@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.8.1-develop.7441.1.b42958b98c

package/dist/modules/workflows/api/tasks/[id]/complete/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/workflows/api/tasks/%5Bid%5D/complete/route.ts"],
-  "sourcesContent": ["/**\n * User Task Completion API\n *\n * Endpoints:\n * - POST /api/workflows/tasks/[id]/complete - Complete a user task with form data\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { TaskHandlerService } from '../../../../lib/task-handler'\nimport { gateTaskAction } from '../../../../lib/task-visibility-request'\nimport {\n  workflowsTag,\n  completeTaskRequestSchema as openApiCompleteTaskSchema,\n  userTaskCompleteResponseSchema,\n  workflowErrorSchema,\n} from '../../../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.tasks.complete'],\n}\n\n// Request body schema\nconst completeTaskSchema = z.object({\n  formData: z.record(z.string(), z.any()),\n  comments: z.string().optional(),\n  /**\n   * The decision button the assignee pressed. Optional and additive: a task\n   * without decisions completes through the plain form exactly as before.\n   */\n  decisionId: z.string().min(1).optional(),\n})\n\n/**\n * POST /api/workflows/tasks/[id]/complete\n *\n * Complete a user task with form data\n *\n * Request body:\n * {\n *   formData: { [key: string]: any },  // Form field values\n *   comments: string (optional)         // Optional comments\n * }\n *\n * This endpoint:\n * 1. Validates the task can be completed\n * 2. Validates form data against the task's form schema\n * 3. Updates the task with completion data\n * 4. Merges form data into workflow context\n * 5. Resumes workflow execution\n */\nexport async function POST(\n  request: NextRequest,\n  { params }: { params: { id: string } }\n) {\n  try {\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = scope?.selectedId ?? auth.orgId\n\n    if (!tenantId || !organizationId) {\n      return NextResponse.json(\n        { error: 'Missing tenant or organization context' },\n        { status: 400 }\n      )\n    }\n\n    // Parse request body\n    const body = await request.json()\n    const parseResult = completeTaskSchema.safeParse(body)\n\n    if (!parseResult.success) {\n      return NextResponse.json(\n        {\n          error: 'Invalid request body',\n          details: parseResult.error.format(),\n        },\n        { status: 400 }\n      )\n    }\n\n    const { formData, comments, decisionId } = parseResult.data\n\n    // \u00A76.4 replaces the bare tenant/organization check that used to stand here.\n    // The narrowing D-1 keeps `workflows.tasks.complete` on the route and still\n    // demands: holding it no longer completes anyone ELSE's task. Refusals are\n    // indistinguishable from a nonexistent id unless the caller already sees the\n    // row.\n    const gate = await gateTaskAction({\n      container,\n      em,\n      auth: { userId: auth.sub, tenantId, roleNames: auth.roles ?? [] },\n      taskId: params.id,\n      organizationId,\n      // Complete is the one act where the gate, not the handler, decides\n      // ownership: the handler leaves an OWNERLESS row open to anyone holding\n      // the feature, which is exactly the pre-change semantics \u00A76.4 narrows.\n      requireOwnership: true,\n    })\n\n    if (!gate.allowed) {\n      return NextResponse.json(gate.refusal.body, { status: gate.refusal.status })\n    }\n\n    const { UserTask } = await import('../../../../data/entities')\n\n    // Call task handler to complete task and resume workflow\n    const taskHandler = container.resolve<TaskHandlerService>('taskHandler')\n    await taskHandler.completeUserTask(em, container, {\n      taskId: params.id,\n      formData,\n      userId: auth.sub,\n      comments,\n      decisionId,\n      scope: { tenantId, organizationId },\n    })\n\n    // Fetch updated task\n    const updatedTask = await em.findOne(UserTask, {\n      id: params.id,\n      tenantId,\n      organizationId,\n    })\n\n    return NextResponse.json({\n      data: updatedTask,\n      message: 'Task completed successfully. Workflow resumed.',\n    })\n  } catch (error) {\n    logger.error('Error completing user task', { err: error })\n\n    // Handle specific error codes from task-handler\n    if (error instanceof Error) {\n      if ((error as { code?: unknown }).code === 'UNKNOWN_DECISION') {\n        return NextResponse.json(\n          { error: error.message },\n          { status: 400 }\n        )\n      }\n      // \"Task is assigned to another user\" matches none of the message arms\n      // below, so this refusal used to answer 500. It is a conflict.\n      if ((error as { code?: unknown }).code === 'TASK_ASSIGNED_TO_ANOTHER_USER') {\n        return NextResponse.json(\n          { error: error.message },\n          { status: 409 }\n        )\n      }\n      if (error.message.includes('not found')) {\n        return NextResponse.json(\n          { error: error.message },\n          { status: 404 }\n        )\n      }\n      if (error.message.includes('validation')) {\n        return NextResponse.json(\n          { error: error.message },\n          { status: 400 }\n        )\n      }\n      if (error.message.includes('already completed')) {\n        return NextResponse.json(\n          { error: error.message },\n          { status: 409 }\n        )\n      }\n    }\n\n    return NextResponse.json(\n      {\n        error: 'Failed to complete user task',\n        details: error instanceof Error ? error.message : String(error),\n      },\n      { status: 500 }\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'Complete user task',\n  methods: {\n    POST: {\n      summary: 'Complete a task with form data',\n      description: 'Validates form data against task schema, updates task with completion data, merges form data into workflow context, and resumes workflow execution.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: openApiCompleteTaskSchema,\n      },\n      responses: [\n        { status: 200, description: 'Task completed successfully', schema: userTaskCompleteResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid request body, validation failed, or missing context', schema: workflowErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: workflowErrorSchema },\n        { status: 403, description: 'The task is visible to the caller but is not theirs to act on \u2014 it has no assignee and no role queue, so it must be reassigned first (\u00A76.4: administration widens seeing, never acting).', schema: workflowErrorSchema },\n        { status: 404, description: 'Task not found, or not visible to the caller', schema: workflowErrorSchema },\n        { status: 409, description: 'Task already completed', schema: workflowErrorSchema },\n        { status: 500, description: 'Internal server error', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAOA,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AAEnD,SAAS,sBAAsB;AAC/B;AAAA,EACE;AAAA,EACA,6BAA6B;AAAA,EAC7B;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,0BAA0B;AAC9C;AAGA,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,IAAI,CAAC;AAAA,EACtC,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAK9B,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACzC,CAAC;AAoBD,eAAsB,KACpB,SACA,EAAE,OAAO,GACT;AACA,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,cAAc,KAAK;AAEjD,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,yCAAyC;AAAA,QAClD,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAGA,UAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,UAAM,cAAc,mBAAmB,UAAU,IAAI;AAErD,QAAI,CAAC,YAAY,SAAS;AACxB,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO;AAAA,UACP,SAAS,YAAY,MAAM,OAAO;AAAA,QACpC;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,EAAE,UAAU,UAAU,WAAW,IAAI,YAAY;AAOvD,UAAM,OAAO,MAAM,eAAe;AAAA,MAChC;AAAA,MACA;AAAA,MACA,MAAM,EAAE,QAAQ,KAAK,KAAK,UAAU,WAAW,KAAK,SAAS,CAAC,EAAE;AAAA,MAChE,QAAQ,OAAO;AAAA,MACf;AAAA;AAAA;AAAA;AAAA,MAIA,kBAAkB;AAAA,IACpB,CAAC;AAED,QAAI,CAAC,KAAK,SAAS;AACjB,aAAO,aAAa,KAAK,KAAK,QAAQ,MAAM,EAAE,QAAQ,KAAK,QAAQ,OAAO,CAAC;AAAA,IAC7E;AAEA,UAAM,EAAE,SAAS,IAAI,MAAM,OAAO,2BAA2B;AAG7D,UAAM,cAAc,UAAU,QAA4B,aAAa;AACvE,UAAM,YAAY,iBAAiB,IAAI,WAAW;AAAA,MAChD,QAAQ,OAAO;AAAA,MACf;AAAA,MACA,QAAQ,KAAK;AAAA,MACb;AAAA,MACA;AAAA,MACA,OAAO,EAAE,UAAU,eAAe;AAAA,IACpC,CAAC;AAGD,UAAM,cAAc,MAAM,GAAG,QAAQ,UAAU;AAAA,MAC7C,IAAI,OAAO;AAAA,MACX;AAAA,MACA;AAAA,IACF,CAAC;AAED,WAAO,aAAa,KAAK;AAAA,MACvB,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,8BAA8B,EAAE,KAAK,MAAM,CAAC;AAGzD,QAAI,iBAAiB,OAAO;AAC1B,UAAK,MAA6B,SAAS,oBAAoB;AAC7D,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,MAAM,QAAQ;AAAA,UACvB,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAGA,UAAK,MAA6B,SAAS,iCAAiC;AAC1E,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,MAAM,QAAQ;AAAA,UACvB,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,UAAI,MAAM,QAAQ,SAAS,WAAW,GAAG;AACvC,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,MAAM,QAAQ;AAAA,UACvB,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,UAAI,MAAM,QAAQ,SAAS,YAAY,GAAG;AACxC,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,MAAM,QAAQ;AAAA,UACvB,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,UAAI,MAAM,QAAQ,SAAS,mBAAmB,GAAG;AAC/C,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,MAAM,QAAQ;AAAA,UACvB,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAEA,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,OAAO;AAAA,QACP,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAChE;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,+BAA+B,QAAQ,+BAA+B;AAAA,MACpG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,+DAA+D,QAAQ,oBAAoB;AAAA,QACvH,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,oMAA4L,QAAQ,oBAAoB;AAAA,QACpP,EAAE,QAAQ,KAAK,aAAa,gDAAgD,QAAQ,oBAAoB;AAAA,QACxG,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,oBAAoB;AAAA,QAClF,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * User Task Completion API\n *\n * Endpoints:\n * - POST /api/workflows/tasks/[id]/complete - Complete a user task with form data\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport type { TaskHandlerService } from '../../../../lib/task-handler'\nimport { gateTaskAction } from '../../../../lib/task-visibility-request'\nimport {\n  workflowsTag,\n  completeTaskRequestSchema as openApiCompleteTaskSchema,\n  userTaskCompleteResponseSchema,\n  workflowErrorSchema,\n} from '../../../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.tasks.complete'],\n}\n\n// Request body schema\nconst completeTaskSchema = z.object({\n  formData: z.record(z.string(), z.any()),\n  comments: z.string().optional(),\n  /**\n   * The decision button the assignee pressed. Optional and additive: a task\n   * without decisions completes through the plain form exactly as before.