@things-factory/worklist 10.1.248 → 10.1.249

package/dist-client/components/decision-slots.js

@@ -0,0 +1,152 @@
+/**
+ * Turns an activity's decisionKeys declaration plus an instance's input into the slots a decision
+ * screen draws.
+ *
+ * ── Nothing heavy is imported ─────────────────────────────────────────────
+ * No lit, no i18next — only the pure reading of the input in `shared/decision-sentences`, which the
+ * server freezes sentences with. The rule is a mapping from a declaration and a payload to an ordered list,
+ * and keeping it free of imports is what lets the test runner hold it: that runner parses
+ * TypeScript by stripping types and reads neither decorators nor enums, so one heavy import takes
+ * a whole test file down with it. Labels and markup are the caller's half.
+ */
+import { paramsFrom, valueAtPath } from '../../shared/decision-sentences.js';
+/* The blanks are read the same way the server freezes them — one reading, in `shared/decision-sentences`. */
+export { valueAtPath };
+/** The roles that may appear more than once. Every other role names one value. */
+export const REPEATABLE_ROLES = ['consequence', 'evidence'];
+/** Listed in the order the screen reads them: what is asked, then past, present, future. */
+export const DECISION_ROLES = [
+    'headline',
+    'subject',
+    'reversibility',
+    'reason',
+    'evidence',
+    'currentState',
+    'consequence'
+];
+/**
+ * The slots to draw, in the order they were declared.
+ *
+ * Declaration order is the screen's hierarchy: plant wrote four of these screens by hand and all
+ * four put the headline first, then the subject, the reason, what changes, and why it came up. That
+ * agreement is what makes the order part of the contract rather than a preference, so this function
+ * neither sorts nor groups.
+ *
+ * Every declared key produces a slot, including one whose path leads nowhere. Dropping those would
+ * leave the screen unable to say that a declaration and a payload disagree, and a reader would see
+ * a screen that looks complete.
+ */
+export function decisionSlots(decisionKeys, input) {
+    if (!decisionKeys?.length) {
+        return [];
+    }
+    return decisionKeys.map(key => {
+        const { value, found } = valueAtPath(input, String(key?.inputPath ?? ''));
+        return {
+            role: String(key?.role ?? ''),
+            inputPath: String(key?.inputPath ?? ''),
+            name: key?.name,
+            tKey: key?.tKey,
+            unit: key?.unit,
+            valueTKey: key?.valueTKey,
+            params: paramsFrom(key?.params, input),
+            value,
+            found
+        };
+    });
+}
+/** The slots for one role, in declared order. Empty when the activity declared none. */
+export function slotsOfRole(slots, role) {
+    return slots.filter(slot => slot.role === role);
+}
+/**
+ * The single slot for a role that names one value, or undefined.
+ *
+ * Reaching for a second one would be reading a declaration the guard refuses, so this answers the
+ * first and does not quietly merge.
+ */
+export function slotOfRole(slots, role) {
+    return slots.find(slot => slot.role === role);
+}
+/**
+ * What the declaration says about undoing this approval.
+ *
+ * The value is an object: `reversible` is required and `caveat` is the module's own sentence about
+ * it. The asymmetry is the point — the boolean decides how heavily the screen draws the band, and
+ * a sentence alone cannot decide that.
+ *
+ *   { reversible: false, caveat: '버린 자재는 돌아오지 않습니다' }
+ *
+ * ── A condition is written as false ───────────────────────────────────────
+ * 「되돌릴 수 있습니다 — 단, 실적이 마감되기 전까지」 is written `false` with the condition in the
+ * caveat. Written `true` the screen draws it lightly and the reader walks past the condition. There
+ * is no third value: a middle one always draws ambiguously, and the reader has to guess which side
+ * it is on. (2026-09-11, architect's ruling)
+ *
+ * ── Not `note` ───────────────────────────────────────────────────────────
+ * ops-contract already has CommandApproval.note, and that one is **the approver's own comment** —
+ * a person's words, in the same neighbourhood as this screen. Same word for a module's sentence
+ * would be read as the person's. `caveat` is used nowhere in the three repositories.
+ */
+/**
+ * The kinds of an effect, as shell names them (shell server/reversibility, ADR-0064 decision 1).
+ *
+ * A copy, and the only one on this side: shell's client entry carries side effects and a client
+ * importing server code moves the build, so the shell file itself says screens do not import it.
+ * test/reversibility-kinds.test.ts holds this list to shell's, word for word.
+ */
+export const REVERSIBILITY_KINDS = ['irreversible', 'compensable', 'reversible', 'unknown'];
+/** The one kind that is not undone and still not destructive: the original stays, a new record corrects it. */
+export const COMPENSABLE = 'compensable';
+/** Undone by a paired operation. The only kind that agrees with reversible: true. */
+export const REVERSIBLE = 'reversible';
+/**
+ * What the slot says, or undefined when it does not say.
+ *
+ * Undefined covers both "the path led nowhere" and "nobody declared the role". Drawing nothing is
+ * right for both: telling an approver an action can be taken back when the payload never said so
+ * is the one mistake this line cannot make, and a truthy read would make it — the string
+ * '되돌릴 수 없습니다…' is truthy.
+ */
+export function reversibilityOf(slot) {
+    const value = slot?.value;
+    if (!value || typeof value !== 'object' || typeof value.reversible !== 'boolean') {
+        return undefined;
+    }
+    if (value.kind !== undefined && (!REVERSIBILITY_KINDS.includes(value.kind) || (value.kind === REVERSIBLE) !== value.reversible))
+        return undefined;
+    return {
+        reversible: value.reversible,
+        ...(value.kind ? { kind: value.kind } : {}),
+        ...(typeof value.caveat === 'string' && value.caveat.trim() ? { caveat: value.caveat } : {})
+    };
+}
+/**
+ * The value is there but not the shape this role takes.
+ *
+ * plant declared the role and put a sentence at that path, so the band drew nothing at all and the
+ * heaviest line on the screen was silently missing. Reporting nothing to the reader is right — the
+ * screen cannot tell which way it goes — but a developer should not have to find it by hand. The
+ * caller logs this; the rule stays free of side effects so a test can hold it.
+ */
+export function reversibilityIsMalformed(slot) {
+    return !!slot && slot.found && slot.value != null && reversibilityOf(slot) === undefined;
+}
+/**
+ * Whether these slots draw anything at all.
+ *
+ * Every declared slot can miss a payload - an older instance predates the field a declaration
+ * names. Then a screen falls back to the model rather than drawing an empty decision box. `reason`
+ * draws even when missing, as the grey "nobody wrote one" line, so declaring it is enough.
+ */
+export function decisionDrawable(slots) {
+    const found = (role) => slotsOfRole(slots, role).some(slot => slot.found);
+    return (found('headline') ||
+        found('subject') ||
+        found('currentState') ||
+        !!slotOfRole(slots, 'reason') ||
+        found('consequence') ||
+        found('evidence') ||
+        reversibilityOf(slotOfRole(slots, 'reversibility')) !== undefined);
+}
+//# sourceMappingURL=decision-slots.js.map

