@things-factory/worklist 10.1.248 → 10.1.249

package/dist-server/controllers/activity-installation/registry-conflict.d.ts

@@ -0,0 +1,47 @@
+/**
+ * One key cannot be both a built activity and a declaration that it is not built yet.
+ *
+ * ── Why both directions ───────────────────────────────────────────────────
+ * declareIntendedActivity already refused a key that was installed. installActivityTemplate did not
+ * refuse a key that was declared, so which order a module happened to boot in decided whether the
+ * conflict was caught at all — declare-then-install slipped through and left the key in both
+ * registries.
+ *
+ * The catalog reads both and concatenates them, so the same work is drawn twice: once as working and
+ * once as planned, with the count strip off by one. A reader takes the planned row for work still to
+ * come. Nothing throws and nothing is logged.
+ *
+ * Deduplicating at the read would hide the broken state instead of preventing it, so the two
+ * refusals are made symmetric and the read is left alone.
+ *
+ * ── Which one wins ───────────────────────────────────────────────────────
+ * The built activity. A declaration says "this does not exist yet", and once it exists the
+ * declaration is simply stale — so both messages say to delete the declaration, and neither
+ * suggests removing the activity.
+ *
+ * The shapes are spelled out as key presence rather than imported: InstallableActivity carries
+ * type-graphql decorators, and the test runner strips types without reading them.
+ */
+type KeyedByName = {
+    [key: string]: unknown;
+};
+/** Called when a declaration arrives. */
+export declare function assertNotAlreadyInstalled(key: string, installed: KeyedByName): void;
+/** Called when a template arrives. */
+export declare function assertNotDeclaredIntended(key: string, intended: KeyedByName): void;
+/**
+ * Two doors must not fold to the same slug — **their value sentences would overwrite each other.**
+ *
+ * The i18n key for a decision slot is `approval.<door>.<inputPath>` and `<door>` is the activity
+ * name kebab-cased, so two names differing only where the slug does not look (`Batch Release` and
+ * `BatchRelease`) land on one key. Then one door's sentences are drawn on the other's card, in
+ * whichever order the locale file happened to be written.
+ *
+ * Nothing throws when that happens and nothing is logged — the card simply says the wrong thing
+ * about an approval somebody is about to give. It cannot happen today, which is why it is checked
+ * now rather than after a door finds it.
+ *
+ * Refused where the second template arrives, so the message can name both.
+ */
+export declare function assertDoorSlugIsFree(name: string, slugOf: (name: string) => string, installed: KeyedByName): void;
+export {};

package/dist-server/controllers/activity-installation/registry-conflict.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertNotAlreadyInstalled = assertNotAlreadyInstalled;
+exports.assertNotDeclaredIntended = assertNotDeclaredIntended;
+exports.assertDoorSlugIsFree = assertDoorSlugIsFree;
+/** Called when a declaration arrives. */
+function assertNotAlreadyInstalled(key, installed) {
+    if (!installed?.[key]) {
+        return;
+    }
+    throw new Error(`declareIntendedActivity: "${key}" is already installed as an activity. ` +
+        'Remove the declaration now that the activity exists.');
+}
+/** Called when a template arrives. */
+function assertNotDeclaredIntended(key, intended) {
+    if (!intended?.[key]) {
+        return;
+    }
+    throw new Error(`installActivityTemplate: "${key}" is also declared as intended — work identified but not built. ` +
+        'Remove the declaration now that the activity exists.');
+}
+/**
+ * Two doors must not fold to the same slug — **their value sentences would overwrite each other.**
+ *
+ * The i18n key for a decision slot is `approval.<door>.<inputPath>` and `<door>` is the activity
+ * name kebab-cased, so two names differing only where the slug does not look (`Batch Release` and
+ * `BatchRelease`) land on one key. Then one door's sentences are drawn on the other's card, in
+ * whichever order the locale file happened to be written.
+ *
+ * Nothing throws when that happens and nothing is logged — the card simply says the wrong thing
+ * about an approval somebody is about to give. It cannot happen today, which is why it is checked
+ * now rather than after a door finds it.
+ *
+ * Refused where the second template arrives, so the message can name both.
+ */
+function assertDoorSlugIsFree(name, slugOf, installed) {
+    const slug = slugOf(name);
+    const taken = Object.keys(installed || {}).find(one => one !== name && slugOf(one) === slug);
+    if (!taken) {
+        return;
+    }
+    throw new Error(`activity "${name}" folds to the same door key as "${taken}" ("${slug}"). ` +
+        `The approval card reads its sentences from approval.${slug}.<inputPath>, so the two would ` +
+        `draw each other's words with nothing to say which. Give one of them a name that reads ` +
+        `differently, not one that only looks different.`);
+}
+//# sourceMappingURL=registry-conflict.js.map

package/dist-server/controllers/activity-installation/registry-conflict.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-conflict.js","sourceRoot":"","sources":["../../../server/controllers/activity-installation/registry-conflict.ts"],"names":[],"mappings":";;AA2BA,8DASC;AAGD,8DASC;AAgBD,oDAeC;AArDD,yCAAyC;AACzC,SAAgB,yBAAyB,CAAC,GAAW,EAAE,SAAsB;IAC3E,IAAI,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,OAAM;IACR,CAAC;IAED,MAAM,IAAI,KAAK,CACb,6BAA6B,GAAG,yCAAyC;QACvE,sDAAsD,CACzD,CAAA;AACH,CAAC;AAED,sCAAsC;AACtC,SAAgB,yBAAyB,CAAC,GAAW,EAAE,QAAqB;IAC1E,IAAI,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,OAAM;IACR,CAAC;IAED,MAAM,IAAI,KAAK,CACb,6BAA6B,GAAG,kEAAkE;QAChG,sDAAsD,CACzD,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAgB,oBAAoB,CAAC,IAAY,EAAE,MAAgC,EAAE,SAAsB;IACzG,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;IAEzB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAA;IAE5F,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAM;IACR,CAAC;IAED,MAAM,IAAI,KAAK,CACb,aAAa,IAAI,oCAAoC,KAAK,OAAO,IAAI,MAAM;QACzE,uDAAuD,IAAI,iCAAiC;QAC5F,wFAAwF;QACxF,iDAAiD,CACpD,CAAA;AACH,CAAC","sourcesContent":["/**\n * One key cannot be both a built activity and a declaration that it is not built yet.\n *\n * ── Why both directions ───────────────────────────────────────────────────\n * declareIntendedActivity already refused a key that was installed. installActivityTemplate did not\n * refuse a key that was declared, so which order a module happened to boot in decided whether the\n * conflict was caught at all — declare-then-install slipped through and left the key in both\n * registries.\n *\n * The catalog reads both and concatenates them, so the same work is drawn twice: once as working and\n * once as planned, with the count strip off by one. A reader takes the planned row for work still to\n * come. Nothing throws and nothing is logged.\n *\n * Deduplicating at the read would hide the broken state instead of preventing it, so the two\n * refusals are made symmetric and the read is left alone.\n *\n * ── Which one wins ───────────────────────────────────────────────────────\n * The built activity. A declaration says \"this does not exist yet\", and once it exists the\n * declaration is simply stale — so both messages say to delete the declaration, and neither\n * suggests removing the activity.\n *\n * The shapes are spelled out as key presence rather than imported: InstallableActivity carries\n * type-graphql decorators, and the test runner strips types without reading them.\n */\ntype KeyedByName = { [key: string]: unknown }\n\n/** Called when a declaration arrives. */\nexport function assertNotAlreadyInstalled(key: string, installed: KeyedByName): void {\n  if (!installed?.[key]) {\n    return\n  }\n\n  throw new Error(\n    `declareIntendedActivity: \"${key}\" is already installed as an activity. ` +\n      'Remove the declaration now that the activity exists.'\n  )\n}\n\n/** Called when a template arrives. */\nexport function assertNotDeclaredIntended(key: string, intended: KeyedByName): void {\n  if (!intended?.[key]) {\n    return\n  }\n\n  throw new Error(\n    `installActivityTemplate: \"${key}\" is also declared as intended — work identified but not built. ` +\n      'Remove the declaration now that the activity exists.'\n  )\n}\n\n/**\n * Two doors must not fold to the same slug — **their value sentences would overwrite each other.**\n *\n * The i18n key for a decision slot is `approval.<door>.<inputPath>` and `<door>` is the activity\n * name kebab-cased, so two names differing only where the slug does not look (`Batch Release` and\n * `BatchRelease`) land on one key. Then one door's sentences are drawn on the other's card, in\n * whichever order the locale file happened to be written.\n *\n * Nothing throws when that happens and nothing is logged — the card simply says the wrong thing\n * about an approval somebody is about to give. It cannot happen today, which is why it is checked\n * now rather than after a door finds it.\n *\n * Refused where the second template arrives, so the message can name both.\n */\nexport function assertDoorSlugIsFree(name: string, slugOf: (name: string) => string, installed: KeyedByName): void {\n  const slug = slugOf(name)\n\n  const taken = Object.keys(installed || {}).find(one => one !== name && slugOf(one) === slug)\n\n  if (!taken) {\n    return\n  }\n\n  throw new Error(\n    `activity \"${name}\" folds to the same door key as \"${taken}\" (\"${slug}\"). ` +\n      `The approval card reads its sentences from approval.${slug}.<inputPath>, so the two would ` +\n      `draw each other's words with nothing to say which. Give one of them a name that reads ` +\n      `differently, not one that only looks different.`\n  )\n}\n"]}

