@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.9.0

package/dist/modules/workflows/api/commands/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/workflows/api/commands/route.ts"],
-  "sourcesContent": ["/**\n * Workflow-Safe Commands API\n *\n * Endpoint:\n * - GET /api/workflows/commands - List commands allowlisted for UPDATE_ENTITY activities\n *\n * ## Why this returns disabled candidates instead of hiding them\n *\n * It used to return the whole catalogue to any holder of\n * `workflows.definitions.edit`, which meant an author could pick a command the\n * tenant had not enabled and only discover it when a run failed. Returning ONLY\n * the enabled ones would fix that failure but create a worse one: the field\n * accepts free text (`allowCustomValues`), so a command that vanishes from the\n * list is not prevented, it is merely unexplained \u2014 \"why can I not update\n * products here?\" becomes unanswerable from the editor.\n *\n * So every candidate is returned with an explicit `enabled` flag and the picker\n * renders the disabled ones as unavailable, naming the remedy. This is the same\n * rule the command palette already follows: a command that cannot run right now\n * is shown disabled, never hidden, because a missing entry reads as\n * \"unsupported\" and a disabled one reads as \"not now\".\n *\n * `enabled`, `defaultEnabled` and `labelKey` are ADDITIVE fields on an existing\n * response; `commandId` and `requiredFeatures` are unchanged.\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { listWorkflowSafeCommands } from '../../lib/workflow-safe-commands'\nimport { resolveWorkflowCommandCatalogue } from '../../lib/workflow-command-enablement'\nimport { resolveWorkflowCommandPolicyForContainer } from '../../lib/workflow-command-settings'\nimport { workflowsTag, workflowErrorSchema, workflowSafeCommandListResponseSchema } from '../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.edit'],\n}\n\n/**\n * GET /api/workflows/commands\n *\n * List the workflow-safe command allowlist for the UPDATE_ENTITY command picker.\n */\nexport async function GET(request: NextRequest) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = scope?.selectedId ?? auth.orgId\n\n    if (!tenantId) {\n      return NextResponse.json({ error: 'Missing tenant context' }, { status: 400 })\n    }\n\n    const rbacService = container.resolve('rbacService')\n    const hasPermission = await rbacService.userHasAllFeatures(\n      auth.sub,\n      ['workflows.definitions.edit'],\n      { tenantId, organizationId }\n    )\n\n    if (!hasPermission) {\n      return NextResponse.json({ error: 'Insufficient permissions' }, { status: 403 })\n    }\n\n    const policy = await resolveWorkflowCommandPolicyForContainer(container, tenantId)\n    const items = resolveWorkflowCommandCatalogue(listWorkflowSafeCommands(), policy)\n\n    return NextResponse.json({ items })\n  } catch (error) {\n    logger.error('Error listing workflow-safe commands', { err: error })\n    return NextResponse.json(\n      { error: 'Failed to list workflow-safe commands' },\n      { status: 500 }\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'List workflow-safe commands',\n  methods: {\n    GET: {\n      summary: 'List commands allowlisted for UPDATE_ENTITY activities',\n      description: 'Returns the registered workflow-safe command catalogue consumed by the UPDATE_ENTITY command picker, each entry carrying whether the caller\\'s tenant has enabled it. Entries with enabled:false, and commands outside the catalogue entirely, can still be authored but fail at runtime.',\n      responses: [\n        { status: 200, description: 'Allowlisted workflow-safe commands', schema: workflowSafeCommandListResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing tenant context', schema: workflowErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: workflowErrorSchema },\n        { status: 403, description: 'Insufficient permissions', schema: workflowErrorSchema },\n        { status: 500, description: 'Internal server error', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AA0BA,SAAsB,oBAAoB;AAE1C,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,gCAAgC;AACzC,SAAS,uCAAuC;AAChD,SAAS,gDAAgD;AACzD,SAAS,cAAc,qBAAqB,6CAA6C;AACzF,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,4BAA4B;AAChD;AAOA,eAAsB,IAAI,SAAsB;AAC9C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,cAAc,KAAK;AAEjD,QAAI,CAAC,UAAU;AACb,aAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/E;AAEA,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,UAAM,gBAAgB,MAAM,YAAY;AAAA,MACtC,KAAK;AAAA,MACL,CAAC,4BAA4B;AAAA,MAC7B,EAAE,UAAU,eAAe;AAAA,IAC7B;AAEA,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjF;AAEA,UAAM,SAAS,MAAM,yCAAyC,WAAW,QAAQ;AACjF,UAAM,QAAQ,gCAAgC,yBAAyB,GAAG,MAAM;AAEhF,WAAO,aAAa,KAAK,EAAE,MAAM,CAAC;AAAA,EACpC,SAAS,OAAO;AACd,WAAO,MAAM,wCAAwC,EAAE,KAAK,MAAM,CAAC;AACnE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,wCAAwC;AAAA,MACjD,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,sCAAsC;AAAA,MAClH;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,oBAAoB;AAAA,QAClF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * Workflow-Safe Commands API\n *\n * Endpoint:\n * - GET /api/workflows/commands - List commands allowlisted for UPDATE_ENTITY activities\n *\n * ## Why this returns disabled candidates instead of hiding them\n *\n * It used to return the whole catalogue to any holder of\n * `workflows.definitions.edit`, which meant an author could pick a command the\n * tenant had not enabled and only discover it when a run failed. Returning ONLY\n * the enabled ones would fix that failure but create a worse one: the field\n * accepts free text (`allowCustomValues`), so a command that vanishes from the\n * list is not prevented, it is merely unexplained \u2014 \"why can I not update\n * products here?\" becomes unanswerable from the editor.\n *\n * So every candidate is returned with an explicit `enabled` flag and the picker\n * renders the disabled ones as unavailable, naming the remedy. This is the same\n * rule the command palette already follows: a command that cannot run right now\n * is shown disabled, never hidden, because a missing entry reads as\n * \"unsupported\" and a disabled one reads as \"not now\".\n *\n * `enabled`, `defaultEnabled` and `labelKey` are ADDITIVE fields on an existing\n * response; `commandId` and `requiredFeatures` are unchanged.\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { listWorkflowSafeCommands } from '../../lib/workflow-safe-commands'\nimport { resolveWorkflowCommandCatalogue } from '../../lib/workflow-command-enablement'\nimport { resolveWorkflowCommandPolicyForContainer } from '../../lib/workflow-command-settings'\nimport { workflowsTag, workflowErrorSchema, workflowSafeCommandListResponseSchema } from '../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.edit'],\n}\n\n/**\n * GET /api/workflows/commands\n *\n * List the workflow-safe command allowlist for the UPDATE_ENTITY command picker.\n */\nexport async function GET(request: NextRequest) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth)\n\n    if (!tenantId) {\n      return NextResponse.json({ error: 'Missing tenant context' }, { status: 400 })\n    }\n\n    const rbacService = container.resolve('rbacService')\n    const hasPermission = await rbacService.userHasAllFeatures(\n      auth.sub,\n      ['workflows.definitions.edit'],\n      { tenantId, organizationId }\n    )\n\n    if (!hasPermission) {\n      return NextResponse.json({ error: 'Insufficient permissions' }, { status: 403 })\n    }\n\n    const policy = await resolveWorkflowCommandPolicyForContainer(container, tenantId)\n    const items = resolveWorkflowCommandCatalogue(listWorkflowSafeCommands(), policy)\n\n    return NextResponse.json({ items })\n  } catch (error) {\n    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status })\n    logger.error('Error listing workflow-safe commands', { err: error })\n    return NextResponse.json(\n      { error: 'Failed to list workflow-safe commands' },\n      { status: 500 }\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'List workflow-safe commands',\n  methods: {\n    GET: {\n      summary: 'List commands allowlisted for UPDATE_ENTITY activities',\n      description: 'Returns the registered workflow-safe command catalogue consumed by the UPDATE_ENTITY command picker, each entry carrying whether the caller\\'s tenant has enabled it. Entries with enabled:false, and commands outside the catalogue entirely, can still be authored but fail at runtime.',\n      responses: [\n        { status: 200, description: 'Allowlisted workflow-safe commands', schema: workflowSafeCommandListResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing tenant context', schema: workflowErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: workflowErrorSchema },\n        { status: 403, description: 'Insufficient permissions', schema: workflowErrorSchema },\n        { status: 500, description: 'Internal server error', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AA0BA,SAAsB,oBAAoB;AAE1C,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,gCAAgC;AACzC,SAAS,uCAAuC;AAChD,SAAS,gDAAgD;AACzD,SAAS,cAAc,qBAAqB,6CAA6C;AACzF,SAAS,oBAAoB;AAC7B,SAAS,uBAAuB;AAEhC,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,4BAA4B;AAChD;AAOA,eAAsB,IAAI,SAAsB;AAC9C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,kCAAkC,OAAO,IAAI;AAEpE,QAAI,CAAC,UAAU;AACb,aAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/E;AAEA,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,UAAM,gBAAgB,MAAM,YAAY;AAAA,MACtC,KAAK;AAAA,MACL,CAAC,4BAA4B;AAAA,MAC7B,EAAE,UAAU,eAAe;AAAA,IAC7B;AAEA,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjF;AAEA,UAAM,SAAS,MAAM,yCAAyC,WAAW,QAAQ;AACjF,UAAM,QAAQ,gCAAgC,yBAAyB,GAAG,MAAM;AAEhF,WAAO,aAAa,KAAK,EAAE,MAAM,CAAC;AAAA,EACpC,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,EAAG,QAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AACzF,WAAO,MAAM,wCAAwC,EAAE,KAAK,MAAM,CAAC;AACnE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,wCAAwC;AAAA,MACjD,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,sCAAsC;AAAA,MAClH;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,oBAAoB;AAAA,QAClF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/workflows/api/definitions/[id]/callers/route.js

@@ -4,8 +4,10 @@ import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { createLogger } from "@open-mercato/shared/lib/logger";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { WorkflowDefinition } from "../../../../data/entities.js";
 import { findSubWorkflowCallers } from "../../../../lib/caller-graph.js";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 const logger = createLogger("workflows").child({ component: "definition-callers-api" });
 const metadata = {
   requireAuth: true,
@@ -22,7 +24,7 @@ async function GET(request, context) {
     }
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request });
     const tenantId = auth.tenantId;
-    const organizationId = scope?.selectedId ?? auth.orgId;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth);
     if (!tenantId || !organizationId) {
       return NextResponse.json({ error: "Missing tenant or organization context" }, { status: 400 });
     }
@@ -44,6 +46,7 @@ async function GET(request, context) {
     });
     return NextResponse.json({ callers });
   } catch (error) {
+    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status });
     logger.error("error resolving workflow definition callers", {
       error: error instanceof Error ? error.message : String(error)
     });

package/dist/modules/workflows/api/definitions/[id]/callers/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/workflows/api/definitions/%5Bid%5D/callers/route.ts"],
-  "sourcesContent": ["/**\n * Workflow Definition Callers (breaking-change preview)\n *\n * GET /api/workflows/definitions/[id]/callers\n *\n * Returns the parent definitions that invoke this workflow as a sub-workflow and,\n * for each, the field mappings that this definition's current IO port contract\n * would break.\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { WorkflowDefinition } from '../../../../data/entities'\nimport type { WorkflowIoContract } from '../../../../data/validators'\nimport { findSubWorkflowCallers } from '../../../../lib/caller-graph'\n\nconst logger = createLogger('workflows').child({ component: 'definition-callers-api' })\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.view'],\n}\n\ninterface RouteContext {\n  params: Promise<{ id: string }>\n}\n\nexport async function GET(request: NextRequest, context: RouteContext) {\n  try {\n    const params = await context.params\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = scope?.selectedId ?? auth.orgId\n\n    if (!tenantId || !organizationId) {\n      return NextResponse.json({ error: 'Missing tenant or organization context' }, { status: 400 })\n    }\n\n    const definition = await em.findOne(WorkflowDefinition, {\n      id: params.id,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })\n    if (!definition) {\n      return NextResponse.json({ error: 'Workflow definition not found' }, { status: 404 })\n    }\n\n    const ports: WorkflowIoContract = (definition.definition as { io?: WorkflowIoContract })?.io || {}\n    const callers = await findSubWorkflowCallers(em, {\n      subWorkflowId: definition.workflowId,\n      tenantId,\n      organizationId,\n      ports,\n    })\n\n    return NextResponse.json({ callers })\n  } catch (error) {\n    logger.error('error resolving workflow definition callers', {\n      error: error instanceof Error ? error.message : String(error),\n    })\n    return NextResponse.json({ error: 'Failed to resolve callers' }, { status: 500 })\n  }\n}\n\nexport const openApi = {\n  methods: {\n    GET: {\n      summary: 'List sub-workflow callers and breaking mappings',\n      description: 'Returns parent definitions that invoke this workflow as a sub-workflow and the mappings its current port contract would break.',\n      tags: ['Workflows'],\n      pathParams: z.object({ id: z.string().describe('Workflow definition id') }),\n      responses: [\n        {\n          status: 200,\n          description: 'Callers',\n          example: { callers: [{ workflowId: 'order-flow', version: 1, stepId: 'sub', brokenMappings: ['input:orderId'] }] },\n        },\n        { status: 404, description: 'Not found', example: { error: 'Workflow definition not found' } },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAUA,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AACnD,SAAS,0BAA0B;AAEnC,SAAS,8BAA8B;AAEvC,MAAM,SAAS,aAAa,WAAW,EAAE,MAAM,EAAE,WAAW,yBAAyB,CAAC;AAE/E,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,4BAA4B;AAChD;AAMA,eAAsB,IAAI,SAAsB,SAAuB;AACrE,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ;AAC7B,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,cAAc,KAAK;AAEjD,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,aAAO,aAAa,KAAK,EAAE,OAAO,yCAAyC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/F;AAEA,UAAM,aAAa,MAAM,GAAG,QAAQ,oBAAoB;AAAA,MACtD,IAAI,OAAO;AAAA,MACX;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,YAAY;AACf,aAAO,aAAa,KAAK,EAAE,OAAO,gCAAgC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACtF;AAEA,UAAM,QAA6B,WAAW,YAA4C,MAAM,CAAC;AACjG,UAAM,UAAU,MAAM,uBAAuB,IAAI;AAAA,MAC/C,eAAe,WAAW;AAAA,MAC1B;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAED,WAAO,aAAa,KAAK,EAAE,QAAQ,CAAC;AAAA,EACtC,SAAS,OAAO;AACd,WAAO,MAAM,+CAA+C;AAAA,MAC1D,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAC9D,CAAC;AACD,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,MAAM,CAAC,WAAW;AAAA,MAClB,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,wBAAwB,EAAE,CAAC;AAAA,MAC1E,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,cAAc,SAAS,GAAG,QAAQ,OAAO,gBAAgB,CAAC,eAAe,EAAE,CAAC,EAAE;AAAA,QACnH;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,aAAa,SAAS,EAAE,OAAO,gCAAgC,EAAE;AAAA,MAC/F;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * Workflow Definition Callers (breaking-change preview)\n *\n * GET /api/workflows/definitions/[id]/callers\n *\n * Returns the parent definitions that invoke this workflow as a sub-workflow and,\n * for each, the field mappings that this definition's current IO port contract\n * would break.\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { WorkflowDefinition } from '../../../../data/entities'\nimport type { WorkflowIoContract } from '../../../../data/validators'\nimport { findSubWorkflowCallers } from '../../../../lib/caller-graph'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\n\nconst logger = createLogger('workflows').child({ component: 'definition-callers-api' })\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.view'],\n}\n\ninterface RouteContext {\n  params: Promise<{ id: string }>\n}\n\nexport async function GET(request: NextRequest, context: RouteContext) {\n  try {\n    const params = await context.params\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth)\n\n    if (!tenantId || !organizationId) {\n      return NextResponse.json({ error: 'Missing tenant or organization context' }, { status: 400 })\n    }\n\n    const definition = await em.findOne(WorkflowDefinition, {\n      id: params.id,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })\n    if (!definition) {\n      return NextResponse.json({ error: 'Workflow definition not found' }, { status: 404 })\n    }\n\n    const ports: WorkflowIoContract = (definition.definition as { io?: WorkflowIoContract })?.io || {}\n    const callers = await findSubWorkflowCallers(em, {\n      subWorkflowId: definition.workflowId,\n      tenantId,\n      organizationId,\n      ports,\n    })\n\n    return NextResponse.json({ callers })\n  } catch (error) {\n    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status })\n    logger.error('error resolving workflow definition callers', {\n      error: error instanceof Error ? error.message : String(error),\n    })\n    return NextResponse.json({ error: 'Failed to resolve callers' }, { status: 500 })\n  }\n}\n\nexport const openApi = {\n  methods: {\n    GET: {\n      summary: 'List sub-workflow callers and breaking mappings',\n      description: 'Returns parent definitions that invoke this workflow as a sub-workflow and the mappings its current port contract would break.',\n      tags: ['Workflows'],\n      pathParams: z.object({ id: z.string().describe('Workflow definition id') }),\n      responses: [\n        {\n          status: 200,\n          description: 'Callers',\n          example: { callers: [{ workflowId: 'order-flow', version: 1, stepId: 'sub', brokenMappings: ['input:orderId'] }] },\n        },\n        { status: 404, description: 'Not found', example: { error: 'Workflow definition not found' } },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAUA,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,0BAA0B;AAEnC,SAAS,8BAA8B;AACvC,SAAS,uBAAuB;AAEhC,MAAM,SAAS,aAAa,WAAW,EAAE,MAAM,EAAE,WAAW,yBAAyB,CAAC;AAE/E,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,4BAA4B;AAChD;AAMA,eAAsB,IAAI,SAAsB,SAAuB;AACrE,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ;AAC7B,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,kCAAkC,OAAO,IAAI;AAEpE,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,aAAO,aAAa,KAAK,EAAE,OAAO,yCAAyC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/F;AAEA,UAAM,aAAa,MAAM,GAAG,QAAQ,oBAAoB;AAAA,MACtD,IAAI,OAAO;AAAA,MACX;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,YAAY;AACf,aAAO,aAAa,KAAK,EAAE,OAAO,gCAAgC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACtF;AAEA,UAAM,QAA6B,WAAW,YAA4C,MAAM,CAAC;AACjG,UAAM,UAAU,MAAM,uBAAuB,IAAI;AAAA,MAC/C,eAAe,WAAW;AAAA,MAC1B;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAED,WAAO,aAAa,KAAK,EAAE,QAAQ,CAAC;AAAA,EACtC,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,EAAG,QAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AACzF,WAAO,MAAM,+CAA+C;AAAA,MAC1D,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAC9D,CAAC;AACD,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,MAAM,CAAC,WAAW;AAAA,MAClB,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,wBAAwB,EAAE,CAAC;AAAA,MAC1E,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,cAAc,SAAS,GAAG,QAAQ,OAAO,gBAAgB,CAAC,eAAe,EAAE,CAAC,EAAE;AAAA,QACnH;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,aAAa,SAAS,EAAE,OAAO,gCAAgC,EAAE;AAAA,MAC/F;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/workflows/api/definitions/[id]/context-schema/route.js