package/dist-client/components/decision-slots.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-slots.js","sourceRoot":"","sources":["../../client/components/decision-slots.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAA;AAE5E,6GAA6G;AAC7G,OAAO,EAAE,WAAW,EAAE,CAAA;AAEtB,kFAAkF;AAClF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,aAAa,EAAE,UAAU,CAAU,CAAA;AAEpE,4FAA4F;AAC5F,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,UAAU;IACV,SAAS;IACT,eAAe;IACf,QAAQ;IACR,UAAU;IACV,cAAc;IACd,aAAa;CACL,CAAA;AAmDV;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAC3B,YAAyD,EACzD,KAAU;IAEV,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAA;IACX,CAAC;IAED,OAAO,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;QAC5B,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,CAAA;QAEzE,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;YAC7B,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,IAAI,EAAE,CAAC;YACvC,IAAI,EAAE,GAAG,EAAE,IAAI;YACf,IAAI,EAAE,GAAG,EAAE,IAAI;YACf,IAAI,EAAE,GAAG,EAAE,IAAI;YACf,SAAS,EAAE,GAAG,EAAE,SAAS;YACzB,MAAM,EAAE,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC;YACtC,KAAK;YACL,KAAK;SACN,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAGD,wFAAwF;AACxF,MAAM,UAAU,WAAW,CAAC,KAAqB,EAAE,IAAY;IAC7D,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;AACjD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,KAAqB,EAAE,IAAY;IAC5D,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,CAAU,CAAA;AAGpG,+GAA+G;AAC/G,MAAM,CAAC,MAAM,WAAW,GAAsB,aAAa,CAAA;AAE3D,qFAAqF;AACrF,MAAM,CAAC,MAAM,UAAU,GAAsB,YAAY,CAAA;AAIzD;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,IAAmB;IACjD,MAAM,KAAK,GAAQ,IAAI,EAAE,KAAK,CAAA;IAE9B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACjF,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAE,mBAAyC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,KAAK,KAAK,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAA;IAExK,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7F,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAmB;IAC1D,OAAO,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,SAAS,CAAA;AAC1F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAqB;IACpD,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAEjF,OAAO,CACL,KAAK,CAAC,UAAU,CAAC;QACjB,KAAK,CAAC,SAAS,CAAC;QAChB,KAAK,CAAC,cAAc,CAAC;QACrB,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC;QAC7B,KAAK,CAAC,aAAa,CAAC;QACpB,KAAK,CAAC,UAAU,CAAC;QACjB,eAAe,CAAC,UAAU,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC,KAAK,SAAS,CAClE,CAAA;AACH,CAAC","sourcesContent":["/**\n * Turns an activity's decisionKeys declaration plus an instance's input into the slots a decision\n * screen draws.\n *\n * ── Nothing heavy is imported ─────────────────────────────────────────────\n * No lit, no i18next — only the pure reading of the input in `shared/decision-sentences`, which the\n * server freezes sentences with. The rule is a mapping from a declaration and a payload to an ordered list,\n * and keeping it free of imports is what lets the test runner hold it: that runner parses\n * TypeScript by stripping types and reads neither decorators nor enums, so one heavy import takes\n * a whole test file down with it. Labels and markup are the caller's half.\n */\n\nimport { paramsFrom, valueAtPath } from '../../shared/decision-sentences.js'\n\n/* The blanks are read the same way the server freezes them — one reading, in `shared/decision-sentences`. */\nexport { valueAtPath }\n\n/** The roles that may appear more than once. Every other role names one value. */\nexport const REPEATABLE_ROLES = ['consequence', 'evidence'] as const\n\n/** Listed in the order the screen reads them: what is asked, then past, present, future. */\nexport const DECISION_ROLES = [\n  'headline',\n  'subject',\n  'reversibility',\n  'reason',\n  'evidence',\n  'currentState',\n  'consequence'\n] as const\n\nexport type DecisionKeyDeclaration = {\n  role?: string\n  inputPath?: string\n  name?: string\n  tKey?: string\n  unit?: string\n  /** i18n key for the value **sentence** — `approval.<door>.<inputPath>`, computed by the server. */\n  valueTKey?: string\n  /** What the sentence puts in its blanks: name in the sentence → inputPath to read it from. */\n  params?: { [name: string]: string }\n}\n\nexport type DecisionSlot = {\n  role: string\n  inputPath: string\n  /**\n   * 번역이 없을 때 화면이 보일 수 있는 단 하나의 글.\n   *\n   * 선언은 늘 이것을 주는데 슬롯이 버리고 있었다. 그래서 `tKey` 가 다섯 언어 어디에도 없으면 화면에\n   * 남는 것이 점 섞인 키뿐이었다 — 보일 것이 없는 게 아니라 **가진 것을 안 나른 것**이다.\n   */\n  name?: string\n  tKey?: string\n  unit?: string\n  /** i18n key for the value sentence. Absent means the frozen `value` is what this slot has. */\n  valueTKey?: string\n  /**\n   * The sentence's blanks, **already read out of the input.**\n   *\n   * The declaration says where each value lives; this says what was there. Resolving here rather\n   * than on the screen keeps the path language in one place — the same `valueAtPath` the slot's own\n   * value goes through, so a params path that leads nowhere behaves the way an inputPath does\n   * instead of inventing a second rule.\n   */\n  params?: { [name: string]: unknown }\n  /** What the path led to. Undefined both when the path leads nowhere and when the value is unset. */\n  value: unknown\n  /**\n   * Whether the path led anywhere at all.\n   *\n   * A reason nobody wrote and a reason whose path is wrong look identical in `value`, and the screen\n   * owes different answers: the first is 「사유 없음」 in grey, the second is a declaration that does\n   * not match the payload and must not be drawn as if the person left it blank. Folding them into\n   * one value is the fallback that shifts meaning.\n   */\n  found: boolean\n}\n\n\n/**\n * The slots to draw, in the order they were declared.\n *\n * Declaration order is the screen's hierarchy: plant wrote four of these screens by hand and all\n * four put the headline first, then the subject, the reason, what changes, and why it came up. That\n * agreement is what makes the order part of the contract rather than a preference, so this function\n * neither sorts nor groups.