\n   */\n  decisionId: z.string().min(1).optional(),\n})\n\n/**\n * POST /api/workflows/tasks/[id]/complete\n *\n * Complete a user task with form data\n *\n * Request body:\n * {\n *   formData: { [key: string]: any },  // Form field values\n *   comments: string (optional)         // Optional comments\n * }\n *\n * This endpoint:\n * 1. Validates the task can be completed\n * 2. Validates form data against the task's form schema\n * 3. Updates the task with completion data\n * 4. Merges form data into workflow context\n * 5. Resumes workflow execution\n */\nexport async function POST(\n  request: NextRequest,\n  { params }: { params: { id: string } }\n) {\n  try {\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth)\n\n    if (!tenantId || !organizationId) {\n      return NextResponse.json(\n        { error: 'Missing tenant or organization context' },\n        { status: 400 }\n      )\n    }\n\n    // Parse request body\n    const body = await request.json()\n    const parseResult = completeTaskSchema.safeParse(body)\n\n    if (!parseResult.success) {\n      return NextResponse.json(\n        {\n          error: 'Invalid request body',\n          details: parseResult.error.format(),\n        },\n        { status: 400 }\n      )\n    }\n\n    const { formData, comments, decisionId } = parseResult.data\n\n    // \u00A76.4 replaces the bare tenant/organization check that used to stand here.\n    // The narrowing D-1 keeps `workflows.tasks.complete` on the route and still\n    // demands: holding it no longer completes anyone ELSE's task. Refusals are\n    // indistinguishable from a nonexistent id unless the caller already sees the\n    // row.\n    const gate = await gateTaskAction({\n      container,\n      em,\n      auth: { userId: auth.sub, tenantId, roleNames: auth.roles ?? [] },\n      taskId: params.id,\n      organizationId,\n      // Complete is the one act where the gate, not the handler, decides\n      // ownership: the handler leaves an OWNERLESS row open to anyone holding\n      // the feature, which is exactly the pre-change semantics \u00A76.4 narrows.\n      requireOwnership: true,\n    })\n\n    if (!gate.allowed) {\n      return NextResponse.json(gate.refusal.body, { status: gate.refusal.status })\n    }\n\n    const { UserTask } = await import('../../../../data/entities')\n\n    // Call task handler to complete task and resume workflow\n    const taskHandler = container.resolve<TaskHandlerService>('taskHandler')\n    await taskHandler.completeUserTask(em, container, {\n      taskId: params.id,\n      formData,\n      userId: auth.sub,\n      comments,\n      decisionId,\n      scope: { tenantId, organizationId },\n    })\n\n    // Fetch updated task\n    const updatedTask = await em.findOne(UserTask, {\n      id: params.id,\n      tenantId,\n      organizationId,\n    })\n\n    return NextResponse.json({\n      data: updatedTask,\n      message: 'Task completed successfully. Workflow resumed.',\n    })\n  } catch (error) {\n    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status })\n    logger.error('Error completing user task', { err: error })\n\n    // Handle specific error codes from task-handler\n    if (error instanceof Error) {\n      if ((error as { code?: unknown }).code === 'UNKNOWN_DECISION') {\n        return NextResponse.json(\n          { error: error.message },\n          { status: 400 }\n        )\n      }\n      // \"Task is assigned to another user\" matches none of the message arms\n      // below, so this refusal used to answer 500. It is a conflict.\n      if ((error as { code?: unknown }).code === 'TASK_ASSIGNED_TO_ANOTHER_USER') {\n        return NextResponse.json(\n          { error: error.message },\n          { status: 409 }\n        )\n      }\n      if (error.message.includes('not found')) {\n        return NextResponse.json(\n          { error: error.message },\n          { status: 404 }\n        )\n      }\n      if (error.message.includes('validation')) {\n        return NextResponse.json(\n          { error: error.message },\n          { status: 400 }\n        )\n      }\n      if (error.message.includes('already completed')) {\n        return NextResponse.json(\n          { error: error.message },\n          { status: 409 }\n        )\n      }\n    }\n\n    return NextResponse.json(\n      {\n        error: 'Failed to complete user task',\n        details: error instanceof Error ? error.message : String(error),\n      },\n      { status: 500 }\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'Complete user task',\n  methods: {\n    POST: {\n      summary: 'Complete a task with form data',\n      description: 'Validates form data against task schema, updates task with completion data, merges form data into workflow context, and resumes workflow execution.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: openApiCompleteTaskSchema,\n      },\n      responses: [\n        { status: 200, description: 'Task completed successfully', schema: userTaskCompleteResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid request body, validation failed, or missing context', schema: workflowErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: workflowErrorSchema },\n        { status: 403, description: 'The task is visible to the caller but is not theirs to act on \u2014 it has no assignee and no role queue, so it must be reassigned first (\u00A76.4: administration widens seeing, never acting).', schema: workflowErrorSchema },\n        { status: 404, description: 'Task not found, or not visible to the caller', schema: workflowErrorSchema },\n        { status: 409, description: 'Task already completed', schema: workflowErrorSchema },\n        { status: 500, description: 'Internal server error', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAOA,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAElD,SAAS,sBAAsB;AAC/B;AAAA,EACE;AAAA,EACA,6BAA6B;AAAA,EAC7B;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,uBAAuB;AAEhC,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,0BAA0B;AAC9C;AAGA,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,IAAI,CAAC;AAAA,EACtC,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAK9B,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACzC,CAAC;AAoBD,eAAsB,KACpB,SACA,EAAE,OAAO,GACT;AACA,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,kCAAkC,OAAO,IAAI;AAEpE,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,yCAAyC;AAAA,QAClD,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAGA,UAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,UAAM,cAAc,mBAAmB,UAAU,IAAI;AAErD,QAAI,CAAC,YAAY,SAAS;AACxB,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO;AAAA,UACP,SAAS,YAAY,MAAM,OAAO;AAAA,QACpC;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,EAAE,UAAU,UAAU,WAAW,IAAI,YAAY;AAOvD,UAAM,OAAO,MAAM,eAAe;AAAA,MAChC;AAAA,MACA;AAAA,MACA,MAAM,EAAE,QAAQ,KAAK,KAAK,UAAU,WAAW,KAAK,SAAS,CAAC,EAAE;AAAA,MAChE,QAAQ,OAAO;AAAA,MACf;AAAA;AAAA;AAAA;AAAA,MAIA,kBAAkB;AAAA,IACpB,CAAC;AAED,QAAI,CAAC,KAAK,SAAS;AACjB,aAAO,aAAa,KAAK,KAAK,QAAQ,MAAM,EAAE,QAAQ,KAAK,QAAQ,OAAO,CAAC;AAAA,IAC7E;AAEA,UAAM,EAAE,SAAS,IAAI,MAAM,OAAO,2BAA2B;AAG7D,UAAM,cAAc,UAAU,QAA4B,aAAa;AACvE,UAAM,YAAY,iBAAiB,IAAI,WAAW;AAAA,MAChD,QAAQ,OAAO;AAAA,MACf;AAAA,MACA,QAAQ,KAAK;AAAA,MACb;AAAA,MACA;AAAA,MACA,OAAO,EAAE,UAAU,eAAe;AAAA,IACpC,CAAC;AAGD,UAAM,cAAc,MAAM,GAAG,QAAQ,UAAU;AAAA,MAC7C,IAAI,OAAO;AAAA,MACX;AAAA,MACA;AAAA,IACF,CAAC;AAED,WAAO,aAAa,KAAK;AAAA,MACvB,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,EAAG,QAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AACzF,WAAO,MAAM,8BAA8B,EAAE,KAAK,MAAM,CAAC;AAGzD,QAAI,iBAAiB,OAAO;AAC1B,UAAK,MAA6B,SAAS,oBAAoB;AAC7D,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,MAAM,QAAQ;AAAA,UACvB,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAGA,UAAK,MAA6B,SAAS,iCAAiC;AAC1E,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,MAAM,QAAQ;AAAA,UACvB,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,UAAI,MAAM,QAAQ,SAAS,WAAW,GAAG;AACvC,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,MAAM,QAAQ;AAAA,UACvB,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,UAAI,MAAM,QAAQ,SAAS,YAAY,GAAG;AACxC,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,MAAM,QAAQ;AAAA,UACvB,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,UAAI,MAAM,QAAQ,SAAS,mBAAmB,GAAG;AAC/C,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,MAAM,QAAQ;AAAA,UACvB,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAEA,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,OAAO;AAAA,QACP,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAChE;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,+BAA+B,QAAQ,+BAA+B;AAAA,MACpG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,+DAA+D,QAAQ,oBAAoB;AAAA,QACvH,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,oMAA4L,QAAQ,oBAAoB;AAAA,QACpP,EAAE,QAAQ,KAAK,aAAa,gDAAgD,QAAQ,oBAAoB;AAAA,QACxG,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,oBAAoB;AAAA,QAClF,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/workflows/api/tasks/[id]/reassign/route.js

@@ -2,6 +2,7 @@ import { NextResponse } from "next/server";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { enforceCommandOptimisticLock } from "@open-mercato/shared/lib/crud/optimistic-lock-command";
 import { createLogger } from "@open-mercato/shared/lib/logger";
@@ -29,7 +30,7 @@ async function POST(request, { params }) {
     }
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request });
     const tenantId = auth.tenantId;
-    const organizationId = scope?.selectedId ?? auth.orgId;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth);
     if (!tenantId || !organizationId) {
       return NextResponse.json(
         { error: "Missing tenant or organization context" },

package/dist/modules/workflows/api/tasks/[id]/reassign/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/workflows/api/tasks/%5Bid%5D/reassign/route.ts"],