@@ -3,7 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
-import { resolveOrganizationScopeFilter } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
+import { resolveOrganizationScopeFilter, resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import {
   computeDefinitionContextLedger,
   narrowLedgerToStep,
@@ -16,6 +16,7 @@ import {
   workflowContextSchemaResponseSchema
 } from "../../../openapi.js";
 import { createLogger } from "@open-mercato/shared/lib/logger";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 const logger = createLogger("workflows");
 const metadata = {
   requireAuth: true,
@@ -46,7 +47,7 @@ async function GET(request, context) {
     }
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request });
     const tenantId = auth.tenantId;
-    const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
     if (!tenantId) {
       return NextResponse.json({ error: "Missing tenant context" }, { status: 400 });
     }
@@ -71,6 +72,7 @@ async function GET(request, context) {
     }
     return respondWithLedger(definitionData, stepId);
   } catch (error) {
+    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status });
     logger.error("Error computing workflow context schema", { err: error });
     return NextResponse.json(
       { error: "Failed to compute workflow context schema" },

package/dist/modules/workflows/api/definitions/[id]/context-schema/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/workflows/api/definitions/%5Bid%5D/context-schema/route.ts"],
-  "sourcesContent": ["/**\n * Workflow Definition Context-Schema API (spec \u00A73.1 context ledger)\n *\n * Endpoints:\n * - GET /api/workflows/definitions/[id]/context-schema - Per-step context ledger\n *\n * Serves the SERVER-computed context ledger for a workflow definition: for\n * every step, the entries describing what context paths are available when the\n * step runs, with type/presence/source metadata. Computed on the server\n * because only the server runtime has the full activity registry and command\n * registry (UPDATE_ENTITY output schemas resolve through\n * `resolveServerOutputContract`); the browser-side editor consumes this\n * response instead of resolving contracts locally.\n *\n * Supports the same id forms as the sibling definition GET: a DB UUID\n * (tenant/org-scoped), \"code:<workflowId>\" for code-based definitions, and the\n * synthetic codeWorkflowUuid(workflowId) fallback used by instances started\n * from unpersisted code definitions. `?stepId=<id>` narrows the response to a\n * single step and 404s when the step does not exist in the definition.\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport type { EntityManager } from '@mikro-orm/core'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveOrganizationScopeFilter } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { type WorkflowDefinitionData } from '../../../../data/entities'\nimport {\n  computeDefinitionContextLedger,\n  narrowLedgerToStep,\n  resolveDefinitionDataForLedger,\n  warmContextLedgerResolvers,\n} from '../../../../lib/definition-context-schema'\nimport {\n  workflowsTag,\n  workflowErrorSchema,\n  workflowContextSchemaResponseSchema,\n} from '../../../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.view'],\n}\n\ninterface RouteContext {\n  params: Promise<{\n    id: string\n  }>\n}\n\nfunction respondWithLedger(definition: WorkflowDefinitionData, stepId: string | null) {\n  const ledger = computeDefinitionContextLedger(definition)\n  if (stepId === null) {\n    return NextResponse.json({ steps: ledger.steps })\n  }\n  const stepView = narrowLedgerToStep(ledger, stepId)\n  if (!stepView) {\n    return NextResponse.json(\n      { error: 'Step not found in workflow definition' },\n      { status: 404 },\n    )\n  }\n  return NextResponse.json({ steps: { [stepId]: stepView } })\n}\n\n/**\n * GET /api/workflows/definitions/[id]/context-schema\n *\n * Compute and return the per-step context ledger for a workflow definition.\n */\nexport async function GET(\n  request: NextRequest,\n  context: RouteContext,\n) {\n  try {\n    const params = await context.params\n    const container = await createRequestContainer()\n    const em = container.resolve('em') as EntityManager\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth || !auth.sub) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n\n    if (!tenantId) {\n      return NextResponse.json({ error: 'Missing tenant context' }, { status: 400 })\n    }\n\n    const rbacService = container.resolve('rbacService') as {\n      userHasAllFeatures: (\n        userId: string,\n        features: string[],\n        scope: { tenantId: string | null; organizationId: string | null },\n      ) => Promise<boolean>\n    }\n    const hasPermission = await rbacService.userHasAllFeatures(\n      auth.sub,\n      ['workflows.definitions.view'],\n      { tenantId, organizationId },\n    )\n\n    if (!hasPermission) {\n      return NextResponse.json({ error: 'Insufficient permissions' }, { status: 403 })\n    }\n\n    const stepId = new URL(request.url).searchParams.get('stepId')\n\n    await warmContextLedgerResolvers(container)\n\n    const orgFilter = resolveOrganizationScopeFilter(scope, auth)\n    const definitionData = await resolveDefinitionDataForLedger(em, params.id, {\n      tenantId,\n      organizationWhere: orgFilter.where,\n    })\n\n    if (!definitionData) {\n      return NextResponse.json({ error: 'Workflow definition not found' }, { status: 404 })\n    }\n\n    return respondWithLedger(definitionData, stepId)\n  } catch (error) {\n    logger.error('Error computing workflow context schema', { err: error })\n    return NextResponse.json(\n      { error: 'Failed to compute workflow context schema' },\n      { status: 500 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'Workflow definition per-step context ledger',\n  pathParams: z.object({\n    id: z.string().describe('UUID for DB definitions, or \"code:<workflowId>\" for code-based definitions'),\n  }),\n  methods: {\n    GET: {\n      summary: 'Get the per-step context ledger',\n      description: 'Computes what context paths are available at each step of the workflow definition, with type, presence (always/maybe), and producer source. Presence degrades to \"maybe\" at joins unless the entry arrives on every incoming route. Use ?stepId=<id> to narrow the response to one step.',\n      query: z.object({\n        stepId: z.string().optional().describe('Narrow the response to this step (404 when the step does not exist)'),\n      }),\n      responses: [\n        {\n          status: 200,\n          description: 'Per-step context ledger',\n          schema: workflowContextSchemaResponseSchema,\n          example: {\n            steps: {\n              approve: {\n                entries: [\n                  {\n                    path: 'orderId',\n                    type: 'text',\n                    presence: 'always',\n                    source: { kind: 'contextSchema', label: 'contextSchema.input' },\n                  },\n                  {\n                    path: 'discount',\n                    type: 'number',\n                    presence: 'maybe',\n                    source: { kind: 'userTask', stepId: 'review', label: 'userTask:review' },\n                  },\n                ],\n              },\n            },\n          },\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Missing tenant context', schema: workflowErrorSchema },\n        { status: 403, description: 'Insufficient permissions', schema: workflowErrorSchema },\n        { status: 404, description: 'Workflow definition or requested step not found', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAqBA,SAAsB,oBAAoB;AAE1C,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,sCAAsC;AAE/C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,4BAA4B;AAChD;AAQA,SAAS,kBAAkB,YAAoC,QAAuB;AACpF,QAAM,SAAS,+BAA+B,UAAU;AACxD,MAAI,WAAW,MAAM;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,OAAO,MAAM,CAAC;AAAA,EAClD;AACA,QAAM,WAAW,mBAAmB,QAAQ,MAAM;AAClD,MAAI,CAAC,UAAU;AACb,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,wCAAwC;AAAA,MACjD,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,SAAO,aAAa,KAAK,EAAE,OAAO,EAAE,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;AAC5D;AAOA,eAAsB,IACpB,SACA,SACA;AACA,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ;AAC7B,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,QAAQ,CAAC,KAAK,KAAK;AACtB,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAE1D,QAAI,CAAC,UAAU;AACb,aAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/E;AAEA,UAAM,cAAc,UAAU,QAAQ,aAAa;AAOnD,UAAM,gBAAgB,MAAM,YAAY;AAAA,MACtC,KAAK;AAAA,MACL,CAAC,4BAA4B;AAAA,MAC7B,EAAE,UAAU,eAAe;AAAA,IAC7B;AAEA,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjF;AAEA,UAAM,SAAS,IAAI,IAAI,QAAQ,GAAG,EAAE,aAAa,IAAI,QAAQ;AAE7D,UAAM,2BAA2B,SAAS;AAE1C,UAAM,YAAY,+BAA+B,OAAO,IAAI;AAC5D,UAAM,iBAAiB,MAAM,+BAA+B,IAAI,OAAO,IAAI;AAAA,MACzE;AAAA,MACA,mBAAmB,UAAU;AAAA,IAC/B,CAAC;AAED,QAAI,CAAC,gBAAgB;AACnB,aAAO,aAAa,KAAK,EAAE,OAAO,gCAAgC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACtF;AAEA,WAAO,kBAAkB,gBAAgB,MAAM;AAAA,EACjD,SAAS,OAAO;AACd,WAAO,MAAM,2CAA2C,EAAE,KAAK,MAAM,CAAC;AACtE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,4CAA4C;AAAA,MACrD,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY,EAAE,OAAO;AAAA,IACnB,IAAI,EAAE,OAAO,EAAE,SAAS,4EAA4E;AAAA,EACtG,CAAC;AAAA,EACD,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO,EAAE,OAAO;AAAA,QACd,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,qEAAqE;AAAA,MAC9G,CAAC;AAAA,MACD,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,OAAO;AAAA,cACL,SAAS;AAAA,gBACP,SAAS;AAAA,kBACP;AAAA,oBACE,MAAM;AAAA,oBACN,MAAM;AAAA,oBACN,UAAU;AAAA,oBACV,QAAQ,EAAE,MAAM,iBAAiB,OAAO,sBAAsB;AAAA,kBAChE;AAAA,kBACA;AAAA,oBACE,MAAM;AAAA,oBACN,MAAM;AAAA,oBACN,UAAU;AAAA,oBACV,QAAQ,EAAE,MAAM,YAAY,QAAQ,UAAU,OAAO,kBAAkB;AAAA,kBACzE;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,oBAAoB;AAAA,QAClF,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,mDAAmD,QAAQ,oBAAoB;AAAA,MAC7G;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * Workflow Definition Context-Schema API (spec \u00A73.1 context ledger)\n *\n * Endpoints:\n * - GET /api/workflows/definitions/[id]/context-schema - Per-step context ledger\n *\n * Serves the SERVER-computed context ledger for a workflow definition: for\n * every step, the entries describing what context paths are available when the\n * step runs, with type/presence/source metadata. Computed on the server\n * because only the server runtime has the full activity registry and command\n * registry (UPDATE_ENTITY output schemas resolve through\n * `resolveServerOutputContract`); the browser-side editor consumes this\n * response instead of resolving contracts locally.\n *\n * Supports the same id forms as the sibling definition GET: a DB UUID\n * (tenant/org-scoped), \"code:<workflowId>\" for code-based definitions, and the\n * synthetic codeWorkflowUuid(workflowId) fallback used by instances started\n * from unpersisted code definitions. `?stepId=<id>` narrows the response to a\n * single step and 404s when the step does not exist in the definition.\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport type { EntityManager } from '@mikro-orm/core'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveOrganizationScopeFilter, resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { type WorkflowDefinitionData } from '../../../../data/entities'\nimport {\n  computeDefinitionContextLedger,\n  narrowLedgerToStep,\n  resolveDefinitionDataForLedger,\n  warmContextLedgerResolvers,\n} from '../../../../lib/definition-context-schema'\nimport {\n  workflowsTag,\n  workflowErrorSchema,\n  workflowContextSchemaResponseSchema,\n} from '../../../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.view'],\n}\n\ninterface RouteContext {\n  params: Promise<{\n    id: string\n  }>\n}\n\nfunction respondWithLedger(definition: WorkflowDefinitionData, stepId: string | null) {\n  const ledger = computeDefinitionContextLedger(definition)\n  if (stepId === null) {\n    return NextResponse.json({ steps: ledger.steps })\n  }\n  const stepView = narrowLedgerToStep(ledger, stepId)\n  if (!stepView) {\n    return NextResponse.json(\n      { error: 'Step not found in workflow definition' },\n      { status: 404 },\n    )\n  }\n  return NextResponse.json({ steps: { [stepId]: stepView } })\n}\n\n/**\n * GET /api/workflows/definitions/[id]/context-schema\n *\n * Compute and return the per-step context ledger for a workflow definition.\n */\nexport async function GET(\n  request: NextRequest,\n  context: RouteContext,\n) {\n  try {\n    const params = await context.params\n    const container = await createRequestContainer()\n    const em = container.resolve('em') as EntityManager\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth || !auth.sub) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n\n    if (!tenantId) {\n      return NextResponse.json({ error: 'Missing tenant context' }, { status: 400 })\n    }\n\n    const rbacService = container.resolve('rbacService') as {\n      userHasAllFeatures: (\n        userId: string,\n        features: string[],\n        scope: { tenantId: string | null; organizationId: string | null },\n      ) => Promise<boolean>\n    }\n    const hasPermission = await rbacService.userHasAllFeatures(\n      auth.sub,\n      ['workflows.definitions.view'],\n      { tenantId, organizationId },\n    )\n\n    if (!hasPermission) {\n      return NextResponse.json({ error: 'Insufficient permissions' }, { status: 403 })\n    }\n\n    const stepId = new URL(request.url).searchParams.get('stepId')\n\n    await warmContextLedgerResolvers(container)\n\n    const orgFilter = resolveOrganizationScopeFilter(scope, auth)\n    const definitionData = await resolveDefinitionDataForLedger(em, params.id, {\n      tenantId,\n      organizationWhere: orgFilter.where,\n    })\n\n    if (!definitionData) {\n      return NextResponse.json({ error: 'Workflow definition not found' }, { status: 404 })\n    }\n\n    return respondWithLedger(definitionData, stepId)\n  } catch (error) {\n    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status })\n    logger.error('Error computing workflow context schema', { err: error })\n    return NextResponse.json(\n      { error: 'Failed to compute workflow context schema' },\n      { status: 500 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'Workflow definition per-step context ledger',\n  pathParams: z.object({\n    id: z.string().describe('UUID for DB definitions, or \"code:<workflowId>\" for code-based definitions'),\n  }),\n  methods: {\n    GET: {\n      summary: 'Get the per-step context ledger',\n      description: 'Computes what context paths are available at each step of the workflow definition, with type, presence (always/maybe), and producer source. Presence degrades to \"maybe\" at joins unless the entry arrives on every incoming route. Use ?stepId=<id> to narrow the response to one step.',\n      query: z.object({\n        stepId: z.string().optional().describe('Narrow the response to this step (404 when the step does not exist)'),\n      }),\n      responses: [\n        {\n          status: 200,\n          description: 'Per-step context ledger',\n          schema: workflowContextSchemaResponseSchema,\n          example: {\n            steps: {\n              approve: {\n                entries: [\n                  {\n                    path: 'orderId',\n                    type: 'text',\n                    presence: 'always',\n                    source: { kind: 'contextSchema', label: 'contextSchema.input' },\n                  },\n                  {\n                    path: 'discount',\n                    type: 'number',\n                    presence: 'maybe',\n                    source: { kind: 'userTask', stepId: 'review', label: 'userTask:review' },\n                  },\n                ],\n              },\n            },\n          },\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Missing tenant context', schema: workflowErrorSchema },\n        { status: 403, description: 'Insufficient permissions', schema: workflowErrorSchema },\n        { status: 404, description: 'Workflow definition or requested step not found', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAqBA,SAAsB,oBAAoB;AAE1C,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,gCAAgC,yCAAyC;AAElF;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,uBAAuB;AAEhC,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,4BAA4B;AAChD;AAQA,SAAS,kBAAkB,YAAoC,QAAuB;AACpF,QAAM,SAAS,+BAA+B,UAAU;AACxD,MAAI,WAAW,MAAM;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,OAAO,MAAM,CAAC;AAAA,EAClD;AACA,QAAM,WAAW,mBAAmB,QAAQ,MAAM;AAClD,MAAI,CAAC,UAAU;AACb,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,wCAAwC;AAAA,MACjD,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,SAAO,aAAa,KAAK,EAAE,OAAO,EAAE,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;AAC5D;AAOA,eAAsB,IACpB,SACA,SACA;AACA,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ;AAC7B,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,QAAQ,CAAC,KAAK,KAAK;AACtB,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AAEzE,QAAI,CAAC,UAAU;AACb,aAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/E;AAEA,UAAM,cAAc,UAAU,QAAQ,aAAa;AAOnD,UAAM,gBAAgB,MAAM,YAAY;AAAA,MACtC,KAAK;AAAA,MACL,CAAC,4BAA4B;AAAA,MAC7B,EAAE,UAAU,eAAe;AAAA,IAC7B;AAEA,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjF;AAEA,UAAM,SAAS,IAAI,IAAI,QAAQ,GAAG,EAAE,aAAa,IAAI,QAAQ;AAE7D,UAAM,2BAA2B,SAAS;AAE1C,UAAM,YAAY,+BAA+B,OAAO,IAAI;AAC5D,UAAM,iBAAiB,MAAM,+BAA+B,IAAI,OAAO,IAAI;AAAA,MACzE;AAAA,MACA,mBAAmB,UAAU;AAAA,IAC/B,CAAC;AAED,QAAI,CAAC,gBAAgB;AACnB,aAAO,aAAa,KAAK,EAAE,OAAO,gCAAgC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACtF;AAEA,WAAO,kBAAkB,gBAAgB,MAAM;AAAA,EACjD,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,EAAG,QAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AACzF,WAAO,MAAM,2CAA2C,EAAE,KAAK,MAAM,CAAC;AACtE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,4CAA4C;AAAA,MACrD,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY,EAAE,OAAO;AAAA,IACnB,IAAI,EAAE,OAAO,EAAE,SAAS,4EAA4E;AAAA,EACtG,CAAC;AAAA,EACD,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO,EAAE,OAAO;AAAA,QACd,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,qEAAqE;AAAA,MAC9G,CAAC;AAAA,MACD,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,OAAO;AAAA,cACL,SAAS;AAAA,gBACP,SAAS;AAAA,kBACP;AAAA,oBACE,MAAM;AAAA,oBACN,MAAM;AAAA,oBACN,UAAU;AAAA,oBACV,QAAQ,EAAE,MAAM,iBAAiB,OAAO,sBAAsB;AAAA,kBAChE;AAAA,kBACA;AAAA,oBACE,MAAM;AAAA,oBACN,MAAM;AAAA,oBACN,UAAU;AAAA,oBACV,QAAQ,EAAE,MAAM,YAAY,QAAQ,UAAU,OAAO,kBAAkB;AAAA,kBACzE;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,oBAAoB;AAAA,QAClF,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,mDAAmD,QAAQ,oBAAoB;AAAA,MAC7G;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/workflows/api/definitions/[id]/customize/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { validateCrudMutationGuard, runCrudMutationGuardAfterSuccess } from "@open-mercato/shared/lib/crud/mutation-guard";
 import { WorkflowDefinition } from "../../../../data/entities.js";
 import { serializeWorkflowDefinition } from "../../serialize.js";
@@ -10,6 +11,7 @@ import { workflowDefinitionMutationResponseSchema, workflowErrorSchema } from ".
