n              },\n              {\n                stepId: 'validate-cart',\n                stepName: 'Validate Cart',\n                stepType: 'AUTOMATED',\n                description: 'Validate cart items and check inventory',\n              },\n              {\n                stepId: 'payment',\n                stepName: 'Process Payment',\n                stepType: 'AUTOMATED',\n                description: 'Charge payment method',\n                retryPolicy: {\n                  maxAttempts: 3,\n                  backoffMs: 1000,\n                },\n              },\n              {\n                stepId: 'end',\n                stepName: 'End',\n                stepType: 'END',\n              },\n            ],\n            transitions: [\n              {\n                transitionId: 'start-to-validate',\n                fromStepId: 'start',\n                toStepId: 'validate-cart',\n                trigger: 'auto',\n              },\n              {\n                transitionId: 'validate-to-payment',\n                fromStepId: 'validate-cart',\n                toStepId: 'payment',\n                trigger: 'auto',\n              },\n              {\n                transitionId: 'payment-to-end',\n                fromStepId: 'payment',\n                toStepId: 'end',\n                trigger: 'auto',\n                activities: [\n                  {\n                    activityName: 'Send Order Confirmation',\n                    activityType: 'SEND_EMAIL',\n                    config: {\n                      to: '{{context.customerEmail}}',\n                      subject: 'Order Confirmation #{{context.orderId}}',\n                      template: 'order_confirmation',\n                    },\n                  },\n                ],\n              },\n            ],\n          },\n          enabled: true,\n        },\n      },\n      responses: [\n        {\n          status: 201,\n          description: 'Workflow definition created successfully',\n          schema: workflowDefinitionMutationResponseSchema,\n          example: {\n            data: {\n              id: '123e4567-e89b-12d3-a456-426614174000',\n              workflowId: 'checkout-flow',\n              workflowName: 'Checkout Flow',\n              description: 'Complete checkout workflow for processing orders',\n              version: 1,\n              definition: {\n                steps: [\n                  { stepId: 'start', stepName: 'Start', stepType: 'START' },\n                  {\n                    stepId: 'validate-cart',\n                    stepName: 'Validate Cart',\n                    stepType: 'AUTOMATED',\n                  },\n                  {\n                    stepId: 'payment',\n                    stepName: 'Process Payment',\n                    stepType: 'AUTOMATED',\n                  },\n                  { stepId: 'end', stepName: 'End', stepType: 'END' },\n                ],\n                transitions: [\n                  {\n                    transitionId: 'start-to-validate',\n                    fromStepId: 'start',\n                    toStepId: 'validate-cart',\n                    trigger: 'auto',\n                  },\n                  {\n                    transitionId: 'validate-to-payment',\n                    fromStepId: 'validate-cart',\n                    toStepId: 'payment',\n                    trigger: 'auto',\n                  },\n                  {\n                    transitionId: 'payment-to-end',\n                    fromStepId: 'payment',\n                    toStepId: 'end',\n                    trigger: 'auto',\n                  },\n                ],\n              },\n              enabled: true,\n              tenantId: '123e4567-e89b-12d3-a456-426614174001',\n              organizationId: '123e4567-e89b-12d3-a456-426614174002',\n              createdAt: '2025-12-08T10:00:00.000Z',\n              updatedAt: '2025-12-08T10:00:00.000Z',\n            },\n            message: 'Workflow definition created successfully',\n          },\n        },\n        {\n          status: 400,\n          description: 'Validation error - invalid workflow structure',\n          schema: workflowErrorSchema,\n          example: {\n            error: 'Validation failed',\n            details: [\n              {\n                path: ['definition', 'steps'],\n                code: 'custom',\n                message: 'Workflow must have at least START and END steps',\n              },\n            ],\n          },\n        },\n        {\n          status: 409,\n          description: 'Conflict - workflow with same ID and version already exists',\n          schema: workflowErrorSchema,\n          example: {\n            error: 'Workflow definition with ID \"checkout-flow\" and version 1 already exists',\n          },\n        },\n      ],\n    },\n  },\n}\n\n"],
+  "mappings": "AAQA,SAAS,kBAAkB;AAC3B,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,yBAAyB;AAClC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,sCAAsC;AAC/C,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP,SAAS,6BAA6B,uCAAuC;AAC7E;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,8BAA8B;AACvC,SAAS,2CAA2C;AACpD,SAAS,2BAA2B;AACpC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,4BAA4B;AAChD;AAIA,MAAM,uCAAuC;AAC7C,MAAM,+CAA+C;AAErD,SAAS,kCAAkC,OAAyB;AAClE,MAAI,CAAC,SAAS,OAAO,UAAU,UAAU;AACvC,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ;AACd,QAAM,aAAa,MAAM;AACzB,QAAM,OAAO,MAAM;AACnB,QAAM,UAAU,OAAO,MAAM,YAAY,WAAW,MAAM,UAAU;AACpE,QAAM,SAAS,OAAO,MAAM,WAAW,WAAW,MAAM,SAAS;AAEjE,MAAI,eAAe,wCAAwC,eAAe,8CAA8C;AACtH,WAAO;AAAA,EACT;AAEA,MAAI,SAAS,YAAY,OAAO,SAAS,0BAA0B,KAAK,OAAO,SAAS,mCAAmC,IAAI;AAC7H,WAAO;AAAA,EACT;AAEA,SAAO,QAAQ,SAAS,oCAAoC,KAAK,QAAQ,SAAS,4CAA4C;AAChI;AAOA,eAAsB,IAAI,SAAsB;AAC9C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,YAAY,+BAA+B,OAAO,IAAI;AAE5D,UAAM,EAAE,aAAa,IAAI,IAAI,IAAI,QAAQ,GAAG;AAC5C,UAAM,UAAU,aAAa,IAAI,SAAS;AAC1C,UAAM,aAAa,aAAa,IAAI,YAAY;AAChD,UAAM,SAAS,aAAa,IAAI,QAAQ;AACxC,UAAM,OAAO,aAAa,IAAI,MAAM;AACpC,UAAM,YAAY,aAAa,IAAI,WAAW;AAC9C,UAAM,eAAe,aAAa,IAAI,SAAS;AAC/C,UAAM,UAAU,iBAAiB,QAAQ,QAAQ,KAAK,YAAY,IAAI,SAAS,cAAc,EAAE,IAAI;AACnG,UAAM,QAAQ,SAAS,aAAa,IAAI,OAAO,KAAK,IAAI;AACxD,UAAM,SAAS,SAAS,aAAa,IAAI,QAAQ,KAAK,GAAG;AAGzD,UAAM,QAAa;AAAA,MACjB;AAAA,MACA,GAAG,UAAU;AAAA,MACb,WAAW;AAAA,IACb;AAEA,QAAI,YAAY,MAAM;AACpB,YAAM,UAAU,YAAY;AAAA,IAC9B;AAEA,QAAI,YAAY;AACd,YAAM,aAAa;AAAA,IACrB;AAEA,QAAI,MAAM;AACR,YAAM,OAAO;AAAA,IACf;AAEA,QAAI,WAAW;AACb,YAAM,YAAY;AAAA,IACpB;AAEA,QAAI,YAAY,MAAM;AACpB,YAAM,UAAU;AAAA,IAClB;AAEA,QAAI,QAAQ;AACV,YAAM,MAAM;AAAA,QACV,EAAE,YAAY,EAAE,QAAQ,IAAI,kBAAkB,MAAM,CAAC,IAAI,EAAE;AAAA,QAC3D,EAAE,cAAc,EAAE,QAAQ,IAAI,kBAAkB,MAAM,CAAC,IAAI,EAAE;AAAA,MAC/D;AAAA,IACF;AAIA,UAAM,gBAAgB,YAAY,OAAO,YAAY,SAAS;AAC9D,UAAM,cAAc,SAAS,OAAO,YAAY,IAAI;AACpD,UAAM,aAAa,oBAAoB,EAAE,IAAI,CAAC,OAAO,GAAG,UAAU;AAClE,UAAM,WAAW,WAAW,SAAS,IACjC,IAAI;AAAA,OAEA,MAAM,GAAG;AAAA,QACP;AAAA,QACA,EAAE,GAAG,OAAO,YAAY,EAAE,KAAK,WAAW,EAAE;AAAA,QAC5C,EAAE,QAAQ,CAAC,YAAY,EAAW;AAAA,MACpC,GACA,IAAI,CAAC,MAA0B,EAAE,UAAU;AAAA,IAC/C,IACA,oBAAI,IAAY;AAEpB,UAAM,WAAW,oBAAoB,EAClC,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,GAAG,UAAU,CAAC,EAC3C,OAAO,CAAC,OAAO;AAEd,UAAI,QAAQ,SAAS,WAAY,QAAO;AACxC,UAAI,aAAa,cAAc,YAAa,QAAO;AACnD,UAAI,YAAY,QAAQ,GAAG,YAAY,QAAS,QAAO;AACvD,UAAI,aAAa;AACf,cAAM,UACJ,GAAG,WAAW,YAAY,EAAE,SAAS,WAAW,KAChD,GAAG,aAAa,YAAY,EAAE,SAAS,WAAW;AACpD,YAAI,CAAC,QAAS,QAAO;AAAA,MACvB;AACA,UAAI,kBAAkB,QAAQ,GAAG,YAAY,cAAe,QAAO;AACnE,UAAI,cAAc,GAAG,eAAe,WAAY,QAAO;AACvD,aAAO;AAAA,IACT,CAAC,EACA,IAAI,CAAC,OAAO,gCAAgC,IAAI,QAAQ,GAAG,UAAU,EAAE,CAAC;AAE3E,UAAM,UAAU,MAAM,GAAG,MAAM,oBAAoB,KAAK;AACxD,UAAM,QAAQ,UAAU,SAAS;AAIjC,UAAM,gBAAgB,SAAS;AAC/B,UAAM,WAAW,gBAAgB,IAC7B,MAAM,GAAG,KAAK,oBAAoB,OAAO;AAAA,MACvC,SAAS,EAAE,cAAc,MAAM;AAAA,MAC/B,OAAO;AAAA,IACT,CAAC,IACD,CAAC;AAEL,UAAM,eAAe,SAAS,IAAI,2BAA2B;AAE7D,UAAM,SAAS,CAAC,GAAG,cAAc,GAAG,QAAQ,EAAE;AAAA,MAAK,CAAC,GAAG,MACrD,EAAE,aAAa,cAAc,EAAE,YAAY;AAAA,IAC7C;AAEA,UAAM,YAAY,OAAO,MAAM,QAAQ,SAAS,KAAK;AAErD,WAAO,aAAa,KAAK;AAAA,MACvB,MAAM;AAAA,MACN,YAAY;AAAA,QACV;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS,SAAS,QAAQ;AAAA,MAC5B;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,sCAAsC,EAAE,KAAK,MAAM,CAAC;AACjE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,sCAAsC;AAAA,MAC/C,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAOA,eAAsB,KAAK,SAAsB;AAC/C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,cAAc,KAAK;AAGjD,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,UAAM,gBAAgB,MAAM,YAAY;AAAA,MACtC,KAAK;AAAA,MACL,CAAC,8BAA8B;AAAA,MAC/B;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,2BAA2B;AAAA,QACpC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,OAAO,MAAM,QAAQ,KAAK;AAGhC,UAAM,aAAa,2CAA2C,UAAU,IAAI;AAC5E,QAAI,CAAC,WAAW,SAAS;AACvB,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO;AAAA,UACP,SAAS,oCAAoC,WAAW,KAAK;AAAA,QAC/D;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,QAA0C,WAAW;AAK3D,UAAM,iBAAiB,MAAM,WAAW,gBACpC,MAAM,aACN,EAAE,GAAG,MAAM,YAAY,eAAe,SAAkB;AAM5D,UAAM,WAAW,MAAM,GAAG,QAAQ,oBAAoB;AAAA,MACpD,YAAY,MAAM;AAAA,MAClB;AAAA,IACF,GAAG,EAAE,SAAS,EAAE,SAAS,OAAO,EAAE,CAAC;AAEnC,QAAI,UAAU;AACZ,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO,gCAAgC,MAAM,UAAU;AAAA,QACzD;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,kBAAkB,yBAAyB,MAAM,eAAe;AACtE,UAAM,eAAe,MAAM,6BAA6B,aAAa;AAAA,MACnE,QAAQ,KAAK;AAAA,MACb,OAAO,EAAE,UAAU,eAAe;AAAA,MAClC,WAAW;AAAA,MACX,SAAS,CAAC;AAAA,IACZ,CAAC;AACD,QAAI,cAAc;AAChB,aAAO,aAAa,KAAK,aAAa,MAAM,EAAE,QAAQ,aAAa,OAAO,CAAC;AAAA,IAC7E;AAaA,UAAM,aAAa,GAAG,OAAO,oBAAoB;AAAA,MAC/C,IAAI,WAAW;AAAA,MACf,YAAY,MAAM;AAAA,MAClB,cAAc,MAAM;AAAA,MACpB,aAAa,MAAM;AAAA,MACnB,SAAS,MAAM;AAAA,MACf,YAAY;AAAA,MACZ,UAAU,MAAM;AAAA,MAChB,SAAS,MAAM,WAAW;AAAA,MAC1B,iBAAiB,gBAAgB,SAAS,kBAAkB;AAAA,MAC5D;AAAA,MACA;AAAA,MACA,WAAW,KAAK;AAAA,MAChB,WAAW,KAAK;AAAA,MAChB,WAAW,oBAAI,KAAK;AAAA,MACpB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AAED,UAAM,gCAAgC,WAAW,UAAU;AAE3D,UAAM,GAAG,QAAQ,UAAU,EAAE,MAAM;AAKnC,QAAI,SAAU,wBAAuB,UAAU,kBAAkB,MAAS;AAE1E,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,MAAM,4BAA4B,UAAU;AAAA,QAC5C,SAAS;AAAA,MACX;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF,SAAS,OAAO;AACd,QAAI,kCAAkC,KAAK,GAAG;AAC5C,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,kDAAkD;AAAA,QAC3D,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,WAAO,MAAM,sCAAsC,EAAE,KAAK,MAAM,CAAC;AACjE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,uCAAuC;AAAA,MAChD,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,MAAM,CAAC,WAAW;AAAA,MAClB,OAAO,oCAAoC,KAAK,EAAE,YAAY,KAAK,CAAC,EAAE,OAAO;AAAA,QAC3E,SAAS,EAAE,QAAQ,EAAE,SAAS;AAAA,QAC9B,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,QAC5B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,SAAS;AAAA,QACxD,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,MACtD,CAAC;AAAA,MACD,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,MAAM;AAAA,cACJ;AAAA,gBACE,IAAI;AAAA,gBACJ,YAAY;AAAA,gBACZ,cAAc;AAAA,gBACd,aAAa;AAAA,gBACb,SAAS;AAAA,gBACT,YAAY;AAAA,kBACV,OAAO;AAAA,oBACL;AAAA,sBACE,QAAQ;AAAA,sBACR,UAAU;AAAA,sBACV,UAAU;AAAA,oBACZ;AAAA,oBACA;AAAA,sBACE,QAAQ;AAAA,sBACR,UAAU;AAAA,sBACV,UAAU;AAAA,oBACZ;AAAA,oBACA;AAAA,sBACE,QAAQ;AAAA,sBACR,UAAU;AAAA,sBACV,UAAU;AAAA,oBACZ;AAAA,kBACF;AAAA,kBACA,aAAa;AAAA,oBACX;AAAA,sBACE,cAAc;AAAA,sBACd,YAAY;AAAA,sBACZ,UAAU;AAAA,sBACV,SAAS;AAAA,oBACX;AAAA,oBACA;AAAA,sBACE,cAAc;AAAA,sBACd,YAAY;AAAA,sBACZ,UAAU;AAAA,sBACV,SAAS;AAAA,oBACX;AAAA,kBACF;AAAA,gBACF;AAAA,gBACA,SAAS;AAAA,gBACT,UAAU;AAAA,gBACV,gBAAgB;AAAA,gBAChB,WAAW;AAAA,gBACX,WAAW;AAAA,cACb;AAAA,YACF;AAAA,YACA,YAAY;AAAA,cACV,OAAO;AAAA,cACP,OAAO;AAAA,cACP,QAAQ;AAAA,cACR,SAAS;AAAA,YACX;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,MAAM,CAAC,WAAW;AAAA,MAClB,aAAa;AAAA,QACX,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,aAAa;AAAA,UACb,SAAS;AAAA,UACT,YAAY;AAAA,YACV,OAAO;AAAA,cACL;AAAA,gBACE,QAAQ;AAAA,gBACR,UAAU;AAAA,gBACV,UAAU;AAAA,cACZ;AAAA,cACA;AAAA,gBACE,QAAQ;AAAA,gBACR,UAAU;AAAA,gBACV,UAAU;AAAA,gBACV,aAAa;AAAA,cACf;AAAA,cACA;AAAA,gBACE,QAAQ;AAAA,gBACR,UAAU;AAAA,gBACV,UAAU;AAAA,gBACV,aAAa;AAAA,gBACb,aAAa;AAAA,kBACX,aAAa;AAAA,kBACb,WAAW;AAAA,gBACb;AAAA,cACF;AAAA,cACA;AAAA,gBACE,QAAQ;AAAA,gBACR,UAAU;AAAA,gBACV,UAAU;AAAA,cACZ;AAAA,YACF;AAAA,YACA,aAAa;AAAA,cACX;AAAA,gBACE,cAAc;AAAA,gBACd,YAAY;AAAA,gBACZ,UAAU;AAAA,gBACV,SAAS;AAAA,cACX;AAAA,cACA;AAAA,gBACE,cAAc;AAAA,gBACd,YAAY;AAAA,gBACZ,UAAU;AAAA,gBACV,SAAS;AAAA,cACX;AAAA,cACA;AAAA,gBACE,cAAc;AAAA,gBACd,YAAY;AAAA,gBACZ,UAAU;AAAA,gBACV,SAAS;AAAA,gBACT,YAAY;AAAA,kBACV;AAAA,oBACE,cAAc;AAAA,oBACd,cAAc;AAAA,oBACd,QAAQ;AAAA,sBACN,IAAI;AAAA,sBACJ,SAAS;AAAA,sBACT,UAAU;AAAA,oBACZ;AAAA,kBACF;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,UACA,SAAS;AAAA,QACX;AAAA,MACF;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,MAAM;AAAA,cACJ,IAAI;AAAA,cACJ,YAAY;AAAA,cACZ,cAAc;AAAA,cACd,aAAa;AAAA,cACb,SAAS;AAAA,cACT,YAAY;AAAA,gBACV,OAAO;AAAA,kBACL,EAAE,QAAQ,SAAS,UAAU,SAAS,UAAU,QAAQ;AAAA,kBACxD;AAAA,oBACE,QAAQ;AAAA,oBACR,UAAU;AAAA,oBACV,UAAU;AAAA,kBACZ;AAAA,kBACA;AAAA,oBACE,QAAQ;AAAA,oBACR,UAAU;AAAA,oBACV,UAAU;AAAA,kBACZ;AAAA,kBACA,EAAE,QAAQ,OAAO,UAAU,OAAO,UAAU,MAAM;AAAA,gBACpD;AAAA,gBACA,aAAa;AAAA,kBACX;AAAA,oBACE,cAAc;AAAA,oBACd,YAAY;AAAA,oBACZ,UAAU;AAAA,oBACV,SAAS;AAAA,kBACX;AAAA,kBACA;AAAA,oBACE,cAAc;AAAA,oBACd,YAAY;AAAA,oBACZ,UAAU;AAAA,oBACV,SAAS;AAAA,kBACX;AAAA,kBACA;AAAA,oBACE,cAAc;AAAA,oBACd,YAAY;AAAA,oBACZ,UAAU;AAAA,oBACV,SAAS;AAAA,kBACX;AAAA,gBACF;AAAA,cACF;AAAA,cACA,SAAS;AAAA,cACT,UAAU;AAAA,cACV,gBAAgB;AAAA,cAChB,WAAW;AAAA,cACX,WAAW;AAAA,YACb;AAAA,YACA,SAAS;AAAA,UACX;AAAA,QACF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,OAAO;AAAA,YACP,SAAS;AAAA,cACP;AAAA,gBACE,MAAM,CAAC,cAAc,OAAO;AAAA,gBAC5B,MAAM;AAAA,gBACN,SAAS;AAAA,cACX;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,OAAO;AAAA,UACT;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/workflows/api/definitions/serialize.js

@@ -15,10 +15,13 @@ function serializeWorkflowDefinition(definition) {
     definition: definition.definition,
     metadata: definition.metadata ?? null,
     enabled: definition.enabled,
+    kind: definition.kind,
+    lifecycle: definition.lifecycle,
     effectiveFrom: definition.effectiveFrom ?? null,
     effectiveTo: definition.effectiveTo ?? null,
     tenantId: definition.tenantId,
     organizationId: definition.organizationId,
+    grantedFeatures: definition.grantedFeatures ?? null,
     createdBy: definition.createdBy ?? null,
     updatedBy: definition.updatedBy ?? null,
     createdAt: definition.createdAt,
@@ -39,10 +42,16 @@ function serializeCodeWorkflowDefinition(codeDef, syntheticId) {
     definition: codeDef.definition,
     metadata: codeDef.metadata ?? null,
     enabled: codeDef.enabled,
+    // Code-based definitions are normal, published workflows (never components).
+    kind: "workflow",
+    lifecycle: "published",
     effectiveFrom: null,
     effectiveTo: null,
     tenantId: null,
     organizationId: null,
+    // Code-based definitions carry no execution grant: they are not editable
+    // rows, so there is nothing to authorise a grant against.
+    grantedFeatures: null,
     createdBy: null,
     updatedBy: null,
     createdAt: null,

package/dist/modules/workflows/api/definitions/serialize.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/workflows/api/definitions/serialize.ts"],
-  "sourcesContent": ["import type { WorkflowDefinition } from '../../data/entities'\nimport type { CodeWorkflowDefinition } from '@open-mercato/shared/modules/workflows'\nimport { getCodeWorkflow } from '../../lib/code-registry'\n\nexport type WorkflowDefinitionSource = 'code' | 'code_override' | 'user'\n\nfunction resolveSource(definition: WorkflowDefinition): WorkflowDefinitionSource {\n  if (definition.codeWorkflowId) return 'code_override'\n  return 'user'\n}\n\nexport function serializeWorkflowDefinition(definition: WorkflowDefinition) {\n  const source = resolveSource(definition)\n  const codeModuleId =\n    source === 'code_override' && definition.codeWorkflowId\n      ? getCodeWorkflow(definition.codeWorkflowId)?.moduleId ?? null\n      : null\n  return {\n    id: definition.id,\n    workflowId: definition.workflowId,\n    workflowName: definition.workflowName,\n    description: definition.description ?? null,\n    version: definition.version,\n    definition: definition.definition,\n    metadata: definition.metadata ?? null,\n    enabled: definition.enabled,\n    effectiveFrom: definition.effectiveFrom ?? null,\n    effectiveTo: definition.effectiveTo ?? null,\n    tenantId: definition.tenantId,\n    organizationId: definition.organizationId,\n    createdBy: definition.createdBy ?? null,\n    updatedBy: definition.updatedBy ?? null,\n    createdAt: definition.createdAt,\n    updatedAt: definition.updatedAt,\n    deletedAt: definition.deletedAt ?? null,\n    source,\n    isCodeBased: source === 'code' || source === 'code_override',\n    codeModuleId,\n  }\n}\n\nexport function serializeCodeWorkflowDefinition(codeDef: CodeWorkflowDefinition, syntheticId: string) {\n  return {\n    id: syntheticId,\n    workflowId: codeDef.workflowId,\n    workflowName: codeDef.workflowName,\n    description: codeDef.description ?? null,\n    version: codeDef.version,\n    definition: codeDef.definition,\n    metadata: codeDef.metadata ?? null,\n    enabled: codeDef.enabled,\n    effectiveFrom: null,\n    effectiveTo: null,\n    tenantId: null,\n    organizationId: null,\n    createdBy: null,\n    updatedBy: null,\n    createdAt: null,\n    updatedAt: null,\n    deletedAt: null,\n    source: 'code' as const,\n    isCodeBased: true,\n    codeModuleId: codeDef.moduleId,\n  }\n}\n"],
-  "mappings": "AAEA,SAAS,uBAAuB;AAIhC,SAAS,cAAc,YAA0D;AAC/E,MAAI,WAAW,eAAgB,QAAO;AACtC,SAAO;AACT;AAEO,SAAS,4BAA4B,YAAgC;AAC1E,QAAM,SAAS,cAAc,UAAU;AACvC,QAAM,eACJ,WAAW,mBAAmB,WAAW,iBACrC,gBAAgB,WAAW,cAAc,GAAG,YAAY,OACxD;AACN,SAAO;AAAA,IACL,IAAI,WAAW;AAAA,IACf,YAAY,WAAW;AAAA,IACvB,cAAc,WAAW;AAAA,IACzB,aAAa,WAAW,eAAe;AAAA,IACvC,SAAS,WAAW;AAAA,IACpB,YAAY,WAAW;AAAA,IACvB,UAAU,WAAW,YAAY;AAAA,IACjC,SAAS,WAAW;AAAA,IACpB,eAAe,WAAW,iBAAiB;AAAA,IAC3C,aAAa,WAAW,eAAe;AAAA,IACvC,UAAU,WAAW;AAAA,IACrB,gBAAgB,WAAW;AAAA,IAC3B,WAAW,WAAW,aAAa;AAAA,IACnC,WAAW,WAAW,aAAa;AAAA,IACnC,WAAW,WAAW;AAAA,IACtB,WAAW,WAAW;AAAA,IACtB,WAAW,WAAW,aAAa;AAAA,IACnC;AAAA,IACA,aAAa,WAAW,UAAU,WAAW;AAAA,IAC7C;AAAA,EACF;AACF;AAEO,SAAS,gCAAgC,SAAiC,aAAqB;AACpG,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,YAAY,QAAQ;AAAA,IACpB,cAAc,QAAQ;AAAA,IACtB,aAAa,QAAQ,eAAe;AAAA,IACpC,SAAS,QAAQ;AAAA,IACjB,YAAY,QAAQ;AAAA,IACpB,UAAU,QAAQ,YAAY;AAAA,IAC9B,SAAS,QAAQ;AAAA,IACjB,eAAe;AAAA,IACf,aAAa;AAAA,IACb,UAAU;AAAA,IACV,gBAAgB;AAAA,IAChB,WAAW;AAAA,IACX,WAAW;AAAA,IACX,WAAW;AAAA,IACX,WAAW;AAAA,IACX,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,cAAc,QAAQ;AAAA,EACxB;AACF;",
+  "sourcesContent": ["import type { WorkflowDefinition } from '../../data/entities'\nimport type { CodeWorkflowDefinition } from '@open-mercato/shared/modules/workflows'\nimport { getCodeWorkflow } from '../../lib/code-registry'\n\nexport type WorkflowDefinitionSource = 'code' | 'code_override' | 'user'\n\nfunction resolveSource(definition: WorkflowDefinition): WorkflowDefinitionSource {\n  if (definition.codeWorkflowId) return 'code_override'\n  return 'user'\n}\n\nexport function serializeWorkflowDefinition(definition: WorkflowDefinition) {\n  const source = resolveSource(definition)\n  const codeModuleId =\n    source === 'code_override' && definition.codeWorkflowId\n      ? getCodeWorkflow(definition.codeWorkflowId)?.moduleId ?? null\n      : null\n  return {\n    id: definition.id,\n    workflowId: definition.workflowId,\n    workflowName: definition.workflowName,\n    description: definition.description ?? null,\n    version: definition.version,\n    definition: definition.definition,\n    metadata: definition.metadata ?? null,\n    enabled: definition.enabled,\n    kind: definition.kind,\n    lifecycle: definition.lifecycle,\n    effectiveFrom: definition.effectiveFrom ?? null,\n    effectiveTo: definition.effectiveTo ?? null,\n    tenantId: definition.tenantId,\n    organizationId: definition.organizationId,\n    grantedFeatures: definition.grantedFeatures ?? null,\n    createdBy: definition.createdBy ?? null,\n    updatedBy: definition.updatedBy ?? null,\n    createdAt: definition.createdAt,\n    updatedAt: definition.updatedAt,\n    deletedAt: definition.deletedAt ?? null,\n    source,\n    isCodeBased: source === 'code' || source === 'code_override',\n    codeModuleId,\n  }\n}\n\nexport function serializeCodeWorkflowDefinition(codeDef: CodeWorkflowDefinition, syntheticId: string) {\n  return {\n    id: syntheticId,\n    workflowId: codeDef.workflowId,\n    workflowName: codeDef.workflowName,\n    description: codeDef.description ?? null,\n    version: codeDef.version,\n    definition: codeDef.definition,\n    metadata: codeDef.metadata ?? null,\n    enabled: codeDef.enabled,\n    // Code-based definitions are normal, published workflows (never components).\n    kind: 'workflow' as const,\n    lifecycle: 'published' as const,\n    effectiveFrom: null,\n    effectiveTo: null,\n    tenantId: null,\n    organizationId: null,\n    // Code-based definitions carry no execution grant: they are not editable\n    // rows, so there is nothing to authorise a grant against.\n    grantedFeatures: null,\n    createdBy: null,\n    updatedBy: null,\n    createdAt: null,\n    updatedAt: null,\n    deletedAt: null,\n    source: 'code' as const,\n    isCodeBased: true,\n    codeModuleId: codeDef.moduleId,\n  }\n}\n"],
+  "mappings": "AAEA,SAAS,uBAAuB;AAIhC,SAAS,cAAc,YAA0D;AAC/E,MAAI,WAAW,eAAgB,QAAO;AACtC,SAAO;AACT;AAEO,SAAS,4BAA4B,YAAgC;AAC1E,QAAM,SAAS,cAAc,UAAU;AACvC,QAAM,eACJ,WAAW,mBAAmB,WAAW,iBACrC,gBAAgB,WAAW,cAAc,GAAG,YAAY,OACxD;AACN,SAAO;AAAA,IACL,IAAI,WAAW;AAAA,IACf,YAAY,WAAW;AAAA,IACvB,cAAc,WAAW;AAAA,IACzB,aAAa,WAAW,eAAe;AAAA,IACvC,SAAS,WAAW;AAAA,IACpB,YAAY,WAAW;AAAA,IACvB,UAAU,WAAW,YAAY;AAAA,IACjC,SAAS,WAAW;AAAA,IACpB,MAAM,WAAW;AAAA,IACjB,WAAW,WAAW;AAAA,IACtB,eAAe,WAAW,iBAAiB;AAAA,IAC3C,aAAa,WAAW,eAAe;AAAA,IACvC,UAAU,WAAW;AAAA,IACrB,gBAAgB,WAAW;AAAA,IAC3B,iBAAiB,WAAW,mBAAmB;AAAA,IAC/C,WAAW,WAAW,aAAa;AAAA,IACnC,WAAW,WAAW,aAAa;AAAA,IACnC,WAAW,WAAW;AAAA,IACtB,WAAW,WAAW;AAAA,IACtB,WAAW,WAAW,aAAa;AAAA,IACnC;AAAA,IACA,aAAa,WAAW,UAAU,WAAW;AAAA,IAC7C;AAAA,EACF;AACF;AAEO,SAAS,gCAAgC,SAAiC,aAAqB;AACpG,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,YAAY,QAAQ;AAAA,IACpB,cAAc,QAAQ;AAAA,IACtB,aAAa,QAAQ,eAAe;AAAA,IACpC,SAAS,QAAQ;AAAA,IACjB,YAAY,QAAQ;AAAA,IACpB,UAAU,QAAQ,YAAY;AAAA,IAC9B,SAAS,QAAQ;AAAA;AAAA,IAEjB,MAAM;AAAA,IACN,WAAW;AAAA,IACX,eAAe;AAAA,IACf,aAAa;AAAA,IACb,UAAU;AAAA,IACV,gBAAgB;AAAA;AAAA;AAAA,IAGhB,iBAAiB;AAAA,IACjB,WAAW;AAAA,IACX,WAAW;AAAA,IACX,WAAW;AAAA,IACX,WAAW;AAAA,IACX,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,cAAc,QAAQ;AAAA,EACxB;AACF;",
   "names": []
 }

package/dist/modules/workflows/api/endpoints/route.js

@@ -0,0 +1,69 @@
+import { NextResponse } from "next/server";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { getWorkflowEndpointCatalog } from "../../lib/endpoint-catalog.js";
+import { workflowsTag, workflowErrorSchema, workflowEndpointListResponseSchema } from "../openapi.js";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+const logger = createLogger("workflows");
+const metadata = {
+  requireAuth: true,
+  requireFeatures: ["workflows.definitions.view"]
+};
+async function GET(request) {
+  try {
+    const container = await createRequestContainer();
+    const auth = await getAuthFromRequest(request);
+    if (!auth) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+    const scope = await resolveOrganizationScopeForRequest({ container, auth, request });
+    const tenantId = auth.tenantId;
+    const organizationId = scope?.selectedId ?? auth.orgId;
+    if (!tenantId) {
+      return NextResponse.json({ error: "Missing tenant context" }, { status: 400 });
+    }
+    const rbacService = container.resolve("rbacService");
+    const hasPermission = await rbacService.userHasAllFeatures(
+      auth.sub,
+      ["workflows.definitions.view"],
+      { tenantId, organizationId }
+    );
+    if (!hasPermission) {
+      return NextResponse.json({ error: "Insufficient permissions" }, { status: 403 });
+    }
+    const catalog = await getWorkflowEndpointCatalog();
+    return NextResponse.json({ items: catalog.items });
+  } catch (error) {
+    logger.error("Error listing workflow endpoint catalog", { err: error });
+    return NextResponse.json(
+      { error: "Failed to list workflow endpoint catalog" },
+      { status: 500 }
+    );
+  }
+}
+const openApi = {
+  tag: workflowsTag,
+  summary: "List the workflow endpoint catalog",
+  methods: {
+    GET: {
+      summary: "List endpoints available to CALL_API activities",
+      description: "Returns a trimmed projection of the OpenAPI surface (path, method, summary, tag, parameters, and declared request/response schemas) consumed by the CALL_API endpoint picker. Endpoints outside this catalog can still be authored as free text. Responses without a declared schema omit responseSchema so consumers degrade to unknown typing.",
+      responses: [
+        { status: 200, description: "Endpoint catalog projected from the OpenAPI surface", schema: workflowEndpointListResponseSchema }
+      ],
+      errors: [
+        { status: 400, description: "Missing tenant context", schema: workflowErrorSchema },
+        { status: 401, description: "Unauthorized", schema: workflowErrorSchema },
+        { status: 403, description: "Insufficient permissions", schema: workflowErrorSchema },
+        { status: 500, description: "Internal server error", schema: workflowErrorSchema }
+      ]
+    }
+  }
+};
+export {
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/workflows/api/endpoints/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/workflows/api/endpoints/route.ts"],
+  "sourcesContent": ["/**\n * Workflow Endpoint Catalog API (issue #4235)\n *\n * Endpoint:\n * - GET /api/workflows/endpoints - Trimmed index of the platform API surface for the CALL_API endpoint picker\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { getWorkflowEndpointCatalog } from '../../lib/endpoint-catalog'\nimport { workflowsTag, workflowErrorSchema, workflowEndpointListResponseSchema } from '../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.view'],\n}\n\n/**\n * GET /api/workflows/endpoints\n *\n * List the endpoint catalog projected from the in-process OpenAPI surface for\n * the CALL_API endpoint picker.\n */\nexport async function GET(request: NextRequest) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = scope?.selectedId ?? auth.orgId\n\n    if (!tenantId) {\n      return NextResponse.json({ error: 'Missing tenant context' }, { status: 400 })\n    }\n\n    const rbacService = container.resolve('rbacService')\n    const hasPermission = await rbacService.userHasAllFeatures(\n      auth.sub,\n      ['workflows.definitions.view'],\n      { tenantId, organizationId }\n    )\n\n    if (!hasPermission) {\n      return NextResponse.json({ error: 'Insufficient permissions' }, { status: 403 })\n    }\n\n    const catalog = await getWorkflowEndpointCatalog()\n\n    return NextResponse.json({ items: catalog.items })\n  } catch (error) {\n    logger.error('Error listing workflow endpoint catalog', { err: error })\n    return NextResponse.json(\n      { error: 'Failed to list workflow endpoint catalog' },\n      { status: 500 }\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'List the workflow endpoint catalog',\n  methods: {\n    GET: {\n      summary: 'List endpoints available to CALL_API activities',\n      description: 'Returns a trimmed projection of the OpenAPI surface (path, method, summary, tag, parameters, and declared request/response schemas) consumed by the CALL_API endpoint picker. Endpoints outside this catalog can still be authored as free text. Responses without a declared schema omit responseSchema so consumers degrade to unknown typing.',\n      responses: [\n        { status: 200, description: 'Endpoint catalog projected from the OpenAPI surface', schema: workflowEndpointListResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing tenant context', schema: workflowErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: workflowErrorSchema },\n        { status: 403, description: 'Insufficient permissions', schema: workflowErrorSchema },\n        { status: 500, description: 'Internal server error', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAOA,SAAsB,oBAAoB;AAE1C,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,kCAAkC;AAC3C,SAAS,cAAc,qBAAqB,0CAA0C;AACtF,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,4BAA4B;AAChD;AAQA,eAAsB,IAAI,SAAsB;AAC9C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,cAAc,KAAK;AAEjD,QAAI,CAAC,UAAU;AACb,aAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/E;AAEA,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,UAAM,gBAAgB,MAAM,YAAY;AAAA,MACtC,KAAK;AAAA,MACL,CAAC,4BAA4B;AAAA,MAC7B,EAAE,UAAU,eAAe;AAAA,IAC7B;AAEA,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjF;AAEA,UAAM,UAAU,MAAM,2BAA2B;AAEjD,WAAO,aAAa,KAAK,EAAE,OAAO,QAAQ,MAAM,CAAC;AAAA,EACnD,SAAS,OAAO;AACd,WAAO,MAAM,2CAA2C,EAAE,KAAK,MAAM,CAAC;AACtE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,2CAA2C;AAAA,MACpD,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,uDAAuD,QAAQ,mCAAmC;AAAA,MAChI;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,oBAAoB;AAAA,QAClF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/workflows/api/functions/route.js

@@ -0,0 +1,73 @@
+import { NextResponse } from "next/server";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { listWorkflowFunctions } from "../../lib/workflow-function-registry.js";
+import { workflowsTag, workflowErrorSchema, workflowFunctionListResponseSchema } from "../openapi.js";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+const logger = createLogger("workflows");
+const metadata = {
+  requireAuth: true,
+  requireFeatures: ["workflows.definitions.edit"]
+};
+async function GET(request) {
+  try {
+    const container = await createRequestContainer();
+    const auth = await getAuthFromRequest(request);
+    if (!auth) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+    const scope = await resolveOrganizationScopeForRequest({ container, auth, request });
+    const tenantId = auth.tenantId;
+    const organizationId = scope?.selectedId ?? auth.orgId;
+    if (!tenantId) {
+      return NextResponse.json({ error: "Missing tenant context" }, { status: 400 });
+    }
+    const rbacService = container.resolve("rbacService");
+    const hasPermission = await rbacService.userHasAllFeatures(
+      auth.sub,
+      ["workflows.definitions.edit"],
+      { tenantId, organizationId }
+    );
+    if (!hasPermission) {
+      return NextResponse.json({ error: "Insufficient permissions" }, { status: 403 });
+    }
+    const items = listWorkflowFunctions().map((definition) => ({
+      name: definition.name,
+      ...definition.labelKey ? { labelKey: definition.labelKey } : {},
+      ...definition.description ? { description: definition.description } : {}
+    }));
+    return NextResponse.json({ items });
+  } catch (error) {
+    logger.error("Error listing workflow functions", { err: error });
+    return NextResponse.json(
+      { error: "Failed to list workflow functions" },
+      { status: 500 }
+    );
+  }
+}
+const openApi = {
+  tag: workflowsTag,
+  summary: "List workflow functions",
+  methods: {
+    GET: {
+      summary: "List registered workflow function descriptors for EXECUTE_FUNCTION activities",
+      description: "Returns the registered workflow function descriptors consumed by the EXECUTE_FUNCTION function picker. Functions outside this list can still be authored but fail at runtime when no matching workflowFunction:<name> DI registration exists.",
+      responses: [
+        { status: 200, description: "Registered workflow function descriptors", schema: workflowFunctionListResponseSchema }
+      ],
+      errors: [
+        { status: 400, description: "Missing tenant context", schema: workflowErrorSchema },
+        { status: 401, description: "Unauthorized", schema: workflowErrorSchema },
+        { status: 403, description: "Insufficient permissions", schema: workflowErrorSchema },
+        { status: 500, description: "Internal server error", schema: workflowErrorSchema }
+      ]
+    }
+  }
+};
+export {
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/workflows/api/functions/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/workflows/api/functions/route.ts"],
+  "sourcesContent": ["/**\n * Workflow Functions API\n *\n * Endpoint:\n * - GET /api/workflows/functions - List registered workflow function descriptors for EXECUTE_FUNCTION activities\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { listWorkflowFunctions } from '../../lib/workflow-function-registry'\nimport { workflowsTag, workflowErrorSchema, workflowFunctionListResponseSchema } from '../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.edit'],\n}\n\n/**\n * GET /api/workflows/functions\n *\n * List the registered workflow function descriptors for the EXECUTE_FUNCTION function picker.\n */\nexport async function GET(request: NextRequest) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = scope?.selectedId ?? auth.orgId\n\n    if (!tenantId) {\n      return NextResponse.json({ error: 'Missing tenant context' }, { status: 400 })\n    }\n\n    const rbacService = container.resolve('rbacService')\n    const hasPermission = await rbacService.userHasAllFeatures(\n      auth.sub,\n      ['workflows.definitions.edit'],\n      { tenantId, organizationId }\n    )\n\n    if (!hasPermission) {\n      return NextResponse.json({ error: 'Insufficient permissions' }, { status: 403 })\n    }\n\n    const items = listWorkflowFunctions().map((definition) => ({\n      name: definition.name,\n      ...(definition.labelKey ? { labelKey: definition.labelKey } : {}),\n      ...(definition.description ? { description: definition.description } : {}),\n    }))\n\n    return NextResponse.json({ items })\n  } catch (error) {\n    logger.error('Error listing workflow functions', { err: error })\n    return NextResponse.json(\n      { error: 'Failed to list workflow functions' },\n      { status: 500 }\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'List workflow functions',\n  methods: {\n    GET: {\n      summary: 'List registered workflow function descriptors for EXECUTE_FUNCTION activities',\n      description: 'Returns the registered workflow function descriptors consumed by the EXECUTE_FUNCTION function picker. Functions outside this list can still be authored but fail at runtime when no matching workflowFunction:<name> DI registration exists.',\n      responses: [\n        { status: 200, description: 'Registered workflow function descriptors', schema: workflowFunctionListResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing tenant context', schema: workflowErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: workflowErrorSchema },\n        { status: 403, description: 'Insufficient permissions', schema: workflowErrorSchema },\n        { status: 500, description: 'Internal server error', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAOA,SAAsB,oBAAoB;AAE1C,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,6BAA6B;AACtC,SAAS,cAAc,qBAAqB,0CAA0C;AACtF,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,4BAA4B;AAChD;AAOA,eAAsB,IAAI,SAAsB;AAC9C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,cAAc,KAAK;AAEjD,QAAI,CAAC,UAAU;AACb,aAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/E;AAEA,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,UAAM,gBAAgB,MAAM,YAAY;AAAA,MACtC,KAAK;AAAA,MACL,CAAC,4BAA4B;AAAA,MAC7B,EAAE,UAAU,eAAe;AAAA,IAC7B;AAEA,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjF;AAEA,UAAM,QAAQ,sBAAsB,EAAE,IAAI,CAAC,gBAAgB;AAAA,MACzD,MAAM,WAAW;AAAA,MACjB,GAAI,WAAW,WAAW,EAAE,UAAU,WAAW,SAAS,IAAI,CAAC;AAAA,MAC/D,GAAI,WAAW,cAAc,EAAE,aAAa,WAAW,YAAY,IAAI,CAAC;AAAA,IAC1E,EAAE;AAEF,WAAO,aAAa,KAAK,EAAE,MAAM,CAAC;AAAA,EACpC,SAAS,OAAO;AACd,WAAO,MAAM,oCAAoC,EAAE,KAAK,MAAM,CAAC;AAC/D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,oCAAoC;AAAA,MAC7C,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,4CAA4C,QAAQ,mCAAmC;AAAA,MACrH;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,oBAAoB;AAAA,QAClF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/workflows/api/grantable-features/route.js

@@ -0,0 +1,75 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { getModules } from "@open-mercato/shared/lib/i18n/server";
+import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { hasFeature } from "@open-mercato/shared/security/features";
+import { WORKFLOW_GRANT_FEATURE } from "../../lib/definition-grant.js";
+const metadata = {
+  GET: { requireAuth: true, requireFeatures: [WORKFLOW_GRANT_FEATURE] }
+};
+const grantableFeatureSchema = z.object({
+  id: z.string(),
+  title: z.string(),
+  module: z.string()
+});
+async function GET(request) {
+  const auth = await getAuthFromRequest(request);
+  if (!auth) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  const container = await createRequestContainer();
+  const scope = await resolveOrganizationScopeForRequest({ container, auth, request });
+  const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+  const tenantId = auth.tenantId ?? null;
+  const rbacService = container.resolve("rbacService");
+  const granted = rbacService.getGrantedFeatures ? await rbacService.getGrantedFeatures(auth.sub, { tenantId, organizationId }) : [];
+  const byId = /* @__PURE__ */ new Map();
+  for (const mod of getModules() || []) {
+    const features = mod.features || [];
+    for (const feature of features) {
+      const id = typeof feature.id === "string" ? feature.id.trim() : "";
+      if (!id || byId.has(id)) continue;
+      if (!hasFeature(granted, id)) continue;
+      byId.set(id, {
+        id,
+        title: typeof feature.title === "string" && feature.title ? feature.title : id,
+        module: typeof feature.module === "string" && feature.module ? feature.module : String(mod.id ?? "")
+      });
+    }
+  }
+  const items = Array.from(byId.values()).sort(
+    (a, b) => a.module.localeCompare(b.module) || a.id.localeCompare(b.id)
+  );
+  return NextResponse.json({ items });
+}
+const openApi = {
+  tag: "Workflows",
+  summary: "List the ACL features the caller may grant to a workflow definition",
+  methods: {
+    GET: {
+      summary: "List grantable execution features",
+      description: "Declared ACL feature ids/titles intersected with the calling user\u2019s own current grants (wildcard-aware). Drives the definition editor\u2019s execution-permissions picker; gated by workflows.definitions.grant_features.",
+      responses: [
+        {
+          status: 200,
+          description: "Grantable feature catalog",
+          schema: z.object({ items: z.array(grantableFeatureSchema) })
+        }
+      ],
+      errors: [
+        { status: 401, description: "Unauthorized", schema: z.object({ error: z.string() }) },
+        {
+          status: 403,
+          description: "Missing workflows.definitions.grant_features",
+          schema: z.object({ error: z.string() })
+        }
+      ]
+    }
+  }
+};
+export {
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/workflows/api/grantable-features/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/workflows/api/grantable-features/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { getModules } from '@open-mercato/shared/lib/i18n/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { hasFeature } from '@open-mercato/shared/security/features'\nimport { WORKFLOW_GRANT_FEATURE } from '../../lib/definition-grant'\n\n/**\n * The vocabulary a workflow author may put into a definition's execution grant.\n *\n * Unlike `auth`'s catalog (gated `auth.acl.manage`) and `agent_orchestrator`'s\n * (which lists every declared feature), this one is INTERSECTED with the\n * caller's own current grants: the save-time rule is that a grant can never\n * exceed the granting user's features, so offering ids that would be refused on\n * save would only produce checkboxes that fail. Ids + titles only \u2014 no role or\n * grant data for anyone else leaks through.\n */\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: [WORKFLOW_GRANT_FEATURE] },\n}\n\ntype GrantableFeature = { id: string; title: string; module: string }\n\nconst grantableFeatureSchema = z.object({\n  id: z.string(),\n  title: z.string(),\n  module: z.string(),\n})\n\ntype RbacServiceLike = {\n  getGrantedFeatures?: (\n    userId: string,\n    scope: { tenantId: string | null; organizationId: string | null },\n  ) => Promise<string[]>\n}\n\nexport async function GET(request: Request) {\n  const auth = await getAuthFromRequest(request)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const container = await createRequestContainer()\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n  const organizationId = scope?.selectedId ?? auth.orgId ?? null\n  const tenantId = auth.tenantId ?? null\n\n  const rbacService = container.resolve('rbacService') as RbacServiceLike\n  const granted = rbacService.getGrantedFeatures\n    ? await rbacService.getGrantedFeatures(auth.sub, { tenantId, organizationId })\n    : []\n\n  const byId = new Map<string, GrantableFeature>()\n  for (const mod of getModules() || []) {\n    const features = (mod as { features?: Array<Record<string, unknown>> }).features || []\n    for (const feature of features) {\n      const id = typeof feature.id === 'string' ? feature.id.trim() : ''\n      if (!id || byId.has(id)) continue\n      // Wildcard-aware: an author holding `catalog.*` may grant every concrete\n      // `catalog.\u2026` id. Never an exact-string check.\n      if (!hasFeature(granted, id)) continue\n      byId.set(id, {\n        id,\n        title: typeof feature.title === 'string' && feature.title ? feature.title : id,\n        module: typeof feature.module === 'string' && feature.module ? feature.module : String(mod.id ?? ''),\n      })\n    }\n  }\n\n  const items = Array.from(byId.values()).sort(\n    (a, b) => a.module.localeCompare(b.module) || a.id.localeCompare(b.id),\n  )\n  return NextResponse.json({ items })\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Workflows',\n  summary: 'List the ACL features the caller may grant to a workflow definition',\n  methods: {\n    GET: {\n      summary: 'List grantable execution features',\n      description:\n        'Declared ACL feature ids/titles intersected with the calling user\u2019s own current grants (wildcard-aware). Drives the definition editor\u2019s execution-permissions picker; gated by workflows.definitions.grant_features.',\n      responses: [\n        {\n          status: 200,\n          description: 'Grantable feature catalog',\n          schema: z.object({ items: z.array(grantableFeatureSchema) }),\n        },\n      ],\n      errors: [\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        {\n          status: 403,\n          description: 'Missing workflows.definitions.grant_features',\n          schema: z.object({ error: z.string() }),\n        },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,kBAAkB;AAC3B,SAAS,0CAA0C;AACnD,SAAS,kBAAkB;AAC3B,SAAS,8BAA8B;AAYhC,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACtE;AAIA,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,IAAI,EAAE,OAAO;AAAA,EACb,OAAO,EAAE,OAAO;AAAA,EAChB,QAAQ,EAAE,OAAO;AACnB,CAAC;AASD,eAAsB,IAAI,SAAkB;AAC1C,QAAM,OAAO,MAAM,mBAAmB,OAAO;AAC7C,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,QAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAM,WAAW,KAAK,YAAY;AAElC,QAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,QAAM,UAAU,YAAY,qBACxB,MAAM,YAAY,mBAAmB,KAAK,KAAK,EAAE,UAAU,eAAe,CAAC,IAC3E,CAAC;AAEL,QAAM,OAAO,oBAAI,IAA8B;AAC/C,aAAW,OAAO,WAAW,KAAK,CAAC,GAAG;AACpC,UAAM,WAAY,IAAsD,YAAY,CAAC;AACrF,eAAW,WAAW,UAAU;AAC9B,YAAM,KAAK,OAAO,QAAQ,OAAO,WAAW,QAAQ,GAAG,KAAK,IAAI;AAChE,UAAI,CAAC,MAAM,KAAK,IAAI,EAAE,EAAG;AAGzB,UAAI,CAAC,WAAW,SAAS,EAAE,EAAG;AAC9B,WAAK,IAAI,IAAI;AAAA,QACX;AAAA,QACA,OAAO,OAAO,QAAQ,UAAU,YAAY,QAAQ,QAAQ,QAAQ,QAAQ;AAAA,QAC5E,QAAQ,OAAO,QAAQ,WAAW,YAAY,QAAQ,SAAS,QAAQ,SAAS,OAAO,IAAI,MAAM,EAAE;AAAA,MACrG,CAAC;AAAA,IACH;AAAA,EACF;AAEA,QAAM,QAAQ,MAAM,KAAK,KAAK,OAAO,CAAC,EAAE;AAAA,IACtC,CAAC,GAAG,MAAM,EAAE,OAAO,cAAc,EAAE,MAAM,KAAK,EAAE,GAAG,cAAc,EAAE,EAAE;AAAA,EACvE;AACA,SAAO,aAAa,KAAK,EAAE,MAAM,CAAC;AACpC;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,EAAE,CAAC;AAAA,QAC7D;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}