@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.9.0

package/dist/modules/workflows/api/definitions/[id]/reset-to-code/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { validateCrudMutationGuard, runCrudMutationGuardAfterSuccess } from "@open-mercato/shared/lib/crud/mutation-guard";
 import { WorkflowDefinition, WorkflowInstance } from "../../../../data/entities.js";
 import { serializeCodeWorkflowDefinition } from "../../serialize.js";
@@ -10,6 +11,7 @@ import { workflowDefinitionResetResponseSchema, workflowErrorSchema } from "../.
 import { getCodeWorkflow } from "../../../../lib/code-registry.js";
 import { invalidateTriggerCache } from "../../../../lib/event-trigger-service.js";
 import { createLogger } from "@open-mercato/shared/lib/logger";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 const logger = createLogger("workflows");
 const metadata = {
   requireAuth: true,
@@ -26,7 +28,7 @@ async function POST(request, context) {
     }
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request });
     const tenantId = auth.tenantId;
-    const organizationId = scope?.selectedId ?? auth.orgId;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth);
     const rbacService = container.resolve("rbacService");
     const hasPermission = await rbacService.userHasAllFeatures(
       auth.sub,
@@ -146,6 +148,7 @@ async function POST(request, context) {
       message: "Workflow definition reset to code version"
     });
   } catch (error) {
+    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status });
     logger.error("Error resetting workflow definition to code", { err: error });
     return NextResponse.json(
       { error: "Failed to reset workflow definition to code" },

package/dist/modules/workflows/api/definitions/[id]/reset-to-code/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/workflows/api/definitions/%5Bid%5D/reset-to-code/route.ts"],
-  "sourcesContent": ["/**\n * Reset Customized Workflow Definition to Code\n *\n * POST /api/workflows/definitions/[id]/reset-to-code\n *\n * Deletes the DB override row for a code-based workflow definition,\n * reverting it back to the original code registry version.\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { validateCrudMutationGuard, runCrudMutationGuardAfterSuccess } from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { WorkflowDefinition, WorkflowInstance } from '../../../../data/entities'\nimport { serializeCodeWorkflowDefinition } from '../../serialize'\nimport { workflowDefinitionResetResponseSchema, workflowErrorSchema } from '../../../openapi'\nimport { getCodeWorkflow } from '../../../../lib/code-registry'\nimport { invalidateTriggerCache } from '../../../../lib/event-trigger-service'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.edit'],\n}\n\ninterface RouteContext {\n  params: Promise<{\n    id: string\n  }>\n}\n\n/**\n * POST /api/workflows/definitions/[id]/reset-to-code\n *\n * Reset a customized code workflow definition back to its original code version.\n */\nexport async function POST(\n  request: NextRequest,\n  context: RouteContext\n) {\n  try {\n    const params = await context.params\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = scope?.selectedId ?? auth.orgId\n\n    // Check edit permission\n    const rbacService = container.resolve('rbacService')\n    const hasPermission = await rbacService.userHasAllFeatures(\n      auth.sub,\n      ['workflows.definitions.edit'],\n      {\n        tenantId,\n        organizationId,\n      }\n    )\n\n    if (!hasPermission) {\n      return NextResponse.json(\n        { error: 'Insufficient permissions' },\n        { status: 403 }\n      )\n    }\n\n    // Find existing definition\n    const definition = await em.findOne(WorkflowDefinition, {\n      id: params.id,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })\n\n    if (!definition) {\n      return NextResponse.json(\n        { error: 'Workflow definition not found' },\n        { status: 404 }\n      )\n    }\n\n    // Verify this is a code-based override\n    if (!definition.codeWorkflowId) {\n      return NextResponse.json(\n        { error: 'This workflow definition is not a code-based override and cannot be reset' },\n        { status: 400 }\n      )\n    }\n\n    // Check if there are active workflow instances using this definition\n    const activeInstances = await em.count(WorkflowInstance, {\n      definitionId: definition.id,\n      status: { $in: ['RUNNING', 'WAITING'] },\n    })\n\n    if (activeInstances > 0) {\n      return NextResponse.json(\n        {\n          error: `Cannot reset workflow definition with ${activeInstances} active instance(s)`,\n        },\n        { status: 409 }\n      )\n    }\n\n    const guardResult = await validateCrudMutationGuard(container, {\n      tenantId: tenantId ?? '',\n      organizationId: organizationId ?? null,\n      userId: auth.sub ?? '',\n      resourceKind: 'workflows.definition',\n      resourceId: String(definition.id),\n      operation: 'custom',\n      requestMethod: 'POST',\n      requestHeaders: request.headers,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    // Look up the original code definition before deleting\n    const codeDef = getCodeWorkflow(definition.codeWorkflowId)\n\n    // Snapshot identifying fields before remove() detaches the entity\n    const removedSnapshot = {\n      id: String(definition.id),\n      workflowId: definition.workflowId,\n      codeWorkflowId: definition.codeWorkflowId,\n      tenantId: definition.tenantId,\n      organizationId: definition.organizationId,\n    }\n\n    // Hard-delete the DB override row\n    em.remove(definition)\n    await em.flush()\n\n    // Trigger ownership falls back to the code registry, so the cached snapshot\n    // still holds the embedded triggers of a row that no longer exists (#4425).\n    if (removedSnapshot.tenantId) {\n      invalidateTriggerCache(removedSnapshot.tenantId, removedSnapshot.organizationId ?? undefined)\n    }\n\n    if (guardResult?.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId: tenantId ?? '',\n        organizationId: organizationId ?? null,\n        userId: auth.sub ?? '',\n        resourceKind: 'workflows.definition',\n        resourceId: removedSnapshot.id,\n        operation: 'custom',\n        requestMethod: 'POST',\n        requestHeaders: request.headers,\n        metadata: guardResult.metadata,\n      })\n    }\n\n    try {\n      const eventBus = container.resolve('eventBus') as\n        | { emitEvent(event: string, payload: unknown, options?: unknown): Promise<void> }\n        | undefined\n      if (eventBus && typeof eventBus.emitEvent === 'function') {\n        await eventBus.emitEvent(\n          'workflows.definition.reset_to_code',\n          {\n            id: removedSnapshot.id,\n            workflowId: removedSnapshot.workflowId,\n            codeWorkflowId: removedSnapshot.codeWorkflowId,\n            tenantId: removedSnapshot.tenantId,\n            organizationId: removedSnapshot.organizationId,\n            userId: auth.sub ?? null,\n          },\n          {\n            tenantId: removedSnapshot.tenantId,\n            organizationId: removedSnapshot.organizationId,\n            persistent: true,\n          },\n        )\n      }\n    } catch (eventError) {\n      logger.error('Failed to emit workflows.definition.reset_to_code event', { err: eventError })\n    }\n\n    if (!codeDef) {\n      return NextResponse.json({\n        message: 'Workflow definition reset to code version (code definition no longer registered)',\n        data: null,\n      })\n    }\n\n    const syntheticId = `code:${codeDef.workflowId}`\n\n    return NextResponse.json({\n      data: serializeCodeWorkflowDefinition(codeDef, syntheticId),\n      message: 'Workflow definition reset to code version',\n    })\n  } catch (error) {\n    logger.error('Error resetting workflow definition to code', { err: error })\n    return NextResponse.json(\n      { error: 'Failed to reset workflow definition to code' },\n      { status: 500 }\n    )\n  }\n}\n\nexport const openApi = {\n  methods: {\n    POST: {\n      summary: 'Reset workflow definition to code version',\n      description: 'Deletes the DB override for a code-based workflow definition, reverting it to the original code registry version. Cannot be reset if there are active instances.',\n      tags: ['Workflows'],\n      pathParams: z.object({\n        id: z.string().uuid(),\n      }),\n      responses: [\n        {\n          status: 200,\n          description: 'Workflow definition reset to code version',\n          schema: workflowDefinitionResetResponseSchema,\n          example: {\n            data: {\n              id: 'code:checkout-flow',\n              workflowId: 'checkout-flow',\n              workflowName: 'Checkout Flow',\n              description: 'Code-defined checkout workflow',\n              version: 1,\n              source: 'code',\n              isCodeBased: true,\n            },\n            message: 'Workflow definition reset to code version',\n          },\n        },\n        {\n          status: 400,\n          description: 'Definition is not a code-based override',\n          schema: workflowErrorSchema,\n          example: {\n            error: 'This workflow definition is not a code-based override and cannot be reset',\n          },\n        },\n        {\n          status: 404,\n          description: 'Workflow definition not found',\n          schema: workflowErrorSchema,\n          example: {\n            error: 'Workflow definition not found',\n          },\n        },\n        {\n          status: 409,\n          description: 'Cannot reset - active workflow instances exist',\n          schema: workflowErrorSchema,\n          example: {\n            error: 'Cannot reset workflow definition with 3 active instance(s)',\n          },\n        },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AASA,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,2BAA2B,wCAAwC;AAC5E,SAAS,oBAAoB,wBAAwB;AACrD,SAAS,uCAAuC;AAChD,SAAS,uCAAuC,2BAA2B;AAC3E,SAAS,uBAAuB;AAChC,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,4BAA4B;AAChD;AAaA,eAAsB,KACpB,SACA,SACA;AACA,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ;AAC7B,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,cAAc,KAAK;AAGjD,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,UAAM,gBAAgB,MAAM,YAAY;AAAA,MACtC,KAAK;AAAA,MACL,CAAC,4BAA4B;AAAA,MAC7B;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,2BAA2B;AAAA,QACpC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAGA,UAAM,aAAa,MAAM,GAAG,QAAQ,oBAAoB;AAAA,MACtD,IAAI,OAAO;AAAA,MACX;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AAED,QAAI,CAAC,YAAY;AACf,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,gCAAgC;AAAA,QACzC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAGA,QAAI,CAAC,WAAW,gBAAgB;AAC9B,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,4EAA4E;AAAA,QACrF,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAGA,UAAM,kBAAkB,MAAM,GAAG,MAAM,kBAAkB;AAAA,MACvD,cAAc,WAAW;AAAA,MACzB,QAAQ,EAAE,KAAK,CAAC,WAAW,SAAS,EAAE;AAAA,IACxC,CAAC;AAED,QAAI,kBAAkB,GAAG;AACvB,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO,yCAAyC,eAAe;AAAA,QACjE;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,MAC7D,UAAU,YAAY;AAAA,MACtB,gBAAgB,kBAAkB;AAAA,MAClC,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY,OAAO,WAAW,EAAE;AAAA,MAChC,WAAW;AAAA,MACX,eAAe;AAAA,MACf,gBAAgB,QAAQ;AAAA,IAC1B,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAGA,UAAM,UAAU,gBAAgB,WAAW,cAAc;AAGzD,UAAM,kBAAkB;AAAA,MACtB,IAAI,OAAO,WAAW,EAAE;AAAA,MACxB,YAAY,WAAW;AAAA,MACvB,gBAAgB,WAAW;AAAA,MAC3B,UAAU,WAAW;AAAA,MACrB,gBAAgB,WAAW;AAAA,IAC7B;AAGA,OAAG,OAAO,UAAU;AACpB,UAAM,GAAG,MAAM;AAIf,QAAI,gBAAgB,UAAU;AAC5B,6BAAuB,gBAAgB,UAAU,gBAAgB,kBAAkB,MAAS;AAAA,IAC9F;AAEA,QAAI,aAAa,uBAAuB;AACtC,YAAM,iCAAiC,WAAW;AAAA,QAChD,UAAU,YAAY;AAAA,QACtB,gBAAgB,kBAAkB;AAAA,QAClC,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc;AAAA,QACd,YAAY,gBAAgB;AAAA,QAC5B,WAAW;AAAA,QACX,eAAe;AAAA,QACf,gBAAgB,QAAQ;AAAA,QACxB,UAAU,YAAY;AAAA,MACxB,CAAC;AAAA,IACH;AAEA,QAAI;AACF,YAAM,WAAW,UAAU,QAAQ,UAAU;AAG7C,UAAI,YAAY,OAAO,SAAS,cAAc,YAAY;AACxD,cAAM,SAAS;AAAA,UACb;AAAA,UACA;AAAA,YACE,IAAI,gBAAgB;AAAA,YACpB,YAAY,gBAAgB;AAAA,YAC5B,gBAAgB,gBAAgB;AAAA,YAChC,UAAU,gBAAgB;AAAA,YAC1B,gBAAgB,gBAAgB;AAAA,YAChC,QAAQ,KAAK,OAAO;AAAA,UACtB;AAAA,UACA;AAAA,YACE,UAAU,gBAAgB;AAAA,YAC1B,gBAAgB,gBAAgB;AAAA,YAChC,YAAY;AAAA,UACd;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,YAAY;AACnB,aAAO,MAAM,2DAA2D,EAAE,KAAK,WAAW,CAAC;AAAA,IAC7F;AAEA,QAAI,CAAC,SAAS;AACZ,aAAO,aAAa,KAAK;AAAA,QACvB,SAAS;AAAA,QACT,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAEA,UAAM,cAAc,QAAQ,QAAQ,UAAU;AAE9C,WAAO,aAAa,KAAK;AAAA,MACvB,MAAM,gCAAgC,SAAS,WAAW;AAAA,MAC1D,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,+CAA+C,EAAE,KAAK,MAAM,CAAC;AAC1E,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,8CAA8C;AAAA,MACvD,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,MAAM,CAAC,WAAW;AAAA,MAClB,YAAY,EAAE,OAAO;AAAA,QACnB,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,MACtB,CAAC;AAAA,MACD,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,MAAM;AAAA,cACJ,IAAI;AAAA,cACJ,YAAY;AAAA,cACZ,cAAc;AAAA,cACd,aAAa;AAAA,cACb,SAAS;AAAA,cACT,QAAQ;AAAA,cACR,aAAa;AAAA,YACf;AAAA,YACA,SAAS;AAAA,UACX;AAAA,QACF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,OAAO;AAAA,UACT;AAAA,QACF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,OAAO;AAAA,UACT;AAAA,QACF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,OAAO;AAAA,UACT;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * Reset Customized Workflow Definition to Code\n *\n * POST /api/workflows/definitions/[id]/reset-to-code\n *\n * Deletes the DB override row for a code-based workflow definition,\n * reverting it back to the original code registry version.\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { validateCrudMutationGuard, runCrudMutationGuardAfterSuccess } from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { WorkflowDefinition, WorkflowInstance } from '../../../../data/entities'\nimport { serializeCodeWorkflowDefinition } from '../../serialize'\nimport { workflowDefinitionResetResponseSchema, workflowErrorSchema } from '../../../openapi'\nimport { getCodeWorkflow } from '../../../../lib/code-registry'\nimport { invalidateTriggerCache } from '../../../../lib/event-trigger-service'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.edit'],\n}\n\ninterface RouteContext {\n  params: Promise<{\n    id: string\n  }>\n}\n\n/**\n * POST /api/workflows/definitions/[id]/reset-to-code\n *\n * Reset a customized code workflow definition back to its original code version.\n */\nexport async function POST(\n  request: NextRequest,\n  context: RouteContext\n) {\n  try {\n    const params = await context.params\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth)\n\n    // Check edit permission\n    const rbacService = container.resolve('rbacService')\n    const hasPermission = await rbacService.userHasAllFeatures(\n      auth.sub,\n      ['workflows.definitions.edit'],\n      {\n        tenantId,\n        organizationId,\n      }\n    )\n\n    if (!hasPermission) {\n      return NextResponse.json(\n        { error: 'Insufficient permissions' },\n        { status: 403 }\n      )\n    }\n\n    // Find existing definition\n    const definition = await em.findOne(WorkflowDefinition, {\n      id: params.id,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })\n\n    if (!definition) {\n      return NextResponse.json(\n        { error: 'Workflow definition not found' },\n        { status: 404 }\n      )\n    }\n\n    // Verify this is a code-based override\n    if (!definition.codeWorkflowId) {\n      return NextResponse.json(\n        { error: 'This workflow definition is not a code-based override and cannot be reset' },\n        { status: 400 }\n      )\n    }\n\n    // Check if there are active workflow instances using this definition\n    const activeInstances = await em.count(WorkflowInstance, {\n      definitionId: definition.id,\n      status: { $in: ['RUNNING', 'WAITING'] },\n    })\n\n    if (activeInstances > 0) {\n      return NextResponse.json(\n        {\n          error: `Cannot reset workflow definition with ${activeInstances} active instance(s)`,\n        },\n        { status: 409 }\n      )\n    }\n\n    const guardResult = await validateCrudMutationGuard(container, {\n      tenantId: tenantId ?? '',\n      organizationId: organizationId ?? null,\n      userId: auth.sub ?? '',\n      resourceKind: 'workflows.definition',\n      resourceId: String(definition.id),\n      operation: 'custom',\n      requestMethod: 'POST',\n      requestHeaders: request.headers,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    // Look up the original code definition before deleting\n    const codeDef = getCodeWorkflow(definition.codeWorkflowId)\n\n    // Snapshot identifying fields before remove() detaches the entity\n    const removedSnapshot = {\n      id: String(definition.id),\n      workflowId: definition.workflowId,\n      codeWorkflowId: definition.codeWorkflowId,\n      tenantId: definition.tenantId,\n      organizationId: definition.organizationId,\n    }\n\n    // Hard-delete the DB override row\n    em.remove(definition)\n    await em.flush()\n\n    // Trigger ownership falls back to the code registry, so the cached snapshot\n    // still holds the embedded triggers of a row that no longer exists (#4425).\n    if (removedSnapshot.tenantId) {\n      invalidateTriggerCache(removedSnapshot.tenantId, removedSnapshot.organizationId ?? undefined)\n    }\n\n    if (guardResult?.