\n *\n * Every declared key produces a slot, including one whose path leads nowhere. Dropping those would\n * leave the screen unable to say that a declaration and a payload disagree, and a reader would see\n * a screen that looks complete.\n */\nexport function decisionSlots(\n  decisionKeys: DecisionKeyDeclaration[] | null | undefined,\n  input: any\n): DecisionSlot[] {\n  if (!decisionKeys?.length) {\n    return []\n  }\n\n  return decisionKeys.map(key => {\n    const { value, found } = valueAtPath(input, String(key?.inputPath ?? ''))\n\n    return {\n      role: String(key?.role ?? ''),\n      inputPath: String(key?.inputPath ?? ''),\n      name: key?.name,\n      tKey: key?.tKey,\n      unit: key?.unit,\n      valueTKey: key?.valueTKey,\n      params: paramsFrom(key?.params, input),\n      value,\n      found\n    }\n  })\n}\n\n\n/** The slots for one role, in declared order. Empty when the activity declared none. */\nexport function slotsOfRole(slots: DecisionSlot[], role: string): DecisionSlot[] {\n  return slots.filter(slot => slot.role === role)\n}\n\n/**\n * The single slot for a role that names one value, or undefined.\n *\n * Reaching for a second one would be reading a declaration the guard refuses, so this answers the\n * first and does not quietly merge.\n */\nexport function slotOfRole(slots: DecisionSlot[], role: string): DecisionSlot | undefined {\n  return slots.find(slot => slot.role === role)\n}\n\n/**\n * What the declaration says about undoing this approval.\n *\n * The value is an object: `reversible` is required and `caveat` is the module's own sentence about\n * it. The asymmetry is the point — the boolean decides how heavily the screen draws the band, and\n * a sentence alone cannot decide that.\n *\n *   { reversible: false, caveat: '버린 자재는 돌아오지 않습니다' }\n *\n * ── A condition is written as false ───────────────────────────────────────\n * 「되돌릴 수 있습니다 — 단, 실적이 마감되기 전까지」 is written `false` with the condition in the\n * caveat. Written `true` the screen draws it lightly and the reader walks past the condition. There\n * is no third value: a middle one always draws ambiguously, and the reader has to guess which side\n * it is on. (2026-09-11, architect's ruling)\n *\n * ── Not `note` ───────────────────────────────────────────────────────────\n * ops-contract already has CommandApproval.note, and that one is **the approver's own comment** —\n * a person's words, in the same neighbourhood as this screen. Same word for a module's sentence\n * would be read as the person's. `caveat` is used nowhere in the three repositories.\n */\n/**\n * The kinds of an effect, as shell names them (shell server/reversibility, ADR-0064 decision 1).\n *\n * A copy, and the only one on this side: shell's client entry carries side effects and a client\n * importing server code moves the build, so the shell file itself says screens do not import it.\n * test/reversibility-kinds.test.ts holds this list to shell's, word for word.\n */\nexport const REVERSIBILITY_KINDS = ['irreversible', 'compensable', 'reversible', 'unknown'] as const\nexport type ReversibilityKind = (typeof REVERSIBILITY_KINDS)[number]\n\n/** The one kind that is not undone and still not destructive: the original stays, a new record corrects it. */\nexport const COMPENSABLE: ReversibilityKind = 'compensable'\n\n/** Undone by a paired operation. The only kind that agrees with reversible: true. */\nexport const REVERSIBLE: ReversibilityKind = 'reversible'\n\nexport type Reversibility = { reversible: boolean; kind?: ReversibilityKind; caveat?: string }\n\n/**\n * What the slot says, or undefined when it does not say.\n *\n * Undefined covers both \"the path led nowhere\" and \"nobody declared the role\". Drawing nothing is\n * right for both: telling an approver an action can be taken back when the payload never said so\n * is the one mistake this line cannot make, and a truthy read would make it — the string\n * '되돌릴 수 없습니다…' is truthy.\n */\nexport function reversibilityOf(slot?: DecisionSlot): Reversibility | undefined {\n  const value: any = slot?.value\n\n  if (!value || typeof value !== 'object' || typeof value.reversible !== 'boolean') {\n    return undefined\n  }\n  if (value.kind !== undefined && (!(REVERSIBILITY_KINDS as readonly string[]).includes(value.kind) || (value.kind === REVERSIBLE) !== value.reversible)) return undefined\n\n  return {\n    reversible: value.reversible,\n    ...(value.kind ? { kind: value.kind } : {}),\n    ...(typeof value.caveat === 'string' && value.caveat.trim() ? { caveat: value.caveat } : {})\n  }\n}\n\n/**\n * The value is there but not the shape this role takes.\n *\n * plant declared the role and put a sentence at that path, so the band drew nothing at all and the\n * heaviest line on the screen was silently missing. Reporting nothing to the reader is right — the\n * screen cannot tell which way it goes — but a developer should not have to find it by hand. The\n * caller logs this; the rule stays free of side effects so a test can hold it.\n */\nexport function reversibilityIsMalformed(slot?: DecisionSlot): boolean {\n  return !!slot && slot.found && slot.value != null && reversibilityOf(slot) === undefined\n}\n\n/**\n * Whether these slots draw anything at all.\n *\n * Every declared slot can miss a payload - an older instance predates the field a declaration\n * names. Then a screen falls back to the model rather than drawing an empty decision box. `reason`\n * draws even when missing, as the grey \"nobody wrote one\" line, so declaring it is enough.\n */\nexport function decisionDrawable(slots: DecisionSlot[]): boolean {\n  const found = (role: string) => slotsOfRole(slots, role).some(slot => slot.found)\n\n  return (\n    found('headline') ||\n    found('subject') ||\n    found('currentState') ||\n    !!slotOfRole(slots, 'reason') ||\n    found('consequence') ||\n    found('evidence') ||\n    reversibilityOf(slotOfRole(slots, 'reversibility')) !== undefined\n  )\n}\n"]}