 import { getCodeWorkflow } from "../../../../lib/code-registry.js";
 import { invalidateTriggerCache } from "../../../../lib/event-trigger-service.js";
 import { createLogger } from "@open-mercato/shared/lib/logger";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 const logger = createLogger("workflows");
 const metadata = {
   requireAuth: true,
@@ -26,7 +28,7 @@ async function POST(request, context) {
     }
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request });
     const tenantId = auth.tenantId;
-    const organizationId = scope?.selectedId ?? auth.orgId;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth);
     if (!params.id.startsWith("code:")) {
       return NextResponse.json(
         { error: "Customize is only supported for code-based workflow definitions" },
@@ -128,6 +130,7 @@ async function POST(request, context) {
       message: "Workflow definition customized successfully"
     });
   } catch (error) {
+    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status });
     logger.error("Error customizing workflow definition", { err: error });
     return NextResponse.json({ error: "Failed to customize workflow definition" }, { status: 500 });
   }

package/dist/modules/workflows/api/definitions/[id]/customize/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/workflows/api/definitions/%5Bid%5D/customize/route.ts"],
-  "sourcesContent": ["/**\n * Customize Code-Based Workflow Definition\n *\n * POST /api/workflows/definitions/[id]/customize\n *\n * Creates a DB override row for a code-based workflow definition, seeded from\n * the current code registry values. The id param must be of the form\n * \"code:<workflowId>\".\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { validateCrudMutationGuard, runCrudMutationGuardAfterSuccess } from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { WorkflowDefinition } from '../../../../data/entities'\nimport { serializeWorkflowDefinition } from '../../serialize'\nimport { workflowDefinitionMutationResponseSchema, workflowErrorSchema } from '../../../openapi'\nimport { getCodeWorkflow } from '../../../../lib/code-registry'\nimport { invalidateTriggerCache } from '../../../../lib/event-trigger-service'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.edit'],\n}\n\ninterface RouteContext {\n  params: Promise<{\n    id: string\n  }>\n}\n\nexport async function POST(request: NextRequest, context: RouteContext) {\n  try {\n    const params = await context.params\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = scope?.selectedId ?? auth.orgId\n\n    if (!params.id.startsWith('code:')) {\n      return NextResponse.json(\n        { error: 'Customize is only supported for code-based workflow definitions' },\n        { status: 400 },\n      )\n    }\n\n    const workflowId = params.id.slice(5)\n    const codeDef = getCodeWorkflow(workflowId)\n    if (!codeDef) {\n      return NextResponse.json({ error: 'Workflow definition not found' }, { status: 404 })\n    }\n\n    const guardResult = await validateCrudMutationGuard(container, {\n      tenantId: tenantId ?? '',\n      organizationId: organizationId ?? null,\n      userId: auth.sub ?? '',\n      resourceKind: 'workflows.definition',\n      resourceId: params.id,\n      operation: 'custom',\n      requestMethod: 'POST',\n      requestHeaders: request.headers,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    // Pin to the latest version so the override targets a deterministic row.\n    const existingOverride = await em.findOne(WorkflowDefinition, {\n      workflowId: codeDef.workflowId,\n      tenantId,\n    }, { orderBy: { version: 'DESC' } })\n\n    let saved: WorkflowDefinition\n    if (existingOverride) {\n      existingOverride.deletedAt = null\n      existingOverride.workflowName = codeDef.workflowName\n      existingOverride.description = codeDef.description\n      existingOverride.version = codeDef.version\n      existingOverride.definition = codeDef.definition\n      existingOverride.metadata = codeDef.metadata ?? null\n      existingOverride.enabled = codeDef.enabled\n      existingOverride.codeWorkflowId = codeDef.workflowId\n      existingOverride.updatedBy = auth.sub\n      existingOverride.updatedAt = new Date()\n      await em.flush()\n      saved = existingOverride\n    } else {\n      const override = em.create(WorkflowDefinition, {\n        workflowId: codeDef.workflowId,\n        workflowName: codeDef.workflowName,\n        description: codeDef.description,\n        version: codeDef.version,\n        definition: codeDef.definition,\n        metadata: codeDef.metadata,\n        enabled: codeDef.enabled,\n        codeWorkflowId: codeDef.workflowId,\n        tenantId,\n        organizationId,\n        createdBy: auth.sub,\n        updatedBy: auth.sub,\n        createdAt: new Date(),\n        updatedAt: new Date(),\n      })\n      em.persist(override)\n      await em.flush()\n      saved = override\n    }\n\n    // Materializing the override moves trigger ownership from the code registry\n    // to the new `workflow_definitions` row, so the cached snapshot the wildcard\n    // subscriber reads is stale until TRIGGER_CACHE_TTL expires (#4425). Scope\n    // the invalidation to the saved row's own organization: reviving an existing\n    // override belonging to a sibling organization changes triggers for THAT\n    // organization, not for the caller's.\n    if (saved.tenantId) invalidateTriggerCache(saved.tenantId, saved.organizationId ?? undefined)\n\n    if (guardResult?.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId: tenantId ?? '',\n        organizationId: organizationId ?? null,\n        userId: auth.sub ?? '',\n        resourceKind: 'workflows.definition',\n        resourceId: String(saved.id),\n        operation: 'custom',\n        requestMethod: 'POST',\n        requestHeaders: request.headers,\n        metadata: guardResult.metadata,\n      })\n    }\n\n    try {\n      const eventBus = container.resolve('eventBus') as\n        | { emitEvent(event: string, payload: unknown, options?: unknown): Promise<void> }\n        | undefined\n      if (eventBus && typeof eventBus.emitEvent === 'function') {\n        await eventBus.emitEvent(\n          'workflows.definition.customized',\n          {\n            id: saved.id,\n            workflowId: saved.workflowId,\n            codeWorkflowId: saved.codeWorkflowId ?? null,\n            tenantId: saved.tenantId,\n            organizationId: saved.organizationId,\n            userId: auth.sub ?? null,\n          },\n          { tenantId: saved.tenantId, organizationId: saved.organizationId, persistent: true },\n        )\n      }\n    } catch (eventError) {\n      logger.error('Failed to emit workflows.definition.customized event', { err: eventError })\n    }\n\n    return NextResponse.json({\n      data: serializeWorkflowDefinition(saved),\n      message: 'Workflow definition customized successfully',\n    })\n  } catch (error) {\n    logger.error('Error customizing workflow definition', { err: error })\n    return NextResponse.json({ error: 'Failed to customize workflow definition' }, { status: 500 })\n  }\n}\n\nexport const openApi = {\n  methods: {\n    POST: {\n      summary: 'Customize code-based workflow definition',\n      description: 'Creates a DB override for a code-based workflow definition, seeded from the current code registry values. The id param must be of the form \"code:<workflowId>\".',\n      tags: ['Workflows'],\n      pathParams: z.object({\n        id: z.string().describe('Must be of the form \"code:<workflowId>\"'),\n      }),\n      responses: [\n        {\n          status: 200,\n          description: 'Workflow definition customized successfully',\n          schema: workflowDefinitionMutationResponseSchema,\n          example: {\n            data: {\n              id: '123e4567-e89b-12d3-a456-426614174000',\n              workflowId: 'workflows.simple-approval',\n              workflowName: 'Simple Approval Workflow',\n              source: 'code_override',\n            },\n            message: 'Workflow definition customized successfully',\n          },\n        },\n        {\n          status: 400,\n          description: 'Not a code-based id',\n          schema: workflowErrorSchema,\n          example: { error: 'Customize is only supported for code-based workflow definitions' },\n        },\n        {\n          status: 404,\n          description: 'Code workflow not found',\n          schema: workflowErrorSchema,\n          example: { error: 'Workflow definition not found' },\n        },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAUA,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,2BAA2B,wCAAwC;AAC5E,SAAS,0BAA0B;AACnC,SAAS,mCAAmC;AAC5C,SAAS,0CAA0C,2BAA2B;AAC9E,SAAS,uBAAuB;AAChC,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,4BAA4B;AAChD;AAQA,eAAsB,KAAK,SAAsB,SAAuB;AACtE,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ;AAC7B,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,cAAc,KAAK;AAEjD,QAAI,CAAC,OAAO,GAAG,WAAW,OAAO,GAAG;AAClC,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,kEAAkE;AAAA,QAC3E,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,aAAa,OAAO,GAAG,MAAM,CAAC;AACpC,UAAM,UAAU,gBAAgB,UAAU;AAC1C,QAAI,CAAC,SAAS;AACZ,aAAO,aAAa,KAAK,EAAE,OAAO,gCAAgC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACtF;AAEA,UAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,MAC7D,UAAU,YAAY;AAAA,MACtB,gBAAgB,kBAAkB;AAAA,MAClC,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,WAAW;AAAA,MACX,eAAe;AAAA,MACf,gBAAgB,QAAQ;AAAA,IAC1B,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAGA,UAAM,mBAAmB,MAAM,GAAG,QAAQ,oBAAoB;AAAA,MAC5D,YAAY,QAAQ;AAAA,MACpB;AAAA,IACF,GAAG,EAAE,SAAS,EAAE,SAAS,OAAO,EAAE,CAAC;AAEnC,QAAI;AACJ,QAAI,kBAAkB;AACpB,uBAAiB,YAAY;AAC7B,uBAAiB,eAAe,QAAQ;AACxC,uBAAiB,cAAc,QAAQ;AACvC,uBAAiB,UAAU,QAAQ;AACnC,uBAAiB,aAAa,QAAQ;AACtC,uBAAiB,WAAW,QAAQ,YAAY;AAChD,uBAAiB,UAAU,QAAQ;AACnC,uBAAiB,iBAAiB,QAAQ;AAC1C,uBAAiB,YAAY,KAAK;AAClC,uBAAiB,YAAY,oBAAI,KAAK;AACtC,YAAM,GAAG,MAAM;AACf,cAAQ;AAAA,IACV,OAAO;AACL,YAAM,WAAW,GAAG,OAAO,oBAAoB;AAAA,QAC7C,YAAY,QAAQ;AAAA,QACpB,cAAc,QAAQ;AAAA,QACtB,aAAa,QAAQ;AAAA,QACrB,SAAS,QAAQ;AAAA,QACjB,YAAY,QAAQ;AAAA,QACpB,UAAU,QAAQ;AAAA,QAClB,SAAS,QAAQ;AAAA,QACjB,gBAAgB,QAAQ;AAAA,QACxB;AAAA,QACA;AAAA,QACA,WAAW,KAAK;AAAA,QAChB,WAAW,KAAK;AAAA,QAChB,WAAW,oBAAI,KAAK;AAAA,QACpB,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAC;AACD,SAAG,QAAQ,QAAQ;AACnB,YAAM,GAAG,MAAM;AACf,cAAQ;AAAA,IACV;AAQA,QAAI,MAAM,SAAU,wBAAuB,MAAM,UAAU,MAAM,kBAAkB,MAAS;AAE5F,QAAI,aAAa,uBAAuB;AACtC,YAAM,iCAAiC,WAAW;AAAA,QAChD,UAAU,YAAY;AAAA,QACtB,gBAAgB,kBAAkB;AAAA,QAClC,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc;AAAA,QACd,YAAY,OAAO,MAAM,EAAE;AAAA,QAC3B,WAAW;AAAA,QACX,eAAe;AAAA,QACf,gBAAgB,QAAQ;AAAA,QACxB,UAAU,YAAY;AAAA,MACxB,CAAC;AAAA,IACH;AAEA,QAAI;AACF,YAAM,WAAW,UAAU,QAAQ,UAAU;AAG7C,UAAI,YAAY,OAAO,SAAS,cAAc,YAAY;AACxD,cAAM,SAAS;AAAA,UACb;AAAA,UACA;AAAA,YACE,IAAI,MAAM;AAAA,YACV,YAAY,MAAM;AAAA,YAClB,gBAAgB,MAAM,kBAAkB;AAAA,YACxC,UAAU,MAAM;AAAA,YAChB,gBAAgB,MAAM;AAAA,YACtB,QAAQ,KAAK,OAAO;AAAA,UACtB;AAAA,UACA,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,gBAAgB,YAAY,KAAK;AAAA,QACrF;AAAA,MACF;AAAA,IACF,SAAS,YAAY;AACnB,aAAO,MAAM,wDAAwD,EAAE,KAAK,WAAW,CAAC;AAAA,IAC1F;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,MAAM,4BAA4B,KAAK;AAAA,MACvC,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,yCAAyC,EAAE,KAAK,MAAM,CAAC;AACpE,WAAO,aAAa,KAAK,EAAE,OAAO,0CAA0C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChG;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,MAAM,CAAC,WAAW;AAAA,MAClB,YAAY,EAAE,OAAO;AAAA,QACnB,IAAI,EAAE,OAAO,EAAE,SAAS,yCAAyC;AAAA,MACnE,CAAC;AAAA,MACD,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,MAAM;AAAA,cACJ,IAAI;AAAA,cACJ,YAAY;AAAA,cACZ,cAAc;AAAA,cACd,QAAQ;AAAA,YACV;AAAA,YACA,SAAS;AAAA,UACX;AAAA,QACF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS,EAAE,OAAO,kEAAkE;AAAA,QACtF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS,EAAE,OAAO,gCAAgC;AAAA,QACpD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * Customize Code-Based Workflow Definition\n *\n * POST /api/workflows/definitions/[id]/customize\n *\n * Creates a DB override row for a code-based workflow definition, seeded from\n * the current code registry values. The id param must be of the form\n * \"code:<workflowId>\".\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { validateCrudMutationGuard, runCrudMutationGuardAfterSuccess } from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { WorkflowDefinition } from '../../../../data/entities'\nimport { serializeWorkflowDefinition } from '../../serialize'\nimport { workflowDefinitionMutationResponseSchema, workflowErrorSchema } from '../../../openapi'\nimport { getCodeWorkflow } from '../../../../lib/code-registry'\nimport { invalidateTriggerCache } from '../../../../lib/event-trigger-service'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.edit'],\n}\n\ninterface RouteContext {\n  params: Promise<{\n    id: string\n  }>\n}\n\nexport async function POST(request: NextRequest, context: RouteContext) {\n  try {\n    const params = await context.params\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth)\n\n    if (!params.id.startsWith('code:')) {\n      return NextResponse.json(\n        { error: 'Customize is only supported for code-based workflow definitions' },\n        { status: 400 },\n      )\n    }\n\n    const workflowId = params.id.slice(5)\n    const codeDef = getCodeWorkflow(workflowId)\n    if (!codeDef) {\n      return NextResponse.json({ error: 'Workflow definition not found' }, { status: 404 })\n    }\n\n    const guardResult = await validateCrudMutationGuard(container, {\n      tenantId: tenantId ?? '',\n      organizationId: organizationId ?? null,\n      userId: auth.sub ?? '',\n      resourceKind: 'workflows.definition',\n      resourceId: params.id,\n      operation: 'custom',\n      requestMethod: 'POST',\n      requestHeaders: request.headers,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    // Pin to the latest version so the override targets a deterministic row.\n    const existingOverride = await em.findOne(WorkflowDefinition, {\n      workflowId: codeDef.workflowId,\n      tenantId,\n    }, { orderBy: { version: 'DESC' } })\n\n    let saved: WorkflowDefinition\n    if (existingOverride) {\n      existingOverride.deletedAt = null\n      existingOverride.workflowName = codeDef.workflowName\n      existingOverride.description = codeDef.description\n      existingOverride.version = codeDef.version\n      existingOverride.definition = codeDef.definition\n      existingOverride.metadata = codeDef.metadata ?? null\n      existingOverride.enabled = codeDef.enabled\n      existingOverride.codeWorkflowId = codeDef.workflowId\n      existingOverride.updatedBy = auth.sub\n      existingOverride.updatedAt = new Date()\n      await em.flush()\n      saved = existingOverride\n    } else {\n      const override = em.create(WorkflowDefinition, {\n        workflowId: codeDef.workflowId,\n        workflowName: codeDef.workflowName,\n        description: codeDef.description,\n        version: codeDef.version,\n        definition: codeDef.definition,\n        metadata: codeDef.metadata,\n        enabled: codeDef.enabled,\n        codeWorkflowId: codeDef.workflowId,\n        tenantId,\n        organizationId,\n        createdBy: auth.sub,\n        updatedBy: auth.sub,\n        createdAt: new Date(),\n        updatedAt: new Date(),\n      })\n      em.persist(override)\n      await em.flush()\n      saved = override\n    }\n\n    // Materializing the override moves trigger ownership from the code registry\n    // to the new `workflow_definitions` row, so the cached snapshot the wildcard\n    // subscriber reads is stale until TRIGGER_CACHE_TTL expires (#4425). Scope\n    // the invalidation to the saved row's own organization: reviving an existing\n    // override belonging to a sibling organization changes triggers for THAT\n    // organization, not for the caller's.\n    if (saved.tenantId) invalidateTriggerCache(saved.tenantId, saved.organizationId ?? undefined)\n\n    if (guardResult?.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId: tenantId ?? '',\n        organizationId: organizationId ?? null,\n        userId: auth.sub ?? '',\n        resourceKind: 'workflows.definition',\n        resourceId: String(saved.id),\n        operation: 'custom',\n        requestMethod: 'POST',\n        requestHeaders: request.headers,\n        metadata: guardResult.metadata,\n      })\n    }\n\n    try {\n      const eventBus = container.resolve('eventBus') as\n        | { emitEvent(event: string, payload: unknown, options?: unknown): Promise<void> }\n        | undefined\n      if (eventBus && typeof eventBus.emitEvent === 'function') {\n        await eventBus.emitEvent(\n          'workflows.definition.customized',\n          {\n            id: saved.id,\n            workflowId: saved.workflowId,\n            codeWorkflowId: saved.codeWorkflowId ?? null,\n            tenantId: saved.tenantId,\n            organizationId: saved.organizationId,\n            userId: auth.sub ?? null,\n          },\n          { tenantId: saved.tenantId, organizationId: saved.organizationId, persistent: true },\n        )\n      }\n    } catch (eventError) {\n      logger.error('Failed to emit workflows.definition.customized event', { err: eventError })\n    }\n\n    return NextResponse.json({\n      data: serializeWorkflowDefinition(saved),\n      message: 'Workflow definition customized successfully',\n    })\n  } catch (error) {\n    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status })\n    logger.error('Error customizing workflow definition', { err: error })\n    return NextResponse.json({ error: 'Failed to customize workflow definition' }, { status: 500 })\n  }\n}\n\nexport const openApi = {\n  methods: {\n    POST: {\n      summary: 'Customize code-based workflow definition',\n      description: 'Creates a DB override for a code-based workflow definition, seeded from the current code registry values. The id param must be of the form \"code:<workflowId>\".',\n      tags: ['Workflows'],\n      pathParams: z.object({\n        id: z.string().describe('Must be of the form \"code:<workflowId>\"'),\n      }),\n      responses: [\n        {\n          status: 200,\n          description: 'Workflow definition customized successfully',\n          schema: workflowDefinitionMutationResponseSchema,\n          example: {\n            data: {\n              id: '123e4567-e89b-12d3-a456-426614174000',\n              workflowId: 'workflows.simple-approval',\n              workflowName: 'Simple Approval Workflow',\n              source: 'code_override',\n            },\n            message: 'Workflow definition customized successfully',\n          },\n        },\n        {\n          status: 400,\n          description: 'Not a code-based id',\n          schema: workflowErrorSchema,\n          example: { error: 'Customize is only supported for code-based workflow definitions' },\n        },\n        {\n          status: 404,\n          description: 'Code workflow not found',\n          schema: workflowErrorSchema,\n          example: { error: 'Workflow definition not found' },\n        },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAUA,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,2BAA2B,wCAAwC;AAC5E,SAAS,0BAA0B;AACnC,SAAS,mCAAmC;AAC5C,SAAS,0CAA0C,2BAA2B;AAC9E,SAAS,uBAAuB;AAChC,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAC7B,SAAS,uBAAuB;AAEhC,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,4BAA4B;AAChD;AAQA,eAAsB,KAAK,SAAsB,SAAuB;AACtE,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ;AAC7B,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,kCAAkC,OAAO,IAAI;AAEpE,QAAI,CAAC,OAAO,GAAG,WAAW,OAAO,GAAG;AAClC,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,kEAAkE;AAAA,QAC3E,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,aAAa,OAAO,GAAG,MAAM,CAAC;AACpC,UAAM,UAAU,gBAAgB,UAAU;AAC1C,QAAI,CAAC,SAAS;AACZ,aAAO,aAAa,KAAK,EAAE,OAAO,gCAAgC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACtF;AAEA,UAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,MAC7D,UAAU,YAAY;AAAA,MACtB,gBAAgB,kBAAkB;AAAA,MAClC,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,WAAW;AAAA,MACX,eAAe;AAAA,MACf,gBAAgB,QAAQ;AAAA,IAC1B,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAGA,UAAM,mBAAmB,MAAM,GAAG,QAAQ,oBAAoB;AAAA,MAC5D,YAAY,QAAQ;AAAA,MACpB;AAAA,IACF,GAAG,EAAE,SAAS,EAAE,SAAS,OAAO,EAAE,CAAC;AAEnC,QAAI;AACJ,QAAI,kBAAkB;AACpB,uBAAiB,YAAY;AAC7B,uBAAiB,eAAe,QAAQ;AACxC,uBAAiB,cAAc,QAAQ;AACvC,uBAAiB,UAAU,QAAQ;AACnC,uBAAiB,aAAa,QAAQ;AACtC,uBAAiB,WAAW,QAAQ,YAAY;AAChD,uBAAiB,UAAU,QAAQ;AACnC,uBAAiB,iBAAiB,QAAQ;AAC1C,uBAAiB,YAAY,KAAK;AAClC,uBAAiB,YAAY,oBAAI,KAAK;AACtC,YAAM,GAAG,MAAM;AACf,cAAQ;AAAA,IACV,OAAO;AACL,YAAM,WAAW,GAAG,OAAO,oBAAoB;AAAA,QAC7C,YAAY,QAAQ;AAAA,QACpB,cAAc,QAAQ;AAAA,QACtB,aAAa,QAAQ;AAAA,QACrB,SAAS,QAAQ;AAAA,QACjB,YAAY,QAAQ;AAAA,QACpB,UAAU,QAAQ;AAAA,QAClB,SAAS,QAAQ;AAAA,QACjB,gBAAgB,QAAQ;AAAA,QACxB;AAAA,QACA;AAAA,QACA,WAAW,KAAK;AAAA,QAChB,WAAW,KAAK;AAAA,QAChB,WAAW,oBAAI,KAAK;AAAA,QACpB,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAC;AACD,SAAG,QAAQ,QAAQ;AACnB,YAAM,GAAG,MAAM;AACf,cAAQ;AAAA,IACV;AAQA,QAAI,MAAM,SAAU,wBAAuB,MAAM,UAAU,MAAM,kBAAkB,MAAS;AAE5F,QAAI,aAAa,uBAAuB;AACtC,YAAM,iCAAiC,WAAW;AAAA,QAChD,UAAU,YAAY;AAAA,QACtB,gBAAgB,kBAAkB;AAAA,QAClC,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc;AAAA,QACd,YAAY,OAAO,MAAM,EAAE;AAAA,QAC3B,WAAW;AAAA,QACX,eAAe;AAAA,QACf,gBAAgB,QAAQ;AAAA,QACxB,UAAU,YAAY;AAAA,MACxB,CAAC;AAAA,IACH;AAEA,QAAI;AACF,YAAM,WAAW,UAAU,QAAQ,UAAU;AAG7C,UAAI,YAAY,OAAO,SAAS,cAAc,YAAY;AACxD,cAAM,SAAS;AAAA,UACb;AAAA,UACA;AAAA,YACE,IAAI,MAAM;AAAA,YACV,YAAY,MAAM;AAAA,YAClB,gBAAgB,MAAM,kBAAkB;AAAA,YACxC,UAAU,MAAM;AAAA,YAChB,gBAAgB,MAAM;AAAA,YACtB,QAAQ,KAAK,OAAO;AAAA,UACtB;AAAA,UACA,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,gBAAgB,YAAY,KAAK;AAAA,QACrF;AAAA,MACF;AAAA,IACF,SAAS,YAAY;AACnB,aAAO,MAAM,wDAAwD,EAAE,KAAK,WAAW,CAAC;AAAA,IAC1F;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,MAAM,4BAA4B,KAAK;AAAA,MACvC,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,EAAG,QAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AACzF,WAAO,MAAM,yCAAyC,EAAE,KAAK,MAAM,CAAC;AACpE,WAAO,aAAa,KAAK,EAAE,OAAO,0CAA0C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChG;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,MAAM,CAAC,WAAW;AAAA,MAClB,YAAY,EAAE,OAAO;AAAA,QACnB,IAAI,EAAE,OAAO,EAAE,SAAS,yCAAyC;AAAA,MACnE,CAAC;AAAA,MACD,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,MAAM;AAAA,cACJ,IAAI;AAAA,cACJ,YAAY;AAAA,cACZ,cAAc;AAAA,cACd,QAAQ;AAAA,YACV;AAAA,YACA,SAAS;AAAA,UACX;AAAA,QACF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS,EAAE,OAAO,kEAAkE;AAAA,QACtF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS,EAAE,OAAO,gCAAgC;AAAA,QACpD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/workflows/api/definitions/[id]/draft/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { runRouteMutationGuards } from "@open-mercato/shared/lib/crud/route-mutation-guard";
 import { WorkflowDefinition, WorkflowDefinitionDraft } from "../../../../data/entities.js";
 import {
@@ -16,6 +17,7 @@ import {
   workflowDefinitionDraftDeleteResponseSchema
 } from "../../../openapi.js";
 import { createLogger } from "@open-mercato/shared/lib/logger";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 const logger = createLogger("workflows");
 const DRAFT_RESOURCE_KIND = "workflows.definition_draft";
 const draftIdSchema = z.uuid();
@@ -43,7 +45,7 @@ async function resolveDraftContext(request, context) {
   }
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request });
   const tenantId = auth.tenantId;
-  const organizationId = scope?.selectedId ?? auth.orgId;
+  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth);
   if (!tenantId) {
     return { ok: false, response: NextResponse.json({ error: "Missing tenant context" }, { status: 400 }) };
   }
@@ -98,6 +100,7 @@ async function GET(request, context) {
     }
     return NextResponse.json({ data: serializeWorkflowDefinitionDraft(draft) });
   } catch (error) {
+    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status });
     logger.error("Error getting workflow definition draft", { err: error });
     return NextResponse.json({ error: "Failed to get workflow definition draft" }, { status: 500 });
   }
@@ -180,6 +183,7 @@ async function PUT(request, context) {
       message: "Workflow definition draft saved"
     });
   } catch (error) {
+    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status });
     logger.error("Error saving workflow definition draft", { err: error });
     return NextResponse.json({ error: "Failed to save workflow definition draft" }, { status: 500 });
   }
@@ -218,6 +222,7 @@ async function DELETE(request, context) {
     await guarded.runAfterSuccess();
     return NextResponse.json({ message: "Workflow definition draft discarded" });
   } catch (error) {
+    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status });
     logger.error("Error discarding workflow definition draft", { err: error });
     return NextResponse.json({ error: "Failed to discard workflow definition draft" }, { status: 500 });
   }

package/dist/modules/workflows/api/definitions/[id]/draft/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/workflows/api/definitions/%5Bid%5D/draft/route.ts"],
-  "sourcesContent": ["/**\n * Workflow Definition Draft API (spec \u00A74.7 save model)\n *\n * Endpoints:\n * - GET /api/workflows/definitions/[id]/draft - Get the CURRENT USER's draft\n * - PUT /api/workflows/definitions/[id]/draft - Upsert the current user's draft\n * - DELETE /api/workflows/definitions/[id]/draft - Discard the current user's draft (idempotent)\n *\n * Drafts are a per-user autosave layer over a saved definition. They are\n * scoped by tenant + organization + userId from the authenticated principal\n * (never from the body) and deliberately do NOT participate in the\n * definition's optimistic lock \u2014 only the explicit definition PUT does.\n * Server drafts exist only for saved definitions (UUID ids): \"code:*\" and\n * unsaved-definition ids are rejected with 400; drafts for not-yet-saved\n * definitions are the editor's local concern (Step 8.3).\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { WorkflowDefinition, WorkflowDefinitionDraft } from '../../../../data/entities'\nimport {\n  upsertWorkflowDefinitionDraftInputSchema,\n  type UpsertWorkflowDefinitionDraftApiInput,\n} from '../../../../data/validators'\nimport {\n  workflowsTag,\n  workflowErrorSchema,\n  workflowDefinitionDraftDetailResponseSchema,\n  workflowDefinitionDraftMutationResponseSchema,\n  workflowDefinitionDraftDeleteResponseSchema,\n} from '../../../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('workflows')\n\nconst DRAFT_RESOURCE_KIND = 'workflows.definition_draft'\n\nconst draftIdSchema = z.uuid()\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.edit'],\n}\n\ninterface RouteContext {\n  params: Promise<{\n    id: string\n  }>\n}\n\ntype ResolvedDraftContext = {\n  ok: true\n  container: Awaited<ReturnType<typeof createRequestContainer>>\n  em: {\n    findOne: (entity: unknown, where: Record<string, unknown>) => Promise<unknown>\n    create: (entity: unknown, data: Record<string, unknown>) => WorkflowDefinitionDraft\n    persist: (entity: unknown) => unknown\n    flush: () => Promise<void>\n  }\n  auth: { sub: string; tenantId: string | null; orgId: string | null }\n  userId: string\n  tenantId: string\n  organizationId: string\n  definitionId: string\n}\n\ntype RejectedDraftContext = {\n  ok: false\n  response: NextResponse\n}\n\nasync function resolveDraftContext(\n  request: NextRequest,\n  context: RouteContext,\n): Promise<ResolvedDraftContext | RejectedDraftContext> {\n  const params = await context.params\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as ResolvedDraftContext['em']\n  const auth = await getAuthFromRequest(request)\n\n  if (!auth || !auth.sub) {\n    return { ok: false, response: NextResponse.json({ error: 'Unauthorized' }, { status: 401 }) }\n  }\n\n  const idValidation = draftIdSchema.safeParse(params.id)\n  if (!idValidation.success) {\n    return {\n      ok: false,\n      response: NextResponse.json(\n        { error: 'Drafts are only available for saved workflow definitions' },\n        { status: 400 },\n      ),\n    }\n  }\n\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n  const tenantId = auth.tenantId\n  const organizationId = scope?.selectedId ?? auth.orgId\n\n  if (!tenantId) {\n    return { ok: false, response: NextResponse.json({ error: 'Missing tenant context' }, { status: 400 }) }\n  }\n  if (!organizationId) {\n    return { ok: false, response: NextResponse.json({ error: 'Missing organization context' }, { status: 400 }) }\n  }\n\n  const rbacService = container.resolve('rbacService') as {\n    userHasAllFeatures: (\n      userId: string,\n      features: string[],\n      scope: { tenantId: string | null; organizationId: string | null },\n    ) => Promise<boolean>\n  }\n  const hasPermission = await rbacService.userHasAllFeatures(\n    auth.sub,\n    ['workflows.definitions.edit'],\n    { tenantId, organizationId },\n  )\n\n  if (!hasPermission) {\n    return { ok: false, response: NextResponse.json({ error: 'Insufficient permissions' }, { status: 403 }) }\n  }\n\n  return {\n    ok: true,\n    container,\n    em,\n    auth: { sub: auth.sub, tenantId: auth.tenantId ?? null, orgId: auth.orgId ?? null },\n    userId: auth.sub,\n    tenantId,\n    organizationId,\n    definitionId: idValidation.data,\n  }\n}\n\nfunction serializeWorkflowDefinitionDraft(draft: WorkflowDefinitionDraft) {\n  return {\n    id: draft.id,\n    definitionId: draft.definitionId ?? null,\n    definition: draft.definition,\n    metadata: draft.metadata ?? null,\n    baseUpdatedAt: draft.baseUpdatedAt ? draft.baseUpdatedAt.toISOString() : null,\n    createdAt: draft.createdAt ? draft.createdAt.toISOString() : null,\n    updatedAt: draft.updatedAt ? draft.updatedAt.toISOString() : null,\n  }\n}\n\n/**\n * GET /api/workflows/definitions/[id]/draft\n *\n * Return the current user's draft for the definition, or 404 when none exists.\n */\nexport async function GET(\n  request: NextRequest,\n  context: RouteContext,\n) {\n  try {\n    const resolved = await resolveDraftContext(request, context)\n    if (!resolved.ok) return resolved.response\n    const { em, userId, tenantId, organizationId, definitionId } = resolved\n\n    const draft = (await em.findOne(WorkflowDefinitionDraft, {\n      definitionId,\n      userId,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })) as WorkflowDefinitionDraft | null\n\n    if (!draft) {\n      return NextResponse.json({ error: 'Workflow definition draft not found' }, { status: 404 })\n    }\n\n    return NextResponse.json({ data: serializeWorkflowDefinitionDraft(draft) })\n  } catch (error) {\n    logger.error('Error getting workflow definition draft', { err: error })\n    return NextResponse.json({ error: 'Failed to get workflow definition draft' }, { status: 500 })\n  }\n}\n\n/**\n * PUT /api/workflows/definitions/[id]/draft\n *\n * Upsert the current user's draft for the definition. The body is validated\n * shape-only (a draft may be mid-edit and structurally incomplete); full\n * definition validation happens on explicit Save via the definition PUT.\n */\nexport async function PUT(\n  request: NextRequest,\n  context: RouteContext,\n) {\n  try {\n    const resolved = await resolveDraftContext(request, context)\n    if (!resolved.ok) return resolved.response\n    const { container, em, userId, tenantId, organizationId, definitionId } = resolved\n\n    const body = await request.json()\n    const validation = upsertWorkflowDefinitionDraftInputSchema.safeParse(body)\n    if (!validation.success) {\n      return NextResponse.json(\n        { error: 'Validation failed', details: validation.error.issues },\n        { status: 400 },\n      )\n    }\n\n    const input: UpsertWorkflowDefinitionDraftApiInput = validation.data\n\n    const definition = (await em.findOne(WorkflowDefinition, {\n      id: definitionId,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })) as WorkflowDefinition | null\n\n    if (!definition) {\n      return NextResponse.json({ error: 'Workflow definition not found' }, { status: 404 })\n    }\n\n    const guarded = await runRouteMutationGuards({\n      container,\n      req: request,\n      auth: { userId, tenantId, organizationId },\n      input: {\n        resourceKind: DRAFT_RESOURCE_KIND,\n        resourceId: definitionId,\n        operation: 'update',\n        mutationPayload: input as Record<string, unknown>,\n      },\n    })\n    if (!guarded.ok) {\n      return NextResponse.json(guarded.errorBody, { status: guarded.errorStatus })\n    }\n\n    const existingDraft = (await em.findOne(WorkflowDefinitionDraft, {\n      definitionId,\n      userId,\n      tenantId,\n    })) as WorkflowDefinitionDraft | null\n\n    let savedDraft: WorkflowDefinitionDraft\n    if (existingDraft) {\n      existingDraft.deletedAt = null\n      existingDraft.organizationId = organizationId\n      existingDraft.definition = input.definition\n      if (input.metadata !== undefined) {\n        existingDraft.metadata = input.metadata\n      }\n      if (input.baseUpdatedAt !== undefined) {\n        existingDraft.baseUpdatedAt = input.baseUpdatedAt\n      }\n      existingDraft.updatedAt = new Date()\n      await em.flush()\n      savedDraft = existingDraft\n    } else {\n      const draft = em.create(WorkflowDefinitionDraft, {\n        definitionId,\n        userId,\n        definition: input.definition,\n        metadata: input.metadata ?? null,\n        baseUpdatedAt: input.baseUpdatedAt ?? null,\n        tenantId,\n        organizationId,\n        createdAt: new Date(),\n        updatedAt: new Date(),\n      })\n      em.persist(draft)\n      await em.flush()\n      savedDraft = draft\n    }\n\n    await guarded.runAfterSuccess()\n\n    return NextResponse.json({\n      data: serializeWorkflowDefinitionDraft(savedDraft),\n      message: 'Workflow definition draft saved',\n    })\n  } catch (error) {\n    logger.error('Error saving workflow definition draft', { err: error })\n    return NextResponse.json({ error: 'Failed to save workflow definition draft' }, { status: 500 })\n  }\n}\n\n/**\n * DELETE /api/workflows/definitions/[id]/draft\n *\n * Discard the current user's draft. Idempotent: deleting a non-existent draft\n * succeeds.\n */\nexport async function DELETE(\n  request: NextRequest,\n  context: RouteContext,\n) {\n  try {\n    const resolved = await resolveDraftContext(request, context)\n    if (!resolved.ok) return resolved.response\n    const { container, em, userId, tenantId, organizationId, definitionId } = resolved\n\n    const draft = (await em.findOne(WorkflowDefinitionDraft, {\n      definitionId,\n      userId,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })) as WorkflowDefinitionDraft | null\n\n    if (!draft) {\n      return NextResponse.json({ message: 'Workflow definition draft discarded' })\n    }\n\n    const guarded = await runRouteMutationGuards({\n      container,\n      req: request,\n      auth: { userId, tenantId, organizationId },\n      input: {\n        resourceKind: DRAFT_RESOURCE_KIND,\n        resourceId: definitionId,\n        operation: 'delete',\n      },\n    })\n    if (!guarded.ok) {\n      return NextResponse.json(guarded.errorBody, { status: guarded.errorStatus })\n    }\n\n    draft.deletedAt = new Date()\n    draft.updatedAt = new Date()\n    await em.flush()\n\n    await guarded.runAfterSuccess()\n\n    return NextResponse.json({ message: 'Workflow definition draft discarded' })\n  } catch (error) {\n    logger.error('Error discarding workflow definition draft', { err: error })\n    return NextResponse.json({ error: 'Failed to discard workflow definition draft' }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'Per-user workflow definition drafts',\n  pathParams: z.object({\n    id: z.uuid().describe('Workflow definition UUID (server drafts exist only for saved definitions)'),\n  }),\n  methods: {\n    GET: {\n      summary: 'Get the current user\\'s draft',\n      description: 'Returns the authenticated user\\'s autosaved draft for the workflow definition. Drafts are private to the user who saved them.',\n      responses: [\n        { status: 200, description: 'Draft found', schema: workflowDefinitionDraftDetailResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid definition id (only saved definitions have server drafts)', schema: workflowErrorSchema },\n        { status: 403, description: 'Insufficient permissions', schema: workflowErrorSchema },\n        { status: 404, description: 'No draft exists for this user and definition', schema: workflowErrorSchema },\n      ],\n    },\n    PUT: {\n      summary: 'Save the current user\\'s draft',\n      description: 'Creates or updates the authenticated user\\'s draft for the workflow definition. The definition payload is validated shape-only (steps and transitions must be arrays of objects) so a mid-edit, structurally incomplete graph still saves; full validation runs when the draft is promoted via the definition PUT. Draft saves never participate in the definition\\'s optimistic lock.',\n      requestBody: {\n        schema: upsertWorkflowDefinitionDraftInputSchema,\n        example: {\n          definition: {\n            steps: [{ stepId: 'start', stepName: 'Start', stepType: 'START' }],\n            transitions: [],\n          },\n          baseUpdatedAt: '2026-07-27T10:00:00.000Z',\n        },\n      },\n      responses: [\n        { status: 200, description: 'Draft saved', schema: workflowDefinitionDraftMutationResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Malformed draft payload or invalid definition id', schema: workflowErrorSchema },\n        { status: 403, description: 'Insufficient permissions', schema: workflowErrorSchema },\n        { status: 404, description: 'Workflow definition not found', schema: workflowErrorSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Discard the current user\\'s draft',\n      description: 'Deletes the authenticated user\\'s draft for the workflow definition. Idempotent: discarding a non-existent draft succeeds.',\n      responses: [\n        { status: 200, description: 'Draft discarded (or no draft existed)', schema: workflowDefinitionDraftDeleteResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid definition id', schema: workflowErrorSchema },\n        { status: 403, description: 'Insufficient permissions', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAiBA,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,8BAA8B;AACvC,SAAS,oBAAoB,+BAA+B;AAC5D;AAAA,EACE;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEvC,MAAM,sBAAsB;AAE5B,MAAM,gBAAgB,EAAE,KAAK;AAEtB,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,4BAA4B;AAChD;AA6BA,eAAe,oBACb,SACA,SACsD;AACtD,QAAM,SAAS,MAAM,QAAQ;AAC7B,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,MAAI,CAAC,QAAQ,CAAC,KAAK,KAAK;AACtB,WAAO,EAAE,IAAI,OAAO,UAAU,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,EAC9F;AAEA,QAAM,eAAe,cAAc,UAAU,OAAO,EAAE;AACtD,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,UAAU,aAAa;AAAA,QACrB,EAAE,OAAO,2DAA2D;AAAA,QACpE,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,QAAM,WAAW,KAAK;AACtB,QAAM,iBAAiB,OAAO,cAAc,KAAK;AAEjD,MAAI,CAAC,UAAU;AACb,WAAO,EAAE,IAAI,OAAO,UAAU,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,EACxG;AACA,MAAI,CAAC,gBAAgB;AACnB,WAAO,EAAE,IAAI,OAAO,UAAU,aAAa,KAAK,EAAE,OAAO,+BAA+B,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,EAC9G;AAEA,QAAM,cAAc,UAAU,QAAQ,aAAa;AAOnD,QAAM,gBAAgB,MAAM,YAAY;AAAA,IACtC,KAAK;AAAA,IACL,CAAC,4BAA4B;AAAA,IAC7B,EAAE,UAAU,eAAe;AAAA,EAC7B;AAEA,MAAI,CAAC,eAAe;AAClB,WAAO,EAAE,IAAI,OAAO,UAAU,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,EAC1G;AAEA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ;AAAA,IACA;AAAA,IACA,MAAM,EAAE,KAAK,KAAK,KAAK,UAAU,KAAK,YAAY,MAAM,OAAO,KAAK,SAAS,KAAK;AAAA,IAClF,QAAQ,KAAK;AAAA,IACb;AAAA,IACA;AAAA,IACA,cAAc,aAAa;AAAA,EAC7B;AACF;AAEA,SAAS,iCAAiC,OAAgC;AACxE,SAAO;AAAA,IACL,IAAI,MAAM;AAAA,IACV,cAAc,MAAM,gBAAgB;AAAA,IACpC,YAAY,MAAM;AAAA,IAClB,UAAU,MAAM,YAAY;AAAA,IAC5B,eAAe,MAAM,gBAAgB,MAAM,cAAc,YAAY,IAAI;AAAA,IACzE,WAAW,MAAM,YAAY,MAAM,UAAU,YAAY,IAAI;AAAA,IAC7D,WAAW,MAAM,YAAY,MAAM,UAAU,YAAY,IAAI;AAAA,EAC/D;AACF;AAOA,eAAsB,IACpB,SACA,SACA;AACA,MAAI;AACF,UAAM,WAAW,MAAM,oBAAoB,SAAS,OAAO;AAC3D,QAAI,CAAC,SAAS,GAAI,QAAO,SAAS;AAClC,UAAM,EAAE,IAAI,QAAQ,UAAU,gBAAgB,aAAa,IAAI;AAE/D,UAAM,QAAS,MAAM,GAAG,QAAQ,yBAAyB;AAAA,MACvD;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AAED,QAAI,CAAC,OAAO;AACV,aAAO,aAAa,KAAK,EAAE,OAAO,sCAAsC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC5F;AAEA,WAAO,aAAa,KAAK,EAAE,MAAM,iCAAiC,KAAK,EAAE,CAAC;AAAA,EAC5E,SAAS,OAAO;AACd,WAAO,MAAM,2CAA2C,EAAE,KAAK,MAAM,CAAC;AACtE,WAAO,aAAa,KAAK,EAAE,OAAO,0CAA0C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChG;AACF;AASA,eAAsB,IACpB,SACA,SACA;AACA,MAAI;AACF,UAAM,WAAW,MAAM,oBAAoB,SAAS,OAAO;AAC3D,QAAI,CAAC,SAAS,GAAI,QAAO,SAAS;AAClC,UAAM,EAAE,WAAW,IAAI,QAAQ,UAAU,gBAAgB,aAAa,IAAI;AAE1E,UAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,UAAM,aAAa,yCAAyC,UAAU,IAAI;AAC1E,QAAI,CAAC,WAAW,SAAS;AACvB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,qBAAqB,SAAS,WAAW,MAAM,OAAO;AAAA,QAC/D,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,QAA+C,WAAW;AAEhE,UAAM,aAAc,MAAM,GAAG,QAAQ,oBAAoB;AAAA,MACvD,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AAED,QAAI,CAAC,YAAY;AACf,aAAO,aAAa,KAAK,EAAE,OAAO,gCAAgC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACtF;AAEA,UAAM,UAAU,MAAM,uBAAuB;AAAA,MAC3C;AAAA,MACA,KAAK;AAAA,MACL,MAAM,EAAE,QAAQ,UAAU,eAAe;AAAA,MACzC,OAAO;AAAA,QACL,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,iBAAiB;AAAA,MACnB;AAAA,IACF,CAAC;AACD,QAAI,CAAC,QAAQ,IAAI;AACf,aAAO,aAAa,KAAK,QAAQ,WAAW,EAAE,QAAQ,QAAQ,YAAY,CAAC;AAAA,IAC7E;AAEA,UAAM,gBAAiB,MAAM,GAAG,QAAQ,yBAAyB;AAAA,MAC/D;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAED,QAAI;AACJ,QAAI,eAAe;AACjB,oBAAc,YAAY;AAC1B,oBAAc,iBAAiB;AAC/B,oBAAc,aAAa,MAAM;AACjC,UAAI,MAAM,aAAa,QAAW;AAChC,sBAAc,WAAW,MAAM;AAAA,MACjC;AACA,UAAI,MAAM,kBAAkB,QAAW;AACrC,sBAAc,gBAAgB,MAAM;AAAA,MACtC;AACA,oBAAc,YAAY,oBAAI,KAAK;AACnC,YAAM,GAAG,MAAM;AACf,mBAAa;AAAA,IACf,OAAO;AACL,YAAM,QAAQ,GAAG,OAAO,yBAAyB;AAAA,QAC/C;AAAA,QACA;AAAA,QACA,YAAY,MAAM;AAAA,QAClB,UAAU,MAAM,YAAY;AAAA,QAC5B,eAAe,MAAM,iBAAiB;AAAA,QACtC;AAAA,QACA;AAAA,QACA,WAAW,oBAAI,KAAK;AAAA,QACpB,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAC;AACD,SAAG,QAAQ,KAAK;AAChB,YAAM,GAAG,MAAM;AACf,mBAAa;AAAA,IACf;AAEA,UAAM,QAAQ,gBAAgB;AAE9B,WAAO,aAAa,KAAK;AAAA,MACvB,MAAM,iCAAiC,UAAU;AAAA,MACjD,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,0CAA0C,EAAE,KAAK,MAAM,CAAC;AACrE,WAAO,aAAa,KAAK,EAAE,OAAO,2CAA2C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjG;AACF;AAQA,eAAsB,OACpB,SACA,SACA;AACA,MAAI;AACF,UAAM,WAAW,MAAM,oBAAoB,SAAS,OAAO;AAC3D,QAAI,CAAC,SAAS,GAAI,QAAO,SAAS;AAClC,UAAM,EAAE,WAAW,IAAI,QAAQ,UAAU,gBAAgB,aAAa,IAAI;AAE1E,UAAM,QAAS,MAAM,GAAG,QAAQ,yBAAyB;AAAA,MACvD;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AAED,QAAI,CAAC,OAAO;AACV,aAAO,aAAa,KAAK,EAAE,SAAS,sCAAsC,CAAC;AAAA,IAC7E;AAEA,UAAM,UAAU,MAAM,uBAAuB;AAAA,MAC3C;AAAA,MACA,KAAK;AAAA,MACL,MAAM,EAAE,QAAQ,UAAU,eAAe;AAAA,MACzC,OAAO;AAAA,QACL,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,WAAW;AAAA,MACb;AAAA,IACF,CAAC;AACD,QAAI,CAAC,QAAQ,IAAI;AACf,aAAO,aAAa,KAAK,QAAQ,WAAW,EAAE,QAAQ,QAAQ,YAAY,CAAC;AAAA,IAC7E;AAEA,UAAM,YAAY,oBAAI,KAAK;AAC3B,UAAM,YAAY,oBAAI,KAAK;AAC3B,UAAM,GAAG,MAAM;AAEf,UAAM,QAAQ,gBAAgB;AAE9B,WAAO,aAAa,KAAK,EAAE,SAAS,sCAAsC,CAAC;AAAA,EAC7E,SAAS,OAAO;AACd,WAAO,MAAM,8CAA8C,EAAE,KAAK,MAAM,CAAC;AACzE,WAAO,aAAa,KAAK,EAAE,OAAO,8CAA8C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpG;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY,EAAE,OAAO;AAAA,IACnB,IAAI,EAAE,KAAK,EAAE,SAAS,2EAA2E;AAAA,EACnG,CAAC;AAAA,EACD,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,eAAe,QAAQ,4CAA4C;AAAA,MACjG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,qEAAqE,QAAQ,oBAAoB;AAAA,QAC7H,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,gDAAgD,QAAQ,oBAAoB;AAAA,MAC1G;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,YAAY;AAAA,YACV,OAAO,CAAC,EAAE,QAAQ,SAAS,UAAU,SAAS,UAAU,QAAQ,CAAC;AAAA,YACjE,aAAa,CAAC;AAAA,UAChB;AAAA,UACA,eAAe;AAAA,QACjB;AAAA,MACF;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,eAAe,QAAQ,8CAA8C;AAAA,MACnG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,oDAAoD,QAAQ,oBAAoB;AAAA,QAC5G,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,oBAAoB;AAAA,MAC3F;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,yCAAyC,QAAQ,4CAA4C;AAAA,MAC3H;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * Workflow Definition Draft API (spec \u00A74.7 save model)\n *\n * Endpoints:\n * - GET /api/workflows/definitions/[id]/draft - Get the CURRENT USER's draft\n * - PUT /api/workflows/definitions/[id]/draft - Upsert the current user's draft\n * - DELETE /api/workflows/definitions/[id]/draft - Discard the current user's draft (idempotent)\n *\n * Drafts are a per-user autosave layer over a saved definition. They are\n * scoped by tenant + organization + userId from the authenticated principal\n * (never from the body) and deliberately do NOT participate in the\n * definition's optimistic lock \u2014 only the explicit definition PUT does.\n * Server drafts exist only for saved definitions (UUID ids): \"code:*\" and\n * unsaved-definition ids are rejected with 400; drafts for not-yet-saved\n * definitions are the editor's local concern (Step 8.3).\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { WorkflowDefinition, WorkflowDefinitionDraft } from '../../../../data/entities'\nimport {\n  upsertWorkflowDefinitionDraftInputSchema,\n  type UpsertWorkflowDefinitionDraftApiInput,\n} from '../../../../data/validators'\nimport {\n  workflowsTag,\n  workflowErrorSchema,\n  workflowDefinitionDraftDetailResponseSchema,\n  workflowDefinitionDraftMutationResponseSchema,\n  workflowDefinitionDraftDeleteResponseSchema,\n} from '../../../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\n\nconst logger = createLogger('workflows')\n\nconst DRAFT_RESOURCE_KIND = 'workflows.definition_draft'\n\nconst draftIdSchema = z.uuid()\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.edit'],\n}\n\ninterface RouteContext {\n  params: Promise<{\n    id: string\n  }>\n}\n\ntype ResolvedDraftContext = {\n  ok: true\n  container: Awaited<ReturnType<typeof createRequestContainer>>\n  em: {\n    findOne: (entity: unknown, where: Record<string, unknown>) => Promise<unknown>\n    create: (entity: unknown, data: Record<string, unknown>) => WorkflowDefinitionDraft\n    persist: (entity: unknown) => unknown\n    flush: () => Promise<void>\n  }\n  auth: { sub: string; tenantId: string | null; orgId: string | null }\n  userId: string\n  tenantId: string\n  organizationId: string\n  definitionId: string\n}\n\ntype RejectedDraftContext = {\n  ok: false\n  response: NextResponse\n}\n\nasync function resolveDraftContext(\n  request: NextRequest,\n  context: RouteContext,\n): Promise<ResolvedDraftContext | RejectedDraftContext> {\n  const params = await context.params\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as ResolvedDraftContext['em']\n  const auth = await getAuthFromRequest(request)\n\n  if (!auth || !auth.sub) {\n    return { ok: false, response: NextResponse.json({ error: 'Unauthorized' }, { status: 401 }) }\n  }\n\n  const idValidation = draftIdSchema.safeParse(params.id)\n  if (!idValidation.success) {\n    return {\n      ok: false,\n      response: NextResponse.json(\n        { error: 'Drafts are only available for saved workflow definitions' },\n        { status: 400 },\n      ),\n    }\n  }\n\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n  const tenantId = auth.tenantId\n  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth)\n\n  if (!tenantId) {\n    return { ok: false, response: NextResponse.json({ error: 'Missing tenant context' }, { status: 400 }) }\n  }\n  if (!organizationId) {\n    return { ok: false, response: NextResponse.json({ error: 'Missing organization context' }, { status: 400 }) }\n  }\n\n  const rbacService = container.resolve('rbacService') as {\n    userHasAllFeatures: (\n      userId: string,\n      features: string[],\n      scope: { tenantId: string | null; organizationId: string | null },\n    ) => Promise<boolean>\n  }\n  const hasPermission = await rbacService.userHasAllFeatures(\n    auth.sub,\n    ['workflows.definitions.edit'],\n    { tenantId, organizationId },\n  )\n\n  if (!hasPermission) {\n    return { ok: false, response: NextResponse.json({ error: 'Insufficient permissions' }, { status: 403 }) }\n  }\n\n  return {\n    ok: true,\n    container,\n    em,\n    auth: { sub: auth.sub, tenantId: auth.tenantId ?? null, orgId: auth.orgId ?? null },\n    userId: auth.sub,\n    tenantId,\n    organizationId,\n    definitionId: idValidation.data,\n  }\n}\n\nfunction serializeWorkflowDefinitionDraft(draft: WorkflowDefinitionDraft) {\n  return {\n    id: draft.id,\n    definitionId: draft.definitionId ?? null,\n    definition: draft.definition,\n    metadata: draft.metadata ?? null,\n    baseUpdatedAt: draft.baseUpdatedAt ? draft.baseUpdatedAt.toISOString() : null,\n    createdAt: draft.createdAt ? draft.createdAt.toISOString() : null,\n    updatedAt: draft.updatedAt ? draft.updatedAt.toISOString() : null,\n  }\n}\n\n/**\n * GET /api/workflows/definitions/[id]/draft\n *\n * Return the current user's draft for the definition, or 404 when none exists.\n */\nexport async function GET(\n  request: NextRequest,\n  context: RouteContext,\n) {\n  try {\n    const resolved = await resolveDraftContext(request, context)\n    if (!resolved.ok) return resolved.response\n    const { em, userId, tenantId, organizationId, definitionId } = resolved\n\n    const draft = (await em.findOne(WorkflowDefinitionDraft, {\n      definitionId,\n      userId,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })) as WorkflowDefinitionDraft | null\n\n    if (!draft) {\n      return NextResponse.json({ error: 'Workflow definition draft not found' }, { status: 404 })\n    }\n\n    return NextResponse.json({ data: serializeWorkflowDefinitionDraft(draft) })\n  } catch (error) {\n    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status })\n    logger.error('Error getting workflow definition draft', { err: error })\n    return NextResponse.json({ error: 'Failed to get workflow definition draft' }, { status: 500 })\n  }\n}\n\n/**\n * PUT /api/workflows/definitions/[id]/draft\n *\n * Upsert the current user's draft for the definition. The body is validated\n * shape-only (a draft may be mid-edit and structurally incomplete); full\n * definition validation happens on explicit Save via the definition PUT.\n */\nexport async function PUT(\n  request: NextRequest,\n  context: RouteContext,\n) {\n  try {\n    const resolved = await resolveDraftContext(request, context)\n    if (!resolved.ok) return resolved.response\n    const { container, em, userId, tenantId, organizationId, definitionId } = resolved\n\n    const body = await request.json()\n    const validation = upsertWorkflowDefinitionDraftInputSchema.safeParse(body)\n    if (!validation.success) {\n      return NextResponse.json(\n        { error: 'Validation failed', details: validation.error.issues },\n        { status: 400 },\n      )\n    }\n\n    const input: UpsertWorkflowDefinitionDraftApiInput = validation.data\n\n    const definition = (await em.findOne(WorkflowDefinition, {\n      id: definitionId,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })) as WorkflowDefinition | null\n\n    if (!definition) {\n      return NextResponse.json({ error: 'Workflow definition not found' }, { status: 404 })\n    }\n\n    const guarded = await runRouteMutationGuards({\n      container,\n      req: request,\n      auth: { userId, tenantId, organizationId },\n      input: {\n        resourceKind: DRAFT_RESOURCE_KIND,\n        resourceId: definitionId,\n        operation: 'update',\n        mutationPayload: input as Record<string, unknown>,\n      },\n    })\n    if (!guarded.ok) {\n      return NextResponse.json(guarded.errorBody, { status: guarded.errorStatus })\n    }\n\n    const existingDraft = (await em.findOne(WorkflowDefinitionDraft, {\n      definitionId,\n      userId,\n      tenantId,\n    })) as WorkflowDefinitionDraft | null\n\n    let savedDraft: WorkflowDefinitionDraft\n    if (existingDraft) {\n      existingDraft.deletedAt = null\n      existingDraft.organizationId = organizationId\n      existingDraft.definition = input.definition\n      if (input.metadata !== undefined) {\n        existingDraft.metadata = input.metadata\n      }\n      if (input.baseUpdatedAt !== undefined) {\n        existingDraft.baseUpdatedAt = input.baseUpdatedAt\n      }\n      existingDraft.updatedAt = new Date()\n      await em.flush()\n      savedDraft = existingDraft\n    } else {\n      const draft = em.create(WorkflowDefinitionDraft, {\n        definitionId,\n        userId,\n        definition: input.definition,\n        metadata: input.metadata ?? null,\n        baseUpdatedAt: input.baseUpdatedAt ?? null,\n        tenantId,\n        organizationId,\n        createdAt: new Date(),\n        updatedAt: new Date(),\n      })\n      em.persist(draft)\n      await em.flush()\n      savedDraft = draft\n    }\n\n    await guarded.runAfterSuccess()\n\n    return NextResponse.json({\n      data: serializeWorkflowDefinitionDraft(savedDraft),\n      message: 'Workflow definition draft saved',\n    })\n  } catch (error) {\n    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status })\n    logger.error('Error saving workflow definition draft', { err: error })\n    return NextResponse.json({ error: 'Failed to save workflow definition draft' }, { status: 500 })\n  }\n}\n\n/**\n * DELETE /api/workflows/definitions/[id]/draft\n *\n * Discard the current user's draft. Idempotent: deleting a non-existent draft\n * succeeds.\n */\nexport async function DELETE(\n  request: NextRequest,\n  context: RouteContext,\n) {\n  try {\n    const resolved = await resolveDraftContext(request, context)\n    if (!resolved.ok) return resolved.response\n    const { container, em, userId, tenantId, organizationId, definitionId } = resolved\n\n    const draft = (await em.findOne(WorkflowDefinitionDraft, {\n      definitionId,\n      userId,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })) as WorkflowDefinitionDraft | null\n\n    if (!draft) {\n      return NextResponse.json({ message: 'Workflow definition draft discarded' })\n    }\n\n    const guarded = await runRouteMutationGuards({\n      container,\n      req: request,\n      auth: { userId, tenantId, organizationId },\n      input: {\n        resourceKind: DRAFT_RESOURCE_KIND,\n        resourceId: definitionId,\n        operation: 'delete',\n      },\n    })\n    if (!guarded.ok) {\n      return NextResponse.json(guarded.errorBody, { status: guarded.errorStatus })\n    }\n\n    draft.deletedAt = new Date()\n    draft.updatedAt = new Date()\n    await em.flush()\n\n    await guarded.runAfterSuccess()\n\n    return NextResponse.json({ message: 'Workflow definition draft discarded' })\n  } catch (error) {\n    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status })\n    logger.error('Error discarding workflow definition draft', { err: error })\n    return NextResponse.json({ error: 'Failed to discard workflow definition draft' }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'Per-user workflow definition drafts',\n  pathParams: z.object({\n    id: z.uuid().describe('Workflow definition UUID (server drafts exist only for saved definitions)'),\n  }),\n  methods: {\n    GET: {\n      summary: 'Get the current user\\'s draft',\n      description: 'Returns the authenticated user\\'s autosaved draft for the workflow definition. Drafts are private to the user who saved them.',\n      responses: [\n        { status: 200, description: 'Draft found', schema: workflowDefinitionDraftDetailResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid definition id (only saved definitions have server drafts)', schema: workflowErrorSchema },\n        { status: 403, description: 'Insufficient permissions', schema: workflowErrorSchema },\n        { status: 404, description: 'No draft exists for this user and definition', schema: workflowErrorSchema },\n      ],\n    },\n    PUT: {\n      summary: 'Save the current user\\'s draft',\n      description: 'Creates or updates the authenticated user\\'s draft for the workflow definition. The definition payload is validated shape-only (steps and transitions must be arrays of objects) so a mid-edit, structurally incomplete graph still saves; full validation runs when the draft is promoted via the definition PUT. Draft saves never participate in the definition\\'s optimistic lock.',\n      requestBody: {\n        schema: upsertWorkflowDefinitionDraftInputSchema,\n        example: {\n          definition: {\n            steps: [{ stepId: 'start', stepName: 'Start', stepType: 'START' }],\n            transitions: [],\n          },\n          baseUpdatedAt: '2026-07-27T10:00:00.000Z',\n        },\n      },\n      responses: [\n        { status: 200, description: 'Draft saved', schema: workflowDefinitionDraftMutationResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Malformed draft payload or invalid definition id', schema: workflowErrorSchema },\n        { status: 403, description: 'Insufficient permissions', schema: workflowErrorSchema },\n        { status: 404, description: 'Workflow definition not found', schema: workflowErrorSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Discard the current user\\'s draft',\n      description: 'Deletes the authenticated user\\'s draft for the workflow definition. Idempotent: discarding a non-existent draft succeeds.',\n      responses: [\n        { status: 200, description: 'Draft discarded (or no draft existed)', schema: workflowDefinitionDraftDeleteResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid definition id', schema: workflowErrorSchema },\n        { status: 403, description: 'Insufficient permissions', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAiBA,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,8BAA8B;AACvC,SAAS,oBAAoB,+BAA+B;AAC5D;AAAA,EACE;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,uBAAuB;AAEhC,MAAM,SAAS,aAAa,WAAW;AAEvC,MAAM,sBAAsB;AAE5B,MAAM,gBAAgB,EAAE,KAAK;AAEtB,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,4BAA4B;AAChD;AA6BA,eAAe,oBACb,SACA,SACsD;AACtD,QAAM,SAAS,MAAM,QAAQ;AAC7B,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,MAAI,CAAC,QAAQ,CAAC,KAAK,KAAK;AACtB,WAAO,EAAE,IAAI,OAAO,UAAU,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,EAC9F;AAEA,QAAM,eAAe,cAAc,UAAU,OAAO,EAAE;AACtD,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,UAAU,aAAa;AAAA,QACrB,EAAE,OAAO,2DAA2D;AAAA,QACpE,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,QAAM,WAAW,KAAK;AACtB,QAAM,iBAAiB,kCAAkC,OAAO,IAAI;AAEpE,MAAI,CAAC,UAAU;AACb,WAAO,EAAE,IAAI,OAAO,UAAU,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,EACxG;AACA,MAAI,CAAC,gBAAgB;AACnB,WAAO,EAAE,IAAI,OAAO,UAAU,aAAa,KAAK,EAAE,OAAO,+BAA+B,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,EAC9G;AAEA,QAAM,cAAc,UAAU,QAAQ,aAAa;AAOnD,QAAM,gBAAgB,MAAM,YAAY;AAAA,IACtC,KAAK;AAAA,IACL,CAAC,4BAA4B;AAAA,IAC7B,EAAE,UAAU,eAAe;AAAA,EAC7B;AAEA,MAAI,CAAC,eAAe;AAClB,WAAO,EAAE,IAAI,OAAO,UAAU,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,EAC1G;AAEA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ;AAAA,IACA;AAAA,IACA,MAAM,EAAE,KAAK,KAAK,KAAK,UAAU,KAAK,YAAY,MAAM,OAAO,KAAK,SAAS,KAAK;AAAA,IAClF,QAAQ,KAAK;AAAA,IACb;AAAA,IACA;AAAA,IACA,cAAc,aAAa;AAAA,EAC7B;AACF;AAEA,SAAS,iCAAiC,OAAgC;AACxE,SAAO;AAAA,IACL,IAAI,MAAM;AAAA,IACV,cAAc,MAAM,gBAAgB;AAAA,IACpC,YAAY,MAAM;AAAA,IAClB,UAAU,MAAM,YAAY;AAAA,IAC5B,eAAe,MAAM,gBAAgB,MAAM,cAAc,YAAY,IAAI;AAAA,IACzE,WAAW,MAAM,YAAY,MAAM,UAAU,YAAY,IAAI;AAAA,IAC7D,WAAW,MAAM,YAAY,MAAM,UAAU,YAAY,IAAI;AAAA,EAC/D;AACF;AAOA,eAAsB,IACpB,SACA,SACA;AACA,MAAI;AACF,UAAM,WAAW,MAAM,oBAAoB,SAAS,OAAO;AAC3D,QAAI,CAAC,SAAS,GAAI,QAAO,SAAS;AAClC,UAAM,EAAE,IAAI,QAAQ,UAAU,gBAAgB,aAAa,IAAI;AAE/D,UAAM,QAAS,MAAM,GAAG,QAAQ,yBAAyB;AAAA,MACvD;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AAED,QAAI,CAAC,OAAO;AACV,aAAO,aAAa,KAAK,EAAE,OAAO,sCAAsC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC5F;AAEA,WAAO,aAAa,KAAK,EAAE,MAAM,iCAAiC,KAAK,EAAE,CAAC;AAAA,EAC5E,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,EAAG,QAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AACzF,WAAO,MAAM,2CAA2C,EAAE,KAAK,MAAM,CAAC;AACtE,WAAO,aAAa,KAAK,EAAE,OAAO,0CAA0C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChG;AACF;AASA,eAAsB,IACpB,SACA,SACA;AACA,MAAI;AACF,UAAM,WAAW,MAAM,oBAAoB,SAAS,OAAO;AAC3D,QAAI,CAAC,SAAS,GAAI,QAAO,SAAS;AAClC,UAAM,EAAE,WAAW,IAAI,QAAQ,UAAU,gBAAgB,aAAa,IAAI;AAE1E,UAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,UAAM,aAAa,yCAAyC,UAAU,IAAI;AAC1E,QAAI,CAAC,WAAW,SAAS;AACvB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,qBAAqB,SAAS,WAAW,MAAM,OAAO;AAAA,QAC/D,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,QAA+C,WAAW;AAEhE,UAAM,aAAc,MAAM,GAAG,QAAQ,oBAAoB;AAAA,MACvD,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AAED,QAAI,CAAC,YAAY;AACf,aAAO,aAAa,KAAK,EAAE,OAAO,gCAAgC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACtF;AAEA,UAAM,UAAU,MAAM,uBAAuB;AAAA,MAC3C;AAAA,MACA,KAAK;AAAA,MACL,MAAM,EAAE,QAAQ,UAAU,eAAe;AAAA,MACzC,OAAO;AAAA,QACL,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,iBAAiB;AAAA,MACnB;AAAA,IACF,CAAC;AACD,QAAI,CAAC,QAAQ,IAAI;AACf,aAAO,aAAa,KAAK,QAAQ,WAAW,EAAE,QAAQ,QAAQ,YAAY,CAAC;AAAA,IAC7E;AAEA,UAAM,gBAAiB,MAAM,GAAG,QAAQ,yBAAyB;AAAA,MAC/D;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAED,QAAI;AACJ,QAAI,eAAe;AACjB,oBAAc,YAAY;AAC1B,oBAAc,iBAAiB;AAC/B,oBAAc,aAAa,MAAM;AACjC,UAAI,MAAM,aAAa,QAAW;AAChC,sBAAc,WAAW,MAAM;AAAA,MACjC;AACA,UAAI,MAAM,kBAAkB,QAAW;AACrC,sBAAc,gBAAgB,MAAM;AAAA,MACtC;AACA,oBAAc,YAAY,oBAAI,KAAK;AACnC,YAAM,GAAG,MAAM;AACf,mBAAa;AAAA,IACf,OAAO;AACL,YAAM,QAAQ,GAAG,OAAO,yBAAyB;AAAA,QAC/C;AAAA,QACA;AAAA,QACA,YAAY,MAAM;AAAA,QAClB,UAAU,MAAM,YAAY;AAAA,QAC5B,eAAe,MAAM,iBAAiB;AAAA,QACtC;AAAA,QACA;AAAA,QACA,WAAW,oBAAI,KAAK;AAAA,QACpB,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAC;AACD,SAAG,QAAQ,KAAK;AAChB,YAAM,GAAG,MAAM;AACf,mBAAa;AAAA,IACf;AAEA,UAAM,QAAQ,gBAAgB;AAE9B,WAAO,aAAa,KAAK;AAAA,MACvB,MAAM,iCAAiC,UAAU;AAAA,MACjD,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,EAAG,QAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AACzF,WAAO,MAAM,0CAA0C,EAAE,KAAK,MAAM,CAAC;AACrE,WAAO,aAAa,KAAK,EAAE,OAAO,2CAA2C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjG;AACF;AAQA,eAAsB,OACpB,SACA,SACA;AACA,MAAI;AACF,UAAM,WAAW,MAAM,oBAAoB,SAAS,OAAO;AAC3D,QAAI,CAAC,SAAS,GAAI,QAAO,SAAS;AAClC,UAAM,EAAE,WAAW,IAAI,QAAQ,UAAU,gBAAgB,aAAa,IAAI;AAE1E,UAAM,QAAS,MAAM,GAAG,QAAQ,yBAAyB;AAAA,MACvD;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AAED,QAAI,CAAC,OAAO;AACV,aAAO,aAAa,KAAK,EAAE,SAAS,sCAAsC,CAAC;AAAA,IAC7E;AAEA,UAAM,UAAU,MAAM,uBAAuB;AAAA,MAC3C;AAAA,MACA,KAAK;AAAA,MACL,MAAM,EAAE,QAAQ,UAAU,eAAe;AAAA,MACzC,OAAO;AAAA,QACL,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,WAAW;AAAA,MACb;AAAA,IACF,CAAC;AACD,QAAI,CAAC,QAAQ,IAAI;AACf,aAAO,aAAa,KAAK,QAAQ,WAAW,EAAE,QAAQ,QAAQ,YAAY,CAAC;AAAA,IAC7E;AAEA,UAAM,YAAY,oBAAI,KAAK;AAC3B,UAAM,YAAY,oBAAI,KAAK;AAC3B,UAAM,GAAG,MAAM;AAEf,UAAM,QAAQ,gBAAgB;AAE9B,WAAO,aAAa,KAAK,EAAE,SAAS,sCAAsC,CAAC;AAAA,EAC7E,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,EAAG,QAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AACzF,WAAO,MAAM,8CAA8C,EAAE,KAAK,MAAM,CAAC;AACzE,WAAO,aAAa,KAAK,EAAE,OAAO,8CAA8C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpG;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY,EAAE,OAAO;AAAA,IACnB,IAAI,EAAE,KAAK,EAAE,SAAS,2EAA2E;AAAA,EACnG,CAAC;AAAA,EACD,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,eAAe,QAAQ,4CAA4C;AAAA,MACjG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,qEAAqE,QAAQ,oBAAoB;AAAA,QAC7H,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,gDAAgD,QAAQ,oBAAoB;AAAA,MAC1G;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,YAAY;AAAA,YACV,OAAO,CAAC,EAAE,QAAQ,SAAS,UAAU,SAAS,UAAU,QAAQ,CAAC;AAAA,YACjE,aAAa,CAAC;AAAA,UAChB;AAAA,UACA,eAAe;AAAA,QACjB;AAAA,MACF;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,eAAe,QAAQ,8CAA8C;AAAA,MACnG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,oDAAoD,QAAQ,oBAAoB;AAAA,QAC5G,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,oBAAoB;AAAA,MAC3F;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,yCAAyC,QAAQ,4CAA4C;AAAA,MAC3H;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/workflows/api/definitions/[id]/publish/route.js

@@ -4,16 +4,19 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { validateCrudMutationGuard, runCrudMutationGuardAfterSuccess } from "@open-mercato/shared/lib/crud/mutation-guard";
 import { WorkflowDefinition } from "../../../../data/entities.js";
 import { createLogger } from "@open-mercato/shared/lib/logger";
 import { serializeWorkflowDefinition } from "../../serialize.js";
 import { findSubWorkflowCallers } from "../../../../lib/caller-graph.js";
+import { invalidateTriggerCache } from "../../../../lib/event-trigger-service.js";
 import {
   authorizeWorkflowGrantChange,
   normalizeGrantedFeatures,
   syncWorkflowDefinitionPrincipal
 } from "../../../../lib/definition-grant.js";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 const logger = createLogger("workflows").child({ component: "definition-publish-api" });
 const metadata = {
   requireAuth: true,
@@ -33,7 +36,7 @@ async function POST(request, context) {
     }
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request });
     const tenantId = auth.tenantId;
-    const organizationId = scope?.selectedId ?? auth.orgId;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth);
     if (!tenantId || !organizationId) {
       return NextResponse.json({ error: "Missing tenant or organization context" }, { status: 400 });
     }
@@ -122,6 +125,7 @@ async function POST(request, context) {
     await syncWorkflowDefinitionPrincipal(container, published);
     em.persist(published);
     await em.flush();
+    invalidateTriggerCache(tenantId, organizationId);
     if (guardResult?.shouldRunAfterSuccess) {
       await runCrudMutationGuardAfterSuccess(container, {
         tenantId,
@@ -162,6 +166,7 @@ async function POST(request, context) {
       message: "Workflow definition published successfully"
     });
   } catch (error) {
+    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status });
     logger.error("error publishing workflow definition", {
       error: error instanceof Error ? error.message : String(error)
     });

package/dist/modules/workflows/api/definitions/[id]/publish/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/workflows/api/definitions/%5Bid%5D/publish/route.ts"],
-  "sourcesContent": ["/**\n * Publish Workflow Definition Version\n *\n * POST /api/workflows/definitions/[id]/publish\n *\n * Mints a new frozen, published version of a workflow definition (snapshotting\n * its current data + IO port contract). Runs breaking-change detection against\n * callers of the workflow as a sub-workflow; when callers would break, the\n * caller must pass `acknowledgeBreakingChanges: true`. Emits\n * `workflows.definition.published`.\n */\n\nimport { randomUUID } from 'node:crypto'\nimport { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { validateCrudMutationGuard, runCrudMutationGuardAfterSuccess } from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { WorkflowDefinition } from '../../../../data/entities'\nimport type { WorkflowIoContract } from '../../../../data/validators'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { serializeWorkflowDefinition } from '../../serialize'\nimport { findSubWorkflowCallers } from '../../../../lib/caller-graph'\nimport {\n  authorizeWorkflowGrantChange,\n  normalizeGrantedFeatures,\n  syncWorkflowDefinitionPrincipal,\n} from '../../../../lib/definition-grant'\n\nconst logger = createLogger('workflows').child({ component: 'definition-publish-api' })\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.publish'],\n}\n\nconst publishInputSchema = z.object({\n  acknowledgeBreakingChanges: z.boolean().optional(),\n})\n\ninterface RouteContext {\n  params: Promise<{ id: string }>\n}\n\nexport async function POST(request: NextRequest, context: RouteContext) {\n  try {\n    const params = await context.params\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = scope?.selectedId ?? auth.orgId\n\n    if (!tenantId || !organizationId) {\n      return NextResponse.json({ error: 'Missing tenant or organization context' }, { status: 400 })\n    }\n\n    const body = await request.json().catch(() => ({}))\n    const parsed = publishInputSchema.safeParse(body)\n    if (!parsed.success) {\n      return NextResponse.json({ error: 'Validation failed', details: parsed.error.issues }, { status: 400 })\n    }\n\n    const guardResult = await validateCrudMutationGuard(container, {\n      tenantId,\n      organizationId,\n      userId: auth.sub ?? '',\n      resourceKind: 'workflows.definition',\n      resourceId: params.id,\n      operation: 'custom',\n      requestMethod: 'POST',\n      requestHeaders: request.headers,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    const source = await em.findOne(WorkflowDefinition, {\n      id: params.id,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })\n    if (!source) {\n      return NextResponse.json({ error: 'Workflow definition not found' }, { status: 404 })\n    }\n\n    // Breaking-change detection: diff this definition's published port contract\n    // against every caller that invokes it as a sub-workflow.\n    const ports: WorkflowIoContract = (source.definition as { io?: WorkflowIoContract })?.io || {}\n    const breakingChanges = await findSubWorkflowCallers(em, {\n      subWorkflowId: source.workflowId,\n      tenantId,\n      organizationId,\n      ports,\n    })\n\n    if (breakingChanges.length > 0 && !parsed.data.acknowledgeBreakingChanges) {\n      return NextResponse.json(\n        {\n          error: 'Publishing would break existing sub-workflow mappings',\n          breakingChanges,\n        },\n        { status: 409 },\n      )\n    }\n\n    // Next version = max existing version for this workflowId/tenant + 1.\n    const latest = await em.findOne(\n      WorkflowDefinition,\n      { workflowId: source.workflowId, tenantId },\n      { orderBy: { version: 'DESC' } },\n    )\n    const nextVersion = (latest?.version ?? source.version) + 1\n\n    // The grant is per VERSION, so publishing mints a NEW execution principal\n    // from the source's grant \u2014 a new identity carrying those powers. It is\n    // therefore re-authorised against the PUBLISHER (`current: []` forces the\n    // check even though the feature list is unchanged): a user who may publish\n    // must not be able to bring a higher-privileged author's grant forward.\n    const grantedFeatures = normalizeGrantedFeatures(source.grantedFeatures)\n    const grantFailure = await authorizeWorkflowGrantChange(\n      container.resolve('rbacService') as Parameters<typeof authorizeWorkflowGrantChange>[0],\n      {\n        userId: auth.sub,\n        scope: { tenantId, organizationId },\n        requested: grantedFeatures,\n        current: [],\n      },\n    )\n    if (grantFailure) {\n      return NextResponse.json(grantFailure.body, { status: grantFailure.status })\n    }\n\n    // Assign the PK up front so it is available before flush (MikroORM does not\n    // generate UUIDs client-side).\n    const published = em.create(WorkflowDefinition, {\n      id: randomUUID(),\n      workflowId: source.workflowId,\n      codeWorkflowId: source.codeWorkflowId ?? null,\n      workflowName: source.workflowName,\n      description: source.description ?? null,\n      version: nextVersion,\n      definition: source.definition,\n      metadata: source.metadata ?? null,\n      enabled: true,\n      kind: source.kind,\n      lifecycle: 'published',\n      grantedFeatures: grantedFeatures.length ? grantedFeatures : null,\n      tenantId,\n      organizationId,\n      createdBy: auth.sub,\n      updatedBy: auth.sub,\n      createdAt: new Date(),\n      updatedAt: new Date(),\n    })\n    await syncWorkflowDefinitionPrincipal(container, published)\n    em.persist(published)\n    await em.flush()\n\n    if (guardResult?.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId,\n        organizationId,\n        userId: auth.sub ?? '',\n        resourceKind: 'workflows.definition',\n        resourceId: String(published.id),\n        operation: 'custom',\n        requestMethod: 'POST',\n        requestHeaders: request.headers,\n        metadata: guardResult.metadata,\n      })\n    }\n\n    try {\n      const eventBus = container.resolve('eventBus') as\n        | { emitEvent(event: string, payload: unknown, options?: unknown): Promise<void> }\n        | undefined\n      if (eventBus && typeof eventBus.emitEvent === 'function') {\n        await eventBus.emitEvent(\n          'workflows.definition.published',\n          {\n            id: published.id,\n            workflowId: published.workflowId,\n            version: published.version,\n            tenantId: published.tenantId,\n            organizationId: published.organizationId,\n            userId: auth.sub ?? null,\n          },\n          { tenantId: published.tenantId, organizationId: published.organizationId, persistent: true },\n        )\n      }\n    } catch (eventError) {\n      logger.error('failed to emit workflows.definition.published event', {\n        error: eventError instanceof Error ? eventError.message : String(eventError),\n      })\n    }\n\n    return NextResponse.json({\n      data: serializeWorkflowDefinition(published),\n      breakingChanges,\n      message: 'Workflow definition published successfully',\n    })\n  } catch (error) {\n    logger.error('error publishing workflow definition', {\n      error: error instanceof Error ? error.message : String(error),\n    })\n    return NextResponse.json({ error: 'Failed to publish workflow definition' }, { status: 500 })\n  }\n}\n\nexport const openApi = {\n  methods: {\n    POST: {\n      summary: 'Publish a new workflow definition version',\n      description:\n        'Mints a frozen published version snapshotting the definition and its IO port contract. Returns affected sub-workflow callers; pass acknowledgeBreakingChanges=true to publish despite breaking changes.',\n      tags: ['Workflows'],\n      pathParams: z.object({ id: z.string().describe('Workflow definition id') }),\n      requestBody: publishInputSchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Published',\n          example: {\n            data: { id: '\u2026', workflowId: 'verify-policy', version: 2, lifecycle: 'published' },\n            breakingChanges: [],\n            message: 'Workflow definition published successfully',\n          },\n        },\n        {\n          status: 409,\n          description: 'Breaking changes not acknowledged',\n          example: {\n            error: 'Publishing would break existing sub-workflow mappings',\n            breakingChanges: [{ workflowId: 'order-flow', version: 1, stepId: 'sub', brokenMappings: ['input:orderId'] }],\n          },\n        },\n        { status: 404, description: 'Not found', example: { error: 'Workflow definition not found' } },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAYA,SAAS,kBAAkB;AAC3B,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,2BAA2B,wCAAwC;AAC5E,SAAS,0BAA0B;AAEnC,SAAS,oBAAoB;AAC7B,SAAS,mCAAmC;AAC5C,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,WAAW,EAAE,MAAM,EAAE,WAAW,yBAAyB,CAAC;AAE/E,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,+BAA+B;AACnD;AAEA,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,4BAA4B,EAAE,QAAQ,EAAE,SAAS;AACnD,CAAC;AAMD,eAAsB,KAAK,SAAsB,SAAuB;AACtE,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ;AAC7B,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,cAAc,KAAK;AAEjD,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,aAAO,aAAa,KAAK,EAAE,OAAO,yCAAyC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/F;AAEA,UAAM,OAAO,MAAM,QAAQ,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAClD,UAAM,SAAS,mBAAmB,UAAU,IAAI;AAChD,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,OAAO,MAAM,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxG;AAEA,UAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,MAC7D;AAAA,MACA;AAAA,MACA,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,WAAW;AAAA,MACX,eAAe;AAAA,MACf,gBAAgB,QAAQ;AAAA,IAC1B,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,UAAM,SAAS,MAAM,GAAG,QAAQ,oBAAoB;AAAA,MAClD,IAAI,OAAO;AAAA,MACX;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,QAAQ;AACX,aAAO,aAAa,KAAK,EAAE,OAAO,gCAAgC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACtF;AAIA,UAAM,QAA6B,OAAO,YAA4C,MAAM,CAAC;AAC7F,UAAM,kBAAkB,MAAM,uBAAuB,IAAI;AAAA,MACvD,eAAe,OAAO;AAAA,MACtB;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAED,QAAI,gBAAgB,SAAS,KAAK,CAAC,OAAO,KAAK,4BAA4B;AACzE,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO;AAAA,UACP;AAAA,QACF;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAGA,UAAM,SAAS,MAAM,GAAG;AAAA,MACtB;AAAA,MACA,EAAE,YAAY,OAAO,YAAY,SAAS;AAAA,MAC1C,EAAE,SAAS,EAAE,SAAS,OAAO,EAAE;AAAA,IACjC;AACA,UAAM,eAAe,QAAQ,WAAW,OAAO,WAAW;AAO1D,UAAM,kBAAkB,yBAAyB,OAAO,eAAe;AACvE,UAAM,eAAe,MAAM;AAAA,MACzB,UAAU,QAAQ,aAAa;AAAA,MAC/B;AAAA,QACE,QAAQ,KAAK;AAAA,QACb,OAAO,EAAE,UAAU,eAAe;AAAA,QAClC,WAAW;AAAA,QACX,SAAS,CAAC;AAAA,MACZ;AAAA,IACF;AACA,QAAI,cAAc;AAChB,aAAO,aAAa,KAAK,aAAa,MAAM,EAAE,QAAQ,aAAa,OAAO,CAAC;AAAA,IAC7E;AAIA,UAAM,YAAY,GAAG,OAAO,oBAAoB;AAAA,MAC9C,IAAI,WAAW;AAAA,MACf,YAAY,OAAO;AAAA,MACnB,gBAAgB,OAAO,kBAAkB;AAAA,MACzC,cAAc,OAAO;AAAA,MACrB,aAAa,OAAO,eAAe;AAAA,MACnC,SAAS;AAAA,MACT,YAAY,OAAO;AAAA,MACnB,UAAU,OAAO,YAAY;AAAA,MAC7B,SAAS;AAAA,MACT,MAAM,OAAO;AAAA,MACb,WAAW;AAAA,MACX,iBAAiB,gBAAgB,SAAS,kBAAkB;AAAA,MAC5D;AAAA,MACA;AAAA,MACA,WAAW,KAAK;AAAA,MAChB,WAAW,KAAK;AAAA,MAChB,WAAW,oBAAI,KAAK;AAAA,MACpB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AACD,UAAM,gCAAgC,WAAW,SAAS;AAC1D,OAAG,QAAQ,SAAS;AACpB,UAAM,GAAG,MAAM;AAEf,QAAI,aAAa,uBAAuB;AACtC,YAAM,iCAAiC,WAAW;AAAA,QAChD;AAAA,QACA;AAAA,QACA,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc;AAAA,QACd,YAAY,OAAO,UAAU,EAAE;AAAA,QAC/B,WAAW;AAAA,QACX,eAAe;AAAA,QACf,gBAAgB,QAAQ;AAAA,QACxB,UAAU,YAAY;AAAA,MACxB,CAAC;AAAA,IACH;AAEA,QAAI;AACF,YAAM,WAAW,UAAU,QAAQ,UAAU;AAG7C,UAAI,YAAY,OAAO,SAAS,cAAc,YAAY;AACxD,cAAM,SAAS;AAAA,UACb;AAAA,UACA;AAAA,YACE,IAAI,UAAU;AAAA,YACd,YAAY,UAAU;AAAA,YACtB,SAAS,UAAU;AAAA,YACnB,UAAU,UAAU;AAAA,YACpB,gBAAgB,UAAU;AAAA,YAC1B,QAAQ,KAAK,OAAO;AAAA,UACtB;AAAA,UACA,EAAE,UAAU,UAAU,UAAU,gBAAgB,UAAU,gBAAgB,YAAY,KAAK;AAAA,QAC7F;AAAA,MACF;AAAA,IACF,SAAS,YAAY;AACnB,aAAO,MAAM,uDAAuD;AAAA,QAClE,OAAO,sBAAsB,QAAQ,WAAW,UAAU,OAAO,UAAU;AAAA,MAC7E,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,MAAM,4BAA4B,SAAS;AAAA,MAC3C;AAAA,MACA,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,wCAAwC;AAAA,MACnD,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAC9D,CAAC;AACD,WAAO,aAAa,KAAK,EAAE,OAAO,wCAAwC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9F;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,MAAM,CAAC,WAAW;AAAA,MAClB,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,wBAAwB,EAAE,CAAC;AAAA,MAC1E,aAAa;AAAA,MACb,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,SAAS;AAAA,YACP,MAAM,EAAE,IAAI,UAAK,YAAY,iBAAiB,SAAS,GAAG,WAAW,YAAY;AAAA,YACjF,iBAAiB,CAAC;AAAA,YAClB,SAAS;AAAA,UACX;AAAA,QACF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,SAAS;AAAA,YACP,OAAO;AAAA,YACP,iBAAiB,CAAC,EAAE,YAAY,cAAc,SAAS,GAAG,QAAQ,OAAO,gBAAgB,CAAC,eAAe,EAAE,CAAC;AAAA,UAC9G;AAAA,QACF;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,aAAa,SAAS,EAAE,OAAO,gCAAgC,EAAE;AAAA,MAC/F;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * Publish Workflow Definition Version\n *\n * POST /api/workflows/definitions/[id]/publish\n *\n * Mints a new frozen, published version of a workflow definition (snapshotting\n * its current data + IO port contract). Runs breaking-change detection against\n * callers of the workflow as a sub-workflow; when callers would break, the\n * caller must pass `acknowledgeBreakingChanges: true`. Emits\n * `workflows.definition.published`.\n */\n\nimport { randomUUID } from 'node:crypto'\nimport { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { validateCrudMutationGuard, runCrudMutationGuardAfterSuccess } from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { WorkflowDefinition } from '../../../../data/entities'\nimport type { WorkflowIoContract } from '../../../../data/validators'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { serializeWorkflowDefinition } from '../../serialize'\nimport { findSubWorkflowCallers } from '../../../../lib/caller-graph'\nimport { invalidateTriggerCache } from '../../../../lib/event-trigger-service'\nimport {\n  authorizeWorkflowGrantChange,\n  normalizeGrantedFeatures,\n  syncWorkflowDefinitionPrincipal,\n} from '../../../../lib/definition-grant'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\n\nconst logger = createLogger('workflows').child({ component: 'definition-publish-api' })\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.publish'],\n}\n\nconst publishInputSchema = z.object({\n  acknowledgeBreakingChanges: z.boolean().optional(),\n})\n\ninterface RouteContext {\n  params: Promise<{ id: string }>\n}\n\nexport async function POST(request: NextRequest, context: RouteContext) {\n  try {\n    const params = await context.params\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth)\n\n    if (!tenantId || !organizationId) {\n      return NextResponse.json({ error: 'Missing tenant or organization context' }, { status: 400 })\n    }\n\n    const body = await request.json().catch(() => ({}))\n    const parsed = publishInputSchema.safeParse(body)\n    if (!parsed.success) {\n      return NextResponse.json({ error: 'Validation failed', details: parsed.error.issues }, { status: 400 })\n    }\n\n    const guardResult = await validateCrudMutationGuard(container, {\n      tenantId,\n      organizationId,\n      userId: auth.sub ?? '',\n      resourceKind: 'workflows.definition',\n      resourceId: params.id,\n      operation: 'custom',\n      requestMethod: 'POST',\n      requestHeaders: request.headers,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    const source = await em.findOne(WorkflowDefinition, {\n      id: params.id,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })\n    if (!source) {\n      return NextResponse.json({ error: 'Workflow definition not found' }, { status: 404 })\n    }\n\n    // Breaking-change detection: diff this definition's published port contract\n    // against every caller that invokes it as a sub-workflow.\n    const ports: WorkflowIoContract = (source.definition as { io?: WorkflowIoContract })?.io || {}\n    const breakingChanges = await findSubWorkflowCallers(em, {\n      subWorkflowId: source.workflowId,\n      tenantId,\n      organizationId,\n      ports,\n    })\n\n    if (breakingChanges.length > 0 && !parsed.data.acknowledgeBreakingChanges) {\n      return NextResponse.json(\n        {\n          error: 'Publishing would break existing sub-workflow mappings',\n          breakingChanges,\n        },\n        { status: 409 },\n      )\n    }\n\n    // Next version = max existing version for this workflowId/tenant + 1.\n    const latest = await em.findOne(\n      WorkflowDefinition,\n      { workflowId: source.workflowId, tenantId },\n      { orderBy: { version: 'DESC' } },\n    )\n    const nextVersion = (latest?.version ?? source.version) + 1\n\n    // The grant is per VERSION, so publishing mints a NEW execution principal\n    // from the source's grant \u2014 a new identity carrying those powers. It is\n    // therefore re-authorised against the PUBLISHER (`current: []` forces the\n    // check even though the feature list is unchanged): a user who may publish\n    // must not be able to bring a higher-privileged author's grant forward.\n    const grantedFeatures = normalizeGrantedFeatures(source.grantedFeatures)\n    const grantFailure = await authorizeWorkflowGrantChange(\n      container.resolve('rbacService') as Parameters<typeof authorizeWorkflowGrantChange>[0],\n      {\n        userId: auth.sub,\n        scope: { tenantId, organizationId },\n        requested: grantedFeatures,\n        current: [],\n      },\n    )\n    if (grantFailure) {\n      return NextResponse.json(grantFailure.body, { status: grantFailure.status })\n    }\n\n    // Assign the PK up front so it is available before flush (MikroORM does not\n    // generate UUIDs client-side).\n    const published = em.create(WorkflowDefinition, {\n      id: randomUUID(),\n      workflowId: source.workflowId,\n      codeWorkflowId: source.codeWorkflowId ?? null,\n      workflowName: source.workflowName,\n      description: source.description ?? null,\n      version: nextVersion,\n      definition: source.definition,\n      metadata: source.metadata ?? null,\n      enabled: true,\n      kind: source.kind,\n      lifecycle: 'published',\n      grantedFeatures: grantedFeatures.length ? grantedFeatures : null,\n      tenantId,\n      organizationId,\n      createdBy: auth.sub,\n      updatedBy: auth.sub,\n      createdAt: new Date(),\n      updatedAt: new Date(),\n    })\n    await syncWorkflowDefinitionPrincipal(container, published)\n    em.persist(published)\n    await em.flush()\n\n    // The minted version is now the one unpinned starts and event triggers\n    // resolve to, so the cached trigger set still pointing at the previous\n    // version must be dropped.\n    invalidateTriggerCache(tenantId, organizationId)\n\n    if (guardResult?.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId,\n        organizationId,\n        userId: auth.sub ?? '',\n        resourceKind: 'workflows.definition',\n        resourceId: String(published.id),\n        operation: 'custom',\n        requestMethod: 'POST',\n        requestHeaders: request.headers,\n        metadata: guardResult.metadata,\n      })\n    }\n\n    try {\n      const eventBus = container.resolve('eventBus') as\n        | { emitEvent(event: string, payload: unknown, options?: unknown): Promise<void> }\n        | undefined\n      if (eventBus && typeof eventBus.emitEvent === 'function') {\n        await eventBus.emitEvent(\n          'workflows.definition.published',\n          {\n            id: published.id,\n            workflowId: published.workflowId,\n            version: published.version,\n            tenantId: published.tenantId,\n            organizationId: published.organizationId,\n            userId: auth.sub ?? null,\n          },\n          { tenantId: published.tenantId, organizationId: published.organizationId, persistent: true },\n        )\n      }\n    } catch (eventError) {\n      logger.error('failed to emit workflows.definition.published event', {\n        error: eventError instanceof Error ? eventError.message : String(eventError),\n      })\n    }\n\n    return NextResponse.json({\n      data: serializeWorkflowDefinition(published),\n      breakingChanges,\n      message: 'Workflow definition published successfully',\n    })\n  } catch (error) {\n    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status })\n    logger.error('error publishing workflow definition', {\n      error: error instanceof Error ? error.message : String(error),\n    })\n    return NextResponse.json({ error: 'Failed to publish workflow definition' }, { status: 500 })\n  }\n}\n\nexport const openApi = {\n  methods: {\n    POST: {\n      summary: 'Publish a new workflow definition version',\n      description:\n        'Mints a frozen published version snapshotting the definition and its IO port contract. Returns affected sub-workflow callers; pass acknowledgeBreakingChanges=true to publish despite breaking changes.',\n      tags: ['Workflows'],\n      pathParams: z.object({ id: z.string().describe('Workflow definition id') }),\n      requestBody: publishInputSchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Published',\n          example: {\n            data: { id: '\u2026', workflowId: 'verify-policy', version: 2, lifecycle: 'published' },\n            breakingChanges: [],\n            message: 'Workflow definition published successfully',\n          },\n        },\n        {\n          status: 409,\n          description: 'Breaking changes not acknowledged',\n          example: {\n            error: 'Publishing would break existing sub-workflow mappings',\n            breakingChanges: [{ workflowId: 'order-flow', version: 1, stepId: 'sub', brokenMappings: ['input:orderId'] }],\n          },\n        },\n        { status: 404, description: 'Not found', example: { error: 'Workflow definition not found' } },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAYA,SAAS,kBAAkB;AAC3B,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,2BAA2B,wCAAwC;AAC5E,SAAS,0BAA0B;AAEnC,SAAS,oBAAoB;AAC7B,SAAS,mCAAmC;AAC5C,SAAS,8BAA8B;AACvC,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,uBAAuB;AAEhC,MAAM,SAAS,aAAa,WAAW,EAAE,MAAM,EAAE,WAAW,yBAAyB,CAAC;AAE/E,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,+BAA+B;AACnD;AAEA,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,4BAA4B,EAAE,QAAQ,EAAE,SAAS;AACnD,CAAC;AAMD,eAAsB,KAAK,SAAsB,SAAuB;AACtE,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ;AAC7B,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,kCAAkC,OAAO,IAAI;AAEpE,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,aAAO,aAAa,KAAK,EAAE,OAAO,yCAAyC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/F;AAEA,UAAM,OAAO,MAAM,QAAQ,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAClD,UAAM,SAAS,mBAAmB,UAAU,IAAI;AAChD,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,OAAO,MAAM,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxG;AAEA,UAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,MAC7D;AAAA,MACA;AAAA,MACA,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,WAAW;AAAA,MACX,eAAe;AAAA,MACf,gBAAgB,QAAQ;AAAA,IAC1B,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,UAAM,SAAS,MAAM,GAAG,QAAQ,oBAAoB;AAAA,MAClD,IAAI,OAAO;AAAA,MACX;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,QAAQ;AACX,aAAO,aAAa,KAAK,EAAE,OAAO,gCAAgC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACtF;AAIA,UAAM,QAA6B,OAAO,YAA4C,MAAM,CAAC;AAC7F,UAAM,kBAAkB,MAAM,uBAAuB,IAAI;AAAA,MACvD,eAAe,OAAO;AAAA,MACtB;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAED,QAAI,gBAAgB,SAAS,KAAK,CAAC,OAAO,KAAK,4BAA4B;AACzE,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO;AAAA,UACP;AAAA,QACF;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAGA,UAAM,SAAS,MAAM,GAAG;AAAA,MACtB;AAAA,MACA,EAAE,YAAY,OAAO,YAAY,SAAS;AAAA,MAC1C,EAAE,SAAS,EAAE,SAAS,OAAO,EAAE;AAAA,IACjC;AACA,UAAM,eAAe,QAAQ,WAAW,OAAO,WAAW;AAO1D,UAAM,kBAAkB,yBAAyB,OAAO,eAAe;AACvE,UAAM,eAAe,MAAM;AAAA,MACzB,UAAU,QAAQ,aAAa;AAAA,MAC/B;AAAA,QACE,QAAQ,KAAK;AAAA,QACb,OAAO,EAAE,UAAU,eAAe;AAAA,QAClC,WAAW;AAAA,QACX,SAAS,CAAC;AAAA,MACZ;AAAA,IACF;AACA,QAAI,cAAc;AAChB,aAAO,aAAa,KAAK,aAAa,MAAM,EAAE,QAAQ,aAAa,OAAO,CAAC;AAAA,IAC7E;AAIA,UAAM,YAAY,GAAG,OAAO,oBAAoB;AAAA,MAC9C,IAAI,WAAW;AAAA,MACf,YAAY,OAAO;AAAA,MACnB,gBAAgB,OAAO,kBAAkB;AAAA,MACzC,cAAc,OAAO;AAAA,MACrB,aAAa,OAAO,eAAe;AAAA,MACnC,SAAS;AAAA,MACT,YAAY,OAAO;AAAA,MACnB,UAAU,OAAO,YAAY;AAAA,MAC7B,SAAS;AAAA,MACT,MAAM,OAAO;AAAA,MACb,WAAW;AAAA,MACX,iBAAiB,gBAAgB,SAAS,kBAAkB;AAAA,MAC5D;AAAA,MACA;AAAA,MACA,WAAW,KAAK;AAAA,MAChB,WAAW,KAAK;AAAA,MAChB,WAAW,oBAAI,KAAK;AAAA,MACpB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AACD,UAAM,gCAAgC,WAAW,SAAS;AAC1D,OAAG,QAAQ,SAAS;AACpB,UAAM,GAAG,MAAM;AAKf,2BAAuB,UAAU,cAAc;AAE/C,QAAI,aAAa,uBAAuB;AACtC,YAAM,iCAAiC,WAAW;AAAA,QAChD;AAAA,QACA;AAAA,QACA,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc;AAAA,QACd,YAAY,OAAO,UAAU,EAAE;AAAA,QAC/B,WAAW;AAAA,QACX,eAAe;AAAA,QACf,gBAAgB,QAAQ;AAAA,QACxB,UAAU,YAAY;AAAA,MACxB,CAAC;AAAA,IACH;AAEA,QAAI;AACF,YAAM,WAAW,UAAU,QAAQ,UAAU;AAG7C,UAAI,YAAY,OAAO,SAAS,cAAc,YAAY;AACxD,cAAM,SAAS;AAAA,UACb;AAAA,UACA;AAAA,YACE,IAAI,UAAU;AAAA,YACd,YAAY,UAAU;AAAA,YACtB,SAAS,UAAU;AAAA,YACnB,UAAU,UAAU;AAAA,YACpB,gBAAgB,UAAU;AAAA,YAC1B,QAAQ,KAAK,OAAO;AAAA,UACtB;AAAA,UACA,EAAE,UAAU,UAAU,UAAU,gBAAgB,UAAU,gBAAgB,YAAY,KAAK;AAAA,QAC7F;AAAA,MACF;AAAA,IACF,SAAS,YAAY;AACnB,aAAO,MAAM,uDAAuD;AAAA,QAClE,OAAO,sBAAsB,QAAQ,WAAW,UAAU,OAAO,UAAU;AAAA,MAC7E,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,MAAM,4BAA4B,SAAS;AAAA,MAC3C;AAAA,MACA,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,EAAG,QAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AACzF,WAAO,MAAM,wCAAwC;AAAA,MACnD,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAC9D,CAAC;AACD,WAAO,aAAa,KAAK,EAAE,OAAO,wCAAwC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9F;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,MAAM,CAAC,WAAW;AAAA,MAClB,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,wBAAwB,EAAE,CAAC;AAAA,MAC1E,aAAa;AAAA,MACb,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,SAAS;AAAA,YACP,MAAM,EAAE,IAAI,UAAK,YAAY,iBAAiB,SAAS,GAAG,WAAW,YAAY;AAAA,YACjF,iBAAiB,CAAC;AAAA,YAClB,SAAS;AAAA,UACX;AAAA,QACF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,SAAS;AAAA,YACP,OAAO;AAAA,YACP,iBAAiB,CAAC,EAAE,YAAY,cAAc,SAAS,GAAG,QAAQ,OAAO,gBAAgB,CAAC,eAAe,EAAE,CAAC;AAAA,UAC9G;AAAA,QACF;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,aAAa,SAAS,EAAE,OAAO,gCAAgC,EAAE;AAAA,MAC/F;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }