@open-mercato/core 0.7.1-develop.7193.1.910a5b0a1e → 0.7.1-develop.7195.1.b5efd1d51a

package/dist/modules/workflows/api/rule-usage/route.js

@@ -0,0 +1,80 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { countReferencingWorkflows, findBusinessRuleUsage } from "../../lib/business-rule-usage.js";
+const logger = createLogger("workflows").child({ component: "rule-usage-api" });
+const metadata = {
+  requireAuth: true,
+  requireFeatures: ["workflows.definitions.view"]
+};
+const querySchema = z.object({
+  ruleId: z.string().min(1).max(50)
+});
+async function GET(request) {
+  try {
+    const auth = await getAuthFromRequest(request);
+    if (!auth) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+    const url = new URL(request.url);
+    const parsed = querySchema.safeParse({ ruleId: url.searchParams.get("ruleId") || void 0 });
+    if (!parsed.success) {
+      return NextResponse.json({ error: "Invalid query parameters" }, { status: 400 });
+    }
+    const container = await createRequestContainer();
+    const em = container.resolve("em");
+    const scope = await resolveOrganizationScopeForRequest({ container, auth, request });
+    const tenantId = auth.tenantId;
+    const organizationId = scope?.selectedId ?? auth.orgId;
+    if (!tenantId || !organizationId) {
+      return NextResponse.json({ error: "Missing tenant or organization context" }, { status: 400 });
+    }
+    const references = await findBusinessRuleUsage(em, {
+      ruleId: parsed.data.ruleId,
+      tenantId,
+      organizationId
+    });
+    return NextResponse.json({
+      ruleId: parsed.data.ruleId,
+      workflowCount: countReferencingWorkflows(references),
+      references
+    });
+  } catch (error) {
+    logger.error("Failed to resolve business rule usage", { err: error });
+    return NextResponse.json({ error: "Failed to resolve business rule usage" }, { status: 500 });
+  }
+}
+const openApi = {
+  methods: {
+    GET: {
+      summary: "List workflows referencing a business rule",
+      description: "Returns the workflow definitions whose START pre-conditions or transition pre/post-conditions reference the given business rule.",
+      tags: ["Workflows"],
+      query: querySchema,
+      responses: [
+        {
+          status: 200,
+          description: "Usage references",
+          example: {
+            ruleId: "ORDER_ABOVE_LIMIT",
+            workflowCount: 1,
+            references: [
+              { workflowId: "order-approval", version: 2, kind: "transitionPreCondition", locationId: "e_start_review" }
+            ]
+          }
+        },
+        { status: 400, description: "Invalid query parameters", example: { error: "Invalid query parameters" } },
+        { status: 401, description: "Unauthorized", example: { error: "Unauthorized" } }
+      ]
+    }
+  }
+};
+export {
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/workflows/api/rule-usage/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/workflows/api/rule-usage/route.ts"],
+  "sourcesContent": ["/**\n * Business Rule Usage in Workflows (dependency visibility)\n *\n * GET /api/workflows/rule-usage?ruleId=<business rule id>\n *\n * Backs the \"used by: N workflows\" panel the Studio renders beside the inline\n * business-rule editor. It lives in workflows \u2014 not business_rules \u2014 so the\n * upstream module never learns about its consumers.\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { countReferencingWorkflows, findBusinessRuleUsage } from '../../lib/business-rule-usage'\n\nconst logger = createLogger('workflows').child({ component: 'rule-usage-api' })\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.view'],\n}\n\nconst querySchema = z.object({\n  ruleId: z.string().min(1).max(50),\n})\n\nexport async function GET(request: NextRequest) {\n  try {\n    const auth = await getAuthFromRequest(request)\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const url = new URL(request.url)\n    const parsed = querySchema.safeParse({ ruleId: url.searchParams.get('ruleId') || undefined })\n    if (!parsed.success) {\n      return NextResponse.json({ error: 'Invalid query parameters' }, { status: 400 })\n    }\n\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = scope?.selectedId ?? auth.orgId\n\n    if (!tenantId || !organizationId) {\n      return NextResponse.json({ error: 'Missing tenant or organization context' }, { status: 400 })\n    }\n\n    const references = await findBusinessRuleUsage(em, {\n      ruleId: parsed.data.ruleId,\n      tenantId,\n      organizationId,\n    })\n\n    return NextResponse.json({\n      ruleId: parsed.data.ruleId,\n      workflowCount: countReferencingWorkflows(references),\n      references,\n    })\n  } catch (error) {\n    logger.error('Failed to resolve business rule usage', { err: error })\n    return NextResponse.json({ error: 'Failed to resolve business rule usage' }, { status: 500 })\n  }\n}\n\nexport const openApi = {\n  methods: {\n    GET: {\n      summary: 'List workflows referencing a business rule',\n      description: 'Returns the workflow definitions whose START pre-conditions or transition pre/post-conditions reference the given business rule.',\n      tags: ['Workflows'],\n      query: querySchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Usage references',\n          example: {\n            ruleId: 'ORDER_ABOVE_LIMIT',\n            workflowCount: 1,\n            references: [\n              { workflowId: 'order-approval', version: 2, kind: 'transitionPreCondition', locationId: 'e_start_review' },\n            ],\n          },\n        },\n        { status: 400, description: 'Invalid query parameters', example: { error: 'Invalid query parameters' } },\n        { status: 401, description: 'Unauthorized', example: { error: 'Unauthorized' } },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAUA,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B,6BAA6B;AAEjE,MAAM,SAAS,aAAa,WAAW,EAAE,MAAM,EAAE,WAAW,iBAAiB,CAAC;AAEvE,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,4BAA4B;AAChD;AAEA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAClC,CAAC;AAED,eAAsB,IAAI,SAAsB;AAC9C,MAAI;AACF,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAC7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,SAAS,YAAY,UAAU,EAAE,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK,OAAU,CAAC;AAC5F,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjF;AAEA,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,cAAc,KAAK;AAEjD,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,aAAO,aAAa,KAAK,EAAE,OAAO,yCAAyC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/F;AAEA,UAAM,aAAa,MAAM,sBAAsB,IAAI;AAAA,MACjD,QAAQ,OAAO,KAAK;AAAA,MACpB;AAAA,MACA;AAAA,IACF,CAAC;AAED,WAAO,aAAa,KAAK;AAAA,MACvB,QAAQ,OAAO,KAAK;AAAA,MACpB,eAAe,0BAA0B,UAAU;AAAA,MACnD;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,yCAAyC,EAAE,KAAK,MAAM,CAAC;AACpE,WAAO,aAAa,KAAK,EAAE,OAAO,wCAAwC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9F;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,MAAM,CAAC,WAAW;AAAA,MAClB,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,SAAS;AAAA,YACP,QAAQ;AAAA,YACR,eAAe;AAAA,YACf,YAAY;AAAA,cACV,EAAE,YAAY,kBAAkB,SAAS,GAAG,MAAM,0BAA0B,YAAY,iBAAiB;AAAA,YAC3G;AAAA,UACF;AAAA,QACF;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,4BAA4B,SAAS,EAAE,OAAO,2BAA2B,EAAE;AAAA,QACvG,EAAE,QAAQ,KAAK,aAAa,gBAAgB,SAAS,EAAE,OAAO,eAAe,EAAE;AAAA,MACjF;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/workflows/api/task-settings/route.js

@@ -0,0 +1,107 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import {
+  readTaskPermissionsBusinessContext,
+  writeTaskPermissionsBusinessContext
+} from "../../lib/task-permission-settings.js";
+import { workflowsTag, workflowErrorSchema } from "../openapi.js";
+const metadata = {
+  // Reading the tenant's task-permission posture is administration, not one's
+  // own work — the predicate reads the setting server-side for everyone else.
