@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.8.1-develop.7441.1.b42958b98c

package/dist/modules/workflows/api/instances/[id]/step-through/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/workflows/api/instances/%5Bid%5D/step-through/route.ts"],
-  "sourcesContent": ["/**\n * Step-through control API (spec section 8.2)\n *\n * Endpoint:\n * - POST /api/workflows/instances/[id]/step-through - continue one step, or\n *   stop stepping and let the run finish on its own.\n *\n * \"Abort\" is deliberately NOT here: cancelling a run is already\n * `POST /api/workflows/instances/[id]/cancel`, and a second way to cancel would\n * be a second place to get the compensation semantics wrong.\n *\n * The release is a token for exactly ONE step id, minted server-side from the\n * instance's CURRENT step \u2014 never from the request body \u2014 so a client cannot\n * release a step the run is not sitting on.\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveOrganizationScopeFilter } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { WorkflowInstance } from '../../../../data/entities'\nimport * as workflowExecutor from '../../../../lib/workflow-executor'\nimport { logWorkflowEvent } from '../../../../lib/event-logger'\nimport {\n  STEP_THROUGH_RELEASED_EVENT_TYPE,\n  isStepThroughArmed,\n  releaseStepThrough,\n} from '../../../../lib/step-through'\nimport { workflowsTag, workflowErrorSchema } from '../../../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.test_run'],\n}\n\nconst stepThroughInputSchema = z.object({\n  action: z.enum(['continue', 'stop']),\n})\n\ninterface RouteContext {\n  params: Promise<{ id: string }>\n}\n\nexport async function POST(request: NextRequest, context: RouteContext) {\n  try {\n    const params = await context.params\n    const container = await createRequestContainer()\n    const em = container.resolve('em') as EntityManager\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth?.sub) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n    const orgFilter = resolveOrganizationScopeFilter(scope, auth)\n\n    if (!tenantId) {\n      return NextResponse.json({ error: 'Missing tenant context' }, { status: 400 })\n    }\n\n    const rbacService = container.resolve('rbacService') as {\n      userHasAllFeatures: (\n        userId: string,\n        features: string[],\n        scope: { tenantId: string | null; organizationId: string | null },\n      ) => Promise<boolean>\n    }\n    const allowed = await rbacService.userHasAllFeatures(\n      auth.sub,\n      ['workflows.definitions.test_run'],\n      { tenantId, organizationId },\n    )\n    if (!allowed) {\n      return NextResponse.json({ error: 'Insufficient permissions' }, { status: 403 })\n    }\n\n    const body = await request.json()\n    const validation = stepThroughInputSchema.safeParse(body)\n    if (!validation.success) {\n      return NextResponse.json(\n        { error: 'Validation failed', details: validation.error.issues },\n        { status: 400 },\n      )\n    }\n\n    const instance = await em.findOne(WorkflowInstance, {\n      id: params.id,\n      tenantId,\n      ...orgFilter.where,\n    })\n\n    if (!instance) {\n      return NextResponse.json({ error: 'Workflow instance not found' }, { status: 404 })\n    }\n\n    if (!isStepThroughArmed(instance)) {\n      return NextResponse.json(\n        { error: 'This instance is not running in step-through mode' },\n        { status: 400 },\n      )\n    }\n\n    if (validation.data.action === 'stop') {\n      instance.metadata = { ...(instance.metadata || {}), stepThrough: null }\n      instance.updatedAt = new Date()\n      await em.flush()\n    } else {\n      // The token is minted from the instance's own cursor, so a client can only\n      // ever release the step the run is actually parked on.\n      instance.metadata = {\n        ...(instance.metadata || {}),\n        stepThrough: releaseStepThrough(instance.currentStepId),\n      }\n      instance.updatedAt = new Date()\n      await em.flush()\n\n      await logWorkflowEvent(em, {\n        workflowInstanceId: instance.id,\n        eventType: STEP_THROUGH_RELEASED_EVENT_TYPE,\n        eventData: { stepId: instance.currentStepId },\n        userId: auth.sub,\n        tenantId,\n        organizationId: instance.organizationId,\n      })\n    }\n\n    // The instance was parked with PAUSED; every resume path flips it back to\n    // RUNNING before re-entering, and this one is no different.\n    if (instance.status === 'PAUSED') {\n      instance.status = 'RUNNING'\n      instance.pausedAt = null\n      instance.updatedAt = new Date()\n      await em.flush()\n    }\n\n    const result = await workflowExecutor.executeWorkflow(em, container, instance.id, {\n      userId: auth.sub,\n    })\n\n    return NextResponse.json({\n      data: {\n        instanceId: instance.id,\n        status: result.status,\n        currentStep: result.currentStep,\n        stepThrough: instance.metadata?.stepThrough ?? null,\n      },\n    })\n  } catch (error) {\n    logger.error('Error advancing step-through run', { err: error })\n    return NextResponse.json({ error: 'Failed to advance step-through run' }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'Step-through control',\n  pathParams: z.object({ id: z.string().uuid() }),\n  methods: {\n    POST: {\n      summary: 'Continue one step, or stop stepping',\n      description:\n        'Releases exactly the step the instance is currently parked on and resumes execution, or clears step-through so the run finishes on its own. To abort the run, use the cancel endpoint.',\n      requestBody: { schema: stepThroughInputSchema, example: { action: 'continue' } },\n      responses: [\n        {\n          status: 200,\n          description: 'The run advanced',\n          schema: z.object({\n            data: z.object({\n              instanceId: z.string(),\n              status: z.string(),\n              currentStep: z.string(),\n              stepThrough: z\n                .object({ enabled: z.literal(true), releaseStepId: z.string().nullable().optional() })\n                .nullable(),\n            }),\n          }),\n        },\n        { status: 400, description: 'Not a step-through run, or malformed payload', schema: workflowErrorSchema },\n        { status: 403, description: 'Insufficient permissions', schema: workflowErrorSchema },\n        { status: 404, description: 'Workflow instance not found', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAgBA,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,sCAAsC;AAE/C,SAAS,wBAAwB;AACjC,YAAY,sBAAsB;AAClC,SAAS,wBAAwB;AACjC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,cAAc,2BAA2B;AAClD,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,gCAAgC;AACpD;AAEA,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,QAAQ,EAAE,KAAK,CAAC,YAAY,MAAM,CAAC;AACrC,CAAC;AAMD,eAAsB,KAAK,SAAsB,SAAuB;AACtE,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ;AAC7B,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM,KAAK;AACd,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,UAAM,YAAY,+BAA+B,OAAO,IAAI;AAE5D,QAAI,CAAC,UAAU;AACb,aAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/E;AAEA,UAAM,cAAc,UAAU,QAAQ,aAAa;AAOnD,UAAM,UAAU,MAAM,YAAY;AAAA,MAChC,KAAK;AAAA,MACL,CAAC,gCAAgC;AAAA,MACjC,EAAE,UAAU,eAAe;AAAA,IAC7B;AACA,QAAI,CAAC,SAAS;AACZ,aAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjF;AAEA,UAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,UAAM,aAAa,uBAAuB,UAAU,IAAI;AACxD,QAAI,CAAC,WAAW,SAAS;AACvB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,qBAAqB,SAAS,WAAW,MAAM,OAAO;AAAA,QAC/D,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,WAAW,MAAM,GAAG,QAAQ,kBAAkB;AAAA,MAClD,IAAI,OAAO;AAAA,MACX;AAAA,MACA,GAAG,UAAU;AAAA,IACf,CAAC;AAED,QAAI,CAAC,UAAU;AACb,aAAO,aAAa,KAAK,EAAE,OAAO,8BAA8B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpF;AAEA,QAAI,CAAC,mBAAmB,QAAQ,GAAG;AACjC,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,oDAAoD;AAAA,QAC7D,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,QAAI,WAAW,KAAK,WAAW,QAAQ;AACrC,eAAS,WAAW,EAAE,GAAI,SAAS,YAAY,CAAC,GAAI,aAAa,KAAK;AACtE,eAAS,YAAY,oBAAI,KAAK;AAC9B,YAAM,GAAG,MAAM;AAAA,IACjB,OAAO;AAGL,eAAS,WAAW;AAAA,QAClB,GAAI,SAAS,YAAY,CAAC;AAAA,QAC1B,aAAa,mBAAmB,SAAS,aAAa;AAAA,MACxD;AACA,eAAS,YAAY,oBAAI,KAAK;AAC9B,YAAM,GAAG,MAAM;AAEf,YAAM,iBAAiB,IAAI;AAAA,QACzB,oBAAoB,SAAS;AAAA,QAC7B,WAAW;AAAA,QACX,WAAW,EAAE,QAAQ,SAAS,cAAc;AAAA,QAC5C,QAAQ,KAAK;AAAA,QACb;AAAA,QACA,gBAAgB,SAAS;AAAA,MAC3B,CAAC;AAAA,IACH;AAIA,QAAI,SAAS,WAAW,UAAU;AAChC,eAAS,SAAS;AAClB,eAAS,WAAW;AACpB,eAAS,YAAY,oBAAI,KAAK;AAC9B,YAAM,GAAG,MAAM;AAAA,IACjB;AAEA,UAAM,SAAS,MAAM,iBAAiB,gBAAgB,IAAI,WAAW,SAAS,IAAI;AAAA,MAChF,QAAQ,KAAK;AAAA,IACf,CAAC;AAED,WAAO,aAAa,KAAK;AAAA,MACvB,MAAM;AAAA,QACJ,YAAY,SAAS;AAAA,QACrB,QAAQ,OAAO;AAAA,QACf,aAAa,OAAO;AAAA,QACpB,aAAa,SAAS,UAAU,eAAe;AAAA,MACjD;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,oCAAoC,EAAE,KAAK,MAAM,CAAC;AAC/D,WAAO,aAAa,KAAK,EAAE,OAAO,qCAAqC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EAC9C,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,QAAQ,wBAAwB,SAAS,EAAE,QAAQ,WAAW,EAAE;AAAA,MAC/E,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,MAAM,EAAE,OAAO;AAAA,cACb,YAAY,EAAE,OAAO;AAAA,cACrB,QAAQ,EAAE,OAAO;AAAA,cACjB,aAAa,EAAE,OAAO;AAAA,cACtB,aAAa,EACV,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI,GAAG,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,EACpF,SAAS;AAAA,YACd,CAAC;AAAA,UACH,CAAC;AAAA,QACH;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,gDAAgD,QAAQ,oBAAoB;AAAA,QACxG,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,+BAA+B,QAAQ,oBAAoB;AAAA,MACzF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * Step-through control API (spec section 8.2)\n *\n * Endpoint:\n * - POST /api/workflows/instances/[id]/step-through - continue one step, or\n *   stop stepping and let the run finish on its own.\n *\n * \"Abort\" is deliberately NOT here: cancelling a run is already\n * `POST /api/workflows/instances/[id]/cancel`, and a second way to cancel would\n * be a second place to get the compensation semantics wrong.\n *\n * The release is a token for exactly ONE step id, minted server-side from the\n * instance's CURRENT step \u2014 never from the request body \u2014 so a client cannot\n * release a step the run is not sitting on.\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveOrganizationScopeFilter, resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { WorkflowInstance } from '../../../../data/entities'\nimport * as workflowExecutor from '../../../../lib/workflow-executor'\nimport { logWorkflowEvent } from '../../../../lib/event-logger'\nimport {\n  STEP_THROUGH_RELEASED_EVENT_TYPE,\n  isStepThroughArmed,\n  releaseStepThrough,\n} from '../../../../lib/step-through'\nimport { workflowsTag, workflowErrorSchema } from '../../../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.test_run'],\n}\n\nconst stepThroughInputSchema = z.object({\n  action: z.enum(['continue', 'stop']),\n})\n\ninterface RouteContext {\n  params: Promise<{ id: string }>\n}\n\nexport async function POST(request: NextRequest, context: RouteContext) {\n  try {\n    const params = await context.params\n    const container = await createRequestContainer()\n    const em = container.resolve('em') as EntityManager\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth?.sub) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n    const orgFilter = resolveOrganizationScopeFilter(scope, auth)\n\n    if (!tenantId) {\n      return NextResponse.json({ error: 'Missing tenant context' }, { status: 400 })\n    }\n\n    const rbacService = container.resolve('rbacService') as {\n      userHasAllFeatures: (\n        userId: string,\n        features: string[],\n        scope: { tenantId: string | null; organizationId: string | null },\n      ) => Promise<boolean>\n    }\n    const allowed = await rbacService.userHasAllFeatures(\n      auth.sub,\n      ['workflows.definitions.test_run'],\n      { tenantId, organizationId },\n    )\n    if (!allowed) {\n      return NextResponse.json({ error: 'Insufficient permissions' }, { status: 403 })\n    }\n\n    const body = await request.json()\n    const validation = stepThroughInputSchema.safeParse(body)\n    if (!validation.success) {\n      return NextResponse.json(\n        { error: 'Validation failed', details: validation.error.issues },\n        { status: 400 },\n      )\n    }\n\n    const instance = await em.findOne(WorkflowInstance, {\n      id: params.id,\n      tenantId,\n      ...orgFilter.where,\n    })\n\n    if (!instance) {\n      return NextResponse.json({ error: 'Workflow instance not found' }, { status: 404 })\n    }\n\n    if (!isStepThroughArmed(instance)) {\n      return NextResponse.json(\n        { error: 'This instance is not running in step-through mode' },\n        { status: 400 },\n      )\n    }\n\n    if (validation.data.action === 'stop') {\n      instance.metadata = { ...(instance.metadata || {}), stepThrough: null }\n      instance.updatedAt = new Date()\n      await em.flush()\n    } else {\n      // The token is minted from the instance's own cursor, so a client can only\n      // ever release the step the run is actually parked on.\n      instance.metadata = {\n        ...(instance.metadata || {}),\n        stepThrough: releaseStepThrough(instance.currentStepId),\n      }\n      instance.updatedAt = new Date()\n      await em.flush()\n\n      await logWorkflowEvent(em, {\n        workflowInstanceId: instance.id,\n        eventType: STEP_THROUGH_RELEASED_EVENT_TYPE,\n        eventData: { stepId: instance.currentStepId },\n        userId: auth.sub,\n        tenantId,\n        organizationId: instance.organizationId,\n      })\n    }\n\n    // The instance was parked with PAUSED; every resume path flips it back to\n    // RUNNING before re-entering, and this one is no different.