package/dist-client/components/mutation-outcome.d.ts

@@ -0,0 +1,57 @@
+/**
+ * What came back from a mutation, in the terms a screen has to speak.
+ *
+ * ── Two failures that arrive by different roads ───────────────────────────
+ * A privilege refusal is a GraphQL error. The server marks it itself
+ * ([읽었음] auth-base/server/service/privilege/privilege-rejection.ts:61) with
+ * `extensions: { code: 'FORBIDDEN', requires }`, and `mutate` is configured with
+ * `errorPolicy: 'all'` ([읽었음] operato/webcomponents/graphql/src/graphql-client.ts:18), so it
+ * **resolves** with `errors` rather than throwing.
+ *
+ * A missing or expired session never reaches GraphQL at all:
+ *
+ *   [확인함] curl -X POST http://localhost:4000/graphql -d '{"query":"{ __typename }"}'
+ *            HTTP 401 · body: No auth token
+ *
+ * That is an HTTP failure with a plain-text body, so it arrives as a thrown error, not as `errors`.
+ * A handler that only looks at `errors` misses it, and the throw takes the rest of the handler with
+ * it. Both roads are handled here so a caller does not have to remember there are two.
+ *
+ * ── Why they must not share a sentence ────────────────────────────────────
+ * Telling someone whose session expired to ask an administrator for a privilege sends them to the
+ * wrong place, and they will wait for something nobody is going to do. (2026-09-11, architect)
+ *
+ * Nothing is imported: the test runner strips types without reading decorators, and one heavy
+ * import takes a whole test file down — that happened three times in one day.
+ */
+export type MutationOutcome = 
+/** It went through. `data` is what the mutation answered, so the caller need not keep the response. */
+{
+    ok: true;
+    data: any;
+}
+/** The server said this user may not. `requires` is what it said is needed, when it said. */
+ | {
+    ok: false;
+    kind: 'forbidden';
+    said: string;
+    requires?: unknown;
+}
+/** No session reached the server. Signing in again is the answer, not a privilege. */
+ | {
+    ok: false;
+    kind: 'signed-out';
+    said: string;
+}
+/** Something else. `said` is the server's own sentence — this side does not know the cause. */
+ | {
+    ok: false;
+    kind: 'failed';
+    said: string;
+};
+/** Reading a resolved response. */
+export declare function outcomeOf(response: any): MutationOutcome;
+/** Reading a thrown error — the road a 401 takes. */
+export declare function outcomeOfThrow(thrown: any): MutationOutcome;
+/** The i18n key for a failure, so every screen says the same thing about the same thing. */
+export declare function outcomeKey(outcome: MutationOutcome): string;

package/dist-client/components/mutation-outcome.js

@@ -0,0 +1,78 @@
+/**
+ * What came back from a mutation, in the terms a screen has to speak.
+ *
+ * ── Two failures that arrive by different roads ───────────────────────────
+ * A privilege refusal is a GraphQL error. The server marks it itself
+ * ([읽었음] auth-base/server/service/privilege/privilege-rejection.ts:61) with
+ * `extensions: { code: 'FORBIDDEN', requires }`, and `mutate` is configured with
+ * `errorPolicy: 'all'` ([읽었음] operato/webcomponents/graphql/src/graphql-client.ts:18), so it
+ * **resolves** with `errors` rather than throwing.
+ *
+ * A missing or expired session never reaches GraphQL at all:
+ *
+ *   [확인함] curl -X POST http://localhost:4000/graphql -d '{"query":"{ __typename }"}'
+ *            HTTP 401 · body: No auth token
+ *
+ * That is an HTTP failure with a plain-text body, so it arrives as a thrown error, not as `errors`.
+ * A handler that only looks at `errors` misses it, and the throw takes the rest of the handler with
+ * it. Both roads are handled here so a caller does not have to remember there are two.
+ *
+ * ── Why they must not share a sentence ────────────────────────────────────
+ * Telling someone whose session expired to ask an administrator for a privilege sends them to the
+ * wrong place, and they will wait for something nobody is going to do. (2026-09-11, architect)
+ *
+ * Nothing is imported: the test runner strips types without reading decorators, and one heavy
+ * import takes a whole test file down — that happened three times in one day.
+ */
+/** Reading a resolved response. */
+export function outcomeOf(response) {
+    const errors = response?.errors || [];
+    if (!errors.length && response?.data) {
+        return { ok: true, data: response.data };
+    }
+    const forbidden = errors.find((error) => error?.extensions?.code == 'FORBIDDEN');
+    if (forbidden) {
+        return {
+            ok: false,
+            kind: 'forbidden',
+            said: String(forbidden.message || ''),
+            requires: forbidden.extensions?.requires
+        };
+    }
+    const signedOut = errors.find((error) => looksSignedOut(error?.message));
+    if (signedOut) {
+        return { ok: false, kind: 'signed-out', said: String(signedOut.message || '') };
+    }
+    return { ok: false, kind: 'failed', said: String(errors[0]?.message || '') };
+}
+/** Reading a thrown error — the road a 401 takes. */
+export function outcomeOfThrow(thrown) {
+    const said = String(thrown?.message || thrown || '');
+    /*
+     * Apollo wraps an HTTP failure, so the 401's body travels inside the message. Matching the text
+     * is not ideal; it is what the server gives, since the body is plain text rather than a GraphQL
+     * error with a code. If the server ever answers 401 as a GraphQL error, outcomeOf catches it on
+     * the other road and this one keeps working.
+     */
+    if (looksSignedOut(said) || thrown?.statusCode == 401 || thrown?.networkError?.statusCode == 401) {
+        return { ok: false, kind: 'signed-out', said };
+    }
+    return { ok: false, kind: 'failed', said };
+}
+/** The sentence a session failure carries. Matched loosely because the wording is not ours. */
+function looksSignedOut(message) {
+    const text = String(message || '').toLowerCase();
+    return text.includes('no auth token') || text.includes('jwt expired') || text.includes('unauthenticated');
+}
+/** The i18n key for a failure, so every screen says the same thing about the same thing. */
+export function outcomeKey(outcome) {
+    if (outcome.ok) {
+        return '';
+    }
+    return {
+        forbidden: 'text.not-allowed-to-do-this',
+        'signed-out': 'text.signed-out-sign-in-again',
+        failed: 'text.it-did-not-go-through'
+    }[outcome.kind];
+}
+//# sourceMappingURL=mutation-outcome.js.map

package/dist-client/components/mutation-outcome.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mutation-outcome.js","sourceRoot":"","sources":["../../client/components/mutation-outcome.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAYH,mCAAmC;AACnC,MAAM,UAAU,SAAS,CAAC,QAAa;IACrC,MAAM,MAAM,GAAG,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAA;IAErC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,QAAQ,EAAE,IAAI,EAAE,CAAC;QACrC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAA;IAC1C,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAU,EAAE,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,IAAI,WAAW,CAAC,CAAA;IAErF,IAAI,SAAS,EAAE,CAAC;QACd,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC;YACrC,QAAQ,EAAE,SAAS,CAAC,UAAU,EAAE,QAAQ;SACzC,CAAA;IACH,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAU,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAA;IAE7E,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAA;IACjF,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE,CAAA;AAC9E,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,cAAc,CAAC,MAAW;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,MAAM,IAAI,EAAE,CAAC,CAAA;IAEpD;;;;;OAKG;IACH,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,UAAU,IAAI,GAAG,IAAI,MAAM,EAAE,YAAY,EAAE,UAAU,IAAI,GAAG,EAAE,CAAC;QACjG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAA;IAChD,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;AAC5C,CAAC;AAED,+FAA+F;AAC/F,SAAS,cAAc,CAAC,OAAY;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;IAEhD,OAAO,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAA;AAC3G,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,UAAU,CAAC,OAAwB;IACjD,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,EAAE,CAAA;IACX,CAAC;IAED,OAAO;QACL,SAAS,EAAE,6BAA6B;QACxC,YAAY,EAAE,+BAA+B;QAC7C,MAAM,EAAE,4BAA4B;KACrC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;AACjB,CAAC","sourcesContent":["/**\n * What came back from a mutation, in the terms a screen has to speak.\n *\n * ── Two failures that arrive by different roads ───────────────────────────\n * A privilege refusal is a GraphQL error. The server marks it itself\n * ([읽었음] auth-base/server/service/privilege/privilege-rejection.ts:61) with\n * `extensions: { code: 'FORBIDDEN', requires }`, and `mutate` is configured with\n * `errorPolicy: 'all'` ([읽었음] operato/webcomponents/graphql/src/graphql-client.ts:18), so it\n * **resolves** with `errors` rather than throwing.\n *\n * A missing or expired session never reaches GraphQL at all:\n *\n *   [확인함] curl -X POST http://localhost:4000/graphql -d '{\"query\":\"{ __typename }\"}'\n *            HTTP 401 · body: No auth token\n *\n * That is an HTTP failure with a plain-text body, so it arrives as a thrown error, not as `errors`.\n * A handler that only looks at `errors` misses it, and the throw takes the rest of the handler with\n * it. Both roads are handled here so a caller does not have to remember there are two.\n *\n * ── Why they must not share a sentence ────────────────────────────────────\n * Telling someone whose session expired to ask an administrator for a privilege sends them to the\n * wrong place, and they will wait for something nobody is going to do. (2026-09-11, architect)\n *\n * Nothing is imported: the test runner strips types without reading decorators, and one heavy\n * import takes a whole test file down — that happened three times in one day.\n */\n\nexport type MutationOutcome =\n  /** It went through. `data` is what the mutation answered, so the caller need not keep the response. */\n  | { ok: true; data: any }\n  /** The server said this user may not. `requires` is what it said is needed, when it said. */\n  | { ok: false; kind: 'forbidden'; said: string; requires?: unknown }\n  /** No session reached the server. Signing in again is the answer, not a privilege. */\n  | { ok: false; kind: 'signed-out'; said: string }\n  /** Something else. `said` is the server's own sentence — this side does not know the cause. */\n  | { ok: false; kind: 'failed'; said: string }\n\n/** Reading a resolved response. */\nexport function outcomeOf(response: any): MutationOutcome {\n  const errors = response?.errors || []\n\n  if (!errors.length && response?.data) {\n    return { ok: true, data: response.data }\n  }\n\n  const forbidden = errors.find((error: any) => error?.extensions?.code == 'FORBIDDEN')\n\n  if (forbidden) {\n    return {\n      ok: false,\n      kind: 'forbidden',\n      said: String(forbidden.message || ''),\n      requires: forbidden.extensions?.requires\n    }\n  }\n\n  const signedOut = errors.find((error: any) => looksSignedOut(error?.message))\n\n  if (signedOut) {\n    return { ok: false, kind: 'signed-out', said: String(signedOut.message || '') }\n  }\n\n  return { ok: false, kind: 'failed', said: String(errors[0]?.message || '') }\n}\n\n/** Reading a thrown error — the road a 401 takes. */\nexport function outcomeOfThrow(thrown: any): MutationOutcome {\n  const said = String(thrown?.message || thrown || '')\n\n  /*\n   * Apollo wraps an HTTP failure, so the 401's body travels inside the message. Matching the text\n   * is not ideal; it is what the server gives, since the body is plain text rather than a GraphQL\n   * error with a code. If the server ever answers 401 as a GraphQL error, outcomeOf catches it on\n   * the other road and this one keeps working.\n   */\n  if (looksSignedOut(said) || thrown?.statusCode == 401 || thrown?.networkError?.statusCode == 401) {\n    return { ok: false, kind: 'signed-out', said }\n  }\n\n  return { ok: false, kind: 'failed', said }\n}\n\n/** The sentence a session failure carries. Matched loosely because the wording is not ours. */\nfunction looksSignedOut(message: any): boolean {\n  const text = String(message || '').toLowerCase()\n\n  return text.includes('no auth token') || text.includes('jwt expired') || text.includes('unauthenticated')\n}\n\n/** The i18n key for a failure, so every screen says the same thing about the same thing. */\nexport function outcomeKey(outcome: MutationOutcome): string {\n  if (outcome.ok) {\n    return ''\n  }\n\n  return {\n    forbidden: 'text.not-allowed-to-do-this',\n    'signed-out': 'text.signed-out-sign-in-again',\n    failed: 'text.it-did-not-go-through'\n  }[outcome.kind]\n}\n"]}

package/dist-client/components/say-outcome.d.ts

@@ -0,0 +1,25 @@
+import { MutationOutcome } from './mutation-outcome.js';
+/**
+ * Run a mutation and say so when it does not go through.
+ *
+ * ── Why a wrapper and not a check at each call ────────────────────────────
+ * A failure arrives by two roads — a privilege refusal resolves with `errors`, a missing session
+ * throws an HTTP 401 — and every call site would have to remember both. Six handlers in this package
+ * remembered neither: they read `errors` only to skip the success branch, with no `else`, so a
+ * failed save changed nothing on screen and said nothing. The worker presses the button again.
+ *
+ * The caller keeps its success path and stops carrying the failure one:
+ *
+ *   const outcome = await ranMutation(() => client.mutate({ … }))
+ *   if (!outcome.ok) return
+ *   … what to do when it worked …
+ */
+export declare function ranMutation(run: () => Promise<any>): Promise<MutationOutcome>;
+/**
+ * One sentence per kind of failure.
+ *
+ * `said` is the server's own sentence and only the last kind prints it — for the other two this
+ * side knows what happened and can say what to do about it. Telling someone whose session expired
+ * to ask an administrator for a privilege would send them where nobody can help.
+ */
+export declare function sayFailure(outcome: MutationOutcome): void;

package/dist-client/components/say-outcome.js

@@ -0,0 +1,51 @@
+import { i18next } from '@operato/i18n';
+import { outcomeKey, outcomeOf, outcomeOfThrow } from './mutation-outcome.js';
+/**
+ * Run a mutation and say so when it does not go through.
+ *
+ * ── Why a wrapper and not a check at each call ────────────────────────────
+ * A failure arrives by two roads — a privilege refusal resolves with `errors`, a missing session
+ * throws an HTTP 401 — and every call site would have to remember both. Six handlers in this package
+ * remembered neither: they read `errors` only to skip the success branch, with no `else`, so a
+ * failed save changed nothing on screen and said nothing. The worker presses the button again.
+ *
+ * The caller keeps its success path and stops carrying the failure one:
+ *
+ *   const outcome = await ranMutation(() => client.mutate({ … }))
+ *   if (!outcome.ok) return
+ *   … what to do when it worked …
+ */
+export async function ranMutation(run) {
+    let outcome;
+    try {
+        outcome = outcomeOf(await run());
+    }
+    catch (thrown) {
+        outcome = outcomeOfThrow(thrown);
+    }
+    if (!outcome.ok) {
+        sayFailure(outcome);
+    }
+    return outcome;
+}
+/**
+ * One sentence per kind of failure.
+ *
+ * `said` is the server's own sentence and only the last kind prints it — for the other two this
+ * side knows what happened and can say what to do about it. Telling someone whose session expired
+ * to ask an administrator for a privilege would send them where nobody can help.
+ */
+export function sayFailure(outcome) {
+    if (outcome.ok) {
+        return;
+    }
+    const key = outcomeKey(outcome);
+    document.dispatchEvent(new CustomEvent('notify', {
+        detail: {
+            level: 'error',
+            message: i18next.t(key, { said: outcome.said || '' })
+        }
+    }));
+    console.error(`[worklist] ${outcome.kind} — ${outcome.said}`);
+}
+//# sourceMappingURL=say-outcome.js.map

package/dist-client/components/say-outcome.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"say-outcome.js","sourceRoot":"","sources":["../../client/components/say-outcome.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAEvC,OAAO,EAAmB,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAE9F;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAuB;IACvD,IAAI,OAAwB,CAAA;IAE5B,IAAI,CAAC;QACH,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;IAClC,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;IAClC,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,UAAU,CAAC,OAAO,CAAC,CAAA;IACrB,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,OAAwB;IACjD,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;QACf,OAAM;IACR,CAAC;IAED,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,CAAA;IAE/B,QAAQ,CAAC,aAAa,CACpB,IAAI,WAAW,CAAC,QAAQ,EAAE;QACxB,MAAM,EAAE;YACN,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;SACtD;KACF,CAAC,CACH,CAAA;IAED,OAAO,CAAC,KAAK,CAAC,cAAc,OAAO,CAAC,IAAI,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;AAC/D,CAAC","sourcesContent":["import { i18next } from '@operato/i18n'\n\nimport { MutationOutcome, outcomeKey, outcomeOf, outcomeOfThrow } from './mutation-outcome.js'\n\n/**\n * Run a mutation and say so when it does not go through.\n *\n * ── Why a wrapper and not a check at each call ────────────────────────────\n * A failure arrives by two roads — a privilege refusal resolves with `errors`, a missing session\n * throws an HTTP 401 — and every call site would have to remember both. Six handlers in this package\n * remembered neither: they read `errors` only to skip the success branch, with no `else`, so a\n * failed save changed nothing on screen and said nothing. The worker presses the button again.\n *\n * The caller keeps its success path and stops carrying the failure one:\n *\n *   const outcome = await ranMutation(() => client.mutate({ … }))\n *   if (!outcome.ok) return\n *   … what to do when it worked …\n */\nexport async function ranMutation(run: () => Promise<any>): Promise<MutationOutcome> {\n  let outcome: MutationOutcome\n\n  try {\n    outcome = outcomeOf(await run())\n  } catch (thrown) {\n    outcome = outcomeOfThrow(thrown)\n  }\n\n  if (!outcome.ok) {\n    sayFailure(outcome)\n  }\n\n  return outcome\n}\n\n/**\n * One sentence per kind of failure.\n *\n * `said` is the server's own sentence and only the last kind prints it — for the other two this\n * side knows what happened and can say what to do about it. Telling someone whose session expired\n * to ask an administrator for a privilege would send them where nobody can help.\n */\nexport function sayFailure(outcome: MutationOutcome) {\n  if (outcome.ok) {\n    return\n  }\n\n  const key = outcomeKey(outcome)\n\n  document.dispatchEvent(\n    new CustomEvent('notify', {\n      detail: {\n        level: 'error',\n        message: i18next.t(key, { said: outcome.said || '' })\n      }\n    })\n  )\n\n  console.error(`[worklist] ${outcome.kind} — ${outcome.said}`)\n}\n"]}

package/dist-client/components/state-ribon.d.ts

@@ -0,0 +1,48 @@
+/**
+ * 업무 · 결재 화면의 머리 띠 — **세 화면이 한 모양을 쓴다.**
+ *
+ * activity-thread-ribon · activity-approval-ribon · activity-instance-ribon 이 같은 자리에 같은
+ * 것을 보인다(상태 · 설명 · 결재선 또는 담당자). 그런데 셋이 각자 100여 줄의 CSS 를 갖고 있었고,
+ * 상태색 여덟 개가 세 벌로 복사되어 있었다.
+ *
+ * ── 채운 띠를 걷은 이유 — 글자가 안 읽혔다 ─────────────────────────────────
+ * 전에는 상태마다 다른 색으로 띠 전체를 채우고 그 위에 흰 글자를 얹었다. 색은 하드코딩된 hex 여덟
+ * 개였고, --md-sys-color-on-primary(대개 흰색)를 글자색으로 썼다. contrast 를 계산하면 12px 글자
+ * 기준 AA(4.5:1)에 네 개가 못 미친다.
+ *
+ *     started    #56af45  2.76   ← 작업자가 가장 오래 보는 상태
+ *     ended      #02acae  2.79
+ *     rejected   #f27429  2.87
+ *     submitted  #428df3  3.31
+ *     unassigned #5f7184  5.02   (통과)
+ *     escalated  #595de5  5.09   (통과)
+ *     aborted    #cb3a33  5.01   (통과)
+ *     delegated  #8654b0  5.37   (통과)
+ *
+ * 색을 여덟 개 다시 고르는 대신 **띠를 채우지 않는다.** SurfaceStyles 가 정한 규칙과 같다 —
+ * 흰 면에 1px 선을 두르고, 색은 상태 앞의 점 하나가 말한다. 글자는 --ui-ink 라 어느 상태에서든
+ * 읽히고, 점은 UI 요소라 3:1 기준으로 판단한다.
+ *
+ * ── 색 여덟 개를 뜻 여섯 개로 ──────────────────────────────────────────────
+ * 하드코딩된 hex 는 앱 팔레트를 따르지 않는다. worklist 는 framework 패키지라 operato-plant ·
+ * operato-gangsters · operato-dataset 이 모두 이 화면을 쓰는데, 어느 앱에서도 그 앱 색이 아니었다.
+ * 토큰으로 바꾸면 앱마다 자기 라이트 · 다크 테마를 따라온다.
+ *
+ *     unassigned · assigned              --ui-muted   아직 시작하지 않았다
+ *     started                            --ui-accent  내 손에서 진행 중이다
+ *     submitted · escalated · delegated  --ui-info    남의 판단을 기다린다
+ *     rejected                           --ui-warn    되돌아왔다. 다시 해야 한다
+ *     ended · approved                   --ui-good    끝났다
+ *     aborted                            --ui-crit    중단됐다
+ *
+ * 색만으로 뜻을 전하지 않는다 — 상태 이름을 항상 함께 적는다.
+ */
+/**
+ * The state → colour mapping above, alone - for anything that shows a worklist state, not only the
+ * ribbon. Set on `:host([state=...])`; read `--worklist-state-color`. The activity instance view kept
+ * a fourth copy of the old eight hex colours after the ribbons moved to meanings; three of them were
+ * under 3:1 on a light surface (started 2.62 · rejected 2.73 · ended 2.65, measured on :4000
+ * 2026-09-24) and `unassigned` had none, so it drew tomato.
+ */
+export declare const WorklistStateColors: import("lit").CSSResult;
+export declare const StateRibonStyles: import("lit").CSSResult[];