-  "sourcesContent": ["/**\n * User Task Reassignment API\n *\n * Endpoints:\n * - POST /api/workflows/tasks/[id]/reassign - Move a task to another assignee or role queue\n *\n * This is the act half of \u00A76.4's central asymmetry. `workflows.tasks.view_all`\n * lets an administrator SEE a colleague's task and never lets them finish it, so\n * the sanctioned path to acting on somebody else's work is to take it first \u2014\n * here \u2014 and the taking is permanently recorded on the audit columns plus a\n * `WorkflowEvent`.\n *\n * It is also the documented remedy for the one shape the model leaves\n * uncompletable: a task with no assignee, no claim and no role queue belongs to\n * nobody, so the act routes answer `TASK_NOT_ACTIONABLE` and name this endpoint.\n * The gate below therefore checks VISIBILITY, never ownership \u2014 requiring\n * ownership would make the unrescuable task unrescuable by definition.\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { TaskHandlerService } from '../../../../lib/task-handler'\nimport { gateTaskAction } from '../../../../lib/task-visibility-request'\nimport { reassignUserTaskSchema } from '../../../../data/validators'\nimport { serializeUserTask } from '../../serialize'\nimport {\n  workflowsTag,\n  userTaskReassignResponseSchema,\n  workflowErrorSchema,\n} from '../../../openapi'\n\nconst logger = createLogger('workflows')\n\n/**\n * `UserTask` is deliberately absent from the curated optimistic-lock entity\n * list, and `optimistic-lock-ui-coverage.test.ts` only matches `PUT`/`PATCH`/\n * `DELETE`, so nothing enforces the header here automatically. The route honours\n * it explicitly: a client that sends `x-om-ext-optimistic-lock-expected-updated-at`\n * gets the same structured 409 every CRUD surface returns, and one that does not\n * is unaffected (the helper is a no-op without the header).\n */\nconst REASSIGN_RESOURCE_KIND = 'workflows.user_task'\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.tasks.reassign'],\n}\n\nexport async function POST(\n  request: NextRequest,\n  { params }: { params: { id: string } },\n) {\n  try {\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = scope?.selectedId ?? auth.orgId\n\n    if (!tenantId || !organizationId) {\n      return NextResponse.json(\n        { error: 'Missing tenant or organization context' },\n        { status: 400 },\n      )\n    }\n\n    let payload: unknown\n    try {\n      payload = await request.json()\n    } catch {\n      payload = {}\n    }\n\n    const parsed = reassignUserTaskSchema.safeParse(payload)\n    if (!parsed.success) {\n      return NextResponse.json(\n        { error: 'Invalid request body', details: parsed.error.issues },\n        { status: 400 },\n      )\n    }\n\n    // Visibility only \u2014 see the file header. A `workflows.tasks.reassign` holder\n    // depends on `workflows.tasks.view_all`, so an administrator reaches every\n    // row in scope, including the ownerless one this endpoint exists to rescue.\n    const gate = await gateTaskAction({\n      container,\n      em,\n      auth: { userId: auth.sub, tenantId, roleNames: auth.roles ?? [] },\n      taskId: params.id,\n      organizationId,\n    })\n\n    if (!gate.allowed) {\n      return NextResponse.json(gate.refusal.body, { status: gate.refusal.status })\n    }\n\n    enforceCommandOptimisticLock({\n      resourceKind: REASSIGN_RESOURCE_KIND,\n      resourceId: gate.task.id,\n      current: gate.task.updatedAt,\n      request,\n    })\n\n    const taskHandler = container.resolve<TaskHandlerService>('taskHandler')\n    const task = await taskHandler.reassignUserTask(em, {\n      taskId: params.id,\n      userId: auth.sub,\n      target: {\n        assignedTo: parsed.data.assignedTo,\n        assignedToRoles: parsed.data.assignedToRoles,\n      },\n      reason: parsed.data.reason,\n      scope: { tenantId, organizationId },\n    })\n\n    return NextResponse.json({\n      data: serializeUserTask(task),\n      message: 'Task reassigned successfully',\n    })\n  } catch (error) {\n    if (isCrudHttpError(error)) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n\n    const code = (error as { code?: unknown } | null)?.code\n    if (code === 'TASK_NOT_FOUND') {\n      return NextResponse.json({ error: (error as Error).message }, { status: 404 })\n    }\n    if (code === 'TASK_NOT_REASSIGNABLE') {\n      return NextResponse.json(\n        { error: (error as Error).message, code: 'TASK_NOT_REASSIGNABLE' },\n        { status: 409 },\n      )\n    }\n\n    logger.error('Error reassigning user task', { err: error })\n    return NextResponse.json(\n      {\n        error: 'Failed to reassign user task',\n        details: error instanceof Error ? error.message : String(error),\n      },\n      { status: 500 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'Reassign user task',\n  methods: {\n    POST: {\n      summary: 'Move a task to another assignee or role queue',\n      description:\n        'Records who moved the task, when, and why (`reassignedBy` / `reassignedAt` / `reassignReason`) and logs a `USER_TASK_REASSIGNED` workflow event. Requires `workflows.tasks.reassign`. An in-flight claim is released and an IN_PROGRESS task returns to PENDING; the status vocabulary is unchanged. Honours the optimistic-lock header `x-om-ext-optimistic-lock-expected-updated-at`.',\n      requestBody: { schema: reassignUserTaskSchema },\n      responses: [\n        {\n          status: 200,\n          description: 'Task reassigned successfully',\n          schema: userTaskReassignResponseSchema,\n        },\n      ],\n      errors: [\n        {\n          status: 400,\n          description: 'Missing tenant/organization context, or a body naming neither an assignee nor a role queue',\n          schema: workflowErrorSchema,\n        },\n        { status: 401, description: 'Unauthorized', schema: workflowErrorSchema },\n        {\n          status: 403,\n          description: 'Visible to the caller but refused by the entity gate, with the blocking entity type named',\n          schema: workflowErrorSchema,\n        },\n        { status: 404, description: 'Task not found, or not visible to the caller', schema: workflowErrorSchema },\n        {\n          status: 409,\n          description: 'Task is in a terminal status, or the record changed since it was loaded (optimistic lock)',\n          schema: workflowErrorSchema,\n        },\n        { status: 500, description: 'Internal server error', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAmBA,SAAsB,oBAAoB;AAE1C,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,uBAAuB;AAChC,SAAS,oCAAoC;AAC7C,SAAS,oBAAoB;AAE7B,SAAS,sBAAsB;AAC/B,SAAS,8BAA8B;AACvC,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,WAAW;AAUvC,MAAM,yBAAyB;AAExB,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,0BAA0B;AAC9C;AAEA,eAAsB,KACpB,SACA,EAAE,OAAO,GACT;AACA,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,cAAc,KAAK;AAEjD,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,yCAAyC;AAAA,QAClD,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,QAAQ,KAAK;AAAA,IAC/B,QAAQ;AACN,gBAAU,CAAC;AAAA,IACb;AAEA,UAAM,SAAS,uBAAuB,UAAU,OAAO;AACvD,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,wBAAwB,SAAS,OAAO,MAAM,OAAO;AAAA,QAC9D,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAKA,UAAM,OAAO,MAAM,eAAe;AAAA,MAChC;AAAA,MACA;AAAA,MACA,MAAM,EAAE,QAAQ,KAAK,KAAK,UAAU,WAAW,KAAK,SAAS,CAAC,EAAE;AAAA,MAChE,QAAQ,OAAO;AAAA,MACf;AAAA,IACF,CAAC;AAED,QAAI,CAAC,KAAK,SAAS;AACjB,aAAO,aAAa,KAAK,KAAK,QAAQ,MAAM,EAAE,QAAQ,KAAK,QAAQ,OAAO,CAAC;AAAA,IAC7E;AAEA,iCAA6B;AAAA,MAC3B,cAAc;AAAA,MACd,YAAY,KAAK,KAAK;AAAA,MACtB,SAAS,KAAK,KAAK;AAAA,MACnB;AAAA,IACF,CAAC;AAED,UAAM,cAAc,UAAU,QAA4B,aAAa;AACvE,UAAM,OAAO,MAAM,YAAY,iBAAiB,IAAI;AAAA,MAClD,QAAQ,OAAO;AAAA,MACf,QAAQ,KAAK;AAAA,MACb,QAAQ;AAAA,QACN,YAAY,OAAO,KAAK;AAAA,QACxB,iBAAiB,OAAO,KAAK;AAAA,MAC/B;AAAA,MACA,QAAQ,OAAO,KAAK;AAAA,MACpB,OAAO,EAAE,UAAU,eAAe;AAAA,IACpC,CAAC;AAED,WAAO,aAAa,KAAK;AAAA,MACvB,MAAM,kBAAkB,IAAI;AAAA,MAC5B,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,GAAG;AAC1B,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AAEA,UAAM,OAAQ,OAAqC;AACnD,QAAI,SAAS,kBAAkB;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAQ,MAAgB,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/E;AACA,QAAI,SAAS,yBAAyB;AACpC,aAAO,aAAa;AAAA,QAClB,EAAE,OAAQ,MAAgB,SAAS,MAAM,wBAAwB;AAAA,QACjE,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,WAAO,MAAM,+BAA+B,EAAE,KAAK,MAAM,CAAC;AAC1D,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,OAAO;AAAA,QACP,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAChE;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,QAAQ,uBAAuB;AAAA,MAC9C,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,gDAAgD,QAAQ,oBAAoB;AAAA,QACxG;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * User Task Reassignment API\n *\n * Endpoints:\n * - POST /api/workflows/tasks/[id]/reassign - Move a task to another assignee or role queue\n *\n * This is the act half of \u00A76.4's central asymmetry. `workflows.tasks.view_all`\n * lets an administrator SEE a colleague's task and never lets them finish it, so\n * the sanctioned path to acting on somebody else's work is to take it first \u2014\n * here \u2014 and the taking is permanently recorded on the audit columns plus a\n * `WorkflowEvent`.\n *\n * It is also the documented remedy for the one shape the model leaves\n * uncompletable: a task with no assignee, no claim and no role queue belongs to\n * nobody, so the act routes answer `TASK_NOT_ACTIONABLE` and name this endpoint.\n * The gate below therefore checks VISIBILITY, never ownership \u2014 requiring\n * ownership would make the unrescuable task unrescuable by definition.\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { TaskHandlerService } from '../../../../lib/task-handler'\nimport { gateTaskAction } from '../../../../lib/task-visibility-request'\nimport { reassignUserTaskSchema } from '../../../../data/validators'\nimport { serializeUserTask } from '../../serialize'\nimport {\n  workflowsTag,\n  userTaskReassignResponseSchema,\n  workflowErrorSchema,\n} from '../../../openapi'\n\nconst logger = createLogger('workflows')\n\n/**\n * `UserTask` is deliberately absent from the curated optimistic-lock entity\n * list, and `optimistic-lock-ui-coverage.test.ts` only matches `PUT`/`PATCH`/\n * `DELETE`, so nothing enforces the header here automatically. The route honours\n * it explicitly: a client that sends `x-om-ext-optimistic-lock-expected-updated-at`\n * gets the same structured 409 every CRUD surface returns, and one that does not\n * is unaffected (the helper is a no-op without the header).\n */\nconst REASSIGN_RESOURCE_KIND = 'workflows.user_task'\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.tasks.reassign'],\n}\n\nexport async function POST(\n  request: NextRequest,\n  { params }: { params: { id: string } },\n) {\n  try {\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth)\n\n    if (!tenantId || !organizationId) {\n      return NextResponse.json(\n        { error: 'Missing tenant or organization context' },\n        { status: 400 },\n      )\n    }\n\n    let payload: unknown\n    try {\n      payload = await request.json()\n    } catch {\n      payload = {}\n    }\n\n    const parsed = reassignUserTaskSchema.safeParse(payload)\n    if (!parsed.success) {\n      return NextResponse.json(\n        { error: 'Invalid request body', details: parsed.error.issues },\n        { status: 400 },\n      )\n    }\n\n    // Visibility only \u2014 see the file header. A `workflows.tasks.reassign` holder\n    // depends on `workflows.tasks.view_all`, so an administrator reaches every\n    // row in scope, including the ownerless one this endpoint exists to rescue.\n    const gate = await gateTaskAction({\n      container,\n      em,\n      auth: { userId: auth.sub, tenantId, roleNames: auth.roles ?? [] },\n      taskId: params.id,\n      organizationId,\n    })\n\n    if (!gate.allowed) {\n      return NextResponse.json(gate.refusal.body, { status: gate.refusal.status })\n    }\n\n    enforceCommandOptimisticLock({\n      resourceKind: REASSIGN_RESOURCE_KIND,\n      resourceId: gate.task.id,\n      current: gate.task.updatedAt,\n      request,\n    })\n\n    const taskHandler = container.resolve<TaskHandlerService>('taskHandler')\n    const task = await taskHandler.reassignUserTask(em, {\n      taskId: params.id,\n      userId: auth.sub,\n      target: {\n        assignedTo: parsed.data.assignedTo,\n        assignedToRoles: parsed.data.assignedToRoles,\n      },\n      reason: parsed.data.reason,\n      scope: { tenantId, organizationId },\n    })\n\n    return NextResponse.json({\n      data: serializeUserTask(task),\n      message: 'Task reassigned successfully',\n    })\n  } catch (error) {\n    if (isCrudHttpError(error)) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n\n    const code = (error as { code?: unknown } | null)?.code\n    if (code === 'TASK_NOT_FOUND') {\n      return NextResponse.json({ error: (error as Error).message }, { status: 404 })\n    }\n    if (code === 'TASK_NOT_REASSIGNABLE') {\n      return NextResponse.json(\n        { error: (error as Error).message, code: 'TASK_NOT_REASSIGNABLE' },\n        { status: 409 },\n      )\n    }\n\n    logger.error('Error reassigning user task', { err: error })\n    return NextResponse.json(\n      {\n        error: 'Failed to reassign user task',\n        details: error instanceof Error ? error.message : String(error),\n      },\n      { status: 500 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'Reassign user task',\n  methods: {\n    POST: {\n      summary: 'Move a task to another assignee or role queue',\n      description:\n        'Records who moved the task, when, and why (`reassignedBy` / `reassignedAt` / `reassignReason`) and logs a `USER_TASK_REASSIGNED` workflow event. Requires `workflows.tasks.reassign`. An in-flight claim is released and an IN_PROGRESS task returns to PENDING; the status vocabulary is unchanged. Honours the optimistic-lock header `x-om-ext-optimistic-lock-expected-updated-at`.',\n      requestBody: { schema: reassignUserTaskSchema },\n      responses: [\n        {\n          status: 200,\n          description: 'Task reassigned successfully',\n          schema: userTaskReassignResponseSchema,\n        },\n      ],\n      errors: [\n        {\n          status: 400,\n          description: 'Missing tenant/organization context, or a body naming neither an assignee nor a role queue',\n          schema: workflowErrorSchema,\n        },\n        { status: 401, description: 'Unauthorized', schema: workflowErrorSchema },\n        {\n          status: 403,\n          description: 'Visible to the caller but refused by the entity gate, with the blocking entity type named',\n          schema: workflowErrorSchema,\n        },\n        { status: 404, description: 'Task not found, or not visible to the caller', schema: workflowErrorSchema },\n        {\n          status: 409,\n          description: 'Task is in a terminal status, or the record changed since it was loaded (optimistic lock)',\n          schema: workflowErrorSchema,\n        },\n        { status: 500, description: 'Internal server error', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAmBA,SAAsB,oBAAoB;AAE1C,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,uBAAuB;AAChC,SAAS,oCAAoC;AAC7C,SAAS,oBAAoB;AAE7B,SAAS,sBAAsB;AAC/B,SAAS,8BAA8B;AACvC,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,WAAW;AAUvC,MAAM,yBAAyB;AAExB,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,0BAA0B;AAC9C;AAEA,eAAsB,KACpB,SACA,EAAE,OAAO,GACT;AACA,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,kCAAkC,OAAO,IAAI;AAEpE,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,yCAAyC;AAAA,QAClD,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,QAAQ,KAAK;AAAA,IAC/B,QAAQ;AACN,gBAAU,CAAC;AAAA,IACb;AAEA,UAAM,SAAS,uBAAuB,UAAU,OAAO;AACvD,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,wBAAwB,SAAS,OAAO,MAAM,OAAO;AAAA,QAC9D,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAKA,UAAM,OAAO,MAAM,eAAe;AAAA,MAChC;AAAA,MACA;AAAA,MACA,MAAM,EAAE,QAAQ,KAAK,KAAK,UAAU,WAAW,KAAK,SAAS,CAAC,EAAE;AAAA,MAChE,QAAQ,OAAO;AAAA,MACf;AAAA,IACF,CAAC;AAED,QAAI,CAAC,KAAK,SAAS;AACjB,aAAO,aAAa,KAAK,KAAK,QAAQ,MAAM,EAAE,QAAQ,KAAK,QAAQ,OAAO,CAAC;AAAA,IAC7E;AAEA,iCAA6B;AAAA,MAC3B,cAAc;AAAA,MACd,YAAY,KAAK,KAAK;AAAA,MACtB,SAAS,KAAK,KAAK;AAAA,MACnB;AAAA,IACF,CAAC;AAED,UAAM,cAAc,UAAU,QAA4B,aAAa;AACvE,UAAM,OAAO,MAAM,YAAY,iBAAiB,IAAI;AAAA,MAClD,QAAQ,OAAO;AAAA,MACf,QAAQ,KAAK;AAAA,MACb,QAAQ;AAAA,QACN,YAAY,OAAO,KAAK;AAAA,QACxB,iBAAiB,OAAO,KAAK;AAAA,MAC/B;AAAA,MACA,QAAQ,OAAO,KAAK;AAAA,MACpB,OAAO,EAAE,UAAU,eAAe;AAAA,IACpC,CAAC;AAED,WAAO,aAAa,KAAK;AAAA,MACvB,MAAM,kBAAkB,IAAI;AAAA,MAC5B,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,GAAG;AAC1B,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AAEA,UAAM,OAAQ,OAAqC;AACnD,QAAI,SAAS,kBAAkB;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAQ,MAAgB,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/E;AACA,QAAI,SAAS,yBAAyB;AACpC,aAAO,aAAa;AAAA,QAClB,EAAE,OAAQ,MAAgB,SAAS,MAAM,wBAAwB;AAAA,QACjE,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,WAAO,MAAM,+BAA+B,EAAE,KAAK,MAAM,CAAC;AAC1D,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,OAAO;AAAA,QACP,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAChE;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,QAAQ,uBAAuB;AAAA,MAC9C,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,gDAAgD,QAAQ,oBAAoB;AAAA,QACxG;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/workflows/api/tasks/[id]/unclaim/route.js

@@ -2,6 +2,7 @@ import { NextResponse } from "next/server";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { createLogger } from "@open-mercato/shared/lib/logger";
 import { gateTaskAction } from "../../../../lib/task-visibility-request.js";
 import { serializeUserTask } from "../../serialize.js";
@@ -11,6 +12,7 @@ import {
   userTaskClaimResponseSchema,
   workflowErrorSchema
 } from "../../../openapi.js";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 const logger = createLogger("workflows");
 const metadata = {
   requireAuth: true,
@@ -26,7 +28,7 @@ async function POST(request, { params }) {
     }
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request });
     const tenantId = auth.tenantId;
-    const organizationId = scope?.selectedId ?? auth.orgId;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth);
     if (!tenantId || !organizationId) {
       return NextResponse.json(
         { error: "Missing tenant or organization context" },
@@ -54,6 +56,7 @@ async function POST(request, { params }) {
       message: "Task released successfully"
     });
   } catch (error) {
+    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status });
     logger.error("Error releasing user task", { err: error });
     const code = error?.code;
     if (code === "TASK_NOT_FOUND") {

package/dist/modules/workflows/api/tasks/[id]/unclaim/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/workflows/api/tasks/%5Bid%5D/unclaim/route.ts"],
-  "sourcesContent": ["/**\n * User Task Unclaim API\n *\n * Endpoints:\n * - POST /api/workflows/tasks/[id]/unclaim - Release a claimed task back to its\n *   role queue\n *\n * The counterpart of `claim`. New route, so purely additive\n * (BACKWARD_COMPATIBILITY.md \u00A77); gated on the same `workflows.tasks.claim`\n * feature, because releasing your own claim is part of claiming rather than a\n * separate authority.\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport type { EntityManager } from '@mikro-orm/core'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { TaskHandlerService } from '../../../../lib/task-handler'\nimport { gateTaskAction } from '../../../../lib/task-visibility-request'\nimport { serializeUserTask } from '../../serialize'\nimport { UserTask } from '../../../../data/entities'\nimport {\n  workflowsTag,\n  userTaskClaimResponseSchema,\n  workflowErrorSchema,\n} from '../../../openapi'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.tasks.claim'],\n}\n\nexport async function POST(\n  request: NextRequest,\n  { params }: { params: { id: string } }\n) {\n  try {\n    const container = await createRequestContainer()\n    const em = container.resolve<EntityManager>('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = scope?.selectedId ?? auth.orgId\n\n    if (!tenantId || !organizationId) {\n      return NextResponse.json(\n        { error: 'Missing tenant or organization context' },\n        { status: 400 }\n      )\n    }\n\n    // \u00A76.4 first, so a caller with no relationship to the task cannot tell a\n    // claimed task from a nonexistent one. The handler still enforces that the\n    // caller IS the claimant, with the same compare-and-set.\n    const gate = await gateTaskAction({\n      container,\n      em,\n      auth: { userId: auth.sub, tenantId, roleNames: auth.roles ?? [] },\n      taskId: params.id,\n      organizationId,\n    })\n\n    if (!gate.allowed) {\n      return NextResponse.json(gate.refusal.body, { status: gate.refusal.status })\n    }\n\n    const taskHandler = container.resolve<TaskHandlerService>('taskHandler')\n    await taskHandler.releaseUserTask(em, params.id, auth.sub, { tenantId, organizationId })\n\n    const task = await em.findOne(UserTask, { id: params.id, tenantId, organizationId })\n\n    if (!task) {\n      return NextResponse.json({ error: 'Task not found after release' }, { status: 500 })\n    }\n\n    return NextResponse.json({\n      data: serializeUserTask(task),\n      message: 'Task released successfully',\n    })\n  } catch (error) {\n    logger.error('Error releasing user task', { err: error })\n\n    const code = (error as { code?: unknown } | null)?.code\n    if (code === 'TASK_NOT_FOUND') {\n      return NextResponse.json({ error: (error as Error).message }, { status: 404 })\n    }\n    if (code === 'TASK_ASSIGNED_TO_ANOTHER_USER') {\n      return NextResponse.json({ error: (error as Error).message }, { status: 409 })\n    }\n\n    return NextResponse.json(\n      {\n        error: 'Failed to release user task',\n        details: error instanceof Error ? error.message : String(error),\n      },\n      { status: 500 }\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'Release user task',\n  methods: {\n    POST: {\n      summary: 'Release a claimed task back to its role queue',\n      description:\n        'Clears the caller\\'s claim and returns the task to PENDING so another holder of the queued role can pick it up. Refused when the task is claimed by somebody else or is no longer in progress.',\n      responses: [\n        { status: 200, description: 'Task released successfully', schema: userTaskClaimResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing tenant or organization context', schema: workflowErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: workflowErrorSchema },\n        { status: 403, description: 'The task is visible to the caller but is not theirs to act on \u2014 it has no assignee and no role queue, so it must be reassigned first (\u00A76.4: administration widens seeing, never acting).', schema: workflowErrorSchema },\n        { status: 404, description: 'Task not found, not visible to the caller, or not claimed', schema: workflowErrorSchema },\n        { status: 409, description: 'Task claimed by another user', schema: workflowErrorSchema },\n        { status: 500, description: 'Internal server error', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAaA,SAAsB,oBAAoB;AAG1C,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,oBAAoB;AAE7B,SAAS,sBAAsB;AAC/B,SAAS,yBAAyB;AAClC,SAAS,gBAAgB;AACzB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,uBAAuB;AAC3C;AAEA,eAAsB,KACpB,SACA,EAAE,OAAO,GACT;AACA,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAuB,IAAI;AAChD,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,cAAc,KAAK;AAEjD,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,yCAAyC;AAAA,QAClD,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAKA,UAAM,OAAO,MAAM,eAAe;AAAA,MAChC;AAAA,MACA;AAAA,MACA,MAAM,EAAE,QAAQ,KAAK,KAAK,UAAU,WAAW,KAAK,SAAS,CAAC,EAAE;AAAA,MAChE,QAAQ,OAAO;AAAA,MACf;AAAA,IACF,CAAC;AAED,QAAI,CAAC,KAAK,SAAS;AACjB,aAAO,aAAa,KAAK,KAAK,QAAQ,MAAM,EAAE,QAAQ,KAAK,QAAQ,OAAO,CAAC;AAAA,IAC7E;AAEA,UAAM,cAAc,UAAU,QAA4B,aAAa;AACvE,UAAM,YAAY,gBAAgB,IAAI,OAAO,IAAI,KAAK,KAAK,EAAE,UAAU,eAAe,CAAC;AAEvF,UAAM,OAAO,MAAM,GAAG,QAAQ,UAAU,EAAE,IAAI,OAAO,IAAI,UAAU,eAAe,CAAC;AAEnF,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,+BAA+B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrF;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,MAAM,kBAAkB,IAAI;AAAA,MAC5B,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,6BAA6B,EAAE,KAAK,MAAM,CAAC;AAExD,UAAM,OAAQ,OAAqC;AACnD,QAAI,SAAS,kBAAkB;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAQ,MAAgB,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/E;AACA,QAAI,SAAS,iCAAiC;AAC5C,aAAO,aAAa,KAAK,EAAE,OAAQ,MAAgB,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/E;AAEA,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,OAAO;AAAA,QACP,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAChE;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,8BAA8B,QAAQ,4BAA4B;AAAA,MAChG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0CAA0C,QAAQ,oBAAoB;AAAA,QAClG,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,oMAA4L,QAAQ,oBAAoB;AAAA,QACpP,EAAE,QAAQ,KAAK,aAAa,6DAA6D,QAAQ,oBAAoB;AAAA,QACrH,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,oBAAoB;AAAA,QACxF,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * User Task Unclaim API\n *\n * Endpoints:\n * - POST /api/workflows/tasks/[id]/unclaim - Release a claimed task back to its\n *   role queue\n *\n * The counterpart of `claim`. New route, so purely additive\n * (BACKWARD_COMPATIBILITY.md \u00A77); gated on the same `workflows.tasks.claim`\n * feature, because releasing your own claim is part of claiming rather than a\n * separate authority.\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport type { EntityManager } from '@mikro-orm/core'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { TaskHandlerService } from '../../../../lib/task-handler'\nimport { gateTaskAction } from '../../../../lib/task-visibility-request'\nimport { serializeUserTask } from '../../serialize'\nimport { UserTask } from '../../../../data/entities'\nimport {\n  workflowsTag,\n  userTaskClaimResponseSchema,\n  workflowErrorSchema,\n} from '../../../openapi'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.tasks.claim'],\n}\n\nexport async function POST(\n  request: NextRequest,\n  { params }: { params: { id: string } }\n) {\n  try {\n    const container = await createRequestContainer()\n    const em = container.resolve<EntityManager>('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth)\n\n    if (!tenantId || !organizationId) {\n      return NextResponse.json(\n        { error: 'Missing tenant or organization context' },\n        { status: 400 }\n      )\n    }\n\n    // \u00A76.4 first, so a caller with no relationship to the task cannot tell a\n    // claimed task from a nonexistent one. The handler still enforces that the\n    // caller IS the claimant, with the same compare-and-set.\n    const gate = await gateTaskAction({\n      container,\n      em,\n      auth: { userId: auth.sub, tenantId, roleNames: auth.roles ?? [] },\n      taskId: params.id,\n      organizationId,\n    })\n\n    if (!gate.allowed) {\n      return NextResponse.json(gate.refusal.body, { status: gate.refusal.status })\n    }\n\n    const taskHandler = container.resolve<TaskHandlerService>('taskHandler')\n    await taskHandler.releaseUserTask(em, params.id, auth.sub, { tenantId, organizationId })\n\n    const task = await em.findOne(UserTask, { id: params.id, tenantId, organizationId })\n\n    if (!task) {\n      return NextResponse.json({ error: 'Task not found after release' }, { status: 500 })\n    }\n\n    return NextResponse.json({\n      data: serializeUserTask(task),\n      message: 'Task released successfully',\n    })\n  } catch (error) {\n    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status })\n    logger.error('Error releasing user task', { err: error })\n\n    const code = (error as { code?: unknown } | null)?.code\n    if (code === 'TASK_NOT_FOUND') {\n      return NextResponse.json({ error: (error as Error).message }, { status: 404 })\n    }\n    if (code === 'TASK_ASSIGNED_TO_ANOTHER_USER') {\n      return NextResponse.json({ error: (error as Error).message }, { status: 409 })\n    }\n\n    return NextResponse.json(\n      {\n        error: 'Failed to release user task',\n        details: error instanceof Error ? error.message : String(error),\n      },\n      { status: 500 }\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'Release user task',\n  methods: {\n    POST: {\n      summary: 'Release a claimed task back to its role queue',\n      description:\n        'Clears the caller\\'s claim and returns the task to PENDING so another holder of the queued role can pick it up. Refused when the task is claimed by somebody else or is no longer in progress.',\n      responses: [\n        { status: 200, description: 'Task released successfully', schema: userTaskClaimResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing tenant or organization context', schema: workflowErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: workflowErrorSchema },\n        { status: 403, description: 'The task is visible to the caller but is not theirs to act on \u2014 it has no assignee and no role queue, so it must be reassigned first (\u00A76.4: administration widens seeing, never acting).', schema: workflowErrorSchema },\n        { status: 404, description: 'Task not found, not visible to the caller, or not claimed', schema: workflowErrorSchema },\n        { status: 409, description: 'Task claimed by another user', schema: workflowErrorSchema },\n        { status: 500, description: 'Internal server error', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAaA,SAAsB,oBAAoB;AAG1C,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,oBAAoB;AAE7B,SAAS,sBAAsB;AAC/B,SAAS,yBAAyB;AAClC,SAAS,gBAAgB;AACzB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,uBAAuB;AAEhC,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,uBAAuB;AAC3C;AAEA,eAAsB,KACpB,SACA,EAAE,OAAO,GACT;AACA,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAuB,IAAI;AAChD,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,kCAAkC,OAAO,IAAI;AAEpE,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,yCAAyC;AAAA,QAClD,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAKA,UAAM,OAAO,MAAM,eAAe;AAAA,MAChC;AAAA,MACA;AAAA,MACA,MAAM,EAAE,QAAQ,KAAK,KAAK,UAAU,WAAW,KAAK,SAAS,CAAC,EAAE;AAAA,MAChE,QAAQ,OAAO;AAAA,MACf;AAAA,IACF,CAAC;AAED,QAAI,CAAC,KAAK,SAAS;AACjB,aAAO,aAAa,KAAK,KAAK,QAAQ,MAAM,EAAE,QAAQ,KAAK,QAAQ,OAAO,CAAC;AAAA,IAC7E;AAEA,UAAM,cAAc,UAAU,QAA4B,aAAa;AACvE,UAAM,YAAY,gBAAgB,IAAI,OAAO,IAAI,KAAK,KAAK,EAAE,UAAU,eAAe,CAAC;AAEvF,UAAM,OAAO,MAAM,GAAG,QAAQ,UAAU,EAAE,IAAI,OAAO,IAAI,UAAU,eAAe,CAAC;AAEnF,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,+BAA+B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrF;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,MAAM,kBAAkB,IAAI;AAAA,MAC5B,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,EAAG,QAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AACzF,WAAO,MAAM,6BAA6B,EAAE,KAAK,MAAM,CAAC;AAExD,UAAM,OAAQ,OAAqC;AACnD,QAAI,SAAS,kBAAkB;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAQ,MAAgB,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/E;AACA,QAAI,SAAS,iCAAiC;AAC5C,aAAO,aAAa,KAAK,EAAE,OAAQ,MAAgB,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/E;AAEA,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,OAAO;AAAA,QACP,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAChE;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,8BAA8B,QAAQ,4BAA4B;AAAA,MAChG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0CAA0C,QAAQ,oBAAoB;AAAA,QAClG,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,oMAA4L,QAAQ,oBAAoB;AAAA,QACpP,EAAE,QAAQ,KAAK,aAAa,6DAA6D,QAAQ,oBAAoB;AAAA,QACrH,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,oBAAoB;AAAA,QACxF,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/workflows/api/templates/route.js

@@ -2,9 +2,11 @@ import { NextResponse } from "next/server";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { loadWorkflowTemplates } from "../../lib/workflow-templates.js";
 import { workflowsTag, workflowErrorSchema, workflowTemplateListResponseSchema } from "../openapi.js";
 import { createLogger } from "@open-mercato/shared/lib/logger";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 const logger = createLogger("workflows");
 const metadata = {
   requireAuth: true,
@@ -19,7 +21,7 @@ async function GET(request) {
     }
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request });
     const tenantId = auth.tenantId;
-    const organizationId = scope?.selectedId ?? auth.orgId;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth);
     if (!tenantId) {
       return NextResponse.json({ error: "Missing tenant context" }, { status: 400 });
     }
@@ -35,6 +37,7 @@ async function GET(request) {
     const items = loadWorkflowTemplates();
     return NextResponse.json({ items });
   } catch (error) {
+    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status });
     logger.error("Error listing workflow templates", { err: error });
     return NextResponse.json(
       { error: "Failed to list workflow templates" },

package/dist/modules/workflows/api/templates/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/workflows/api/templates/route.ts"],
-  "sourcesContent": ["/**\n * Workflow Templates API\n *\n * Endpoint:\n * - GET /api/workflows/templates - List seeded workflow templates for the gallery\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { loadWorkflowTemplates } from '../../lib/workflow-templates'\nimport { workflowsTag, workflowErrorSchema, workflowTemplateListResponseSchema } from '../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.view'],\n}\n\n/**\n * GET /api/workflows/templates\n *\n * List the shipped workflow templates (gallery metadata + full definitions).\n */\nexport async function GET(request: NextRequest) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = scope?.selectedId ?? auth.orgId\n\n    if (!tenantId) {\n      return NextResponse.json({ error: 'Missing tenant context' }, { status: 400 })\n    }\n\n    const rbacService = container.resolve('rbacService')\n    const hasPermission = await rbacService.userHasAllFeatures(\n      auth.sub,\n      ['workflows.definitions.view'],\n      { tenantId, organizationId }\n    )\n\n    if (!hasPermission) {\n      return NextResponse.json({ error: 'Insufficient permissions' }, { status: 403 })\n    }\n\n    const items = loadWorkflowTemplates()\n\n    return NextResponse.json({ items })\n  } catch (error) {\n    logger.error('Error listing workflow templates', { err: error })\n    return NextResponse.json(\n      { error: 'Failed to list workflow templates' },\n      { status: 500 }\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'List workflow templates',\n  methods: {\n    GET: {\n      summary: 'List seeded workflow templates',\n      description: 'Returns the shipped workflow template gallery: metadata (id, i18n name/description keys, category, icon) plus the complete workflow definition each template seeds.',\n      responses: [\n        { status: 200, description: 'Available workflow templates', schema: workflowTemplateListResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing tenant context', schema: workflowErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: workflowErrorSchema },\n        { status: 403, description: 'Insufficient permissions', schema: workflowErrorSchema },\n        { status: 500, description: 'Internal server error', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAOA,SAAsB,oBAAoB;AAE1C,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,6BAA6B;AACtC,SAAS,cAAc,qBAAqB,0CAA0C;AACtF,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,4BAA4B;AAChD;AAOA,eAAsB,IAAI,SAAsB;AAC9C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,cAAc,KAAK;AAEjD,QAAI,CAAC,UAAU;AACb,aAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/E;AAEA,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,UAAM,gBAAgB,MAAM,YAAY;AAAA,MACtC,KAAK;AAAA,MACL,CAAC,4BAA4B;AAAA,MAC7B,EAAE,UAAU,eAAe;AAAA,IAC7B;AAEA,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjF;AAEA,UAAM,QAAQ,sBAAsB;AAEpC,WAAO,aAAa,KAAK,EAAE,MAAM,CAAC;AAAA,EACpC,SAAS,OAAO;AACd,WAAO,MAAM,oCAAoC,EAAE,KAAK,MAAM,CAAC;AAC/D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,oCAAoC;AAAA,MAC7C,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,mCAAmC;AAAA,MACzG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,oBAAoB;AAAA,QAClF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * Workflow Templates API\n *\n * Endpoint:\n * - GET /api/workflows/templates - List seeded workflow templates for the gallery\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { loadWorkflowTemplates } from '../../lib/workflow-templates'\nimport { workflowsTag, workflowErrorSchema, workflowTemplateListResponseSchema } from '../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.view'],\n}\n\n/**\n * GET /api/workflows/templates\n *\n * List the shipped workflow templates (gallery metadata + full definitions).\n */\nexport async function GET(request: NextRequest) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth)\n\n    if (!tenantId) {\n      return NextResponse.json({ error: 'Missing tenant context' }, { status: 400 })\n    }\n\n    const rbacService = container.resolve('rbacService')\n    const hasPermission = await rbacService.userHasAllFeatures(\n      auth.sub,\n      ['workflows.definitions.view'],\n      { tenantId, organizationId }\n    )\n\n    if (!hasPermission) {\n      return NextResponse.json({ error: 'Insufficient permissions' }, { status: 403 })\n    }\n\n    const items = loadWorkflowTemplates()\n\n    return NextResponse.json({ items })\n  } catch (error) {\n    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status })\n    logger.error('Error listing workflow templates', { err: error })\n    return NextResponse.json(\n      { error: 'Failed to list workflow templates' },\n      { status: 500 }\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'List workflow templates',\n  methods: {\n    GET: {\n      summary: 'List seeded workflow templates',\n      description: 'Returns the shipped workflow template gallery: metadata (id, i18n name/description keys, category, icon) plus the complete workflow definition each template seeds.',\n      responses: [\n        { status: 200, description: 'Available workflow templates', schema: workflowTemplateListResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing tenant context', schema: workflowErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: workflowErrorSchema },\n        { status: 403, description: 'Insufficient permissions', schema: workflowErrorSchema },\n        { status: 500, description: 'Internal server error', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAOA,SAAsB,oBAAoB;AAE1C,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,6BAA6B;AACtC,SAAS,cAAc,qBAAqB,0CAA0C;AACtF,SAAS,oBAAoB;AAC7B,SAAS,uBAAuB;AAEhC,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,4BAA4B;AAChD;AAOA,eAAsB,IAAI,SAAsB;AAC9C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,kCAAkC,OAAO,IAAI;AAEpE,QAAI,CAAC,UAAU;AACb,aAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/E;AAEA,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,UAAM,gBAAgB,MAAM,YAAY;AAAA,MACtC,KAAK;AAAA,MACL,CAAC,4BAA4B;AAAA,MAC7B,EAAE,UAAU,eAAe;AAAA,IAC7B;AAEA,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjF;AAEA,UAAM,QAAQ,sBAAsB;AAEpC,WAAO,aAAa,KAAK,EAAE,MAAM,CAAC;AAAA,EACpC,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,EAAG,QAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AACzF,WAAO,MAAM,oCAAoC,EAAE,KAAK,MAAM,CAAC;AAC/D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,oCAAoC;AAAA,MAC7C,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,mCAAmC;AAAA,MACzG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,oBAAoB;AAAA,QAClF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/workflows/api/work-inbox/next/route.js

@@ -2,6 +2,7 @@ import { NextResponse } from "next/server";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { createLogger } from "@open-mercato/shared/lib/logger";
 import { USER_TASK_INBOX_KIND } from "../../tasks/serialize.js";
 import { serializeWorkInboxRow } from "../../../lib/work-inbox/provider.js";
@@ -17,6 +18,7 @@ import {
   workInboxClaimNextResponseSchema,
   workflowErrorSchema
 } from "../../openapi.js";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 const logger = createLogger("workflows");
 const RACE_LOST_CODES = /* @__PURE__ */ new Set(["TASK_NOT_FOUND", "TASK_ALREADY_ASSIGNED", "TASK_NOT_ROLE_ASSIGNED"]);
 const metadata = {
@@ -38,7 +40,7 @@ async function POST(request) {
     }
     const organizationScope = await resolveOrganizationScopeForRequest({ container, auth, request });
     const tenantId = auth.tenantId;
-    const organizationId = organizationScope?.selectedId ?? auth.orgId;
+    const organizationId = resolveSingleOrganizationIdOrDeny(organizationScope, auth);
     if (!tenantId || !organizationId) {
       return NextResponse.json(
         { error: "Missing tenant or organization context" },
@@ -93,6 +95,7 @@ async function POST(request) {
     }
     return NextResponse.json({ data: null, message: "No claimable work available" });
   } catch (error) {
+    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status });
     logger.error("Error claiming the next work item", { err: error });
     return NextResponse.json(
       {

package/dist/modules/workflows/api/work-inbox/next/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/workflows/api/work-inbox/next/route.ts"],
-  "sourcesContent": ["/**\n * Work Inbox \u2014 claim-next (spec \u00A76.2: \"a one-click claim-next affordance \u2026\n * keeps frontline flow\").\n *\n * Endpoints:\n * - POST /api/workflows/work-inbox/next \u2014 claim the top claimable item\n *\n * Atomicity: the candidate list is a plain read and is expected to be stale by\n * the time it is used. The claim itself is `taskHandler.claimUserTask`, which\n * takes the row with a conditional `UPDATE \u2026 WHERE status = 'PENDING' AND\n * claimed_by IS NULL`. Two operators pressing the button at the same instant\n * therefore see the same candidate list and the loser's update affects zero\n * rows, at which point this handler moves on to the next candidate instead of\n * failing. Nothing about the claim is re-implemented here (module MUST #1).\n *\n * Phase 1 claims workflow tasks only: `taskHandler` is the claim seam for the\n * `user_task` kind, and a provider-generic claim would need each source to\n * expose a server-side claim of its own. Other kinds stay claimable through\n * their own endpoints, which the row's `actions` already advertise.\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport type { EntityManager } from '@mikro-orm/core'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { USER_TASK_INBOX_KIND } from '../../tasks/serialize'\nimport { serializeWorkInboxRow } from '../../../lib/work-inbox/provider'\nimport { parseWorkInboxQuery } from '../../../lib/work-inbox/query'\nimport { toUserTaskWorkInboxRow } from '../../../lib/work-inbox/user-task-source'\nimport type { WorkInboxService } from '../../../lib/work-inbox/service'\nimport type { TaskHandlerService } from '../../../lib/task-handler'\nimport {\n  collectScopedTaskEntityTypes,\n  resolveTaskVisibilityForRequest,\n} from '../../../lib/task-visibility-request'\nimport { UserTask } from '../../../data/entities'\nimport {\n  workflowsTag,\n  workInboxClaimNextResponseSchema,\n  workflowErrorSchema,\n} from '../../openapi'\n\nconst logger = createLogger('workflows')\n\n/** Codes that mean \"someone else got there first\" \u2014 try the next candidate. */\nconst RACE_LOST_CODES = new Set(['TASK_NOT_FOUND', 'TASK_ALREADY_ASSIGNED', 'TASK_NOT_ROLE_ASSIGNED'])\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.tasks.claim'],\n}\n\nfunction isRaceLost(error: unknown): boolean {\n  if (!error || typeof error !== 'object') return false\n  const code = (error as { code?: unknown }).code\n  return typeof code === 'string' && RACE_LOST_CODES.has(code)\n}\n\nexport async function POST(request: NextRequest) {\n  try {\n    const container = await createRequestContainer()\n    const em = container.resolve<EntityManager>('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const organizationScope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = organizationScope?.selectedId ?? auth.orgId\n\n    if (!tenantId || !organizationId) {\n      return NextResponse.json(\n        { error: 'Missing tenant or organization context' },\n        { status: 400 },\n      )\n    }\n\n    const roles = auth.roles ?? []\n    const query = parseWorkInboxQuery(new URL(request.url).searchParams, new Date())\n    const workInboxService = container.resolve<WorkInboxService>('workInboxService')\n\n    // The candidate list is a READ, so it is subject to the same \u00A76.4 rule as\n    // every other read. Claiming is gated again by `taskHandler`, which owns\n    // queue membership and the compare-and-set.\n    const organizationIds = [organizationId]\n    const visibility = await resolveTaskVisibilityForRequest({\n      container,\n      em,\n      auth: { userId: auth.sub, tenantId, roleNames: roles },\n      organizationIds,\n      aclOrganizationId: organizationId,\n      entityTypes: await collectScopedTaskEntityTypes(em, { tenantId, organizationIds }),\n    })\n\n    const candidates = await workInboxService.listClaimableWorkInbox(\n      {\n        ...query,\n        kinds: [USER_TASK_INBOX_KIND],\n        roles,\n        statuses: ['PENDING'],\n        myWork: false,\n      },\n      {\n        scope: { tenantId, organizationIds, userId: auth.sub, roles, visibility },\n        resolve: <T,>(name: string): T => container.resolve<T>(name),\n      },\n    )\n\n    const taskHandler = container.resolve<TaskHandlerService>('taskHandler')\n\n    for (const candidate of candidates) {\n      try {\n        await taskHandler.claimUserTask(\n          em,\n          candidate.id,\n          auth.sub,\n          { tenantId, organizationId },\n          roles,\n        )\n      } catch (error) {\n        if (isRaceLost(error)) continue\n        throw error\n      }\n\n      const task = await em.findOne(UserTask, { id: candidate.id, tenantId, organizationId })\n      const claimed = task ? toUserTaskWorkInboxRow(task, query.now) : candidate\n\n      return NextResponse.json({\n        data: serializeWorkInboxRow(claimed),\n        message: 'Task claimed successfully',\n      })\n    }\n\n    return NextResponse.json({ data: null, message: 'No claimable work available' })\n  } catch (error) {\n    logger.error('Error claiming the next work item', { err: error })\n    return NextResponse.json(\n      {\n        error: 'Failed to claim the next work item',\n        details: error instanceof Error ? error.message : String(error),\n      },\n      { status: 500 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'Claim the next work item',\n  methods: {\n    POST: {\n      summary: 'Claim the top claimable item from the work inbox',\n      description:\n        'Walks the caller\\'s claimable queue in inbox order and claims the first item it wins. The claim is a conditional update, so concurrent callers never receive the same item \u2014 a caller that loses the race moves on to the next candidate. Returns null data when nothing is claimable.',\n      responses: [\n        { status: 200, description: 'The claimed item, or null when nothing was claimable', schema: workInboxClaimNextResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing tenant or organization context', schema: workflowErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: workflowErrorSchema },\n        { status: 500, description: 'Internal server error', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAqBA,SAAsB,oBAAoB;AAG1C,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,oBAAoB;AAC7B,SAAS,4BAA4B;AACrC,SAAS,6BAA6B;AACtC,SAAS,2BAA2B;AACpC,SAAS,8BAA8B;AAGvC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,gBAAgB;AACzB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,WAAW;AAGvC,MAAM,kBAAkB,oBAAI,IAAI,CAAC,kBAAkB,yBAAyB,wBAAwB,CAAC;AAE9F,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,uBAAuB;AAC3C;AAEA,SAAS,WAAW,OAAyB;AAC3C,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,OAAQ,MAA6B;AAC3C,SAAO,OAAO,SAAS,YAAY,gBAAgB,IAAI,IAAI;AAC7D;AAEA,eAAsB,KAAK,SAAsB;AAC/C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAuB,IAAI;AAChD,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,oBAAoB,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AAC/F,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,mBAAmB,cAAc,KAAK;AAE7D,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,yCAAyC;AAAA,QAClD,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,QAAQ,KAAK,SAAS,CAAC;AAC7B,UAAM,QAAQ,oBAAoB,IAAI,IAAI,QAAQ,GAAG,EAAE,cAAc,oBAAI,KAAK,CAAC;AAC/E,UAAM,mBAAmB,UAAU,QAA0B,kBAAkB;AAK/E,UAAM,kBAAkB,CAAC,cAAc;AACvC,UAAM,aAAa,MAAM,gCAAgC;AAAA,MACvD;AAAA,MACA;AAAA,MACA,MAAM,EAAE,QAAQ,KAAK,KAAK,UAAU,WAAW,MAAM;AAAA,MACrD;AAAA,MACA,mBAAmB;AAAA,MACnB,aAAa,MAAM,6BAA6B,IAAI,EAAE,UAAU,gBAAgB,CAAC;AAAA,IACnF,CAAC;AAED,UAAM,aAAa,MAAM,iBAAiB;AAAA,MACxC;AAAA,QACE,GAAG;AAAA,QACH,OAAO,CAAC,oBAAoB;AAAA,QAC5B;AAAA,QACA,UAAU,CAAC,SAAS;AAAA,QACpB,QAAQ;AAAA,MACV;AAAA,MACA;AAAA,QACE,OAAO,EAAE,UAAU,iBAAiB,QAAQ,KAAK,KAAK,OAAO,WAAW;AAAA,QACxE,SAAS,CAAK,SAAoB,UAAU,QAAW,IAAI;AAAA,MAC7D;AAAA,IACF;AAEA,UAAM,cAAc,UAAU,QAA4B,aAAa;AAEvE,eAAW,aAAa,YAAY;AAClC,UAAI;AACF,cAAM,YAAY;AAAA,UAChB;AAAA,UACA,UAAU;AAAA,UACV,KAAK;AAAA,UACL,EAAE,UAAU,eAAe;AAAA,UAC3B;AAAA,QACF;AAAA,MACF,SAAS,OAAO;AACd,YAAI,WAAW,KAAK,EAAG;AACvB,cAAM;AAAA,MACR;AAEA,YAAM,OAAO,MAAM,GAAG,QAAQ,UAAU,EAAE,IAAI,UAAU,IAAI,UAAU,eAAe,CAAC;AACtF,YAAM,UAAU,OAAO,uBAAuB,MAAM,MAAM,GAAG,IAAI;AAEjE,aAAO,aAAa,KAAK;AAAA,QACvB,MAAM,sBAAsB,OAAO;AAAA,QACnC,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK,EAAE,MAAM,MAAM,SAAS,8BAA8B,CAAC;AAAA,EACjF,SAAS,OAAO;AACd,WAAO,MAAM,qCAAqC,EAAE,KAAK,MAAM,CAAC;AAChE,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,OAAO;AAAA,QACP,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAChE;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wDAAwD,QAAQ,iCAAiC;AAAA,MAC/H;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0CAA0C,QAAQ,oBAAoB;AAAA,QAClG,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * Work Inbox \u2014 claim-next (spec \u00A76.2: \"a one-click claim-next affordance \u2026\n * keeps frontline flow\").\n *\n * Endpoints:\n * - POST /api/workflows/work-inbox/next \u2014 claim the top claimable item\n *\n * Atomicity: the candidate list is a plain read and is expected to be stale by\n * the time it is used. The claim itself is `taskHandler.claimUserTask`, which\n * takes the row with a conditional `UPDATE \u2026 WHERE status = 'PENDING' AND\n * claimed_by IS NULL`. Two operators pressing the button at the same instant\n * therefore see the same candidate list and the loser's update affects zero\n * rows, at which point this handler moves on to the next candidate instead of\n * failing. Nothing about the claim is re-implemented here (module MUST #1).\n *\n * Phase 1 claims workflow tasks only: `taskHandler` is the claim seam for the\n * `user_task` kind, and a provider-generic claim would need each source to\n * expose a server-side claim of its own. Other kinds stay claimable through\n * their own endpoints, which the row's `actions` already advertise.\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport type { EntityManager } from '@mikro-orm/core'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { USER_TASK_INBOX_KIND } from '../../tasks/serialize'\nimport { serializeWorkInboxRow } from '../../../lib/work-inbox/provider'\nimport { parseWorkInboxQuery } from '../../../lib/work-inbox/query'\nimport { toUserTaskWorkInboxRow } from '../../../lib/work-inbox/user-task-source'\nimport type { WorkInboxService } from '../../../lib/work-inbox/service'\nimport type { TaskHandlerService } from '../../../lib/task-handler'\nimport {\n  collectScopedTaskEntityTypes,\n  resolveTaskVisibilityForRequest,\n} from '../../../lib/task-visibility-request'\nimport { UserTask } from '../../../data/entities'\nimport {\n  workflowsTag,\n  workInboxClaimNextResponseSchema,\n  workflowErrorSchema,\n} from '../../openapi'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\n\nconst logger = createLogger('workflows')\n\n/** Codes that mean \"someone else got there first\" \u2014 try the next candidate. */\nconst RACE_LOST_CODES = new Set(['TASK_NOT_FOUND', 'TASK_ALREADY_ASSIGNED', 'TASK_NOT_ROLE_ASSIGNED'])\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.tasks.claim'],\n}\n\nfunction isRaceLost(error: unknown): boolean {\n  if (!error || typeof error !== 'object') return false\n  const code = (error as { code?: unknown }).code\n  return typeof code === 'string' && RACE_LOST_CODES.has(code)\n}\n\nexport async function POST(request: NextRequest) {\n  try {\n    const container = await createRequestContainer()\n    const em = container.resolve<EntityManager>('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const organizationScope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = resolveSingleOrganizationIdOrDeny(organizationScope, auth)\n\n    if (!tenantId || !organizationId) {\n      return NextResponse.json(\n        { error: 'Missing tenant or organization context' },\n        { status: 400 },\n      )\n    }\n\n    const roles = auth.roles ?? []\n    const query = parseWorkInboxQuery(new URL(request.url).searchParams, new Date())\n    const workInboxService = container.resolve<WorkInboxService>('workInboxService')\n\n    // The candidate list is a READ, so it is subject to the same \u00A76.4 rule as\n    // every other read. Claiming is gated again by `taskHandler`, which owns\n    // queue membership and the compare-and-set.\n    const organizationIds = [organizationId]\n    const visibility = await resolveTaskVisibilityForRequest({\n      container,\n      em,\n      auth: { userId: auth.sub, tenantId, roleNames: roles },\n      organizationIds,\n      aclOrganizationId: organizationId,\n      entityTypes: await collectScopedTaskEntityTypes(em, { tenantId, organizationIds }),\n    })\n\n    const candidates = await workInboxService.listClaimableWorkInbox(\n      {\n        ...query,\n        kinds: [USER_TASK_INBOX_KIND],\n        roles,\n        statuses: ['PENDING'],\n        myWork: false,\n      },\n      {\n        scope: { tenantId, organizationIds, userId: auth.sub, roles, visibility },\n        resolve: <T,>(name: string): T => container.resolve<T>(name),\n      },\n    )\n\n    const taskHandler = container.resolve<TaskHandlerService>('taskHandler')\n\n    for (const candidate of candidates) {\n      try {\n        await taskHandler.claimUserTask(\n          em,\n          candidate.id,\n          auth.sub,\n          { tenantId, organizationId },\n          roles,\n        )\n      } catch (error) {\n        if (isRaceLost(error)) continue\n        throw error\n      }\n\n      const task = await em.findOne(UserTask, { id: candidate.id, tenantId, organizationId })\n      const claimed = task ? toUserTaskWorkInboxRow(task, query.now) : candidate\n\n      return NextResponse.json({\n        data: serializeWorkInboxRow(claimed),\n        message: 'Task claimed successfully',\n      })\n    }\n\n    return NextResponse.json({ data: null, message: 'No claimable work available' })\n  } catch (error) {\n    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status })\n    logger.error('Error claiming the next work item', { err: error })\n    return NextResponse.json(\n      {\n        error: 'Failed to claim the next work item',\n        details: error instanceof Error ? error.message : String(error),\n      },\n      { status: 500 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'Claim the next work item',\n  methods: {\n    POST: {\n      summary: 'Claim the top claimable item from the work inbox',\n      description:\n        'Walks the caller\\'s claimable queue in inbox order and claims the first item it wins. The claim is a conditional update, so concurrent callers never receive the same item \u2014 a caller that loses the race moves on to the next candidate. Returns null data when nothing is claimable.',\n      responses: [\n        { status: 200, description: 'The claimed item, or null when nothing was claimable', schema: workInboxClaimNextResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing tenant or organization context', schema: workflowErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: workflowErrorSchema },\n        { status: 500, description: 'Internal server error', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAqBA,SAAsB,oBAAoB;AAG1C,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,oBAAoB;AAC7B,SAAS,4BAA4B;AACrC,SAAS,6BAA6B;AACtC,SAAS,2BAA2B;AACpC,SAAS,8BAA8B;AAGvC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,gBAAgB;AACzB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,uBAAuB;AAEhC,MAAM,SAAS,aAAa,WAAW;AAGvC,MAAM,kBAAkB,oBAAI,IAAI,CAAC,kBAAkB,yBAAyB,wBAAwB,CAAC;AAE9F,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,uBAAuB;AAC3C;AAEA,SAAS,WAAW,OAAyB;AAC3C,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,OAAQ,MAA6B;AAC3C,SAAO,OAAO,SAAS,YAAY,gBAAgB,IAAI,IAAI;AAC7D;AAEA,eAAsB,KAAK,SAAsB;AAC/C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAuB,IAAI;AAChD,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,oBAAoB,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AAC/F,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,kCAAkC,mBAAmB,IAAI;AAEhF,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,yCAAyC;AAAA,QAClD,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,QAAQ,KAAK,SAAS,CAAC;AAC7B,UAAM,QAAQ,oBAAoB,IAAI,IAAI,QAAQ,GAAG,EAAE,cAAc,oBAAI,KAAK,CAAC;AAC/E,UAAM,mBAAmB,UAAU,QAA0B,kBAAkB;AAK/E,UAAM,kBAAkB,CAAC,cAAc;AACvC,UAAM,aAAa,MAAM,gCAAgC;AAAA,MACvD;AAAA,MACA;AAAA,MACA,MAAM,EAAE,QAAQ,KAAK,KAAK,UAAU,WAAW,MAAM;AAAA,MACrD;AAAA,MACA,mBAAmB;AAAA,MACnB,aAAa,MAAM,6BAA6B,IAAI,EAAE,UAAU,gBAAgB,CAAC;AAAA,IACnF,CAAC;AAED,UAAM,aAAa,MAAM,iBAAiB;AAAA,MACxC;AAAA,QACE,GAAG;AAAA,QACH,OAAO,CAAC,oBAAoB;AAAA,QAC5B;AAAA,QACA,UAAU,CAAC,SAAS;AAAA,QACpB,QAAQ;AAAA,MACV;AAAA,MACA;AAAA,QACE,OAAO,EAAE,UAAU,iBAAiB,QAAQ,KAAK,KAAK,OAAO,WAAW;AAAA,QACxE,SAAS,CAAK,SAAoB,UAAU,QAAW,IAAI;AAAA,MAC7D;AAAA,IACF;AAEA,UAAM,cAAc,UAAU,QAA4B,aAAa;AAEvE,eAAW,aAAa,YAAY;AAClC,UAAI;AACF,cAAM,YAAY;AAAA,UAChB;AAAA,UACA,UAAU;AAAA,UACV,KAAK;AAAA,UACL,EAAE,UAAU,eAAe;AAAA,UAC3B;AAAA,QACF;AAAA,MACF,SAAS,OAAO;AACd,YAAI,WAAW,KAAK,EAAG;AACvB,cAAM;AAAA,MACR;AAEA,YAAM,OAAO,MAAM,GAAG,QAAQ,UAAU,EAAE,IAAI,UAAU,IAAI,UAAU,eAAe,CAAC;AACtF,YAAM,UAAU,OAAO,uBAAuB,MAAM,MAAM,GAAG,IAAI;AAEjE,aAAO,aAAa,KAAK;AAAA,QACvB,MAAM,sBAAsB,OAAO;AAAA,QACnC,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK,EAAE,MAAM,MAAM,SAAS,8BAA8B,CAAC;AAAA,EACjF,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,EAAG,QAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AACzF,WAAO,MAAM,qCAAqC,EAAE,KAAK,MAAM,CAAC;AAChE,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,OAAO;AAAA,QACP,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAChE;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wDAAwD,QAAQ,iCAAiC;AAAA,MAC/H;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0CAA0C,QAAQ,oBAAoB;AAAA,QAClG,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/workflows/lib/activity-executor.js

@@ -460,11 +460,12 @@ async function executeActivityByType(em, container, activity, context, signal) {
     signal
   });
 }
-async function executeSendEmail(config, context, container) {
+async function executeSendEmail(config, context, container, signal) {
   const { to, subject, template, templateData, body } = config;
   if (!to || !subject) {
     throw new Error('SEND_EMAIL requires "to" and "subject" fields');
   }
+  throwIfAborted(signal);
   logger.info("Send email activity invoked", { component: "SEND_EMAIL", subject });
   let emailService;
   try {
@@ -473,19 +474,26 @@ async function executeSendEmail(config, context, container) {
     emailService = void 0;
   }
   if (emailService && typeof emailService.send === "function") {
-    await emailService.send({
-      to,
-      subject,
-      template,
-      templateData,
-      body
-    });
+    await raceAbortable(
+      Promise.resolve(
+        emailService.send({
+          to,
+          subject,
+          template,
+          templateData,
+          body,
+          signal
+        })
+      ),
+      signal
+    );
+    throwIfAborted(signal);
     return { sent: true, to, subject, via: "emailService" };
   }
   logger.warn("SEND_EMAIL has no registered email service; email was not sent", { component: "SEND_EMAIL", subject });
   return { sent: false, simulated: true, to, subject, via: "console", reason: "no-email-service" };
 }
-async function executeEmitEvent(config, context, container) {
+async function executeEmitEvent(config, context, container, signal) {
   const { eventName, payload } = config;
   if (!eventName) {
     throw new Error('EMIT_EVENT requires "eventName" field');
@@ -499,6 +507,7 @@ async function executeEmitEvent(config, context, container) {
       `EMIT_EVENT payload contains unresolved template variables for: ${unresolvedPayloadKeys.join(", ")}. Check that the workflow context provides these keys.`
     );
   }
+  throwIfAborted(signal);
   const eventBus = container.resolve("eventBus");
   if (!eventBus || typeof eventBus.emitEvent !== "function") {
     throw new Error("Event bus not available in container");
@@ -512,10 +521,16 @@ async function executeEmitEvent(config, context, container) {
       organizationId: context.workflowInstance.organizationId
     }
   };
-  await eventBus.emitEvent(eventName, enrichedPayload, {
-    tenantId: context.workflowInstance.tenantId,
-    organizationId: context.workflowInstance.organizationId
-  });
+  await raceAbortable(
+    Promise.resolve(
+      eventBus.emitEvent(eventName, enrichedPayload, {
+        tenantId: context.workflowInstance.tenantId,
+        organizationId: context.workflowInstance.organizationId
+      })
+    ),
+    signal
+  );
+  throwIfAborted(signal);
   return { emitted: true, eventName, payload: enrichedPayload };
 }
 const UNRESOLVED_TEMPLATE_PATTERN = /\{\{[^}]+\}\}/;
@@ -533,7 +548,7 @@ function findUnresolvedTemplateKeys(value, path = "") {
   }
   return [];
 }
-async function executeUpdateEntity(em, config, context, container) {
+async function executeUpdateEntity(em, config, context, container, signal) {
   const { commandId, input, statusDictionary } = config;
   if (!commandId) {
     throw new Error('UPDATE_ENTITY requires "commandId" field (e.g., "sales.documents.update")');
@@ -546,6 +561,7 @@ async function executeUpdateEntity(em, config, context, container) {
     container,
     context.workflowInstance.tenantId
   );
+  throwIfAborted(signal);
   if (!isWorkflowCommandEnabled(workflowSafeCommand, commandPolicy)) {
     throw new Error("UPDATE_ENTITY command is not enabled for this tenant");
   }
@@ -563,6 +579,7 @@ async function executeUpdateEntity(em, config, context, container) {
     context.workflowInstance.tenantId,
     context.workflowInstance.organizationId
   );
+  throwIfAborted(signal);
   if (!authorized) {
     throw new Error("UPDATE_ENTITY command is not authorized");
   }
@@ -585,6 +602,7 @@ async function executeUpdateEntity(em, config, context, container) {
       context.workflowInstance.tenantId,
       context.workflowInstance.organizationId
     );
+    throwIfAborted(signal);
     if (statusEntryId) {
       finalInput.statusEntryId = statusEntryId;
     }
@@ -602,10 +620,17 @@ async function executeUpdateEntity(em, config, context, container) {
     selectedOrganizationId: context.workflowInstance.organizationId,
     organizationIds: context.workflowInstance.organizationId ? [context.workflowInstance.organizationId] : null
   };
-  const { result, logEntry } = await commandBus.execute(commandId, {
-    input: finalInput,
-    ctx
-  });
+  throwIfAborted(signal);
+  const { result, logEntry } = await raceAbortable(
+    Promise.resolve(
+      commandBus.execute(commandId, {
+        input: finalInput,
+        ctx
+      })
+    ),
+    signal
+  );
+  throwIfAborted(signal);
   return {
     executed: true,
     commandId,
@@ -705,18 +730,23 @@ async function executeCallWebhook(config, context, deps = {}) {
     result
   };
 }
-async function executeFunction(config, context, container) {
+async function executeFunction(config, context, container, signal) {
   const { functionName, args = {} } = config;
   if (!functionName) {
     throw new Error('EXECUTE_FUNCTION requires "functionName" field');
   }
+  throwIfAborted(signal);
   const fnKey = `workflowFunction:${functionName}`;
   try {
     const fn = container.resolve(fnKey);
     if (typeof fn !== "function") {
       throw new Error(`Registered workflow function "${functionName}" is not a function`);
     }
-    const result = await fn(args, context);
+    const result = await raceAbortable(
+      Promise.resolve(fn(args, context, signal)),
+      signal
+    );
+    throwIfAborted(signal);
     return { executed: true, functionName, result };
   } catch (error) {
     if (error instanceof Error && error.message.includes("not registered")) {
@@ -1168,6 +1198,43 @@ async function executeWithTimeout(executor, timeoutMs) {
     clearTimeout(timeoutId);
   }
 }
+function createActivityAbortError(signal) {
+  if (signal?.reason instanceof Error) return signal.reason;
+  try {
+    return new DOMException("The operation was aborted", "AbortError");
+  } catch {
+    const error = new Error("The operation was aborted");
+    error.name = "AbortError";
+    return error;
+  }
+}
+function throwIfAborted(signal) {
+  if (signal?.aborted) {
+    throw createActivityAbortError(signal);
+  }
+}
+function raceAbortable(promise, signal) {
+  if (!signal) return promise;
+  if (signal.aborted) {
+    return Promise.reject(createActivityAbortError(signal));
+  }
+  return new Promise((resolve, reject) => {
+    const onAbort = () => {
+      reject(createActivityAbortError(signal));
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+    promise.then(
+      (value) => {
+        signal.removeEventListener("abort", onAbort);
+        resolve(value);
+      },
+      (error) => {
+        signal.removeEventListener("abort", onAbort);
+        reject(error);
+      }
+    );
+  });
+}
 bindActivityExecutor({
   executeSendEmail,
   executeEmitEvent,