\n    if (instance.status === 'PAUSED') {\n      instance.status = 'RUNNING'\n      instance.pausedAt = null\n      instance.updatedAt = new Date()\n      await em.flush()\n    }\n\n    const result = await workflowExecutor.executeWorkflow(em, container, instance.id, {\n      userId: auth.sub,\n    })\n\n    return NextResponse.json({\n      data: {\n        instanceId: instance.id,\n        status: result.status,\n        currentStep: result.currentStep,\n        stepThrough: instance.metadata?.stepThrough ?? null,\n      },\n    })\n  } catch (error) {\n    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status })\n    logger.error('Error advancing step-through run', { err: error })\n    return NextResponse.json({ error: 'Failed to advance step-through run' }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'Step-through control',\n  pathParams: z.object({ id: z.string().uuid() }),\n  methods: {\n    POST: {\n      summary: 'Continue one step, or stop stepping',\n      description:\n        'Releases exactly the step the instance is currently parked on and resumes execution, or clears step-through so the run finishes on its own. To abort the run, use the cancel endpoint.',\n      requestBody: { schema: stepThroughInputSchema, example: { action: 'continue' } },\n      responses: [\n        {\n          status: 200,\n          description: 'The run advanced',\n          schema: z.object({\n            data: z.object({\n              instanceId: z.string(),\n              status: z.string(),\n              currentStep: z.string(),\n              stepThrough: z\n                .object({ enabled: z.literal(true), releaseStepId: z.string().nullable().optional() })\n                .nullable(),\n            }),\n          }),\n        },\n        { status: 400, description: 'Not a step-through run, or malformed payload', schema: workflowErrorSchema },\n        { status: 403, description: 'Insufficient permissions', schema: workflowErrorSchema },\n        { status: 404, description: 'Workflow instance not found', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAgBA,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,gCAAgC,yCAAyC;AAElF,SAAS,wBAAwB;AACjC,YAAY,sBAAsB;AAClC,SAAS,wBAAwB;AACjC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,cAAc,2BAA2B;AAClD,SAAS,oBAAoB;AAC7B,SAAS,uBAAuB;AAEhC,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,gCAAgC;AACpD;AAEA,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,QAAQ,EAAE,KAAK,CAAC,YAAY,MAAM,CAAC;AACrC,CAAC;AAMD,eAAsB,KAAK,SAAsB,SAAuB;AACtE,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ;AAC7B,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM,KAAK;AACd,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AACzE,UAAM,YAAY,+BAA+B,OAAO,IAAI;AAE5D,QAAI,CAAC,UAAU;AACb,aAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/E;AAEA,UAAM,cAAc,UAAU,QAAQ,aAAa;AAOnD,UAAM,UAAU,MAAM,YAAY;AAAA,MAChC,KAAK;AAAA,MACL,CAAC,gCAAgC;AAAA,MACjC,EAAE,UAAU,eAAe;AAAA,IAC7B;AACA,QAAI,CAAC,SAAS;AACZ,aAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjF;AAEA,UAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,UAAM,aAAa,uBAAuB,UAAU,IAAI;AACxD,QAAI,CAAC,WAAW,SAAS;AACvB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,qBAAqB,SAAS,WAAW,MAAM,OAAO;AAAA,QAC/D,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,WAAW,MAAM,GAAG,QAAQ,kBAAkB;AAAA,MAClD,IAAI,OAAO;AAAA,MACX;AAAA,MACA,GAAG,UAAU;AAAA,IACf,CAAC;AAED,QAAI,CAAC,UAAU;AACb,aAAO,aAAa,KAAK,EAAE,OAAO,8BAA8B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpF;AAEA,QAAI,CAAC,mBAAmB,QAAQ,GAAG;AACjC,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,oDAAoD;AAAA,QAC7D,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,QAAI,WAAW,KAAK,WAAW,QAAQ;AACrC,eAAS,WAAW,EAAE,GAAI,SAAS,YAAY,CAAC,GAAI,aAAa,KAAK;AACtE,eAAS,YAAY,oBAAI,KAAK;AAC9B,YAAM,GAAG,MAAM;AAAA,IACjB,OAAO;AAGL,eAAS,WAAW;AAAA,QAClB,GAAI,SAAS,YAAY,CAAC;AAAA,QAC1B,aAAa,mBAAmB,SAAS,aAAa;AAAA,MACxD;AACA,eAAS,YAAY,oBAAI,KAAK;AAC9B,YAAM,GAAG,MAAM;AAEf,YAAM,iBAAiB,IAAI;AAAA,QACzB,oBAAoB,SAAS;AAAA,QAC7B,WAAW;AAAA,QACX,WAAW,EAAE,QAAQ,SAAS,cAAc;AAAA,QAC5C,QAAQ,KAAK;AAAA,QACb;AAAA,QACA,gBAAgB,SAAS;AAAA,MAC3B,CAAC;AAAA,IACH;AAIA,QAAI,SAAS,WAAW,UAAU;AAChC,eAAS,SAAS;AAClB,eAAS,WAAW;AACpB,eAAS,YAAY,oBAAI,KAAK;AAC9B,YAAM,GAAG,MAAM;AAAA,IACjB;AAEA,UAAM,SAAS,MAAM,iBAAiB,gBAAgB,IAAI,WAAW,SAAS,IAAI;AAAA,MAChF,QAAQ,KAAK;AAAA,IACf,CAAC;AAED,WAAO,aAAa,KAAK;AAAA,MACvB,MAAM;AAAA,QACJ,YAAY,SAAS;AAAA,QACrB,QAAQ,OAAO;AAAA,QACf,aAAa,OAAO;AAAA,QACpB,aAAa,SAAS,UAAU,eAAe;AAAA,MACjD;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,EAAG,QAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AACzF,WAAO,MAAM,oCAAoC,EAAE,KAAK,MAAM,CAAC;AAC/D,WAAO,aAAa,KAAK,EAAE,OAAO,qCAAqC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EAC9C,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,QAAQ,wBAAwB,SAAS,EAAE,QAAQ,WAAW,EAAE;AAAA,MAC/E,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,MAAM,EAAE,OAAO;AAAA,cACb,YAAY,EAAE,OAAO;AAAA,cACrB,QAAQ,EAAE,OAAO;AAAA,cACjB,aAAa,EAAE,OAAO;AAAA,cACtB,aAAa,EACV,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI,GAAG,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,EACpF,SAAS;AAAA,YACd,CAAC;AAAA,UACH,CAAC;AAAA,QACH;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,gDAAgD,QAAQ,oBAAoB;AAAA,QACxG,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,+BAA+B,QAAQ,oBAAoB;AAAA,MACzF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/workflows/api/instances/route.js

@@ -5,7 +5,7 @@ import { parseBooleanToken } from "@open-mercato/shared/lib/boolean";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
-import { resolveOrganizationScopeFilter } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
+import { resolveOrganizationScopeFilter, resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { WorkflowInstance } from "../../data/entities.js";
 import {
   startWorkflowInputSchema,
@@ -23,6 +23,7 @@ import { findWorkflowDefinition } from "../../lib/find-definition.js";
 import { isComponentKind } from "../../lib/component-guard.js";
 import { buildStartedAtRange } from "../../lib/instance-date-filter.js";
 import { isWorkflowRunOutcome } from "../../lib/run-outcome.js";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 const logger = createLogger("workflows");
 const metadata = {
   requireAuth: true,
@@ -166,7 +167,7 @@ async function POST(request) {
     }
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request });
     const tenantId = auth.tenantId;
-    const organizationId = scope?.selectedId ?? auth.orgId;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth);
     if (!tenantId || !organizationId) {
       return NextResponse.json(
         { error: "Missing tenant or organization context" },
@@ -266,6 +267,7 @@ async function POST(request) {
       { status: 201 }
     );
   } catch (error) {
+    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status });
     logger.error("Error starting workflow", { err: error });
     if (error instanceof workflowExecutor.WorkflowExecutionError) {
       if (error.code === "DEFINITION_NOT_FOUND") {

package/dist/modules/workflows/api/instances/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/workflows/api/instances/route.ts"],
-  "sourcesContent": ["/**\n * Workflow Instances API\n *\n * Endpoints:\n * - GET /api/workflows/instances - List workflow instances\n * - POST /api/workflows/instances - Start a new workflow instance\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { raw } from '@mikro-orm/core'\nimport { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveOrganizationScopeFilter } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { WorkflowInstance } from '../../data/entities'\nimport {\n  startWorkflowInputSchema,\n  type StartWorkflowApiInput,\n  workflowInstanceStatusSchema,\n  workflowRunOutcomeSchema,\n} from '../../data/validators'\nimport {\n  workflowInstanceResponseSchema,\n  workflowBackgroundStartSchema,\n  paginationSchema,\n} from '../openapi'\nimport * as workflowExecutor from '../../lib/workflow-executor'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { findWorkflowDefinition } from '../../lib/find-definition'\nimport { isComponentKind } from '../../lib/component-guard'\nimport { buildStartedAtRange } from '../../lib/instance-date-filter'\nimport { isWorkflowRunOutcome } from '../../lib/run-outcome'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.instances.view'],\n}\n\n/**\n * GET /api/workflows/instances\n *\n * List workflow instances with optional filters\n */\nexport async function GET(request: NextRequest) {\n  try {\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const orgFilter = resolveOrganizationScopeFilter(scope, auth)\n\n    if (!tenantId) {\n      return NextResponse.json(\n        { error: 'Missing tenant context' },\n        { status: 400 }\n      )\n    }\n\n    const { searchParams } = new URL(request.url)\n    const workflowId = searchParams.get('workflowId')\n    const status = searchParams.get('status')\n    const outcome = searchParams.get('outcome')\n    const correlationKey = searchParams.get('correlationKey')\n    const entityType = searchParams.get('entityType')\n    const entityId = searchParams.get('entityId')\n    const parentInstanceId = searchParams.get('parentInstanceId')\n    const hasParent = parseBooleanToken(searchParams.get('hasParent'))\n    const attention = parseBooleanToken(searchParams.get('attention'))\n    const dryRun = parseBooleanToken(searchParams.get('dryRun'))\n    const limit = parseInt(searchParams.get('limit') || '50')\n    const offset = parseInt(searchParams.get('offset') || '0')\n\n    // Spec 8.3 run-list date filter. An unparseable bound is a 400, never a\n    // dropped predicate \u2014 a query built from an Invalid Date answers nothing\n    // while looking like it answered something.\n    const startedAtRange = buildStartedAtRange(\n      searchParams.get('startedFrom'),\n      searchParams.get('startedTo')\n    )\n    if (!startedAtRange.ok) {\n      return NextResponse.json({ error: startedAtRange.error }, { status: 400 })\n    }\n\n    // Build where clause with tenant scoping\n    const where: any = {\n      tenantId,\n      ...orgFilter.where,\n    }\n\n    if (workflowId) {\n      where.workflowId = workflowId\n    }\n\n    if (status) {\n      // Support comma-separated status values (e.g., \"RUNNING,PAUSED,WAITING_FOR_ACTIVITIES\")\n      const statuses = status.split(',').map(s => s.trim()).filter(Boolean)\n      if (statuses.length === 1) {\n        where.status = statuses[0]\n      } else if (statuses.length > 1) {\n        where.status = { $in: statuses }\n      }\n    }\n\n    // Outcome (the run's VERDICT) filters independently of `status` \u2014 the two\n    // answer different questions and a caller narrowing by one must not have\n    // the other narrowed for them. An unrecognised value is a 400 rather than a\n    // dropped predicate: a filter that silently matches everything is the exact\n    // invisible-omission failure this column exists to remove.\n    if (outcome) {\n      const requested = outcome.split(',').map((value) => value.trim()).filter(Boolean)\n      const invalid = requested.filter((value) => !isWorkflowRunOutcome(value))\n      if (invalid.length > 0) {\n        return NextResponse.json(\n          { error: `Unknown outcome: ${invalid.join(', ')}` },\n          { status: 400 }\n        )\n      }\n      if (requested.length === 1) {\n        where.outcome = requested[0]\n      } else if (requested.length > 1) {\n        where.outcome = { $in: requested }\n      }\n    }\n\n    if (correlationKey) {\n      where.correlationKey = correlationKey\n    }\n\n    // Simulations are excluded from the run list by DEFAULT (spec section 8.2:\n    // \"excludes the instance from KPIs\"). A caller that wants them asks for\n    // them with `dryRun=true`; `dryRun=false` is the same as omitting it.\n    where.isDryRun = dryRun === true\n\n    if (startedAtRange.range) {\n      where.startedAt = startedAtRange.range\n    }\n\n    // For JSONB metadata filtering, use $contains with explicit key-value pairs\n    // MikroORM's dot notation creates table joins, not JSON access\n    if (entityType || entityId) {\n      where.$and = where.$and || []\n      if (entityType) {\n        where.$and.push({\n          metadata: { $contains: { entityType: entityType } }\n        })\n      }\n      if (entityId) {\n        where.$and.push({\n          metadata: { $contains: { entityId: entityId } }\n        })\n      }\n    }\n\n    // Parent/sub-workflow filtering. The parent linkage is stored in\n    // metadata.labels.parentInstanceId (set by the SUB_WORKFLOW step handler).\n    // - parentInstanceId: return only the direct children of that parent\n    //   (JSONB containment; works for equality).\n    // - hasParent=false: return only top-level/standalone instances, and\n    //   hasParent=true only children. Absence of a key cannot be expressed via\n    //   $contains, so use a JSON-path predicate (null = IS NULL).\n    if (parentInstanceId) {\n      where.$and = where.$and || []\n      where.$and.push({\n        metadata: { $contains: { labels: { parentInstanceId } } },\n      })\n    } else if (hasParent !== null) {\n      where.$and = where.$and || []\n      // Unqualified column reference is unambiguous here \u2014 the instance list\n      // query is single-table (tenant/org scope adds predicates, not joins).\n      const parentIdPath = raw(`(metadata #>> '{labels,parentInstanceId}')`)\n      where.$and.push({ [parentIdPath]: hasParent ? { $ne: null } : null })\n    }\n\n    // Failure-queue park filter (spec 5.9): instances parked by a `failureQueue`\n    // error directive carry an engine-owned metadata.attention marker.\n    if (attention !== null) {\n      where.$and = where.$and || []\n      const attentionPath = raw(`(metadata #>> '{attention,reason}')`)\n      where.$and.push({ [attentionPath]: attention ? { $ne: null } : null })\n    }\n\n    const [instances, total] = await em.findAndCount(\n      WorkflowInstance,\n      where,\n      {\n        orderBy: { createdAt: 'DESC' },\n        limit,\n        offset,\n      }\n    )\n\n    return NextResponse.json({\n      data: instances,\n      pagination: {\n        total,\n        limit,\n        offset,\n        hasMore: offset + limit < total,\n      },\n    })\n  } catch (error) {\n    logger.error('Error listing workflow instances', { err: error })\n    return NextResponse.json(\n      { error: 'Failed to list workflow instances' },\n      { status: 500 }\n    )\n  }\n}\n\n/**\n * POST /api/workflows/instances\n *\n * Start a new workflow instance\n */\nexport async function POST(request: NextRequest) {\n  try {\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = scope?.selectedId ?? auth.orgId\n\n    if (!tenantId || !organizationId) {\n      return NextResponse.json(\n        { error: 'Missing tenant or organization context' },\n        { status: 400 }\n      )\n    }\n\n    // Check create permission\n    const rbacService = container.resolve('rbacService')\n    const hasPermission = await rbacService.userHasAllFeatures(\n      auth.sub,\n      ['workflows.instances.create'],\n      {\n        tenantId,\n        organizationId,\n      }\n    )\n\n    if (!hasPermission) {\n      return NextResponse.json(\n        { error: 'Insufficient permissions' },\n        { status: 403 }\n      )\n    }\n\n    const body = await request.json()\n\n    // Validate input\n    const validation = startWorkflowInputSchema.safeParse(body)\n    if (!validation.success) {\n      return NextResponse.json(\n        {\n          error: 'Validation failed',\n          details: validation.error.issues,\n        },\n        { status: 400 }\n      )\n    }\n\n    const input: StartWorkflowApiInput = validation.data\n\n    // Dry run (spec section 8.2) is the definition-author's test loop, not a\n    // way to start instances, so it carries its own grant on top of\n    // `instances.create` \u2014 the same feature the per-node Test step uses.\n    if (input.dryRun || input.stepThrough) {\n      const canTestRun = await rbacService.userHasAllFeatures(\n        auth.sub,\n        ['workflows.definitions.test_run'],\n        { tenantId, organizationId }\n      )\n      if (!canTestRun) {\n        return NextResponse.json(\n          { error: 'Insufficient permissions' },\n          { status: 403 }\n        )\n      }\n    }\n\n    // Reject standalone start of a reusable component. Components have no\n    // trigger and may only be invoked as a SUB_WORKFLOW; this guard lives on\n    // the manual-start path only, so sub-workflow invocation is unaffected.\n    const startDefinition = await findWorkflowDefinition(em, {\n      workflowId: input.workflowId,\n      version: input.version,\n      tenantId,\n      organizationId,\n    })\n    if (startDefinition && isComponentKind(startDefinition.kind)) {\n      return NextResponse.json(\n        { error: 'This workflow is a reusable component and cannot be started standalone; invoke it from a SUB_WORKFLOW step.' },\n        { status: 400 }\n      )\n    }\n\n    // Server-authoritative actor; do not trust client-supplied metadata.initiatedBy.\n    // The step-through marker is engine-owned for the same reason: it is set\n    // ONLY from the feature-gated flag above, never from client metadata.\n    const metadata = {\n      ...input.metadata,\n      initiatedBy: auth.sub,\n      ...(input.stepThrough ? { stepThrough: { enabled: true as const, releaseStepId: null } } : {}),\n    }\n\n    // Start workflow\n    const instance = await workflowExecutor.startWorkflow(em, {\n      workflowId: input.workflowId,\n      version: input.version,\n      initialContext: input.initialContext || {},\n      correlationKey: input.correlationKey,\n      metadata,\n      isDryRun: input.dryRun === true,\n      tenantId,\n      organizationId,\n    })\n\n    // Advance the workflow asynchronously after responding (non-blocking, so the\n    // frontend can poll step-by-step progress). This is a fire-and-forget task in\n    // this process \u2014 NOT a durable queue job \u2014 so it does not survive a process\n    // restart; the executor durably marks the instance FAILED on error, and the\n    // async-activity worker / retry endpoint resume any instance left mid-flight.\n    setImmediate(async () => {\n      try {\n        // Create new container and EM for background execution\n        const bgContainer = await createRequestContainer()\n        const bgEm = bgContainer.resolve('em')\n        await workflowExecutor.executeWorkflow(bgEm, bgContainer, instance.id, {\n          userId: auth.sub,\n        })\n      } catch (error) {\n        logger.error('Background workflow execution error', { err: error })\n      }\n    })\n\n    return NextResponse.json(\n      {\n        data: {\n          instance,\n          execution: {\n            status: instance.status,\n            currentStep: instance.currentStepId,\n            message: 'Workflow execution started',\n          },\n        },\n        message: 'Workflow started successfully',\n      },\n      { status: 201 }\n    )\n  } catch (error) {\n    logger.error('Error starting workflow', { err: error })\n\n    // Handle specific errors\n    if (error instanceof workflowExecutor.WorkflowExecutionError) {\n      if (error.code === 'DEFINITION_NOT_FOUND') {\n        return NextResponse.json(\n          { error: error.message },\n          { status: 404 }\n        )\n      }\n      if (error.code === 'DEFINITION_DISABLED') {\n        return NextResponse.json(\n          { error: error.message },\n          { status: 400 }\n        )\n      }\n      if (error.code === 'INVALID_DEFINITION') {\n        return NextResponse.json(\n          { error: error.message },\n          { status: 400 }\n        )\n      }\n      if (error.code === 'START_PRE_CONDITIONS_FAILED') {\n        return NextResponse.json(\n          {\n            error: error.message,\n            code: error.code,\n            details: error.details,\n          },\n          { status: 422 }\n        )\n      }\n    }\n\n    return NextResponse.json(\n      { error: 'Failed to start workflow' },\n      { status: 500 }\n    )\n  }\n}\n\nexport const openApi = {\n  methods: {\n    GET: {\n      summary: 'List workflow instances',\n      description: 'Get a list of workflow instances with optional filters. Supports pagination and filtering by status, workflowId, correlationKey, etc.',\n      tags: ['Workflows'],\n      query: z.object({\n        workflowId: z.string().optional(),\n        status: workflowInstanceStatusSchema.optional(),\n        outcome: workflowRunOutcomeSchema.optional().describe('Filter by the run VERDICT, independently of status. Comma-separated for several (e.g. partial_failure,failure). An unknown value is a 400.'),\n        correlationKey: z.string().optional(),\n        entityType: z.string().optional(),\n        entityId: z.string().optional(),\n        parentInstanceId: z.string().optional().describe('Return only direct sub-workflow children of this parent instance.'),\n        hasParent: z.boolean().optional().describe('false = only top-level/standalone instances; true = only sub-workflow children. Ignored when parentInstanceId is set.'),\n        attention: z.boolean().optional().describe('true = only instances parked by a failure-queue error directive; false = only instances without an attention marker.'),\n        startedFrom: z.string().optional().describe('Lower bound on startedAt. A calendar day (YYYY-MM-DD) is taken from 00:00:00.000Z; a full ISO timestamp is taken verbatim.'),\n        startedTo: z.string().optional().describe('Upper bound on startedAt, inclusive. A calendar day (YYYY-MM-DD) covers the whole day up to 23:59:59.999Z.'),\n        limit: z.number().int().positive().default(50).optional(),\n        offset: z.number().int().min(0).default(0).optional(),\n      }),\n      responses: [\n        {\n          status: 200,\n          description: 'List of workflow instances',\n          schema: z.object({\n            data: z.array(workflowInstanceResponseSchema),\n            pagination: paginationSchema,\n          }),\n        },\n        {\n          status: 400,\n          description: 'Invalid date range or unknown outcome',\n          schema: z.object({ error: z.string() }),\n        },\n        {\n          status: 401,\n          description: 'Unauthorized',\n          schema: z.object({ error: z.string() }),\n        },\n        {\n          status: 500,\n          description: 'Internal server error',\n          schema: z.object({ error: z.string() }),\n        },\n      ],\n    },\n    POST: {\n      summary: 'Start workflow instance',\n      description: 'Start a new workflow instance from a workflow definition. The workflow will execute immediately.',\n      tags: ['Workflows'],\n      requestBody: {\n        contentType: 'application/json',\n        schema: startWorkflowInputSchema,\n        description: 'Workflow instance configuration including workflowId, initial context, and metadata.',\n      },\n      responses: [\n        {\n          status: 201,\n          description: 'Workflow started successfully',\n          schema: z.object({\n            data: z.object({\n              instance: workflowInstanceResponseSchema,\n              execution: workflowBackgroundStartSchema,\n            }),\n            message: z.string(),\n          }),\n        },\n        {\n          status: 400,\n          description: 'Bad request - Validation failed or definition disabled/invalid',\n          schema: z.object({\n            error: z.string(),\n            details: z.any().optional(),\n          }),\n        },\n        {\n          status: 401,\n          description: 'Unauthorized',\n          schema: z.object({ error: z.string() }),\n        },\n        {\n          status: 403,\n          description: 'Forbidden - Insufficient permissions',\n          schema: z.object({ error: z.string() }),\n        },\n        {\n          status: 404,\n          description: 'Workflow definition not found',\n          schema: z.object({ error: z.string() }),\n        },\n        {\n          status: 500,\n          description: 'Internal server error',\n          schema: z.object({ error: z.string() }),\n        },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAQA,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAClB,SAAS,WAAW;AACpB,SAAS,yBAAyB;AAClC,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,sCAAsC;AAC/C,SAAS,wBAAwB;AACjC;AAAA,EACE;AAAA,EAEA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,YAAY,sBAAsB;AAClC,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,uBAAuB;AAChC,SAAS,2BAA2B;AACpC,SAAS,4BAA4B;AAErC,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,0BAA0B;AAC9C;AAOA,eAAsB,IAAI,SAAsB;AAC9C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,YAAY,+BAA+B,OAAO,IAAI;AAE5D,QAAI,CAAC,UAAU;AACb,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,yBAAyB;AAAA,QAClC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,EAAE,aAAa,IAAI,IAAI,IAAI,QAAQ,GAAG;AAC5C,UAAM,aAAa,aAAa,IAAI,YAAY;AAChD,UAAM,SAAS,aAAa,IAAI,QAAQ;AACxC,UAAM,UAAU,aAAa,IAAI,SAAS;AAC1C,UAAM,iBAAiB,aAAa,IAAI,gBAAgB;AACxD,UAAM,aAAa,aAAa,IAAI,YAAY;AAChD,UAAM,WAAW,aAAa,IAAI,UAAU;AAC5C,UAAM,mBAAmB,aAAa,IAAI,kBAAkB;AAC5D,UAAM,YAAY,kBAAkB,aAAa,IAAI,WAAW,CAAC;AACjE,UAAM,YAAY,kBAAkB,aAAa,IAAI,WAAW,CAAC;AACjE,UAAM,SAAS,kBAAkB,aAAa,IAAI,QAAQ,CAAC;AAC3D,UAAM,QAAQ,SAAS,aAAa,IAAI,OAAO,KAAK,IAAI;AACxD,UAAM,SAAS,SAAS,aAAa,IAAI,QAAQ,KAAK,GAAG;AAKzD,UAAM,iBAAiB;AAAA,MACrB,aAAa,IAAI,aAAa;AAAA,MAC9B,aAAa,IAAI,WAAW;AAAA,IAC9B;AACA,QAAI,CAAC,eAAe,IAAI;AACtB,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,MAAM,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3E;AAGA,UAAM,QAAa;AAAA,MACjB;AAAA,MACA,GAAG,UAAU;AAAA,IACf;AAEA,QAAI,YAAY;AACd,YAAM,aAAa;AAAA,IACrB;AAEA,QAAI,QAAQ;AAEV,YAAM,WAAW,OAAO,MAAM,GAAG,EAAE,IAAI,OAAK,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO;AACpE,UAAI,SAAS,WAAW,GAAG;AACzB,cAAM,SAAS,SAAS,CAAC;AAAA,MAC3B,WAAW,SAAS,SAAS,GAAG;AAC9B,cAAM,SAAS,EAAE,KAAK,SAAS;AAAA,MACjC;AAAA,IACF;AAOA,QAAI,SAAS;AACX,YAAM,YAAY,QAAQ,MAAM,GAAG,EAAE,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,OAAO,OAAO;AAChF,YAAM,UAAU,UAAU,OAAO,CAAC,UAAU,CAAC,qBAAqB,KAAK,CAAC;AACxE,UAAI,QAAQ,SAAS,GAAG;AACtB,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,oBAAoB,QAAQ,KAAK,IAAI,CAAC,GAAG;AAAA,UAClD,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,UAAI,UAAU,WAAW,GAAG;AAC1B,cAAM,UAAU,UAAU,CAAC;AAAA,MAC7B,WAAW,UAAU,SAAS,GAAG;AAC/B,cAAM,UAAU,EAAE,KAAK,UAAU;AAAA,MACnC;AAAA,IACF;AAEA,QAAI,gBAAgB;AAClB,YAAM,iBAAiB;AAAA,IACzB;AAKA,UAAM,WAAW,WAAW;AAE5B,QAAI,eAAe,OAAO;AACxB,YAAM,YAAY,eAAe;AAAA,IACnC;AAIA,QAAI,cAAc,UAAU;AAC1B,YAAM,OAAO,MAAM,QAAQ,CAAC;AAC5B,UAAI,YAAY;AACd,cAAM,KAAK,KAAK;AAAA,UACd,UAAU,EAAE,WAAW,EAAE,WAAuB,EAAE;AAAA,QACpD,CAAC;AAAA,MACH;AACA,UAAI,UAAU;AACZ,cAAM,KAAK,KAAK;AAAA,UACd,UAAU,EAAE,WAAW,EAAE,SAAmB,EAAE;AAAA,QAChD,CAAC;AAAA,MACH;AAAA,IACF;AASA,QAAI,kBAAkB;AACpB,YAAM,OAAO,MAAM,QAAQ,CAAC;AAC5B,YAAM,KAAK,KAAK;AAAA,QACd,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,iBAAiB,EAAE,EAAE;AAAA,MAC1D,CAAC;AAAA,IACH,WAAW,cAAc,MAAM;AAC7B,YAAM,OAAO,MAAM,QAAQ,CAAC;AAG5B,YAAM,eAAe,IAAI,4CAA4C;AACrE,YAAM,KAAK,KAAK,EAAE,CAAC,YAAY,GAAG,YAAY,EAAE,KAAK,KAAK,IAAI,KAAK,CAAC;AAAA,IACtE;AAIA,QAAI,cAAc,MAAM;AACtB,YAAM,OAAO,MAAM,QAAQ,CAAC;AAC5B,YAAM,gBAAgB,IAAI,qCAAqC;AAC/D,YAAM,KAAK,KAAK,EAAE,CAAC,aAAa,GAAG,YAAY,EAAE,KAAK,KAAK,IAAI,KAAK,CAAC;AAAA,IACvE;AAEA,UAAM,CAAC,WAAW,KAAK,IAAI,MAAM,GAAG;AAAA,MAClC;AAAA,MACA;AAAA,MACA;AAAA,QACE,SAAS,EAAE,WAAW,OAAO;AAAA,QAC7B;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,MAAM;AAAA,MACN,YAAY;AAAA,QACV;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS,SAAS,QAAQ;AAAA,MAC5B;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,oCAAoC,EAAE,KAAK,MAAM,CAAC;AAC/D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,oCAAoC;AAAA,MAC7C,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAOA,eAAsB,KAAK,SAAsB;AAC/C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,cAAc,KAAK;AAEjD,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,yCAAyC;AAAA,QAClD,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAGA,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,UAAM,gBAAgB,MAAM,YAAY;AAAA,MACtC,KAAK;AAAA,MACL,CAAC,4BAA4B;AAAA,MAC7B;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,2BAA2B;AAAA,QACpC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,OAAO,MAAM,QAAQ,KAAK;AAGhC,UAAM,aAAa,yBAAyB,UAAU,IAAI;AAC1D,QAAI,CAAC,WAAW,SAAS;AACvB,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO;AAAA,UACP,SAAS,WAAW,MAAM;AAAA,QAC5B;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,QAA+B,WAAW;AAKhD,QAAI,MAAM,UAAU,MAAM,aAAa;AACrC,YAAM,aAAa,MAAM,YAAY;AAAA,QACnC,KAAK;AAAA,QACL,CAAC,gCAAgC;AAAA,QACjC,EAAE,UAAU,eAAe;AAAA,MAC7B;AACA,UAAI,CAAC,YAAY;AACf,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,2BAA2B;AAAA,UACpC,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAKA,UAAM,kBAAkB,MAAM,uBAAuB,IAAI;AAAA,MACvD,YAAY,MAAM;AAAA,MAClB,SAAS,MAAM;AAAA,MACf;AAAA,MACA;AAAA,IACF,CAAC;AACD,QAAI,mBAAmB,gBAAgB,gBAAgB,IAAI,GAAG;AAC5D,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,8GAA8G;AAAA,QACvH,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAKA,UAAMA,YAAW;AAAA,MACf,GAAG,MAAM;AAAA,MACT,aAAa,KAAK;AAAA,MAClB,GAAI,MAAM,cAAc,EAAE,aAAa,EAAE,SAAS,MAAe,eAAe,KAAK,EAAE,IAAI,CAAC;AAAA,IAC9F;AAGA,UAAM,WAAW,MAAM,iBAAiB,cAAc,IAAI;AAAA,MACxD,YAAY,MAAM;AAAA,MAClB,SAAS,MAAM;AAAA,MACf,gBAAgB,MAAM,kBAAkB,CAAC;AAAA,MACzC,gBAAgB,MAAM;AAAA,MACtB,UAAAA;AAAA,MACA,UAAU,MAAM,WAAW;AAAA,MAC3B;AAAA,MACA;AAAA,IACF,CAAC;AAOD,iBAAa,YAAY;AACvB,UAAI;AAEF,cAAM,cAAc,MAAM,uBAAuB;AACjD,cAAM,OAAO,YAAY,QAAQ,IAAI;AACrC,cAAM,iBAAiB,gBAAgB,MAAM,aAAa,SAAS,IAAI;AAAA,UACrE,QAAQ,KAAK;AAAA,QACf,CAAC;AAAA,MACH,SAAS,OAAO;AACd,eAAO,MAAM,uCAAuC,EAAE,KAAK,MAAM,CAAC;AAAA,MACpE;AAAA,IACF,CAAC;AAED,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,MAAM;AAAA,UACJ;AAAA,UACA,WAAW;AAAA,YACT,QAAQ,SAAS;AAAA,YACjB,aAAa,SAAS;AAAA,YACtB,SAAS;AAAA,UACX;AAAA,QACF;AAAA,QACA,SAAS;AAAA,MACX;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF,SAAS,OAAO;AACd,WAAO,MAAM,2BAA2B,EAAE,KAAK,MAAM,CAAC;AAGtD,QAAI,iBAAiB,iBAAiB,wBAAwB;AAC5D,UAAI,MAAM,SAAS,wBAAwB;AACzC,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,MAAM,QAAQ;AAAA,UACvB,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,UAAI,MAAM,SAAS,uBAAuB;AACxC,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,MAAM,QAAQ;AAAA,UACvB,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,UAAI,MAAM,SAAS,sBAAsB;AACvC,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,MAAM,QAAQ;AAAA,UACvB,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,UAAI,MAAM,SAAS,+BAA+B;AAChD,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,OAAO,MAAM;AAAA,YACb,MAAM,MAAM;AAAA,YACZ,SAAS,MAAM;AAAA,UACjB;AAAA,UACA,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAEA,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,2BAA2B;AAAA,MACpC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,MAAM,CAAC,WAAW;AAAA,MAClB,OAAO,EAAE,OAAO;AAAA,QACd,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,QAChC,QAAQ,6BAA6B,SAAS;AAAA,QAC9C,SAAS,yBAAyB,SAAS,EAAE,SAAS,4IAA4I;AAAA,QAClM,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,QACpC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,QAChC,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,QAC9B,kBAAkB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,mEAAmE;AAAA,QACpH,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,uHAAuH;AAAA,QAClK,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,sHAAsH;AAAA,QACjK,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,4HAA4H;AAAA,QACxK,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,4GAA4G;AAAA,QACtJ,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,SAAS;AAAA,QACxD,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,MACtD,CAAC;AAAA,MACD,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,MAAM,EAAE,MAAM,8BAA8B;AAAA,YAC5C,YAAY;AAAA,UACd,CAAC;AAAA,QACH;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,MAAM,CAAC,WAAW;AAAA,MAClB,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,QACR,aAAa;AAAA,MACf;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,MAAM,EAAE,OAAO;AAAA,cACb,UAAU;AAAA,cACV,WAAW;AAAA,YACb,CAAC;AAAA,YACD,SAAS,EAAE,OAAO;AAAA,UACpB,CAAC;AAAA,QACH;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,OAAO,EAAE,OAAO;AAAA,YAChB,SAAS,EAAE,IAAI,EAAE,SAAS;AAAA,UAC5B,CAAC;AAAA,QACH;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * Workflow Instances API\n *\n * Endpoints:\n * - GET /api/workflows/instances - List workflow instances\n * - POST /api/workflows/instances - Start a new workflow instance\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { raw } from '@mikro-orm/core'\nimport { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveOrganizationScopeFilter, resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { WorkflowInstance } from '../../data/entities'\nimport {\n  startWorkflowInputSchema,\n  type StartWorkflowApiInput,\n  workflowInstanceStatusSchema,\n  workflowRunOutcomeSchema,\n} from '../../data/validators'\nimport {\n  workflowInstanceResponseSchema,\n  workflowBackgroundStartSchema,\n  paginationSchema,\n} from '../openapi'\nimport * as workflowExecutor from '../../lib/workflow-executor'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { findWorkflowDefinition } from '../../lib/find-definition'\nimport { isComponentKind } from '../../lib/component-guard'\nimport { buildStartedAtRange } from '../../lib/instance-date-filter'\nimport { isWorkflowRunOutcome } from '../../lib/run-outcome'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.instances.view'],\n}\n\n/**\n * GET /api/workflows/instances\n *\n * List workflow instances with optional filters\n */\nexport async function GET(request: NextRequest) {\n  try {\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const orgFilter = resolveOrganizationScopeFilter(scope, auth)\n\n    if (!tenantId) {\n      return NextResponse.json(\n        { error: 'Missing tenant context' },\n        { status: 400 }\n      )\n    }\n\n    const { searchParams } = new URL(request.url)\n    const workflowId = searchParams.get('workflowId')\n    const status = searchParams.get('status')\n    const outcome = searchParams.get('outcome')\n    const correlationKey = searchParams.get('correlationKey')\n    const entityType = searchParams.get('entityType')\n    const entityId = searchParams.get('entityId')\n    const parentInstanceId = searchParams.get('parentInstanceId')\n    const hasParent = parseBooleanToken(searchParams.get('hasParent'))\n    const attention = parseBooleanToken(searchParams.get('attention'))\n    const dryRun = parseBooleanToken(searchParams.get('dryRun'))\n    const limit = parseInt(searchParams.get('limit') || '50')\n    const offset = parseInt(searchParams.get('offset') || '0')\n\n    // Spec 8.3 run-list date filter. An unparseable bound is a 400, never a\n    // dropped predicate \u2014 a query built from an Invalid Date answers nothing\n    // while looking like it answered something.\n    const startedAtRange = buildStartedAtRange(\n      searchParams.get('startedFrom'),\n      searchParams.get('startedTo')\n    )\n    if (!startedAtRange.ok) {\n      return NextResponse.json({ error: startedAtRange.error }, { status: 400 })\n    }\n\n    // Build where clause with tenant scoping\n    const where: any = {\n      tenantId,\n      ...orgFilter.where,\n    }\n\n    if (workflowId) {\n      where.workflowId = workflowId\n    }\n\n    if (status) {\n      // Support comma-separated status values (e.g., \"RUNNING,PAUSED,WAITING_FOR_ACTIVITIES\")\n      const statuses = status.split(',').map(s => s.trim()).filter(Boolean)\n      if (statuses.length === 1) {\n        where.status = statuses[0]\n      } else if (statuses.length > 1) {\n        where.status = { $in: statuses }\n      }\n    }\n\n    // Outcome (the run's VERDICT) filters independently of `status` \u2014 the two\n    // answer different questions and a caller narrowing by one must not have\n    // the other narrowed for them. An unrecognised value is a 400 rather than a\n    // dropped predicate: a filter that silently matches everything is the exact\n    // invisible-omission failure this column exists to remove.\n    if (outcome) {\n      const requested = outcome.split(',').map((value) => value.trim()).filter(Boolean)\n      const invalid = requested.filter((value) => !isWorkflowRunOutcome(value))\n      if (invalid.length > 0) {\n        return NextResponse.json(\n          { error: `Unknown outcome: ${invalid.join(', ')}` },\n          { status: 400 }\n        )\n      }\n      if (requested.length === 1) {\n        where.outcome = requested[0]\n      } else if (requested.length > 1) {\n        where.outcome = { $in: requested }\n      }\n    }\n\n    if (correlationKey) {\n      where.correlationKey = correlationKey\n    }\n\n    // Simulations are excluded from the run list by DEFAULT (spec section 8.2:\n    // \"excludes the instance from KPIs\"). A caller that wants them asks for\n    // them with `dryRun=true`; `dryRun=false` is the same as omitting it.\n    where.isDryRun = dryRun === true\n\n    if (startedAtRange.range) {\n      where.startedAt = startedAtRange.range\n    }\n\n    // For JSONB metadata filtering, use $contains with explicit key-value pairs\n    // MikroORM's dot notation creates table joins, not JSON access\n    if (entityType || entityId) {\n      where.$and = where.$and || []\n      if (entityType) {\n        where.$and.push({\n          metadata: { $contains: { entityType: entityType } }\n        })\n      }\n      if (entityId) {\n        where.$and.push({\n          metadata: { $contains: { entityId: entityId } }\n        })\n      }\n    }\n\n    // Parent/sub-workflow filtering. The parent linkage is stored in\n    // metadata.labels.parentInstanceId (set by the SUB_WORKFLOW step handler).\n    // - parentInstanceId: return only the direct children of that parent\n    //   (JSONB containment; works for equality).\n    // - hasParent=false: return only top-level/standalone instances, and\n    //   hasParent=true only children. Absence of a key cannot be expressed via\n    //   $contains, so use a JSON-path predicate (null = IS NULL).\n    if (parentInstanceId) {\n      where.$and = where.$and || []\n      where.$and.push({\n        metadata: { $contains: { labels: { parentInstanceId } } },\n      })\n    } else if (hasParent !== null) {\n      where.$and = where.$and || []\n      // Unqualified column reference is unambiguous here \u2014 the instance list\n      // query is single-table (tenant/org scope adds predicates, not joins).\n      const parentIdPath = raw(`(metadata #>> '{labels,parentInstanceId}')`)\n      where.$and.push({ [parentIdPath]: hasParent ? { $ne: null } : null })\n    }\n\n    // Failure-queue park filter (spec 5.9): instances parked by a `failureQueue`\n    // error directive carry an engine-owned metadata.attention marker.\n    if (attention !== null) {\n      where.$and = where.$and || []\n      const attentionPath = raw(`(metadata #>> '{attention,reason}')`)\n      where.$and.push({ [attentionPath]: attention ? { $ne: null } : null })\n    }\n\n    const [instances, total] = await em.findAndCount(\n      WorkflowInstance,\n      where,\n      {\n        orderBy: { createdAt: 'DESC' },\n        limit,\n        offset,\n      }\n    )\n\n    return NextResponse.json({\n      data: instances,\n      pagination: {\n        total,\n        limit,\n        offset,\n        hasMore: offset + limit < total,\n      },\n    })\n  } catch (error) {\n    logger.error('Error listing workflow instances', { err: error })\n    return NextResponse.json(\n      { error: 'Failed to list workflow instances' },\n      { status: 500 }\n    )\n  }\n}\n\n/**\n * POST /api/workflows/instances\n *\n * Start a new workflow instance\n */\nexport async function POST(request: NextRequest) {\n  try {\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth)\n\n    if (!tenantId || !organizationId) {\n      return NextResponse.json(\n        { error: 'Missing tenant or organization context' },\n        { status: 400 }\n      )\n    }\n\n    // Check create permission\n    const rbacService = container.resolve('rbacService')\n    const hasPermission = await rbacService.userHasAllFeatures(\n      auth.sub,\n      ['workflows.instances.create'],\n      {\n        tenantId,\n        organizationId,\n      }\n    )\n\n    if (!hasPermission) {\n      return NextResponse.json(\n        { error: 'Insufficient permissions' },\n        { status: 403 }\n      )\n    }\n\n    const body = await request.json()\n\n    // Validate input\n    const validation = startWorkflowInputSchema.safeParse(body)\n    if (!validation.success) {\n      return NextResponse.json(\n        {\n          error: 'Validation failed',\n          details: validation.error.issues,\n        },\n        { status: 400 }\n      )\n    }\n\n    const input: StartWorkflowApiInput = validation.data\n\n    // Dry run (spec section 8.2) is the definition-author's test loop, not a\n    // way to start instances, so it carries its own grant on top of\n    // `instances.create` \u2014 the same feature the per-node Test step uses.\n    if (input.dryRun || input.stepThrough) {\n      const canTestRun = await rbacService.userHasAllFeatures(\n        auth.sub,\n        ['workflows.definitions.test_run'],\n        { tenantId, organizationId }\n      )\n      if (!canTestRun) {\n        return NextResponse.json(\n          { error: 'Insufficient permissions' },\n          { status: 403 }\n        )\n      }\n    }\n\n    // Reject standalone start of a reusable component. Components have no\n    // trigger and may only be invoked as a SUB_WORKFLOW; this guard lives on\n    // the manual-start path only, so sub-workflow invocation is unaffected.\n    const startDefinition = await findWorkflowDefinition(em, {\n      workflowId: input.workflowId,\n      version: input.version,\n      tenantId,\n      organizationId,\n    })\n    if (startDefinition && isComponentKind(startDefinition.kind)) {\n      return NextResponse.json(\n        { error: 'This workflow is a reusable component and cannot be started standalone; invoke it from a SUB_WORKFLOW step.' },\n        { status: 400 }\n      )\n    }\n\n    // Server-authoritative actor; do not trust client-supplied metadata.initiatedBy.\n    // The step-through marker is engine-owned for the same reason: it is set\n    // ONLY from the feature-gated flag above, never from client metadata.\n    const metadata = {\n      ...input.metadata,\n      initiatedBy: auth.sub,\n      ...(input.stepThrough ? { stepThrough: { enabled: true as const, releaseStepId: null } } : {}),\n    }\n\n    // Start workflow\n    const instance = await workflowExecutor.startWorkflow(em, {\n      workflowId: input.workflowId,\n      version: input.version,\n      initialContext: input.initialContext || {},\n      correlationKey: input.correlationKey,\n      metadata,\n      isDryRun: input.dryRun === true,\n      tenantId,\n      organizationId,\n    })\n\n    // Advance the workflow asynchronously after responding (non-blocking, so the\n    // frontend can poll step-by-step progress). This is a fire-and-forget task in\n    // this process \u2014 NOT a durable queue job \u2014 so it does not survive a process\n    // restart; the executor durably marks the instance FAILED on error, and the\n    // async-activity worker / retry endpoint resume any instance left mid-flight.\n    setImmediate(async () => {\n      try {\n        // Create new container and EM for background execution\n        const bgContainer = await createRequestContainer()\n        const bgEm = bgContainer.resolve('em')\n        await workflowExecutor.executeWorkflow(bgEm, bgContainer, instance.id, {\n          userId: auth.sub,\n        })\n      } catch (error) {\n        logger.error('Background workflow execution error', { err: error })\n      }\n    })\n\n    return NextResponse.json(\n      {\n        data: {\n          instance,\n          execution: {\n            status: instance.status,\n            currentStep: instance.currentStepId,\n            message: 'Workflow execution started',\n          },\n        },\n        message: 'Workflow started successfully',\n      },\n      { status: 201 }\n    )\n  } catch (error) {\n    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status })\n    logger.error('Error starting workflow', { err: error })\n\n    // Handle specific errors\n    if (error instanceof workflowExecutor.WorkflowExecutionError) {\n      if (error.code === 'DEFINITION_NOT_FOUND') {\n        return NextResponse.json(\n          { error: error.message },\n          { status: 404 }\n        )\n      }\n      if (error.code === 'DEFINITION_DISABLED') {\n        return NextResponse.json(\n          { error: error.message },\n          { status: 400 }\n        )\n      }\n      if (error.code === 'INVALID_DEFINITION') {\n        return NextResponse.json(\n          { error: error.message },\n          { status: 400 }\n        )\n      }\n      if (error.code === 'START_PRE_CONDITIONS_FAILED') {\n        return NextResponse.json(\n          {\n            error: error.message,\n            code: error.code,\n            details: error.details,\n          },\n          { status: 422 }\n        )\n      }\n    }\n\n    return NextResponse.json(\n      { error: 'Failed to start workflow' },\n      { status: 500 }\n    )\n  }\n}\n\nexport const openApi = {\n  methods: {\n    GET: {\n      summary: 'List workflow instances',\n      description: 'Get a list of workflow instances with optional filters. Supports pagination and filtering by status, workflowId, correlationKey, etc.',\n      tags: ['Workflows'],\n      query: z.object({\n        workflowId: z.string().optional(),\n        status: workflowInstanceStatusSchema.optional(),\n        outcome: workflowRunOutcomeSchema.optional().describe('Filter by the run VERDICT, independently of status. Comma-separated for several (e.g. partial_failure,failure). An unknown value is a 400.'),\n        correlationKey: z.string().optional(),\n        entityType: z.string().optional(),\n        entityId: z.string().optional(),\n        parentInstanceId: z.string().optional().describe('Return only direct sub-workflow children of this parent instance.'),\n        hasParent: z.boolean().optional().describe('false = only top-level/standalone instances; true = only sub-workflow children. Ignored when parentInstanceId is set.'),\n        attention: z.boolean().optional().describe('true = only instances parked by a failure-queue error directive; false = only instances without an attention marker.'),\n        startedFrom: z.string().optional().describe('Lower bound on startedAt. A calendar day (YYYY-MM-DD) is taken from 00:00:00.000Z; a full ISO timestamp is taken verbatim.'),\n        startedTo: z.string().optional().describe('Upper bound on startedAt, inclusive. A calendar day (YYYY-MM-DD) covers the whole day up to 23:59:59.999Z.'),\n        limit: z.number().int().positive().default(50).optional(),\n        offset: z.number().int().min(0).default(0).optional(),\n      }),\n      responses: [\n        {\n          status: 200,\n          description: 'List of workflow instances',\n          schema: z.object({\n            data: z.array(workflowInstanceResponseSchema),\n            pagination: paginationSchema,\n          }),\n        },\n        {\n          status: 400,\n          description: 'Invalid date range or unknown outcome',\n          schema: z.object({ error: z.string() }),\n        },\n        {\n          status: 401,\n          description: 'Unauthorized',\n          schema: z.object({ error: z.string() }),\n        },\n        {\n          status: 500,\n          description: 'Internal server error',\n          schema: z.object({ error: z.string() }),\n        },\n      ],\n    },\n    POST: {\n      summary: 'Start workflow instance',\n      description: 'Start a new workflow instance from a workflow definition. The workflow will execute immediately.',\n      tags: ['Workflows'],\n      requestBody: {\n        contentType: 'application/json',\n        schema: startWorkflowInputSchema,\n        description: 'Workflow instance configuration including workflowId, initial context, and metadata.',\n      },\n      responses: [\n        {\n          status: 201,\n          description: 'Workflow started successfully',\n          schema: z.object({\n            data: z.object({\n              instance: workflowInstanceResponseSchema,\n              execution: workflowBackgroundStartSchema,\n            }),\n            message: z.string(),\n          }),\n        },\n        {\n          status: 400,\n          description: 'Bad request - Validation failed or definition disabled/invalid',\n          schema: z.object({\n            error: z.string(),\n            details: z.any().optional(),\n          }),\n        },\n        {\n          status: 401,\n          description: 'Unauthorized',\n          schema: z.object({ error: z.string() }),\n        },\n        {\n          status: 403,\n          description: 'Forbidden - Insufficient permissions',\n          schema: z.object({ error: z.string() }),\n        },\n        {\n          status: 404,\n          description: 'Workflow definition not found',\n          schema: z.object({ error: z.string() }),\n        },\n        {\n          status: 500,\n          description: 'Internal server error',\n          schema: z.object({ error: z.string() }),\n        },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAQA,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAClB,SAAS,WAAW;AACpB,SAAS,yBAAyB;AAClC,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,gCAAgC,yCAAyC;AAClF,SAAS,wBAAwB;AACjC;AAAA,EACE;AAAA,EAEA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,YAAY,sBAAsB;AAClC,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,uBAAuB;AAChC,SAAS,2BAA2B;AACpC,SAAS,4BAA4B;AACrC,SAAS,uBAAuB;AAEhC,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,0BAA0B;AAC9C;AAOA,eAAsB,IAAI,SAAsB;AAC9C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,YAAY,+BAA+B,OAAO,IAAI;AAE5D,QAAI,CAAC,UAAU;AACb,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,yBAAyB;AAAA,QAClC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,EAAE,aAAa,IAAI,IAAI,IAAI,QAAQ,GAAG;AAC5C,UAAM,aAAa,aAAa,IAAI,YAAY;AAChD,UAAM,SAAS,aAAa,IAAI,QAAQ;AACxC,UAAM,UAAU,aAAa,IAAI,SAAS;AAC1C,UAAM,iBAAiB,aAAa,IAAI,gBAAgB;AACxD,UAAM,aAAa,aAAa,IAAI,YAAY;AAChD,UAAM,WAAW,aAAa,IAAI,UAAU;AAC5C,UAAM,mBAAmB,aAAa,IAAI,kBAAkB;AAC5D,UAAM,YAAY,kBAAkB,aAAa,IAAI,WAAW,CAAC;AACjE,UAAM,YAAY,kBAAkB,aAAa,IAAI,WAAW,CAAC;AACjE,UAAM,SAAS,kBAAkB,aAAa,IAAI,QAAQ,CAAC;AAC3D,UAAM,QAAQ,SAAS,aAAa,IAAI,OAAO,KAAK,IAAI;AACxD,UAAM,SAAS,SAAS,aAAa,IAAI,QAAQ,KAAK,GAAG;AAKzD,UAAM,iBAAiB;AAAA,MACrB,aAAa,IAAI,aAAa;AAAA,MAC9B,aAAa,IAAI,WAAW;AAAA,IAC9B;AACA,QAAI,CAAC,eAAe,IAAI;AACtB,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,MAAM,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3E;AAGA,UAAM,QAAa;AAAA,MACjB;AAAA,MACA,GAAG,UAAU;AAAA,IACf;AAEA,QAAI,YAAY;AACd,YAAM,aAAa;AAAA,IACrB;AAEA,QAAI,QAAQ;AAEV,YAAM,WAAW,OAAO,MAAM,GAAG,EAAE,IAAI,OAAK,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO;AACpE,UAAI,SAAS,WAAW,GAAG;AACzB,cAAM,SAAS,SAAS,CAAC;AAAA,MAC3B,WAAW,SAAS,SAAS,GAAG;AAC9B,cAAM,SAAS,EAAE,KAAK,SAAS;AAAA,MACjC;AAAA,IACF;AAOA,QAAI,SAAS;AACX,YAAM,YAAY,QAAQ,MAAM,GAAG,EAAE,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,OAAO,OAAO;AAChF,YAAM,UAAU,UAAU,OAAO,CAAC,UAAU,CAAC,qBAAqB,KAAK,CAAC;AACxE,UAAI,QAAQ,SAAS,GAAG;AACtB,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,oBAAoB,QAAQ,KAAK,IAAI,CAAC,GAAG;AAAA,UAClD,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,UAAI,UAAU,WAAW,GAAG;AAC1B,cAAM,UAAU,UAAU,CAAC;AAAA,MAC7B,WAAW,UAAU,SAAS,GAAG;AAC/B,cAAM,UAAU,EAAE,KAAK,UAAU;AAAA,MACnC;AAAA,IACF;AAEA,QAAI,gBAAgB;AAClB,YAAM,iBAAiB;AAAA,IACzB;AAKA,UAAM,WAAW,WAAW;AAE5B,QAAI,eAAe,OAAO;AACxB,YAAM,YAAY,eAAe;AAAA,IACnC;AAIA,QAAI,cAAc,UAAU;AAC1B,YAAM,OAAO,MAAM,QAAQ,CAAC;AAC5B,UAAI,YAAY;AACd,cAAM,KAAK,KAAK;AAAA,UACd,UAAU,EAAE,WAAW,EAAE,WAAuB,EAAE;AAAA,QACpD,CAAC;AAAA,MACH;AACA,UAAI,UAAU;AACZ,cAAM,KAAK,KAAK;AAAA,UACd,UAAU,EAAE,WAAW,EAAE,SAAmB,EAAE;AAAA,QAChD,CAAC;AAAA,MACH;AAAA,IACF;AASA,QAAI,kBAAkB;AACpB,YAAM,OAAO,MAAM,QAAQ,CAAC;AAC5B,YAAM,KAAK,KAAK;AAAA,QACd,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,iBAAiB,EAAE,EAAE;AAAA,MAC1D,CAAC;AAAA,IACH,WAAW,cAAc,MAAM;AAC7B,YAAM,OAAO,MAAM,QAAQ,CAAC;AAG5B,YAAM,eAAe,IAAI,4CAA4C;AACrE,YAAM,KAAK,KAAK,EAAE,CAAC,YAAY,GAAG,YAAY,EAAE,KAAK,KAAK,IAAI,KAAK,CAAC;AAAA,IACtE;AAIA,QAAI,cAAc,MAAM;AACtB,YAAM,OAAO,MAAM,QAAQ,CAAC;AAC5B,YAAM,gBAAgB,IAAI,qCAAqC;AAC/D,YAAM,KAAK,KAAK,EAAE,CAAC,aAAa,GAAG,YAAY,EAAE,KAAK,KAAK,IAAI,KAAK,CAAC;AAAA,IACvE;AAEA,UAAM,CAAC,WAAW,KAAK,IAAI,MAAM,GAAG;AAAA,MAClC;AAAA,MACA;AAAA,MACA;AAAA,QACE,SAAS,EAAE,WAAW,OAAO;AAAA,QAC7B;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,MAAM;AAAA,MACN,YAAY;AAAA,QACV;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS,SAAS,QAAQ;AAAA,MAC5B;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,oCAAoC,EAAE,KAAK,MAAM,CAAC;AAC/D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,oCAAoC;AAAA,MAC7C,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAOA,eAAsB,KAAK,SAAsB;AAC/C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,kCAAkC,OAAO,IAAI;AAEpE,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,yCAAyC;AAAA,QAClD,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAGA,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,UAAM,gBAAgB,MAAM,YAAY;AAAA,MACtC,KAAK;AAAA,MACL,CAAC,4BAA4B;AAAA,MAC7B;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,2BAA2B;AAAA,QACpC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,OAAO,MAAM,QAAQ,KAAK;AAGhC,UAAM,aAAa,yBAAyB,UAAU,IAAI;AAC1D,QAAI,CAAC,WAAW,SAAS;AACvB,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO;AAAA,UACP,SAAS,WAAW,MAAM;AAAA,QAC5B;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,QAA+B,WAAW;AAKhD,QAAI,MAAM,UAAU,MAAM,aAAa;AACrC,YAAM,aAAa,MAAM,YAAY;AAAA,QACnC,KAAK;AAAA,QACL,CAAC,gCAAgC;AAAA,QACjC,EAAE,UAAU,eAAe;AAAA,MAC7B;AACA,UAAI,CAAC,YAAY;AACf,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,2BAA2B;AAAA,UACpC,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAKA,UAAM,kBAAkB,MAAM,uBAAuB,IAAI;AAAA,MACvD,YAAY,MAAM;AAAA,MAClB,SAAS,MAAM;AAAA,MACf;AAAA,MACA;AAAA,IACF,CAAC;AACD,QAAI,mBAAmB,gBAAgB,gBAAgB,IAAI,GAAG;AAC5D,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,8GAA8G;AAAA,QACvH,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAKA,UAAMA,YAAW;AAAA,MACf,GAAG,MAAM;AAAA,MACT,aAAa,KAAK;AAAA,MAClB,GAAI,MAAM,cAAc,EAAE,aAAa,EAAE,SAAS,MAAe,eAAe,KAAK,EAAE,IAAI,CAAC;AAAA,IAC9F;AAGA,UAAM,WAAW,MAAM,iBAAiB,cAAc,IAAI;AAAA,MACxD,YAAY,MAAM;AAAA,MAClB,SAAS,MAAM;AAAA,MACf,gBAAgB,MAAM,kBAAkB,CAAC;AAAA,MACzC,gBAAgB,MAAM;AAAA,MACtB,UAAAA;AAAA,MACA,UAAU,MAAM,WAAW;AAAA,MAC3B;AAAA,MACA;AAAA,IACF,CAAC;AAOD,iBAAa,YAAY;AACvB,UAAI;AAEF,cAAM,cAAc,MAAM,uBAAuB;AACjD,cAAM,OAAO,YAAY,QAAQ,IAAI;AACrC,cAAM,iBAAiB,gBAAgB,MAAM,aAAa,SAAS,IAAI;AAAA,UACrE,QAAQ,KAAK;AAAA,QACf,CAAC;AAAA,MACH,SAAS,OAAO;AACd,eAAO,MAAM,uCAAuC,EAAE,KAAK,MAAM,CAAC;AAAA,MACpE;AAAA,IACF,CAAC;AAED,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,MAAM;AAAA,UACJ;AAAA,UACA,WAAW;AAAA,YACT,QAAQ,SAAS;AAAA,YACjB,aAAa,SAAS;AAAA,YACtB,SAAS;AAAA,UACX;AAAA,QACF;AAAA,QACA,SAAS;AAAA,MACX;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,EAAG,QAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AACzF,WAAO,MAAM,2BAA2B,EAAE,KAAK,MAAM,CAAC;AAGtD,QAAI,iBAAiB,iBAAiB,wBAAwB;AAC5D,UAAI,MAAM,SAAS,wBAAwB;AACzC,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,MAAM,QAAQ;AAAA,UACvB,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,UAAI,MAAM,SAAS,uBAAuB;AACxC,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,MAAM,QAAQ;AAAA,UACvB,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,UAAI,MAAM,SAAS,sBAAsB;AACvC,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,MAAM,QAAQ;AAAA,UACvB,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,UAAI,MAAM,SAAS,+BAA+B;AAChD,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,OAAO,MAAM;AAAA,YACb,MAAM,MAAM;AAAA,YACZ,SAAS,MAAM;AAAA,UACjB;AAAA,UACA,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAEA,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,2BAA2B;AAAA,MACpC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,MAAM,CAAC,WAAW;AAAA,MAClB,OAAO,EAAE,OAAO;AAAA,QACd,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,QAChC,QAAQ,6BAA6B,SAAS;AAAA,QAC9C,SAAS,yBAAyB,SAAS,EAAE,SAAS,4IAA4I;AAAA,QAClM,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,QACpC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,QAChC,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,QAC9B,kBAAkB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,mEAAmE;AAAA,QACpH,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,uHAAuH;AAAA,QAClK,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,sHAAsH;AAAA,QACjK,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,4HAA4H;AAAA,QACxK,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,4GAA4G;AAAA,QACtJ,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,SAAS;AAAA,QACxD,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,MACtD,CAAC;AAAA,MACD,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,MAAM,EAAE,MAAM,8BAA8B;AAAA,YAC5C,YAAY;AAAA,UACd,CAAC;AAAA,QACH;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,MAAM,CAAC,WAAW;AAAA,MAClB,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,QACR,aAAa;AAAA,MACf;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,MAAM,EAAE,OAAO;AAAA,cACb,UAAU;AAAA,cACV,WAAW;AAAA,YACb,CAAC;AAAA,YACD,SAAS,EAAE,OAAO;AAAA,UACpB,CAAC;AAAA,QACH;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,OAAO,EAAE,OAAO;AAAA,YAChB,SAAS,EAAE,IAAI,EAAE,SAAS;AAAA,UAC5B,CAAC;AAAA,QACH;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": ["metadata"]
 }

package/dist/modules/workflows/api/instances/validate-start/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import * as startValidator from "../../../lib/start-validator.js";
 import {
   workflowsTag,
@@ -11,6 +12,7 @@ import {
   workflowErrorSchema
 } from "../../openapi.js";
 import { createLogger } from "@open-mercato/shared/lib/logger";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 const logger = createLogger("workflows");
 const metadata = {
   requireAuth: true,
@@ -32,7 +34,7 @@ async function POST(request) {
     }
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request });
     const tenantId = auth.tenantId;
-    const organizationId = scope?.selectedId ?? auth.orgId;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth);
     if (!tenantId || !organizationId) {
       return NextResponse.json(
         { error: "Missing tenant or organization context" },
@@ -63,6 +65,7 @@ async function POST(request) {
       validatedRules: result.validatedRules.length > 0 ? result.validatedRules : void 0
     });
   } catch (error) {
+    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status });
     logger.error("Error validating workflow start", { err: error });
     return NextResponse.json(
       { error: "Failed to validate workflow start" },

package/dist/modules/workflows/api/instances/validate-start/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/workflows/api/instances/validate-start/route.ts"],
-  "sourcesContent": ["/**\n * Workflow Start Validation API\n *\n * POST /api/workflows/instances/validate-start\n *\n * Validates if a workflow can be started with the given context.\n * Evaluates pre-conditions defined on the START step and returns\n * validation errors with localized messages if any fail.\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport * as startValidator from '../../../lib/start-validator'\nimport {\n  workflowsTag,\n  validateStartRequestSchema,\n  validateStartResponseSchema,\n  workflowErrorSchema,\n} from '../../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.instances.view'],\n}\n\n// Input schema for validation request\nconst validateStartInputSchema = z.object({\n  workflowId: z.string().min(1),\n  version: z.number().int().positive().optional(),\n  context: z.record(z.string(), z.any()).optional().default({}),\n  locale: z.string().default('en'),\n})\n\n/**\n * POST /api/workflows/instances/validate-start\n *\n * Validates if a workflow can be started with the given context.\n * Returns 200 with validation result (canStart: true/false, errors, validatedRules)\n */\nexport async function POST(request: NextRequest) {\n  try {\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = scope?.selectedId ?? auth.orgId\n\n    if (!tenantId || !organizationId) {\n      return NextResponse.json(\n        { error: 'Missing tenant or organization context' },\n        { status: 400 }\n      )\n    }\n\n    const body = await request.json()\n    const validation = validateStartInputSchema.safeParse(body)\n\n    if (!validation.success) {\n      return NextResponse.json(\n        { error: 'Validation failed', details: validation.error.issues },\n        { status: 400 }\n      )\n    }\n\n    const { workflowId, version, context, locale } = validation.data\n\n    // Validate start pre-conditions\n    const result = await startValidator.validateWorkflowStart(em, {\n      workflowId,\n      version,\n      context,\n      locale,\n      tenantId,\n      organizationId,\n    })\n\n    // Always return 200 with the validation result\n    // The client can check canStart to determine if workflow can proceed\n    return NextResponse.json({\n      canStart: result.canStart,\n      workflowId,\n      errors: result.errors.length > 0 ? result.errors : undefined,\n      validatedRules: result.validatedRules.length > 0 ? result.validatedRules : undefined,\n    })\n  } catch (error) {\n    logger.error('Error validating workflow start', { err: error })\n    return NextResponse.json(\n      { error: 'Failed to validate workflow start' },\n      { status: 500 }\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'Validate workflow start',\n  methods: {\n    POST: {\n      summary: 'Validate if workflow can be started',\n      description: 'Evaluates pre-conditions defined on the START step and returns validation errors with localized messages if any fail. Returns canStart: true/false with details.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: validateStartRequestSchema,\n      },\n      responses: [\n        { status: 200, description: 'Validation result (canStart, errors, validatedRules)', schema: validateStartResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid request body or missing context', schema: workflowErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: workflowErrorSchema },\n        { status: 500, description: 'Internal server error', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAUA,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,YAAY,oBAAoB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,0BAA0B;AAC9C;AAGA,MAAM,2BAA2B,EAAE,OAAO;AAAA,EACxC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC5B,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC9C,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC5D,QAAQ,EAAE,OAAO,EAAE,QAAQ,IAAI;AACjC,CAAC;AAQD,eAAsB,KAAK,SAAsB;AAC/C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,cAAc,KAAK;AAEjD,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,yCAAyC;AAAA,QAClD,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,UAAM,aAAa,yBAAyB,UAAU,IAAI;AAE1D,QAAI,CAAC,WAAW,SAAS;AACvB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,qBAAqB,SAAS,WAAW,MAAM,OAAO;AAAA,QAC/D,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,EAAE,YAAY,SAAS,SAAS,OAAO,IAAI,WAAW;AAG5D,UAAM,SAAS,MAAM,eAAe,sBAAsB,IAAI;AAAA,MAC5D;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAID,WAAO,aAAa,KAAK;AAAA,MACvB,UAAU,OAAO;AAAA,MACjB;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,IAAI,OAAO,SAAS;AAAA,MACnD,gBAAgB,OAAO,eAAe,SAAS,IAAI,OAAO,iBAAiB;AAAA,IAC7E,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,mCAAmC,EAAE,KAAK,MAAM,CAAC;AAC9D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,oCAAoC;AAAA,MAC7C,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wDAAwD,QAAQ,4BAA4B;AAAA,MAC1H;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,2CAA2C,QAAQ,oBAAoB;AAAA,QACnG,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * Workflow Start Validation API\n *\n * POST /api/workflows/instances/validate-start\n *\n * Validates if a workflow can be started with the given context.\n * Evaluates pre-conditions defined on the START step and returns\n * validation errors with localized messages if any fail.\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport * as startValidator from '../../../lib/start-validator'\nimport {\n  workflowsTag,\n  validateStartRequestSchema,\n  validateStartResponseSchema,\n  workflowErrorSchema,\n} from '../../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.instances.view'],\n}\n\n// Input schema for validation request\nconst validateStartInputSchema = z.object({\n  workflowId: z.string().min(1),\n  version: z.number().int().positive().optional(),\n  context: z.record(z.string(), z.any()).optional().default({}),\n  locale: z.string().default('en'),\n})\n\n/**\n * POST /api/workflows/instances/validate-start\n *\n * Validates if a workflow can be started with the given context.\n * Returns 200 with validation result (canStart: true/false, errors, validatedRules)\n */\nexport async function POST(request: NextRequest) {\n  try {\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth)\n\n    if (!tenantId || !organizationId) {\n      return NextResponse.json(\n        { error: 'Missing tenant or organization context' },\n        { status: 400 }\n      )\n    }\n\n    const body = await request.json()\n    const validation = validateStartInputSchema.safeParse(body)\n\n    if (!validation.success) {\n      return NextResponse.json(\n        { error: 'Validation failed', details: validation.error.issues },\n        { status: 400 }\n      )\n    }\n\n    const { workflowId, version, context, locale } = validation.data\n\n    // Validate start pre-conditions\n    const result = await startValidator.validateWorkflowStart(em, {\n      workflowId,\n      version,\n      context,\n      locale,\n      tenantId,\n      organizationId,\n    })\n\n    // Always return 200 with the validation result\n    // The client can check canStart to determine if workflow can proceed\n    return NextResponse.json({\n      canStart: result.canStart,\n      workflowId,\n      errors: result.errors.length > 0 ? result.errors : undefined,\n      validatedRules: result.validatedRules.length > 0 ? result.validatedRules : undefined,\n    })\n  } catch (error) {\n    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status })\n    logger.error('Error validating workflow start', { err: error })\n    return NextResponse.json(\n      { error: 'Failed to validate workflow start' },\n      { status: 500 }\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'Validate workflow start',\n  methods: {\n    POST: {\n      summary: 'Validate if workflow can be started',\n      description: 'Evaluates pre-conditions defined on the START step and returns validation errors with localized messages if any fail. Returns canStart: true/false with details.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: validateStartRequestSchema,\n      },\n      responses: [\n        { status: 200, description: 'Validation result (canStart, errors, validatedRules)', schema: validateStartResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid request body or missing context', schema: workflowErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: workflowErrorSchema },\n        { status: 500, description: 'Internal server error', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAUA,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,YAAY,oBAAoB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,uBAAuB;AAEhC,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,0BAA0B;AAC9C;AAGA,MAAM,2BAA2B,EAAE,OAAO;AAAA,EACxC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC5B,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC9C,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC5D,QAAQ,EAAE,OAAO,EAAE,QAAQ,IAAI;AACjC,CAAC;AAQD,eAAsB,KAAK,SAAsB;AAC/C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,kCAAkC,OAAO,IAAI;AAEpE,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,yCAAyC;AAAA,QAClD,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,UAAM,aAAa,yBAAyB,UAAU,IAAI;AAE1D,QAAI,CAAC,WAAW,SAAS;AACvB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,qBAAqB,SAAS,WAAW,MAAM,OAAO;AAAA,QAC/D,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,EAAE,YAAY,SAAS,SAAS,OAAO,IAAI,WAAW;AAG5D,UAAM,SAAS,MAAM,eAAe,sBAAsB,IAAI;AAAA,MAC5D;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAID,WAAO,aAAa,KAAK;AAAA,MACvB,UAAU,OAAO;AAAA,MACjB;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,IAAI,OAAO,SAAS;AAAA,MACnD,gBAAgB,OAAO,eAAe,SAAS,IAAI,OAAO,iBAAiB;AAAA,IAC7E,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,EAAG,QAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AACzF,WAAO,MAAM,mCAAmC,EAAE,KAAK,MAAM,CAAC;AAC9D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,oCAAoC;AAAA,MAC7C,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wDAAwD,QAAQ,4BAA4B;AAAA,MAC1H;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,2CAA2C,QAAQ,oBAAoB;AAAA,QACnG,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/workflows/api/rule-usage/route.js

@@ -3,8 +3,10 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { createLogger } from "@open-mercato/shared/lib/logger";
 import { countReferencingWorkflows, findBusinessRuleUsage } from "../../lib/business-rule-usage.js";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 const logger = createLogger("workflows").child({ component: "rule-usage-api" });
 const metadata = {
   requireAuth: true,
@@ -28,7 +30,7 @@ async function GET(request) {
     const em = container.resolve("em");
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request });
     const tenantId = auth.tenantId;
-    const organizationId = scope?.selectedId ?? auth.orgId;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth);
     if (!tenantId || !organizationId) {
       return NextResponse.json({ error: "Missing tenant or organization context" }, { status: 400 });
     }
@@ -43,6 +45,7 @@ async function GET(request) {
       references
     });
   } catch (error) {
+    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status });
     logger.error("Failed to resolve business rule usage", { err: error });
     return NextResponse.json({ error: "Failed to resolve business rule usage" }, { status: 500 });
   }

package/dist/modules/workflows/api/rule-usage/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/workflows/api/rule-usage/route.ts"],
-  "sourcesContent": ["/**\n * Business Rule Usage in Workflows (dependency visibility)\n *\n * GET /api/workflows/rule-usage?ruleId=<business rule id>\n *\n * Backs the \"used by: N workflows\" panel the Studio renders beside the inline\n * business-rule editor. It lives in workflows \u2014 not business_rules \u2014 so the\n * upstream module never learns about its consumers.\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { countReferencingWorkflows, findBusinessRuleUsage } from '../../lib/business-rule-usage'\n\nconst logger = createLogger('workflows').child({ component: 'rule-usage-api' })\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.view'],\n}\n\nconst querySchema = z.object({\n  ruleId: z.string().min(1).max(50),\n})\n\nexport async function GET(request: NextRequest) {\n  try {\n    const auth = await getAuthFromRequest(request)\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const url = new URL(request.url)\n    const parsed = querySchema.safeParse({ ruleId: url.searchParams.get('ruleId') || undefined })\n    if (!parsed.success) {\n      return NextResponse.json({ error: 'Invalid query parameters' }, { status: 400 })\n    }\n\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = scope?.selectedId ?? auth.orgId\n\n    if (!tenantId || !organizationId) {\n      return NextResponse.json({ error: 'Missing tenant or organization context' }, { status: 400 })\n    }\n\n    const references = await findBusinessRuleUsage(em, {\n      ruleId: parsed.data.ruleId,\n      tenantId,\n      organizationId,\n    })\n\n    return NextResponse.json({\n      ruleId: parsed.data.ruleId,\n      workflowCount: countReferencingWorkflows(references),\n      references,\n    })\n  } catch (error) {\n    logger.error('Failed to resolve business rule usage', { err: error })\n    return NextResponse.json({ error: 'Failed to resolve business rule usage' }, { status: 500 })\n  }\n}\n\nexport const openApi = {\n  methods: {\n    GET: {\n      summary: 'List workflows referencing a business rule',\n      description: 'Returns the workflow definitions whose START pre-conditions or transition pre/post-conditions reference the given business rule.',\n      tags: ['Workflows'],\n      query: querySchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Usage references',\n          example: {\n            ruleId: 'ORDER_ABOVE_LIMIT',\n            workflowCount: 1,\n            references: [\n              { workflowId: 'order-approval', version: 2, kind: 'transitionPreCondition', locationId: 'e_start_review' },\n            ],\n          },\n        },\n        { status: 400, description: 'Invalid query parameters', example: { error: 'Invalid query parameters' } },\n        { status: 401, description: 'Unauthorized', example: { error: 'Unauthorized' } },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAUA,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B,6BAA6B;AAEjE,MAAM,SAAS,aAAa,WAAW,EAAE,MAAM,EAAE,WAAW,iBAAiB,CAAC;AAEvE,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,4BAA4B;AAChD;AAEA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAClC,CAAC;AAED,eAAsB,IAAI,SAAsB;AAC9C,MAAI;AACF,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAC7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,SAAS,YAAY,UAAU,EAAE,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK,OAAU,CAAC;AAC5F,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjF;AAEA,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,cAAc,KAAK;AAEjD,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,aAAO,aAAa,KAAK,EAAE,OAAO,yCAAyC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/F;AAEA,UAAM,aAAa,MAAM,sBAAsB,IAAI;AAAA,MACjD,QAAQ,OAAO,KAAK;AAAA,MACpB;AAAA,MACA;AAAA,IACF,CAAC;AAED,WAAO,aAAa,KAAK;AAAA,MACvB,QAAQ,OAAO,KAAK;AAAA,MACpB,eAAe,0BAA0B,UAAU;AAAA,MACnD;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,yCAAyC,EAAE,KAAK,MAAM,CAAC;AACpE,WAAO,aAAa,KAAK,EAAE,OAAO,wCAAwC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9F;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,MAAM,CAAC,WAAW;AAAA,MAClB,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,SAAS;AAAA,YACP,QAAQ;AAAA,YACR,eAAe;AAAA,YACf,YAAY;AAAA,cACV,EAAE,YAAY,kBAAkB,SAAS,GAAG,MAAM,0BAA0B,YAAY,iBAAiB;AAAA,YAC3G;AAAA,UACF;AAAA,QACF;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,4BAA4B,SAAS,EAAE,OAAO,2BAA2B,EAAE;AAAA,QACvG,EAAE,QAAQ,KAAK,aAAa,gBAAgB,SAAS,EAAE,OAAO,eAAe,EAAE;AAAA,MACjF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * Business Rule Usage in Workflows (dependency visibility)\n *\n * GET /api/workflows/rule-usage?ruleId=<business rule id>\n *\n * Backs the \"used by: N workflows\" panel the Studio renders beside the inline\n * business-rule editor. It lives in workflows \u2014 not business_rules \u2014 so the\n * upstream module never learns about its consumers.\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { countReferencingWorkflows, findBusinessRuleUsage } from '../../lib/business-rule-usage'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\n\nconst logger = createLogger('workflows').child({ component: 'rule-usage-api' })\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.view'],\n}\n\nconst querySchema = z.object({\n  ruleId: z.string().min(1).max(50),\n})\n\nexport async function GET(request: NextRequest) {\n  try {\n    const auth = await getAuthFromRequest(request)\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const url = new URL(request.url)\n    const parsed = querySchema.safeParse({ ruleId: url.searchParams.get('ruleId') || undefined })\n    if (!parsed.success) {\n      return NextResponse.json({ error: 'Invalid query parameters' }, { status: 400 })\n    }\n\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth)\n\n    if (!tenantId || !organizationId) {\n      return NextResponse.json({ error: 'Missing tenant or organization context' }, { status: 400 })\n    }\n\n    const references = await findBusinessRuleUsage(em, {\n      ruleId: parsed.data.ruleId,\n      tenantId,\n      organizationId,\n    })\n\n    return NextResponse.json({\n      ruleId: parsed.data.ruleId,\n      workflowCount: countReferencingWorkflows(references),\n      references,\n    })\n  } catch (error) {\n    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status })\n    logger.error('Failed to resolve business rule usage', { err: error })\n    return NextResponse.json({ error: 'Failed to resolve business rule usage' }, { status: 500 })\n  }\n}\n\nexport const openApi = {\n  methods: {\n    GET: {\n      summary: 'List workflows referencing a business rule',\n      description: 'Returns the workflow definitions whose START pre-conditions or transition pre/post-conditions reference the given business rule.',\n      tags: ['Workflows'],\n      query: querySchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Usage references',\n          example: {\n            ruleId: 'ORDER_ABOVE_LIMIT',\n            workflowCount: 1,\n            references: [\n              { workflowId: 'order-approval', version: 2, kind: 'transitionPreCondition', locationId: 'e_start_review' },\n            ],\n          },\n        },\n        { status: 400, description: 'Invalid query parameters', example: { error: 'Invalid query parameters' } },\n        { status: 401, description: 'Unauthorized', example: { error: 'Unauthorized' } },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAUA,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B,6BAA6B;AACjE,SAAS,uBAAuB;AAEhC,MAAM,SAAS,aAAa,WAAW,EAAE,MAAM,EAAE,WAAW,iBAAiB,CAAC;AAEvE,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,4BAA4B;AAChD;AAEA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAClC,CAAC;AAED,eAAsB,IAAI,SAAsB;AAC9C,MAAI;AACF,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAC7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,SAAS,YAAY,UAAU,EAAE,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK,OAAU,CAAC;AAC5F,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjF;AAEA,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,kCAAkC,OAAO,IAAI;AAEpE,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,aAAO,aAAa,KAAK,EAAE,OAAO,yCAAyC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/F;AAEA,UAAM,aAAa,MAAM,sBAAsB,IAAI;AAAA,MACjD,QAAQ,OAAO,KAAK;AAAA,MACpB;AAAA,MACA;AAAA,IACF,CAAC;AAED,WAAO,aAAa,KAAK;AAAA,MACvB,QAAQ,OAAO,KAAK;AAAA,MACpB,eAAe,0BAA0B,UAAU;AAAA,MACnD;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,EAAG,QAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AACzF,WAAO,MAAM,yCAAyC,EAAE,KAAK,MAAM,CAAC;AACpE,WAAO,aAAa,KAAK,EAAE,OAAO,wCAAwC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9F;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,MAAM,CAAC,WAAW;AAAA,MAClB,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,SAAS;AAAA,YACP,QAAQ;AAAA,YACR,eAAe;AAAA,YACf,YAAY;AAAA,cACV,EAAE,YAAY,kBAAkB,SAAS,GAAG,MAAM,0BAA0B,YAAY,iBAAiB;AAAA,YAC3G;AAAA,UACF;AAAA,QACF;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,4BAA4B,SAAS,EAAE,OAAO,2BAA2B,EAAE;AAAA,QACvG,EAAE,QAAQ,KAAK,aAAa,gBAAgB,SAAS,EAAE,OAAO,eAAe,EAAE;AAAA,MACjF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/workflows/api/signals/route.js

@@ -2,6 +2,7 @@ import { NextResponse } from "next/server";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { z } from "zod";
 import { sendSignalByCorrelationKey } from "../../lib/signal-handler.js";
 import {
@@ -11,6 +12,7 @@ import {
   workflowErrorSchema
 } from "../openapi.js";
 import { createLogger } from "@open-mercato/shared/lib/logger";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 const logger = createLogger("workflows");
 const metadata = {
   requireAuth: true,
@@ -31,7 +33,7 @@ async function POST(request) {
     }
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request });
     const tenantId = auth.tenantId;
-    const organizationId = scope?.selectedId ?? auth.orgId;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth);
     if (!tenantId || !organizationId) {
       return NextResponse.json(
         { error: "Missing tenant or organization context" },
@@ -63,6 +65,7 @@ async function POST(request) {
       count
     });
   } catch (error) {
+    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status });
     logger.error("Signal error", { err: error });
     return NextResponse.json(
       { error: error.message || "Failed to send signal" },

package/dist/modules/workflows/api/signals/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/workflows/api/signals/route.ts"],
-  "sourcesContent": ["import { NextRequest, NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { z } from 'zod'\nimport { sendSignalByCorrelationKey } from '../../lib/signal-handler'\nimport {\n  workflowsTag,\n  sendSignalByCorrelationRequestSchema,\n  sendSignalByCorrelationResponseSchema,\n  workflowErrorSchema,\n} from '../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.signals.send'],\n}\n\nconst sendSignalByKeySchema = z.object({\n  correlationKey: z.string().min(1, 'Correlation key required'),\n  signalName: z.string().min(1, 'Signal name required'),\n  payload: z.record(z.string(), z.any()).optional(),\n})\n\n/**\n * POST /api/workflows/signals\n *\n * Send signal to workflows by correlation key\n */\nexport async function POST(request: NextRequest) {\n  try {\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = scope?.selectedId ?? auth.orgId\n\n    if (!tenantId || !organizationId) {\n      return NextResponse.json(\n        { error: 'Missing tenant or organization context' },\n        { status: 400 }\n      )\n    }\n\n    // Check permission\n    const rbacService = container.resolve('rbacService')\n    const hasPermission = await rbacService.userHasAllFeatures(\n      auth.sub,\n      ['workflows.signals.send'],\n      { tenantId, organizationId }\n    )\n\n    if (!hasPermission) {\n      return NextResponse.json({ error: 'Insufficient permissions' }, { status: 403 })\n    }\n\n    const body = await request.json()\n    const input = sendSignalByKeySchema.parse(body)\n\n    const count = await sendSignalByCorrelationKey(em, container, {\n      correlationKey: input.correlationKey,\n      signalName: input.signalName,\n      payload: input.payload,\n      userId: auth.sub,\n      tenantId,\n      organizationId,\n    })\n\n    return NextResponse.json({\n      success: true,\n      message: `Signal sent to ${count} workflow(s)`,\n      count,\n    })\n  } catch (error: any) {\n    logger.error('Signal error', { err: error })\n    return NextResponse.json(\n      { error: error.message || 'Failed to send signal' },\n      { status: 500 }\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'Send signal by correlation key',\n  methods: {\n    POST: {\n      summary: 'Send signal to workflows by correlation key',\n      description: 'Sends a signal to all workflow instances waiting for the specified signal that match the correlation key. Returns the count of workflows that received the signal.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: sendSignalByCorrelationRequestSchema,\n      },\n      responses: [\n        { status: 200, description: 'Signal sent to matching workflows', schema: sendSignalByCorrelationResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing tenant or organization context', schema: workflowErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: workflowErrorSchema },\n        { status: 403, description: 'Insufficient permissions', schema: workflowErrorSchema },\n        { status: 500, description: 'Internal server error', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAsB,oBAAoB;AAE1C,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,SAAS;AAClB,SAAS,kCAAkC;AAC3C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,wBAAwB;AAC5C;AAEA,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,gBAAgB,EAAE,OAAO,EAAE,IAAI,GAAG,0BAA0B;AAAA,EAC5D,YAAY,EAAE,OAAO,EAAE,IAAI,GAAG,sBAAsB;AAAA,EACpD,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,IAAI,CAAC,EAAE,SAAS;AAClD,CAAC;AAOD,eAAsB,KAAK,SAAsB;AAC/C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,cAAc,KAAK;AAEjD,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,yCAAyC;AAAA,QAClD,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAGA,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,UAAM,gBAAgB,MAAM,YAAY;AAAA,MACtC,KAAK;AAAA,MACL,CAAC,wBAAwB;AAAA,MACzB,EAAE,UAAU,eAAe;AAAA,IAC7B;AAEA,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjF;AAEA,UAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,UAAM,QAAQ,sBAAsB,MAAM,IAAI;AAE9C,UAAM,QAAQ,MAAM,2BAA2B,IAAI,WAAW;AAAA,MAC5D,gBAAgB,MAAM;AAAA,MACtB,YAAY,MAAM;AAAA,MAClB,SAAS,MAAM;AAAA,MACf,QAAQ,KAAK;AAAA,MACb;AAAA,MACA;AAAA,IACF,CAAC;AAED,WAAO,aAAa,KAAK;AAAA,MACvB,SAAS;AAAA,MACT,SAAS,kBAAkB,KAAK;AAAA,MAChC;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAY;AACnB,WAAO,MAAM,gBAAgB,EAAE,KAAK,MAAM,CAAC;AAC3C,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,MAAM,WAAW,wBAAwB;AAAA,MAClD,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,qCAAqC,QAAQ,sCAAsC;AAAA,MACjH;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0CAA0C,QAAQ,oBAAoB;AAAA,QAClG,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextRequest, NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { z } from 'zod'\nimport { sendSignalByCorrelationKey } from '../../lib/signal-handler'\nimport {\n  workflowsTag,\n  sendSignalByCorrelationRequestSchema,\n  sendSignalByCorrelationResponseSchema,\n  workflowErrorSchema,\n} from '../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.signals.send'],\n}\n\nconst sendSignalByKeySchema = z.object({\n  correlationKey: z.string().min(1, 'Correlation key required'),\n  signalName: z.string().min(1, 'Signal name required'),\n  payload: z.record(z.string(), z.any()).optional(),\n})\n\n/**\n * POST /api/workflows/signals\n *\n * Send signal to workflows by correlation key\n */\nexport async function POST(request: NextRequest) {\n  try {\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth)\n\n    if (!tenantId || !organizationId) {\n      return NextResponse.json(\n        { error: 'Missing tenant or organization context' },\n        { status: 400 }\n      )\n    }\n\n    // Check permission\n    const rbacService = container.resolve('rbacService')\n    const hasPermission = await rbacService.userHasAllFeatures(\n      auth.sub,\n      ['workflows.signals.send'],\n      { tenantId, organizationId }\n    )\n\n    if (!hasPermission) {\n      return NextResponse.json({ error: 'Insufficient permissions' }, { status: 403 })\n    }\n\n    const body = await request.json()\n    const input = sendSignalByKeySchema.parse(body)\n\n    const count = await sendSignalByCorrelationKey(em, container, {\n      correlationKey: input.correlationKey,\n      signalName: input.signalName,\n      payload: input.payload,\n      userId: auth.sub,\n      tenantId,\n      organizationId,\n    })\n\n    return NextResponse.json({\n      success: true,\n      message: `Signal sent to ${count} workflow(s)`,\n      count,\n    })\n  } catch (error: any) {\n    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status })\n    logger.error('Signal error', { err: error })\n    return NextResponse.json(\n      { error: error.message || 'Failed to send signal' },\n      { status: 500 }\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'Send signal by correlation key',\n  methods: {\n    POST: {\n      summary: 'Send signal to workflows by correlation key',\n      description: 'Sends a signal to all workflow instances waiting for the specified signal that match the correlation key. Returns the count of workflows that received the signal.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: sendSignalByCorrelationRequestSchema,\n      },\n      responses: [\n        { status: 200, description: 'Signal sent to matching workflows', schema: sendSignalByCorrelationResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing tenant or organization context', schema: workflowErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: workflowErrorSchema },\n        { status: 403, description: 'Insufficient permissions', schema: workflowErrorSchema },\n        { status: 500, description: 'Internal server error', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAsB,oBAAoB;AAE1C,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,SAAS;AAClB,SAAS,kCAAkC;AAC3C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,uBAAuB;AAEhC,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,wBAAwB;AAC5C;AAEA,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,gBAAgB,EAAE,OAAO,EAAE,IAAI,GAAG,0BAA0B;AAAA,EAC5D,YAAY,EAAE,OAAO,EAAE,IAAI,GAAG,sBAAsB;AAAA,EACpD,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,IAAI,CAAC,EAAE,SAAS;AAClD,CAAC;AAOD,eAAsB,KAAK,SAAsB;AAC/C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,kCAAkC,OAAO,IAAI;AAEpE,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,yCAAyC;AAAA,QAClD,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAGA,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,UAAM,gBAAgB,MAAM,YAAY;AAAA,MACtC,KAAK;AAAA,MACL,CAAC,wBAAwB;AAAA,MACzB,EAAE,UAAU,eAAe;AAAA,IAC7B;AAEA,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjF;AAEA,UAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,UAAM,QAAQ,sBAAsB,MAAM,IAAI;AAE9C,UAAM,QAAQ,MAAM,2BAA2B,IAAI,WAAW;AAAA,MAC5D,gBAAgB,MAAM;AAAA,MACtB,YAAY,MAAM;AAAA,MAClB,SAAS,MAAM;AAAA,MACf,QAAQ,KAAK;AAAA,MACb;AAAA,MACA;AAAA,IACF,CAAC;AAED,WAAO,aAAa,KAAK;AAAA,MACvB,SAAS;AAAA,MACT,SAAS,kBAAkB,KAAK;AAAA,MAChC;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAY;AACnB,QAAI,gBAAgB,KAAK,EAAG,QAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AACzF,WAAO,MAAM,gBAAgB,EAAE,KAAK,MAAM,CAAC;AAC3C,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,MAAM,WAAW,wBAAwB;AAAA,MAClD,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,qCAAqC,QAAQ,sCAAsC;AAAA,MACjH;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0CAA0C,QAAQ,oBAAoB;AAAA,QAClG,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/workflows/api/tasks/[id]/claim/route.js

@@ -2,6 +2,7 @@ import { NextResponse } from "next/server";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { gateTaskAction } from "../../../../lib/task-visibility-request.js";
 import {
   workflowsTag,
@@ -9,6 +10,7 @@ import {
   workflowErrorSchema
 } from "../../../openapi.js";
 import { createLogger } from "@open-mercato/shared/lib/logger";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 const logger = createLogger("workflows");
 const metadata = {
   requireAuth: true,
@@ -24,7 +26,7 @@ async function POST(request, { params }) {
     }
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request });
     const tenantId = auth.tenantId;
-    const organizationId = scope?.selectedId ?? auth.orgId;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth);
     if (!tenantId || !organizationId) {
       return NextResponse.json(
         { error: "Missing tenant or organization context" },
@@ -66,6 +68,7 @@ async function POST(request, { params }) {
       message: "Task claimed successfully"
     });
   } catch (error) {
+    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status });
     logger.error("Error claiming user task", { err: error });
     const code = error?.code;
     if (code === "TASK_NOT_FOUND") {

package/dist/modules/workflows/api/tasks/[id]/claim/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/workflows/api/tasks/%5Bid%5D/claim/route.ts"],
-  "sourcesContent": ["/**\n * User Task Claim API\n *\n * Endpoints:\n * - POST /api/workflows/tasks/[id]/claim - Claim a task from role queue\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { TaskHandlerService } from '../../../../lib/task-handler'\nimport { gateTaskAction } from '../../../../lib/task-visibility-request'\nimport {\n  workflowsTag,\n  userTaskClaimResponseSchema,\n  workflowErrorSchema,\n} from '../../../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.tasks.claim'],\n}\n\n/**\n * POST /api/workflows/tasks/[id]/claim\n *\n * Claim a user task from a role queue\n *\n * This allows a user to claim a task that's assigned to their role(s).\n * Once claimed, the task moves to IN_PROGRESS status and is assigned to the claiming user.\n */\nexport async function POST(\n  request: NextRequest,\n  { params }: { params: { id: string } }\n) {\n  try {\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = scope?.selectedId ?? auth.orgId\n\n    if (!tenantId || !organizationId) {\n      return NextResponse.json(\n        { error: 'Missing tenant or organization context' },\n        { status: 400 }\n      )\n    }\n\n    // \u00A76.4 runs BEFORE the handler, and that ordering is the disclosure fix:\n    // `claimUserTask` reports `TASK_ALREADY_ASSIGNED` before it checks queue\n    // membership, so a caller with no relationship to the task used to learn\n    // that it exists from the status code alone. Now they get the same 404 a\n    // nonexistent id produces, and the handler still owns membership, the\n    // compare-and-set and every error code below.\n    const gate = await gateTaskAction({\n      container,\n      em,\n      auth: { userId: auth.sub, tenantId, roleNames: auth.roles ?? [] },\n      taskId: params.id,\n      organizationId,\n    })\n\n    if (!gate.allowed) {\n      return NextResponse.json(gate.refusal.body, { status: gate.refusal.status })\n    }\n\n    // Call task handler to claim task\n    const taskHandler = container.resolve<TaskHandlerService>('taskHandler')\n    // Role names are server-derived (`auth.roles`), never read off the request \u2014\n    // a caller who holds none of the task's queues is refused as \"not found\".\n    await taskHandler.claimUserTask(\n      em,\n      params.id,\n      auth.sub,\n      { tenantId, organizationId },\n      auth.roles ?? [],\n    )\n\n    // Fetch updated task\n    const { UserTask } = await import('../../../../data/entities')\n    const task = await em.findOne(UserTask, {\n      id: params.id,\n      tenantId,\n      organizationId,\n    })\n\n    if (!task) {\n      return NextResponse.json(\n        { error: 'Task not found after claim' },\n        { status: 500 }\n      )\n    }\n\n    return NextResponse.json({\n      data: task,\n      message: 'Task claimed successfully',\n    })\n  } catch (error) {\n    logger.error('Error claiming user task', { err: error })\n\n    // Keyed on the handler's error CODE rather than on substrings of its\n    // message. The old message matching had no arm for `TASK_NOT_ROLE_ASSIGNED`\n    // (\"Task is not assigned to any roles\" contains neither \"not found\" nor\n    // \"already\"), so a task with an empty queue answered 500.\n    const code = (error as { code?: unknown } | null)?.code\n    if (code === 'TASK_NOT_FOUND') {\n      return NextResponse.json({ error: (error as Error).message }, { status: 404 })\n    }\n    if (code === 'TASK_ALREADY_ASSIGNED' || code === 'TASK_NOT_ROLE_ASSIGNED') {\n      return NextResponse.json({ error: (error as Error).message }, { status: 409 })\n    }\n\n    return NextResponse.json(\n      {\n        error: 'Failed to claim user task',\n        details: error instanceof Error ? error.message : String(error),\n      },\n      { status: 500 }\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'Claim user task',\n  methods: {\n    POST: {\n      summary: 'Claim a task from role queue',\n      description: 'Allows a user to claim a task assigned to their role(s). Once claimed, the task moves to IN_PROGRESS status and is assigned to the claiming user.',\n      responses: [\n        { status: 200, description: 'Task claimed successfully', schema: userTaskClaimResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing tenant or organization context', schema: workflowErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: workflowErrorSchema },\n        { status: 403, description: 'The task is visible to the caller but is not theirs to act on \u2014 it has no assignee and no role queue, so it must be reassigned first (\u00A76.4: administration widens seeing, never acting).', schema: workflowErrorSchema },\n        { status: 404, description: 'Task not found, or not visible to the caller', schema: workflowErrorSchema },\n        { status: 409, description: 'Task already claimed', schema: workflowErrorSchema },\n        { status: 500, description: 'Internal server error', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAOA,SAAsB,oBAAoB;AAE1C,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AAEnD,SAAS,sBAAsB;AAC/B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,uBAAuB;AAC3C;AAUA,eAAsB,KACpB,SACA,EAAE,OAAO,GACT;AACA,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,cAAc,KAAK;AAEjD,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,yCAAyC;AAAA,QAClD,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAQA,UAAM,OAAO,MAAM,eAAe;AAAA,MAChC;AAAA,MACA;AAAA,MACA,MAAM,EAAE,QAAQ,KAAK,KAAK,UAAU,WAAW,KAAK,SAAS,CAAC,EAAE;AAAA,MAChE,QAAQ,OAAO;AAAA,MACf;AAAA,IACF,CAAC;AAED,QAAI,CAAC,KAAK,SAAS;AACjB,aAAO,aAAa,KAAK,KAAK,QAAQ,MAAM,EAAE,QAAQ,KAAK,QAAQ,OAAO,CAAC;AAAA,IAC7E;AAGA,UAAM,cAAc,UAAU,QAA4B,aAAa;AAGvE,UAAM,YAAY;AAAA,MAChB;AAAA,MACA,OAAO;AAAA,MACP,KAAK;AAAA,MACL,EAAE,UAAU,eAAe;AAAA,MAC3B,KAAK,SAAS,CAAC;AAAA,IACjB;AAGA,UAAM,EAAE,SAAS,IAAI,MAAM,OAAO,2BAA2B;AAC7D,UAAM,OAAO,MAAM,GAAG,QAAQ,UAAU;AAAA,MACtC,IAAI,OAAO;AAAA,MACX;AAAA,MACA;AAAA,IACF,CAAC;AAED,QAAI,CAAC,MAAM;AACT,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,6BAA6B;AAAA,QACtC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,4BAA4B,EAAE,KAAK,MAAM,CAAC;AAMvD,UAAM,OAAQ,OAAqC;AACnD,QAAI,SAAS,kBAAkB;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAQ,MAAgB,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/E;AACA,QAAI,SAAS,2BAA2B,SAAS,0BAA0B;AACzE,aAAO,aAAa,KAAK,EAAE,OAAQ,MAAgB,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/E;AAEA,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,OAAO;AAAA,QACP,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAChE;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,4BAA4B;AAAA,MAC/F;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0CAA0C,QAAQ,oBAAoB;AAAA,QAClG,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,oMAA4L,QAAQ,oBAAoB;AAAA,QACpP,EAAE,QAAQ,KAAK,aAAa,gDAAgD,QAAQ,oBAAoB;AAAA,QACxG,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,oBAAoB;AAAA,QAChF,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * User Task Claim API\n *\n * Endpoints:\n * - POST /api/workflows/tasks/[id]/claim - Claim a task from role queue\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport type { TaskHandlerService } from '../../../../lib/task-handler'\nimport { gateTaskAction } from '../../../../lib/task-visibility-request'\nimport {\n  workflowsTag,\n  userTaskClaimResponseSchema,\n  workflowErrorSchema,\n} from '../../../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.tasks.claim'],\n}\n\n/**\n * POST /api/workflows/tasks/[id]/claim\n *\n * Claim a user task from a role queue\n *\n * This allows a user to claim a task that's assigned to their role(s).\n * Once claimed, the task moves to IN_PROGRESS status and is assigned to the claiming user.\n */\nexport async function POST(\n  request: NextRequest,\n  { params }: { params: { id: string } }\n) {\n  try {\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth)\n\n    if (!tenantId || !organizationId) {\n      return NextResponse.json(\n        { error: 'Missing tenant or organization context' },\n        { status: 400 }\n      )\n    }\n\n    // \u00A76.4 runs BEFORE the handler, and that ordering is the disclosure fix:\n    // `claimUserTask` reports `TASK_ALREADY_ASSIGNED` before it checks queue\n    // membership, so a caller with no relationship to the task used to learn\n    // that it exists from the status code alone. Now they get the same 404 a\n    // nonexistent id produces, and the handler still owns membership, the\n    // compare-and-set and every error code below.\n    const gate = await gateTaskAction({\n      container,\n      em,\n      auth: { userId: auth.sub, tenantId, roleNames: auth.roles ?? [] },\n      taskId: params.id,\n      organizationId,\n    })\n\n    if (!gate.allowed) {\n      return NextResponse.json(gate.refusal.body, { status: gate.refusal.status })\n    }\n\n    // Call task handler to claim task\n    const taskHandler = container.resolve<TaskHandlerService>('taskHandler')\n    // Role names are server-derived (`auth.roles`), never read off the request \u2014\n    // a caller who holds none of the task's queues is refused as \"not found\".\n    await taskHandler.claimUserTask(\n      em,\n      params.id,\n      auth.sub,\n      { tenantId, organizationId },\n      auth.roles ?? [],\n    )\n\n    // Fetch updated task\n    const { UserTask } = await import('../../../../data/entities')\n    const task = await em.findOne(UserTask, {\n      id: params.id,\n      tenantId,\n      organizationId,\n    })\n\n    if (!task) {\n      return NextResponse.json(\n        { error: 'Task not found after claim' },\n        { status: 500 }\n      )\n    }\n\n    return NextResponse.json({\n      data: task,\n      message: 'Task claimed successfully',\n    })\n  } catch (error) {\n    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status })\n    logger.error('Error claiming user task', { err: error })\n\n    // Keyed on the handler's error CODE rather than on substrings of its\n    // message. The old message matching had no arm for `TASK_NOT_ROLE_ASSIGNED`\n    // (\"Task is not assigned to any roles\" contains neither \"not found\" nor\n    // \"already\"), so a task with an empty queue answered 500.\n    const code = (error as { code?: unknown } | null)?.code\n    if (code === 'TASK_NOT_FOUND') {\n      return NextResponse.json({ error: (error as Error).message }, { status: 404 })\n    }\n    if (code === 'TASK_ALREADY_ASSIGNED' || code === 'TASK_NOT_ROLE_ASSIGNED') {\n      return NextResponse.json({ error: (error as Error).message }, { status: 409 })\n    }\n\n    return NextResponse.json(\n      {\n        error: 'Failed to claim user task',\n        details: error instanceof Error ? error.message : String(error),\n      },\n      { status: 500 }\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'Claim user task',\n  methods: {\n    POST: {\n      summary: 'Claim a task from role queue',\n      description: 'Allows a user to claim a task assigned to their role(s). Once claimed, the task moves to IN_PROGRESS status and is assigned to the claiming user.',\n      responses: [\n        { status: 200, description: 'Task claimed successfully', schema: userTaskClaimResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing tenant or organization context', schema: workflowErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: workflowErrorSchema },\n        { status: 403, description: 'The task is visible to the caller but is not theirs to act on \u2014 it has no assignee and no role queue, so it must be reassigned first (\u00A76.4: administration widens seeing, never acting).', schema: workflowErrorSchema },\n        { status: 404, description: 'Task not found, or not visible to the caller', schema: workflowErrorSchema },\n        { status: 409, description: 'Task already claimed', schema: workflowErrorSchema },\n        { status: 500, description: 'Internal server error', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAOA,SAAsB,oBAAoB;AAE1C,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAElD,SAAS,sBAAsB;AAC/B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,uBAAuB;AAEhC,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,uBAAuB;AAC3C;AAUA,eAAsB,KACpB,SACA,EAAE,OAAO,GACT;AACA,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,kCAAkC,OAAO,IAAI;AAEpE,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,yCAAyC;AAAA,QAClD,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAQA,UAAM,OAAO,MAAM,eAAe;AAAA,MAChC;AAAA,MACA;AAAA,MACA,MAAM,EAAE,QAAQ,KAAK,KAAK,UAAU,WAAW,KAAK,SAAS,CAAC,EAAE;AAAA,MAChE,QAAQ,OAAO;AAAA,MACf;AAAA,IACF,CAAC;AAED,QAAI,CAAC,KAAK,SAAS;AACjB,aAAO,aAAa,KAAK,KAAK,QAAQ,MAAM,EAAE,QAAQ,KAAK,QAAQ,OAAO,CAAC;AAAA,IAC7E;AAGA,UAAM,cAAc,UAAU,QAA4B,aAAa;AAGvE,UAAM,YAAY;AAAA,MAChB;AAAA,MACA,OAAO;AAAA,MACP,KAAK;AAAA,MACL,EAAE,UAAU,eAAe;AAAA,MAC3B,KAAK,SAAS,CAAC;AAAA,IACjB;AAGA,UAAM,EAAE,SAAS,IAAI,MAAM,OAAO,2BAA2B;AAC7D,UAAM,OAAO,MAAM,GAAG,QAAQ,UAAU;AAAA,MACtC,IAAI,OAAO;AAAA,MACX;AAAA,MACA;AAAA,IACF,CAAC;AAED,QAAI,CAAC,MAAM;AACT,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,6BAA6B;AAAA,QACtC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,EAAG,QAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AACzF,WAAO,MAAM,4BAA4B,EAAE,KAAK,MAAM,CAAC;AAMvD,UAAM,OAAQ,OAAqC;AACnD,QAAI,SAAS,kBAAkB;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAQ,MAAgB,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/E;AACA,QAAI,SAAS,2BAA2B,SAAS,0BAA0B;AACzE,aAAO,aAAa,KAAK,EAAE,OAAQ,MAAgB,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/E;AAEA,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,OAAO;AAAA,QACP,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAChE;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,4BAA4B;AAAA,MAC/F;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0CAA0C,QAAQ,oBAAoB;AAAA,QAClG,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,oMAA4L,QAAQ,oBAAoB;AAAA,QACpP,EAAE,QAAQ,KAAK,aAAa,gDAAgD,QAAQ,oBAAoB;AAAA,QACxG,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,oBAAoB;AAAA,QAChF,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/workflows/api/tasks/[id]/complete/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { gateTaskAction } from "../../../../lib/task-visibility-request.js";
 import {
   workflowsTag,
@@ -11,6 +12,7 @@ import {
   workflowErrorSchema
 } from "../../../openapi.js";
 import { createLogger } from "@open-mercato/shared/lib/logger";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 const logger = createLogger("workflows");
 const metadata = {
   requireAuth: true,
@@ -35,7 +37,7 @@ async function POST(request, { params }) {
     }
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request });
     const tenantId = auth.tenantId;
-    const organizationId = scope?.selectedId ?? auth.orgId;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth);
     if (!tenantId || !organizationId) {
       return NextResponse.json(
         { error: "Missing tenant or organization context" },
@@ -88,6 +90,7 @@ async function POST(request, { params }) {
       message: "Task completed successfully. Workflow resumed."
     });
   } catch (error) {
+    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status });
     logger.error("Error completing user task", { err: error });
     if (error instanceof Error) {
       if (error.code === "UNKNOWN_DECISION") {