@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.9.0

package/dist/modules/workflows/api/definitions/generate/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/workflows/api/definitions/generate/route.ts"],
-  "sourcesContent": ["/**\n * Prompt-to-draft API (spec \u00A79, \"AI-assisted authoring\")\n *\n * Endpoint:\n * - POST /api/workflows/definitions/generate \u2014 natural language \u2192 draft definition\n *\n * ## This route PERSISTS NOTHING\n *\n * That is the whole trust model, and it is stronger than the `enabled: false`\n * row `workflows.create_definition` writes for external agents. There is no\n * `em.persist` on any path here: the generated definition is returned to the\n * Studio, the author reviews it on the canvas, and the ordinary Save + Enable\n * path \u2014 with its optimistic lock, its structural-edit guard and its publish\n * step \u2014 is the only way it ever becomes something the engine can run.\n *\n * ## Refusals are 200s\n *\n * \"No AI provider configured\", \"the model call failed\", \"the model produced\n * something that is not a workflow\" are all NORMAL authoring outcomes the\n * editor renders, exactly like the sibling test-step route's `{ refused: true }`\n * body. They respond 200 with a structured `{ ok: false, reason }` so the\n * surface can say what happened instead of showing a stack trace \u2014 this\n * module's recurring bug class is shipped behaviour that silently does nothing,\n * and a bare 500 is that bug wearing a status code.\n *\n * ## One evaluator\n *\n * The Problems pass is `evaluateWorkflowDefinition` \u2014 the same composer the\n * Studio's Problems panel and the definition API's 400 body come through. The\n * response carries its `problems`, `errorCount` and `warningCount` so the\n * author sees what is wrong with a draft BEFORE deciding to put it on a canvas.\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { zodToJsonSchema } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { getDeclaredEvents } from '@open-mercato/shared/modules/events'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { WorkflowDefinitionData } from '../../../data/entities'\nimport {\n  transitionTriggerSchema,\n  workflowDefinitionDataSchema,\n  workflowStepTypeSchema,\n} from '../../../data/validators'\nimport { listActivityTypes } from '../../../lib/activity-registry'\nimport '../../../lib/activity-registry-bootstrap'\nimport {\n  WORKFLOW_DRAFT_AGENT_ID,\n  WORKFLOW_DRAFT_MAX_REPAIR_ATTEMPTS,\n  WORKFLOW_DRAFT_PROMPT_MAX_LENGTH,\n  buildWorkflowDraftCatalog,\n  buildWorkflowDraftPrompt,\n  buildWorkflowDraftRepairPrompt,\n  classifyWorkflowDraftFailure,\n  interpretWorkflowDraftObject,\n  workflowDraftGenerationSchema,\n  type WorkflowDraftInterpretation,\n} from '../../../lib/ai-authoring'\nimport { resolveWorkflowDraftRunner } from '../../../lib/ai-draft-runner'\nimport {\n  computeDefinitionContextLedger,\n  warmContextLedgerResolvers,\n} from '../../../lib/definition-context-schema'\nimport { evaluateWorkflowDefinition } from '../../../lib/definition-evaluation'\nimport { listWorkflowFunctions } from '../../../lib/workflow-function-registry'\nimport { listWorkflowSafeCommands } from '../../../lib/workflow-safe-commands'\nimport { workflowsTag, workflowErrorSchema } from '../../openapi'\n\nconst logger = createLogger('workflows')\n\nconst DEFINITIONS_CREATE = 'workflows.definitions.create'\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: [DEFINITIONS_CREATE],\n}\n\nconst generateDefinitionRequestSchema = z.object({\n  prompt: z.string().trim().min(1).max(WORKFLOW_DRAFT_PROMPT_MAX_LENGTH),\n})\n\nconst generateDefinitionResponseSchema = z.object({\n  ok: z.boolean(),\n  reason: z.enum(['unavailable', 'failed', 'malformedResponse', 'schemaError']).optional(),\n  message: z.string().optional(),\n  messages: z.array(z.string()).optional(),\n  summary: z.string().optional(),\n  definition: z.record(z.string(), z.unknown()).optional(),\n  problems: z.array(z.record(z.string(), z.unknown())).optional(),\n  errorCount: z.number().int().nonnegative().optional(),\n  warningCount: z.number().int().nonnegative().optional(),\n})\n\ntype DraftAgentBridgeLike = {\n  listAgentOutcomeContracts?: () => Promise<Array<{ agentId?: unknown }>>\n}\n\n/**\n * The agents an `INVOKE_AGENT` draft may target, from the OPTIONAL\n * `agent_orchestrator` peer. Absent peer, missing method, or any failure \u21D2 an\n * empty list, which makes the catalog fail-closed: `buildWorkflowDraftPrompt`\n * then forbids `INVOKE_AGENT` outright rather than letting the model author an\n * agent step with no agent to run.\n */\nasync function resolveDraftAgents(\n  container: Awaited<ReturnType<typeof createRequestContainer>>,\n): Promise<{ id: string }[]> {\n  let bridge: DraftAgentBridgeLike | undefined\n  try {\n    bridge = container.resolve<DraftAgentBridgeLike>('agentWorkflowBridge')\n  } catch {\n    return []\n  }\n  if (!bridge || typeof bridge.listAgentOutcomeContracts !== 'function') return []\n  try {\n    const snapshots = await bridge.listAgentOutcomeContracts()\n    return snapshots\n      .map((snapshot) => (typeof snapshot.agentId === 'string' ? { id: snapshot.agentId } : null))\n      .filter((entry): entry is { id: string } => entry !== null)\n  } catch {\n    return []\n  }\n}\n\n/** Compute the ledger for the generated definition, tolerating a broken graph. */\nasync function tryComputeLedger(\n  container: Awaited<ReturnType<typeof createRequestContainer>>,\n  definition: WorkflowDefinitionData,\n) {\n  try {\n    await warmContextLedgerResolvers(container)\n    return computeDefinitionContextLedger(definition)\n  } catch {\n    return null\n  }\n}\n\nexport async function POST(request: NextRequest) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth || !auth.sub) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n\n    if (!tenantId) {\n      return NextResponse.json({ error: 'Missing tenant context' }, { status: 400 })\n    }\n\n    const rbacService = container.resolve('rbacService') as {\n      userHasAllFeatures: (\n        userId: string,\n        features: string[],\n        scope: { tenantId: string | null; organizationId: string | null },\n      ) => Promise<boolean>\n      loadAcl?: (\n        userId: string,\n        scope: { tenantId: string | null; organizationId: string | null },\n      ) => Promise<{ features: string[]; isSuperAdmin: boolean }>\n    }\n\n    const hasPermission = await rbacService.userHasAllFeatures(auth.sub, [DEFINITIONS_CREATE], {\n      tenantId,\n      organizationId,\n    })\n    if (!hasPermission) {\n      return NextResponse.json({ error: 'Insufficient permissions' }, { status: 403 })\n    }\n\n    const body = await request.json()\n    const validation = generateDefinitionRequestSchema.safeParse(body)\n    if (!validation.success) {\n      return NextResponse.json(\n        { error: 'Validation failed', details: validation.error.issues },\n        { status: 400 },\n      )\n    }\n\n    const runner = await resolveWorkflowDraftRunner()\n    if (!runner) {\n      return NextResponse.json({ ok: false, reason: 'unavailable' })\n    }\n\n    // The catalogs the draft is authored against: the platform's own\n    // registries, never a hand-maintained list that could drift from them.\n    const catalog = buildWorkflowDraftCatalog({\n      stepTypes: workflowStepTypeSchema.options,\n      transitionTriggers: transitionTriggerSchema.options,\n      activityTypes: listActivityTypes().map((entry) => ({\n        id: entry.id,\n        configSchema: zodToJsonSchema(entry.configSchema) ?? undefined,\n      })),\n      commands: listWorkflowSafeCommands().map((entry) => ({ id: entry.commandId })),\n      functions: listWorkflowFunctions().map((entry) => ({\n        name: entry.name,\n        ...(entry.description ? { label: entry.description } : {}),\n      })),\n      events: getDeclaredEvents()\n        .filter((event) => !event.excludeFromTriggers)\n        .map((event) => ({ id: event.id })),\n      agents: await resolveDraftAgents(container),\n    })\n\n    const acl = (await rbacService.loadAcl?.(auth.sub, { tenantId, organizationId })) ?? null\n\n    const authContext = {\n      tenantId,\n      organizationId,\n      userId: auth.sub,\n      features: acl?.features ?? [],\n      isSuperAdmin: acl?.isSuperAdmin ?? false,\n    }\n    const parseDefinition = (value: unknown) => {\n      const parsed = workflowDefinitionDataSchema.safeParse(value)\n      if (parsed.success) return { ok: true as const, definition: parsed.data as WorkflowDefinitionData }\n      return {\n        ok: false as const,\n        messages: parsed.error.issues.map(\n          (issue) => `${issue.path.join('.') || '(root)'}: ${issue.message}`,\n        ),\n      }\n    }\n\n    // Bounded validate-and-repair. The validator's messages are precise enough\n    // to act on, so a rejected draft goes BACK to the model with them rather\n    // than to the human as a dead end. Bounded because an unbounded loop\n    // against a model that cannot fix its own output is just a slower dead end\n    // that costs tokens; after the last attempt the surface reports the final\n    // errors exactly as it always did.\n    let prompt = buildWorkflowDraftPrompt({ prompt: validation.data.prompt, catalog })\n    let interpreted: WorkflowDraftInterpretation<WorkflowDefinitionData> | null = null\n    let repairAttempts = 0\n\n    for (let attempt = 0; attempt <= WORKFLOW_DRAFT_MAX_REPAIR_ATTEMPTS; attempt += 1) {\n      let raw: unknown\n      try {\n        raw = await runner({\n          agentId: WORKFLOW_DRAFT_AGENT_ID,\n          prompt,\n          schemaName: 'WorkflowDraft',\n          schema: workflowDraftGenerationSchema,\n          authContext,\n          container,\n        })\n      } catch (error) {\n        const kind = classifyWorkflowDraftFailure(error)\n        logger.warn('Workflow draft generation failed', { err: error, kind, attempt })\n        return NextResponse.json({\n          ok: false,\n          reason: kind,\n          ...(kind === 'failed'\n            ? { message: error instanceof Error ? error.message : String(error) }\n            : {}),\n        })\n      }\n\n      interpreted = interpretWorkflowDraftObject<WorkflowDefinitionData>({ raw, parseDefinition })\n      if (interpreted.ok) break\n      if (attempt === WORKFLOW_DRAFT_MAX_REPAIR_ATTEMPTS) break\n\n      repairAttempts += 1\n      logger.info('Workflow draft rejected; asking the model to repair it', {\n        reason: interpreted.reason,\n        messageCount: interpreted.messages.length,\n        attempt: repairAttempts,\n      })\n      prompt = buildWorkflowDraftRepairPrompt({\n        previousPrompt: prompt,\n        rejectedDraft: raw,\n        messages: interpreted.messages,\n      })\n    }\n\n    if (!interpreted || !interpreted.ok) {\n      return NextResponse.json({\n        ok: false,\n        reason: interpreted?.reason ?? 'malformedResponse',\n        messages: interpreted?.messages ?? [],\n        repairAttempts,\n      })\n    }\n\n    const ledger = await tryComputeLedger(container, interpreted.definition)\n    const evaluation = evaluateWorkflowDefinition(interpreted.definition, { ledger })\n\n    // Nothing above wrote a row, and nothing below does either \u2014 this route\n    // never resolves an EntityManager, so a future write would be an obvious\n    // diff rather than a quiet line inside an existing block.\n    return NextResponse.json({\n      ok: true,\n      summary: interpreted.summary,\n      definition: interpreted.definition,\n      problems: evaluation.problems,\n      errorCount: evaluation.errorCount,\n      warningCount: evaluation.warningCount,\n    })\n  } catch (error) {\n    logger.error('Error generating workflow definition draft', { err: error })\n    return NextResponse.json({ error: 'Failed to generate workflow draft' }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'Generate a draft workflow definition from a prompt',\n  methods: {\n    POST: {\n      summary: 'Author a draft workflow definition from natural language',\n      description:\n        'Runs the propose-only workflows.workflow_author agent against this installation\\'s activity, command, function and event catalogs and returns a draft definition plus the Problems-panel evaluation for it. Persists nothing: the draft is returned to the Studio for a human to apply, save and enable. Refusals (\"unavailable\" when no AI provider or agent registry is present, \"failed\" when the model call errored, \"malformedResponse\"/\"schemaError\" when the output is not a workflow definition) respond 200 with a structured body.',\n      requestBody: { schema: generateDefinitionRequestSchema },\n      responses: [\n        {\n          status: 200,\n          description:\n            'The generated draft with its Problems-panel evaluation, or a structured refusal',\n          schema: generateDefinitionResponseSchema,\n        },\n        { status: 400, description: 'Invalid request body', schema: workflowErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: workflowErrorSchema },\n        { status: 403, description: 'Insufficient permissions', schema: workflowErrorSchema },\n        { status: 500, description: 'Generation failed unexpectedly', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAiCA,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAElB,SAAS,uBAAuB;AAChC,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,yBAAyB;AAClC,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AAEnD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,yBAAyB;AAClC,OAAO;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,kCAAkC;AAC3C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,kCAAkC;AAC3C,SAAS,6BAA6B;AACtC,SAAS,gCAAgC;AACzC,SAAS,cAAc,2BAA2B;AAElD,MAAM,SAAS,aAAa,WAAW;AAEvC,MAAM,qBAAqB;AAEpB,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,kBAAkB;AACtC;AAEA,MAAM,kCAAkC,EAAE,OAAO;AAAA,EAC/C,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,gCAAgC;AACvE,CAAC;AAED,MAAM,mCAAmC,EAAE,OAAO;AAAA,EAChD,IAAI,EAAE,QAAQ;AAAA,EACd,QAAQ,EAAE,KAAK,CAAC,eAAe,UAAU,qBAAqB,aAAa,CAAC,EAAE,SAAS;AAAA,EACvF,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACvC,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EACvD,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,SAAS;AAAA,EAC9D,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EACpD,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AACxD,CAAC;AAaD,eAAe,mBACb,WAC2B;AAC3B,MAAI;AACJ,MAAI;AACF,aAAS,UAAU,QAA8B,qBAAqB;AAAA,EACxE,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACA,MAAI,CAAC,UAAU,OAAO,OAAO,8BAA8B,WAAY,QAAO,CAAC;AAC/E,MAAI;AACF,UAAM,YAAY,MAAM,OAAO,0BAA0B;AACzD,WAAO,UACJ,IAAI,CAAC,aAAc,OAAO,SAAS,YAAY,WAAW,EAAE,IAAI,SAAS,QAAQ,IAAI,IAAK,EAC1F,OAAO,CAAC,UAAmC,UAAU,IAAI;AAAA,EAC9D,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAGA,eAAe,iBACb,WACA,YACA;AACA,MAAI;AACF,UAAM,2BAA2B,SAAS;AAC1C,WAAO,+BAA+B,UAAU;AAAA,EAClD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,KAAK,SAAsB;AAC/C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,QAAQ,CAAC,KAAK,KAAK;AACtB,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAE1D,QAAI,CAAC,UAAU;AACb,aAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/E;AAEA,UAAM,cAAc,UAAU,QAAQ,aAAa;AAYnD,UAAM,gBAAgB,MAAM,YAAY,mBAAmB,KAAK,KAAK,CAAC,kBAAkB,GAAG;AAAA,MACzF;AAAA,MACA;AAAA,IACF,CAAC;AACD,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjF;AAEA,UAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,UAAM,aAAa,gCAAgC,UAAU,IAAI;AACjE,QAAI,CAAC,WAAW,SAAS;AACvB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,qBAAqB,SAAS,WAAW,MAAM,OAAO;AAAA,QAC/D,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,SAAS,MAAM,2BAA2B;AAChD,QAAI,CAAC,QAAQ;AACX,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,QAAQ,cAAc,CAAC;AAAA,IAC/D;AAIA,UAAM,UAAU,0BAA0B;AAAA,MACxC,WAAW,uBAAuB;AAAA,MAClC,oBAAoB,wBAAwB;AAAA,MAC5C,eAAe,kBAAkB,EAAE,IAAI,CAAC,WAAW;AAAA,QACjD,IAAI,MAAM;AAAA,QACV,cAAc,gBAAgB,MAAM,YAAY,KAAK;AAAA,MACvD,EAAE;AAAA,MACF,UAAU,yBAAyB,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,MAAM,UAAU,EAAE;AAAA,MAC7E,WAAW,sBAAsB,EAAE,IAAI,CAAC,WAAW;AAAA,QACjD,MAAM,MAAM;AAAA,QACZ,GAAI,MAAM,cAAc,EAAE,OAAO,MAAM,YAAY,IAAI,CAAC;AAAA,MAC1D,EAAE;AAAA,MACF,QAAQ,kBAAkB,EACvB,OAAO,CAAC,UAAU,CAAC,MAAM,mBAAmB,EAC5C,IAAI,CAAC,WAAW,EAAE,IAAI,MAAM,GAAG,EAAE;AAAA,MACpC,QAAQ,MAAM,mBAAmB,SAAS;AAAA,IAC5C,CAAC;AAED,UAAM,MAAO,MAAM,YAAY,UAAU,KAAK,KAAK,EAAE,UAAU,eAAe,CAAC,KAAM;AAErF,UAAM,cAAc;AAAA,MAClB;AAAA,MACA;AAAA,MACA,QAAQ,KAAK;AAAA,MACb,UAAU,KAAK,YAAY,CAAC;AAAA,MAC5B,cAAc,KAAK,gBAAgB;AAAA,IACrC;AACA,UAAM,kBAAkB,CAAC,UAAmB;AAC1C,YAAM,SAAS,6BAA6B,UAAU,KAAK;AAC3D,UAAI,OAAO,QAAS,QAAO,EAAE,IAAI,MAAe,YAAY,OAAO,KAA+B;AAClG,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,UAAU,OAAO,MAAM,OAAO;AAAA,UAC5B,CAAC,UAAU,GAAG,MAAM,KAAK,KAAK,GAAG,KAAK,QAAQ,KAAK,MAAM,OAAO;AAAA,QAClE;AAAA,MACF;AAAA,IACF;AAQA,QAAI,SAAS,yBAAyB,EAAE,QAAQ,WAAW,KAAK,QAAQ,QAAQ,CAAC;AACjF,QAAI,cAA0E;AAC9E,QAAI,iBAAiB;AAErB,aAAS,UAAU,GAAG,WAAW,oCAAoC,WAAW,GAAG;AACjF,UAAI;AACJ,UAAI;AACF,cAAM,MAAM,OAAO;AAAA,UACjB,SAAS;AAAA,UACT;AAAA,UACA,YAAY;AAAA,UACZ,QAAQ;AAAA,UACR;AAAA,UACA;AAAA,QACF,CAAC;AAAA,MACH,SAAS,OAAO;AACd,cAAM,OAAO,6BAA6B,KAAK;AAC/C,eAAO,KAAK,oCAAoC,EAAE,KAAK,OAAO,MAAM,QAAQ,CAAC;AAC7E,eAAO,aAAa,KAAK;AAAA,UACvB,IAAI;AAAA,UACJ,QAAQ;AAAA,UACR,GAAI,SAAS,WACT,EAAE,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,IAClE,CAAC;AAAA,QACP,CAAC;AAAA,MACH;AAEA,oBAAc,6BAAqD,EAAE,KAAK,gBAAgB,CAAC;AAC3F,UAAI,YAAY,GAAI;AACpB,UAAI,YAAY,mCAAoC;AAEpD,wBAAkB;AAClB,aAAO,KAAK,0DAA0D;AAAA,QACpE,QAAQ,YAAY;AAAA,QACpB,cAAc,YAAY,SAAS;AAAA,QACnC,SAAS;AAAA,MACX,CAAC;AACD,eAAS,+BAA+B;AAAA,QACtC,gBAAgB;AAAA,QAChB,eAAe;AAAA,QACf,UAAU,YAAY;AAAA,MACxB,CAAC;AAAA,IACH;AAEA,QAAI,CAAC,eAAe,CAAC,YAAY,IAAI;AACnC,aAAO,aAAa,KAAK;AAAA,QACvB,IAAI;AAAA,QACJ,QAAQ,aAAa,UAAU;AAAA,QAC/B,UAAU,aAAa,YAAY,CAAC;AAAA,QACpC;AAAA,MACF,CAAC;AAAA,IACH;AAEA,UAAM,SAAS,MAAM,iBAAiB,WAAW,YAAY,UAAU;AACvE,UAAM,aAAa,2BAA2B,YAAY,YAAY,EAAE,OAAO,CAAC;AAKhF,WAAO,aAAa,KAAK;AAAA,MACvB,IAAI;AAAA,MACJ,SAAS,YAAY;AAAA,MACrB,YAAY,YAAY;AAAA,MACxB,UAAU,WAAW;AAAA,MACrB,YAAY,WAAW;AAAA,MACvB,cAAc,WAAW;AAAA,IAC3B,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,8CAA8C,EAAE,KAAK,MAAM,CAAC;AACzE,WAAO,aAAa,KAAK,EAAE,OAAO,oCAAoC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,QAAQ,gCAAgC;AAAA,MACvD,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aACE;AAAA,UACF,QAAQ;AAAA,QACV;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,oBAAoB;AAAA,QAChF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,kCAAkC,QAAQ,oBAAoB;AAAA,MAC5F;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * Prompt-to-draft API (spec \u00A79, \"AI-assisted authoring\")\n *\n * Endpoint:\n * - POST /api/workflows/definitions/generate \u2014 natural language \u2192 draft definition\n *\n * ## This route PERSISTS NOTHING\n *\n * That is the whole trust model, and it is stronger than the `enabled: false`\n * row `workflows.create_definition` writes for external agents. There is no\n * `em.persist` on any path here: the generated definition is returned to the\n * Studio, the author reviews it on the canvas, and the ordinary Save + Enable\n * path \u2014 with its optimistic lock, its structural-edit guard and its publish\n * step \u2014 is the only way it ever becomes something the engine can run.\n *\n * ## Refusals are 200s\n *\n * \"No AI provider configured\", \"the model call failed\", \"the model produced\n * something that is not a workflow\" are all NORMAL authoring outcomes the\n * editor renders, exactly like the sibling test-step route's `{ refused: true }`\n * body. They respond 200 with a structured `{ ok: false, reason }` so the\n * surface can say what happened instead of showing a stack trace \u2014 this\n * module's recurring bug class is shipped behaviour that silently does nothing,\n * and a bare 500 is that bug wearing a status code.\n *\n * ## One evaluator\n *\n * The Problems pass is `evaluateWorkflowDefinition` \u2014 the same composer the\n * Studio's Problems panel and the definition API's 400 body come through. The\n * response carries its `problems`, `errorCount` and `warningCount` so the\n * author sees what is wrong with a draft BEFORE deciding to put it on a canvas.\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { zodToJsonSchema } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { getDeclaredEvents } from '@open-mercato/shared/modules/events'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport type { WorkflowDefinitionData } from '../../../data/entities'\nimport {\n  transitionTriggerSchema,\n  workflowDefinitionDataSchema,\n  workflowStepTypeSchema,\n} from '../../../data/validators'\nimport { listActivityTypes } from '../../../lib/activity-registry'\nimport '../../../lib/activity-registry-bootstrap'\nimport {\n  WORKFLOW_DRAFT_AGENT_ID,\n  WORKFLOW_DRAFT_MAX_REPAIR_ATTEMPTS,\n  WORKFLOW_DRAFT_PROMPT_MAX_LENGTH,\n  buildWorkflowDraftCatalog,\n  buildWorkflowDraftPrompt,\n  buildWorkflowDraftRepairPrompt,\n  classifyWorkflowDraftFailure,\n  interpretWorkflowDraftObject,\n  workflowDraftGenerationSchema,\n  type WorkflowDraftInterpretation,\n} from '../../../lib/ai-authoring'\nimport { resolveWorkflowDraftRunner } from '../../../lib/ai-draft-runner'\nimport {\n  computeDefinitionContextLedger,\n  warmContextLedgerResolvers,\n} from '../../../lib/definition-context-schema'\nimport { evaluateWorkflowDefinition } from '../../../lib/definition-evaluation'\nimport { listWorkflowFunctions } from '../../../lib/workflow-function-registry'\nimport { listWorkflowSafeCommands } from '../../../lib/workflow-safe-commands'\nimport { workflowsTag, workflowErrorSchema } from '../../openapi'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\n\nconst logger = createLogger('workflows')\n\nconst DEFINITIONS_CREATE = 'workflows.definitions.create'\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: [DEFINITIONS_CREATE],\n}\n\nconst generateDefinitionRequestSchema = z.object({\n  prompt: z.string().trim().min(1).max(WORKFLOW_DRAFT_PROMPT_MAX_LENGTH),\n})\n\nconst generateDefinitionResponseSchema = z.object({\n  ok: z.boolean(),\n  reason: z.enum(['unavailable', 'failed', 'malformedResponse', 'schemaError']).optional(),\n  message: z.string().optional(),\n  messages: z.array(z.string()).optional(),\n  summary: z.string().optional(),\n  definition: z.record(z.string(), z.unknown()).optional(),\n  problems: z.array(z.record(z.string(), z.unknown())).optional(),\n  errorCount: z.number().int().nonnegative().optional(),\n  warningCount: z.number().int().nonnegative().optional(),\n})\n\ntype DraftAgentBridgeLike = {\n  listAgentOutcomeContracts?: () => Promise<Array<{ agentId?: unknown }>>\n}\n\n/**\n * The agents an `INVOKE_AGENT` draft may target, from the OPTIONAL\n * `agent_orchestrator` peer. Absent peer, missing method, or any failure \u21D2 an\n * empty list, which makes the catalog fail-closed: `buildWorkflowDraftPrompt`\n * then forbids `INVOKE_AGENT` outright rather than letting the model author an\n * agent step with no agent to run.\n */\nasync function resolveDraftAgents(\n  container: Awaited<ReturnType<typeof createRequestContainer>>,\n): Promise<{ id: string }[]> {\n  let bridge: DraftAgentBridgeLike | undefined\n  try {\n    bridge = container.resolve<DraftAgentBridgeLike>('agentWorkflowBridge')\n  } catch {\n    return []\n  }\n  if (!bridge || typeof bridge.listAgentOutcomeContracts !== 'function') return []\n  try {\n    const snapshots = await bridge.listAgentOutcomeContracts()\n    return snapshots\n      .map((snapshot) => (typeof snapshot.agentId === 'string' ? { id: snapshot.agentId } : null))\n      .filter((entry): entry is { id: string } => entry !== null)\n  } catch {\n    return []\n  }\n}\n\n/** Compute the ledger for the generated definition, tolerating a broken graph. */\nasync function tryComputeLedger(\n  container: Awaited<ReturnType<typeof createRequestContainer>>,\n  definition: WorkflowDefinitionData,\n) {\n  try {\n    await warmContextLedgerResolvers(container)\n    return computeDefinitionContextLedger(definition)\n  } catch {\n    return null\n  }\n}\n\nexport async function POST(request: NextRequest) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth || !auth.sub) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n\n    if (!tenantId) {\n      return NextResponse.json({ error: 'Missing tenant context' }, { status: 400 })\n    }\n\n    const rbacService = container.resolve('rbacService') as {\n      userHasAllFeatures: (\n        userId: string,\n        features: string[],\n        scope: { tenantId: string | null; organizationId: string | null },\n      ) => Promise<boolean>\n      loadAcl?: (\n        userId: string,\n        scope: { tenantId: string | null; organizationId: string | null },\n      ) => Promise<{ features: string[]; isSuperAdmin: boolean }>\n    }\n\n    const hasPermission = await rbacService.userHasAllFeatures(auth.sub, [DEFINITIONS_CREATE], {\n      tenantId,\n      organizationId,\n    })\n    if (!hasPermission) {\n      return NextResponse.json({ error: 'Insufficient permissions' }, { status: 403 })\n    }\n\n    const body = await request.json()\n    const validation = generateDefinitionRequestSchema.safeParse(body)\n    if (!validation.success) {\n      return NextResponse.json(\n        { error: 'Validation failed', details: validation.error.issues },\n        { status: 400 },\n      )\n    }\n\n    const runner = await resolveWorkflowDraftRunner()\n    if (!runner) {\n      return NextResponse.json({ ok: false, reason: 'unavailable' })\n    }\n\n    // The catalogs the draft is authored against: the platform's own\n    // registries, never a hand-maintained list that could drift from them.\n    const catalog = buildWorkflowDraftCatalog({\n      stepTypes: workflowStepTypeSchema.options,\n      transitionTriggers: transitionTriggerSchema.options,\n      activityTypes: listActivityTypes().map((entry) => ({\n        id: entry.id,\n        configSchema: zodToJsonSchema(entry.configSchema) ?? undefined,\n      })),\n      commands: listWorkflowSafeCommands().map((entry) => ({ id: entry.commandId })),\n      functions: listWorkflowFunctions().map((entry) => ({\n        name: entry.name,\n        ...(entry.description ? { label: entry.description } : {}),\n      })),\n      events: getDeclaredEvents()\n        .filter((event) => !event.excludeFromTriggers)\n        .map((event) => ({ id: event.id })),\n      agents: await resolveDraftAgents(container),\n    })\n\n    const acl = (await rbacService.loadAcl?.(auth.sub, { tenantId, organizationId })) ?? null\n\n    const authContext = {\n      tenantId,\n      organizationId,\n      userId: auth.sub,\n      features: acl?.features ?? [],\n      isSuperAdmin: acl?.isSuperAdmin ?? false,\n    }\n    const parseDefinition = (value: unknown) => {\n      const parsed = workflowDefinitionDataSchema.safeParse(value)\n      if (parsed.success) return { ok: true as const, definition: parsed.data as WorkflowDefinitionData }\n      return {\n        ok: false as const,\n        messages: parsed.error.issues.map(\n          (issue) => `${issue.path.join('.') || '(root)'}: ${issue.message}`,\n        ),\n      }\n    }\n\n    // Bounded validate-and-repair. The validator's messages are precise enough\n    // to act on, so a rejected draft goes BACK to the model with them rather\n    // than to the human as a dead end. Bounded because an unbounded loop\n    // against a model that cannot fix its own output is just a slower dead end\n    // that costs tokens; after the last attempt the surface reports the final\n    // errors exactly as it always did.\n    let prompt = buildWorkflowDraftPrompt({ prompt: validation.data.prompt, catalog })\n    let interpreted: WorkflowDraftInterpretation<WorkflowDefinitionData> | null = null\n    let repairAttempts = 0\n\n    for (let attempt = 0; attempt <= WORKFLOW_DRAFT_MAX_REPAIR_ATTEMPTS; attempt += 1) {\n      let raw: unknown\n      try {\n        raw = await runner({\n          agentId: WORKFLOW_DRAFT_AGENT_ID,\n          prompt,\n          schemaName: 'WorkflowDraft',\n          schema: workflowDraftGenerationSchema,\n          authContext,\n          container,\n        })\n      } catch (error) {\n        const kind = classifyWorkflowDraftFailure(error)\n        logger.warn('Workflow draft generation failed', { err: error, kind, attempt })\n        return NextResponse.json({\n          ok: false,\n          reason: kind,\n          ...(kind === 'failed'\n            ? { message: error instanceof Error ? error.message : String(error) }\n            : {}),\n        })\n      }\n\n      interpreted = interpretWorkflowDraftObject<WorkflowDefinitionData>({ raw, parseDefinition })\n      if (interpreted.ok) break\n      if (attempt === WORKFLOW_DRAFT_MAX_REPAIR_ATTEMPTS) break\n\n      repairAttempts += 1\n      logger.info('Workflow draft rejected; asking the model to repair it', {\n        reason: interpreted.reason,\n        messageCount: interpreted.messages.length,\n        attempt: repairAttempts,\n      })\n      prompt = buildWorkflowDraftRepairPrompt({\n        previousPrompt: prompt,\n        rejectedDraft: raw,\n        messages: interpreted.messages,\n      })\n    }\n\n    if (!interpreted || !interpreted.ok) {\n      return NextResponse.json({\n        ok: false,\n        reason: interpreted?.reason ?? 'malformedResponse',\n        messages: interpreted?.messages ?? [],\n        repairAttempts,\n      })\n    }\n\n    const ledger = await tryComputeLedger(container, interpreted.definition)\n    const evaluation = evaluateWorkflowDefinition(interpreted.definition, { ledger })\n\n    // Nothing above wrote a row, and nothing below does either \u2014 this route\n    // never resolves an EntityManager, so a future write would be an obvious\n    // diff rather than a quiet line inside an existing block.\n    return NextResponse.json({\n      ok: true,\n      summary: interpreted.summary,\n      definition: interpreted.definition,\n      problems: evaluation.problems,\n      errorCount: evaluation.errorCount,\n      warningCount: evaluation.warningCount,\n    })\n  } catch (error) {\n    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status })\n    logger.error('Error generating workflow definition draft', { err: error })\n    return NextResponse.json({ error: 'Failed to generate workflow draft' }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'Generate a draft workflow definition from a prompt',\n  methods: {\n    POST: {\n      summary: 'Author a draft workflow definition from natural language',\n      description:\n        'Runs the propose-only workflows.workflow_author agent against this installation\\'s activity, command, function and event catalogs and returns a draft definition plus the Problems-panel evaluation for it. Persists nothing: the draft is returned to the Studio for a human to apply, save and enable. Refusals (\"unavailable\" when no AI provider or agent registry is present, \"failed\" when the model call errored, \"malformedResponse\"/\"schemaError\" when the output is not a workflow definition) respond 200 with a structured body.',\n      requestBody: { schema: generateDefinitionRequestSchema },\n      responses: [\n        {\n          status: 200,\n          description:\n            'The generated draft with its Problems-panel evaluation, or a structured refusal',\n          schema: generateDefinitionResponseSchema,\n        },\n        { status: 400, description: 'Invalid request body', schema: workflowErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: workflowErrorSchema },\n        { status: 403, description: 'Insufficient permissions', schema: workflowErrorSchema },\n        { status: 500, description: 'Generation failed unexpectedly', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAiCA,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAElB,SAAS,uBAAuB;AAChC,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,yBAAyB;AAClC,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAElD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,yBAAyB;AAClC,OAAO;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,kCAAkC;AAC3C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,kCAAkC;AAC3C,SAAS,6BAA6B;AACtC,SAAS,gCAAgC;AACzC,SAAS,cAAc,2BAA2B;AAClD,SAAS,uBAAuB;AAEhC,MAAM,SAAS,aAAa,WAAW;AAEvC,MAAM,qBAAqB;AAEpB,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,kBAAkB;AACtC;AAEA,MAAM,kCAAkC,EAAE,OAAO;AAAA,EAC/C,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,gCAAgC;AACvE,CAAC;AAED,MAAM,mCAAmC,EAAE,OAAO;AAAA,EAChD,IAAI,EAAE,QAAQ;AAAA,EACd,QAAQ,EAAE,KAAK,CAAC,eAAe,UAAU,qBAAqB,aAAa,CAAC,EAAE,SAAS;AAAA,EACvF,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACvC,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EACvD,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,SAAS;AAAA,EAC9D,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EACpD,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AACxD,CAAC;AAaD,eAAe,mBACb,WAC2B;AAC3B,MAAI;AACJ,MAAI;AACF,aAAS,UAAU,QAA8B,qBAAqB;AAAA,EACxE,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACA,MAAI,CAAC,UAAU,OAAO,OAAO,8BAA8B,WAAY,QAAO,CAAC;AAC/E,MAAI;AACF,UAAM,YAAY,MAAM,OAAO,0BAA0B;AACzD,WAAO,UACJ,IAAI,CAAC,aAAc,OAAO,SAAS,YAAY,WAAW,EAAE,IAAI,SAAS,QAAQ,IAAI,IAAK,EAC1F,OAAO,CAAC,UAAmC,UAAU,IAAI;AAAA,EAC9D,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAGA,eAAe,iBACb,WACA,YACA;AACA,MAAI;AACF,UAAM,2BAA2B,SAAS;AAC1C,WAAO,+BAA+B,UAAU;AAAA,EAClD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,KAAK,SAAsB;AAC/C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,QAAQ,CAAC,KAAK,KAAK;AACtB,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AAEzE,QAAI,CAAC,UAAU;AACb,aAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/E;AAEA,UAAM,cAAc,UAAU,QAAQ,aAAa;AAYnD,UAAM,gBAAgB,MAAM,YAAY,mBAAmB,KAAK,KAAK,CAAC,kBAAkB,GAAG;AAAA,MACzF;AAAA,MACA;AAAA,IACF,CAAC;AACD,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjF;AAEA,UAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,UAAM,aAAa,gCAAgC,UAAU,IAAI;AACjE,QAAI,CAAC,WAAW,SAAS;AACvB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,qBAAqB,SAAS,WAAW,MAAM,OAAO;AAAA,QAC/D,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,SAAS,MAAM,2BAA2B;AAChD,QAAI,CAAC,QAAQ;AACX,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,QAAQ,cAAc,CAAC;AAAA,IAC/D;AAIA,UAAM,UAAU,0BAA0B;AAAA,MACxC,WAAW,uBAAuB;AAAA,MAClC,oBAAoB,wBAAwB;AAAA,MAC5C,eAAe,kBAAkB,EAAE,IAAI,CAAC,WAAW;AAAA,QACjD,IAAI,MAAM;AAAA,QACV,cAAc,gBAAgB,MAAM,YAAY,KAAK;AAAA,MACvD,EAAE;AAAA,MACF,UAAU,yBAAyB,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,MAAM,UAAU,EAAE;AAAA,MAC7E,WAAW,sBAAsB,EAAE,IAAI,CAAC,WAAW;AAAA,QACjD,MAAM,MAAM;AAAA,QACZ,GAAI,MAAM,cAAc,EAAE,OAAO,MAAM,YAAY,IAAI,CAAC;AAAA,MAC1D,EAAE;AAAA,MACF,QAAQ,kBAAkB,EACvB,OAAO,CAAC,UAAU,CAAC,MAAM,mBAAmB,EAC5C,IAAI,CAAC,WAAW,EAAE,IAAI,MAAM,GAAG,EAAE;AAAA,MACpC,QAAQ,MAAM,mBAAmB,SAAS;AAAA,IAC5C,CAAC;AAED,UAAM,MAAO,MAAM,YAAY,UAAU,KAAK,KAAK,EAAE,UAAU,eAAe,CAAC,KAAM;AAErF,UAAM,cAAc;AAAA,MAClB;AAAA,MACA;AAAA,MACA,QAAQ,KAAK;AAAA,MACb,UAAU,KAAK,YAAY,CAAC;AAAA,MAC5B,cAAc,KAAK,gBAAgB;AAAA,IACrC;AACA,UAAM,kBAAkB,CAAC,UAAmB;AAC1C,YAAM,SAAS,6BAA6B,UAAU,KAAK;AAC3D,UAAI,OAAO,QAAS,QAAO,EAAE,IAAI,MAAe,YAAY,OAAO,KAA+B;AAClG,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,UAAU,OAAO,MAAM,OAAO;AAAA,UAC5B,CAAC,UAAU,GAAG,MAAM,KAAK,KAAK,GAAG,KAAK,QAAQ,KAAK,MAAM,OAAO;AAAA,QAClE;AAAA,MACF;AAAA,IACF;AAQA,QAAI,SAAS,yBAAyB,EAAE,QAAQ,WAAW,KAAK,QAAQ,QAAQ,CAAC;AACjF,QAAI,cAA0E;AAC9E,QAAI,iBAAiB;AAErB,aAAS,UAAU,GAAG,WAAW,oCAAoC,WAAW,GAAG;AACjF,UAAI;AACJ,UAAI;AACF,cAAM,MAAM,OAAO;AAAA,UACjB,SAAS;AAAA,UACT;AAAA,UACA,YAAY;AAAA,UACZ,QAAQ;AAAA,UACR;AAAA,UACA;AAAA,QACF,CAAC;AAAA,MACH,SAAS,OAAO;AACd,cAAM,OAAO,6BAA6B,KAAK;AAC/C,eAAO,KAAK,oCAAoC,EAAE,KAAK,OAAO,MAAM,QAAQ,CAAC;AAC7E,eAAO,aAAa,KAAK;AAAA,UACvB,IAAI;AAAA,UACJ,QAAQ;AAAA,UACR,GAAI,SAAS,WACT,EAAE,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,IAClE,CAAC;AAAA,QACP,CAAC;AAAA,MACH;AAEA,oBAAc,6BAAqD,EAAE,KAAK,gBAAgB,CAAC;AAC3F,UAAI,YAAY,GAAI;AACpB,UAAI,YAAY,mCAAoC;AAEpD,wBAAkB;AAClB,aAAO,KAAK,0DAA0D;AAAA,QACpE,QAAQ,YAAY;AAAA,QACpB,cAAc,YAAY,SAAS;AAAA,QACnC,SAAS;AAAA,MACX,CAAC;AACD,eAAS,+BAA+B;AAAA,QACtC,gBAAgB;AAAA,QAChB,eAAe;AAAA,QACf,UAAU,YAAY;AAAA,MACxB,CAAC;AAAA,IACH;AAEA,QAAI,CAAC,eAAe,CAAC,YAAY,IAAI;AACnC,aAAO,aAAa,KAAK;AAAA,QACvB,IAAI;AAAA,QACJ,QAAQ,aAAa,UAAU;AAAA,QAC/B,UAAU,aAAa,YAAY,CAAC;AAAA,QACpC;AAAA,MACF,CAAC;AAAA,IACH;AAEA,UAAM,SAAS,MAAM,iBAAiB,WAAW,YAAY,UAAU;AACvE,UAAM,aAAa,2BAA2B,YAAY,YAAY,EAAE,OAAO,CAAC;AAKhF,WAAO,aAAa,KAAK;AAAA,MACvB,IAAI;AAAA,MACJ,SAAS,YAAY;AAAA,MACrB,YAAY,YAAY;AAAA,MACxB,UAAU,WAAW;AAAA,MACrB,YAAY,WAAW;AAAA,MACvB,cAAc,WAAW;AAAA,IAC3B,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,EAAG,QAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AACzF,WAAO,MAAM,8CAA8C,EAAE,KAAK,MAAM,CAAC;AACzE,WAAO,aAAa,KAAK,EAAE,OAAO,oCAAoC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,QAAQ,gCAAgC;AAAA,MACvD,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aACE;AAAA,UACF,QAAQ;AAAA,QACV;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,oBAAoB;AAAA,QAChF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,kCAAkC,QAAQ,oBAAoB;AAAA,MAC5F;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/workflows/api/definitions/route.js

@@ -5,7 +5,7 @@ import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { escapeLikePattern } from "@open-mercato/shared/lib/db/escapeLikePattern";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
-import { resolveOrganizationScopeFilter } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
+import { resolveOrganizationScopeFilter, resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { WorkflowDefinition } from "../../data/entities.js";
 import {
   createWorkflowDefinitionInputSchema,
@@ -26,6 +26,7 @@ import {
   syncWorkflowDefinitionPrincipal
 } from "../../lib/definition-grant.js";
 import { createLogger } from "@open-mercato/shared/lib/logger";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 const logger = createLogger("workflows");
 const metadata = {
   requireAuth: true,
@@ -158,7 +159,7 @@ async function POST(request) {
     }
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request });
     const tenantId = auth.tenantId;
-    const organizationId = scope?.selectedId ?? auth.orgId;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth);
     const rbacService = container.resolve("rbacService");
     const hasPermission = await rbacService.userHasAllFeatures(
       auth.sub,
@@ -237,6 +238,7 @@ async function POST(request) {
       { status: 201 }
     );
   } catch (error) {
+    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status });
     if (isWorkflowIdUniqueConstraintError(error)) {
       return NextResponse.json(
         { error: "Workflow definition with this ID already exists" },

package/dist/modules/workflows/api/definitions/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/workflows/api/definitions/route.ts"],
-  "sourcesContent": ["/**\n * Workflow Definitions API\n *\n * Endpoints:\n * - GET /api/workflows/definitions - List workflow definitions\n * - POST /api/workflows/definitions - Create workflow definition\n */\n\nimport { randomUUID } from 'node:crypto'\nimport { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveOrganizationScopeFilter } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { WorkflowDefinition } from '../../data/entities'\nimport {\n  createWorkflowDefinitionInputSchema,\n  createWorkflowDefinitionInputCheckedSchema,\n  type CreateWorkflowDefinitionApiInput,\n} from '../../data/validators'\nimport { serializeWorkflowDefinition, serializeCodeWorkflowDefinition } from './serialize'\nimport {\n  workflowDefinitionListResponseSchema,\n  workflowDefinitionMutationResponseSchema,\n  workflowErrorSchema,\n} from '../openapi'\nimport { invalidateTriggerCache } from '../../lib/event-trigger-service'\nimport { normalizeDefinitionValidationIssues } from '../../lib/definition-error-body'\nimport { getAllCodeWorkflows } from '../../lib/code-registry'\nimport {\n  authorizeWorkflowGrantChange,\n  normalizeGrantedFeatures,\n  syncWorkflowDefinitionPrincipal,\n} from '../../lib/definition-grant'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.view'],\n}\n\n// Post-versioning the unique constraint is (workflow_id, version, tenant_id);\n// the legacy name is still matched so the check survives a partially-migrated DB.\nconst WORKFLOW_ID_TENANT_UNIQUE_CONSTRAINT = 'workflow_definitions_workflow_id_tenant_id_unique'\nconst WORKFLOW_ID_VERSION_TENANT_UNIQUE_CONSTRAINT = 'workflow_definitions_workflow_id_version_tenant_id_unique'\n\nfunction isWorkflowIdUniqueConstraintError(error: unknown): boolean {\n  if (!error || typeof error !== 'object') {\n    return false\n  }\n\n  const value = error as Record<string, unknown>\n  const constraint = value.constraint\n  const code = value.code\n  const message = typeof value.message === 'string' ? value.message : ''\n  const detail = typeof value.detail === 'string' ? value.detail : ''\n\n  if (constraint === WORKFLOW_ID_TENANT_UNIQUE_CONSTRAINT || constraint === WORKFLOW_ID_VERSION_TENANT_UNIQUE_CONSTRAINT) {\n    return true\n  }\n\n  if (code === '23505' && (detail.includes('(workflow_id, tenant_id)') || detail.includes('(workflow_id, version, tenant_id)'))) {\n    return true\n  }\n\n  return message.includes(WORKFLOW_ID_TENANT_UNIQUE_CONSTRAINT) || message.includes(WORKFLOW_ID_VERSION_TENANT_UNIQUE_CONSTRAINT)\n}\n\n/**\n * GET /api/workflows/definitions\n *\n * List workflow definitions with optional filters\n */\nexport async function GET(request: NextRequest) {\n  try {\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const orgFilter = resolveOrganizationScopeFilter(scope, auth)\n\n    const { searchParams } = new URL(request.url)\n    const enabled = searchParams.get('enabled')\n    const workflowId = searchParams.get('workflowId')\n    const search = searchParams.get('search')\n    const kind = searchParams.get('kind')\n    const lifecycle = searchParams.get('lifecycle')\n    const versionParam = searchParams.get('version')\n    const version = versionParam !== null && /^\\d+$/.test(versionParam) ? parseInt(versionParam, 10) : null\n    const limit = parseInt(searchParams.get('limit') || '50')\n    const offset = parseInt(searchParams.get('offset') || '0')\n\n    // Build where clause with tenant scoping\n    const where: any = {\n      tenantId,\n      ...orgFilter.where,\n      deletedAt: null,\n    }\n\n    if (enabled !== null) {\n      where.enabled = enabled === 'true'\n    }\n\n    if (workflowId) {\n      where.workflowId = workflowId\n    }\n\n    if (kind) {\n      where.kind = kind\n    }\n\n    if (lifecycle) {\n      where.lifecycle = lifecycle\n    }\n\n    if (version !== null) {\n      where.version = version\n    }\n\n    if (search) {\n      where.$or = [\n        { workflowId: { $ilike: `%${escapeLikePattern(search)}%` } },\n        { workflowName: { $ilike: `%${escapeLikePattern(search)}%` } },\n      ]\n    }\n\n    // Determine which code workflows are shadowed by a DB row (so we can\n    // exclude them from the code-only list) without loading all DB rows.\n    const enabledFilter = enabled !== null ? enabled === 'true' : null\n    const searchLower = search ? search.toLowerCase() : null\n    const allCodeIds = getAllCodeWorkflows().map((cw) => cw.workflowId)\n    const shadowed = allCodeIds.length > 0\n      ? new Set(\n          (\n            await em.find(\n              WorkflowDefinition,\n              { ...where, workflowId: { $in: allCodeIds } },\n              { fields: ['workflowId'] as const },\n            )\n          ).map((d: WorkflowDefinition) => d.workflowId),\n        )\n      : new Set<string>()\n\n    const codeOnly = getAllCodeWorkflows()\n      .filter((cw) => !shadowed.has(cw.workflowId))\n      .filter((cw) => {\n        // Code-based definitions are always kind=workflow / lifecycle=published.\n        if (kind && kind !== 'workflow') return false\n        if (lifecycle && lifecycle !== 'published') return false\n        if (version !== null && cw.version !== version) return false\n        if (searchLower) {\n          const matches =\n            cw.workflowId.toLowerCase().includes(searchLower) ||\n            cw.workflowName.toLowerCase().includes(searchLower)\n          if (!matches) return false\n        }\n        if (enabledFilter !== null && cw.enabled !== enabledFilter) return false\n        if (workflowId && cw.workflowId !== workflowId) return false\n        return true\n      })\n      .map((cw) => serializeCodeWorkflowDefinition(cw, `code:${cw.workflowId}`))\n\n    const dbCount = await em.count(WorkflowDefinition, where)\n    const total = dbCount + codeOnly.length\n\n    // Fetch only the prefix of DB rows we might need to fill the requested\n    // page after merging with the (already-filtered) code-only list.\n    const dbWindowLimit = offset + limit\n    const dbWindow = dbWindowLimit > 0\n      ? await em.find(WorkflowDefinition, where, {\n          orderBy: { workflowName: 'ASC' },\n          limit: dbWindowLimit,\n        })\n      : []\n\n    const serializedDb = dbWindow.map(serializeWorkflowDefinition)\n\n    const merged = [...serializedDb, ...codeOnly].sort((a, b) =>\n      a.workflowName.localeCompare(b.workflowName),\n    )\n\n    const paginated = merged.slice(offset, offset + limit)\n\n    return NextResponse.json({\n      data: paginated,\n      pagination: {\n        total,\n        limit,\n        offset,\n        hasMore: offset + limit < total,\n      },\n    })\n  } catch (error) {\n    logger.error('Error listing workflow definitions', { err: error })\n    return NextResponse.json(\n      { error: 'Failed to list workflow definitions' },\n      { status: 500 }\n    )\n  }\n}\n\n/**\n * POST /api/workflows/definitions\n *\n * Create a new workflow definition\n */\nexport async function POST(request: NextRequest) {\n  try {\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = scope?.selectedId ?? auth.orgId\n\n    // Check create permission\n    const rbacService = container.resolve('rbacService')\n    const hasPermission = await rbacService.userHasAllFeatures(\n      auth.sub,\n      ['workflows.definitions.create'],\n      {\n        tenantId,\n        organizationId,\n      }\n    )\n\n    if (!hasPermission) {\n      return NextResponse.json(\n        { error: 'Insufficient permissions' },\n        { status: 403 }\n      )\n    }\n\n    const body = await request.json()\n\n    // Validate input\n    const validation = createWorkflowDefinitionInputCheckedSchema.safeParse(body)\n    if (!validation.success) {\n      return NextResponse.json(\n        {\n          error: 'Validation failed',\n          details: normalizeDefinitionValidationIssues(validation.error),\n        },\n        { status: 400 }\n      )\n    }\n\n    const input: CreateWorkflowDefinitionApiInput = validation.data\n\n    // New definitions default to strict interpolation (spec \u00A73.6). The default\n    // lives on the create path only \u2014 a schema-level default would flip\n    // existing lenient definitions on their next full-body update.\n    const definitionData = input.definition.interpolation\n      ? input.definition\n      : { ...input.definition, interpolation: 'strict' as const }\n\n    // Create always mints version 1. A workflowId that already exists (any\n    // version) is a conflict \u2014 new versions are produced via the publish flow,\n    // not by re-creating. orderBy keeps the existence check deterministic now\n    // that multiple versions can coexist.\n    const existing = await em.findOne(WorkflowDefinition, {\n      workflowId: input.workflowId,\n      tenantId,\n    }, { orderBy: { version: 'DESC' } })\n\n    if (existing) {\n      return NextResponse.json(\n        {\n          error: `Workflow definition with ID \"${input.workflowId}\" already exists`,\n        },\n        { status: 409 }\n      )\n    }\n\n    const grantedFeatures = normalizeGrantedFeatures(input.grantedFeatures)\n    const grantFailure = await authorizeWorkflowGrantChange(rbacService, {\n      userId: auth.sub,\n      scope: { tenantId, organizationId },\n      requested: grantedFeatures,\n      current: [],\n    })\n    if (grantFailure) {\n      return NextResponse.json(grantFailure.body, { status: grantFailure.status })\n    }\n\n    // Create workflow definition.\n    //\n    // The PK is minted up front (MikroORM does not generate UUIDs client-side)\n    // so the execution principal \u2014 whose identity key is the definition id \u2014 can\n    // be provisioned BEFORE the row claiming the grant is persisted. A failed\n    // provisioning then leaves no definition pointing at a principal that does\n    // not exist.\n    //\n    // `createdBy` is recorded here for the first time. It was never set on this\n    // path, which silently disabled the definition-author fallback CALL_API and\n    // INVOKE_AGENT rely on for event-triggered runs.\n    const definition = em.create(WorkflowDefinition, {\n      id: randomUUID(),\n      workflowId: input.workflowId,\n      workflowName: input.workflowName,\n      description: input.description,\n      version: input.version,\n      definition: definitionData,\n      metadata: input.metadata,\n      enabled: input.enabled ?? true,\n      grantedFeatures: grantedFeatures.length ? grantedFeatures : null,\n      tenantId,\n      organizationId,\n      createdBy: auth.sub,\n      updatedBy: auth.sub,\n      createdAt: new Date(),\n      updatedAt: new Date(),\n    })\n\n    await syncWorkflowDefinitionPrincipal(container, definition)\n\n    await em.persist(definition).flush()\n\n    // Newly-created embedded triggers must be visible to the wildcard event\n    // subscriber immediately; invalidate the in-memory trigger cache so the\n    // next event reload picks up this definition.\n    if (tenantId) invalidateTriggerCache(tenantId, organizationId ?? undefined)\n\n    return NextResponse.json(\n      {\n        data: serializeWorkflowDefinition(definition),\n        message: 'Workflow definition created successfully',\n      },\n      { status: 201 }\n    )\n  } catch (error) {\n    if (isWorkflowIdUniqueConstraintError(error)) {\n      return NextResponse.json(\n        { error: 'Workflow definition with this ID already exists' },\n        { status: 409 }\n      )\n    }\n\n    logger.error('Error creating workflow definition', { err: error })\n    return NextResponse.json(\n      { error: 'Failed to create workflow definition' },\n      { status: 500 }\n    )\n  }\n}\n\nexport const openApi = {\n  methods: {\n    GET: {\n      summary: 'List workflow definitions',\n      description: 'Get a list of workflow definitions with optional filters. Supports pagination and search.',\n      tags: ['Workflows'],\n      query: createWorkflowDefinitionInputSchema.pick({ workflowId: true }).extend({\n        enabled: z.boolean().optional(),\n        search: z.string().optional(),\n        limit: z.number().int().positive().default(50).optional(),\n        offset: z.number().int().min(0).default(0).optional(),\n      }),\n      responses: [\n        {\n          status: 200,\n          description: 'List of workflow definitions with pagination',\n          schema: workflowDefinitionListResponseSchema,\n          example: {\n            data: [\n              {\n                id: '123e4567-e89b-12d3-a456-426614174000',\n                workflowId: 'checkout-flow',\n                workflowName: 'Checkout Flow',\n                description: 'Complete checkout workflow for processing orders',\n                version: 1,\n                definition: {\n                  steps: [\n                    {\n                      stepId: 'start',\n                      stepName: 'Start',\n                      stepType: 'START',\n                    },\n                    {\n                      stepId: 'validate-cart',\n                      stepName: 'Validate Cart',\n                      stepType: 'AUTOMATED',\n                    },\n                    {\n                      stepId: 'end',\n                      stepName: 'End',\n                      stepType: 'END',\n                    },\n                  ],\n                  transitions: [\n                    {\n                      transitionId: 'start-to-validate',\n                      fromStepId: 'start',\n                      toStepId: 'validate-cart',\n                      trigger: 'auto',\n                    },\n                    {\n                      transitionId: 'validate-to-end',\n                      fromStepId: 'validate-cart',\n                      toStepId: 'end',\n                      trigger: 'auto',\n                    },\n                  ],\n                },\n                enabled: true,\n                tenantId: '123e4567-e89b-12d3-a456-426614174001',\n                organizationId: '123e4567-e89b-12d3-a456-426614174002',\n                createdAt: '2025-12-08T10:00:00.000Z',\n                updatedAt: '2025-12-08T10:00:00.000Z',\n              },\n            ],\n            pagination: {\n              total: 1,\n              limit: 50,\n              offset: 0,\n              hasMore: false,\n            },\n          },\n        },\n      ],\n    },\n    POST: {\n      summary: 'Create workflow definition',\n      description: 'Create a new workflow definition. The definition must include at least START and END steps with at least one transition connecting them.',\n      tags: ['Workflows'],\n      requestBody: {\n        schema: createWorkflowDefinitionInputSchema,\n        example: {\n          workflowId: 'checkout-flow',\n          workflowName: 'Checkout Flow',\n          description: 'Complete checkout workflow for processing orders',\n          version: 1,\n          definition: {\n            steps: [\n              {\n                stepId: 'start',\n                stepName: 'Start',\n                stepType: 'START',\n              },\n              {\n                stepId: 'validate-cart',\n                stepName: 'Validate Cart',\n                stepType: 'AUTOMATED',\n                description: 'Validate cart items and check inventory',\n              },\n              {\n                stepId: 'payment',\n                stepName: 'Process Payment',\n                stepType: 'AUTOMATED',\n                description: 'Charge payment method',\n                retryPolicy: {\n                  maxAttempts: 3,\n                  backoffMs: 1000,\n                },\n              },\n              {\n                stepId: 'end',\n                stepName: 'End',\n                stepType: 'END',\n              },\n            ],\n            transitions: [\n              {\n                transitionId: 'start-to-validate',\n                fromStepId: 'start',\n                toStepId: 'validate-cart',\n                trigger: 'auto',\n              },\n              {\n                transitionId: 'validate-to-payment',\n                fromStepId: 'validate-cart',\n                toStepId: 'payment',\n                trigger: 'auto',\n              },\n              {\n                transitionId: 'payment-to-end',\n                fromStepId: 'payment',\n                toStepId: 'end',\n                trigger: 'auto',\n                activities: [\n                  {\n                    activityName: 'Send Order Confirmation',\n                    activityType: 'SEND_EMAIL',\n                    config: {\n                      to: '{{context.customerEmail}}',\n                      subject: 'Order Confirmation #{{context.orderId}}',\n                      template: 'order_confirmation',\n                    },\n                  },\n                ],\n              },\n            ],\n          },\n          enabled: true,\n        },\n      },\n      responses: [\n        {\n          status: 201,\n          description: 'Workflow definition created successfully',\n          schema: workflowDefinitionMutationResponseSchema,\n          example: {\n            data: {\n              id: '123e4567-e89b-12d3-a456-426614174000',\n              workflowId: 'checkout-flow',\n              workflowName: 'Checkout Flow',\n              description: 'Complete checkout workflow for processing orders',\n              version: 1,\n              definition: {\n                steps: [\n                  { stepId: 'start', stepName: 'Start', stepType: 'START' },\n                  {\n                    stepId: 'validate-cart',\n                    stepName: 'Validate Cart',\n                    stepType: 'AUTOMATED',\n                  },\n                  {\n                    stepId: 'payment',\n                    stepName: 'Process Payment',\n                    stepType: 'AUTOMATED',\n                  },\n                  { stepId: 'end', stepName: 'End', stepType: 'END' },\n                ],\n                transitions: [\n                  {\n                    transitionId: 'start-to-validate',\n                    fromStepId: 'start',\n                    toStepId: 'validate-cart',\n                    trigger: 'auto',\n                  },\n                  {\n                    transitionId: 'validate-to-payment',\n                    fromStepId: 'validate-cart',\n                    toStepId: 'payment',\n                    trigger: 'auto',\n                  },\n                  {\n                    transitionId: 'payment-to-end',\n                    fromStepId: 'payment',\n                    toStepId: 'end',\n                    trigger: 'auto',\n                  },\n                ],\n              },\n              enabled: true,\n              tenantId: '123e4567-e89b-12d3-a456-426614174001',\n              organizationId: '123e4567-e89b-12d3-a456-426614174002',\n              createdAt: '2025-12-08T10:00:00.000Z',\n              updatedAt: '2025-12-08T10:00:00.000Z',\n            },\n            message: 'Workflow definition created successfully',\n          },\n        },\n        {\n          status: 400,\n          description: 'Validation error - invalid workflow structure',\n          schema: workflowErrorSchema,\n          example: {\n            error: 'Validation failed',\n            details: [\n              {\n                path: ['definition', 'steps'],\n                code: 'custom',\n                message: 'Workflow must have at least START and END steps',\n              },\n            ],\n          },\n        },\n        {\n          status: 409,\n          description: 'Conflict - workflow with same ID and version already exists',\n          schema: workflowErrorSchema,\n          example: {\n            error: 'Workflow definition with ID \"checkout-flow\" and version 1 already exists',\n          },\n        },\n      ],\n    },\n  },\n}\n\n"],
-  "mappings": "AAQA,SAAS,kBAAkB;AAC3B,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,yBAAyB;AAClC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,sCAAsC;AAC/C,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP,SAAS,6BAA6B,uCAAuC;AAC7E;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,8BAA8B;AACvC,SAAS,2CAA2C;AACpD,SAAS,2BAA2B;AACpC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,4BAA4B;AAChD;AAIA,MAAM,uCAAuC;AAC7C,MAAM,+CAA+C;AAErD,SAAS,kCAAkC,OAAyB;AAClE,MAAI,CAAC,SAAS,OAAO,UAAU,UAAU;AACvC,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ;AACd,QAAM,aAAa,MAAM;AACzB,QAAM,OAAO,MAAM;AACnB,QAAM,UAAU,OAAO,MAAM,YAAY,WAAW,MAAM,UAAU;AACpE,QAAM,SAAS,OAAO,MAAM,WAAW,WAAW,MAAM,SAAS;AAEjE,MAAI,eAAe,wCAAwC,eAAe,8CAA8C;AACtH,WAAO;AAAA,EACT;AAEA,MAAI,SAAS,YAAY,OAAO,SAAS,0BAA0B,KAAK,OAAO,SAAS,mCAAmC,IAAI;AAC7H,WAAO;AAAA,EACT;AAEA,SAAO,QAAQ,SAAS,oCAAoC,KAAK,QAAQ,SAAS,4CAA4C;AAChI;AAOA,eAAsB,IAAI,SAAsB;AAC9C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,YAAY,+BAA+B,OAAO,IAAI;AAE5D,UAAM,EAAE,aAAa,IAAI,IAAI,IAAI,QAAQ,GAAG;AAC5C,UAAM,UAAU,aAAa,IAAI,SAAS;AAC1C,UAAM,aAAa,aAAa,IAAI,YAAY;AAChD,UAAM,SAAS,aAAa,IAAI,QAAQ;AACxC,UAAM,OAAO,aAAa,IAAI,MAAM;AACpC,UAAM,YAAY,aAAa,IAAI,WAAW;AAC9C,UAAM,eAAe,aAAa,IAAI,SAAS;AAC/C,UAAM,UAAU,iBAAiB,QAAQ,QAAQ,KAAK,YAAY,IAAI,SAAS,cAAc,EAAE,IAAI;AACnG,UAAM,QAAQ,SAAS,aAAa,IAAI,OAAO,KAAK,IAAI;AACxD,UAAM,SAAS,SAAS,aAAa,IAAI,QAAQ,KAAK,GAAG;AAGzD,UAAM,QAAa;AAAA,MACjB;AAAA,MACA,GAAG,UAAU;AAAA,MACb,WAAW;AAAA,IACb;AAEA,QAAI,YAAY,MAAM;AACpB,YAAM,UAAU,YAAY;AAAA,IAC9B;AAEA,QAAI,YAAY;AACd,YAAM,aAAa;AAAA,IACrB;AAEA,QAAI,MAAM;AACR,YAAM,OAAO;AAAA,IACf;AAEA,QAAI,WAAW;AACb,YAAM,YAAY;AAAA,IACpB;AAEA,QAAI,YAAY,MAAM;AACpB,YAAM,UAAU;AAAA,IAClB;AAEA,QAAI,QAAQ;AACV,YAAM,MAAM;AAAA,QACV,EAAE,YAAY,EAAE,QAAQ,IAAI,kBAAkB,MAAM,CAAC,IAAI,EAAE;AAAA,QAC3D,EAAE,cAAc,EAAE,QAAQ,IAAI,kBAAkB,MAAM,CAAC,IAAI,EAAE;AAAA,MAC/D;AAAA,IACF;AAIA,UAAM,gBAAgB,YAAY,OAAO,YAAY,SAAS;AAC9D,UAAM,cAAc,SAAS,OAAO,YAAY,IAAI;AACpD,UAAM,aAAa,oBAAoB,EAAE,IAAI,CAAC,OAAO,GAAG,UAAU;AAClE,UAAM,WAAW,WAAW,SAAS,IACjC,IAAI;AAAA,OAEA,MAAM,GAAG;AAAA,QACP;AAAA,QACA,EAAE,GAAG,OAAO,YAAY,EAAE,KAAK,WAAW,EAAE;AAAA,QAC5C,EAAE,QAAQ,CAAC,YAAY,EAAW;AAAA,MACpC,GACA,IAAI,CAAC,MAA0B,EAAE,UAAU;AAAA,IAC/C,IACA,oBAAI,IAAY;AAEpB,UAAM,WAAW,oBAAoB,EAClC,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,GAAG,UAAU,CAAC,EAC3C,OAAO,CAAC,OAAO;AAEd,UAAI,QAAQ,SAAS,WAAY,QAAO;AACxC,UAAI,aAAa,cAAc,YAAa,QAAO;AACnD,UAAI,YAAY,QAAQ,GAAG,YAAY,QAAS,QAAO;AACvD,UAAI,aAAa;AACf,cAAM,UACJ,GAAG,WAAW,YAAY,EAAE,SAAS,WAAW,KAChD,GAAG,aAAa,YAAY,EAAE,SAAS,WAAW;AACpD,YAAI,CAAC,QAAS,QAAO;AAAA,MACvB;AACA,UAAI,kBAAkB,QAAQ,GAAG,YAAY,cAAe,QAAO;AACnE,UAAI,cAAc,GAAG,eAAe,WAAY,QAAO;AACvD,aAAO;AAAA,IACT,CAAC,EACA,IAAI,CAAC,OAAO,gCAAgC,IAAI,QAAQ,GAAG,UAAU,EAAE,CAAC;AAE3E,UAAM,UAAU,MAAM,GAAG,MAAM,oBAAoB,KAAK;AACxD,UAAM,QAAQ,UAAU,SAAS;AAIjC,UAAM,gBAAgB,SAAS;AAC/B,UAAM,WAAW,gBAAgB,IAC7B,MAAM,GAAG,KAAK,oBAAoB,OAAO;AAAA,MACvC,SAAS,EAAE,cAAc,MAAM;AAAA,MAC/B,OAAO;AAAA,IACT,CAAC,IACD,CAAC;AAEL,UAAM,eAAe,SAAS,IAAI,2BAA2B;AAE7D,UAAM,SAAS,CAAC,GAAG,cAAc,GAAG,QAAQ,EAAE;AAAA,MAAK,CAAC,GAAG,MACrD,EAAE,aAAa,cAAc,EAAE,YAAY;AAAA,IAC7C;AAEA,UAAM,YAAY,OAAO,MAAM,QAAQ,SAAS,KAAK;AAErD,WAAO,aAAa,KAAK;AAAA,MACvB,MAAM;AAAA,MACN,YAAY;AAAA,QACV;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS,SAAS,QAAQ;AAAA,MAC5B;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,sCAAsC,EAAE,KAAK,MAAM,CAAC;AACjE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,sCAAsC;AAAA,MAC/C,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAOA,eAAsB,KAAK,SAAsB;AAC/C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,cAAc,KAAK;AAGjD,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,UAAM,gBAAgB,MAAM,YAAY;AAAA,MACtC,KAAK;AAAA,MACL,CAAC,8BAA8B;AAAA,MAC/B;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,2BAA2B;AAAA,QACpC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,OAAO,MAAM,QAAQ,KAAK;AAGhC,UAAM,aAAa,2CAA2C,UAAU,IAAI;AAC5E,QAAI,CAAC,WAAW,SAAS;AACvB,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO;AAAA,UACP,SAAS,oCAAoC,WAAW,KAAK;AAAA,QAC/D;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,QAA0C,WAAW;AAK3D,UAAM,iBAAiB,MAAM,WAAW,gBACpC,MAAM,aACN,EAAE,GAAG,MAAM,YAAY,eAAe,SAAkB;AAM5D,UAAM,WAAW,MAAM,GAAG,QAAQ,oBAAoB;AAAA,MACpD,YAAY,MAAM;AAAA,MAClB;AAAA,IACF,GAAG,EAAE,SAAS,EAAE,SAAS,OAAO,EAAE,CAAC;AAEnC,QAAI,UAAU;AACZ,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO,gCAAgC,MAAM,UAAU;AAAA,QACzD;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,kBAAkB,yBAAyB,MAAM,eAAe;AACtE,UAAM,eAAe,MAAM,6BAA6B,aAAa;AAAA,MACnE,QAAQ,KAAK;AAAA,MACb,OAAO,EAAE,UAAU,eAAe;AAAA,MAClC,WAAW;AAAA,MACX,SAAS,CAAC;AAAA,IACZ,CAAC;AACD,QAAI,cAAc;AAChB,aAAO,aAAa,KAAK,aAAa,MAAM,EAAE,QAAQ,aAAa,OAAO,CAAC;AAAA,IAC7E;AAaA,UAAM,aAAa,GAAG,OAAO,oBAAoB;AAAA,MAC/C,IAAI,WAAW;AAAA,MACf,YAAY,MAAM;AAAA,MAClB,cAAc,MAAM;AAAA,MACpB,aAAa,MAAM;AAAA,MACnB,SAAS,MAAM;AAAA,MACf,YAAY;AAAA,MACZ,UAAU,MAAM;AAAA,MAChB,SAAS,MAAM,WAAW;AAAA,MAC1B,iBAAiB,gBAAgB,SAAS,kBAAkB;AAAA,MAC5D;AAAA,MACA;AAAA,MACA,WAAW,KAAK;AAAA,MAChB,WAAW,KAAK;AAAA,MAChB,WAAW,oBAAI,KAAK;AAAA,MACpB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AAED,UAAM,gCAAgC,WAAW,UAAU;AAE3D,UAAM,GAAG,QAAQ,UAAU,EAAE,MAAM;AAKnC,QAAI,SAAU,wBAAuB,UAAU,kBAAkB,MAAS;AAE1E,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,MAAM,4BAA4B,UAAU;AAAA,QAC5C,SAAS;AAAA,MACX;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF,SAAS,OAAO;AACd,QAAI,kCAAkC,KAAK,GAAG;AAC5C,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,kDAAkD;AAAA,QAC3D,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,WAAO,MAAM,sCAAsC,EAAE,KAAK,MAAM,CAAC;AACjE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,uCAAuC;AAAA,MAChD,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,MAAM,CAAC,WAAW;AAAA,MAClB,OAAO,oCAAoC,KAAK,EAAE,YAAY,KAAK,CAAC,EAAE,OAAO;AAAA,QAC3E,SAAS,EAAE,QAAQ,EAAE,SAAS;AAAA,QAC9B,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,QAC5B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,SAAS;AAAA,QACxD,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,MACtD,CAAC;AAAA,MACD,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,MAAM;AAAA,cACJ;AAAA,gBACE,IAAI;AAAA,gBACJ,YAAY;AAAA,gBACZ,cAAc;AAAA,gBACd,aAAa;AAAA,gBACb,SAAS;AAAA,gBACT,YAAY;AAAA,kBACV,OAAO;AAAA,oBACL;AAAA,sBACE,QAAQ;AAAA,sBACR,UAAU;AAAA,sBACV,UAAU;AAAA,oBACZ;AAAA,oBACA;AAAA,sBACE,QAAQ;AAAA,sBACR,UAAU;AAAA,sBACV,UAAU;AAAA,oBACZ;AAAA,oBACA;AAAA,sBACE,QAAQ;AAAA,sBACR,UAAU;AAAA,sBACV,UAAU;AAAA,oBACZ;AAAA,kBACF;AAAA,kBACA,aAAa;AAAA,oBACX;AAAA,sBACE,cAAc;AAAA,sBACd,YAAY;AAAA,sBACZ,UAAU;AAAA,sBACV,SAAS;AAAA,oBACX;AAAA,oBACA;AAAA,sBACE,cAAc;AAAA,sBACd,YAAY;AAAA,sBACZ,UAAU;AAAA,sBACV,SAAS;AAAA,oBACX;AAAA,kBACF;AAAA,gBACF;AAAA,gBACA,SAAS;AAAA,gBACT,UAAU;AAAA,gBACV,gBAAgB;AAAA,gBAChB,WAAW;AAAA,gBACX,WAAW;AAAA,cACb;AAAA,YACF;AAAA,YACA,YAAY;AAAA,cACV,OAAO;AAAA,cACP,OAAO;AAAA,cACP,QAAQ;AAAA,cACR,SAAS;AAAA,YACX;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,MAAM,CAAC,WAAW;AAAA,MAClB,aAAa;AAAA,QACX,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,aAAa;AAAA,UACb,SAAS;AAAA,UACT,YAAY;AAAA,YACV,OAAO;AAAA,cACL;AAAA,gBACE,QAAQ;AAAA,gBACR,UAAU;AAAA,gBACV,UAAU;AAAA,cACZ;AAAA,cACA;AAAA,gBACE,QAAQ;AAAA,gBACR,UAAU;AAAA,gBACV,UAAU;AAAA,gBACV,aAAa;AAAA,cACf;AAAA,cACA;AAAA,gBACE,QAAQ;AAAA,gBACR,UAAU;AAAA,gBACV,UAAU;AAAA,gBACV,aAAa;AAAA,gBACb,aAAa;AAAA,kBACX,aAAa;AAAA,kBACb,WAAW;AAAA,gBACb;AAAA,cACF;AAAA,cACA;AAAA,gBACE,QAAQ;AAAA,gBACR,UAAU;AAAA,gBACV,UAAU;AAAA,cACZ;AAAA,YACF;AAAA,YACA,aAAa;AAAA,cACX;AAAA,gBACE,cAAc;AAAA,gBACd,YAAY;AAAA,gBACZ,UAAU;AAAA,gBACV,SAAS;AAAA,cACX;AAAA,cACA;AAAA,gBACE,cAAc;AAAA,gBACd,YAAY;AAAA,gBACZ,UAAU;AAAA,gBACV,SAAS;AAAA,cACX;AAAA,cACA;AAAA,gBACE,cAAc;AAAA,gBACd,YAAY;AAAA,gBACZ,UAAU;AAAA,gBACV,SAAS;AAAA,gBACT,YAAY;AAAA,kBACV;AAAA,oBACE,cAAc;AAAA,oBACd,cAAc;AAAA,oBACd,QAAQ;AAAA,sBACN,IAAI;AAAA,sBACJ,SAAS;AAAA,sBACT,UAAU;AAAA,oBACZ;AAAA,kBACF;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,UACA,SAAS;AAAA,QACX;AAAA,MACF;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,MAAM;AAAA,cACJ,IAAI;AAAA,cACJ,YAAY;AAAA,cACZ,cAAc;AAAA,cACd,aAAa;AAAA,cACb,SAAS;AAAA,cACT,YAAY;AAAA,gBACV,OAAO;AAAA,kBACL,EAAE,QAAQ,SAAS,UAAU,SAAS,UAAU,QAAQ;AAAA,kBACxD;AAAA,oBACE,QAAQ;AAAA,oBACR,UAAU;AAAA,oBACV,UAAU;AAAA,kBACZ;AAAA,kBACA;AAAA,oBACE,QAAQ;AAAA,oBACR,UAAU;AAAA,oBACV,UAAU;AAAA,kBACZ;AAAA,kBACA,EAAE,QAAQ,OAAO,UAAU,OAAO,UAAU,MAAM;AAAA,gBACpD;AAAA,gBACA,aAAa;AAAA,kBACX;AAAA,oBACE,cAAc;AAAA,oBACd,YAAY;AAAA,oBACZ,UAAU;AAAA,oBACV,SAAS;AAAA,kBACX;AAAA,kBACA;AAAA,oBACE,cAAc;AAAA,oBACd,YAAY;AAAA,oBACZ,UAAU;AAAA,oBACV,SAAS;AAAA,kBACX;AAAA,kBACA;AAAA,oBACE,cAAc;AAAA,oBACd,YAAY;AAAA,oBACZ,UAAU;AAAA,oBACV,SAAS;AAAA,kBACX;AAAA,gBACF;AAAA,cACF;AAAA,cACA,SAAS;AAAA,cACT,UAAU;AAAA,cACV,gBAAgB;AAAA,cAChB,WAAW;AAAA,cACX,WAAW;AAAA,YACb;AAAA,YACA,SAAS;AAAA,UACX;AAAA,QACF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,OAAO;AAAA,YACP,SAAS;AAAA,cACP;AAAA,gBACE,MAAM,CAAC,cAAc,OAAO;AAAA,gBAC5B,MAAM;AAAA,gBACN,SAAS;AAAA,cACX;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,OAAO;AAAA,UACT;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * Workflow Definitions API\n *\n * Endpoints:\n * - GET /api/workflows/definitions - List workflow definitions\n * - POST /api/workflows/definitions - Create workflow definition\n */\n\nimport { randomUUID } from 'node:crypto'\nimport { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveOrganizationScopeFilter, resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { WorkflowDefinition } from '../../data/entities'\nimport {\n  createWorkflowDefinitionInputSchema,\n  createWorkflowDefinitionInputCheckedSchema,\n  type CreateWorkflowDefinitionApiInput,\n} from '../../data/validators'\nimport { serializeWorkflowDefinition, serializeCodeWorkflowDefinition } from './serialize'\nimport {\n  workflowDefinitionListResponseSchema,\n  workflowDefinitionMutationResponseSchema,\n  workflowErrorSchema,\n} from '../openapi'\nimport { invalidateTriggerCache } from '../../lib/event-trigger-service'\nimport { normalizeDefinitionValidationIssues } from '../../lib/definition-error-body'\nimport { getAllCodeWorkflows } from '../../lib/code-registry'\nimport {\n  authorizeWorkflowGrantChange,\n  normalizeGrantedFeatures,\n  syncWorkflowDefinitionPrincipal,\n} from '../../lib/definition-grant'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.view'],\n}\n\n// Post-versioning the unique constraint is (workflow_id, version, tenant_id);\n// the legacy name is still matched so the check survives a partially-migrated DB.\nconst WORKFLOW_ID_TENANT_UNIQUE_CONSTRAINT = 'workflow_definitions_workflow_id_tenant_id_unique'\nconst WORKFLOW_ID_VERSION_TENANT_UNIQUE_CONSTRAINT = 'workflow_definitions_workflow_id_version_tenant_id_unique'\n\nfunction isWorkflowIdUniqueConstraintError(error: unknown): boolean {\n  if (!error || typeof error !== 'object') {\n    return false\n  }\n\n  const value = error as Record<string, unknown>\n  const constraint = value.constraint\n  const code = value.code\n  const message = typeof value.message === 'string' ? value.message : ''\n  const detail = typeof value.detail === 'string' ? value.detail : ''\n\n  if (constraint === WORKFLOW_ID_TENANT_UNIQUE_CONSTRAINT || constraint === WORKFLOW_ID_VERSION_TENANT_UNIQUE_CONSTRAINT) {\n    return true\n  }\n\n  if (code === '23505' && (detail.includes('(workflow_id, tenant_id)') || detail.includes('(workflow_id, version, tenant_id)'))) {\n    return true\n  }\n\n  return message.includes(WORKFLOW_ID_TENANT_UNIQUE_CONSTRAINT) || message.includes(WORKFLOW_ID_VERSION_TENANT_UNIQUE_CONSTRAINT)\n}\n\n/**\n * GET /api/workflows/definitions\n *\n * List workflow definitions with optional filters\n */\nexport async function GET(request: NextRequest) {\n  try {\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const orgFilter = resolveOrganizationScopeFilter(scope, auth)\n\n    const { searchParams } = new URL(request.url)\n    const enabled = searchParams.get('enabled')\n    const workflowId = searchParams.get('workflowId')\n    const search = searchParams.get('search')\n    const kind = searchParams.get('kind')\n    const lifecycle = searchParams.get('lifecycle')\n    const versionParam = searchParams.get('version')\n    const version = versionParam !== null && /^\\d+$/.test(versionParam) ? parseInt(versionParam, 10) : null\n    const limit = parseInt(searchParams.get('limit') || '50')\n    const offset = parseInt(searchParams.get('offset') || '0')\n\n    // Build where clause with tenant scoping\n    const where: any = {\n      tenantId,\n      ...orgFilter.where,\n      deletedAt: null,\n    }\n\n    if (enabled !== null) {\n      where.enabled = enabled === 'true'\n    }\n\n    if (workflowId) {\n      where.workflowId = workflowId\n    }\n\n    if (kind) {\n      where.kind = kind\n    }\n\n    if (lifecycle) {\n      where.lifecycle = lifecycle\n    }\n\n    if (version !== null) {\n      where.version = version\n    }\n\n    if (search) {\n      where.$or = [\n        { workflowId: { $ilike: `%${escapeLikePattern(search)}%` } },\n        { workflowName: { $ilike: `%${escapeLikePattern(search)}%` } },\n      ]\n    }\n\n    // Determine which code workflows are shadowed by a DB row (so we can\n    // exclude them from the code-only list) without loading all DB rows.\n    const enabledFilter = enabled !== null ? enabled === 'true' : null\n    const searchLower = search ? search.toLowerCase() : null\n    const allCodeIds = getAllCodeWorkflows().map((cw) => cw.workflowId)\n    const shadowed = allCodeIds.length > 0\n      ? new Set(\n          (\n            await em.find(\n              WorkflowDefinition,\n              { ...where, workflowId: { $in: allCodeIds } },\n              { fields: ['workflowId'] as const },\n            )\n          ).map((d: WorkflowDefinition) => d.workflowId),\n        )\n      : new Set<string>()\n\n    const codeOnly = getAllCodeWorkflows()\n      .filter((cw) => !shadowed.has(cw.workflowId))\n      .filter((cw) => {\n        // Code-based definitions are always kind=workflow / lifecycle=published.\n        if (kind && kind !== 'workflow') return false\n        if (lifecycle && lifecycle !== 'published') return false\n        if (version !== null && cw.version !== version) return false\n        if (searchLower) {\n          const matches =\n            cw.workflowId.toLowerCase().includes(searchLower) ||\n            cw.workflowName.toLowerCase().includes(searchLower)\n          if (!matches) return false\n        }\n        if (enabledFilter !== null && cw.enabled !== enabledFilter) return false\n        if (workflowId && cw.workflowId !== workflowId) return false\n        return true\n      })\n      .map((cw) => serializeCodeWorkflowDefinition(cw, `code:${cw.workflowId}`))\n\n    const dbCount = await em.count(WorkflowDefinition, where)\n    const total = dbCount + codeOnly.length\n\n    // Fetch only the prefix of DB rows we might need to fill the requested\n    // page after merging with the (already-filtered) code-only list.\n    const dbWindowLimit = offset + limit\n    const dbWindow = dbWindowLimit > 0\n      ? await em.find(WorkflowDefinition, where, {\n          orderBy: { workflowName: 'ASC' },\n          limit: dbWindowLimit,\n        })\n      : []\n\n    const serializedDb = dbWindow.map(serializeWorkflowDefinition)\n\n    const merged = [...serializedDb, ...codeOnly].sort((a, b) =>\n      a.workflowName.localeCompare(b.workflowName),\n    )\n\n    const paginated = merged.slice(offset, offset + limit)\n\n    return NextResponse.json({\n      data: paginated,\n      pagination: {\n        total,\n        limit,\n        offset,\n        hasMore: offset + limit < total,\n      },\n    })\n  } catch (error) {\n    logger.error('Error listing workflow definitions', { err: error })\n    return NextResponse.json(\n      { error: 'Failed to list workflow definitions' },\n      { status: 500 }\n    )\n  }\n}\n\n/**\n * POST /api/workflows/definitions\n *\n * Create a new workflow definition\n */\nexport async function POST(request: NextRequest) {\n  try {\n    const container = await createRequestContainer()\n    const em = container.resolve('em')\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth)\n\n    // Check create permission\n    const rbacService = container.resolve('rbacService')\n    const hasPermission = await rbacService.userHasAllFeatures(\n      auth.sub,\n      ['workflows.definitions.create'],\n      {\n        tenantId,\n        organizationId,\n      }\n    )\n\n    if (!hasPermission) {\n      return NextResponse.json(\n        { error: 'Insufficient permissions' },\n        { status: 403 }\n      )\n    }\n\n    const body = await request.json()\n\n    // Validate input\n    const validation = createWorkflowDefinitionInputCheckedSchema.safeParse(body)\n    if (!validation.success) {\n      return NextResponse.json(\n        {\n          error: 'Validation failed',\n          details: normalizeDefinitionValidationIssues(validation.error),\n        },\n        { status: 400 }\n      )\n    }\n\n    const input: CreateWorkflowDefinitionApiInput = validation.data\n\n    // New definitions default to strict interpolation (spec \u00A73.6). The default\n    // lives on the create path only \u2014 a schema-level default would flip\n    // existing lenient definitions on their next full-body update.\n    const definitionData = input.definition.interpolation\n      ? input.definition\n      : { ...input.definition, interpolation: 'strict' as const }\n\n    // Create always mints version 1. A workflowId that already exists (any\n    // version) is a conflict \u2014 new versions are produced via the publish flow,\n    // not by re-creating. orderBy keeps the existence check deterministic now\n    // that multiple versions can coexist.\n    const existing = await em.findOne(WorkflowDefinition, {\n      workflowId: input.workflowId,\n      tenantId,\n    }, { orderBy: { version: 'DESC' } })\n\n    if (existing) {\n      return NextResponse.json(\n        {\n          error: `Workflow definition with ID \"${input.workflowId}\" already exists`,\n        },\n        { status: 409 }\n      )\n    }\n\n    const grantedFeatures = normalizeGrantedFeatures(input.grantedFeatures)\n    const grantFailure = await authorizeWorkflowGrantChange(rbacService, {\n      userId: auth.sub,\n      scope: { tenantId, organizationId },\n      requested: grantedFeatures,\n      current: [],\n    })\n    if (grantFailure) {\n      return NextResponse.json(grantFailure.body, { status: grantFailure.status })\n    }\n\n    // Create workflow definition.\n    //\n    // The PK is minted up front (MikroORM does not generate UUIDs client-side)\n    // so the execution principal \u2014 whose identity key is the definition id \u2014 can\n    // be provisioned BEFORE the row claiming the grant is persisted. A failed\n    // provisioning then leaves no definition pointing at a principal that does\n    // not exist.\n    //\n    // `createdBy` is recorded here for the first time. It was never set on this\n    // path, which silently disabled the definition-author fallback CALL_API and\n    // INVOKE_AGENT rely on for event-triggered runs.\n    const definition = em.create(WorkflowDefinition, {\n      id: randomUUID(),\n      workflowId: input.workflowId,\n      workflowName: input.workflowName,\n      description: input.description,\n      version: input.version,\n      definition: definitionData,\n      metadata: input.metadata,\n      enabled: input.enabled ?? true,\n      grantedFeatures: grantedFeatures.length ? grantedFeatures : null,\n      tenantId,\n      organizationId,\n      createdBy: auth.sub,\n      updatedBy: auth.sub,\n      createdAt: new Date(),\n      updatedAt: new Date(),\n    })\n\n    await syncWorkflowDefinitionPrincipal(container, definition)\n\n    await em.persist(definition).flush()\n\n    // Newly-created embedded triggers must be visible to the wildcard event\n    // subscriber immediately; invalidate the in-memory trigger cache so the\n    // next event reload picks up this definition.\n    if (tenantId) invalidateTriggerCache(tenantId, organizationId ?? undefined)\n\n    return NextResponse.json(\n      {\n        data: serializeWorkflowDefinition(definition),\n        message: 'Workflow definition created successfully',\n      },\n      { status: 201 }\n    )\n  } catch (error) {\n    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status })\n    if (isWorkflowIdUniqueConstraintError(error)) {\n      return NextResponse.json(\n        { error: 'Workflow definition with this ID already exists' },\n        { status: 409 }\n      )\n    }\n\n    logger.error('Error creating workflow definition', { err: error })\n    return NextResponse.json(\n      { error: 'Failed to create workflow definition' },\n      { status: 500 }\n    )\n  }\n}\n\nexport const openApi = {\n  methods: {\n    GET: {\n      summary: 'List workflow definitions',\n      description: 'Get a list of workflow definitions with optional filters. Supports pagination and search.',\n      tags: ['Workflows'],\n      query: createWorkflowDefinitionInputSchema.pick({ workflowId: true }).extend({\n        enabled: z.boolean().optional(),\n        search: z.string().optional(),\n        limit: z.number().int().positive().default(50).optional(),\n        offset: z.number().int().min(0).default(0).optional(),\n      }),\n      responses: [\n        {\n          status: 200,\n          description: 'List of workflow definitions with pagination',\n          schema: workflowDefinitionListResponseSchema,\n          example: {\n            data: [\n              {\n                id: '123e4567-e89b-12d3-a456-426614174000',\n                workflowId: 'checkout-flow',\n                workflowName: 'Checkout Flow',\n                description: 'Complete checkout workflow for processing orders',\n                version: 1,\n                definition: {\n                  steps: [\n                    {\n                      stepId: 'start',\n                      stepName: 'Start',\n                      stepType: 'START',\n                    },\n                    {\n                      stepId: 'validate-cart',\n                      stepName: 'Validate Cart',\n                      stepType: 'AUTOMATED',\n                    },\n                    {\n                      stepId: 'end',\n                      stepName: 'End',\n                      stepType: 'END',\n                    },\n                  ],\n                  transitions: [\n                    {\n                      transitionId: 'start-to-validate',\n                      fromStepId: 'start',\n                      toStepId: 'validate-cart',\n                      trigger: 'auto',\n                    },\n                    {\n                      transitionId: 'validate-to-end',\n                      fromStepId: 'validate-cart',\n                      toStepId: 'end',\n                      trigger: 'auto',\n                    },\n                  ],\n                },\n                enabled: true,\n                tenantId: '123e4567-e89b-12d3-a456-426614174001',\n                organizationId: '123e4567-e89b-12d3-a456-426614174002',\n                createdAt: '2025-12-08T10:00:00.000Z',\n                updatedAt: '2025-12-08T10:00:00.000Z',\n              },\n            ],\n            pagination: {\n              total: 1,\n              limit: 50,\n              offset: 0,\n              hasMore: false,\n            },\n          },\n        },\n      ],\n    },\n    POST: {\n      summary: 'Create workflow definition',\n      description: 'Create a new workflow definition. The definition must include at least START and END steps with at least one transition connecting them.',\n      tags: ['Workflows'],\n      requestBody: {\n        schema: createWorkflowDefinitionInputSchema,\n        example: {\n          workflowId: 'checkout-flow',\n          workflowName: 'Checkout Flow',\n          description: 'Complete checkout workflow for processing orders',\n          version: 1,\n          definition: {\n            steps: [\n              {\n                stepId: 'start',\n                stepName: 'Start',\n                stepType: 'START',\n              },\n              {\n                stepId: 'validate-cart',\n                stepName: 'Validate Cart',\n                stepType: 'AUTOMATED',\n                description: 'Validate cart items and check inventory',\n              },\n              {\n                stepId: 'payment',\n                stepName: 'Process Payment',\n                stepType: 'AUTOMATED',\n                description: 'Charge payment method',\n                retryPolicy: {\n                  maxAttempts: 3,\n                  backoffMs: 1000,\n                },\n              },\n              {\n                stepId: 'end',\n                stepName: 'End',\n                stepType: 'END',\n              },\n            ],\n            transitions: [\n              {\n                transitionId: 'start-to-validate',\n                fromStepId: 'start',\n                toStepId: 'validate-cart',\n                trigger: 'auto',\n              },\n              {\n                transitionId: 'validate-to-payment',\n                fromStepId: 'validate-cart',\n                toStepId: 'payment',\n                trigger: 'auto',\n              },\n              {\n                transitionId: 'payment-to-end',\n                fromStepId: 'payment',\n                toStepId: 'end',\n                trigger: 'auto',\n                activities: [\n                  {\n                    activityName: 'Send Order Confirmation',\n                    activityType: 'SEND_EMAIL',\n                    config: {\n                      to: '{{context.customerEmail}}',\n                      subject: 'Order Confirmation #{{context.orderId}}',\n                      template: 'order_confirmation',\n                    },\n                  },\n                ],\n              },\n            ],\n          },\n          enabled: true,\n        },\n      },\n      responses: [\n        {\n          status: 201,\n          description: 'Workflow definition created successfully',\n          schema: workflowDefinitionMutationResponseSchema,\n          example: {\n            data: {\n              id: '123e4567-e89b-12d3-a456-426614174000',\n              workflowId: 'checkout-flow',\n              workflowName: 'Checkout Flow',\n              description: 'Complete checkout workflow for processing orders',\n              version: 1,\n              definition: {\n                steps: [\n                  { stepId: 'start', stepName: 'Start', stepType: 'START' },\n                  {\n                    stepId: 'validate-cart',\n                    stepName: 'Validate Cart',\n                    stepType: 'AUTOMATED',\n                  },\n                  {\n                    stepId: 'payment',\n                    stepName: 'Process Payment',\n                    stepType: 'AUTOMATED',\n                  },\n                  { stepId: 'end', stepName: 'End', stepType: 'END' },\n                ],\n                transitions: [\n                  {\n                    transitionId: 'start-to-validate',\n                    fromStepId: 'start',\n                    toStepId: 'validate-cart',\n                    trigger: 'auto',\n                  },\n                  {\n                    transitionId: 'validate-to-payment',\n                    fromStepId: 'validate-cart',\n                    toStepId: 'payment',\n                    trigger: 'auto',\n                  },\n                  {\n                    transitionId: 'payment-to-end',\n                    fromStepId: 'payment',\n                    toStepId: 'end',\n                    trigger: 'auto',\n                  },\n                ],\n              },\n              enabled: true,\n              tenantId: '123e4567-e89b-12d3-a456-426614174001',\n              organizationId: '123e4567-e89b-12d3-a456-426614174002',\n              createdAt: '2025-12-08T10:00:00.000Z',\n              updatedAt: '2025-12-08T10:00:00.000Z',\n            },\n            message: 'Workflow definition created successfully',\n          },\n        },\n        {\n          status: 400,\n          description: 'Validation error - invalid workflow structure',\n          schema: workflowErrorSchema,\n          example: {\n            error: 'Validation failed',\n            details: [\n              {\n                path: ['definition', 'steps'],\n                code: 'custom',\n                message: 'Workflow must have at least START and END steps',\n              },\n            ],\n          },\n        },\n        {\n          status: 409,\n          description: 'Conflict - workflow with same ID and version already exists',\n          schema: workflowErrorSchema,\n          example: {\n            error: 'Workflow definition with ID \"checkout-flow\" and version 1 already exists',\n          },\n        },\n      ],\n    },\n  },\n}\n\n"],
+  "mappings": "AAQA,SAAS,kBAAkB;AAC3B,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,yBAAyB;AAClC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,gCAAgC,yCAAyC;AAClF,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP,SAAS,6BAA6B,uCAAuC;AAC7E;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,8BAA8B;AACvC,SAAS,2CAA2C;AACpD,SAAS,2BAA2B;AACpC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,uBAAuB;AAEhC,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,4BAA4B;AAChD;AAIA,MAAM,uCAAuC;AAC7C,MAAM,+CAA+C;AAErD,SAAS,kCAAkC,OAAyB;AAClE,MAAI,CAAC,SAAS,OAAO,UAAU,UAAU;AACvC,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ;AACd,QAAM,aAAa,MAAM;AACzB,QAAM,OAAO,MAAM;AACnB,QAAM,UAAU,OAAO,MAAM,YAAY,WAAW,MAAM,UAAU;AACpE,QAAM,SAAS,OAAO,MAAM,WAAW,WAAW,MAAM,SAAS;AAEjE,MAAI,eAAe,wCAAwC,eAAe,8CAA8C;AACtH,WAAO;AAAA,EACT;AAEA,MAAI,SAAS,YAAY,OAAO,SAAS,0BAA0B,KAAK,OAAO,SAAS,mCAAmC,IAAI;AAC7H,WAAO;AAAA,EACT;AAEA,SAAO,QAAQ,SAAS,oCAAoC,KAAK,QAAQ,SAAS,4CAA4C;AAChI;AAOA,eAAsB,IAAI,SAAsB;AAC9C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,YAAY,+BAA+B,OAAO,IAAI;AAE5D,UAAM,EAAE,aAAa,IAAI,IAAI,IAAI,QAAQ,GAAG;AAC5C,UAAM,UAAU,aAAa,IAAI,SAAS;AAC1C,UAAM,aAAa,aAAa,IAAI,YAAY;AAChD,UAAM,SAAS,aAAa,IAAI,QAAQ;AACxC,UAAM,OAAO,aAAa,IAAI,MAAM;AACpC,UAAM,YAAY,aAAa,IAAI,WAAW;AAC9C,UAAM,eAAe,aAAa,IAAI,SAAS;AAC/C,UAAM,UAAU,iBAAiB,QAAQ,QAAQ,KAAK,YAAY,IAAI,SAAS,cAAc,EAAE,IAAI;AACnG,UAAM,QAAQ,SAAS,aAAa,IAAI,OAAO,KAAK,IAAI;AACxD,UAAM,SAAS,SAAS,aAAa,IAAI,QAAQ,KAAK,GAAG;AAGzD,UAAM,QAAa;AAAA,MACjB;AAAA,MACA,GAAG,UAAU;AAAA,MACb,WAAW;AAAA,IACb;AAEA,QAAI,YAAY,MAAM;AACpB,YAAM,UAAU,YAAY;AAAA,IAC9B;AAEA,QAAI,YAAY;AACd,YAAM,aAAa;AAAA,IACrB;AAEA,QAAI,MAAM;AACR,YAAM,OAAO;AAAA,IACf;AAEA,QAAI,WAAW;AACb,YAAM,YAAY;AAAA,IACpB;AAEA,QAAI,YAAY,MAAM;AACpB,YAAM,UAAU;AAAA,IAClB;AAEA,QAAI,QAAQ;AACV,YAAM,MAAM;AAAA,QACV,EAAE,YAAY,EAAE,QAAQ,IAAI,kBAAkB,MAAM,CAAC,IAAI,EAAE;AAAA,QAC3D,EAAE,cAAc,EAAE,QAAQ,IAAI,kBAAkB,MAAM,CAAC,IAAI,EAAE;AAAA,MAC/D;AAAA,IACF;AAIA,UAAM,gBAAgB,YAAY,OAAO,YAAY,SAAS;AAC9D,UAAM,cAAc,SAAS,OAAO,YAAY,IAAI;AACpD,UAAM,aAAa,oBAAoB,EAAE,IAAI,CAAC,OAAO,GAAG,UAAU;AAClE,UAAM,WAAW,WAAW,SAAS,IACjC,IAAI;AAAA,OAEA,MAAM,GAAG;AAAA,QACP;AAAA,QACA,EAAE,GAAG,OAAO,YAAY,EAAE,KAAK,WAAW,EAAE;AAAA,QAC5C,EAAE,QAAQ,CAAC,YAAY,EAAW;AAAA,MACpC,GACA,IAAI,CAAC,MAA0B,EAAE,UAAU;AAAA,IAC/C,IACA,oBAAI,IAAY;AAEpB,UAAM,WAAW,oBAAoB,EAClC,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,GAAG,UAAU,CAAC,EAC3C,OAAO,CAAC,OAAO;AAEd,UAAI,QAAQ,SAAS,WAAY,QAAO;AACxC,UAAI,aAAa,cAAc,YAAa,QAAO;AACnD,UAAI,YAAY,QAAQ,GAAG,YAAY,QAAS,QAAO;AACvD,UAAI,aAAa;AACf,cAAM,UACJ,GAAG,WAAW,YAAY,EAAE,SAAS,WAAW,KAChD,GAAG,aAAa,YAAY,EAAE,SAAS,WAAW;AACpD,YAAI,CAAC,QAAS,QAAO;AAAA,MACvB;AACA,UAAI,kBAAkB,QAAQ,GAAG,YAAY,cAAe,QAAO;AACnE,UAAI,cAAc,GAAG,eAAe,WAAY,QAAO;AACvD,aAAO;AAAA,IACT,CAAC,EACA,IAAI,CAAC,OAAO,gCAAgC,IAAI,QAAQ,GAAG,UAAU,EAAE,CAAC;AAE3E,UAAM,UAAU,MAAM,GAAG,MAAM,oBAAoB,KAAK;AACxD,UAAM,QAAQ,UAAU,SAAS;AAIjC,UAAM,gBAAgB,SAAS;AAC/B,UAAM,WAAW,gBAAgB,IAC7B,MAAM,GAAG,KAAK,oBAAoB,OAAO;AAAA,MACvC,SAAS,EAAE,cAAc,MAAM;AAAA,MAC/B,OAAO;AAAA,IACT,CAAC,IACD,CAAC;AAEL,UAAM,eAAe,SAAS,IAAI,2BAA2B;AAE7D,UAAM,SAAS,CAAC,GAAG,cAAc,GAAG,QAAQ,EAAE;AAAA,MAAK,CAAC,GAAG,MACrD,EAAE,aAAa,cAAc,EAAE,YAAY;AAAA,IAC7C;AAEA,UAAM,YAAY,OAAO,MAAM,QAAQ,SAAS,KAAK;AAErD,WAAO,aAAa,KAAK;AAAA,MACvB,MAAM;AAAA,MACN,YAAY;AAAA,QACV;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS,SAAS,QAAQ;AAAA,MAC5B;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,sCAAsC,EAAE,KAAK,MAAM,CAAC;AACjE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,sCAAsC;AAAA,MAC/C,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAOA,eAAsB,KAAK,SAAsB;AAC/C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,kCAAkC,OAAO,IAAI;AAGpE,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,UAAM,gBAAgB,MAAM,YAAY;AAAA,MACtC,KAAK;AAAA,MACL,CAAC,8BAA8B;AAAA,MAC/B;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,2BAA2B;AAAA,QACpC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,OAAO,MAAM,QAAQ,KAAK;AAGhC,UAAM,aAAa,2CAA2C,UAAU,IAAI;AAC5E,QAAI,CAAC,WAAW,SAAS;AACvB,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO;AAAA,UACP,SAAS,oCAAoC,WAAW,KAAK;AAAA,QAC/D;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,QAA0C,WAAW;AAK3D,UAAM,iBAAiB,MAAM,WAAW,gBACpC,MAAM,aACN,EAAE,GAAG,MAAM,YAAY,eAAe,SAAkB;AAM5D,UAAM,WAAW,MAAM,GAAG,QAAQ,oBAAoB;AAAA,MACpD,YAAY,MAAM;AAAA,MAClB;AAAA,IACF,GAAG,EAAE,SAAS,EAAE,SAAS,OAAO,EAAE,CAAC;AAEnC,QAAI,UAAU;AACZ,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO,gCAAgC,MAAM,UAAU;AAAA,QACzD;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,kBAAkB,yBAAyB,MAAM,eAAe;AACtE,UAAM,eAAe,MAAM,6BAA6B,aAAa;AAAA,MACnE,QAAQ,KAAK;AAAA,MACb,OAAO,EAAE,UAAU,eAAe;AAAA,MAClC,WAAW;AAAA,MACX,SAAS,CAAC;AAAA,IACZ,CAAC;AACD,QAAI,cAAc;AAChB,aAAO,aAAa,KAAK,aAAa,MAAM,EAAE,QAAQ,aAAa,OAAO,CAAC;AAAA,IAC7E;AAaA,UAAM,aAAa,GAAG,OAAO,oBAAoB;AAAA,MAC/C,IAAI,WAAW;AAAA,MACf,YAAY,MAAM;AAAA,MAClB,cAAc,MAAM;AAAA,MACpB,aAAa,MAAM;AAAA,MACnB,SAAS,MAAM;AAAA,MACf,YAAY;AAAA,MACZ,UAAU,MAAM;AAAA,MAChB,SAAS,MAAM,WAAW;AAAA,MAC1B,iBAAiB,gBAAgB,SAAS,kBAAkB;AAAA,MAC5D;AAAA,MACA;AAAA,MACA,WAAW,KAAK;AAAA,MAChB,WAAW,KAAK;AAAA,MAChB,WAAW,oBAAI,KAAK;AAAA,MACpB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AAED,UAAM,gCAAgC,WAAW,UAAU;AAE3D,UAAM,GAAG,QAAQ,UAAU,EAAE,MAAM;AAKnC,QAAI,SAAU,wBAAuB,UAAU,kBAAkB,MAAS;AAE1E,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,MAAM,4BAA4B,UAAU;AAAA,QAC5C,SAAS;AAAA,MACX;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,EAAG,QAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AACzF,QAAI,kCAAkC,KAAK,GAAG;AAC5C,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,kDAAkD;AAAA,QAC3D,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,WAAO,MAAM,sCAAsC,EAAE,KAAK,MAAM,CAAC;AACjE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,uCAAuC;AAAA,MAChD,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,MAAM,CAAC,WAAW;AAAA,MAClB,OAAO,oCAAoC,KAAK,EAAE,YAAY,KAAK,CAAC,EAAE,OAAO;AAAA,QAC3E,SAAS,EAAE,QAAQ,EAAE,SAAS;AAAA,QAC9B,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,QAC5B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,SAAS;AAAA,QACxD,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,MACtD,CAAC;AAAA,MACD,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,MAAM;AAAA,cACJ;AAAA,gBACE,IAAI;AAAA,gBACJ,YAAY;AAAA,gBACZ,cAAc;AAAA,gBACd,aAAa;AAAA,gBACb,SAAS;AAAA,gBACT,YAAY;AAAA,kBACV,OAAO;AAAA,oBACL;AAAA,sBACE,QAAQ;AAAA,sBACR,UAAU;AAAA,sBACV,UAAU;AAAA,oBACZ;AAAA,oBACA;AAAA,sBACE,QAAQ;AAAA,sBACR,UAAU;AAAA,sBACV,UAAU;AAAA,oBACZ;AAAA,oBACA;AAAA,sBACE,QAAQ;AAAA,sBACR,UAAU;AAAA,sBACV,UAAU;AAAA,oBACZ;AAAA,kBACF;AAAA,kBACA,aAAa;AAAA,oBACX;AAAA,sBACE,cAAc;AAAA,sBACd,YAAY;AAAA,sBACZ,UAAU;AAAA,sBACV,SAAS;AAAA,oBACX;AAAA,oBACA;AAAA,sBACE,cAAc;AAAA,sBACd,YAAY;AAAA,sBACZ,UAAU;AAAA,sBACV,SAAS;AAAA,oBACX;AAAA,kBACF;AAAA,gBACF;AAAA,gBACA,SAAS;AAAA,gBACT,UAAU;AAAA,gBACV,gBAAgB;AAAA,gBAChB,WAAW;AAAA,gBACX,WAAW;AAAA,cACb;AAAA,YACF;AAAA,YACA,YAAY;AAAA,cACV,OAAO;AAAA,cACP,OAAO;AAAA,cACP,QAAQ;AAAA,cACR,SAAS;AAAA,YACX;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,MAAM,CAAC,WAAW;AAAA,MAClB,aAAa;AAAA,QACX,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,aAAa;AAAA,UACb,SAAS;AAAA,UACT,YAAY;AAAA,YACV,OAAO;AAAA,cACL;AAAA,gBACE,QAAQ;AAAA,gBACR,UAAU;AAAA,gBACV,UAAU;AAAA,cACZ;AAAA,cACA;AAAA,gBACE,QAAQ;AAAA,gBACR,UAAU;AAAA,gBACV,UAAU;AAAA,gBACV,aAAa;AAAA,cACf;AAAA,cACA;AAAA,gBACE,QAAQ;AAAA,gBACR,UAAU;AAAA,gBACV,UAAU;AAAA,gBACV,aAAa;AAAA,gBACb,aAAa;AAAA,kBACX,aAAa;AAAA,kBACb,WAAW;AAAA,gBACb;AAAA,cACF;AAAA,cACA;AAAA,gBACE,QAAQ;AAAA,gBACR,UAAU;AAAA,gBACV,UAAU;AAAA,cACZ;AAAA,YACF;AAAA,YACA,aAAa;AAAA,cACX;AAAA,gBACE,cAAc;AAAA,gBACd,YAAY;AAAA,gBACZ,UAAU;AAAA,gBACV,SAAS;AAAA,cACX;AAAA,cACA;AAAA,gBACE,cAAc;AAAA,gBACd,YAAY;AAAA,gBACZ,UAAU;AAAA,gBACV,SAAS;AAAA,cACX;AAAA,cACA;AAAA,gBACE,cAAc;AAAA,gBACd,YAAY;AAAA,gBACZ,UAAU;AAAA,gBACV,SAAS;AAAA,gBACT,YAAY;AAAA,kBACV;AAAA,oBACE,cAAc;AAAA,oBACd,cAAc;AAAA,oBACd,QAAQ;AAAA,sBACN,IAAI;AAAA,sBACJ,SAAS;AAAA,sBACT,UAAU;AAAA,oBACZ;AAAA,kBACF;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,UACA,SAAS;AAAA,QACX;AAAA,MACF;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,MAAM;AAAA,cACJ,IAAI;AAAA,cACJ,YAAY;AAAA,cACZ,cAAc;AAAA,cACd,aAAa;AAAA,cACb,SAAS;AAAA,cACT,YAAY;AAAA,gBACV,OAAO;AAAA,kBACL,EAAE,QAAQ,SAAS,UAAU,SAAS,UAAU,QAAQ;AAAA,kBACxD;AAAA,oBACE,QAAQ;AAAA,oBACR,UAAU;AAAA,oBACV,UAAU;AAAA,kBACZ;AAAA,kBACA;AAAA,oBACE,QAAQ;AAAA,oBACR,UAAU;AAAA,oBACV,UAAU;AAAA,kBACZ;AAAA,kBACA,EAAE,QAAQ,OAAO,UAAU,OAAO,UAAU,MAAM;AAAA,gBACpD;AAAA,gBACA,aAAa;AAAA,kBACX;AAAA,oBACE,cAAc;AAAA,oBACd,YAAY;AAAA,oBACZ,UAAU;AAAA,oBACV,SAAS;AAAA,kBACX;AAAA,kBACA;AAAA,oBACE,cAAc;AAAA,oBACd,YAAY;AAAA,oBACZ,UAAU;AAAA,oBACV,SAAS;AAAA,kBACX;AAAA,kBACA;AAAA,oBACE,cAAc;AAAA,oBACd,YAAY;AAAA,oBACZ,UAAU;AAAA,oBACV,SAAS;AAAA,kBACX;AAAA,gBACF;AAAA,cACF;AAAA,cACA,SAAS;AAAA,cACT,UAAU;AAAA,cACV,gBAAgB;AAAA,cAChB,WAAW;AAAA,cACX,WAAW;AAAA,YACb;AAAA,YACA,SAAS;AAAA,UACX;AAAA,QACF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,OAAO;AAAA,YACP,SAAS;AAAA,cACP;AAAA,gBACE,MAAM,CAAC,cAAc,OAAO;AAAA,gBAC5B,MAAM;AAAA,gBACN,SAAS;AAAA,cACX;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,OAAO;AAAA,UACT;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/workflows/api/endpoints/route.js

@@ -2,9 +2,11 @@ import { NextResponse } from "next/server";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { getWorkflowEndpointCatalog } from "../../lib/endpoint-catalog.js";
 import { workflowsTag, workflowErrorSchema, workflowEndpointListResponseSchema } from "../openapi.js";
 import { createLogger } from "@open-mercato/shared/lib/logger";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 const logger = createLogger("workflows");
 const metadata = {
   requireAuth: true,
@@ -19,7 +21,7 @@ async function GET(request) {
     }
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request });
     const tenantId = auth.tenantId;
-    const organizationId = scope?.selectedId ?? auth.orgId;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth);
     if (!tenantId) {
       return NextResponse.json({ error: "Missing tenant context" }, { status: 400 });
     }
@@ -35,6 +37,7 @@ async function GET(request) {
     const catalog = await getWorkflowEndpointCatalog();
     return NextResponse.json({ items: catalog.items });
   } catch (error) {
+    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status });
     logger.error("Error listing workflow endpoint catalog", { err: error });
     return NextResponse.json(
       { error: "Failed to list workflow endpoint catalog" },

package/dist/modules/workflows/api/endpoints/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/workflows/api/endpoints/route.ts"],
-  "sourcesContent": ["/**\n * Workflow Endpoint Catalog API (issue #4235)\n *\n * Endpoint:\n * - GET /api/workflows/endpoints - Trimmed index of the platform API surface for the CALL_API endpoint picker\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { getWorkflowEndpointCatalog } from '../../lib/endpoint-catalog'\nimport { workflowsTag, workflowErrorSchema, workflowEndpointListResponseSchema } from '../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.view'],\n}\n\n/**\n * GET /api/workflows/endpoints\n *\n * List the endpoint catalog projected from the in-process OpenAPI surface for\n * the CALL_API endpoint picker.\n */\nexport async function GET(request: NextRequest) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = scope?.selectedId ?? auth.orgId\n\n    if (!tenantId) {\n      return NextResponse.json({ error: 'Missing tenant context' }, { status: 400 })\n    }\n\n    const rbacService = container.resolve('rbacService')\n    const hasPermission = await rbacService.userHasAllFeatures(\n      auth.sub,\n      ['workflows.definitions.view'],\n      { tenantId, organizationId }\n    )\n\n    if (!hasPermission) {\n      return NextResponse.json({ error: 'Insufficient permissions' }, { status: 403 })\n    }\n\n    const catalog = await getWorkflowEndpointCatalog()\n\n    return NextResponse.json({ items: catalog.items })\n  } catch (error) {\n    logger.error('Error listing workflow endpoint catalog', { err: error })\n    return NextResponse.json(\n      { error: 'Failed to list workflow endpoint catalog' },\n      { status: 500 }\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'List the workflow endpoint catalog',\n  methods: {\n    GET: {\n      summary: 'List endpoints available to CALL_API activities',\n      description: 'Returns a trimmed projection of the OpenAPI surface (path, method, summary, tag, parameters, and declared request/response schemas) consumed by the CALL_API endpoint picker. Endpoints outside this catalog can still be authored as free text. Responses without a declared schema omit responseSchema so consumers degrade to unknown typing.',\n      responses: [\n        { status: 200, description: 'Endpoint catalog projected from the OpenAPI surface', schema: workflowEndpointListResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing tenant context', schema: workflowErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: workflowErrorSchema },\n        { status: 403, description: 'Insufficient permissions', schema: workflowErrorSchema },\n        { status: 500, description: 'Internal server error', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAOA,SAAsB,oBAAoB;AAE1C,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,kCAAkC;AAC3C,SAAS,cAAc,qBAAqB,0CAA0C;AACtF,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,4BAA4B;AAChD;AAQA,eAAsB,IAAI,SAAsB;AAC9C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,cAAc,KAAK;AAEjD,QAAI,CAAC,UAAU;AACb,aAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/E;AAEA,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,UAAM,gBAAgB,MAAM,YAAY;AAAA,MACtC,KAAK;AAAA,MACL,CAAC,4BAA4B;AAAA,MAC7B,EAAE,UAAU,eAAe;AAAA,IAC7B;AAEA,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjF;AAEA,UAAM,UAAU,MAAM,2BAA2B;AAEjD,WAAO,aAAa,KAAK,EAAE,OAAO,QAAQ,MAAM,CAAC;AAAA,EACnD,SAAS,OAAO;AACd,WAAO,MAAM,2CAA2C,EAAE,KAAK,MAAM,CAAC;AACtE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,2CAA2C;AAAA,MACpD,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,uDAAuD,QAAQ,mCAAmC;AAAA,MAChI;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,oBAAoB;AAAA,QAClF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * Workflow Endpoint Catalog API (issue #4235)\n *\n * Endpoint:\n * - GET /api/workflows/endpoints - Trimmed index of the platform API surface for the CALL_API endpoint picker\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { getWorkflowEndpointCatalog } from '../../lib/endpoint-catalog'\nimport { workflowsTag, workflowErrorSchema, workflowEndpointListResponseSchema } from '../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.view'],\n}\n\n/**\n * GET /api/workflows/endpoints\n *\n * List the endpoint catalog projected from the in-process OpenAPI surface for\n * the CALL_API endpoint picker.\n */\nexport async function GET(request: NextRequest) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth)\n\n    if (!tenantId) {\n      return NextResponse.json({ error: 'Missing tenant context' }, { status: 400 })\n    }\n\n    const rbacService = container.resolve('rbacService')\n    const hasPermission = await rbacService.userHasAllFeatures(\n      auth.sub,\n      ['workflows.definitions.view'],\n      { tenantId, organizationId }\n    )\n\n    if (!hasPermission) {\n      return NextResponse.json({ error: 'Insufficient permissions' }, { status: 403 })\n    }\n\n    const catalog = await getWorkflowEndpointCatalog()\n\n    return NextResponse.json({ items: catalog.items })\n  } catch (error) {\n    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status })\n    logger.error('Error listing workflow endpoint catalog', { err: error })\n    return NextResponse.json(\n      { error: 'Failed to list workflow endpoint catalog' },\n      { status: 500 }\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'List the workflow endpoint catalog',\n  methods: {\n    GET: {\n      summary: 'List endpoints available to CALL_API activities',\n      description: 'Returns a trimmed projection of the OpenAPI surface (path, method, summary, tag, parameters, and declared request/response schemas) consumed by the CALL_API endpoint picker. Endpoints outside this catalog can still be authored as free text. Responses without a declared schema omit responseSchema so consumers degrade to unknown typing.',\n      responses: [\n        { status: 200, description: 'Endpoint catalog projected from the OpenAPI surface', schema: workflowEndpointListResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing tenant context', schema: workflowErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: workflowErrorSchema },\n        { status: 403, description: 'Insufficient permissions', schema: workflowErrorSchema },\n        { status: 500, description: 'Internal server error', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAOA,SAAsB,oBAAoB;AAE1C,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,kCAAkC;AAC3C,SAAS,cAAc,qBAAqB,0CAA0C;AACtF,SAAS,oBAAoB;AAC7B,SAAS,uBAAuB;AAEhC,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,4BAA4B;AAChD;AAQA,eAAsB,IAAI,SAAsB;AAC9C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,kCAAkC,OAAO,IAAI;AAEpE,QAAI,CAAC,UAAU;AACb,aAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/E;AAEA,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,UAAM,gBAAgB,MAAM,YAAY;AAAA,MACtC,KAAK;AAAA,MACL,CAAC,4BAA4B;AAAA,MAC7B,EAAE,UAAU,eAAe;AAAA,IAC7B;AAEA,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjF;AAEA,UAAM,UAAU,MAAM,2BAA2B;AAEjD,WAAO,aAAa,KAAK,EAAE,OAAO,QAAQ,MAAM,CAAC;AAAA,EACnD,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,EAAG,QAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AACzF,WAAO,MAAM,2CAA2C,EAAE,KAAK,MAAM,CAAC;AACtE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,2CAA2C;AAAA,MACpD,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,uDAAuD,QAAQ,mCAAmC;AAAA,MAChI;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,oBAAoB;AAAA,QAClF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/workflows/api/functions/route.js

@@ -2,9 +2,11 @@ import { NextResponse } from "next/server";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { listWorkflowFunctions } from "../../lib/workflow-function-registry.js";
 import { workflowsTag, workflowErrorSchema, workflowFunctionListResponseSchema } from "../openapi.js";
 import { createLogger } from "@open-mercato/shared/lib/logger";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 const logger = createLogger("workflows");
 const metadata = {
   requireAuth: true,
@@ -19,7 +21,7 @@ async function GET(request) {
     }
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request });
     const tenantId = auth.tenantId;
-    const organizationId = scope?.selectedId ?? auth.orgId;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth);
     if (!tenantId) {
       return NextResponse.json({ error: "Missing tenant context" }, { status: 400 });
     }
@@ -39,6 +41,7 @@ async function GET(request) {
     }));
     return NextResponse.json({ items });
   } catch (error) {
+    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status });
     logger.error("Error listing workflow functions", { err: error });
     return NextResponse.json(
       { error: "Failed to list workflow functions" },

package/dist/modules/workflows/api/functions/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/workflows/api/functions/route.ts"],
-  "sourcesContent": ["/**\n * Workflow Functions API\n *\n * Endpoint:\n * - GET /api/workflows/functions - List registered workflow function descriptors for EXECUTE_FUNCTION activities\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { listWorkflowFunctions } from '../../lib/workflow-function-registry'\nimport { workflowsTag, workflowErrorSchema, workflowFunctionListResponseSchema } from '../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.edit'],\n}\n\n/**\n * GET /api/workflows/functions\n *\n * List the registered workflow function descriptors for the EXECUTE_FUNCTION function picker.\n */\nexport async function GET(request: NextRequest) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = scope?.selectedId ?? auth.orgId\n\n    if (!tenantId) {\n      return NextResponse.json({ error: 'Missing tenant context' }, { status: 400 })\n    }\n\n    const rbacService = container.resolve('rbacService')\n    const hasPermission = await rbacService.userHasAllFeatures(\n      auth.sub,\n      ['workflows.definitions.edit'],\n      { tenantId, organizationId }\n    )\n\n    if (!hasPermission) {\n      return NextResponse.json({ error: 'Insufficient permissions' }, { status: 403 })\n    }\n\n    const items = listWorkflowFunctions().map((definition) => ({\n      name: definition.name,\n      ...(definition.labelKey ? { labelKey: definition.labelKey } : {}),\n      ...(definition.description ? { description: definition.description } : {}),\n    }))\n\n    return NextResponse.json({ items })\n  } catch (error) {\n    logger.error('Error listing workflow functions', { err: error })\n    return NextResponse.json(\n      { error: 'Failed to list workflow functions' },\n      { status: 500 }\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'List workflow functions',\n  methods: {\n    GET: {\n      summary: 'List registered workflow function descriptors for EXECUTE_FUNCTION activities',\n      description: 'Returns the registered workflow function descriptors consumed by the EXECUTE_FUNCTION function picker. Functions outside this list can still be authored but fail at runtime when no matching workflowFunction:<name> DI registration exists.',\n      responses: [\n        { status: 200, description: 'Registered workflow function descriptors', schema: workflowFunctionListResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing tenant context', schema: workflowErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: workflowErrorSchema },\n        { status: 403, description: 'Insufficient permissions', schema: workflowErrorSchema },\n        { status: 500, description: 'Internal server error', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAOA,SAAsB,oBAAoB;AAE1C,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,6BAA6B;AACtC,SAAS,cAAc,qBAAqB,0CAA0C;AACtF,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,4BAA4B;AAChD;AAOA,eAAsB,IAAI,SAAsB;AAC9C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,cAAc,KAAK;AAEjD,QAAI,CAAC,UAAU;AACb,aAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/E;AAEA,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,UAAM,gBAAgB,MAAM,YAAY;AAAA,MACtC,KAAK;AAAA,MACL,CAAC,4BAA4B;AAAA,MAC7B,EAAE,UAAU,eAAe;AAAA,IAC7B;AAEA,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjF;AAEA,UAAM,QAAQ,sBAAsB,EAAE,IAAI,CAAC,gBAAgB;AAAA,MACzD,MAAM,WAAW;AAAA,MACjB,GAAI,WAAW,WAAW,EAAE,UAAU,WAAW,SAAS,IAAI,CAAC;AAAA,MAC/D,GAAI,WAAW,cAAc,EAAE,aAAa,WAAW,YAAY,IAAI,CAAC;AAAA,IAC1E,EAAE;AAEF,WAAO,aAAa,KAAK,EAAE,MAAM,CAAC;AAAA,EACpC,SAAS,OAAO;AACd,WAAO,MAAM,oCAAoC,EAAE,KAAK,MAAM,CAAC;AAC/D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,oCAAoC;AAAA,MAC7C,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,4CAA4C,QAAQ,mCAAmC;AAAA,MACrH;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,oBAAoB;AAAA,QAClF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * Workflow Functions API\n *\n * Endpoint:\n * - GET /api/workflows/functions - List registered workflow function descriptors for EXECUTE_FUNCTION activities\n */\n\nimport { NextRequest, NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { listWorkflowFunctions } from '../../lib/workflow-function-registry'\nimport { workflowsTag, workflowErrorSchema, workflowFunctionListResponseSchema } from '../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\n\nconst logger = createLogger('workflows')\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['workflows.definitions.edit'],\n}\n\n/**\n * GET /api/workflows/functions\n *\n * List the registered workflow function descriptors for the EXECUTE_FUNCTION function picker.\n */\nexport async function GET(request: NextRequest) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(request)\n\n    if (!auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n    const tenantId = auth.tenantId\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth)\n\n    if (!tenantId) {\n      return NextResponse.json({ error: 'Missing tenant context' }, { status: 400 })\n    }\n\n    const rbacService = container.resolve('rbacService')\n    const hasPermission = await rbacService.userHasAllFeatures(\n      auth.sub,\n      ['workflows.definitions.edit'],\n      { tenantId, organizationId }\n    )\n\n    if (!hasPermission) {\n      return NextResponse.json({ error: 'Insufficient permissions' }, { status: 403 })\n    }\n\n    const items = listWorkflowFunctions().map((definition) => ({\n      name: definition.name,\n      ...(definition.labelKey ? { labelKey: definition.labelKey } : {}),\n      ...(definition.description ? { description: definition.description } : {}),\n    }))\n\n    return NextResponse.json({ items })\n  } catch (error) {\n    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status })\n    logger.error('Error listing workflow functions', { err: error })\n    return NextResponse.json(\n      { error: 'Failed to list workflow functions' },\n      { status: 500 }\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: workflowsTag,\n  summary: 'List workflow functions',\n  methods: {\n    GET: {\n      summary: 'List registered workflow function descriptors for EXECUTE_FUNCTION activities',\n      description: 'Returns the registered workflow function descriptors consumed by the EXECUTE_FUNCTION function picker. Functions outside this list can still be authored but fail at runtime when no matching workflowFunction:<name> DI registration exists.',\n      responses: [\n        { status: 200, description: 'Registered workflow function descriptors', schema: workflowFunctionListResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing tenant context', schema: workflowErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: workflowErrorSchema },\n        { status: 403, description: 'Insufficient permissions', schema: workflowErrorSchema },\n        { status: 500, description: 'Internal server error', schema: workflowErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAOA,SAAsB,oBAAoB;AAE1C,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,6BAA6B;AACtC,SAAS,cAAc,qBAAqB,0CAA0C;AACtF,SAAS,oBAAoB;AAC7B,SAAS,uBAAuB;AAEhC,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,4BAA4B;AAChD;AAOA,eAAsB,IAAI,SAAsB;AAC9C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAE7C,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,kCAAkC,OAAO,IAAI;AAEpE,QAAI,CAAC,UAAU;AACb,aAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/E;AAEA,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,UAAM,gBAAgB,MAAM,YAAY;AAAA,MACtC,KAAK;AAAA,MACL,CAAC,4BAA4B;AAAA,MAC7B,EAAE,UAAU,eAAe;AAAA,IAC7B;AAEA,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjF;AAEA,UAAM,QAAQ,sBAAsB,EAAE,IAAI,CAAC,gBAAgB;AAAA,MACzD,MAAM,WAAW;AAAA,MACjB,GAAI,WAAW,WAAW,EAAE,UAAU,WAAW,SAAS,IAAI,CAAC;AAAA,MAC/D,GAAI,WAAW,cAAc,EAAE,aAAa,WAAW,YAAY,IAAI,CAAC;AAAA,IAC1E,EAAE;AAEF,WAAO,aAAa,KAAK,EAAE,MAAM,CAAC;AAAA,EACpC,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,EAAG,QAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AACzF,WAAO,MAAM,oCAAoC,EAAE,KAAK,MAAM,CAAC;AAC/D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,oCAAoC;AAAA,MAC7C,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,4CAA4C,QAAQ,mCAAmC;AAAA,MACrH;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,oBAAoB;AAAA,QAClF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/workflows/api/grantable-features/route.js

@@ -4,6 +4,7 @@ import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { getModules } from "@open-mercato/shared/lib/i18n/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { hasFeature } from "@open-mercato/shared/security/features";
 import { WORKFLOW_GRANT_FEATURE } from "../../lib/definition-grant.js";
 const metadata = {
@@ -19,7 +20,7 @@ async function GET(request) {
   if (!auth) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   const container = await createRequestContainer();
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request });
-  const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
   const tenantId = auth.tenantId ?? null;
   const rbacService = container.resolve("rbacService");
   const granted = rbacService.getGrantedFeatures ? await rbacService.getGrantedFeatures(auth.sub, { tenantId, organizationId }) : [];

package/dist/modules/workflows/api/grantable-features/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/workflows/api/grantable-features/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { getModules } from '@open-mercato/shared/lib/i18n/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { hasFeature } from '@open-mercato/shared/security/features'\nimport { WORKFLOW_GRANT_FEATURE } from '../../lib/definition-grant'\n\n/**\n * The vocabulary a workflow author may put into a definition's execution grant.\n *\n * Unlike `auth`'s catalog (gated `auth.acl.manage`) and `agent_orchestrator`'s\n * (which lists every declared feature), this one is INTERSECTED with the\n * caller's own current grants: the save-time rule is that a grant can never\n * exceed the granting user's features, so offering ids that would be refused on\n * save would only produce checkboxes that fail. Ids + titles only \u2014 no role or\n * grant data for anyone else leaks through.\n */\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: [WORKFLOW_GRANT_FEATURE] },\n}\n\ntype GrantableFeature = { id: string; title: string; module: string }\n\nconst grantableFeatureSchema = z.object({\n  id: z.string(),\n  title: z.string(),\n  module: z.string(),\n})\n\ntype RbacServiceLike = {\n  getGrantedFeatures?: (\n    userId: string,\n    scope: { tenantId: string | null; organizationId: string | null },\n  ) => Promise<string[]>\n}\n\nexport async function GET(request: Request) {\n  const auth = await getAuthFromRequest(request)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const container = await createRequestContainer()\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n  const organizationId = scope?.selectedId ?? auth.orgId ?? null\n  const tenantId = auth.tenantId ?? null\n\n  const rbacService = container.resolve('rbacService') as RbacServiceLike\n  const granted = rbacService.getGrantedFeatures\n    ? await rbacService.getGrantedFeatures(auth.sub, { tenantId, organizationId })\n    : []\n\n  const byId = new Map<string, GrantableFeature>()\n  for (const mod of getModules() || []) {\n    const features = (mod as { features?: Array<Record<string, unknown>> }).features || []\n    for (const feature of features) {\n      const id = typeof feature.id === 'string' ? feature.id.trim() : ''\n      if (!id || byId.has(id)) continue\n      // Wildcard-aware: an author holding `catalog.*` may grant every concrete\n      // `catalog.\u2026` id. Never an exact-string check.\n      if (!hasFeature(granted, id)) continue\n      byId.set(id, {\n        id,\n        title: typeof feature.title === 'string' && feature.title ? feature.title : id,\n        module: typeof feature.module === 'string' && feature.module ? feature.module : String(mod.id ?? ''),\n      })\n    }\n  }\n\n  const items = Array.from(byId.values()).sort(\n    (a, b) => a.module.localeCompare(b.module) || a.id.localeCompare(b.id),\n  )\n  return NextResponse.json({ items })\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Workflows',\n  summary: 'List the ACL features the caller may grant to a workflow definition',\n  methods: {\n    GET: {\n      summary: 'List grantable execution features',\n      description:\n        'Declared ACL feature ids/titles intersected with the calling user\u2019s own current grants (wildcard-aware). Drives the definition editor\u2019s execution-permissions picker; gated by workflows.definitions.grant_features.',\n      responses: [\n        {\n          status: 200,\n          description: 'Grantable feature catalog',\n          schema: z.object({ items: z.array(grantableFeatureSchema) }),\n        },\n      ],\n      errors: [\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        {\n          status: 403,\n          description: 'Missing workflows.definitions.grant_features',\n          schema: z.object({ error: z.string() }),\n        },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,kBAAkB;AAC3B,SAAS,0CAA0C;AACnD,SAAS,kBAAkB;AAC3B,SAAS,8BAA8B;AAYhC,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACtE;AAIA,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,IAAI,EAAE,OAAO;AAAA,EACb,OAAO,EAAE,OAAO;AAAA,EAChB,QAAQ,EAAE,OAAO;AACnB,CAAC;AASD,eAAsB,IAAI,SAAkB;AAC1C,QAAM,OAAO,MAAM,mBAAmB,OAAO;AAC7C,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,QAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAM,WAAW,KAAK,YAAY;AAElC,QAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,QAAM,UAAU,YAAY,qBACxB,MAAM,YAAY,mBAAmB,KAAK,KAAK,EAAE,UAAU,eAAe,CAAC,IAC3E,CAAC;AAEL,QAAM,OAAO,oBAAI,IAA8B;AAC/C,aAAW,OAAO,WAAW,KAAK,CAAC,GAAG;AACpC,UAAM,WAAY,IAAsD,YAAY,CAAC;AACrF,eAAW,WAAW,UAAU;AAC9B,YAAM,KAAK,OAAO,QAAQ,OAAO,WAAW,QAAQ,GAAG,KAAK,IAAI;AAChE,UAAI,CAAC,MAAM,KAAK,IAAI,EAAE,EAAG;AAGzB,UAAI,CAAC,WAAW,SAAS,EAAE,EAAG;AAC9B,WAAK,IAAI,IAAI;AAAA,QACX;AAAA,QACA,OAAO,OAAO,QAAQ,UAAU,YAAY,QAAQ,QAAQ,QAAQ,QAAQ;AAAA,QAC5E,QAAQ,OAAO,QAAQ,WAAW,YAAY,QAAQ,SAAS,QAAQ,SAAS,OAAO,IAAI,MAAM,EAAE;AAAA,MACrG,CAAC;AAAA,IACH;AAAA,EACF;AAEA,QAAM,QAAQ,MAAM,KAAK,KAAK,OAAO,CAAC,EAAE;AAAA,IACtC,CAAC,GAAG,MAAM,EAAE,OAAO,cAAc,EAAE,MAAM,KAAK,EAAE,GAAG,cAAc,EAAE,EAAE;AAAA,EACvE;AACA,SAAO,aAAa,KAAK,EAAE,MAAM,CAAC;AACpC;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,EAAE,CAAC;AAAA,QAC7D;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { getModules } from '@open-mercato/shared/lib/i18n/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { hasFeature } from '@open-mercato/shared/security/features'\nimport { WORKFLOW_GRANT_FEATURE } from '../../lib/definition-grant'\n\n/**\n * The vocabulary a workflow author may put into a definition's execution grant.\n *\n * Unlike `auth`'s catalog (gated `auth.acl.manage`) and `agent_orchestrator`'s\n * (which lists every declared feature), this one is INTERSECTED with the\n * caller's own current grants: the save-time rule is that a grant can never\n * exceed the granting user's features, so offering ids that would be refused on\n * save would only produce checkboxes that fail. Ids + titles only \u2014 no role or\n * grant data for anyone else leaks through.\n */\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: [WORKFLOW_GRANT_FEATURE] },\n}\n\ntype GrantableFeature = { id: string; title: string; module: string }\n\nconst grantableFeatureSchema = z.object({\n  id: z.string(),\n  title: z.string(),\n  module: z.string(),\n})\n\ntype RbacServiceLike = {\n  getGrantedFeatures?: (\n    userId: string,\n    scope: { tenantId: string | null; organizationId: string | null },\n  ) => Promise<string[]>\n}\n\nexport async function GET(request: Request) {\n  const auth = await getAuthFromRequest(request)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const container = await createRequestContainer()\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n  const tenantId = auth.tenantId ?? null\n\n  const rbacService = container.resolve('rbacService') as RbacServiceLike\n  const granted = rbacService.getGrantedFeatures\n    ? await rbacService.getGrantedFeatures(auth.sub, { tenantId, organizationId })\n    : []\n\n  const byId = new Map<string, GrantableFeature>()\n  for (const mod of getModules() || []) {\n    const features = (mod as { features?: Array<Record<string, unknown>> }).features || []\n    for (const feature of features) {\n      const id = typeof feature.id === 'string' ? feature.id.trim() : ''\n      if (!id || byId.has(id)) continue\n      // Wildcard-aware: an author holding `catalog.*` may grant every concrete\n      // `catalog.\u2026` id. Never an exact-string check.\n      if (!hasFeature(granted, id)) continue\n      byId.set(id, {\n        id,\n        title: typeof feature.title === 'string' && feature.title ? feature.title : id,\n        module: typeof feature.module === 'string' && feature.module ? feature.module : String(mod.id ?? ''),\n      })\n    }\n  }\n\n  const items = Array.from(byId.values()).sort(\n    (a, b) => a.module.localeCompare(b.module) || a.id.localeCompare(b.id),\n  )\n  return NextResponse.json({ items })\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Workflows',\n  summary: 'List the ACL features the caller may grant to a workflow definition',\n  methods: {\n    GET: {\n      summary: 'List grantable execution features',\n      description:\n        'Declared ACL feature ids/titles intersected with the calling user\u2019s own current grants (wildcard-aware). Drives the definition editor\u2019s execution-permissions picker; gated by workflows.definitions.grant_features.',\n      responses: [\n        {\n          status: 200,\n          description: 'Grantable feature catalog',\n          schema: z.object({ items: z.array(grantableFeatureSchema) }),\n        },\n      ],\n      errors: [\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        {\n          status: 403,\n          description: 'Missing workflows.definitions.grant_features',\n          schema: z.object({ error: z.string() }),\n        },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,kBAAkB;AAC3B,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,kBAAkB;AAC3B,SAAS,8BAA8B;AAYhC,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACtE;AAIA,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,IAAI,EAAE,OAAO;AAAA,EACb,OAAO,EAAE,OAAO;AAAA,EAChB,QAAQ,EAAE,OAAO;AACnB,CAAC;AASD,eAAsB,IAAI,SAAkB;AAC1C,QAAM,OAAO,MAAM,mBAAmB,OAAO;AAC7C,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,QAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AACzE,QAAM,WAAW,KAAK,YAAY;AAElC,QAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,QAAM,UAAU,YAAY,qBACxB,MAAM,YAAY,mBAAmB,KAAK,KAAK,EAAE,UAAU,eAAe,CAAC,IAC3E,CAAC;AAEL,QAAM,OAAO,oBAAI,IAA8B;AAC/C,aAAW,OAAO,WAAW,KAAK,CAAC,GAAG;AACpC,UAAM,WAAY,IAAsD,YAAY,CAAC;AACrF,eAAW,WAAW,UAAU;AAC9B,YAAM,KAAK,OAAO,QAAQ,OAAO,WAAW,QAAQ,GAAG,KAAK,IAAI;AAChE,UAAI,CAAC,MAAM,KAAK,IAAI,EAAE,EAAG;AAGzB,UAAI,CAAC,WAAW,SAAS,EAAE,EAAG;AAC9B,WAAK,IAAI,IAAI;AAAA,QACX;AAAA,QACA,OAAO,OAAO,QAAQ,UAAU,YAAY,QAAQ,QAAQ,QAAQ,QAAQ;AAAA,QAC5E,QAAQ,OAAO,QAAQ,WAAW,YAAY,QAAQ,SAAS,QAAQ,SAAS,OAAO,IAAI,MAAM,EAAE;AAAA,MACrG,CAAC;AAAA,IACH;AAAA,EACF;AAEA,QAAM,QAAQ,MAAM,KAAK,KAAK,OAAO,CAAC,EAAE;AAAA,IACtC,CAAC,GAAG,MAAM,EAAE,OAAO,cAAc,EAAE,MAAM,KAAK,EAAE,GAAG,cAAc,EAAE,EAAE;AAAA,EACvE;AACA,SAAO,aAAa,KAAK,EAAE,MAAM,CAAC;AACpC;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,EAAE,CAAC;AAAA,QAC7D;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/workflows/api/instances/[id]/advance/route.js

@@ -2,6 +2,7 @@ import { NextResponse } from "next/server";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { WorkflowInstance } from "../../../../data/entities.js";
 import * as workflowExecutor from "../../../../lib/workflow-executor.js";
 import * as transitionHandler from "../../../../lib/transition-handler.js";
@@ -13,6 +14,7 @@ import {
   workflowErrorSchema
 } from "../../../openapi.js";
 import { createLogger } from "@open-mercato/shared/lib/logger";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 const logger = createLogger("workflows");
 const advanceWorkflowSchema = z.object({
   toStepId: z.string().optional(),
@@ -32,7 +34,7 @@ async function POST(request, context) {
     }
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request });
     const tenantId = auth.tenantId;
-    const organizationId = scope?.selectedId ?? auth.orgId;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth);
     if (!tenantId || !organizationId) {
       return NextResponse.json(
         { error: "Missing tenant or organization context" },
@@ -195,6 +197,7 @@ async function POST(request, context) {
       { status: 200 }
     );
   } catch (error) {
+    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status });
     logger.error("Error advancing workflow", { err: error });
     if (error instanceof Error) {
       return NextResponse.json(