package/dist-server/controllers/activity-instance/abort.d.ts

@@ -0,0 +1,5 @@
+import { ActivityInstance } from '../../service/activity-instance/activity-instance.js';
+export declare function abort({ id, reason }: {
+    id: string;
+    reason: string;
+}, context: ResolverContext): Promise<ActivityInstance>;

package/dist-server/controllers/activity-instance/abort.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.abort = abort;
+const activity_thread_js_1 = require("../../service/activity-thread/activity-thread.js");
+const activity_instance_js_1 = require("../../service/activity-instance/activity-instance.js");
+const common_js_1 = require("../common.js");
+const _abort_js_1 = require("../activity-thread/_abort.js");
+async function abort({ id, reason }, context) {
+    const { domain, user, tx } = context.state;
+    var repository = tx.getRepository(activity_instance_js_1.ActivityInstance);
+    var activityInstance = await repository.findOne({
+        where: { domain: { id: domain.id }, id },
+        relations: [
+            'domain',
+            'activity',
+            'activityThreads',
+            'assigneeRoles',
+            'supervisoryRole',
+            'updater',
+            'creator',
+            'starter',
+            'terminator'
+        ]
+    });
+    if (!activityInstance) {
+        throw new Error(context.t('error.activity-instance not found', {
+            activityInstance: id
+        }));
+    }
+    /*
+      Prerequisites for a Task to Be Aborted.
+      - The previous state of the task must not be End or Aborted.
+    */
+    if (activityInstance.state == activity_instance_js_1.ActivityInstanceStatus.Aborted ||
+        activityInstance.state == activity_instance_js_1.ActivityInstanceStatus.Ended) {
+        throw new Error(context.t(`error.activity-instance is already terminated`, {
+            id,
+            state: activityInstance.state
+        }));
+    }
+    /*
+      Actions to be processed when a task is aborted
+      - All related activity threads must be aborted.
+    */
+    const TERMINATED = [activity_thread_js_1.ActivityThreadStatus.Aborted, activity_thread_js_1.ActivityThreadStatus.Ended];
+    for (let activityThread of activityInstance.activityThreads) {
+        if (TERMINATED.includes(activityThread.state)) {
+            continue;
+        }
+        await (0, _abort_js_1._abort)({ activityThread, reason }, context);
+    }
+    return await repository.save({
+        ...activityInstance,
+        reason,
+        ...(await (0, common_js_1.evalActivityInstanceState)(id, context)),
+        transaction: 'abort',
+        updater: user,
+        terminatedAt: new Date(),
+        terminator: user
+    });
+}
+//# sourceMappingURL=abort.js.map

package/dist-server/controllers/activity-instance/abort.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"abort.js","sourceRoot":"","sources":["../../../server/controllers/activity-instance/abort.ts"],"names":[],"mappings":";;AAMA,sBAuEC;AA7ED,yFAAuF;AACvF,+FAA+G;AAC/G,4CAAwD;AAExD,4DAA4E;AAErE,KAAK,UAAU,KAAK,CACzB,EAAE,EAAE,EAAE,MAAM,EAAkC,EAC9C,OAAwB;IAExB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAE1C,IAAI,UAAU,GAAG,EAAE,CAAC,aAAa,CAAC,uCAAgB,CAAC,CAAA;IAEnD,IAAI,gBAAgB,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;QAC9C,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE;QACxC,SAAS,EAAE;YACT,QAAQ;YACR,UAAU;YACV,iBAAiB;YACjB,eAAe;YACf,iBAAiB;YACjB,SAAS;YACT,SAAS;YACT,SAAS;YACT,YAAY;SACb;KACF,CAAC,CAAA;IAEF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,OAAO,CAAC,CAAC,CAAC,mCAAmC,EAAE;YAC7C,gBAAgB,EAAE,EAAE;SACrB,CAAC,CACH,CAAA;IACH,CAAC;IAED;;;MAGE;IACF,IACE,gBAAgB,CAAC,KAAK,IAAI,6CAAsB,CAAC,OAAO;QACxD,gBAAgB,CAAC,KAAK,IAAI,6CAAsB,CAAC,KAAK,EACtD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,OAAO,CAAC,CAAC,CAAC,+CAA+C,EAAE;YACzD,EAAE;YACF,KAAK,EAAE,gBAAgB,CAAC,KAAK;SAC9B,CAAC,CACH,CAAA;IACH,CAAC;IAED;;;MAGE;IAEF,MAAM,UAAU,GAAG,CAAC,yCAAoB,CAAC,OAAO,EAAE,yCAAoB,CAAC,KAAK,CAAC,CAAA;IAE7E,KAAK,IAAI,cAAc,IAAI,gBAAgB,CAAC,eAAe,EAAE,CAAC;QAC5D,IAAI,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9C,SAAQ;QACV,CAAC;QAED,MAAM,IAAA,kBAAmB,EAAC,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,CAAA;IAChE,CAAC;IAED,OAAO,MAAM,UAAU,CAAC,IAAI,CAAC;QAC3B,GAAG,gBAAgB;QACnB,MAAM;QACN,GAAG,CAAC,MAAM,IAAA,qCAAyB,EAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACjD,WAAW,EAAE,OAAO;QACpB,OAAO,EAAE,IAAI;QACb,YAAY,EAAE,IAAI,IAAI,EAAE;QACxB,UAAU,EAAE,IAAI;KACjB,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { ActivityThreadStatus } from '../../service/activity-thread/activity-thread.js'\nimport { ActivityInstance, ActivityInstanceStatus } from '../../service/activity-instance/activity-instance.js'\nimport { evalActivityInstanceState } from '../common.js'\n\nimport { _abort as abortActivityThread } from '../activity-thread/_abort.js'\n\nexport async function abort(\n  { id, reason }: { id: string; reason: string },\n  context: ResolverContext\n): Promise<ActivityInstance> {\n  const { domain, user, tx } = context.state\n\n  var repository = tx.getRepository(ActivityInstance)\n\n  var activityInstance = await repository.findOne({\n    where: { domain: { id: domain.id }, id },\n    relations: [\n      'domain',\n      'activity',\n      'activityThreads',\n      'assigneeRoles',\n      'supervisoryRole',\n      'updater',\n      'creator',\n      'starter',\n      'terminator'\n    ]\n  })\n\n  if (!activityInstance) {\n    throw new Error(\n      context.t('error.activity-instance not found', {\n        activityInstance: id\n      })\n    )\n  }\n\n  /* \n    Prerequisites for a Task to Be Aborted.\n    - The previous state of the task must not be End or Aborted.\n  */\n  if (\n    activityInstance.state == ActivityInstanceStatus.Aborted ||\n    activityInstance.state == ActivityInstanceStatus.Ended\n  ) {\n    throw new Error(\n      context.t(`error.activity-instance is already terminated`, {\n        id,\n        state: activityInstance.state\n      })\n    )\n  }\n\n  /* \n    Actions to be processed when a task is aborted\n    - All related activity threads must be aborted.\n  */\n\n  const TERMINATED = [ActivityThreadStatus.Aborted, ActivityThreadStatus.Ended]\n\n  for (let activityThread of activityInstance.activityThreads) {\n    if (TERMINATED.includes(activityThread.state)) {\n      continue\n    }\n\n    await abortActivityThread({ activityThread, reason }, context)\n  }\n\n  return await repository.save({\n    ...activityInstance,\n    reason,\n    ...(await evalActivityInstanceState(id, context)),\n    transaction: 'abort',\n    updater: user,\n    terminatedAt: new Date(),\n    terminator: user\n  })\n}\n"]}

package/dist-server/controllers/activity-instance/approval-expectation.d.ts

@@ -0,0 +1,34 @@
+/**
+ * 「결재를 받겠다」는 기대를 지킬 수 있나 — **순수 판단.**
+ *
+ * ── 왜 이 자리가 필요한가 ──────────────────────────────────────────────────
+ * `startingType: 'post'` 는 낸 사람에게 스레드를 하나 만들고 곧바로 제출까지 간다. 결재선이 있으면
+ * 거기서 상신되고, **없으면 그대로 끝난다.** 끝나면 완료 콜백이 돌아 업무가 확정된다.
+ *
+ * 그 거동 자체는 틀리지 않았다 — 결재 없이 내면 끝나는 일이 있다(작업 일지 같은 것). 문제는 **내는
+ * 쪽이 「이건 결재를 받는다」고 믿고 냈는데 결재선이 비어 조용히 확정되는 경우**다. 오류도 없고
+ * 흔적도 없어서, 승인 게이트가 있는 척만 하게 된다.
+ *
+ * 그래서 기대를 낸 쪽이 말하고 여기서 지킨다. **말하지 않은 건은 지나간다** — 기존에 돌던 것이
+ * 하나도 달라지지 않아야 한다.
+ *
+ * ── 왜 내는 쪽에서 미리 보는 것으로는 부족한가 ────────────────────────────
+ * 미리 봐도 되지만 그것만으로는 부족하다. 보고 나서 내기까지 사이에 누가 결재선을 비울 수 있다.
+ * 내는 것과 같은 트랜잭션 안에서 보는 자리는 하나뿐이다.
+ */
+export type ApprovalExpectation = {
+    ok: true;
+} | {
+    ok: false;
+    because: 'approval-line-missing';
+    activityName: string;
+};
+export declare function judgeApprovalExpectation(input: {
+    requireApproval?: boolean;
+    /** 액티비티의 것을 물려받고, 초안을 다시 내는 경우 원본의 것까지 합친 **최종** 결재선. */
+    approvalLine?: unknown[] | null;
+    activityName: string;
+}): ApprovalExpectation;
+export declare function expectationBroken(verdict: ApprovalExpectation): verdict is Extract<ApprovalExpectation, {
+    ok: false;
+}>;

package/dist-server/controllers/activity-instance/approval-expectation.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.judgeApprovalExpectation = judgeApprovalExpectation;
+exports.expectationBroken = expectationBroken;
+function judgeApprovalExpectation(input) {
+    if (!input.requireApproval) {
+        /* 기대를 말하지 않았다. 결재 없이 내면 끝나는 일이 정상인 앱이 있다. */
+        return { ok: true };
+    }
+    if (input.approvalLine?.length) {
+        return { ok: true };
+    }
+    return { ok: false, because: 'approval-line-missing', activityName: input.activityName };
+}
+function expectationBroken(verdict) {
+    return !verdict.ok;
+}
+//# sourceMappingURL=approval-expectation.js.map

package/dist-server/controllers/activity-instance/approval-expectation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-expectation.js","sourceRoot":"","sources":["../../../server/controllers/activity-instance/approval-expectation.ts"],"names":[],"mappings":";;AAsBA,4DAgBC;AAED,8CAIC;AAtBD,SAAgB,wBAAwB,CAAC,KAKxC;IACC,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;QAC3B,6CAA6C;QAC7C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;IACrB,CAAC;IAED,IAAI,KAAK,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QAC/B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;IACrB,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAA;AAC1F,CAAC;AAED,SAAgB,iBAAiB,CAC/B,OAA4B;IAE5B,OAAO,CAAC,OAAO,CAAC,EAAE,CAAA;AACpB,CAAC","sourcesContent":["/**\n * 「결재를 받겠다」는 기대를 지킬 수 있나 — **순수 판단.**\n *\n * ── 왜 이 자리가 필요한가 ──────────────────────────────────────────────────\n * `startingType: 'post'` 는 낸 사람에게 스레드를 하나 만들고 곧바로 제출까지 간다. 결재선이 있으면\n * 거기서 상신되고, **없으면 그대로 끝난다.** 끝나면 완료 콜백이 돌아 업무가 확정된다.\n *\n * 그 거동 자체는 틀리지 않았다 — 결재 없이 내면 끝나는 일이 있다(작업 일지 같은 것). 문제는 **내는\n * 쪽이 「이건 결재를 받는다」고 믿고 냈는데 결재선이 비어 조용히 확정되는 경우**다. 오류도 없고\n * 흔적도 없어서, 승인 게이트가 있는 척만 하게 된다.\n *\n * 그래서 기대를 낸 쪽이 말하고 여기서 지킨다. **말하지 않은 건은 지나간다** — 기존에 돌던 것이\n * 하나도 달라지지 않아야 한다.\n *\n * ── 왜 내는 쪽에서 미리 보는 것으로는 부족한가 ────────────────────────────\n * 미리 봐도 되지만 그것만으로는 부족하다. 보고 나서 내기까지 사이에 누가 결재선을 비울 수 있다.\n * 내는 것과 같은 트랜잭션 안에서 보는 자리는 하나뿐이다.\n */\nexport type ApprovalExpectation =\n  | { ok: true }\n  | { ok: false; because: 'approval-line-missing'; activityName: string }\n\nexport function judgeApprovalExpectation(input: {\n  requireApproval?: boolean\n  /** 액티비티의 것을 물려받고, 초안을 다시 내는 경우 원본의 것까지 합친 **최종** 결재선. */\n  approvalLine?: unknown[] | null\n  activityName: string\n}): ApprovalExpectation {\n  if (!input.requireApproval) {\n    /* 기대를 말하지 않았다. 결재 없이 내면 끝나는 일이 정상인 앱이 있다. */\n    return { ok: true }\n  }\n\n  if (input.approvalLine?.length) {\n    return { ok: true }\n  }\n\n  return { ok: false, because: 'approval-line-missing', activityName: input.activityName }\n}\n\nexport function expectationBroken(\n  verdict: ApprovalExpectation\n): verdict is Extract<ApprovalExpectation, { ok: false }> {\n  return !verdict.ok\n}\n"]}

package/dist-server/controllers/activity-instance/approval-line-input.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The approval line a caller may hand in when drafting or issuing (ruling 2026-09-24).
+ *
+ * The approval line of an activity is set in one place, the activity's detail. A case that carries
+ * its own line would let whoever raises it choose who approves it - a line of references only ends
+ * with nobody judging, and anyone can be named. So:
+ *
+ *   the activity has a line   the input is absent, or the same line - else a named refusal
+ *   the activity has none     the input is taken (an ad hoc line)
+ *
+ * No exception for a manager: a per-case way around the activity's line would make the line live in
+ * two places.
+ *
+ * "The same" is step by step - who (value), in what capacity (participation) and in what order - not
+ * the objects' key order. plant's server doors pass the line of the activity they read by name, which
+ * is this very line, and they must keep passing.
+ */
+type Step = {
+    value?: string;
+    approver?: {
+        id?: string;
+    } | null;
+    participation?: string | null;
+};
+export declare const LINE_IS_SET = "approval-line-is-set";
+export declare function sameApprovalLine(a: readonly Step[] | null | undefined, b: readonly Step[] | null | undefined): boolean;
+/** null when the input may stand; LINE_IS_SET when it would replace the activity's line. */
+export declare function approvalLineInputRefusal(activityLine: readonly Step[] | null | undefined, input: readonly Step[] | null | undefined): typeof LINE_IS_SET | null;
+export {};

package/dist-server/controllers/activity-instance/approval-line-input.js

@@ -0,0 +1,44 @@
+"use strict";
+/**
+ * The approval line a caller may hand in when drafting or issuing (ruling 2026-09-24).
+ *
+ * The approval line of an activity is set in one place, the activity's detail. A case that carries
+ * its own line would let whoever raises it choose who approves it - a line of references only ends
+ * with nobody judging, and anyone can be named. So:
+ *
+ *   the activity has a line   the input is absent, or the same line - else a named refusal
+ *   the activity has none     the input is taken (an ad hoc line)
+ *
+ * No exception for a manager: a per-case way around the activity's line would make the line live in
+ * two places.
+ *
+ * "The same" is step by step - who (value), in what capacity (participation) and in what order - not
+ * the objects' key order. plant's server doors pass the line of the activity they read by name, which
+ * is this very line, and they must keep passing.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LINE_IS_SET = void 0;
+exports.sameApprovalLine = sameApprovalLine;
+exports.approvalLineInputRefusal = approvalLineInputRefusal;
+exports.LINE_IS_SET = 'approval-line-is-set';
+/** Empty participation means approval (approval-line.ts). */
+function capacity(step) {
+    return step?.participation === 'reference' ? 'reference' : 'approval';
+}
+function who(step) {
+    return String(step?.value || step?.approver?.id || '');
+}
+function sameApprovalLine(a, b) {
+    const left = a || [];
+    const right = b || [];
+    return left.length === right.length && left.every((step, order) => who(step) === who(right[order]) && capacity(step) === capacity(right[order]));
+}
+/** null when the input may stand; LINE_IS_SET when it would replace the activity's line. */
+function approvalLineInputRefusal(activityLine, input) {
+    if (!input)
+        return null;
+    if (!activityLine?.length)
+        return null;
+    return sameApprovalLine(activityLine, input) ? null : exports.LINE_IS_SET;
+}
+//# sourceMappingURL=approval-line-input.js.map

package/dist-server/controllers/activity-instance/approval-line-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-line-input.js","sourceRoot":"","sources":["../../../server/controllers/activity-instance/approval-line-input.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG;;;AAeH,4CAKC;AAGD,4DAQC;AA3BY,QAAA,WAAW,GAAG,sBAAsB,CAAA;AAEjD,6DAA6D;AAC7D,SAAS,QAAQ,CAAC,IAAU;IAC1B,OAAO,IAAI,EAAE,aAAa,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAA;AACvE,CAAC;AAED,SAAS,GAAG,CAAC,IAAU;IACrB,OAAO,MAAM,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;AACxD,CAAC;AAED,SAAgB,gBAAgB,CAAC,CAAqC,EAAE,CAAqC;IAC3G,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAA;IACpB,MAAM,KAAK,GAAG,CAAC,IAAI,EAAE,CAAA;IAErB,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAClJ,CAAC;AAED,4FAA4F;AAC5F,SAAgB,wBAAwB,CACtC,YAAgD,EAChD,KAAyC;IAEzC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,IAAI,CAAC,YAAY,EAAE,MAAM;QAAE,OAAO,IAAI,CAAA;IAEtC,OAAO,gBAAgB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,mBAAW,CAAA;AACnE,CAAC","sourcesContent":["/**\n * The approval line a caller may hand in when drafting or issuing (ruling 2026-09-24).\n *\n * The approval line of an activity is set in one place, the activity's detail. A case that carries\n * its own line would let whoever raises it choose who approves it - a line of references only ends\n * with nobody judging, and anyone can be named. So:\n *\n *   the activity has a line   the input is absent, or the same line - else a named refusal\n *   the activity has none     the input is taken (an ad hoc line)\n *\n * No exception for a manager: a per-case way around the activity's line would make the line live in\n * two places.\n *\n * \"The same\" is step by step - who (value), in what capacity (participation) and in what order - not\n * the objects' key order. plant's server doors pass the line of the activity they read by name, which\n * is this very line, and they must keep passing.\n */\n\ntype Step = { value?: string; approver?: { id?: string } | null; participation?: string | null }\n\nexport const LINE_IS_SET = 'approval-line-is-set'\n\n/** Empty participation means approval (approval-line.ts). */\nfunction capacity(step: Step): string {\n  return step?.participation === 'reference' ? 'reference' : 'approval'\n}\n\nfunction who(step: Step): string {\n  return String(step?.value || step?.approver?.id || '')\n}\n\nexport function sameApprovalLine(a: readonly Step[] | null | undefined, b: readonly Step[] | null | undefined): boolean {\n  const left = a || []\n  const right = b || []\n\n  return left.length === right.length && left.every((step, order) => who(step) === who(right[order]) && capacity(step) === capacity(right[order]))\n}\n\n/** null when the input may stand; LINE_IS_SET when it would replace the activity's line. */\nexport function approvalLineInputRefusal(\n  activityLine: readonly Step[] | null | undefined,\n  input: readonly Step[] | null | undefined\n): typeof LINE_IS_SET | null {\n  if (!input) return null\n  if (!activityLine?.length) return null\n\n  return sameApprovalLine(activityLine, input) ? null : LINE_IS_SET\n}\n"]}

package/dist-server/controllers/activity-instance/assign.d.ts

@@ -0,0 +1,8 @@
+import { ActivityInstance } from '../../service/activity-instance/activity-instance.js';
+export declare function assign({ id, assignees, assigneeRoles, reason, dueAt }: {
+    id: string;
+    assignees?: string[];
+    assigneeRoles?: string[];
+    reason?: string;
+    dueAt?: Date;
+}, context: ResolverContext): Promise<ActivityInstance>;

package/dist-server/controllers/activity-instance/assign.js

@@ -0,0 +1,152 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assign = assign;
+const typeorm_1 = require("typeorm");
+const auth_base_1 = require("@things-factory/auth-base");
+const shell_1 = require("@things-factory/shell");
+const activity_instance_js_1 = require("../../service/activity-instance/activity-instance.js");
+const activity_thread_js_1 = require("../../service/activity-thread/activity-thread.js");
+const assignee_pool_js_1 = require("../../service/activity-instance/assignee-pool.js");
+const common_js_1 = require("../common.js");
+async function assign({ id, assignees, assigneeRoles, reason, dueAt }, context) {
+    const { domain, user, tx } = context.state;
+    const repository = tx.getRepository(activity_instance_js_1.ActivityInstance);
+    var activityInstance = await repository.findOne({
+        where: { domain: { id: domain.id }, id },
+        relations: ['domain', 'activity', 'assigneeRoles', 'supervisoryRole', 'updater', 'creator', 'starter', 'terminator']
+    });
+    if (!activityInstance) {
+        throw new Error(context.t('error.activity-instance not found', {
+            activityInstance: id
+        }));
+    }
+    /*
+     * People or a pool, not both in one call. Given both, the case would wait for the pool and already be
+     * held by the people, and which of the two it means could not be read off the case afterwards.
+     */
+    if (assigneeRoles?.length && assignees?.length) {
+        throw new Error(context.t('error.activity-instance assign people or a role, not both', { id }));
+    }
+    if (assigneeRoles?.length) {
+        return await assignToPool(activityInstance, assigneeRoles, dueAt, context);
+    }
+    /*
+      Prerequisites for a Task to Be Assigned.
+      - The previous state of the task must not be Assigned.
+    */
+    if (activityInstance.state !== activity_instance_js_1.ActivityInstanceStatus.Issued &&
+        activityInstance.state !== activity_instance_js_1.ActivityInstanceStatus.Unassigned) {
+        throw new Error(context.t(`error.activity-instance should not be assigned`, {
+            id,
+            actual: activityInstance.state
+        }));
+    }
+    if (dueAt) {
+        activityInstance.dueAt = dueAt;
+    }
+    /*
+     * People of this domain only. By email alone a manager could hand the task to someone of another
+     * tenant, whose to-do list reads their own domain and would never show it. An address that is not
+     * here is named rather than dropped - dropped, the task went to fewer people than were asked.
+     */
+    const assignedUsers = await tx.getRepository(auth_base_1.User).find({
+        where: { email: (0, typeorm_1.In)(assignees || []), domains: { id: domain.id } },
+        relations: ['domains']
+    });
+    const missing = (assignees || []).filter(email => !assignedUsers.some(one => one.email === email));
+    if (missing.length) {
+        throw new Error(context.t('error.activity-instance assignee not in this domain', { emails: missing.join(', ') }));
+    }
+    await (0, common_js_1.createActivityThreadsForUsers)('assign', activityInstance, assignedUsers, context);
+    return await tx.getRepository(activity_instance_js_1.ActivityInstance).findOneBy({ id: activityInstance.id });
+}
+/**
+ * Put a case in a pool: whoever holds any one of its roles and picks it first holds it.
+ *
+ * The pool is what issue() makes when the activity names assignee roles and waits for one person -
+ * `assigneeRoles` on the case, `threadsMin` 1, and one unassigned thread. To-do lists and the pickable
+ * list read exactly that (assignee-pool.ts), so this makes the same shape and nothing else; a second
+ * shape would be a second pool nobody's list reads.
+ *
+ * Only a case nobody holds - `Issued`, no valid thread (common.ts evalActivityInstanceState). A case
+ * someone already holds is theirs; taking it back into a pool is another action, not this one.
+ */
+async function assignToPool(activityInstance, roleIds, dueAt, context) {
+    const { domain, user, tx } = context.state;
+    const repository = tx.getRepository(activity_instance_js_1.ActivityInstance);
+    const { id } = activityInstance;
+    if (activityInstance.state !== activity_instance_js_1.ActivityInstanceStatus.Issued) {
+        throw new Error(context.t('error.activity-instance should not be assigned', {
+            id,
+            actual: activityInstance.state
+        }));
+    }
+    /*
+     * Roles of this domain only, each once - the same reason as people above: another tenant's pool is read
+     * by nobody here (assignee-pool.ts refuses by name).
+     */
+    const roles = await (0, assignee_pool_js_1.resolvePoolRoles)(roleIds, context);
+    /*
+     * A pool nobody is in is a case nobody sees. Its people are every holder of any of its roles, counted
+     * once each, the way issue() counts them (createActivityThreadsForAllRoleUsers).
+     */
+    if (!(0, assignee_pool_js_1.poolMembers)(roles).length) {
+        throw new Error(context.t('error.activity-instance role has no members', { role: roles.map(role => role.name).join(', ') }));
+    }
+    /*
+     * Take hold of the case first, as pick does: the UPDATE matches only a case still issued and holds its
+     * row to the end of this transaction. Every way into a waiting case takes this row before its threads -
+     * pick's UPDATE, and a member claiming the pool's waiting thread (activity-thread/check-authority.ts) - so
+     * whoever is second waits for the first to commit and then reads what it did. One order everywhere, so
+     * no two of them deadlock.
+     */
+    const claimed = await repository.update({ domain: { id: domain.id }, id, state: activity_instance_js_1.ActivityInstanceStatus.Issued }, { threadsMin: 1, updater: user, ...(dueAt ? { dueAt } : {}) });
+    if (!claimed.affected) {
+        throw new Error(context.t('error.activity-approval taken by someone else', { activityApproval: id }));
+    }
+    /*
+     * Nobody holds it - asked of the threads too, not only of the state. The state is worked out again only
+     * when a thread changes (common.ts updateActivityInstanceState); a thread someone holds under a case still
+     * marked issued is theirs, and the refusal rolls the UPDATE above back.
+     */
+    const threads = await tx.getRepository(activity_thread_js_1.ActivityThread).find({
+        where: { activityInstance: { id } },
+        /* A locking read is a current read - a plain one may answer from the snapshot taken before the wait. */
+        ...((0, shell_1.writeLockSupported)(tx) ? { lock: { mode: 'pessimistic_write' } } : {})
+    });
+    if (threads.some(thread => thread.isValid())) {
+        throw new Error(context.t('error.activity-approval taken by someone else', { activityApproval: id }));
+    }
+    /*
+     * The pool itself is a join table, not a column the UPDATE can set. Written under the hold the UPDATE took,
+     * and written whole: every row of this case goes, then the new list. Worked out as a difference from the
+     * case read above, it was a difference from a read taken before the hold - two assigns at once on postgres
+     * left the union of both lists, the pool of neither (measured 2026-10-20). A DELETE reads what is there
+     * now, so the pool is the list of whichever assign held the case last. Not a save - that would write a
+     * history row of a half-read case.
+     */
+    await tx
+        .createQueryBuilder()
+        .delete()
+        .from(assignee_pool_js_1.CASE_POOL.table)
+        .where(`${assignee_pool_js_1.CASE_POOL.caseColumn} = :id`, { id })
+        .execute();
+    await repository
+        .createQueryBuilder()
+        .relation(activity_instance_js_1.ActivityInstance, 'assigneeRoles')
+        .of(id)
+        .add(roles.map(role => role.id));
+    const pooled = await repository.findOne({
+        where: { id },
+        relations: ['domain', 'activity', 'assigneeRoles', 'supervisoryRole', 'updater', 'creator', 'starter', 'terminator']
+    });
+    /*
+     * A case already in a pool moves to the other pool with its one waiting thread - nobody has taken it, so
+     * a manager who chose the wrong role puts it right here instead of aborting the case.
+     */
+    if (!threads.some(thread => thread.state === activity_thread_js_1.ActivityThreadStatus.Unassigned)) {
+        await (0, common_js_1.createActivityThreadWithUnassigned)('assign', pooled, context);
+    }
+    return await repository.findOneBy({ id });
+}
+//# sourceMappingURL=assign.js.map

package/dist-server/controllers/activity-instance/assign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assign.js","sourceRoot":"","sources":["../../../server/controllers/activity-instance/assign.ts"],"names":[],"mappings":";;AAUA,wBA8EC;AAxFD,qCAA4B;AAE5B,yDAAgD;AAChD,iDAA0D;AAE1D,+FAA+G;AAC/G,yFAAuG;AACvG,uFAA2G;AAC3G,4CAAgG;AAEzF,KAAK,UAAU,MAAM,CAC1B,EACE,EAAE,EACF,SAAS,EACT,aAAa,EACb,MAAM,EACN,KAAK,EACyF,EAChG,OAAwB;IAExB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAE1C,MAAM,UAAU,GAAG,EAAE,CAAC,aAAa,CAAC,uCAAgB,CAAC,CAAA;IAErD,IAAI,gBAAgB,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;QAC9C,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE;QACxC,SAAS,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,eAAe,EAAE,iBAAiB,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC;KACrH,CAAC,CAAA;IAEF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,OAAO,CAAC,CAAC,CAAC,mCAAmC,EAAE;YAC7C,gBAAgB,EAAE,EAAE;SACrB,CAAC,CACH,CAAA;IACH,CAAC;IAED;;;OAGG;IACH,IAAI,aAAa,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,2DAA2D,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;IACjG,CAAC;IAED,IAAI,aAAa,EAAE,MAAM,EAAE,CAAC;QAC1B,OAAO,MAAM,YAAY,CAAC,gBAAgB,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA;IAC5E,CAAC;IAED;;;MAGE;IACF,IACE,gBAAgB,CAAC,KAAK,KAAK,6CAAsB,CAAC,MAAM;QACxD,gBAAgB,CAAC,KAAK,KAAK,6CAAsB,CAAC,UAAU,EAC5D,CAAC;QACD,MAAM,IAAI,KAAK,CACb,OAAO,CAAC,CAAC,CAAC,gDAAgD,EAAE;YAC1D,EAAE;YACF,MAAM,EAAE,gBAAgB,CAAC,KAAK;SAC/B,CAAC,CACH,CAAA;IACH,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,gBAAgB,CAAC,KAAK,GAAG,KAAK,CAAA;IAChC,CAAC;IAED;;;;OAIG;IACH,MAAM,aAAa,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,gBAAI,CAAC,CAAC,IAAI,CAAC;QACtD,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,YAAE,EAAC,SAAS,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE;QACjE,SAAS,EAAE,CAAC,SAAS,CAAC;KACvB,CAAC,CAAA;IAEF,MAAM,OAAO,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAA;IAElG,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,qDAAqD,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;IACnH,CAAC;IAED,MAAM,IAAA,yCAA6B,EAAC,QAAQ,EAAE,gBAAgB,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;IAEvF,OAAO,MAAM,EAAE,CAAC,aAAa,CAAC,uCAAgB,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,gBAAgB,CAAC,EAAE,EAAE,CAAC,CAAA;AACxF,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,YAAY,CACzB,gBAAkC,EAClC,OAAiB,EACjB,KAAuB,EACvB,OAAwB;IAExB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAC1C,MAAM,UAAU,GAAG,EAAE,CAAC,aAAa,CAAC,uCAAgB,CAAC,CAAA;IACrD,MAAM,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAA;IAE/B,IAAI,gBAAgB,CAAC,KAAK,KAAK,6CAAsB,CAAC,MAAM,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,OAAO,CAAC,CAAC,CAAC,gDAAgD,EAAE;YAC1D,EAAE;YACF,MAAM,EAAE,gBAAgB,CAAC,KAAK;SAC/B,CAAC,CACH,CAAA;IACH,CAAC;IAED;;;OAGG;IACH,MAAM,KAAK,GAAG,MAAM,IAAA,mCAAgB,EAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAEtD;;;OAGG;IACH,IAAI,CAAC,IAAA,8BAAW,EAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,6CAA6C,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;IAC9H,CAAC;IAED;;;;;;OAMG;IACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,CACrC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,6CAAsB,CAAC,MAAM,EAAE,EACvE,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAC9D,CAAA;IAED,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,+CAA+C,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;IACvG,CAAC;IAED;;;;OAIG;IACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,mCAAc,CAAC,CAAC,IAAI,CAAC;QAC1D,KAAK,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,EAAE,EAAE;QACnC,wGAAwG;QACxG,GAAG,CAAC,IAAA,0BAAkB,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,mBAA4B,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpF,CAAC,CAAA;IAEF,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,+CAA+C,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;IACvG,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,EAAE;SACL,kBAAkB,EAAE;SACpB,MAAM,EAAE;SACR,IAAI,CAAC,4BAAS,CAAC,KAAK,CAAC;SACrB,KAAK,CAAC,GAAG,4BAAS,CAAC,UAAU,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC;SAC9C,OAAO,EAAE,CAAA;IAEZ,MAAM,UAAU;SACb,kBAAkB,EAAE;SACpB,QAAQ,CAAC,uCAAgB,EAAE,eAAe,CAAC;SAC3C,EAAE,CAAC,EAAE,CAAC;SACN,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;IAElC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;QACtC,KAAK,EAAE,EAAE,EAAE,EAAE;QACb,SAAS,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,eAAe,EAAE,iBAAiB,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC;KACrH,CAAC,CAAA;IAEF;;;OAGG;IACH,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,yCAAoB,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAA,8CAAkC,EAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;IACrE,CAAC;IAED,OAAO,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;AAC3C,CAAC","sourcesContent":["import { In } from 'typeorm'\n\nimport { User } from '@things-factory/auth-base'\nimport { writeLockSupported } from '@things-factory/shell'\n\nimport { ActivityInstance, ActivityInstanceStatus } from '../../service/activity-instance/activity-instance.js'\nimport { ActivityThread, ActivityThreadStatus } from '../../service/activity-thread/activity-thread.js'\nimport { CASE_POOL, poolMembers, resolvePoolRoles } from '../../service/activity-instance/assignee-pool.js'\nimport { createActivityThreadWithUnassigned, createActivityThreadsForUsers } from '../common.js'\n\nexport async function assign(\n  {\n    id,\n    assignees,\n    assigneeRoles,\n    reason,\n    dueAt\n  }: { id: string; assignees?: string[]; assigneeRoles?: string[]; reason?: string; dueAt?: Date },\n  context: ResolverContext\n): Promise<ActivityInstance> {\n  const { domain, user, tx } = context.state\n\n  const repository = tx.getRepository(ActivityInstance)\n\n  var activityInstance = await repository.findOne({\n    where: { domain: { id: domain.id }, id },\n    relations: ['domain', 'activity', 'assigneeRoles', 'supervisoryRole', 'updater', 'creator', 'starter', 'terminator']\n  })\n\n  if (!activityInstance) {\n    throw new Error(\n      context.t('error.activity-instance not found', {\n        activityInstance: id\n      })\n    )\n  }\n\n  /*\n   * People or a pool, not both in one call. Given both, the case would wait for the pool and already be\n   * held by the people, and which of the two it means could not be read off the case afterwards.\n   */\n  if (assigneeRoles?.length && assignees?.length) {\n    throw new Error(context.t('error.activity-instance assign people or a role, not both', { id }))\n  }\n\n  if (assigneeRoles?.length) {\n    return await assignToPool(activityInstance, assigneeRoles, dueAt, context)\n  }\n\n  /*\n    Prerequisites for a Task to Be Assigned.\n    - The previous state of the task must not be Assigned.\n  */\n  if (\n    activityInstance.state !== ActivityInstanceStatus.Issued &&\n    activityInstance.state !== ActivityInstanceStatus.Unassigned\n  ) {\n    throw new Error(\n      context.t(`error.activity-instance should not be assigned`, {\n        id,\n        actual: activityInstance.state\n      })\n    )\n  }\n\n  if (dueAt) {\n    activityInstance.dueAt = dueAt\n  }\n\n  /*\n   * People of this domain only. By email alone a manager could hand the task to someone of another\n   * tenant, whose to-do list reads their own domain and would never show it. An address that is not\n   * here is named rather than dropped - dropped, the task went to fewer people than were asked.\n   */\n  const assignedUsers = await tx.getRepository(User).find({\n    where: { email: In(assignees || []), domains: { id: domain.id } },\n    relations: ['domains']\n  })\n\n  const missing = (assignees || []).filter(email => !assignedUsers.some(one => one.email === email))\n\n  if (missing.length) {\n    throw new Error(context.t('error.activity-instance assignee not in this domain', { emails: missing.join(', ') }))\n  }\n\n  await createActivityThreadsForUsers('assign', activityInstance, assignedUsers, context)\n\n  return await tx.getRepository(ActivityInstance).findOneBy({ id: activityInstance.id })\n}\n\n/**\n * Put a case in a pool: whoever holds any one of its roles and picks it first holds it.\n *\n * The pool is what issue() makes when the activity names assignee roles and waits for one person -\n * `assigneeRoles` on the case, `threadsMin` 1, and one unassigned thread. To-do lists and the pickable\n * list read exactly that (assignee-pool.ts), so this makes the same shape and nothing else; a second\n * shape would be a second pool nobody's list reads.\n *\n * Only a case nobody holds - `Issued`, no valid thread (common.ts evalActivityInstanceState). A case\n * someone already holds is theirs; taking it back into a pool is another action, not this one.\n */\nasync function assignToPool(\n  activityInstance: ActivityInstance,\n  roleIds: string[],\n  dueAt: Date | undefined,\n  context: ResolverContext\n): Promise<ActivityInstance> {\n  const { domain, user, tx } = context.state\n  const repository = tx.getRepository(ActivityInstance)\n  const { id } = activityInstance\n\n  if (activityInstance.state !== ActivityInstanceStatus.Issued) {\n    throw new Error(\n      context.t('error.activity-instance should not be assigned', {\n        id,\n        actual: activityInstance.state\n      })\n    )\n  }\n\n  /*\n   * Roles of this domain only, each once - the same reason as people above: another tenant's pool is read\n   * by nobody here (assignee-pool.ts refuses by name).\n   */\n  const roles = await resolvePoolRoles(roleIds, context)\n\n  /*\n   * A pool nobody is in is a case nobody sees. Its people are every holder of any of its roles, counted\n   * once each, the way issue() counts them (createActivityThreadsForAllRoleUsers).\n   */\n  if (!poolMembers(roles).length) {\n    throw new Error(context.t('error.activity-instance role has no members', { role: roles.map(role => role.name).join(', ') }))\n  }\n\n  /*\n   * Take hold of the case first, as pick does: the UPDATE matches only a case still issued and holds its\n   * row to the end of this transaction. Every way into a waiting case takes this row before its threads -\n   * pick's UPDATE, and a member claiming the pool's waiting thread (activity-thread/check-authority.ts) - so\n   * whoever is second waits for the first to commit and then reads what it did. One order everywhere, so\n   * no two of them deadlock.\n   */\n  const claimed = await repository.update(\n    { domain: { id: domain.id }, id, state: ActivityInstanceStatus.Issued },\n    { threadsMin: 1, updater: user, ...(dueAt ? { dueAt } : {}) }\n  )\n\n  if (!claimed.affected) {\n    throw new Error(context.t('error.activity-approval taken by someone else', { activityApproval: id }))\n  }\n\n  /*\n   * Nobody holds it - asked of the threads too, not only of the state. The state is worked out again only\n   * when a thread changes (common.ts updateActivityInstanceState); a thread someone holds under a case still\n   * marked issued is theirs, and the refusal rolls the UPDATE above back.\n   */\n  const threads = await tx.getRepository(ActivityThread).find({\n    where: { activityInstance: { id } },\n    /* A locking read is a current read - a plain one may answer from the snapshot taken before the wait. */\n    ...(writeLockSupported(tx) ? { lock: { mode: 'pessimistic_write' as const } } : {})\n  })\n\n  if (threads.some(thread => thread.isValid())) {\n    throw new Error(context.t('error.activity-approval taken by someone else', { activityApproval: id }))\n  }\n\n  /*\n   * The pool itself is a join table, not a column the UPDATE can set. Written under the hold the UPDATE took,\n   * and written whole: every row of this case goes, then the new list. Worked out as a difference from the\n   * case read above, it was a difference from a read taken before the hold - two assigns at once on postgres\n   * left the union of both lists, the pool of neither (measured 2026-10-20). A DELETE reads what is there\n   * now, so the pool is the list of whichever assign held the case last. Not a save - that would write a\n   * history row of a half-read case.\n   */\n  await tx\n    .createQueryBuilder()\n    .delete()\n    .from(CASE_POOL.table)\n    .where(`${CASE_POOL.caseColumn} = :id`, { id })\n    .execute()\n\n  await repository\n    .createQueryBuilder()\n    .relation(ActivityInstance, 'assigneeRoles')\n    .of(id)\n    .add(roles.map(role => role.id))\n\n  const pooled = await repository.findOne({\n    where: { id },\n    relations: ['domain', 'activity', 'assigneeRoles', 'supervisoryRole', 'updater', 'creator', 'starter', 'terminator']\n  })\n\n  /*\n   * A case already in a pool moves to the other pool with its one waiting thread - nobody has taken it, so\n   * a manager who chose the wrong role puts it right here instead of aborting the case.\n   */\n  if (!threads.some(thread => thread.state === ActivityThreadStatus.Unassigned)) {\n    await createActivityThreadWithUnassigned('assign', pooled, context)\n  }\n\n  return await repository.findOneBy({ id })\n}\n"]}

package/dist-server/controllers/activity-instance/assignee-input.d.ts

@@ -0,0 +1,25 @@
+/**
+ * A role among the assignees of an activity or a case (ruling 2026-10-20).
+ *
+ * An assignee entry names one person. A role is many, and the entry made it one: issue() turned each
+ * entry into a person through getSystemUserFromOrgMemberItem, whose role branch answered the role's
+ * first user - an unordered relation, so whoever the database listed first got the work and the rest
+ * of the role never saw it.
+ *
+ * "Anyone of this role" already has its one place: `assigneeRoles`, on the activity and on the case.
+ * That is what the to-do lists and the pickable list read (my-open-threads.ts). Reading a role entry as
+ * that pool would make the pool live in two places, and would need rules nobody has written for a role
+ * entry beside different assigneeRoles, two role entries, or a role beside people. So a role entry is
+ * refused by name - where an activity is saved, so whoever sets it reads why, and where a case is
+ * issued, for a list handed in or saved before this.
+ *
+ * The approval line is not this: there a role seat is "anyone of that role may judge" and is resolved
+ * as such (create-approval.ts).
+ */
+type Entry = {
+    type?: string | null;
+} | null | undefined;
+export declare const ROLE_IS_NOT_AN_ASSIGNEE = "role-is-not-an-assignee";
+/** null when the list may stand; ROLE_IS_NOT_AN_ASSIGNEE when an entry names a role. */
+export declare function roleAssigneeRefusal(assignees: readonly Entry[] | null | undefined): typeof ROLE_IS_NOT_AN_ASSIGNEE | null;
+export {};

package/dist-server/controllers/activity-instance/assignee-input.js

@@ -0,0 +1,28 @@
+"use strict";
+/**
+ * A role among the assignees of an activity or a case (ruling 2026-10-20).
+ *
+ * An assignee entry names one person. A role is many, and the entry made it one: issue() turned each
+ * entry into a person through getSystemUserFromOrgMemberItem, whose role branch answered the role's
+ * first user - an unordered relation, so whoever the database listed first got the work and the rest
+ * of the role never saw it.
+ *
+ * "Anyone of this role" already has its one place: `assigneeRoles`, on the activity and on the case.
+ * That is what the to-do lists and the pickable list read (my-open-threads.ts). Reading a role entry as
+ * that pool would make the pool live in two places, and would need rules nobody has written for a role
+ * entry beside different assigneeRoles, two role entries, or a role beside people. So a role entry is
+ * refused by name - where an activity is saved, so whoever sets it reads why, and where a case is
+ * issued, for a list handed in or saved before this.
+ *
+ * The approval line is not this: there a role seat is "anyone of that role may judge" and is resolved
+ * as such (create-approval.ts).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ROLE_IS_NOT_AN_ASSIGNEE = void 0;
+exports.roleAssigneeRefusal = roleAssigneeRefusal;
+exports.ROLE_IS_NOT_AN_ASSIGNEE = 'role-is-not-an-assignee';
+/** null when the list may stand; ROLE_IS_NOT_AN_ASSIGNEE when an entry names a role. */
+function roleAssigneeRefusal(assignees) {
+    return (assignees || []).some(entry => entry?.type === 'Role') ? exports.ROLE_IS_NOT_AN_ASSIGNEE : null;
+}
+//# sourceMappingURL=assignee-input.js.map

package/dist-server/controllers/activity-instance/assignee-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assignee-input.js","sourceRoot":"","sources":["../../../server/controllers/activity-instance/assignee-input.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;;AAOH,kDAEC;AALY,QAAA,uBAAuB,GAAG,yBAAyB,CAAA;AAEhE,wFAAwF;AACxF,SAAgB,mBAAmB,CAAC,SAA8C;IAChF,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,+BAAuB,CAAC,CAAC,CAAC,IAAI,CAAA;AACjG,CAAC","sourcesContent":["/**\n * A role among the assignees of an activity or a case (ruling 2026-10-20).\n *\n * An assignee entry names one person. A role is many, and the entry made it one: issue() turned each\n * entry into a person through getSystemUserFromOrgMemberItem, whose role branch answered the role's\n * first user - an unordered relation, so whoever the database listed first got the work and the rest\n * of the role never saw it.\n *\n * \"Anyone of this role\" already has its one place: `assigneeRoles`, on the activity and on the case.\n * That is what the to-do lists and the pickable list read (my-open-threads.ts). Reading a role entry as\n * that pool would make the pool live in two places, and would need rules nobody has written for a role\n * entry beside different assigneeRoles, two role entries, or a role beside people. So a role entry is\n * refused by name - where an activity is saved, so whoever sets it reads why, and where a case is\n * issued, for a list handed in or saved before this.\n *\n * The approval line is not this: there a role seat is \"anyone of that role may judge\" and is resolved\n * as such (create-approval.ts).\n */\n\ntype Entry = { type?: string | null } | null | undefined\n\nexport const ROLE_IS_NOT_AN_ASSIGNEE = 'role-is-not-an-assignee'\n\n/** null when the list may stand; ROLE_IS_NOT_AN_ASSIGNEE when an entry names a role. */\nexport function roleAssigneeRefusal(assignees: readonly Entry[] | null | undefined): typeof ROLE_IS_NOT_AN_ASSIGNEE | null {\n  return (assignees || []).some(entry => entry?.type === 'Role') ? ROLE_IS_NOT_AN_ASSIGNEE : null\n}\n"]}

package/dist-server/controllers/activity-instance/claim-draft.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Take hold of a draft before working on it - so that a discard and an issue of the same draft cannot
+ * both succeed.
+ *
+ * Measured on postgres (tests/discard-versus-issue.pg.test.ts): issue read the draft, a discard deleted
+ * it, and issue then saved what it had read - the row came back, issued, and the writer had been told it
+ * was thrown away. Reading and saving later holds nothing.
+ *
+ * The claim is an UPDATE that only matches a draft. It takes the row's lock on every driver (SELECT ...
+ * FOR UPDATE is not supported on sqlite), and the lock is held until this transaction ends:
+ *
+ *   this claims first   a discard waits, then finds no draft and is refused by name
+ *   a discard is first  this waits, then matches no row and is refused by name
+ *
+ * No row matched means the draft went out or was thrown away in the meantime.
+ */
+export declare function claimDraft(id: string, context: ResolverContext): Promise<void>;