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId: tenantId ?? '',\n        organizationId: organizationId ?? null,\n        userId: auth.sub ?? '',\n        resourceKind: 'workflows.definition',\n        resourceId: removedSnapshot.id,\n        operation: 'custom',\n        requestMethod: 'POST',\n        requestHeaders: request.headers,\n        metadata: guardResult.metadata,\n      })\n    }\n\n    try {\n      const eventBus = container.resolve('eventBus') as\n        | { emitEvent(event: string, payload: unknown, options?: unknown): Promise<void> }\n        | undefined\n      if (eventBus && typeof eventBus.emitEvent === 'function') {\n        await eventBus.emitEvent(\n          'workflows.definition.reset_to_code',\n          {\n            id: removedSnapshot.id,\n            workflowId: removedSnapshot.workflowId,\n            codeWorkflowId: removedSnapshot.codeWorkflowId,\n            tenantId: removedSnapshot.tenantId,\n            organizationId: removedSnapshot.organizationId,\n            userId: auth.sub ?? null,\n          },\n          {\n            tenantId: removedSnapshot.tenantId,\n            organizationId: removedSnapshot.organizationId,\n            persistent: true,\n          },\n        )\n      }\n    } catch (eventError) {\n      logger.error('Failed to emit workflows.definition.reset_to_code event', { err: eventError })\n    }\n\n    if (!codeDef) {\n      return NextResponse.json({\n        message: 'Workflow definition reset to code version (code definition no longer registered)',\n        data: null,\n      })\n    }\n\n    const syntheticId = `code:${codeDef.workflowId}`\n\n    return NextResponse.json({\n      data: serializeCodeWorkflowDefinition(codeDef, syntheticId),\n      message: 'Workflow definition reset to code version',\n    })\n  } catch (error) {\n    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status })\n    logger.error('Error resetting workflow definition to code', { err: error })\n    return NextResponse.json(\n      { error: 'Failed to reset workflow definition to code' },\n      { status: 500 }\n    )\n  }\n}\n\nexport const openApi = {\n  methods: {\n    POST: {\n      summary: 'Reset workflow definition to code version',\n      description: 'Deletes the DB override for a code-based workflow definition, reverting it to the original code registry version. Cannot be reset if there are active instances.',\n      tags: ['Workflows'],\n      pathParams: z.object({\n        id: z.string().uuid(),\n      }),\n      responses: [\n        {\n          status: 200,\n          description: 'Workflow definition reset to code version',\n          schema: workflowDefinitionResetResponseSchema,\n          example: {\n            data: {\n              id: 'code:checkout-flow',\n              workflowId: 'checkout-flow',\n              workflowName: 'Checkout Flow',\n              description: 'Code-defined checkout workflow',\n              version: 1,\n              source: 'code',\n              isCodeBased: true,\n            },\n            message: 'Workflow definition reset to code version',\n          },\n        },\n        {\n          status: 400,\n          description: 'Definition is not a code-based override',\n          schema: workflowErrorSchema,\n          example: {\n            error: 'This workflow definition is not a code-based override and cannot be reset',\n          },\n        },\n        {\n          status: 404,\n          description: 'Workflow definition not found',\n          schema: workflowErrorSchema,\n          example: {\n            error: 'Workflow definition not found',\n          },\n        },\n        {\n          status: 409,\n          description: 'Cannot reset - active workflow instances exist',\n          schema: workflowErrorSchema,\n          example: {\n            error: 'Cannot reset workflow definition with 3 active instance(s)',\n          },\n        },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AASA,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,2BAA2B,wCAAwC;AAC5E,SAAS,oBAAoB,wBAAwB;AACrD,SAAS,uCAAuC;AAChD,SAAS,uCAAuC,2BAA2B;AAC3E,SAAS,uBAAuB;AAChC,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAC7B,SAAS,uBAAuB;AAEhC,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,4BAA4B;AAChD;AAaA,eAAsB,KACpB,SACA,SACA;AACA,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ;AAC7B,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,kCAAkC,OAAO,IAAI;AAGpE,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,UAAM,gBAAgB,MAAM,YAAY;AAAA,MACtC,KAAK;AAAA,MACL,CAAC,4BAA4B;AAAA,MAC7B;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,2BAA2B;AAAA,QACpC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAGA,UAAM,aAAa,MAAM,GAAG,QAAQ,oBAAoB;AAAA,MACtD,IAAI,OAAO;AAAA,MACX;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AAED,QAAI,CAAC,YAAY;AACf,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,gCAAgC;AAAA,QACzC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAGA,QAAI,CAAC,WAAW,gBAAgB;AAC9B,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,4EAA4E;AAAA,QACrF,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAGA,UAAM,kBAAkB,MAAM,GAAG,MAAM,kBAAkB;AAAA,MACvD,cAAc,WAAW;AAAA,MACzB,QAAQ,EAAE,KAAK,CAAC,WAAW,SAAS,EAAE;AAAA,IACxC,CAAC;AAED,QAAI,kBAAkB,GAAG;AACvB,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO,yCAAyC,eAAe;AAAA,QACjE;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,MAC7D,UAAU,YAAY;AAAA,MACtB,gBAAgB,kBAAkB;AAAA,MAClC,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY,OAAO,WAAW,EAAE;AAAA,MAChC,WAAW;AAAA,MACX,eAAe;AAAA,MACf,gBAAgB,QAAQ;AAAA,IAC1B,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAGA,UAAM,UAAU,gBAAgB,WAAW,cAAc;AAGzD,UAAM,kBAAkB;AAAA,MACtB,IAAI,OAAO,WAAW,EAAE;AAAA,MACxB,YAAY,WAAW;AAAA,MACvB,gBAAgB,WAAW;AAAA,MAC3B,UAAU,WAAW;AAAA,MACrB,gBAAgB,WAAW;AAAA,IAC7B;AAGA,OAAG,OAAO,UAAU;AACpB,UAAM,GAAG,MAAM;AAIf,QAAI,gBAAgB,UAAU;AAC5B,6BAAuB,gBAAgB,UAAU,gBAAgB,kBAAkB,MAAS;AAAA,IAC9F;AAEA,QAAI,aAAa,uBAAuB;AACtC,YAAM,iCAAiC,WAAW;AAAA,QAChD,UAAU,YAAY;AAAA,QACtB,gBAAgB,kBAAkB;AAAA,QAClC,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc;AAAA,QACd,YAAY,gBAAgB;AAAA,QAC5B,WAAW;AAAA,QACX,eAAe;AAAA,QACf,gBAAgB,QAAQ;AAAA,QACxB,UAAU,YAAY;AAAA,MACxB,CAAC;AAAA,IACH;AAEA,QAAI;AACF,YAAM,WAAW,UAAU,QAAQ,UAAU;AAG7C,UAAI,YAAY,OAAO,SAAS,cAAc,YAAY;AACxD,cAAM,SAAS;AAAA,UACb;AAAA,UACA;AAAA,YACE,IAAI,gBAAgB;AAAA,YACpB,YAAY,gBAAgB;AAAA,YAC5B,gBAAgB,gBAAgB;AAAA,YAChC,UAAU,gBAAgB;AAAA,YAC1B,gBAAgB,gBAAgB;AAAA,YAChC,QAAQ,KAAK,OAAO;AAAA,UACtB;AAAA,UACA;AAAA,YACE,UAAU,gBAAgB;AAAA,YAC1B,gBAAgB,gBAAgB;AAAA,YAChC,YAAY;AAAA,UACd;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,YAAY;AACnB,aAAO,MAAM,2DAA2D,EAAE,KAAK,WAAW,CAAC;AAAA,IAC7F;AAEA,QAAI,CAAC,SAAS;AACZ,aAAO,aAAa,KAAK;AAAA,QACvB,SAAS;AAAA,QACT,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAEA,UAAM,cAAc,QAAQ,QAAQ,UAAU;AAE9C,WAAO,aAAa,KAAK;AAAA,MACvB,MAAM,gCAAgC,SAAS,WAAW;AAAA,MAC1D,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,EAAG,QAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AACzF,WAAO,MAAM,+CAA+C,EAAE,KAAK,MAAM,CAAC;AAC1E,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,8CAA8C;AAAA,MACvD,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,MAAM,CAAC,WAAW;AAAA,MAClB,YAAY,EAAE,OAAO;AAAA,QACnB,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,MACtB,CAAC;AAAA,MACD,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,MAAM;AAAA,cACJ,IAAI;AAAA,cACJ,YAAY;AAAA,cACZ,cAAc;AAAA,cACd,aAAa;AAAA,cACb,SAAS;AAAA,cACT,QAAQ;AAAA,cACR,aAAa;AAAA,YACf;AAAA,YACA,SAAS;AAAA,UACX;AAAA,QACF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,OAAO;AAAA,UACT;AAAA,QACF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,OAAO;AAAA,UACT;AAAA,QACF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,OAAO;AAAA,UACT;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/workflows/api/definitions/[id]/route.js

@@ -3,7 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
-import { resolveOrganizationScopeFilter } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
+import { resolveOrganizationScopeFilter, resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { WorkflowDefinition, WorkflowInstance } from "../../../data/entities.js";
 import {
   updateWorkflowDefinitionInputSchema,
@@ -115,7 +115,7 @@ async function PUT(request, context) {
     }
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request });
     const tenantId = auth.tenantId;
-    const organizationId = scope?.selectedId ?? auth.orgId;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth);
     const rbacService = container.resolve("rbacService");
     const hasPermission = await rbacService.userHasAllFeatures(
       auth.sub,
@@ -363,6 +363,7 @@ async function PUT(request, context) {
       message: "Workflow definition updated successfully"
     });
   } catch (error) {
+    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status });
     logger.error("Error updating workflow definition", { err: error });
     return NextResponse.json(
       { error: "Failed to update workflow definition" },
@@ -381,7 +382,7 @@ async function DELETE(request, context) {
     }
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request });
     const tenantId = auth.tenantId;
-    const organizationId = scope?.selectedId ?? auth.orgId;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth);
     const rbacService = container.resolve("rbacService");
     const hasPermission = await rbacService.userHasAllFeatures(
       auth.sub,
@@ -456,6 +457,7 @@ async function DELETE(request, context) {
       message: "Workflow definition deleted successfully"
     });
   } catch (error) {
+    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status });
     logger.error("Error deleting workflow definition", { err: error });
     return NextResponse.json(
       { error: "Failed to delete workflow definition" },

package/dist/modules/workflows/api/definitions/[id]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/workflows/api/definitions/%5Bid%5D/route.ts"],
-  "sourcesContent": ["/**\n * Workflow Definition Detail API\n *\n * Endpoints:\n * - GET /api/workflows/definitions/[id] - Get workflow definition\n * - PUT /api/workflows/definitions/[id] - Update workflow definition\n * - DELETE /api/workflows/definitions/[id] - Delete workflow definition (soft delete)\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveOrganizationScopeFilter } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { WorkflowDefinition, WorkflowInstance } from '../../../data/entities'\nimport {\n  updateWorkflowDefinitionInputSchema,\n  updateWorkflowDefinitionInputCheckedSchema,\n  type UpdateWorkflowDefinitionApiInput,\n} from '../../../data/validators'\nimport { serializeWorkflowDefinition, serializeCodeWorkflowDefinition } from '../serialize'\nimport {\n  workflowDefinitionDetailResponseSchema,\n  workflowDefinitionMutationResponseSchema,\n  workflowDefinitionDeleteResponseSchema,\n  workflowErrorSchema,\n} from '../../openapi'\nimport { invalidateTriggerCache } from '../../../lib/event-trigger-service'\nimport { normalizeDefinitionValidationIssues } from '../../../lib/definition-error-body'\nimport { getCodeWorkflow, getAllCodeWorkflows } from '../../../lib/code-registry'\nimport { codeWorkflowUuid } from '../../../lib/find-definition'\nimport {\n  ACTIVE_WORKFLOW_INSTANCE_STATUSES,\n  buildStructuralEditConflictBody,\n  diffDefinitionStructure,\n} from '../../../lib/definition-edit-safety'\nimport {\n  authorizeWorkflowGrantChange,\n  normalizeGrantedFeatures,\n  syncWorkflowDefinitionPrincipal,\n} from '../../../lib/definition-grant'\nimport { createGenericOptimisticLockReader } from '@open-mercato/shared/lib/crud/optimistic-lock'\nimport { registerOptimisticLockReaderIfAbsent } from '@open-mercato/shared/lib/crud/optimistic-lock-store'\nimport { validateCrudMutationGuard, runCrudMutationGuardAfterSuccess } from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('workflows')\n\nregisterOptimisticLockReaderIfAbsent({\n  'workflows.definition': createGenericOptimisticLockReader({\n    entity: WorkflowDefinition,\n    idField: 'id',\n    tenantField: 'tenantId',\n    orgField: 'organizationId',\n    softDeleteField: 'deletedAt',\n  }),\n})\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.view'],\n}\n\ninterface RouteContext {\n  params: Promise<{\n    id: string\n  }>\n}\n\n/**\n * GET /api/workflows/definitions/[id]\n *\n * Get a single workflow definition by ID\n */\nexport async function GET(\n  request: NextRequest,\n  context: RouteContext\n) {\n  try {\n    const params = await context.params\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const orgFilter = resolveOrganizationScopeFilter(scope, auth)\n\n    // Handle code-based workflow definitions (code:<workflowId>)\n    if (params.id.startsWith('code:')) {\n      const workflowId = params.id.slice(5)\n      const codeDef = getCodeWorkflow(workflowId)\n      if (!codeDef) {\n        return NextResponse.json(\n          { error: 'Workflow definition not found' },\n          { status: 404 }\n        )\n      }\n      return NextResponse.json({\n        data: serializeCodeWorkflowDefinition(codeDef, params.id),\n      })\n    }\n\n    const definition = await em.findOne(WorkflowDefinition, {\n      id: params.id,\n      tenantId,\n      ...orgFilter.where,\n      deletedAt: null,\n    })\n\n    if (!definition) {\n      // Instances started from an unpersisted code definition store the\n      // deterministic codeWorkflowUuid(workflowId) as their definitionId\n      // (see lib/find-definition.ts). Resolve that synthetic UUID back to\n      // the code registry so lookups by instance.definitionId succeed.\n      const codeDef = getAllCodeWorkflows().find(\n        (workflow) => codeWorkflowUuid(workflow.workflowId) === params.id\n      )\n      if (codeDef) {\n        return NextResponse.json({\n          data: serializeCodeWorkflowDefinition(codeDef, `code:${codeDef.workflowId}`),\n        })\n      }\n      return NextResponse.json(\n        { error: 'Workflow definition not found' },\n        { status: 404 }\n      )\n    }\n\n    return NextResponse.json({ data: serializeWorkflowDefinition(definition) })\n  } catch (error) {\n    logger.error('Error getting workflow definition', { err: error })\n    return NextResponse.json(\n      { error: 'Failed to get workflow definition' },\n      { status: 500 }\n    )\n  }\n}\n\n/**\n * PUT /api/workflows/definitions/[id]\n *\n * Update a workflow definition\n */\nexport async function PUT(\n  request: NextRequest,\n  context: RouteContext\n) {\n  try {\n    const params = await context.params\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = scope?.selectedId ?? auth.orgId\n\n    // Check edit permission\n    const rbacService = container.resolve('rbacService')\n    const hasPermission = await rbacService.userHasAllFeatures(\n      auth.sub,\n      ['workflows.definitions.edit'],\n      {\n        tenantId,\n        organizationId,\n      }\n    )\n\n    if (!hasPermission) {\n      return NextResponse.json(\n        { error: 'Insufficient permissions' },\n        { status: 403 }\n      )\n    }\n\n    const body = await request.json()\n\n    // Validate input\n    const validation = updateWorkflowDefinitionInputCheckedSchema.safeParse(body)\n    if (!validation.success) {\n      return NextResponse.json(\n        {\n          error: 'Validation failed',\n          details: normalizeDefinitionValidationIssues(validation.error),\n        },\n        { status: 400 }\n      )\n    }\n\n    const input: UpdateWorkflowDefinitionApiInput = validation.data\n    const guardResult = await validateCrudMutationGuard(container, {\n      tenantId: tenantId ?? '',\n      organizationId: organizationId ?? null,\n      userId: auth.sub ?? '',\n      resourceKind: 'workflows.definition',\n      resourceId: params.id,\n      operation: 'update',\n      requestMethod: 'PUT',\n      requestHeaders: request.headers,\n      mutationPayload: input as Record<string, unknown>,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    // Handle customizing a code-based workflow definition\n    if (params.id.startsWith('code:')) {\n      const workflowId = params.id.slice(5)\n      const codeDef = getCodeWorkflow(workflowId)\n      if (!codeDef) {\n        return NextResponse.json(\n          { error: 'Workflow definition not found' },\n          { status: 404 }\n        )\n      }\n\n      // Check if an override already exists. Pin to the latest version so the\n      // override update targets a deterministic row now that versions coexist.\n      const existingOverride = await em.findOne(WorkflowDefinition, {\n        workflowId: codeDef.workflowId,\n        tenantId,\n      }, { orderBy: { version: 'DESC' } })\n\n      let savedOverride: WorkflowDefinition\n      if (existingOverride) {\n        try {\n          await enforceCommandOptimisticLockWithGuards(container, {\n            resourceKind: 'workflows.definition',\n            resourceId: existingOverride.id,\n            current: existingOverride.updatedAt ?? null,\n            request,\n          })\n        } catch (lockError) {\n          if (isCrudHttpError(lockError)) {\n            return NextResponse.json(lockError.body, { status: lockError.status })\n          }\n          throw lockError\n        }\n        // Revive if soft-deleted, then apply updates\n        existingOverride.deletedAt = null\n        existingOverride.workflowName = codeDef.workflowName\n        existingOverride.description = codeDef.description\n        existingOverride.version = codeDef.version\n        existingOverride.definition = input.definition ?? codeDef.definition\n        existingOverride.metadata = codeDef.metadata ?? null\n        existingOverride.enabled = input.enabled ?? codeDef.enabled\n        existingOverride.codeWorkflowId = codeDef.workflowId\n        existingOverride.updatedBy = auth.sub\n        existingOverride.updatedAt = new Date()\n        await em.flush()\n        savedOverride = existingOverride\n      } else {\n        // Create DB override row from code definition + user changes\n        const override = em.create(WorkflowDefinition, {\n          workflowId: codeDef.workflowId,\n          workflowName: codeDef.workflowName,\n          description: codeDef.description,\n          version: codeDef.version,\n          definition: input.definition ?? codeDef.definition,\n          metadata: codeDef.metadata,\n          enabled: input.enabled ?? codeDef.enabled,\n          codeWorkflowId: codeDef.workflowId,\n          tenantId,\n          organizationId,\n          createdBy: auth.sub,\n          updatedBy: auth.sub,\n          createdAt: new Date(),\n          updatedAt: new Date(),\n        })\n\n        em.persist(override)\n        await em.flush()\n        savedOverride = override\n      }\n\n      try {\n        const eventBus = container.resolve('eventBus') as\n          | { emitEvent(event: string, payload: unknown, options?: unknown): Promise<void> }\n          | undefined\n        if (eventBus && typeof eventBus.emitEvent === 'function') {\n          await eventBus.emitEvent(\n            'workflows.definition.customized',\n            {\n              id: savedOverride.id,\n              workflowId: savedOverride.workflowId,\n              codeWorkflowId: savedOverride.codeWorkflowId ?? null,\n              tenantId: savedOverride.tenantId,\n              organizationId: savedOverride.organizationId,\n              userId: auth.sub ?? null,\n            },\n            { tenantId: savedOverride.tenantId, organizationId: savedOverride.organizationId, persistent: true },\n          )\n        }\n      } catch (eventError) {\n        logger.error('Failed to emit workflows.definition.customized event', { err: eventError })\n      }\n\n      if (guardResult?.shouldRunAfterSuccess) {\n        await runCrudMutationGuardAfterSuccess(container, {\n          tenantId: tenantId ?? '',\n          organizationId: organizationId ?? null,\n          userId: auth.sub ?? '',\n          resourceKind: 'workflows.definition',\n          resourceId: String(savedOverride.id),\n          operation: 'update',\n          requestMethod: 'PUT',\n          requestHeaders: request.headers,\n          metadata: guardResult.metadata,\n        })\n      }\n\n      return NextResponse.json({\n        data: serializeWorkflowDefinition(savedOverride),\n        message: 'Workflow definition customized successfully',\n      })\n    }\n\n    // Find existing definition\n    const definition = await em.findOne(WorkflowDefinition, {\n      id: params.id,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })\n\n    if (!definition) {\n      return NextResponse.json(\n        { error: 'Workflow definition not found' },\n        { status: 404 }\n      )\n    }\n\n    try {\n      await enforceCommandOptimisticLockWithGuards(container, {\n        resourceKind: 'workflows.definition',\n        resourceId: definition.id,\n        current: definition.updatedAt ?? null,\n        request,\n      })\n    } catch (lockError) {\n      if (isCrudHttpError(lockError)) {\n        return NextResponse.json(lockError.body, { status: lockError.status })\n      }\n      throw lockError\n    }\n\n    // Edit-safety rule (spec 4.1). Instances pin this row and the engine\n    // re-reads it on every advance, so a topology rewrite would re-point routes\n    // under a running instance. Structural changes are refused while instances\n    // are still executing; the structured body offers the new-version remedy.\n    // Cosmetic, config and metadata edits stay in-place, and the per-user draft\n    // layer (a separate route) is untouched so work-in-progress stays saveable.\n    if (input.definition !== undefined) {\n      const structuralChanges = diffDefinitionStructure(definition.definition, input.definition)\n      if (structuralChanges.length > 0) {\n        const activeInstanceCount = await em.count(WorkflowInstance, {\n          definitionId: definition.id,\n          status: { $in: [...ACTIVE_WORKFLOW_INSTANCE_STATUSES] },\n          tenantId,\n          organizationId,\n          deletedAt: null,\n        })\n        if (activeInstanceCount > 0) {\n          return NextResponse.json(\n            buildStructuralEditConflictBody({\n              definitionId: definition.id,\n              activeInstanceCount,\n              changes: structuralChanges,\n            }),\n            { status: 409 },\n          )\n        }\n      }\n    }\n\n    // Update fields. workflowId is intentionally ignored \u2014 it identifies the\n    // row and renaming would break references. Version is user-managed and\n    // applied when supplied so the edit form can bump it explicitly.\n    if (input.workflowName !== undefined) {\n      definition.workflowName = input.workflowName\n    }\n    if (input.description !== undefined) {\n      definition.description = input.description\n    }\n    if (input.version !== undefined) {\n      definition.version = input.version\n    }\n    if (input.definition !== undefined) {\n      definition.definition = input.definition\n    }\n    if (input.metadata !== undefined) {\n      definition.metadata = input.metadata\n    }\n    if (input.enabled !== undefined) {\n      definition.enabled = input.enabled\n    }\n    if (input.effectiveFrom !== undefined) {\n      definition.effectiveFrom = input.effectiveFrom\n    }\n    if (input.effectiveTo !== undefined) {\n      definition.effectiveTo = input.effectiveTo\n    }\n\n    // Execution identity. Absent leaves the stored grant untouched; an explicit\n    // value is authorised against the SAVING user's own current features (never\n    // the original author's) and the principal is re-scoped before the row is\n    // flushed, so the column and the role ACL can never disagree.\n    if (input.grantedFeatures !== undefined) {\n      const requestedGrant = normalizeGrantedFeatures(input.grantedFeatures)\n      const previousGrant = normalizeGrantedFeatures(definition.grantedFeatures)\n      const grantFailure = await authorizeWorkflowGrantChange(rbacService, {\n        userId: auth.sub,\n        scope: { tenantId, organizationId },\n        requested: requestedGrant,\n        current: previousGrant,\n      })\n      if (grantFailure) {\n        return NextResponse.json(grantFailure.body, { status: grantFailure.status })\n      }\n      definition.grantedFeatures = requestedGrant.length ? requestedGrant : null\n      // Clearing a grant re-scopes the existing principal to no features rather\n      // than leaving its old ACL behind.\n      await syncWorkflowDefinitionPrincipal(container, definition, { previousFeatures: previousGrant })\n    }\n\n    definition.updatedBy = auth.sub\n    definition.updatedAt = new Date()\n\n    await em.flush()\n\n    if (guardResult?.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId: tenantId ?? '',\n        organizationId: organizationId ?? null,\n        userId: auth.sub ?? '',\n        resourceKind: 'workflows.definition',\n        resourceId: String(definition.id),\n        operation: 'update',\n        requestMethod: 'PUT',\n        requestHeaders: request.headers,\n        metadata: guardResult.metadata,\n      })\n    }\n\n    // Embedded triggers may have changed; invalidate the in-memory cache so\n    // the wildcard event subscriber reloads them on the next event.\n    if (tenantId) invalidateTriggerCache(tenantId, organizationId ?? undefined)\n\n    return NextResponse.json({\n      data: serializeWorkflowDefinition(definition),\n      message: 'Workflow definition updated successfully',\n    })\n  } catch (error) {\n    logger.error('Error updating workflow definition', { err: error })\n    return NextResponse.json(\n      { error: 'Failed to update workflow definition' },\n      { status: 500 }\n    )\n  }\n}\n\n/**\n * DELETE /api/workflows/definitions/[id]\n *\n * Soft delete a workflow definition\n */\nexport async function DELETE(\n  request: NextRequest,\n  context: RouteContext\n) {\n  try {\n    const params = await context.params\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = scope?.selectedId ?? auth.orgId\n\n    // Check delete permission\n    const rbacService = container.resolve('rbacService')\n    const hasPermission = await rbacService.userHasAllFeatures(\n      auth.sub,\n      ['workflows.definitions.delete'],\n      {\n        tenantId,\n        organizationId,\n      }\n    )\n\n    if (!hasPermission) {\n      return NextResponse.json(\n        { error: 'Insufficient permissions' },\n        { status: 403 }\n      )\n    }\n\n    // Find existing definition\n    const definition = await em.findOne(WorkflowDefinition, {\n      id: params.id,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })\n\n    if (!definition) {\n      return NextResponse.json(\n        { error: 'Workflow definition not found' },\n        { status: 404 }\n      )\n    }\n\n    const guardResult = await validateCrudMutationGuard(container, {\n      tenantId: tenantId ?? '',\n      organizationId: organizationId ?? null,\n      userId: auth.sub ?? '',\n      resourceKind: 'workflows.definition',\n      resourceId: params.id,\n      operation: 'delete',\n      requestMethod: 'DELETE',\n      requestHeaders: request.headers,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    // Check if there are active workflow instances using this definition\n    const { WorkflowInstance } = await import('../../../data/entities')\n    const activeInstances = await em.count(WorkflowInstance, {\n      definitionId: definition.id,\n      status: { $in: ['RUNNING', 'WAITING'] },\n    })\n\n    if (activeInstances > 0) {\n      return NextResponse.json(\n        {\n          error: `Cannot delete workflow definition with ${activeInstances} active instance(s)`,\n        },\n        { status: 409 }\n      )\n    }\n\n    // Soft delete\n    definition.deletedAt = new Date()\n    definition.updatedAt = new Date()\n\n    await em.flush()\n\n    if (guardResult?.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId: tenantId ?? '',\n        organizationId: organizationId ?? null,\n        userId: auth.sub ?? '',\n        resourceKind: 'workflows.definition',\n        resourceId: String(definition.id),\n        operation: 'delete',\n        requestMethod: 'DELETE',\n        requestHeaders: request.headers,\n        metadata: guardResult.metadata,\n      })\n    }\n\n    if (tenantId) invalidateTriggerCache(tenantId, organizationId ?? undefined)\n\n    return NextResponse.json({\n      message: 'Workflow definition deleted successfully',\n    })\n  } catch (error) {\n    logger.error('Error deleting workflow definition', { err: error })\n    return NextResponse.json(\n      { error: 'Failed to delete workflow definition' },\n      { status: 500 }\n    )\n  }\n}\n\nexport const openApi = {\n  methods: {\n    GET: {\n      summary: 'Get workflow definition',\n      description: 'Get a single workflow definition by ID. Returns the complete workflow structure including steps and transitions (with embedded activities).',\n      tags: ['Workflows'],\n      pathParams: z.object({\n        id: z.string().describe('UUID for DB definitions, or \"code:<workflowId>\" for code-based definitions'),\n      }),\n      responses: [\n        {\n          status: 200,\n          description: 'Workflow definition found',\n          schema: workflowDefinitionDetailResponseSchema,\n          example: {\n            data: {\n              id: '123e4567-e89b-12d3-a456-426614174000',\n              workflowId: 'checkout-flow',\n              workflowName: 'Checkout Flow',\n              description: 'Complete checkout workflow for processing orders',\n              version: 1,\n              definition: {\n                steps: [\n                  {\n                    stepId: 'start',\n                    stepName: 'Start',\n                    stepType: 'START',\n                  },\n                  {\n                    stepId: 'validate-cart',\n                    stepName: 'Validate Cart',\n                    stepType: 'AUTOMATED',\n                    description: 'Validate cart items and check inventory',\n                  },\n                  {\n                    stepId: 'payment',\n                    stepName: 'Process Payment',\n                    stepType: 'AUTOMATED',\n                    description: 'Charge payment method',\n                    retryPolicy: {\n                      maxAttempts: 3,\n                      backoffMs: 1000,\n                    },\n                  },\n                  {\n                    stepId: 'end',\n                    stepName: 'End',\n                    stepType: 'END',\n                  },\n                ],\n                transitions: [\n                  {\n                    transitionId: 'start-to-validate',\n                    fromStepId: 'start',\n                    toStepId: 'validate-cart',\n                    trigger: 'auto',\n                  },\n                  {\n                    transitionId: 'validate-to-payment',\n                    fromStepId: 'validate-cart',\n                    toStepId: 'payment',\n                    trigger: 'auto',\n                  },\n                  {\n                    transitionId: 'payment-to-end',\n                    fromStepId: 'payment',\n                    toStepId: 'end',\n                    trigger: 'auto',\n                    activities: [\n                      {\n                        activityName: 'Send Order Confirmation',\n                        activityType: 'SEND_EMAIL',\n                        config: {\n                          to: '{{context.customerEmail}}',\n                          subject: 'Order Confirmation #{{context.orderId}}',\n                          template: 'order_confirmation',\n                        },\n                      },\n                    ],\n                  },\n                ],\n              },\n              enabled: true,\n              tenantId: '123e4567-e89b-12d3-a456-426614174001',\n              organizationId: '123e4567-e89b-12d3-a456-426614174002',\n              createdAt: '2025-12-08T10:00:00.000Z',\n              updatedAt: '2025-12-08T10:00:00.000Z',\n            },\n          },\n        },\n        {\n          status: 404,\n          description: 'Workflow definition not found',\n          schema: workflowErrorSchema,\n          example: {\n            error: 'Workflow definition not found',\n          },\n        },\n      ],\n    },\n    PUT: {\n      summary: 'Update workflow definition',\n      description: 'Update an existing workflow definition. Supports partial updates - only provided fields will be updated.',\n      tags: ['Workflows'],\n      pathParams: z.object({\n        id: z.string().uuid(),\n      }),\n      requestBody: {\n        schema: updateWorkflowDefinitionInputSchema,\n        example: {\n          definition: {\n            steps: [\n              {\n                stepId: 'start',\n                stepName: 'Start',\n                stepType: 'START',\n              },\n              {\n                stepId: 'validate-cart',\n                stepName: 'Validate Cart',\n                stepType: 'AUTOMATED',\n              },\n              {\n                stepId: 'payment',\n                stepName: 'Process Payment',\n                stepType: 'AUTOMATED',\n              },\n              {\n                stepId: 'confirmation',\n                stepName: 'Order Confirmation',\n                stepType: 'AUTOMATED',\n              },\n              {\n                stepId: 'end',\n                stepName: 'End',\n                stepType: 'END',\n              },\n            ],\n            transitions: [\n              {\n                transitionId: 'start-to-validate',\n                fromStepId: 'start',\n                toStepId: 'validate-cart',\n                trigger: 'auto',\n              },\n              {\n                transitionId: 'validate-to-payment',\n                fromStepId: 'validate-cart',\n                toStepId: 'payment',\n                trigger: 'auto',\n              },\n              {\n                transitionId: 'payment-to-confirmation',\n                fromStepId: 'payment',\n                toStepId: 'confirmation',\n                trigger: 'auto',\n              },\n              {\n                transitionId: 'confirmation-to-end',\n                fromStepId: 'confirmation',\n                toStepId: 'end',\n                trigger: 'auto',\n              },\n            ],\n          },\n          enabled: true,\n        },\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Workflow definition updated successfully',\n          schema: workflowDefinitionMutationResponseSchema,\n          example: {\n            data: {\n              id: '123e4567-e89b-12d3-a456-426614174000',\n              workflowId: 'checkout-flow',\n              workflowName: 'Checkout Flow',\n              description: 'Complete checkout workflow for processing orders',\n              version: 1,\n              definition: {\n                steps: [\n                  { stepId: 'start', stepName: 'Start', stepType: 'START' },\n                  {\n                    stepId: 'validate-cart',\n                    stepName: 'Validate Cart',\n                    stepType: 'AUTOMATED',\n                  },\n                  {\n                    stepId: 'payment',\n                    stepName: 'Process Payment',\n                    stepType: 'AUTOMATED',\n                  },\n                  {\n                    stepId: 'confirmation',\n                    stepName: 'Order Confirmation',\n                    stepType: 'AUTOMATED',\n                  },\n                  { stepId: 'end', stepName: 'End', stepType: 'END' },\n                ],\n                transitions: [\n                  {\n                    transitionId: 'start-to-validate',\n                    fromStepId: 'start',\n                    toStepId: 'validate-cart',\n                    trigger: 'auto',\n                  },\n                  {\n                    transitionId: 'validate-to-payment',\n                    fromStepId: 'validate-cart',\n                    toStepId: 'payment',\n                    trigger: 'auto',\n                  },\n                  {\n                    transitionId: 'payment-to-confirmation',\n                    fromStepId: 'payment',\n                    toStepId: 'confirmation',\n                    trigger: 'auto',\n                  },\n                  {\n                    transitionId: 'confirmation-to-end',\n                    fromStepId: 'confirmation',\n                    toStepId: 'end',\n                    trigger: 'auto',\n                  },\n                ],\n              },\n              enabled: true,\n              tenantId: '123e4567-e89b-12d3-a456-426614174001',\n              organizationId: '123e4567-e89b-12d3-a456-426614174002',\n              createdAt: '2025-12-08T10:00:00.000Z',\n              updatedAt: '2025-12-08T11:30:00.000Z',\n            },\n            message: 'Workflow definition updated successfully',\n          },\n        },\n        {\n          status: 400,\n          description: 'Validation error',\n          schema: workflowErrorSchema,\n          example: {\n            error: 'Validation failed',\n            details: [\n              {\n                path: ['definition'],\n                code: 'invalid_type',\n                message: 'Invalid input: expected object, received string',\n                expected: 'object',\n                got: 'string',\n              },\n            ],\n          },\n        },\n        {\n          status: 404,\n          description: 'Workflow definition not found',\n          schema: workflowErrorSchema,\n          example: {\n            error: 'Workflow definition not found',\n          },\n        },\n        {\n          status: 409,\n          description:\n            'Structural change refused while instances are still running (or optimistic-lock conflict). Publish a new version and apply the change there.',\n          schema: workflowErrorSchema,\n          example: {\n            error: 'Structural changes require a new version while instances are still running',\n            code: 'WORKFLOW_STRUCTURAL_EDIT_REQUIRES_NEW_VERSION',\n            definitionId: '123e4567-e89b-12d3-a456-426614174000',\n            activeInstanceCount: 3,\n            activeStatuses: ['RUNNING', 'PAUSED', 'WAITING_FOR_ACTIVITIES', 'FORKED', 'COMPENSATING'],\n            changes: [{ kind: 'transitionRetargeted', id: 't_lz3k9_ab12cd34e' }],\n            remedy: {\n              action: 'createVersion',\n              method: 'POST',\n              endpoint: '/api/workflows/definitions/123e4567-e89b-12d3-a456-426614174000/publish',\n            },\n          },\n        },\n      ],\n    },\n    DELETE: {\n      summary: 'Delete workflow definition',\n      description: 'Soft delete a workflow definition. Cannot be deleted if there are active workflow instances (RUNNING or WAITING status) using this definition.',\n      tags: ['Workflows'],\n      pathParams: z.object({\n        id: z.string().uuid(),\n      }),\n      responses: [\n        {\n          status: 200,\n          description: 'Workflow definition deleted successfully',\n          schema: workflowDefinitionDeleteResponseSchema,\n          example: {\n            message: 'Workflow definition deleted successfully',\n          },\n        },\n        {\n          status: 404,\n          description: 'Workflow definition not found',\n          schema: workflowErrorSchema,\n          example: {\n            error: 'Workflow definition not found',\n          },\n        },\n        {\n          status: 409,\n          description: 'Cannot delete - active workflow instances exist',\n          schema: workflowErrorSchema,\n          example: {\n            error: 'Cannot delete workflow definition with 3 active instance(s)',\n          },\n        },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AASA,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,sCAAsC;AAC/C,SAAS,oBAAoB,wBAAwB;AACrD;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP,SAAS,6BAA6B,uCAAuC;AAC7E;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,8BAA8B;AACvC,SAAS,2CAA2C;AACpD,SAAS,iBAAiB,2BAA2B;AACrD,SAAS,wBAAwB;AACjC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,yCAAyC;AAClD,SAAS,4CAA4C;AACrD,SAAS,2BAA2B,wCAAwC;AAC5E,SAAS,8CAA8C;AACvD,SAAS,uBAAuB;AAChC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEvC,qCAAqC;AAAA,EACnC,wBAAwB,kCAAkC;AAAA,IACxD,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,aAAa;AAAA,IACb,UAAU;AAAA,IACV,iBAAiB;AAAA,EACnB,CAAC;AACH,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,4BAA4B;AAChD;AAaA,eAAsB,IACpB,SACA,SACA;AACA,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ;AAC7B,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,YAAY,+BAA+B,OAAO,IAAI;AAG5D,QAAI,OAAO,GAAG,WAAW,OAAO,GAAG;AACjC,YAAM,aAAa,OAAO,GAAG,MAAM,CAAC;AACpC,YAAM,UAAU,gBAAgB,UAAU;AAC1C,UAAI,CAAC,SAAS;AACZ,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,gCAAgC;AAAA,UACzC,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,aAAO,aAAa,KAAK;AAAA,QACvB,MAAM,gCAAgC,SAAS,OAAO,EAAE;AAAA,MAC1D,CAAC;AAAA,IACH;AAEA,UAAM,aAAa,MAAM,GAAG,QAAQ,oBAAoB;AAAA,MACtD,IAAI,OAAO;AAAA,MACX;AAAA,MACA,GAAG,UAAU;AAAA,MACb,WAAW;AAAA,IACb,CAAC;AAED,QAAI,CAAC,YAAY;AAKf,YAAM,UAAU,oBAAoB,EAAE;AAAA,QACpC,CAAC,aAAa,iBAAiB,SAAS,UAAU,MAAM,OAAO;AAAA,MACjE;AACA,UAAI,SAAS;AACX,eAAO,aAAa,KAAK;AAAA,UACvB,MAAM,gCAAgC,SAAS,QAAQ,QAAQ,UAAU,EAAE;AAAA,QAC7E,CAAC;AAAA,MACH;AACA,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,gCAAgC;AAAA,QACzC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,WAAO,aAAa,KAAK,EAAE,MAAM,4BAA4B,UAAU,EAAE,CAAC;AAAA,EAC5E,SAAS,OAAO;AACd,WAAO,MAAM,qCAAqC,EAAE,KAAK,MAAM,CAAC;AAChE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,oCAAoC;AAAA,MAC7C,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAOA,eAAsB,IACpB,SACA,SACA;AACA,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ;AAC7B,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,cAAc,KAAK;AAGjD,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,UAAM,gBAAgB,MAAM,YAAY;AAAA,MACtC,KAAK;AAAA,MACL,CAAC,4BAA4B;AAAA,MAC7B;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,2BAA2B;AAAA,QACpC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,OAAO,MAAM,QAAQ,KAAK;AAGhC,UAAM,aAAa,2CAA2C,UAAU,IAAI;AAC5E,QAAI,CAAC,WAAW,SAAS;AACvB,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO;AAAA,UACP,SAAS,oCAAoC,WAAW,KAAK;AAAA,QAC/D;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,QAA0C,WAAW;AAC3D,UAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,MAC7D,UAAU,YAAY;AAAA,MACtB,gBAAgB,kBAAkB;AAAA,MAClC,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,WAAW;AAAA,MACX,eAAe;AAAA,MACf,gBAAgB,QAAQ;AAAA,MACxB,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAGA,QAAI,OAAO,GAAG,WAAW,OAAO,GAAG;AACjC,YAAM,aAAa,OAAO,GAAG,MAAM,CAAC;AACpC,YAAM,UAAU,gBAAgB,UAAU;AAC1C,UAAI,CAAC,SAAS;AACZ,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,gCAAgC;AAAA,UACzC,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAIA,YAAM,mBAAmB,MAAM,GAAG,QAAQ,oBAAoB;AAAA,QAC5D,YAAY,QAAQ;AAAA,QACpB;AAAA,MACF,GAAG,EAAE,SAAS,EAAE,SAAS,OAAO,EAAE,CAAC;AAEnC,UAAI;AACJ,UAAI,kBAAkB;AACpB,YAAI;AACF,gBAAM,uCAAuC,WAAW;AAAA,YACtD,cAAc;AAAA,YACd,YAAY,iBAAiB;AAAA,YAC7B,SAAS,iBAAiB,aAAa;AAAA,YACvC;AAAA,UACF,CAAC;AAAA,QACH,SAAS,WAAW;AAClB,cAAI,gBAAgB,SAAS,GAAG;AAC9B,mBAAO,aAAa,KAAK,UAAU,MAAM,EAAE,QAAQ,UAAU,OAAO,CAAC;AAAA,UACvE;AACA,gBAAM;AAAA,QACR;AAEA,yBAAiB,YAAY;AAC7B,yBAAiB,eAAe,QAAQ;AACxC,yBAAiB,cAAc,QAAQ;AACvC,yBAAiB,UAAU,QAAQ;AACnC,yBAAiB,aAAa,MAAM,cAAc,QAAQ;AAC1D,yBAAiB,WAAW,QAAQ,YAAY;AAChD,yBAAiB,UAAU,MAAM,WAAW,QAAQ;AACpD,yBAAiB,iBAAiB,QAAQ;AAC1C,yBAAiB,YAAY,KAAK;AAClC,yBAAiB,YAAY,oBAAI,KAAK;AACtC,cAAM,GAAG,MAAM;AACf,wBAAgB;AAAA,MAClB,OAAO;AAEL,cAAM,WAAW,GAAG,OAAO,oBAAoB;AAAA,UAC7C,YAAY,QAAQ;AAAA,UACpB,cAAc,QAAQ;AAAA,UACtB,aAAa,QAAQ;AAAA,UACrB,SAAS,QAAQ;AAAA,UACjB,YAAY,MAAM,cAAc,QAAQ;AAAA,UACxC,UAAU,QAAQ;AAAA,UAClB,SAAS,MAAM,WAAW,QAAQ;AAAA,UAClC,gBAAgB,QAAQ;AAAA,UACxB;AAAA,UACA;AAAA,UACA,WAAW,KAAK;AAAA,UAChB,WAAW,KAAK;AAAA,UAChB,WAAW,oBAAI,KAAK;AAAA,UACpB,WAAW,oBAAI,KAAK;AAAA,QACtB,CAAC;AAED,WAAG,QAAQ,QAAQ;AACnB,cAAM,GAAG,MAAM;AACf,wBAAgB;AAAA,MAClB;AAEA,UAAI;AACF,cAAM,WAAW,UAAU,QAAQ,UAAU;AAG7C,YAAI,YAAY,OAAO,SAAS,cAAc,YAAY;AACxD,gBAAM,SAAS;AAAA,YACb;AAAA,YACA;AAAA,cACE,IAAI,cAAc;AAAA,cAClB,YAAY,cAAc;AAAA,cAC1B,gBAAgB,cAAc,kBAAkB;AAAA,cAChD,UAAU,cAAc;AAAA,cACxB,gBAAgB,cAAc;AAAA,cAC9B,QAAQ,KAAK,OAAO;AAAA,YACtB;AAAA,YACA,EAAE,UAAU,cAAc,UAAU,gBAAgB,cAAc,gBAAgB,YAAY,KAAK;AAAA,UACrG;AAAA,QACF;AAAA,MACF,SAAS,YAAY;AACnB,eAAO,MAAM,wDAAwD,EAAE,KAAK,WAAW,CAAC;AAAA,MAC1F;AAEA,UAAI,aAAa,uBAAuB;AACtC,cAAM,iCAAiC,WAAW;AAAA,UAChD,UAAU,YAAY;AAAA,UACtB,gBAAgB,kBAAkB;AAAA,UAClC,QAAQ,KAAK,OAAO;AAAA,UACpB,cAAc;AAAA,UACd,YAAY,OAAO,cAAc,EAAE;AAAA,UACnC,WAAW;AAAA,UACX,eAAe;AAAA,UACf,gBAAgB,QAAQ;AAAA,UACxB,UAAU,YAAY;AAAA,QACxB,CAAC;AAAA,MACH;AAEA,aAAO,aAAa,KAAK;AAAA,QACvB,MAAM,4BAA4B,aAAa;AAAA,QAC/C,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAGA,UAAM,aAAa,MAAM,GAAG,QAAQ,oBAAoB;AAAA,MACtD,IAAI,OAAO;AAAA,MACX;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AAED,QAAI,CAAC,YAAY;AACf,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,gCAAgC;AAAA,QACzC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,QAAI;AACF,YAAM,uCAAuC,WAAW;AAAA,QACtD,cAAc;AAAA,QACd,YAAY,WAAW;AAAA,QACvB,SAAS,WAAW,aAAa;AAAA,QACjC;AAAA,MACF,CAAC;AAAA,IACH,SAAS,WAAW;AAClB,UAAI,gBAAgB,SAAS,GAAG;AAC9B,eAAO,aAAa,KAAK,UAAU,MAAM,EAAE,QAAQ,UAAU,OAAO,CAAC;AAAA,MACvE;AACA,YAAM;AAAA,IACR;AAQA,QAAI,MAAM,eAAe,QAAW;AAClC,YAAM,oBAAoB,wBAAwB,WAAW,YAAY,MAAM,UAAU;AACzF,UAAI,kBAAkB,SAAS,GAAG;AAChC,cAAM,sBAAsB,MAAM,GAAG,MAAM,kBAAkB;AAAA,UAC3D,cAAc,WAAW;AAAA,UACzB,QAAQ,EAAE,KAAK,CAAC,GAAG,iCAAiC,EAAE;AAAA,UACtD;AAAA,UACA;AAAA,UACA,WAAW;AAAA,QACb,CAAC;AACD,YAAI,sBAAsB,GAAG;AAC3B,iBAAO,aAAa;AAAA,YAClB,gCAAgC;AAAA,cAC9B,cAAc,WAAW;AAAA,cACzB;AAAA,cACA,SAAS;AAAA,YACX,CAAC;AAAA,YACD,EAAE,QAAQ,IAAI;AAAA,UAChB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAKA,QAAI,MAAM,iBAAiB,QAAW;AACpC,iBAAW,eAAe,MAAM;AAAA,IAClC;AACA,QAAI,MAAM,gBAAgB,QAAW;AACnC,iBAAW,cAAc,MAAM;AAAA,IACjC;AACA,QAAI,MAAM,YAAY,QAAW;AAC/B,iBAAW,UAAU,MAAM;AAAA,IAC7B;AACA,QAAI,MAAM,eAAe,QAAW;AAClC,iBAAW,aAAa,MAAM;AAAA,IAChC;AACA,QAAI,MAAM,aAAa,QAAW;AAChC,iBAAW,WAAW,MAAM;AAAA,IAC9B;AACA,QAAI,MAAM,YAAY,QAAW;AAC/B,iBAAW,UAAU,MAAM;AAAA,IAC7B;AACA,QAAI,MAAM,kBAAkB,QAAW;AACrC,iBAAW,gBAAgB,MAAM;AAAA,IACnC;AACA,QAAI,MAAM,gBAAgB,QAAW;AACnC,iBAAW,cAAc,MAAM;AAAA,IACjC;AAMA,QAAI,MAAM,oBAAoB,QAAW;AACvC,YAAM,iBAAiB,yBAAyB,MAAM,eAAe;AACrE,YAAM,gBAAgB,yBAAyB,WAAW,eAAe;AACzE,YAAM,eAAe,MAAM,6BAA6B,aAAa;AAAA,QACnE,QAAQ,KAAK;AAAA,QACb,OAAO,EAAE,UAAU,eAAe;AAAA,QAClC,WAAW;AAAA,QACX,SAAS;AAAA,MACX,CAAC;AACD,UAAI,cAAc;AAChB,eAAO,aAAa,KAAK,aAAa,MAAM,EAAE,QAAQ,aAAa,OAAO,CAAC;AAAA,MAC7E;AACA,iBAAW,kBAAkB,eAAe,SAAS,iBAAiB;AAGtE,YAAM,gCAAgC,WAAW,YAAY,EAAE,kBAAkB,cAAc,CAAC;AAAA,IAClG;AAEA,eAAW,YAAY,KAAK;AAC5B,eAAW,YAAY,oBAAI,KAAK;AAEhC,UAAM,GAAG,MAAM;AAEf,QAAI,aAAa,uBAAuB;AACtC,YAAM,iCAAiC,WAAW;AAAA,QAChD,UAAU,YAAY;AAAA,QACtB,gBAAgB,kBAAkB;AAAA,QAClC,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc;AAAA,QACd,YAAY,OAAO,WAAW,EAAE;AAAA,QAChC,WAAW;AAAA,QACX,eAAe;AAAA,QACf,gBAAgB,QAAQ;AAAA,QACxB,UAAU,YAAY;AAAA,MACxB,CAAC;AAAA,IACH;AAIA,QAAI,SAAU,wBAAuB,UAAU,kBAAkB,MAAS;AAE1E,WAAO,aAAa,KAAK;AAAA,MACvB,MAAM,4BAA4B,UAAU;AAAA,MAC5C,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,sCAAsC,EAAE,KAAK,MAAM,CAAC;AACjE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,uCAAuC;AAAA,MAChD,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAOA,eAAsB,OACpB,SACA,SACA;AACA,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ;AAC7B,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,cAAc,KAAK;AAGjD,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,UAAM,gBAAgB,MAAM,YAAY;AAAA,MACtC,KAAK;AAAA,MACL,CAAC,8BAA8B;AAAA,MAC/B;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,2BAA2B;AAAA,QACpC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAGA,UAAM,aAAa,MAAM,GAAG,QAAQ,oBAAoB;AAAA,MACtD,IAAI,OAAO;AAAA,MACX;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AAED,QAAI,CAAC,YAAY;AACf,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,gCAAgC;AAAA,QACzC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,MAC7D,UAAU,YAAY;AAAA,MACtB,gBAAgB,kBAAkB;AAAA,MAClC,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,WAAW;AAAA,MACX,eAAe;AAAA,MACf,gBAAgB,QAAQ;AAAA,IAC1B,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAGA,UAAM,EAAE,kBAAAA,kBAAiB,IAAI,MAAM,OAAO,wBAAwB;AAClE,UAAM,kBAAkB,MAAM,GAAG,MAAMA,mBAAkB;AAAA,MACvD,cAAc,WAAW;AAAA,MACzB,QAAQ,EAAE,KAAK,CAAC,WAAW,SAAS,EAAE;AAAA,IACxC,CAAC;AAED,QAAI,kBAAkB,GAAG;AACvB,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO,0CAA0C,eAAe;AAAA,QAClE;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAGA,eAAW,YAAY,oBAAI,KAAK;AAChC,eAAW,YAAY,oBAAI,KAAK;AAEhC,UAAM,GAAG,MAAM;AAEf,QAAI,aAAa,uBAAuB;AACtC,YAAM,iCAAiC,WAAW;AAAA,QAChD,UAAU,YAAY;AAAA,QACtB,gBAAgB,kBAAkB;AAAA,QAClC,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc;AAAA,QACd,YAAY,OAAO,WAAW,EAAE;AAAA,QAChC,WAAW;AAAA,QACX,eAAe;AAAA,QACf,gBAAgB,QAAQ;AAAA,QACxB,UAAU,YAAY;AAAA,MACxB,CAAC;AAAA,IACH;AAEA,QAAI,SAAU,wBAAuB,UAAU,kBAAkB,MAAS;AAE1E,WAAO,aAAa,KAAK;AAAA,MACvB,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,sCAAsC,EAAE,KAAK,MAAM,CAAC;AACjE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,uCAAuC;AAAA,MAChD,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,MAAM,CAAC,WAAW;AAAA,MAClB,YAAY,EAAE,OAAO;AAAA,QACnB,IAAI,EAAE,OAAO,EAAE,SAAS,4EAA4E;AAAA,MACtG,CAAC;AAAA,MACD,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,MAAM;AAAA,cACJ,IAAI;AAAA,cACJ,YAAY;AAAA,cACZ,cAAc;AAAA,cACd,aAAa;AAAA,cACb,SAAS;AAAA,cACT,YAAY;AAAA,gBACV,OAAO;AAAA,kBACL;AAAA,oBACE,QAAQ;AAAA,oBACR,UAAU;AAAA,oBACV,UAAU;AAAA,kBACZ;AAAA,kBACA;AAAA,oBACE,QAAQ;AAAA,oBACR,UAAU;AAAA,oBACV,UAAU;AAAA,oBACV,aAAa;AAAA,kBACf;AAAA,kBACA;AAAA,oBACE,QAAQ;AAAA,oBACR,UAAU;AAAA,oBACV,UAAU;AAAA,oBACV,aAAa;AAAA,oBACb,aAAa;AAAA,sBACX,aAAa;AAAA,sBACb,WAAW;AAAA,oBACb;AAAA,kBACF;AAAA,kBACA;AAAA,oBACE,QAAQ;AAAA,oBACR,UAAU;AAAA,oBACV,UAAU;AAAA,kBACZ;AAAA,gBACF;AAAA,gBACA,aAAa;AAAA,kBACX;AAAA,oBACE,cAAc;AAAA,oBACd,YAAY;AAAA,oBACZ,UAAU;AAAA,oBACV,SAAS;AAAA,kBACX;AAAA,kBACA;AAAA,oBACE,cAAc;AAAA,oBACd,YAAY;AAAA,oBACZ,UAAU;AAAA,oBACV,SAAS;AAAA,kBACX;AAAA,kBACA;AAAA,oBACE,cAAc;AAAA,oBACd,YAAY;AAAA,oBACZ,UAAU;AAAA,oBACV,SAAS;AAAA,oBACT,YAAY;AAAA,sBACV;AAAA,wBACE,cAAc;AAAA,wBACd,cAAc;AAAA,wBACd,QAAQ;AAAA,0BACN,IAAI;AAAA,0BACJ,SAAS;AAAA,0BACT,UAAU;AAAA,wBACZ;AAAA,sBACF;AAAA,oBACF;AAAA,kBACF;AAAA,gBACF;AAAA,cACF;AAAA,cACA,SAAS;AAAA,cACT,UAAU;AAAA,cACV,gBAAgB;AAAA,cAChB,WAAW;AAAA,cACX,WAAW;AAAA,YACb;AAAA,UACF;AAAA,QACF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,OAAO;AAAA,UACT;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,MAAM,CAAC,WAAW;AAAA,MAClB,YAAY,EAAE,OAAO;AAAA,QACnB,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,MACtB,CAAC;AAAA,MACD,aAAa;AAAA,QACX,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,YAAY;AAAA,YACV,OAAO;AAAA,cACL;AAAA,gBACE,QAAQ;AAAA,gBACR,UAAU;AAAA,gBACV,UAAU;AAAA,cACZ;AAAA,cACA;AAAA,gBACE,QAAQ;AAAA,gBACR,UAAU;AAAA,gBACV,UAAU;AAAA,cACZ;AAAA,cACA;AAAA,gBACE,QAAQ;AAAA,gBACR,UAAU;AAAA,gBACV,UAAU;AAAA,cACZ;AAAA,cACA;AAAA,gBACE,QAAQ;AAAA,gBACR,UAAU;AAAA,gBACV,UAAU;AAAA,cACZ;AAAA,cACA;AAAA,gBACE,QAAQ;AAAA,gBACR,UAAU;AAAA,gBACV,UAAU;AAAA,cACZ;AAAA,YACF;AAAA,YACA,aAAa;AAAA,cACX;AAAA,gBACE,cAAc;AAAA,gBACd,YAAY;AAAA,gBACZ,UAAU;AAAA,gBACV,SAAS;AAAA,cACX;AAAA,cACA;AAAA,gBACE,cAAc;AAAA,gBACd,YAAY;AAAA,gBACZ,UAAU;AAAA,gBACV,SAAS;AAAA,cACX;AAAA,cACA;AAAA,gBACE,cAAc;AAAA,gBACd,YAAY;AAAA,gBACZ,UAAU;AAAA,gBACV,SAAS;AAAA,cACX;AAAA,cACA;AAAA,gBACE,cAAc;AAAA,gBACd,YAAY;AAAA,gBACZ,UAAU;AAAA,gBACV,SAAS;AAAA,cACX;AAAA,YACF;AAAA,UACF;AAAA,UACA,SAAS;AAAA,QACX;AAAA,MACF;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,MAAM;AAAA,cACJ,IAAI;AAAA,cACJ,YAAY;AAAA,cACZ,cAAc;AAAA,cACd,aAAa;AAAA,cACb,SAAS;AAAA,cACT,YAAY;AAAA,gBACV,OAAO;AAAA,kBACL,EAAE,QAAQ,SAAS,UAAU,SAAS,UAAU,QAAQ;AAAA,kBACxD;AAAA,oBACE,QAAQ;AAAA,oBACR,UAAU;AAAA,oBACV,UAAU;AAAA,kBACZ;AAAA,kBACA;AAAA,oBACE,QAAQ;AAAA,oBACR,UAAU;AAAA,oBACV,UAAU;AAAA,kBACZ;AAAA,kBACA;AAAA,oBACE,QAAQ;AAAA,oBACR,UAAU;AAAA,oBACV,UAAU;AAAA,kBACZ;AAAA,kBACA,EAAE,QAAQ,OAAO,UAAU,OAAO,UAAU,MAAM;AAAA,gBACpD;AAAA,gBACA,aAAa;AAAA,kBACX;AAAA,oBACE,cAAc;AAAA,oBACd,YAAY;AAAA,oBACZ,UAAU;AAAA,oBACV,SAAS;AAAA,kBACX;AAAA,kBACA;AAAA,oBACE,cAAc;AAAA,oBACd,YAAY;AAAA,oBACZ,UAAU;AAAA,oBACV,SAAS;AAAA,kBACX;AAAA,kBACA;AAAA,oBACE,cAAc;AAAA,oBACd,YAAY;AAAA,oBACZ,UAAU;AAAA,oBACV,SAAS;AAAA,kBACX;AAAA,kBACA;AAAA,oBACE,cAAc;AAAA,oBACd,YAAY;AAAA,oBACZ,UAAU;AAAA,oBACV,SAAS;AAAA,kBACX;AAAA,gBACF;AAAA,cACF;AAAA,cACA,SAAS;AAAA,cACT,UAAU;AAAA,cACV,gBAAgB;AAAA,cAChB,WAAW;AAAA,cACX,WAAW;AAAA,YACb;AAAA,YACA,SAAS;AAAA,UACX;AAAA,QACF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,OAAO;AAAA,YACP,SAAS;AAAA,cACP;AAAA,gBACE,MAAM,CAAC,YAAY;AAAA,gBACnB,MAAM;AAAA,gBACN,SAAS;AAAA,gBACT,UAAU;AAAA,gBACV,KAAK;AAAA,cACP;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,OAAO;AAAA,UACT;AAAA,QACF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aACE;AAAA,UACF,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,OAAO;AAAA,YACP,MAAM;AAAA,YACN,cAAc;AAAA,YACd,qBAAqB;AAAA,YACrB,gBAAgB,CAAC,WAAW,UAAU,0BAA0B,UAAU,cAAc;AAAA,YACxF,SAAS,CAAC,EAAE,MAAM,wBAAwB,IAAI,oBAAoB,CAAC;AAAA,YACnE,QAAQ;AAAA,cACN,QAAQ;AAAA,cACR,QAAQ;AAAA,cACR,UAAU;AAAA,YACZ;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,MAAM,CAAC,WAAW;AAAA,MAClB,YAAY,EAAE,OAAO;AAAA,QACnB,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,MACtB,CAAC;AAAA,MACD,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,SAAS;AAAA,UACX;AAAA,QACF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,OAAO;AAAA,UACT;AAAA,QACF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,OAAO;AAAA,UACT;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * Workflow Definition Detail API\n *\n * Endpoints:\n * - GET /api/workflows/definitions/[id] - Get workflow definition\n * - PUT /api/workflows/definitions/[id] - Update workflow definition\n * - DELETE /api/workflows/definitions/[id] - Delete workflow definition (soft delete)\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveOrganizationScopeFilter, resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { WorkflowDefinition, WorkflowInstance } from '../../../data/entities'\nimport {\n  updateWorkflowDefinitionInputSchema,\n  updateWorkflowDefinitionInputCheckedSchema,\n  type UpdateWorkflowDefinitionApiInput,\n} from '../../../data/validators'\nimport { serializeWorkflowDefinition, serializeCodeWorkflowDefinition } from '../serialize'\nimport {\n  workflowDefinitionDetailResponseSchema,\n  workflowDefinitionMutationResponseSchema,\n  workflowDefinitionDeleteResponseSchema,\n  workflowErrorSchema,\n} from '../../openapi'\nimport { invalidateTriggerCache } from '../../../lib/event-trigger-service'\nimport { normalizeDefinitionValidationIssues } from '../../../lib/definition-error-body'\nimport { getCodeWorkflow, getAllCodeWorkflows } from '../../../lib/code-registry'\nimport { codeWorkflowUuid } from '../../../lib/find-definition'\nimport {\n  ACTIVE_WORKFLOW_INSTANCE_STATUSES,\n  buildStructuralEditConflictBody,\n  diffDefinitionStructure,\n} from '../../../lib/definition-edit-safety'\nimport {\n  authorizeWorkflowGrantChange,\n  normalizeGrantedFeatures,\n  syncWorkflowDefinitionPrincipal,\n} from '../../../lib/definition-grant'\nimport { createGenericOptimisticLockReader } from '@open-mercato/shared/lib/crud/optimistic-lock'\nimport { registerOptimisticLockReaderIfAbsent } from '@open-mercato/shared/lib/crud/optimistic-lock-store'\nimport { validateCrudMutationGuard, runCrudMutationGuardAfterSuccess } from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('workflows')\n\nregisterOptimisticLockReaderIfAbsent({\n  'workflows.definition': createGenericOptimisticLockReader({\n    entity: WorkflowDefinition,\n    idField: 'id',\n    tenantField: 'tenantId',\n    orgField: 'organizationId',\n    softDeleteField: 'deletedAt',\n  }),\n})\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.view'],\n}\n\ninterface RouteContext {\n  params: Promise<{\n    id: string\n  }>\n}\n\n/**\n * GET /api/workflows/definitions/[id]\n *\n * Get a single workflow definition by ID\n */\nexport async function GET(\n  request: NextRequest,\n  context: RouteContext\n) {\n  try {\n    const params = await context.params\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const orgFilter = resolveOrganizationScopeFilter(scope, auth)\n\n    // Handle code-based workflow definitions (code:<workflowId>)\n    if (params.id.startsWith('code:')) {\n      const workflowId = params.id.slice(5)\n      const codeDef = getCodeWorkflow(workflowId)\n      if (!codeDef) {\n        return NextResponse.json(\n          { error: 'Workflow definition not found' },\n          { status: 404 }\n        )\n      }\n      return NextResponse.json({\n        data: serializeCodeWorkflowDefinition(codeDef, params.id),\n      })\n    }\n\n    const definition = await em.findOne(WorkflowDefinition, {\n      id: params.id,\n      tenantId,\n      ...orgFilter.where,\n      deletedAt: null,\n    })\n\n    if (!definition) {\n      // Instances started from an unpersisted code definition store the\n      // deterministic codeWorkflowUuid(workflowId) as their definitionId\n      // (see lib/find-definition.ts). Resolve that synthetic UUID back to\n      // the code registry so lookups by instance.definitionId succeed.\n      const codeDef = getAllCodeWorkflows().find(\n        (workflow) => codeWorkflowUuid(workflow.workflowId) === params.id\n      )\n      if (codeDef) {\n        return NextResponse.json({\n          data: serializeCodeWorkflowDefinition(codeDef, `code:${codeDef.workflowId}`),\n        })\n      }\n      return NextResponse.json(\n        { error: 'Workflow definition not found' },\n        { status: 404 }\n      )\n    }\n\n    return NextResponse.json({ data: serializeWorkflowDefinition(definition) })\n  } catch (error) {\n    logger.error('Error getting workflow definition', { err: error })\n    return NextResponse.json(\n      { error: 'Failed to get workflow definition' },\n      { status: 500 }\n    )\n  }\n}\n\n/**\n * PUT /api/workflows/definitions/[id]\n *\n * Update a workflow definition\n */\nexport async function PUT(\n  request: NextRequest,\n  context: RouteContext\n) {\n  try {\n    const params = await context.params\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth)\n\n    // Check edit permission\n    const rbacService = container.resolve('rbacService')\n    const hasPermission = await rbacService.userHasAllFeatures(\n      auth.sub,\n      ['workflows.definitions.edit'],\n      {\n        tenantId,\n        organizationId,\n      }\n    )\n\n    if (!hasPermission) {\n      return NextResponse.json(\n        { error: 'Insufficient permissions' },\n        { status: 403 }\n      )\n    }\n\n    const body = await request.json()\n\n    // Validate input\n    const validation = updateWorkflowDefinitionInputCheckedSchema.safeParse(body)\n    if (!validation.success) {\n      return NextResponse.json(\n        {\n          error: 'Validation failed',\n          details: normalizeDefinitionValidationIssues(validation.error),\n        },\n        { status: 400 }\n      )\n    }\n\n    const input: UpdateWorkflowDefinitionApiInput = validation.data\n    const guardResult = await validateCrudMutationGuard(container, {\n      tenantId: tenantId ?? '',\n      organizationId: organizationId ?? null,\n      userId: auth.sub ?? '',\n      resourceKind: 'workflows.definition',\n      resourceId: params.id,\n      operation: 'update',\n      requestMethod: 'PUT',\n      requestHeaders: request.headers,\n      mutationPayload: input as Record<string, unknown>,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    // Handle customizing a code-based workflow definition\n    if (params.id.startsWith('code:')) {\n      const workflowId = params.id.slice(5)\n      const codeDef = getCodeWorkflow(workflowId)\n      if (!codeDef) {\n        return NextResponse.json(\n          { error: 'Workflow definition not found' },\n          { status: 404 }\n        )\n      }\n\n      // Check if an override already exists. Pin to the latest version so the\n      // override update targets a deterministic row now that versions coexist.\n      const existingOverride = await em.findOne(WorkflowDefinition, {\n        workflowId: codeDef.workflowId,\n        tenantId,\n      }, { orderBy: { version: 'DESC' } })\n\n      let savedOverride: WorkflowDefinition\n      if (existingOverride) {\n        try {\n          await enforceCommandOptimisticLockWithGuards(container, {\n            resourceKind: 'workflows.definition',\n            resourceId: existingOverride.id,\n            current: existingOverride.updatedAt ?? null,\n            request,\n          })\n        } catch (lockError) {\n          if (isCrudHttpError(lockError)) {\n            return NextResponse.json(lockError.body, { status: lockError.status })\n          }\n          throw lockError\n        }\n        // Revive if soft-deleted, then apply updates\n        existingOverride.deletedAt = null\n        existingOverride.workflowName = codeDef.workflowName\n        existingOverride.description = codeDef.description\n        existingOverride.version = codeDef.version\n        existingOverride.definition = input.definition ?? codeDef.definition\n        existingOverride.metadata = codeDef.metadata ?? null\n        existingOverride.enabled = input.enabled ?? codeDef.enabled\n        existingOverride.codeWorkflowId = codeDef.workflowId\n        existingOverride.updatedBy = auth.sub\n        existingOverride.updatedAt = new Date()\n        await em.flush()\n        savedOverride = existingOverride\n      } else {\n        // Create DB override row from code definition + user changes\n        const override = em.create(WorkflowDefinition, {\n          workflowId: codeDef.workflowId,\n          workflowName: codeDef.workflowName,\n          description: codeDef.description,\n          version: codeDef.version,\n          definition: input.definition ?? codeDef.definition,\n          metadata: codeDef.metadata,\n          enabled: input.enabled ?? codeDef.enabled,\n          codeWorkflowId: codeDef.workflowId,\n          tenantId,\n          organizationId,\n          createdBy: auth.sub,\n          updatedBy: auth.sub,\n          createdAt: new Date(),\n          updatedAt: new Date(),\n        })\n\n        em.persist(override)\n        await em.flush()\n        savedOverride = override\n      }\n\n      try {\n        const eventBus = container.resolve('eventBus') as\n          | { emitEvent(event: string, payload: unknown, options?: unknown): Promise<void> }\n          | undefined\n        if (eventBus && typeof eventBus.emitEvent === 'function') {\n          await eventBus.emitEvent(\n            'workflows.definition.customized',\n            {\n              id: savedOverride.id,\n              workflowId: savedOverride.workflowId,\n              codeWorkflowId: savedOverride.codeWorkflowId ?? null,\n              tenantId: savedOverride.tenantId,\n              organizationId: savedOverride.organizationId,\n              userId: auth.sub ?? null,\n            },\n            { tenantId: savedOverride.tenantId, organizationId: savedOverride.organizationId, persistent: true },\n          )\n        }\n      } catch (eventError) {\n        logger.error('Failed to emit workflows.definition.customized event', { err: eventError })\n      }\n\n      if (guardResult?.shouldRunAfterSuccess) {\n        await runCrudMutationGuardAfterSuccess(container, {\n          tenantId: tenantId ?? '',\n          organizationId: organizationId ?? null,\n          userId: auth.sub ?? '',\n          resourceKind: 'workflows.definition',\n          resourceId: String(savedOverride.id),\n          operation: 'update',\n          requestMethod: 'PUT',\n          requestHeaders: request.headers,\n          metadata: guardResult.metadata,\n        })\n      }\n\n      return NextResponse.json({\n        data: serializeWorkflowDefinition(savedOverride),\n        message: 'Workflow definition customized successfully',\n      })\n    }\n\n    // Find existing definition\n    const definition = await em.findOne(WorkflowDefinition, {\n      id: params.id,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })\n\n    if (!definition) {\n      return NextResponse.json(\n        { error: 'Workflow definition not found' },\n        { status: 404 }\n      )\n    }\n\n    try {\n      await enforceCommandOptimisticLockWithGuards(container, {\n        resourceKind: 'workflows.definition',\n        resourceId: definition.id,\n        current: definition.updatedAt ?? null,\n        request,\n      })\n    } catch (lockError) {\n      if (isCrudHttpError(lockError)) {\n        return NextResponse.json(lockError.body, { status: lockError.status })\n      }\n      throw lockError\n    }\n\n    // Edit-safety rule (spec 4.1). Instances pin this row and the engine\n    // re-reads it on every advance, so a topology rewrite would re-point routes\n    // under a running instance. Structural changes are refused while instances\n    // are still executing; the structured body offers the new-version remedy.\n    // Cosmetic, config and metadata edits stay in-place, and the per-user draft\n    // layer (a separate route) is untouched so work-in-progress stays saveable.\n    if (input.definition !== undefined) {\n      const structuralChanges = diffDefinitionStructure(definition.definition, input.definition)\n      if (structuralChanges.length > 0) {\n        const activeInstanceCount = await em.count(WorkflowInstance, {\n          definitionId: definition.id,\n          status: { $in: [...ACTIVE_WORKFLOW_INSTANCE_STATUSES] },\n          tenantId,\n          organizationId,\n          deletedAt: null,\n        })\n        if (activeInstanceCount > 0) {\n          return NextResponse.json(\n            buildStructuralEditConflictBody({\n              definitionId: definition.id,\n              activeInstanceCount,\n              changes: structuralChanges,\n            }),\n            { status: 409 },\n          )\n        }\n      }\n    }\n\n    // Update fields. workflowId is intentionally ignored \u2014 it identifies the\n    // row and renaming would break references. Version is user-managed and\n    // applied when supplied so the edit form can bump it explicitly.\n    if (input.workflowName !== undefined) {\n      definition.workflowName = input.workflowName\n    }\n    if (input.description !== undefined) {\n      definition.description = input.description\n    }\n    if (input.version !== undefined) {\n      definition.version = input.version\n    }\n    if (input.definition !== undefined) {\n      definition.definition = input.definition\n    }\n    if (input.metadata !== undefined) {\n      definition.metadata = input.metadata\n    }\n    if (input.enabled !== undefined) {\n      definition.enabled = input.enabled\n    }\n    if (input.effectiveFrom !== undefined) {\n      definition.effectiveFrom = input.effectiveFrom\n    }\n    if (input.effectiveTo !== undefined) {\n      definition.effectiveTo = input.effectiveTo\n    }\n\n    // Execution identity. Absent leaves the stored grant untouched; an explicit\n    // value is authorised against the SAVING user's own current features (never\n    // the original author's) and the principal is re-scoped before the row is\n    // flushed, so the column and the role ACL can never disagree.\n    if (input.grantedFeatures !== undefined) {\n      const requestedGrant = normalizeGrantedFeatures(input.grantedFeatures)\n      const previousGrant = normalizeGrantedFeatures(definition.grantedFeatures)\n      const grantFailure = await authorizeWorkflowGrantChange(rbacService, {\n        userId: auth.sub,\n        scope: { tenantId, organizationId },\n        requested: requestedGrant,\n        current: previousGrant,\n      })\n      if (grantFailure) {\n        return NextResponse.json(grantFailure.body, { status: grantFailure.status })\n      }\n      definition.grantedFeatures = requestedGrant.length ? requestedGrant : null\n      // Clearing a grant re-scopes the existing principal to no features rather\n      // than leaving its old ACL behind.\n      await syncWorkflowDefinitionPrincipal(container, definition, { previousFeatures: previousGrant })\n    }\n\n    definition.updatedBy = auth.sub\n    definition.updatedAt = new Date()\n\n    await em.flush()\n\n    if (guardResult?.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId: tenantId ?? '',\n        organizationId: organizationId ?? null,\n        userId: auth.sub ?? '',\n        resourceKind: 'workflows.definition',\n        resourceId: String(definition.id),\n        operation: 'update',\n        requestMethod: 'PUT',\n        requestHeaders: request.headers,\n        metadata: guardResult.metadata,\n      })\n    }\n\n    // Embedded triggers may have changed; invalidate the in-memory cache so\n    // the wildcard event subscriber reloads them on the next event.\n    if (tenantId) invalidateTriggerCache(tenantId, organizationId ?? undefined)\n\n    return NextResponse.json({\n      data: serializeWorkflowDefinition(definition),\n      message: 'Workflow definition updated successfully',\n    })\n  } catch (error) {\n    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status })\n    logger.error('Error updating workflow definition', { err: error })\n    return NextResponse.json(\n      { error: 'Failed to update workflow definition' },\n      { status: 500 }\n    )\n  }\n}\n\n/**\n * DELETE /api/workflows/definitions/[id]\n *\n * Soft delete a workflow definition\n */\nexport async function DELETE(\n  request: NextRequest,\n  context: RouteContext\n) {\n  try {\n    const params = await context.params\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth)\n\n    // Check delete permission\n    const rbacService = container.resolve('rbacService')\n    const hasPermission = await rbacService.userHasAllFeatures(\n      auth.sub,\n      ['workflows.definitions.delete'],\n      {\n        tenantId,\n        organizationId,\n      }\n    )\n\n    if (!hasPermission) {\n      return NextResponse.json(\n        { error: 'Insufficient permissions' },\n        { status: 403 }\n      )\n    }\n\n    // Find existing definition\n    const definition = await em.findOne(WorkflowDefinition, {\n      id: params.id,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })\n\n    if (!definition) {\n      return NextResponse.json(\n        { error: 'Workflow definition not found' },\n        { status: 404 }\n      )\n    }\n\n    const guardResult = await validateCrudMutationGuard(container, {\n      tenantId: tenantId ?? '',\n      organizationId: organizationId ?? null,\n      userId: auth.sub ?? '',\n      resourceKind: 'workflows.definition',\n      resourceId: params.id,\n      operation: 'delete',\n      requestMethod: 'DELETE',\n      requestHeaders: request.headers,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    // Check if there are active workflow instances using this definition\n    const { WorkflowInstance } = await import('../../../data/entities')\n    const activeInstances = await em.count(WorkflowInstance, {\n      definitionId: definition.id,\n      status: { $in: ['RUNNING', 'WAITING'] },\n    })\n\n    if (activeInstances > 0) {\n      return NextResponse.json(\n        {\n          error: `Cannot delete workflow definition with ${activeInstances} active instance(s)`,\n        },\n        { status: 409 }\n      )\n    }\n\n    // Soft delete\n    definition.deletedAt = new Date()\n    definition.updatedAt = new Date()\n\n    await em.flush()\n\n    if (guardResult?.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId: tenantId ?? '',\n        organizationId: organizationId ?? null,\n        userId: auth.sub ?? '',\n        resourceKind: 'workflows.definition',\n        resourceId: String(definition.id),\n        operation: 'delete',\n        requestMethod: 'DELETE',\n        requestHeaders: request.headers,\n        metadata: guardResult.metadata,\n      })\n    }\n\n    if (tenantId) invalidateTriggerCache(tenantId, organizationId ?? undefined)\n\n    return NextResponse.json({\n      message: 'Workflow definition deleted successfully',\n    })\n  } catch (error) {\n    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status })\n    logger.error('Error deleting workflow definition', { err: error })\n    return NextResponse.json(\n      { error: 'Failed to delete workflow definition' },\n      { status: 500 }\n    )\n  }\n}\n\nexport const openApi = {\n  methods: {\n    GET: {\n      summary: 'Get workflow definition',\n      description: 'Get a single workflow definition by ID. Returns the complete workflow structure including steps and transitions (with embedded activities).',\n      tags: ['Workflows'],\n      pathParams: z.object({\n        id: z.string().describe('UUID for DB definitions, or \"code:<workflowId>\" for code-based definitions'),\n      }),\n      responses: [\n        {\n          status: 200,\n          description: 'Workflow definition found',\n          schema: workflowDefinitionDetailResponseSchema,\n          example: {\n            data: {\n              id: '123e4567-e89b-12d3-a456-426614174000',\n              workflowId: 'checkout-flow',\n              workflowName: 'Checkout Flow',\n              description: 'Complete checkout workflow for processing orders',\n              version: 1,\n              definition: {\n                steps: [\n                  {\n                    stepId: 'start',\n                    stepName: 'Start',\n                    stepType: 'START',\n                  },\n                  {\n                    stepId: 'validate-cart',\n                    stepName: 'Validate Cart',\n                    stepType: 'AUTOMATED',\n                    description: 'Validate cart items and check inventory',\n                  },\n                  {\n                    stepId: 'payment',\n                    stepName: 'Process Payment',\n                    stepType: 'AUTOMATED',\n                    description: 'Charge payment method',\n                    retryPolicy: {\n                      maxAttempts: 3,\n                      backoffMs: 1000,\n                    },\n                  },\n                  {\n                    stepId: 'end',\n                    stepName: 'End',\n                    stepType: 'END',\n                  },\n                ],\n                transitions: [\n                  {\n                    transitionId: 'start-to-validate',\n                    fromStepId: 'start',\n                    toStepId: 'validate-cart',\n                    trigger: 'auto',\n                  },\n                  {\n                    transitionId: 'validate-to-payment',\n                    fromStepId: 'validate-cart',\n                    toStepId: 'payment',\n                    trigger: 'auto',\n                  },\n                  {\n                    transitionId: 'payment-to-end',\n                    fromStepId: 'payment',\n                    toStepId: 'end',\n                    trigger: 'auto',\n                    activities: [\n                      {\n                        activityName: 'Send Order Confirmation',\n                        activityType: 'SEND_EMAIL',\n                        config: {\n                          to: '{{context.customerEmail}}',\n                          subject: 'Order Confirmation #{{context.orderId}}',\n                          template: 'order_confirmation',\n                        },\n                      },\n                    ],\n                  },\n                ],\n              },\n              enabled: true,\n              tenantId: '123e4567-e89b-12d3-a456-426614174001',\n              organizationId: '123e4567-e89b-12d3-a456-426614174002',\n              createdAt: '2025-12-08T10:00:00.000Z',\n              updatedAt: '2025-12-08T10:00:00.000Z',\n            },\n          },\n        },\n        {\n          status: 404,\n          description: 'Workflow definition not found',\n          schema: workflowErrorSchema,\n          example: {\n            error: 'Workflow definition not found',\n          },\n        },\n      ],\n    },\n    PUT: {\n      summary: 'Update workflow definition',\n      description: 'Update an existing workflow definition. Supports partial updates - only provided fields will be updated.',\n      tags: ['Workflows'],\n      pathParams: z.object({\n        id: z.string().uuid(),\n      }),\n      requestBody: {\n        schema: updateWorkflowDefinitionInputSchema,\n        example: {\n          definition: {\n            steps: [\n              {\n                stepId: 'start',\n                stepName: 'Start',\n                stepType: 'START',\n              },\n              {\n                stepId: 'validate-cart',\n                stepName: 'Validate Cart',\n                stepType: 'AUTOMATED',\n              },\n              {\n                stepId: 'payment',\n                stepName: 'Process Payment',\n                stepType: 'AUTOMATED',\n              },\n              {\n                stepId: 'confirmation',\n                stepName: 'Order Confirmation',\n                stepType: 'AUTOMATED',\n              },\n              {\n                stepId: 'end',\n                stepName: 'End',\n                stepType: 'END',\n              },\n            ],\n            transitions: [\n              {\n                transitionId: 'start-to-validate',\n                fromStepId: 'start',\n                toStepId: 'validate-cart',\n                trigger: 'auto',\n              },\n              {\n                transitionId: 'validate-to-payment',\n                fromStepId: 'validate-cart',\n                toStepId: 'payment',\n                trigger: 'auto',\n              },\n              {\n                transitionId: 'payment-to-confirmation',\n                fromStepId: 'payment',\n                toStepId: 'confirmation',\n                trigger: 'auto',\n              },\n              {\n                transitionId: 'confirmation-to-end',\n                fromStepId: 'confirmation',\n                toStepId: 'end',\n                trigger: 'auto',\n              },\n            ],\n          },\n          enabled: true,\n        },\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Workflow definition updated successfully',\n          schema: workflowDefinitionMutationResponseSchema,\n          example: {\n            data: {\n              id: '123e4567-e89b-12d3-a456-426614174000',\n              workflowId: 'checkout-flow',\n              workflowName: 'Checkout Flow',\n              description: 'Complete checkout workflow for processing orders',\n              version: 1,\n              definition: {\n                steps: [\n                  { stepId: 'start', stepName: 'Start', stepType: 'START' },\n                  {\n                    stepId: 'validate-cart',\n                    stepName: 'Validate Cart',\n                    stepType: 'AUTOMATED',\n                  },\n                  {\n                    stepId: 'payment',\n                    stepName: 'Process Payment',\n                    stepType: 'AUTOMATED',\n                  },\n                  {\n                    stepId: 'confirmation',\n                    stepName: 'Order Confirmation',\n                    stepType: 'AUTOMATED',\n                  },\n                  { stepId: 'end', stepName: 'End', stepType: 'END' },\n                ],\n                transitions: [\n                  {\n                    transitionId: 'start-to-validate',\n                    fromStepId: 'start',\n                    toStepId: 'validate-cart',\n                    trigger: 'auto',\n                  },\n                  {\n                    transitionId: 'validate-to-payment',\n                    fromStepId: 'validate-cart',\n                    toStepId: 'payment',\n                    trigger: 'auto',\n                  },\n                  {\n                    transitionId: 'payment-to-confirmation',\n                    fromStepId: 'payment',\n                    toStepId: 'confirmation',\n                    trigger: 'auto',\n                  },\n                  {\n                    transitionId: 'confirmation-to-end',\n                    fromStepId: 'confirmation',\n                    toStepId: 'end',\n                    trigger: 'auto',\n                  },\n                ],\n              },\n              enabled: true,\n              tenantId: '123e4567-e89b-12d3-a456-426614174001',\n              organizationId: '123e4567-e89b-12d3-a456-426614174002',\n              createdAt: '2025-12-08T10:00:00.000Z',\n              updatedAt: '2025-12-08T11:30:00.000Z',\n            },\n            message: 'Workflow definition updated successfully',\n          },\n        },\n        {\n          status: 400,\n          description: 'Validation error',\n          schema: workflowErrorSchema,\n          example: {\n            error: 'Validation failed',\n            details: [\n              {\n                path: ['definition'],\n                code: 'invalid_type',\n                message: 'Invalid input: expected object, received string',\n                expected: 'object',\n                got: 'string',\n              },\n            ],\n          },\n        },\n        {\n          status: 404,\n          description: 'Workflow definition not found',\n          schema: workflowErrorSchema,\n          example: {\n            error: 'Workflow definition not found',\n          },\n        },\n        {\n          status: 409,\n          description:\n            'Structural change refused while instances are still running (or optimistic-lock conflict). Publish a new version and apply the change there.',\n          schema: workflowErrorSchema,\n          example: {\n            error: 'Structural changes require a new version while instances are still running',\n            code: 'WORKFLOW_STRUCTURAL_EDIT_REQUIRES_NEW_VERSION',\n            definitionId: '123e4567-e89b-12d3-a456-426614174000',\n            activeInstanceCount: 3,\n            activeStatuses: ['RUNNING', 'PAUSED', 'WAITING_FOR_ACTIVITIES', 'FORKED', 'COMPENSATING'],\n            changes: [{ kind: 'transitionRetargeted', id: 't_lz3k9_ab12cd34e' }],\n            remedy: {\n              action: 'createVersion',\n              method: 'POST',\n              endpoint: '/api/workflows/definitions/123e4567-e89b-12d3-a456-426614174000/publish',\n            },\n          },\n        },\n      ],\n    },\n    DELETE: {\n      summary: 'Delete workflow definition',\n      description: 'Soft delete a workflow definition. Cannot be deleted if there are active workflow instances (RUNNING or WAITING status) using this definition.',\n      tags: ['Workflows'],\n      pathParams: z.object({\n        id: z.string().uuid(),\n      }),\n      responses: [\n        {\n          status: 200,\n          description: 'Workflow definition deleted successfully',\n          schema: workflowDefinitionDeleteResponseSchema,\n          example: {\n            message: 'Workflow definition deleted successfully',\n          },\n        },\n        {\n          status: 404,\n          description: 'Workflow definition not found',\n          schema: workflowErrorSchema,\n          example: {\n            error: 'Workflow definition not found',\n          },\n        },\n        {\n          status: 409,\n          description: 'Cannot delete - active workflow instances exist',\n          schema: workflowErrorSchema,\n          example: {\n            error: 'Cannot delete workflow definition with 3 active instance(s)',\n          },\n        },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AASA,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,gCAAgC,yCAAyC;AAClF,SAAS,oBAAoB,wBAAwB;AACrD;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP,SAAS,6BAA6B,uCAAuC;AAC7E;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,8BAA8B;AACvC,SAAS,2CAA2C;AACpD,SAAS,iBAAiB,2BAA2B;AACrD,SAAS,wBAAwB;AACjC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,yCAAyC;AAClD,SAAS,4CAA4C;AACrD,SAAS,2BAA2B,wCAAwC;AAC5E,SAAS,8CAA8C;AACvD,SAAS,uBAAuB;AAChC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEvC,qCAAqC;AAAA,EACnC,wBAAwB,kCAAkC;AAAA,IACxD,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,aAAa;AAAA,IACb,UAAU;AAAA,IACV,iBAAiB;AAAA,EACnB,CAAC;AACH,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,4BAA4B;AAChD;AAaA,eAAsB,IACpB,SACA,SACA;AACA,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ;AAC7B,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,YAAY,+BAA+B,OAAO,IAAI;AAG5D,QAAI,OAAO,GAAG,WAAW,OAAO,GAAG;AACjC,YAAM,aAAa,OAAO,GAAG,MAAM,CAAC;AACpC,YAAM,UAAU,gBAAgB,UAAU;AAC1C,UAAI,CAAC,SAAS;AACZ,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,gCAAgC;AAAA,UACzC,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,aAAO,aAAa,KAAK;AAAA,QACvB,MAAM,gCAAgC,SAAS,OAAO,EAAE;AAAA,MAC1D,CAAC;AAAA,IACH;AAEA,UAAM,aAAa,MAAM,GAAG,QAAQ,oBAAoB;AAAA,MACtD,IAAI,OAAO;AAAA,MACX;AAAA,MACA,GAAG,UAAU;AAAA,MACb,WAAW;AAAA,IACb,CAAC;AAED,QAAI,CAAC,YAAY;AAKf,YAAM,UAAU,oBAAoB,EAAE;AAAA,QACpC,CAAC,aAAa,iBAAiB,SAAS,UAAU,MAAM,OAAO;AAAA,MACjE;AACA,UAAI,SAAS;AACX,eAAO,aAAa,KAAK;AAAA,UACvB,MAAM,gCAAgC,SAAS,QAAQ,QAAQ,UAAU,EAAE;AAAA,QAC7E,CAAC;AAAA,MACH;AACA,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,gCAAgC;AAAA,QACzC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,WAAO,aAAa,KAAK,EAAE,MAAM,4BAA4B,UAAU,EAAE,CAAC;AAAA,EAC5E,SAAS,OAAO;AACd,WAAO,MAAM,qCAAqC,EAAE,KAAK,MAAM,CAAC;AAChE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,oCAAoC;AAAA,MAC7C,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAOA,eAAsB,IACpB,SACA,SACA;AACA,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ;AAC7B,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,kCAAkC,OAAO,IAAI;AAGpE,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,UAAM,gBAAgB,MAAM,YAAY;AAAA,MACtC,KAAK;AAAA,MACL,CAAC,4BAA4B;AAAA,MAC7B;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,2BAA2B;AAAA,QACpC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,OAAO,MAAM,QAAQ,KAAK;AAGhC,UAAM,aAAa,2CAA2C,UAAU,IAAI;AAC5E,QAAI,CAAC,WAAW,SAAS;AACvB,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO;AAAA,UACP,SAAS,oCAAoC,WAAW,KAAK;AAAA,QAC/D;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,QAA0C,WAAW;AAC3D,UAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,MAC7D,UAAU,YAAY;AAAA,MACtB,gBAAgB,kBAAkB;AAAA,MAClC,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,WAAW;AAAA,MACX,eAAe;AAAA,MACf,gBAAgB,QAAQ;AAAA,MACxB,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAGA,QAAI,OAAO,GAAG,WAAW,OAAO,GAAG;AACjC,YAAM,aAAa,OAAO,GAAG,MAAM,CAAC;AACpC,YAAM,UAAU,gBAAgB,UAAU;AAC1C,UAAI,CAAC,SAAS;AACZ,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,gCAAgC;AAAA,UACzC,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAIA,YAAM,mBAAmB,MAAM,GAAG,QAAQ,oBAAoB;AAAA,QAC5D,YAAY,QAAQ;AAAA,QACpB;AAAA,MACF,GAAG,EAAE,SAAS,EAAE,SAAS,OAAO,EAAE,CAAC;AAEnC,UAAI;AACJ,UAAI,kBAAkB;AACpB,YAAI;AACF,gBAAM,uCAAuC,WAAW;AAAA,YACtD,cAAc;AAAA,YACd,YAAY,iBAAiB;AAAA,YAC7B,SAAS,iBAAiB,aAAa;AAAA,YACvC;AAAA,UACF,CAAC;AAAA,QACH,SAAS,WAAW;AAClB,cAAI,gBAAgB,SAAS,GAAG;AAC9B,mBAAO,aAAa,KAAK,UAAU,MAAM,EAAE,QAAQ,UAAU,OAAO,CAAC;AAAA,UACvE;AACA,gBAAM;AAAA,QACR;AAEA,yBAAiB,YAAY;AAC7B,yBAAiB,eAAe,QAAQ;AACxC,yBAAiB,cAAc,QAAQ;AACvC,yBAAiB,UAAU,QAAQ;AACnC,yBAAiB,aAAa,MAAM,cAAc,QAAQ;AAC1D,yBAAiB,WAAW,QAAQ,YAAY;AAChD,yBAAiB,UAAU,MAAM,WAAW,QAAQ;AACpD,yBAAiB,iBAAiB,QAAQ;AAC1C,yBAAiB,YAAY,KAAK;AAClC,yBAAiB,YAAY,oBAAI,KAAK;AACtC,cAAM,GAAG,MAAM;AACf,wBAAgB;AAAA,MAClB,OAAO;AAEL,cAAM,WAAW,GAAG,OAAO,oBAAoB;AAAA,UAC7C,YAAY,QAAQ;AAAA,UACpB,cAAc,QAAQ;AAAA,UACtB,aAAa,QAAQ;AAAA,UACrB,SAAS,QAAQ;AAAA,UACjB,YAAY,MAAM,cAAc,QAAQ;AAAA,UACxC,UAAU,QAAQ;AAAA,UAClB,SAAS,MAAM,WAAW,QAAQ;AAAA,UAClC,gBAAgB,QAAQ;AAAA,UACxB;AAAA,UACA;AAAA,UACA,WAAW,KAAK;AAAA,UAChB,WAAW,KAAK;AAAA,UAChB,WAAW,oBAAI,KAAK;AAAA,UACpB,WAAW,oBAAI,KAAK;AAAA,QACtB,CAAC;AAED,WAAG,QAAQ,QAAQ;AACnB,cAAM,GAAG,MAAM;AACf,wBAAgB;AAAA,MAClB;AAEA,UAAI;AACF,cAAM,WAAW,UAAU,QAAQ,UAAU;AAG7C,YAAI,YAAY,OAAO,SAAS,cAAc,YAAY;AACxD,gBAAM,SAAS;AAAA,YACb;AAAA,YACA;AAAA,cACE,IAAI,cAAc;AAAA,cAClB,YAAY,cAAc;AAAA,cAC1B,gBAAgB,cAAc,kBAAkB;AAAA,cAChD,UAAU,cAAc;AAAA,cACxB,gBAAgB,cAAc;AAAA,cAC9B,QAAQ,KAAK,OAAO;AAAA,YACtB;AAAA,YACA,EAAE,UAAU,cAAc,UAAU,gBAAgB,cAAc,gBAAgB,YAAY,KAAK;AAAA,UACrG;AAAA,QACF;AAAA,MACF,SAAS,YAAY;AACnB,eAAO,MAAM,wDAAwD,EAAE,KAAK,WAAW,CAAC;AAAA,MAC1F;AAEA,UAAI,aAAa,uBAAuB;AACtC,cAAM,iCAAiC,WAAW;AAAA,UAChD,UAAU,YAAY;AAAA,UACtB,gBAAgB,kBAAkB;AAAA,UAClC,QAAQ,KAAK,OAAO;AAAA,UACpB,cAAc;AAAA,UACd,YAAY,OAAO,cAAc,EAAE;AAAA,UACnC,WAAW;AAAA,UACX,eAAe;AAAA,UACf,gBAAgB,QAAQ;AAAA,UACxB,UAAU,YAAY;AAAA,QACxB,CAAC;AAAA,MACH;AAEA,aAAO,aAAa,KAAK;AAAA,QACvB,MAAM,4BAA4B,aAAa;AAAA,QAC/C,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAGA,UAAM,aAAa,MAAM,GAAG,QAAQ,oBAAoB;AAAA,MACtD,IAAI,OAAO;AAAA,MACX;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AAED,QAAI,CAAC,YAAY;AACf,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,gCAAgC;AAAA,QACzC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,QAAI;AACF,YAAM,uCAAuC,WAAW;AAAA,QACtD,cAAc;AAAA,QACd,YAAY,WAAW;AAAA,QACvB,SAAS,WAAW,aAAa;AAAA,QACjC;AAAA,MACF,CAAC;AAAA,IACH,SAAS,WAAW;AAClB,UAAI,gBAAgB,SAAS,GAAG;AAC9B,eAAO,aAAa,KAAK,UAAU,MAAM,EAAE,QAAQ,UAAU,OAAO,CAAC;AAAA,MACvE;AACA,YAAM;AAAA,IACR;AAQA,QAAI,MAAM,eAAe,QAAW;AAClC,YAAM,oBAAoB,wBAAwB,WAAW,YAAY,MAAM,UAAU;AACzF,UAAI,kBAAkB,SAAS,GAAG;AAChC,cAAM,sBAAsB,MAAM,GAAG,MAAM,kBAAkB;AAAA,UAC3D,cAAc,WAAW;AAAA,UACzB,QAAQ,EAAE,KAAK,CAAC,GAAG,iCAAiC,EAAE;AAAA,UACtD;AAAA,UACA;AAAA,UACA,WAAW;AAAA,QACb,CAAC;AACD,YAAI,sBAAsB,GAAG;AAC3B,iBAAO,aAAa;AAAA,YAClB,gCAAgC;AAAA,cAC9B,cAAc,WAAW;AAAA,cACzB;AAAA,cACA,SAAS;AAAA,YACX,CAAC;AAAA,YACD,EAAE,QAAQ,IAAI;AAAA,UAChB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAKA,QAAI,MAAM,iBAAiB,QAAW;AACpC,iBAAW,eAAe,MAAM;AAAA,IAClC;AACA,QAAI,MAAM,gBAAgB,QAAW;AACnC,iBAAW,cAAc,MAAM;AAAA,IACjC;AACA,QAAI,MAAM,YAAY,QAAW;AAC/B,iBAAW,UAAU,MAAM;AAAA,IAC7B;AACA,QAAI,MAAM,eAAe,QAAW;AAClC,iBAAW,aAAa,MAAM;AAAA,IAChC;AACA,QAAI,MAAM,aAAa,QAAW;AAChC,iBAAW,WAAW,MAAM;AAAA,IAC9B;AACA,QAAI,MAAM,YAAY,QAAW;AAC/B,iBAAW,UAAU,MAAM;AAAA,IAC7B;AACA,QAAI,MAAM,kBAAkB,QAAW;AACrC,iBAAW,gBAAgB,MAAM;AAAA,IACnC;AACA,QAAI,MAAM,gBAAgB,QAAW;AACnC,iBAAW,cAAc,MAAM;AAAA,IACjC;AAMA,QAAI,MAAM,oBAAoB,QAAW;AACvC,YAAM,iBAAiB,yBAAyB,MAAM,eAAe;AACrE,YAAM,gBAAgB,yBAAyB,WAAW,eAAe;AACzE,YAAM,eAAe,MAAM,6BAA6B,aAAa;AAAA,QACnE,QAAQ,KAAK;AAAA,QACb,OAAO,EAAE,UAAU,eAAe;AAAA,QAClC,WAAW;AAAA,QACX,SAAS;AAAA,MACX,CAAC;AACD,UAAI,cAAc;AAChB,eAAO,aAAa,KAAK,aAAa,MAAM,EAAE,QAAQ,aAAa,OAAO,CAAC;AAAA,MAC7E;AACA,iBAAW,kBAAkB,eAAe,SAAS,iBAAiB;AAGtE,YAAM,gCAAgC,WAAW,YAAY,EAAE,kBAAkB,cAAc,CAAC;AAAA,IAClG;AAEA,eAAW,YAAY,KAAK;AAC5B,eAAW,YAAY,oBAAI,KAAK;AAEhC,UAAM,GAAG,MAAM;AAEf,QAAI,aAAa,uBAAuB;AACtC,YAAM,iCAAiC,WAAW;AAAA,QAChD,UAAU,YAAY;AAAA,QACtB,gBAAgB,kBAAkB;AAAA,QAClC,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc;AAAA,QACd,YAAY,OAAO,WAAW,EAAE;AAAA,QAChC,WAAW;AAAA,QACX,eAAe;AAAA,QACf,gBAAgB,QAAQ;AAAA,QACxB,UAAU,YAAY;AAAA,MACxB,CAAC;AAAA,IACH;AAIA,QAAI,SAAU,wBAAuB,UAAU,kBAAkB,MAAS;AAE1E,WAAO,aAAa,KAAK;AAAA,MACvB,MAAM,4BAA4B,UAAU;AAAA,MAC5C,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,EAAG,QAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AACzF,WAAO,MAAM,sCAAsC,EAAE,KAAK,MAAM,CAAC;AACjE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,uCAAuC;AAAA,MAChD,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAOA,eAAsB,OACpB,SACA,SACA;AACA,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ;AAC7B,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,kCAAkC,OAAO,IAAI;AAGpE,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,UAAM,gBAAgB,MAAM,YAAY;AAAA,MACtC,KAAK;AAAA,MACL,CAAC,8BAA8B;AAAA,MAC/B;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,2BAA2B;AAAA,QACpC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAGA,UAAM,aAAa,MAAM,GAAG,QAAQ,oBAAoB;AAAA,MACtD,IAAI,OAAO;AAAA,MACX;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AAED,QAAI,CAAC,YAAY;AACf,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,gCAAgC;AAAA,QACzC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,MAC7D,UAAU,YAAY;AAAA,MACtB,gBAAgB,kBAAkB;AAAA,MAClC,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,WAAW;AAAA,MACX,eAAe;AAAA,MACf,gBAAgB,QAAQ;AAAA,IAC1B,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAGA,UAAM,EAAE,kBAAAA,kBAAiB,IAAI,MAAM,OAAO,wBAAwB;AAClE,UAAM,kBAAkB,MAAM,GAAG,MAAMA,mBAAkB;AAAA,MACvD,cAAc,WAAW;AAAA,MACzB,QAAQ,EAAE,KAAK,CAAC,WAAW,SAAS,EAAE;AAAA,IACxC,CAAC;AAED,QAAI,kBAAkB,GAAG;AACvB,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO,0CAA0C,eAAe;AAAA,QAClE;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAGA,eAAW,YAAY,oBAAI,KAAK;AAChC,eAAW,YAAY,oBAAI,KAAK;AAEhC,UAAM,GAAG,MAAM;AAEf,QAAI,aAAa,uBAAuB;AACtC,YAAM,iCAAiC,WAAW;AAAA,QAChD,UAAU,YAAY;AAAA,QACtB,gBAAgB,kBAAkB;AAAA,QAClC,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc;AAAA,QACd,YAAY,OAAO,WAAW,EAAE;AAAA,QAChC,WAAW;AAAA,QACX,eAAe;AAAA,QACf,gBAAgB,QAAQ;AAAA,QACxB,UAAU,YAAY;AAAA,MACxB,CAAC;AAAA,IACH;AAEA,QAAI,SAAU,wBAAuB,UAAU,kBAAkB,MAAS;AAE1E,WAAO,aAAa,KAAK;AAAA,MACvB,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,EAAG,QAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AACzF,WAAO,MAAM,sCAAsC,EAAE,KAAK,MAAM,CAAC;AACjE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,uCAAuC;AAAA,MAChD,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,MAAM,CAAC,WAAW;AAAA,MAClB,YAAY,EAAE,OAAO;AAAA,QACnB,IAAI,EAAE,OAAO,EAAE,SAAS,4EAA4E;AAAA,MACtG,CAAC;AAAA,MACD,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,MAAM;AAAA,cACJ,IAAI;AAAA,cACJ,YAAY;AAAA,cACZ,cAAc;AAAA,cACd,aAAa;AAAA,cACb,SAAS;AAAA,cACT,YAAY;AAAA,gBACV,OAAO;AAAA,kBACL;AAAA,oBACE,QAAQ;AAAA,oBACR,UAAU;AAAA,oBACV,UAAU;AAAA,kBACZ;AAAA,kBACA;AAAA,oBACE,QAAQ;AAAA,oBACR,UAAU;AAAA,oBACV,UAAU;AAAA,oBACV,aAAa;AAAA,kBACf;AAAA,kBACA;AAAA,oBACE,QAAQ;AAAA,oBACR,UAAU;AAAA,oBACV,UAAU;AAAA,oBACV,aAAa;AAAA,oBACb,aAAa;AAAA,sBACX,aAAa;AAAA,sBACb,WAAW;AAAA,oBACb;AAAA,kBACF;AAAA,kBACA;AAAA,oBACE,QAAQ;AAAA,oBACR,UAAU;AAAA,oBACV,UAAU;AAAA,kBACZ;AAAA,gBACF;AAAA,gBACA,aAAa;AAAA,kBACX;AAAA,oBACE,cAAc;AAAA,oBACd,YAAY;AAAA,oBACZ,UAAU;AAAA,oBACV,SAAS;AAAA,kBACX;AAAA,kBACA;AAAA,oBACE,cAAc;AAAA,oBACd,YAAY;AAAA,oBACZ,UAAU;AAAA,oBACV,SAAS;AAAA,kBACX;AAAA,kBACA;AAAA,oBACE,cAAc;AAAA,oBACd,YAAY;AAAA,oBACZ,UAAU;AAAA,oBACV,SAAS;AAAA,oBACT,YAAY;AAAA,sBACV;AAAA,wBACE,cAAc;AAAA,wBACd,cAAc;AAAA,wBACd,QAAQ;AAAA,0BACN,IAAI;AAAA,0BACJ,SAAS;AAAA,0BACT,UAAU;AAAA,wBACZ;AAAA,sBACF;AAAA,oBACF;AAAA,kBACF;AAAA,gBACF;AAAA,cACF;AAAA,cACA,SAAS;AAAA,cACT,UAAU;AAAA,cACV,gBAAgB;AAAA,cAChB,WAAW;AAAA,cACX,WAAW;AAAA,YACb;AAAA,UACF;AAAA,QACF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,OAAO;AAAA,UACT;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,MAAM,CAAC,WAAW;AAAA,MAClB,YAAY,EAAE,OAAO;AAAA,QACnB,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,MACtB,CAAC;AAAA,MACD,aAAa;AAAA,QACX,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,YAAY;AAAA,YACV,OAAO;AAAA,cACL;AAAA,gBACE,QAAQ;AAAA,gBACR,UAAU;AAAA,gBACV,UAAU;AAAA,cACZ;AAAA,cACA;AAAA,gBACE,QAAQ;AAAA,gBACR,UAAU;AAAA,gBACV,UAAU;AAAA,cACZ;AAAA,cACA;AAAA,gBACE,QAAQ;AAAA,gBACR,UAAU;AAAA,gBACV,UAAU;AAAA,cACZ;AAAA,cACA;AAAA,gBACE,QAAQ;AAAA,gBACR,UAAU;AAAA,gBACV,UAAU;AAAA,cACZ;AAAA,cACA;AAAA,gBACE,QAAQ;AAAA,gBACR,UAAU;AAAA,gBACV,UAAU;AAAA,cACZ;AAAA,YACF;AAAA,YACA,aAAa;AAAA,cACX;AAAA,gBACE,cAAc;AAAA,gBACd,YAAY;AAAA,gBACZ,UAAU;AAAA,gBACV,SAAS;AAAA,cACX;AAAA,cACA;AAAA,gBACE,cAAc;AAAA,gBACd,YAAY;AAAA,gBACZ,UAAU;AAAA,gBACV,SAAS;AAAA,cACX;AAAA,cACA;AAAA,gBACE,cAAc;AAAA,gBACd,YAAY;AAAA,gBACZ,UAAU;AAAA,gBACV,SAAS;AAAA,cACX;AAAA,cACA;AAAA,gBACE,cAAc;AAAA,gBACd,YAAY;AAAA,gBACZ,UAAU;AAAA,gBACV,SAAS;AAAA,cACX;AAAA,YACF;AAAA,UACF;AAAA,UACA,SAAS;AAAA,QACX;AAAA,MACF;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,MAAM;AAAA,cACJ,IAAI;AAAA,cACJ,YAAY;AAAA,cACZ,cAAc;AAAA,cACd,aAAa;AAAA,cACb,SAAS;AAAA,cACT,YAAY;AAAA,gBACV,OAAO;AAAA,kBACL,EAAE,QAAQ,SAAS,UAAU,SAAS,UAAU,QAAQ;AAAA,kBACxD;AAAA,oBACE,QAAQ;AAAA,oBACR,UAAU;AAAA,oBACV,UAAU;AAAA,kBACZ;AAAA,kBACA;AAAA,oBACE,QAAQ;AAAA,oBACR,UAAU;AAAA,oBACV,UAAU;AAAA,kBACZ;AAAA,kBACA;AAAA,oBACE,QAAQ;AAAA,oBACR,UAAU;AAAA,oBACV,UAAU;AAAA,kBACZ;AAAA,kBACA,EAAE,QAAQ,OAAO,UAAU,OAAO,UAAU,MAAM;AAAA,gBACpD;AAAA,gBACA,aAAa;AAAA,kBACX;AAAA,oBACE,cAAc;AAAA,oBACd,YAAY;AAAA,oBACZ,UAAU;AAAA,oBACV,SAAS;AAAA,kBACX;AAAA,kBACA;AAAA,oBACE,cAAc;AAAA,oBACd,YAAY;AAAA,oBACZ,UAAU;AAAA,oBACV,SAAS;AAAA,kBACX;AAAA,kBACA;AAAA,oBACE,cAAc;AAAA,oBACd,YAAY;AAAA,oBACZ,UAAU;AAAA,oBACV,SAAS;AAAA,kBACX;AAAA,kBACA;AAAA,oBACE,cAAc;AAAA,oBACd,YAAY;AAAA,oBACZ,UAAU;AAAA,oBACV,SAAS;AAAA,kBACX;AAAA,gBACF;AAAA,cACF;AAAA,cACA,SAAS;AAAA,cACT,UAAU;AAAA,cACV,gBAAgB;AAAA,cAChB,WAAW;AAAA,cACX,WAAW;AAAA,YACb;AAAA,YACA,SAAS;AAAA,UACX;AAAA,QACF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,OAAO;AAAA,YACP,SAAS;AAAA,cACP;AAAA,gBACE,MAAM,CAAC,YAAY;AAAA,gBACnB,MAAM;AAAA,gBACN,SAAS;AAAA,gBACT,UAAU;AAAA,gBACV,KAAK;AAAA,cACP;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,OAAO;AAAA,UACT;AAAA,QACF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aACE;AAAA,UACF,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,OAAO;AAAA,YACP,MAAM;AAAA,YACN,cAAc;AAAA,YACd,qBAAqB;AAAA,YACrB,gBAAgB,CAAC,WAAW,UAAU,0BAA0B,UAAU,cAAc;AAAA,YACxF,SAAS,CAAC,EAAE,MAAM,wBAAwB,IAAI,oBAAoB,CAAC;AAAA,YACnE,QAAQ;AAAA,cACN,QAAQ;AAAA,cACR,QAAQ;AAAA,cACR,UAAU;AAAA,YACZ;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,MAAM,CAAC,WAAW;AAAA,MAClB,YAAY,EAAE,OAAO;AAAA,QACnB,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,MACtB,CAAC;AAAA,MACD,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,SAAS;AAAA,UACX;AAAA,QACF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,OAAO;AAAA,UACT;AAAA,QACF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,OAAO;AAAA,UACT;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": ["WorkflowInstance"]
 }

package/dist/modules/workflows/api/definitions/[id]/test-step/route.js

@@ -3,7 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
-import { resolveOrganizationScopeFilter } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
+import { resolveOrganizationScopeFilter, resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { WorkflowDefinition } from "../../../../data/entities.js";
 import { testWorkflowStepInputSchema } from "../../../../data/validators.js";
 import { getActivityType } from "../../../../lib/activity-registry.js";
@@ -23,6 +23,7 @@ import {
   workflowTestStepResponseSchema
 } from "../../../openapi.js";
 import { createLogger } from "@open-mercato/shared/lib/logger";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 const logger = createLogger("workflows");
 const metadata = {
   requireAuth: true,
@@ -39,7 +40,7 @@ async function POST(request, context) {
     }
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request });
     const tenantId = auth.tenantId;
-    const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
     if (!tenantId) {
       return NextResponse.json({ error: "Missing tenant context" }, { status: 400 });
     }
@@ -155,6 +156,7 @@ async function POST(request, context) {
       interpolatedConfig
     });
   } catch (error) {
+    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status });
     logger.error("Error running workflow test step", { err: error });
     return NextResponse.json(
       { error: "Failed to run workflow test step" },

package/dist/modules/workflows/api/definitions/[id]/test-step/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/workflows/api/definitions/%5Bid%5D/test-step/route.ts"],
-  "sourcesContent": ["/**\n * Workflow Definition Test-Step API (spec \u00A73.6 mock-first dry run)\n *\n * Endpoints:\n * - POST /api/workflows/definitions/[id]/test-step - Dry-run one activity config\n *\n * Mock-first semantics (Phase 2a hard rule): this route NEVER calls\n * `entry.execute` \u2014 side-effecting activities cannot be rolled back, so a test\n * run either invokes the registry entry's would-do `mock` or returns a\n * structured refusal. A refusal (`mock: 'refuse'` or no mock declared) is a\n * NORMAL outcome the editor renders, so it responds 200 with\n * `{ refused: true, reason }`, not a 4xx.\n *\n * The config is interpolated exactly like `executeActivityByType` does \u2014 via\n * the exported `interpolateVariables` against the caller-supplied sample\n * context, the server-side `{{env.*}}` allowlist, and a SYNTHETIC workflow\n * scope (`instanceId: 'test'`, the authenticated tenant/organization, the\n * target stepId as currentStepId) since no real instance exists. The response\n * includes the interpolated config so the UI can show resolved values. The\n * definition's `interpolation` mode is honored: under strict mode an\n * unresolvable token responds 200 with a structured\n * `{ interpolationFailed: true, token, message }` body \u2014 a normal authoring\n * outcome the editor renders, mirroring what the runtime would throw.\n *\n * The route does not read the definition's content, but it still RESOLVES the\n * [id] within the caller's tenant/organization scope (same id forms as the\n * sibling context-schema GET: DB UUID, \"code:<workflowId>\", synthetic\n * codeWorkflowUuid fallback) and 404s otherwise \u2014 the endpoint is anchored to\n * a definition the caller can see, never a free-floating interpolation\n * service.\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveOrganizationScopeFilter } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { WorkflowDefinition, type WorkflowInstance } from '../../../../data/entities'\nimport { testWorkflowStepInputSchema } from '../../../../data/validators'\nimport { getActivityType } from '../../../../lib/activity-registry'\nimport {\n  interpolateVariables,\n  WorkflowInterpolationError,\n  type ActivityContext,\n} from '../../../../lib/activity-executor'\nimport {\n  resolveDefinitionInterpolationMode,\n  type WorkflowInterpolationMode,\n} from '../../../../lib/interpolation-pipeline'\nimport { getCodeWorkflow, getAllCodeWorkflows } from '../../../../lib/code-registry'\nimport { codeWorkflowUuid } from '../../../../lib/find-definition'\nimport {\n  workflowsTag,\n  workflowErrorSchema,\n  workflowTestStepRequestSchema,\n  workflowTestStepResponseSchema,\n} from '../../../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.test_run'],\n}\n\ninterface RouteContext {\n  params: Promise<{\n    id: string\n  }>\n}\n\ntype ResolvedDefinitionRef = {\n  workflowId: string\n  version: number\n  interpolation?: WorkflowInterpolationMode\n}\n\n/**\n * POST /api/workflows/definitions/[id]/test-step\n *\n * Interpolate an activity config against a sample context and run the\n * activity type's would-do mock. Never executes the real activity.\n */\nexport async function POST(\n  request: NextRequest,\n  context: RouteContext,\n) {\n  try {\n    const params = await context.params\n    const container = await createRequestContainer()\n    const em = container.resolve('em') as {\n      findOne: (entity: unknown, where: Record<string, unknown>) => Promise<unknown>\n    }\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth || !auth.sub) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n\n    if (!tenantId) {\n      return NextResponse.json({ error: 'Missing tenant context' }, { status: 400 })\n    }\n\n    const rbacService = container.resolve('rbacService') as {\n      userHasAllFeatures: (\n        userId: string,\n        features: string[],\n        scope: { tenantId: string | null; organizationId: string | null },\n      ) => Promise<boolean>\n    }\n    const hasPermission = await rbacService.userHasAllFeatures(\n      auth.sub,\n      ['workflows.definitions.test_run'],\n      { tenantId, organizationId },\n    )\n\n    if (!hasPermission) {\n      return NextResponse.json({ error: 'Insufficient permissions' }, { status: 403 })\n    }\n\n    const body = await request.json()\n    const validation = testWorkflowStepInputSchema.safeParse(body)\n    if (!validation.success) {\n      return NextResponse.json(\n        { error: 'Validation failed', details: validation.error.issues },\n        { status: 400 },\n      )\n    }\n    const input = validation.data\n\n    let definitionRef: ResolvedDefinitionRef | null = null\n\n    if (params.id.startsWith('code:')) {\n      const workflowId = params.id.slice(5)\n      const codeDef = getCodeWorkflow(workflowId)\n      if (codeDef) {\n        definitionRef = {\n          workflowId: codeDef.workflowId,\n          version: 1,\n          interpolation: resolveDefinitionInterpolationMode(codeDef.definition),\n        }\n      }\n    } else {\n      const orgFilter = resolveOrganizationScopeFilter(scope, auth)\n      const definition = (await em.findOne(WorkflowDefinition, {\n        id: params.id,\n        tenantId,\n        ...orgFilter.where,\n        deletedAt: null,\n      })) as WorkflowDefinition | null\n\n      if (definition) {\n        definitionRef = {\n          workflowId: definition.workflowId,\n          version: definition.version,\n          interpolation: resolveDefinitionInterpolationMode(definition.definition),\n        }\n      } else {\n        const codeDef = getAllCodeWorkflows().find(\n          (workflow) => codeWorkflowUuid(workflow.workflowId) === params.id,\n        )\n        if (codeDef) {\n          definitionRef = {\n            workflowId: codeDef.workflowId,\n            version: 1,\n            interpolation: resolveDefinitionInterpolationMode(codeDef.definition),\n          }\n        }\n      }\n    }\n\n    if (!definitionRef) {\n      return NextResponse.json({ error: 'Workflow definition not found' }, { status: 404 })\n    }\n\n    const entry = getActivityType(input.activityType)\n    if (!entry) {\n      return NextResponse.json(\n        { error: 'Unknown activity type', activityType: input.activityType },\n        { status: 404 },\n      )\n    }\n\n    const syntheticWorkflowInstance = {\n      id: 'test',\n      workflowId: definitionRef.workflowId,\n      version: definitionRef.version,\n      tenantId,\n      organizationId,\n      currentStepId: input.stepId ?? 'test',\n    } as unknown as WorkflowInstance\n\n    let interpolatedConfig: Record<string, unknown>\n    try {\n      interpolatedConfig = interpolateVariables(\n        input.config,\n        input.context,\n        syntheticWorkflowInstance,\n        { mode: definitionRef.interpolation },\n      ) as Record<string, unknown>\n    } catch (error) {\n      if (error instanceof WorkflowInterpolationError) {\n        return NextResponse.json({\n          interpolationFailed: true,\n          token: error.token,\n          message: error.message,\n          activityType: input.activityType,\n        })\n      }\n      throw error\n    }\n\n    if (entry.mock === 'refuse' || entry.mock === undefined) {\n      return NextResponse.json({\n        refused: true,\n        reason: entry.mock === 'refuse' ? 'refused' : 'noMock',\n        activityType: input.activityType,\n      })\n    }\n\n    const mockContext: ActivityContext = {\n      workflowInstance: syntheticWorkflowInstance,\n      workflowContext: input.context,\n    }\n    const output = entry.mock(interpolatedConfig, mockContext)\n\n    return NextResponse.json({\n      simulated: true,\n      activityType: input.activityType,\n      output: output ?? null,\n      interpolatedConfig,\n    })\n  } catch (error) {\n    logger.error('Error running workflow test step', { err: error })\n    return NextResponse.json(\n      { error: 'Failed to run workflow test step' },\n      { status: 500 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'Workflow definition test-step dry run',\n  pathParams: z.object({\n    id: z.string().describe('UUID for DB definitions, or \"code:<workflowId>\" for code-based definitions'),\n  }),\n  methods: {\n    POST: {\n      summary: 'Dry-run one activity config with mock-first semantics',\n      description: 'Interpolates the supplied activity config against the sample context (plus a synthetic workflow scope and the server env allowlist) and runs the activity type\\'s would-do mock. Never executes the real activity. Activity types that declare no mock or opt out with \"refuse\" respond 200 with a structured refusal the editor renders.',\n      requestBody: {\n        schema: workflowTestStepRequestSchema,\n        example: {\n          stepId: 'notify',\n          activityType: 'SEND_EMAIL',\n          config: { to: '{{context.customerEmail}}', subject: 'Order {{context.orderId}} approved' },\n          context: { customerEmail: 'jane@example.com', orderId: 'ORD-42' },\n        },\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Simulated mock output, or a structured refusal when the type cannot be simulated',\n          schema: workflowTestStepResponseSchema,\n          example: {\n            simulated: true,\n            activityType: 'SEND_EMAIL',\n            output: { sent: false, simulated: true, wouldSendTo: 'jane@example.com', subject: 'Order ORD-42 approved' },\n            interpolatedConfig: { to: 'jane@example.com', subject: 'Order ORD-42 approved' },\n          },\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Missing tenant context or malformed payload', schema: workflowErrorSchema },\n        { status: 403, description: 'Insufficient permissions', schema: workflowErrorSchema },\n        { status: 404, description: 'Workflow definition or activity type not found', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAgCA,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,sCAAsC;AAC/C,SAAS,0BAAiD;AAC1D,SAAS,mCAAmC;AAC5C,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,OAEK;AACP,SAAS,iBAAiB,2BAA2B;AACrD,SAAS,wBAAwB;AACjC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,gCAAgC;AACpD;AAoBA,eAAsB,KACpB,SACA,SACA;AACA,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ;AAC7B,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AAGjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,QAAQ,CAAC,KAAK,KAAK;AACtB,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAE1D,QAAI,CAAC,UAAU;AACb,aAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/E;AAEA,UAAM,cAAc,UAAU,QAAQ,aAAa;AAOnD,UAAM,gBAAgB,MAAM,YAAY;AAAA,MACtC,KAAK;AAAA,MACL,CAAC,gCAAgC;AAAA,MACjC,EAAE,UAAU,eAAe;AAAA,IAC7B;AAEA,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjF;AAEA,UAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,UAAM,aAAa,4BAA4B,UAAU,IAAI;AAC7D,QAAI,CAAC,WAAW,SAAS;AACvB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,qBAAqB,SAAS,WAAW,MAAM,OAAO;AAAA,QAC/D,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,UAAM,QAAQ,WAAW;AAEzB,QAAI,gBAA8C;AAElD,QAAI,OAAO,GAAG,WAAW,OAAO,GAAG;AACjC,YAAM,aAAa,OAAO,GAAG,MAAM,CAAC;AACpC,YAAM,UAAU,gBAAgB,UAAU;AAC1C,UAAI,SAAS;AACX,wBAAgB;AAAA,UACd,YAAY,QAAQ;AAAA,UACpB,SAAS;AAAA,UACT,eAAe,mCAAmC,QAAQ,UAAU;AAAA,QACtE;AAAA,MACF;AAAA,IACF,OAAO;AACL,YAAM,YAAY,+BAA+B,OAAO,IAAI;AAC5D,YAAM,aAAc,MAAM,GAAG,QAAQ,oBAAoB;AAAA,QACvD,IAAI,OAAO;AAAA,QACX;AAAA,QACA,GAAG,UAAU;AAAA,QACb,WAAW;AAAA,MACb,CAAC;AAED,UAAI,YAAY;AACd,wBAAgB;AAAA,UACd,YAAY,WAAW;AAAA,UACvB,SAAS,WAAW;AAAA,UACpB,eAAe,mCAAmC,WAAW,UAAU;AAAA,QACzE;AAAA,MACF,OAAO;AACL,cAAM,UAAU,oBAAoB,EAAE;AAAA,UACpC,CAAC,aAAa,iBAAiB,SAAS,UAAU,MAAM,OAAO;AAAA,QACjE;AACA,YAAI,SAAS;AACX,0BAAgB;AAAA,YACd,YAAY,QAAQ;AAAA,YACpB,SAAS;AAAA,YACT,eAAe,mCAAmC,QAAQ,UAAU;AAAA,UACtE;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa,KAAK,EAAE,OAAO,gCAAgC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACtF;AAEA,UAAM,QAAQ,gBAAgB,MAAM,YAAY;AAChD,QAAI,CAAC,OAAO;AACV,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,yBAAyB,cAAc,MAAM,aAAa;AAAA,QACnE,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,4BAA4B;AAAA,MAChC,IAAI;AAAA,MACJ,YAAY,cAAc;AAAA,MAC1B,SAAS,cAAc;AAAA,MACvB;AAAA,MACA;AAAA,MACA,eAAe,MAAM,UAAU;AAAA,IACjC;AAEA,QAAI;AACJ,QAAI;AACF,2BAAqB;AAAA,QACnB,MAAM;AAAA,QACN,MAAM;AAAA,QACN;AAAA,QACA,EAAE,MAAM,cAAc,cAAc;AAAA,MACtC;AAAA,IACF,SAAS,OAAO;AACd,UAAI,iBAAiB,4BAA4B;AAC/C,eAAO,aAAa,KAAK;AAAA,UACvB,qBAAqB;AAAA,UACrB,OAAO,MAAM;AAAA,UACb,SAAS,MAAM;AAAA,UACf,cAAc,MAAM;AAAA,QACtB,CAAC;AAAA,MACH;AACA,YAAM;AAAA,IACR;AAEA,QAAI,MAAM,SAAS,YAAY,MAAM,SAAS,QAAW;AACvD,aAAO,aAAa,KAAK;AAAA,QACvB,SAAS;AAAA,QACT,QAAQ,MAAM,SAAS,WAAW,YAAY;AAAA,QAC9C,cAAc,MAAM;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,UAAM,cAA+B;AAAA,MACnC,kBAAkB;AAAA,MAClB,iBAAiB,MAAM;AAAA,IACzB;AACA,UAAM,SAAS,MAAM,KAAK,oBAAoB,WAAW;AAEzD,WAAO,aAAa,KAAK;AAAA,MACvB,WAAW;AAAA,MACX,cAAc,MAAM;AAAA,MACpB,QAAQ,UAAU;AAAA,MAClB;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,oCAAoC,EAAE,KAAK,MAAM,CAAC;AAC/D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,mCAAmC;AAAA,MAC5C,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY,EAAE,OAAO;AAAA,IACnB,IAAI,EAAE,OAAO,EAAE,SAAS,4EAA4E;AAAA,EACtG,CAAC;AAAA,EACD,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,QAAQ;AAAA,UACR,cAAc;AAAA,UACd,QAAQ,EAAE,IAAI,6BAA6B,SAAS,qCAAqC;AAAA,UACzF,SAAS,EAAE,eAAe,oBAAoB,SAAS,SAAS;AAAA,QAClE;AAAA,MACF;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,WAAW;AAAA,YACX,cAAc;AAAA,YACd,QAAQ,EAAE,MAAM,OAAO,WAAW,MAAM,aAAa,oBAAoB,SAAS,wBAAwB;AAAA,YAC1G,oBAAoB,EAAE,IAAI,oBAAoB,SAAS,wBAAwB;AAAA,UACjF;AAAA,QACF;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,+CAA+C,QAAQ,oBAAoB;AAAA,QACvG,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,kDAAkD,QAAQ,oBAAoB;AAAA,MAC5G;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * Workflow Definition Test-Step API (spec \u00A73.6 mock-first dry run)\n *\n * Endpoints:\n * - POST /api/workflows/definitions/[id]/test-step - Dry-run one activity config\n *\n * Mock-first semantics (Phase 2a hard rule): this route NEVER calls\n * `entry.execute` \u2014 side-effecting activities cannot be rolled back, so a test\n * run either invokes the registry entry's would-do `mock` or returns a\n * structured refusal. A refusal (`mock: 'refuse'` or no mock declared) is a\n * NORMAL outcome the editor renders, so it responds 200 with\n * `{ refused: true, reason }`, not a 4xx.\n *\n * The config is interpolated exactly like `executeActivityByType` does \u2014 via\n * the exported `interpolateVariables` against the caller-supplied sample\n * context, the server-side `{{env.*}}` allowlist, and a SYNTHETIC workflow\n * scope (`instanceId: 'test'`, the authenticated tenant/organization, the\n * target stepId as currentStepId) since no real instance exists. The response\n * includes the interpolated config so the UI can show resolved values. The\n * definition's `interpolation` mode is honored: under strict mode an\n * unresolvable token responds 200 with a structured\n * `{ interpolationFailed: true, token, message }` body \u2014 a normal authoring\n * outcome the editor renders, mirroring what the runtime would throw.\n *\n * The route does not read the definition's content, but it still RESOLVES the\n * [id] within the caller's tenant/organization scope (same id forms as the\n * sibling context-schema GET: DB UUID, \"code:<workflowId>\", synthetic\n * codeWorkflowUuid fallback) and 404s otherwise \u2014 the endpoint is anchored to\n * a definition the caller can see, never a free-floating interpolation\n * service.\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveOrganizationScopeFilter, resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { WorkflowDefinition, type WorkflowInstance } from '../../../../data/entities'\nimport { testWorkflowStepInputSchema } from '../../../../data/validators'\nimport { getActivityType } from '../../../../lib/activity-registry'\nimport {\n  interpolateVariables,\n  WorkflowInterpolationError,\n  type ActivityContext,\n} from '../../../../lib/activity-executor'\nimport {\n  resolveDefinitionInterpolationMode,\n  type WorkflowInterpolationMode,\n} from '../../../../lib/interpolation-pipeline'\nimport { getCodeWorkflow, getAllCodeWorkflows } from '../../../../lib/code-registry'\nimport { codeWorkflowUuid } from '../../../../lib/find-definition'\nimport {\n  workflowsTag,\n  workflowErrorSchema,\n  workflowTestStepRequestSchema,\n  workflowTestStepResponseSchema,\n} from '../../../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.test_run'],\n}\n\ninterface RouteContext {\n  params: Promise<{\n    id: string\n  }>\n}\n\ntype ResolvedDefinitionRef = {\n  workflowId: string\n  version: number\n  interpolation?: WorkflowInterpolationMode\n}\n\n/**\n * POST /api/workflows/definitions/[id]/test-step\n *\n * Interpolate an activity config against a sample context and run the\n * activity type's would-do mock. Never executes the real activity.\n */\nexport async function POST(\n  request: NextRequest,\n  context: RouteContext,\n) {\n  try {\n    const params = await context.params\n    const container = await createRequestContainer()\n    const em = container.resolve('em') as {\n      findOne: (entity: unknown, where: Record<string, unknown>) => Promise<unknown>\n    }\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth || !auth.sub) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n\n    if (!tenantId) {\n      return NextResponse.json({ error: 'Missing tenant context' }, { status: 400 })\n    }\n\n    const rbacService = container.resolve('rbacService') as {\n      userHasAllFeatures: (\n        userId: string,\n        features: string[],\n        scope: { tenantId: string | null; organizationId: string | null },\n      ) => Promise<boolean>\n    }\n    const hasPermission = await rbacService.userHasAllFeatures(\n      auth.sub,\n      ['workflows.definitions.test_run'],\n      { tenantId, organizationId },\n    )\n\n    if (!hasPermission) {\n      return NextResponse.json({ error: 'Insufficient permissions' }, { status: 403 })\n    }\n\n    const body = await request.json()\n    const validation = testWorkflowStepInputSchema.safeParse(body)\n    if (!validation.success) {\n      return NextResponse.json(\n        { error: 'Validation failed', details: validation.error.issues },\n        { status: 400 },\n      )\n    }\n    const input = validation.data\n\n    let definitionRef: ResolvedDefinitionRef | null = null\n\n    if (params.id.startsWith('code:')) {\n      const workflowId = params.id.slice(5)\n      const codeDef = getCodeWorkflow(workflowId)\n      if (codeDef) {\n        definitionRef = {\n          workflowId: codeDef.workflowId,\n          version: 1,\n          interpolation: resolveDefinitionInterpolationMode(codeDef.definition),\n        }\n      }\n    } else {\n      const orgFilter = resolveOrganizationScopeFilter(scope, auth)\n      const definition = (await em.findOne(WorkflowDefinition, {\n        id: params.id,\n        tenantId,\n        ...orgFilter.where,\n        deletedAt: null,\n      })) as WorkflowDefinition | null\n\n      if (definition) {\n        definitionRef = {\n          workflowId: definition.workflowId,\n          version: definition.version,\n          interpolation: resolveDefinitionInterpolationMode(definition.definition),\n        }\n      } else {\n        const codeDef = getAllCodeWorkflows().find(\n          (workflow) => codeWorkflowUuid(workflow.workflowId) === params.id,\n        )\n        if (codeDef) {\n          definitionRef = {\n            workflowId: codeDef.workflowId,\n            version: 1,\n            interpolation: resolveDefinitionInterpolationMode(codeDef.definition),\n          }\n        }\n      }\n    }\n\n    if (!definitionRef) {\n      return NextResponse.json({ error: 'Workflow definition not found' }, { status: 404 })\n    }\n\n    const entry = getActivityType(input.activityType)\n    if (!entry) {\n      return NextResponse.json(\n        { error: 'Unknown activity type', activityType: input.activityType },\n        { status: 404 },\n      )\n    }\n\n    const syntheticWorkflowInstance = {\n      id: 'test',\n      workflowId: definitionRef.workflowId,\n      version: definitionRef.version,\n      tenantId,\n      organizationId,\n      currentStepId: input.stepId ?? 'test',\n    } as unknown as WorkflowInstance\n\n    let interpolatedConfig: Record<string, unknown>\n    try {\n      interpolatedConfig = interpolateVariables(\n        input.config,\n        input.context,\n        syntheticWorkflowInstance,\n        { mode: definitionRef.interpolation },\n      ) as Record<string, unknown>\n    } catch (error) {\n      if (error instanceof WorkflowInterpolationError) {\n        return NextResponse.json({\n          interpolationFailed: true,\n          token: error.token,\n          message: error.message,\n          activityType: input.activityType,\n        })\n      }\n      throw error\n    }\n\n    if (entry.mock === 'refuse' || entry.mock === undefined) {\n      return NextResponse.json({\n        refused: true,\n        reason: entry.mock === 'refuse' ? 'refused' : 'noMock',\n        activityType: input.activityType,\n      })\n    }\n\n    const mockContext: ActivityContext = {\n      workflowInstance: syntheticWorkflowInstance,\n      workflowContext: input.context,\n    }\n    const output = entry.mock(interpolatedConfig, mockContext)\n\n    return NextResponse.json({\n      simulated: true,\n      activityType: input.activityType,\n      output: output ?? null,\n      interpolatedConfig,\n    })\n  } catch (error) {\n    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status })\n    logger.error('Error running workflow test step', { err: error })\n    return NextResponse.json(\n      { error: 'Failed to run workflow test step' },\n      { status: 500 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'Workflow definition test-step dry run',\n  pathParams: z.object({\n    id: z.string().describe('UUID for DB definitions, or \"code:<workflowId>\" for code-based definitions'),\n  }),\n  methods: {\n    POST: {\n      summary: 'Dry-run one activity config with mock-first semantics',\n      description: 'Interpolates the supplied activity config against the sample context (plus a synthetic workflow scope and the server env allowlist) and runs the activity type\\'s would-do mock. Never executes the real activity. Activity types that declare no mock or opt out with \"refuse\" respond 200 with a structured refusal the editor renders.',\n      requestBody: {\n        schema: workflowTestStepRequestSchema,\n        example: {\n          stepId: 'notify',\n          activityType: 'SEND_EMAIL',\n          config: { to: '{{context.customerEmail}}', subject: 'Order {{context.orderId}} approved' },\n          context: { customerEmail: 'jane@example.com', orderId: 'ORD-42' },\n        },\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Simulated mock output, or a structured refusal when the type cannot be simulated',\n          schema: workflowTestStepResponseSchema,\n          example: {\n            simulated: true,\n            activityType: 'SEND_EMAIL',\n            output: { sent: false, simulated: true, wouldSendTo: 'jane@example.com', subject: 'Order ORD-42 approved' },\n            interpolatedConfig: { to: 'jane@example.com', subject: 'Order ORD-42 approved' },\n          },\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Missing tenant context or malformed payload', schema: workflowErrorSchema },\n        { status: 403, description: 'Insufficient permissions', schema: workflowErrorSchema },\n        { status: 404, description: 'Workflow definition or activity type not found', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAgCA,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,gCAAgC,yCAAyC;AAClF,SAAS,0BAAiD;AAC1D,SAAS,mCAAmC;AAC5C,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,OAEK;AACP,SAAS,iBAAiB,2BAA2B;AACrD,SAAS,wBAAwB;AACjC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,uBAAuB;AAEhC,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,gCAAgC;AACpD;AAoBA,eAAsB,KACpB,SACA,SACA;AACA,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ;AAC7B,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AAGjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,QAAQ,CAAC,KAAK,KAAK;AACtB,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AAEzE,QAAI,CAAC,UAAU;AACb,aAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/E;AAEA,UAAM,cAAc,UAAU,QAAQ,aAAa;AAOnD,UAAM,gBAAgB,MAAM,YAAY;AAAA,MACtC,KAAK;AAAA,MACL,CAAC,gCAAgC;AAAA,MACjC,EAAE,UAAU,eAAe;AAAA,IAC7B;AAEA,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjF;AAEA,UAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,UAAM,aAAa,4BAA4B,UAAU,IAAI;AAC7D,QAAI,CAAC,WAAW,SAAS;AACvB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,qBAAqB,SAAS,WAAW,MAAM,OAAO;AAAA,QAC/D,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,UAAM,QAAQ,WAAW;AAEzB,QAAI,gBAA8C;AAElD,QAAI,OAAO,GAAG,WAAW,OAAO,GAAG;AACjC,YAAM,aAAa,OAAO,GAAG,MAAM,CAAC;AACpC,YAAM,UAAU,gBAAgB,UAAU;AAC1C,UAAI,SAAS;AACX,wBAAgB;AAAA,UACd,YAAY,QAAQ;AAAA,UACpB,SAAS;AAAA,UACT,eAAe,mCAAmC,QAAQ,UAAU;AAAA,QACtE;AAAA,MACF;AAAA,IACF,OAAO;AACL,YAAM,YAAY,+BAA+B,OAAO,IAAI;AAC5D,YAAM,aAAc,MAAM,GAAG,QAAQ,oBAAoB;AAAA,QACvD,IAAI,OAAO;AAAA,QACX;AAAA,QACA,GAAG,UAAU;AAAA,QACb,WAAW;AAAA,MACb,CAAC;AAED,UAAI,YAAY;AACd,wBAAgB;AAAA,UACd,YAAY,WAAW;AAAA,UACvB,SAAS,WAAW;AAAA,UACpB,eAAe,mCAAmC,WAAW,UAAU;AAAA,QACzE;AAAA,MACF,OAAO;AACL,cAAM,UAAU,oBAAoB,EAAE;AAAA,UACpC,CAAC,aAAa,iBAAiB,SAAS,UAAU,MAAM,OAAO;AAAA,QACjE;AACA,YAAI,SAAS;AACX,0BAAgB;AAAA,YACd,YAAY,QAAQ;AAAA,YACpB,SAAS;AAAA,YACT,eAAe,mCAAmC,QAAQ,UAAU;AAAA,UACtE;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa,KAAK,EAAE,OAAO,gCAAgC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACtF;AAEA,UAAM,QAAQ,gBAAgB,MAAM,YAAY;AAChD,QAAI,CAAC,OAAO;AACV,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,yBAAyB,cAAc,MAAM,aAAa;AAAA,QACnE,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,4BAA4B;AAAA,MAChC,IAAI;AAAA,MACJ,YAAY,cAAc;AAAA,MAC1B,SAAS,cAAc;AAAA,MACvB;AAAA,MACA;AAAA,MACA,eAAe,MAAM,UAAU;AAAA,IACjC;AAEA,QAAI;AACJ,QAAI;AACF,2BAAqB;AAAA,QACnB,MAAM;AAAA,QACN,MAAM;AAAA,QACN;AAAA,QACA,EAAE,MAAM,cAAc,cAAc;AAAA,MACtC;AAAA,IACF,SAAS,OAAO;AACd,UAAI,iBAAiB,4BAA4B;AAC/C,eAAO,aAAa,KAAK;AAAA,UACvB,qBAAqB;AAAA,UACrB,OAAO,MAAM;AAAA,UACb,SAAS,MAAM;AAAA,UACf,cAAc,MAAM;AAAA,QACtB,CAAC;AAAA,MACH;AACA,YAAM;AAAA,IACR;AAEA,QAAI,MAAM,SAAS,YAAY,MAAM,SAAS,QAAW;AACvD,aAAO,aAAa,KAAK;AAAA,QACvB,SAAS;AAAA,QACT,QAAQ,MAAM,SAAS,WAAW,YAAY;AAAA,QAC9C,cAAc,MAAM;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,UAAM,cAA+B;AAAA,MACnC,kBAAkB;AAAA,MAClB,iBAAiB,MAAM;AAAA,IACzB;AACA,UAAM,SAAS,MAAM,KAAK,oBAAoB,WAAW;AAEzD,WAAO,aAAa,KAAK;AAAA,MACvB,WAAW;AAAA,MACX,cAAc,MAAM;AAAA,MACpB,QAAQ,UAAU;AAAA,MAClB;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,EAAG,QAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AACzF,WAAO,MAAM,oCAAoC,EAAE,KAAK,MAAM,CAAC;AAC/D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,mCAAmC;AAAA,MAC5C,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY,EAAE,OAAO;AAAA,IACnB,IAAI,EAAE,OAAO,EAAE,SAAS,4EAA4E;AAAA,EACtG,CAAC;AAAA,EACD,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,QAAQ;AAAA,UACR,cAAc;AAAA,UACd,QAAQ,EAAE,IAAI,6BAA6B,SAAS,qCAAqC;AAAA,UACzF,SAAS,EAAE,eAAe,oBAAoB,SAAS,SAAS;AAAA,QAClE;AAAA,MACF;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,WAAW;AAAA,YACX,cAAc;AAAA,YACd,QAAQ,EAAE,MAAM,OAAO,WAAW,MAAM,aAAa,oBAAoB,SAAS,wBAAwB;AAAA,YAC1G,oBAAoB,EAAE,IAAI,oBAAoB,SAAS,wBAAwB;AAAA,UACjF;AAAA,QACF;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,+CAA+C,QAAQ,oBAAoB;AAAA,QACvG,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,kDAAkD,QAAQ,oBAAoB;AAAA,MAC5G;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/workflows/api/definitions/generate/route.js

@@ -6,6 +6,7 @@ import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { getDeclaredEvents } from "@open-mercato/shared/modules/events";
 import { createLogger } from "@open-mercato/shared/lib/logger";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import {
   transitionTriggerSchema,
   workflowDefinitionDataSchema,
@@ -33,6 +34,7 @@ import { evaluateWorkflowDefinition } from "../../../lib/definition-evaluation.j
 import { listWorkflowFunctions } from "../../../lib/workflow-function-registry.js";
 import { listWorkflowSafeCommands } from "../../../lib/workflow-safe-commands.js";
 import { workflowsTag, workflowErrorSchema } from "../../openapi.js";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 const logger = createLogger("workflows");
 const DEFINITIONS_CREATE = "workflows.definitions.create";
 const metadata = {
@@ -85,7 +87,7 @@ async function POST(request) {
     }
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request });
     const tenantId = auth.tenantId;
-    const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
     if (!tenantId) {
       return NextResponse.json({ error: "Missing tenant context" }, { status: 400 });
     }
@@ -199,6 +201,7 @@ async function POST(request) {
       warningCount: evaluation.warningCount
     });
   } catch (error) {
+    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status });
     logger.error("Error generating workflow definition draft", { err: error });
     return NextResponse.json({ error: "Failed to generate workflow draft" }, { status: 500 });
   }