+  GET: { requireAuth: true, requireFeatures: ["workflows.tasks.view_all"] },
+  // Writing it is an administrative mutation that is not a reassignment.
+  PUT: { requireAuth: true, requireFeatures: ["workflows.tasks.manage"] }
+};
+const settingsResponseSchema = z.object({
+  taskPermissionsBusinessContext: z.boolean()
+});
+const putBodySchema = z.object({
+  taskPermissionsBusinessContext: z.boolean()
+});
+const putResponseSchema = settingsResponseSchema.extend({ ok: z.boolean() });
+async function resolveModuleConfigService() {
+  try {
+    const { resolve } = await createRequestContainer();
+    return resolve("moduleConfigService");
+  } catch {
+    return null;
+  }
+}
+async function GET(request) {
+  const auth = await getAuthFromRequest(request);
+  if (!auth || !auth.tenantId) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+  const moduleConfigService = await resolveModuleConfigService();
+  const taskPermissionsBusinessContext = await readTaskPermissionsBusinessContext(
+    moduleConfigService,
+    auth.tenantId
+  );
+  return NextResponse.json({ taskPermissionsBusinessContext });
+}
+async function PUT(request) {
+  const auth = await getAuthFromRequest(request);
+  if (!auth || !auth.tenantId) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+  let body;
+  try {
+    body = await request.json();
+  } catch {
+    return NextResponse.json({ error: "Invalid JSON" }, { status: 400 });
+  }
+  const parsed = putBodySchema.safeParse(body);
+  if (!parsed.success) {
+    return NextResponse.json(
+      { error: "Validation failed", details: parsed.error.flatten() },
+      { status: 400 }
+    );
+  }
+  const moduleConfigService = await resolveModuleConfigService();
+  if (!moduleConfigService) {
+    return NextResponse.json({ error: "Settings storage unavailable" }, { status: 503 });
+  }
+  await writeTaskPermissionsBusinessContext(
+    moduleConfigService,
+    auth.tenantId,
+    parsed.data.taskPermissionsBusinessContext
+  );
+  return NextResponse.json({
+    ok: true,
+    taskPermissionsBusinessContext: parsed.data.taskPermissionsBusinessContext
+  });
+}
+const openApi = {
+  tag: workflowsTag,
+  summary: "Tenant task-permission settings",
+  methods: {
+    GET: {
+      summary: "Get tenant task-permission settings",
+      description: "Returns whether the business-context task-permission model (spec \xA76.4) is enabled for the tenant. Defaults to true.",
+      responses: [
+        { status: 200, description: "Current settings", schema: settingsResponseSchema },
+        { status: 401, description: "Missing authentication", schema: workflowErrorSchema }
+      ]
+    },
+    PUT: {
+      summary: "Update tenant task-permission settings",
+      description: "Sets the tenant-scoped opt-out. Setting it to false restores the pre-6.4 READ filter on the task list, task detail and work inbox; it never affects claiming, completing, tenant/organization scoping or the portal task routes.",
+      requestBody: { schema: putBodySchema },
+      responses: [
+        { status: 200, description: "Updated settings", schema: putResponseSchema },
+        { status: 400, description: "Invalid payload", schema: workflowErrorSchema },
+        { status: 401, description: "Missing authentication", schema: workflowErrorSchema },
+        { status: 503, description: "Settings storage unavailable", schema: workflowErrorSchema }
+      ]
+    }
+  }
+};
+export {
+  GET,
+  PUT,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/workflows/api/task-settings/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/workflows/api/task-settings/route.ts"],
+  "sourcesContent": ["/**\n * Tenant task-permission settings (spec \u00A76.4, design \u00A76).\n *\n * - GET  /api/workflows/task-settings \u2014 read the opt-out\n * - PUT  /api/workflows/task-settings \u2014 write it\n *\n * A new route, which BACKWARD_COMPATIBILITY.md \u00A77 allows freely, and the bridge\n * that discharges the deprecation protocol's \"keep the old behaviour alongside\n * the new one for at least one minor version\" for the \u00A76.4 visibility change.\n *\n * Shape copied field-for-field from `entities/api/entity-settings.ts` with one\n * deliberate inversion: the read defaults to `true` (the NEW, narrower model)\n * on failure rather than to the permissive value. See\n * `lib/task-permission-settings.ts`.\n *\n * `tenantId` always comes from the authenticated context and never from the\n * request body \u2014 a settings write that accepted a tenant id would be a\n * cross-tenant write primitive.\n */\n\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  readTaskPermissionsBusinessContext,\n  writeTaskPermissionsBusinessContext,\n  type TaskPermissionsConfigService,\n} from '../../lib/task-permission-settings'\nimport { workflowsTag, workflowErrorSchema } from '../openapi'\n\nexport const metadata = {\n  // Reading the tenant's task-permission posture is administration, not one's\n  // own work \u2014 the predicate reads the setting server-side for everyone else.\n  GET: { requireAuth: true, requireFeatures: ['workflows.tasks.view_all'] },\n  // Writing it is an administrative mutation that is not a reassignment.\n  PUT: { requireAuth: true, requireFeatures: ['workflows.tasks.manage'] },\n}\n\nconst settingsResponseSchema = z.object({\n  taskPermissionsBusinessContext: z.boolean(),\n})\n\nconst putBodySchema = z.object({\n  taskPermissionsBusinessContext: z.boolean(),\n})\n\nconst putResponseSchema = settingsResponseSchema.extend({ ok: z.boolean() })\n\nasync function resolveModuleConfigService(): Promise<TaskPermissionsConfigService | null> {\n  try {\n    const { resolve } = await createRequestContainer()\n    return resolve('moduleConfigService') as TaskPermissionsConfigService\n  } catch {\n    // Fails to the default, which is the NEW model \u2014 never the permissive one.\n    return null\n  }\n}\n\nexport async function GET(request: Request) {\n  const auth = await getAuthFromRequest(request)\n  if (!auth || !auth.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const moduleConfigService = await resolveModuleConfigService()\n  const taskPermissionsBusinessContext = await readTaskPermissionsBusinessContext(\n    moduleConfigService,\n    auth.tenantId,\n  )\n  return NextResponse.json({ taskPermissionsBusinessContext })\n}\n\nexport async function PUT(request: Request) {\n  const auth = await getAuthFromRequest(request)\n  if (!auth || !auth.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  let body: unknown\n  try {\n    body = await request.json()\n  } catch {\n    return NextResponse.json({ error: 'Invalid JSON' }, { status: 400 })\n  }\n\n  const parsed = putBodySchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json(\n      { error: 'Validation failed', details: parsed.error.flatten() },\n      { status: 400 },\n    )\n  }\n\n  const moduleConfigService = await resolveModuleConfigService()\n  if (!moduleConfigService) {\n    return NextResponse.json({ error: 'Settings storage unavailable' }, { status: 503 })\n  }\n\n  await writeTaskPermissionsBusinessContext(\n    moduleConfigService,\n    auth.tenantId,\n    parsed.data.taskPermissionsBusinessContext,\n  )\n\n  return NextResponse.json({\n    ok: true,\n    taskPermissionsBusinessContext: parsed.data.taskPermissionsBusinessContext,\n  })\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'Tenant task-permission settings',\n  methods: {\n    GET: {\n      summary: 'Get tenant task-permission settings',\n      description:\n        'Returns whether the business-context task-permission model (spec \u00A76.4) is enabled for the tenant. Defaults to true.',\n      responses: [\n        { status: 200, description: 'Current settings', schema: settingsResponseSchema },\n        { status: 401, description: 'Missing authentication', schema: workflowErrorSchema },\n      ],\n    },\n    PUT: {\n      summary: 'Update tenant task-permission settings',\n      description:\n        'Sets the tenant-scoped opt-out. Setting it to false restores the pre-6.4 READ filter on the task list, task detail and work inbox; it never affects claiming, completing, tenant/organization scoping or the portal task routes.',\n      requestBody: { schema: putBodySchema },\n      responses: [\n        { status: 200, description: 'Updated settings', schema: putResponseSchema },\n        { status: 400, description: 'Invalid payload', schema: workflowErrorSchema },\n        { status: 401, description: 'Missing authentication', schema: workflowErrorSchema },\n        { status: 503, description: 'Settings storage unavailable', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAoBA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAEvC;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP,SAAS,cAAc,2BAA2B;AAE3C,MAAM,WAAW;AAAA;AAAA;AAAA,EAGtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,0BAA0B,EAAE;AAAA;AAAA,EAExE,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,wBAAwB,EAAE;AACxE;AAEA,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,gCAAgC,EAAE,QAAQ;AAC5C,CAAC;AAED,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,gCAAgC,EAAE,QAAQ;AAC5C,CAAC;AAED,MAAM,oBAAoB,uBAAuB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAE3E,eAAe,6BAA2E;AACxF,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,WAAO,QAAQ,qBAAqB;AAAA,EACtC,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,IAAI,SAAkB;AAC1C,QAAM,OAAO,MAAM,mBAAmB,OAAO;AAC7C,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,sBAAsB,MAAM,2BAA2B;AAC7D,QAAM,iCAAiC,MAAM;AAAA,IAC3C;AAAA,IACA,KAAK;AAAA,EACP;AACA,SAAO,aAAa,KAAK,EAAE,+BAA+B,CAAC;AAC7D;AAEA,eAAsB,IAAI,SAAkB;AAC1C,QAAM,OAAO,MAAM,mBAAmB,OAAO;AAC7C,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,QAAQ,KAAK;AAAA,EAC5B,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,SAAS,cAAc,UAAU,IAAI;AAC3C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE;AAAA,MAC9D,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,sBAAsB,MAAM,2BAA2B;AAC7D,MAAI,CAAC,qBAAqB;AACxB,WAAO,aAAa,KAAK,EAAE,OAAO,+BAA+B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrF;AAEA,QAAM;AAAA,IACJ;AAAA,IACA,KAAK;AAAA,IACL,OAAO,KAAK;AAAA,EACd;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI;AAAA,IACJ,gCAAgC,OAAO,KAAK;AAAA,EAC9C,CAAC;AACH;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,uBAAuB;AAAA,QAC/E,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,oBAAoB;AAAA,MACpF;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,QAAQ,cAAc;AAAA,MACrC,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,kBAAkB;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,oBAAoB;AAAA,QAC3E,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,oBAAoB;AAAA,QAClF,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,oBAAoB;AAAA,MAC1F;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/workflows/api/tasks/[id]/claim/route.js

@@ -2,7 +2,7 @@ import { NextResponse } from "next/server";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
-import { claimUserTask } from "../../../../lib/task-handler.js";
+import { gateTaskAction } from "../../../../lib/task-visibility-request.js";
 import {
   workflowsTag,
   userTaskClaimResponseSchema,
@@ -31,7 +31,24 @@ async function POST(request, { params }) {
         { status: 400 }
       );
     }
-    await claimUserTask(em, params.id, auth.sub);
+    const gate = await gateTaskAction({
+      container,
+      em,
+      auth: { userId: auth.sub, tenantId, roleNames: auth.roles ?? [] },
+      taskId: params.id,
+      organizationId
+    });
+    if (!gate.allowed) {
+      return NextResponse.json(gate.refusal.body, { status: gate.refusal.status });
+    }
+    const taskHandler = container.resolve("taskHandler");
+    await taskHandler.claimUserTask(
+      em,
+      params.id,
+      auth.sub,
+      { tenantId, organizationId },
+      auth.roles ?? []
+    );
     const { UserTask } = await import("../../../../data/entities.js");
     const task = await em.findOne(UserTask, {
       id: params.id,
@@ -50,19 +67,12 @@ async function POST(request, { params }) {
     });
   } catch (error) {
     logger.error("Error claiming user task", { err: error });
-    if (error instanceof Error) {
-      if (error.message.includes("not found")) {
-        return NextResponse.json(
-          { error: error.message },
-          { status: 404 }
-        );
-      }
-      if (error.message.includes("already")) {
-        return NextResponse.json(
-          { error: error.message },
-          { status: 409 }
-        );
-      }
+    const code = error?.code;
+    if (code === "TASK_NOT_FOUND") {
+      return NextResponse.json({ error: error.message }, { status: 404 });
+    }
+    if (code === "TASK_ALREADY_ASSIGNED" || code === "TASK_NOT_ROLE_ASSIGNED") {
+      return NextResponse.json({ error: error.message }, { status: 409 });
     }
     return NextResponse.json(
       {
@@ -86,7 +96,8 @@ const openApi = {
       errors: [
         { status: 400, description: "Missing tenant or organization context", schema: workflowErrorSchema },
         { status: 401, description: "Unauthorized", schema: workflowErrorSchema },
-        { status: 404, description: "Task not found", schema: workflowErrorSchema },
+        { status: 403, description: "The task is visible to the caller but is not theirs to act on \u2014 it has no assignee and no role queue, so it must be reassigned first (\xA76.4: administration widens seeing, never acting).", schema: workflowErrorSchema },
+        { status: 404, description: "Task not found, or not visible to the caller", schema: workflowErrorSchema },
         { status: 409, description: "Task already claimed", schema: workflowErrorSchema },
         { status: 500, description: "Internal server error", schema: workflowErrorSchema }
       ]

package/dist/modules/workflows/api/tasks/[id]/claim/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/workflows/api/tasks/%5Bid%5D/claim/route.ts"],
-  "sourcesContent": ["/**\n * User Task Claim API\n *\n * Endpoints:\n * - POST /api/workflows/tasks/[id]/claim - Claim a task from role queue\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { claimUserTask } from '../../../../lib/task-handler'\nimport {\n  workflowsTag,\n  userTaskClaimResponseSchema,\n  workflowErrorSchema,\n} from '../../../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.tasks.claim'],\n}\n\n/**\n * POST /api/workflows/tasks/[id]/claim\n *\n * Claim a user task from a role queue\n *\n * This allows a user to claim a task that's assigned to their role(s).\n * Once claimed, the task moves to IN_PROGRESS status and is assigned to the claiming user.\n */\nexport async function POST(\n  request: NextRequest,\n  { params }: { params: { id: string } }\n) {\n  try {\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = scope?.selectedId ?? auth.orgId\n\n    if (!tenantId || !organizationId) {\n      return NextResponse.json(\n        { error: 'Missing tenant or organization context' },\n        { status: 400 }\n      )\n    }\n\n    // Call task handler to claim task\n    await claimUserTask(em, params.id, auth.sub)\n\n    // Fetch updated task\n    const { UserTask } = await import('../../../../data/entities')\n    const task = await em.findOne(UserTask, {\n      id: params.id,\n      tenantId,\n      organizationId,\n    })\n\n    if (!task) {\n      return NextResponse.json(\n        { error: 'Task not found after claim' },\n        { status: 500 }\n      )\n    }\n\n    return NextResponse.json({\n      data: task,\n      message: 'Task claimed successfully',\n    })\n  } catch (error) {\n    logger.error('Error claiming user task', { err: error })\n\n    // Handle specific error codes from task-handler\n    if (error instanceof Error) {\n      if (error.message.includes('not found')) {\n        return NextResponse.json(\n          { error: error.message },\n          { status: 404 }\n        )\n      }\n      if (error.message.includes('already')) {\n        return NextResponse.json(\n          { error: error.message },\n          { status: 409 }\n        )\n      }\n    }\n\n    return NextResponse.json(\n      {\n        error: 'Failed to claim user task',\n        details: error instanceof Error ? error.message : String(error),\n      },\n      { status: 500 }\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'Claim user task',\n  methods: {\n    POST: {\n      summary: 'Claim a task from role queue',\n      description: 'Allows a user to claim a task assigned to their role(s). Once claimed, the task moves to IN_PROGRESS status and is assigned to the claiming user.',\n      responses: [\n        { status: 200, description: 'Task claimed successfully', schema: userTaskClaimResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing tenant or organization context', schema: workflowErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: workflowErrorSchema },\n        { status: 404, description: 'Task not found', schema: workflowErrorSchema },\n        { status: 409, description: 'Task already claimed', schema: workflowErrorSchema },\n        { status: 500, description: 'Internal server error', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAOA,SAAsB,oBAAoB;AAE1C,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,qBAAqB;AAC9B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,uBAAuB;AAC3C;AAUA,eAAsB,KACpB,SACA,EAAE,OAAO,GACT;AACA,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,cAAc,KAAK;AAEjD,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,yCAAyC;AAAA,QAClD,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAGA,UAAM,cAAc,IAAI,OAAO,IAAI,KAAK,GAAG;AAG3C,UAAM,EAAE,SAAS,IAAI,MAAM,OAAO,2BAA2B;AAC7D,UAAM,OAAO,MAAM,GAAG,QAAQ,UAAU;AAAA,MACtC,IAAI,OAAO;AAAA,MACX;AAAA,MACA;AAAA,IACF,CAAC;AAED,QAAI,CAAC,MAAM;AACT,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,6BAA6B;AAAA,QACtC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,4BAA4B,EAAE,KAAK,MAAM,CAAC;AAGvD,QAAI,iBAAiB,OAAO;AAC1B,UAAI,MAAM,QAAQ,SAAS,WAAW,GAAG;AACvC,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,MAAM,QAAQ;AAAA,UACvB,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,UAAI,MAAM,QAAQ,SAAS,SAAS,GAAG;AACrC,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,MAAM,QAAQ;AAAA,UACvB,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAEA,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,OAAO;AAAA,QACP,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAChE;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,4BAA4B;AAAA,MAC/F;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0CAA0C,QAAQ,oBAAoB;AAAA,QAClG,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,oBAAoB;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,oBAAoB;AAAA,QAChF,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * User Task Claim API\n *\n * Endpoints:\n * - POST /api/workflows/tasks/[id]/claim - Claim a task from role queue\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { TaskHandlerService } from '../../../../lib/task-handler'\nimport { gateTaskAction } from '../../../../lib/task-visibility-request'\nimport {\n  workflowsTag,\n  userTaskClaimResponseSchema,\n  workflowErrorSchema,\n} from '../../../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.tasks.claim'],\n}\n\n/**\n * POST /api/workflows/tasks/[id]/claim\n *\n * Claim a user task from a role queue\n *\n * This allows a user to claim a task that's assigned to their role(s).\n * Once claimed, the task moves to IN_PROGRESS status and is assigned to the claiming user.\n */\nexport async function POST(\n  request: NextRequest,\n  { params }: { params: { id: string } }\n) {\n  try {\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = scope?.selectedId ?? auth.orgId\n\n    if (!tenantId || !organizationId) {\n      return NextResponse.json(\n        { error: 'Missing tenant or organization context' },\n        { status: 400 }\n      )\n    }\n\n    // \u00A76.4 runs BEFORE the handler, and that ordering is the disclosure fix:\n    // `claimUserTask` reports `TASK_ALREADY_ASSIGNED` before it checks queue\n    // membership, so a caller with no relationship to the task used to learn\n    // that it exists from the status code alone. Now they get the same 404 a\n    // nonexistent id produces, and the handler still owns membership, the\n    // compare-and-set and every error code below.\n    const gate = await gateTaskAction({\n      container,\n      em,\n      auth: { userId: auth.sub, tenantId, roleNames: auth.roles ?? [] },\n      taskId: params.id,\n      organizationId,\n    })\n\n    if (!gate.allowed) {\n      return NextResponse.json(gate.refusal.body, { status: gate.refusal.status })\n    }\n\n    // Call task handler to claim task\n    const taskHandler = container.resolve<TaskHandlerService>('taskHandler')\n    // Role names are server-derived (`auth.roles`), never read off the request \u2014\n    // a caller who holds none of the task's queues is refused as \"not found\".\n    await taskHandler.claimUserTask(\n      em,\n      params.id,\n      auth.sub,\n      { tenantId, organizationId },\n      auth.roles ?? [],\n    )\n\n    // Fetch updated task\n    const { UserTask } = await import('../../../../data/entities')\n    const task = await em.findOne(UserTask, {\n      id: params.id,\n      tenantId,\n      organizationId,\n    })\n\n    if (!task) {\n      return NextResponse.json(\n        { error: 'Task not found after claim' },\n        { status: 500 }\n      )\n    }\n\n    return NextResponse.json({\n      data: task,\n      message: 'Task claimed successfully',\n    })\n  } catch (error) {\n    logger.error('Error claiming user task', { err: error })\n\n    // Keyed on the handler's error CODE rather than on substrings of its\n    // message. The old message matching had no arm for `TASK_NOT_ROLE_ASSIGNED`\n    // (\"Task is not assigned to any roles\" contains neither \"not found\" nor\n    // \"already\"), so a task with an empty queue answered 500.\n    const code = (error as { code?: unknown } | null)?.code\n    if (code === 'TASK_NOT_FOUND') {\n      return NextResponse.json({ error: (error as Error).message }, { status: 404 })\n    }\n    if (code === 'TASK_ALREADY_ASSIGNED' || code === 'TASK_NOT_ROLE_ASSIGNED') {\n      return NextResponse.json({ error: (error as Error).message }, { status: 409 })\n    }\n\n    return NextResponse.json(\n      {\n        error: 'Failed to claim user task',\n        details: error instanceof Error ? error.message : String(error),\n      },\n      { status: 500 }\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'Claim user task',\n  methods: {\n    POST: {\n      summary: 'Claim a task from role queue',\n      description: 'Allows a user to claim a task assigned to their role(s). Once claimed, the task moves to IN_PROGRESS status and is assigned to the claiming user.',\n      responses: [\n        { status: 200, description: 'Task claimed successfully', schema: userTaskClaimResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing tenant or organization context', schema: workflowErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: workflowErrorSchema },\n        { status: 403, description: 'The task is visible to the caller but is not theirs to act on \u2014 it has no assignee and no role queue, so it must be reassigned first (\u00A76.4: administration widens seeing, never acting).', schema: workflowErrorSchema },\n        { status: 404, description: 'Task not found, or not visible to the caller', schema: workflowErrorSchema },\n        { status: 409, description: 'Task already claimed', schema: workflowErrorSchema },\n        { status: 500, description: 'Internal server error', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAOA,SAAsB,oBAAoB;AAE1C,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AAEnD,SAAS,sBAAsB;AAC/B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,uBAAuB;AAC3C;AAUA,eAAsB,KACpB,SACA,EAAE,OAAO,GACT;AACA,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,cAAc,KAAK;AAEjD,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,yCAAyC;AAAA,QAClD,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAQA,UAAM,OAAO,MAAM,eAAe;AAAA,MAChC;AAAA,MACA;AAAA,MACA,MAAM,EAAE,QAAQ,KAAK,KAAK,UAAU,WAAW,KAAK,SAAS,CAAC,EAAE;AAAA,MAChE,QAAQ,OAAO;AAAA,MACf;AAAA,IACF,CAAC;AAED,QAAI,CAAC,KAAK,SAAS;AACjB,aAAO,aAAa,KAAK,KAAK,QAAQ,MAAM,EAAE,QAAQ,KAAK,QAAQ,OAAO,CAAC;AAAA,IAC7E;AAGA,UAAM,cAAc,UAAU,QAA4B,aAAa;AAGvE,UAAM,YAAY;AAAA,MAChB;AAAA,MACA,OAAO;AAAA,MACP,KAAK;AAAA,MACL,EAAE,UAAU,eAAe;AAAA,MAC3B,KAAK,SAAS,CAAC;AAAA,IACjB;AAGA,UAAM,EAAE,SAAS,IAAI,MAAM,OAAO,2BAA2B;AAC7D,UAAM,OAAO,MAAM,GAAG,QAAQ,UAAU;AAAA,MACtC,IAAI,OAAO;AAAA,MACX;AAAA,MACA;AAAA,IACF,CAAC;AAED,QAAI,CAAC,MAAM;AACT,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,6BAA6B;AAAA,QACtC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,4BAA4B,EAAE,KAAK,MAAM,CAAC;AAMvD,UAAM,OAAQ,OAAqC;AACnD,QAAI,SAAS,kBAAkB;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAQ,MAAgB,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/E;AACA,QAAI,SAAS,2BAA2B,SAAS,0BAA0B;AACzE,aAAO,aAAa,KAAK,EAAE,OAAQ,MAAgB,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/E;AAEA,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,OAAO;AAAA,QACP,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAChE;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,4BAA4B;AAAA,MAC/F;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0CAA0C,QAAQ,oBAAoB;AAAA,QAClG,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,oMAA4L,QAAQ,oBAAoB;AAAA,QACpP,EAAE,QAAQ,KAAK,aAAa,gDAAgD,QAAQ,oBAAoB;AAAA,QACxG,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,oBAAoB;AAAA,QAChF,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/workflows/api/tasks/[id]/complete/route.js

@@ -3,7 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
-import { completeUserTask } from "../../../../lib/task-handler.js";
+import { gateTaskAction } from "../../../../lib/task-visibility-request.js";
 import {
   workflowsTag,
   completeTaskRequestSchema as openApiCompleteTaskSchema,
@@ -18,7 +18,12 @@ const metadata = {
 };
 const completeTaskSchema = z.object({
   formData: z.record(z.string(), z.any()),
-  comments: z.string().optional()
+  comments: z.string().optional(),
+  /**
+   * The decision button the assignee pressed. Optional and additive: a task
+   * without decisions completes through the plain form exactly as before.
+   */
+  decisionId: z.string().min(1).optional()
 });
 async function POST(request, { params }) {
   try {
@@ -48,24 +53,30 @@ async function POST(request, { params }) {
         { status: 400 }
       );
     }
-    const { formData, comments } = parseResult.data;
-    const { UserTask } = await import("../../../../data/entities.js");
-    const task = await em.findOne(UserTask, {
-      id: params.id,
-      tenantId,
-      organizationId
+    const { formData, comments, decisionId } = parseResult.data;
+    const gate = await gateTaskAction({
+      container,
+      em,
+      auth: { userId: auth.sub, tenantId, roleNames: auth.roles ?? [] },
+      taskId: params.id,
+      organizationId,
+      // Complete is the one act where the gate, not the handler, decides
+      // ownership: the handler leaves an OWNERLESS row open to anyone holding
+      // the feature, which is exactly the pre-change semantics §6.4 narrows.
+      requireOwnership: true
     });
-    if (!task) {
-      return NextResponse.json(
-        { error: "Task not found" },
-        { status: 404 }
-      );
+    if (!gate.allowed) {
+      return NextResponse.json(gate.refusal.body, { status: gate.refusal.status });
     }
-    await completeUserTask(em, container, {
+    const { UserTask } = await import("../../../../data/entities.js");
+    const taskHandler = container.resolve("taskHandler");
+    await taskHandler.completeUserTask(em, container, {
       taskId: params.id,
       formData,
       userId: auth.sub,
-      comments
+      comments,
+      decisionId,
+      scope: { tenantId, organizationId }
     });
     const updatedTask = await em.findOne(UserTask, {
       id: params.id,
@@ -79,6 +90,18 @@ async function POST(request, { params }) {
   } catch (error) {
     logger.error("Error completing user task", { err: error });
     if (error instanceof Error) {
+      if (error.code === "UNKNOWN_DECISION") {
+        return NextResponse.json(
+          { error: error.message },
+          { status: 400 }
+        );
+      }
+      if (error.code === "TASK_ASSIGNED_TO_ANOTHER_USER") {
+        return NextResponse.json(
+          { error: error.message },
+          { status: 409 }
+        );
+      }
       if (error.message.includes("not found")) {
         return NextResponse.json(
           { error: error.message },
@@ -124,7 +147,8 @@ const openApi = {
       errors: [
         { status: 400, description: "Invalid request body, validation failed, or missing context", schema: workflowErrorSchema },
         { status: 401, description: "Unauthorized", schema: workflowErrorSchema },
-        { status: 404, description: "Task not found", schema: workflowErrorSchema },
+        { status: 403, description: "The task is visible to the caller but is not theirs to act on \u2014 it has no assignee and no role queue, so it must be reassigned first (\xA76.4: administration widens seeing, never acting).", schema: workflowErrorSchema },
+        { status: 404, description: "Task not found, or not visible to the caller", schema: workflowErrorSchema },
         { status: 409, description: "Task already completed", schema: workflowErrorSchema },
         { status: 500, description: "Internal server error", schema: workflowErrorSchema }
       ]

package/dist/modules/workflows/api/tasks/[id]/complete/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/workflows/api/tasks/%5Bid%5D/complete/route.ts"],
-  "sourcesContent": ["/**\n * User Task Completion API\n *\n * Endpoints:\n * - POST /api/workflows/tasks/[id]/complete - Complete a user task with form data\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { completeUserTask } from '../../../../lib/task-handler'\nimport {\n  workflowsTag,\n  completeTaskRequestSchema as openApiCompleteTaskSchema,\n  userTaskCompleteResponseSchema,\n  workflowErrorSchema,\n} from '../../../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.tasks.complete'],\n}\n\n// Request body schema\nconst completeTaskSchema = z.object({\n  formData: z.record(z.string(), z.any()),\n  comments: z.string().optional(),\n})\n\n/**\n * POST /api/workflows/tasks/[id]/complete\n *\n * Complete a user task with form data\n *\n * Request body:\n * {\n *   formData: { [key: string]: any },  // Form field values\n *   comments: string (optional)         // Optional comments\n * }\n *\n * This endpoint:\n * 1. Validates the task can be completed\n * 2. Validates form data against the task's form schema\n * 3. Updates the task with completion data\n * 4. Merges form data into workflow context\n * 5. Resumes workflow execution\n */\nexport async function POST(\n  request: NextRequest,\n  { params }: { params: { id: string } }\n) {\n  try {\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = scope?.selectedId ?? auth.orgId\n\n    if (!tenantId || !organizationId) {\n      return NextResponse.json(\n        { error: 'Missing tenant or organization context' },\n        { status: 400 }\n      )\n    }\n\n    // Parse request body\n    const body = await request.json()\n    const parseResult = completeTaskSchema.safeParse(body)\n\n    if (!parseResult.success) {\n      return NextResponse.json(\n        {\n          error: 'Invalid request body',\n          details: parseResult.error.format(),\n        },\n        { status: 400 }\n      )\n    }\n\n    const { formData, comments } = parseResult.data\n\n    // Verify task belongs to this tenant/org before completing\n    const { UserTask } = await import('../../../../data/entities')\n    const task = await em.findOne(UserTask, {\n      id: params.id,\n      tenantId,\n      organizationId,\n    })\n\n    if (!task) {\n      return NextResponse.json(\n        { error: 'Task not found' },\n        { status: 404 }\n      )\n    }\n\n    // Call task handler to complete task and resume workflow\n    await completeUserTask(em, container, {\n      taskId: params.id,\n      formData,\n      userId: auth.sub,\n      comments,\n    })\n\n    // Fetch updated task\n    const updatedTask = await em.findOne(UserTask, {\n      id: params.id,\n      tenantId,\n      organizationId,\n    })\n\n    return NextResponse.json({\n      data: updatedTask,\n      message: 'Task completed successfully. Workflow resumed.',\n    })\n  } catch (error) {\n    logger.error('Error completing user task', { err: error })\n\n    // Handle specific error codes from task-handler\n    if (error instanceof Error) {\n      if (error.message.includes('not found')) {\n        return NextResponse.json(\n          { error: error.message },\n          { status: 404 }\n        )\n      }\n      if (error.message.includes('validation')) {\n        return NextResponse.json(\n          { error: error.message },\n          { status: 400 }\n        )\n      }\n      if (error.message.includes('already completed')) {\n        return NextResponse.json(\n          { error: error.message },\n          { status: 409 }\n        )\n      }\n    }\n\n    return NextResponse.json(\n      {\n        error: 'Failed to complete user task',\n        details: error instanceof Error ? error.message : String(error),\n      },\n      { status: 500 }\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'Complete user task',\n  methods: {\n    POST: {\n      summary: 'Complete a task with form data',\n      description: 'Validates form data against task schema, updates task with completion data, merges form data into workflow context, and resumes workflow execution.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: openApiCompleteTaskSchema,\n      },\n      responses: [\n        { status: 200, description: 'Task completed successfully', schema: userTaskCompleteResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid request body, validation failed, or missing context', schema: workflowErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: workflowErrorSchema },\n        { status: 404, description: 'Task not found', schema: workflowErrorSchema },\n        { status: 409, description: 'Task already completed', schema: workflowErrorSchema },\n        { status: 500, description: 'Internal server error', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAOA,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,wBAAwB;AACjC;AAAA,EACE;AAAA,EACA,6BAA6B;AAAA,EAC7B;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,0BAA0B;AAC9C;AAGA,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,IAAI,CAAC;AAAA,EACtC,UAAU,EAAE,OAAO,EAAE,SAAS;AAChC,CAAC;AAoBD,eAAsB,KACpB,SACA,EAAE,OAAO,GACT;AACA,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,cAAc,KAAK;AAEjD,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,yCAAyC;AAAA,QAClD,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAGA,UAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,UAAM,cAAc,mBAAmB,UAAU,IAAI;AAErD,QAAI,CAAC,YAAY,SAAS;AACxB,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO;AAAA,UACP,SAAS,YAAY,MAAM,OAAO;AAAA,QACpC;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,EAAE,UAAU,SAAS,IAAI,YAAY;AAG3C,UAAM,EAAE,SAAS,IAAI,MAAM,OAAO,2BAA2B;AAC7D,UAAM,OAAO,MAAM,GAAG,QAAQ,UAAU;AAAA,MACtC,IAAI,OAAO;AAAA,MACX;AAAA,MACA;AAAA,IACF,CAAC;AAED,QAAI,CAAC,MAAM;AACT,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,iBAAiB;AAAA,QAC1B,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAGA,UAAM,iBAAiB,IAAI,WAAW;AAAA,MACpC,QAAQ,OAAO;AAAA,MACf;AAAA,MACA,QAAQ,KAAK;AAAA,MACb;AAAA,IACF,CAAC;AAGD,UAAM,cAAc,MAAM,GAAG,QAAQ,UAAU;AAAA,MAC7C,IAAI,OAAO;AAAA,MACX;AAAA,MACA;AAAA,IACF,CAAC;AAED,WAAO,aAAa,KAAK;AAAA,MACvB,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,8BAA8B,EAAE,KAAK,MAAM,CAAC;AAGzD,QAAI,iBAAiB,OAAO;AAC1B,UAAI,MAAM,QAAQ,SAAS,WAAW,GAAG;AACvC,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,MAAM,QAAQ;AAAA,UACvB,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,UAAI,MAAM,QAAQ,SAAS,YAAY,GAAG;AACxC,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,MAAM,QAAQ;AAAA,UACvB,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,UAAI,MAAM,QAAQ,SAAS,mBAAmB,GAAG;AAC/C,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,MAAM,QAAQ;AAAA,UACvB,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAEA,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,OAAO;AAAA,QACP,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAChE;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,+BAA+B,QAAQ,+BAA+B;AAAA,MACpG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,+DAA+D,QAAQ,oBAAoB;AAAA,QACvH,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,oBAAoB;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,oBAAoB;AAAA,QAClF,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * User Task Completion API\n *\n * Endpoints:\n * - POST /api/workflows/tasks/[id]/complete - Complete a user task with form data\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { TaskHandlerService } from '../../../../lib/task-handler'\nimport { gateTaskAction } from '../../../../lib/task-visibility-request'\nimport {\n  workflowsTag,\n  completeTaskRequestSchema as openApiCompleteTaskSchema,\n  userTaskCompleteResponseSchema,\n  workflowErrorSchema,\n} from '../../../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.tasks.complete'],\n}\n\n// Request body schema\nconst completeTaskSchema = z.object({\n  formData: z.record(z.string(), z.any()),\n  comments: z.string().optional(),\n  /**\n   * The decision button the assignee pressed. Optional and additive: a task\n   * without decisions completes through the plain form exactly as before.\n   */\n  decisionId: z.string().min(1).optional(),\n})\n\n/**\n * POST /api/workflows/tasks/[id]/complete\n *\n * Complete a user task with form data\n *\n * Request body:\n * {\n *   formData: { [key: string]: any },  // Form field values\n *   comments: string (optional)         // Optional comments\n * }\n *\n * This endpoint:\n * 1. Validates the task can be completed\n * 2. Validates form data against the task's form schema\n * 3. Updates the task with completion data\n * 4. Merges form data into workflow context\n * 5. Resumes workflow execution\n */\nexport async function POST(\n  request: NextRequest,\n  { params }: { params: { id: string } }\n) {\n  try {\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = scope?.selectedId ?? auth.orgId\n\n    if (!tenantId || !organizationId) {\n      return NextResponse.json(\n        { error: 'Missing tenant or organization context' },\n        { status: 400 }\n      )\n    }\n\n    // Parse request body\n    const body = await request.json()\n    const parseResult = completeTaskSchema.safeParse(body)\n\n    if (!parseResult.success) {\n      return NextResponse.json(\n        {\n          error: 'Invalid request body',\n          details: parseResult.error.format(),\n        },\n        { status: 400 }\n      )\n    }\n\n    const { formData, comments, decisionId } = parseResult.data\n\n    // \u00A76.4 replaces the bare tenant/organization check that used to stand here.\n    // The narrowing D-1 keeps `workflows.tasks.complete` on the route and still\n    // demands: holding it no longer completes anyone ELSE's task. Refusals are\n    // indistinguishable from a nonexistent id unless the caller already sees the\n    // row.\n    const gate = await gateTaskAction({\n      container,\n      em,\n      auth: { userId: auth.sub, tenantId, roleNames: auth.roles ?? [] },\n      taskId: params.id,\n      organizationId,\n      // Complete is the one act where the gate, not the handler, decides\n      // ownership: the handler leaves an OWNERLESS row open to anyone holding\n      // the feature, which is exactly the pre-change semantics \u00A76.4 narrows.\n      requireOwnership: true,\n    })\n\n    if (!gate.allowed) {\n      return NextResponse.json(gate.refusal.body, { status: gate.refusal.status })\n    }\n\n    const { UserTask } = await import('../../../../data/entities')\n\n    // Call task handler to complete task and resume workflow\n    const taskHandler = container.resolve<TaskHandlerService>('taskHandler')\n    await taskHandler.completeUserTask(em, container, {\n      taskId: params.id,\n      formData,\n      userId: auth.sub,\n      comments,\n      decisionId,\n      scope: { tenantId, organizationId },\n    })\n\n    // Fetch updated task\n    const updatedTask = await em.findOne(UserTask, {\n      id: params.id,\n      tenantId,\n      organizationId,\n    })\n\n    return NextResponse.json({\n      data: updatedTask,\n      message: 'Task completed successfully. Workflow resumed.',\n    })\n  } catch (error) {\n    logger.error('Error completing user task', { err: error })\n\n    // Handle specific error codes from task-handler\n    if (error instanceof Error) {\n      if ((error as { code?: unknown }).code === 'UNKNOWN_DECISION') {\n        return NextResponse.json(\n          { error: error.message },\n          { status: 400 }\n        )\n      }\n      // \"Task is assigned to another user\" matches none of the message arms\n      // below, so this refusal used to answer 500. It is a conflict.\n      if ((error as { code?: unknown }).code === 'TASK_ASSIGNED_TO_ANOTHER_USER') {\n        return NextResponse.json(\n          { error: error.message },\n          { status: 409 }\n        )\n      }\n      if (error.message.includes('not found')) {\n        return NextResponse.json(\n          { error: error.message },\n          { status: 404 }\n        )\n      }\n      if (error.message.includes('validation')) {\n        return NextResponse.json(\n          { error: error.message },\n          { status: 400 }\n        )\n      }\n      if (error.message.includes('already completed')) {\n        return NextResponse.json(\n          { error: error.message },\n          { status: 409 }\n        )\n      }\n    }\n\n    return NextResponse.json(\n      {\n        error: 'Failed to complete user task',\n        details: error instanceof Error ? error.message : String(error),\n      },\n      { status: 500 }\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'Complete user task',\n  methods: {\n    POST: {\n      summary: 'Complete a task with form data',\n      description: 'Validates form data against task schema, updates task with completion data, merges form data into workflow context, and resumes workflow execution.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: openApiCompleteTaskSchema,\n      },\n      responses: [\n        { status: 200, description: 'Task completed successfully', schema: userTaskCompleteResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid request body, validation failed, or missing context', schema: workflowErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: workflowErrorSchema },\n        { status: 403, description: 'The task is visible to the caller but is not theirs to act on \u2014 it has no assignee and no role queue, so it must be reassigned first (\u00A76.4: administration widens seeing, never acting).', schema: workflowErrorSchema },\n        { status: 404, description: 'Task not found, or not visible to the caller', schema: workflowErrorSchema },\n        { status: 409, description: 'Task already completed', schema: workflowErrorSchema },\n        { status: 500, description: 'Internal server error', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAOA,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AAEnD,SAAS,sBAAsB;AAC/B;AAAA,EACE;AAAA,EACA,6BAA6B;AAAA,EAC7B;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,0BAA0B;AAC9C;AAGA,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,IAAI,CAAC;AAAA,EACtC,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAK9B,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACzC,CAAC;AAoBD,eAAsB,KACpB,SACA,EAAE,OAAO,GACT;AACA,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,cAAc,KAAK;AAEjD,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,yCAAyC;AAAA,QAClD,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAGA,UAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,UAAM,cAAc,mBAAmB,UAAU,IAAI;AAErD,QAAI,CAAC,YAAY,SAAS;AACxB,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO;AAAA,UACP,SAAS,YAAY,MAAM,OAAO;AAAA,QACpC;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,EAAE,UAAU,UAAU,WAAW,IAAI,YAAY;AAOvD,UAAM,OAAO,MAAM,eAAe;AAAA,MAChC;AAAA,MACA;AAAA,MACA,MAAM,EAAE,QAAQ,KAAK,KAAK,UAAU,WAAW,KAAK,SAAS,CAAC,EAAE;AAAA,MAChE,QAAQ,OAAO;AAAA,MACf;AAAA;AAAA;AAAA;AAAA,MAIA,kBAAkB;AAAA,IACpB,CAAC;AAED,QAAI,CAAC,KAAK,SAAS;AACjB,aAAO,aAAa,KAAK,KAAK,QAAQ,MAAM,EAAE,QAAQ,KAAK,QAAQ,OAAO,CAAC;AAAA,IAC7E;AAEA,UAAM,EAAE,SAAS,IAAI,MAAM,OAAO,2BAA2B;AAG7D,UAAM,cAAc,UAAU,QAA4B,aAAa;AACvE,UAAM,YAAY,iBAAiB,IAAI,WAAW;AAAA,MAChD,QAAQ,OAAO;AAAA,MACf;AAAA,MACA,QAAQ,KAAK;AAAA,MACb;AAAA,MACA;AAAA,MACA,OAAO,EAAE,UAAU,eAAe;AAAA,IACpC,CAAC;AAGD,UAAM,cAAc,MAAM,GAAG,QAAQ,UAAU;AAAA,MAC7C,IAAI,OAAO;AAAA,MACX;AAAA,MACA;AAAA,IACF,CAAC;AAED,WAAO,aAAa,KAAK;AAAA,MACvB,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,8BAA8B,EAAE,KAAK,MAAM,CAAC;AAGzD,QAAI,iBAAiB,OAAO;AAC1B,UAAK,MAA6B,SAAS,oBAAoB;AAC7D,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,MAAM,QAAQ;AAAA,UACvB,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAGA,UAAK,MAA6B,SAAS,iCAAiC;AAC1E,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,MAAM,QAAQ;AAAA,UACvB,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,UAAI,MAAM,QAAQ,SAAS,WAAW,GAAG;AACvC,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,MAAM,QAAQ;AAAA,UACvB,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,UAAI,MAAM,QAAQ,SAAS,YAAY,GAAG;AACxC,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,MAAM,QAAQ;AAAA,UACvB,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,UAAI,MAAM,QAAQ,SAAS,mBAAmB,GAAG;AAC/C,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,MAAM,QAAQ;AAAA,UACvB,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAEA,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,OAAO;AAAA,QACP,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAChE;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,+BAA+B,QAAQ,+BAA+B;AAAA,MACpG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,+DAA+D,QAAQ,oBAAoB;AAAA,QACvH,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,oMAA4L,QAAQ,oBAAoB;AAAA,QACpP,EAAE,QAAQ,KAAK,aAAa,gDAAgD,QAAQ,oBAAoB;AAAA,QACxG,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,oBAAoB;AAAA,QAClF,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }