@things-factory/worklist 10.1.248 → 10.1.250

package/dist-server/service/work-door/approval-line-standing.d.ts

@@ -0,0 +1,106 @@
+import { Refusal } from '@things-factory/shell';
+/**
+ * 결재선이 **차 있나** — 순수 판단. DB 도 TypeORM 도 모른다.
+ *
+ * ═══════════════════════════════════════════════════════════════════════════
+ * ── 「있다」와 「찼다」가 다르다 ───────────────────────────────────────────
+ * 앞서는 `approvalLine?.length` 만 셌다. 그러면 **역할을 지목해 놓고 그 역할에 사람이 하나도 없는**
+ * 결재선이 「찼다」로 읽힌다. 문 현황 화면은 「이 문은 섰습니다」라고 그리고, 현장이 상신을 누르는
+ * 순간 워크리스트가 `approver is not set` 으로 던진다 — **준비됐다고 말해 놓고 쓸 때 터지는** 부류다.
+ *
+ * 실 테넌트에서 이것이 예외가 아니다. 미라텍에는 이 제품이 세운 역할이 하나도 없다
+ * (§`project_mes_roles_locked_behind_demo`). 역할을 지목한 결재선은 거기서 전부 빈 자리를 가리킨다.
+ *
+ * ── 불을 돌려주지 않는다. 그리고 **union 으로도 안 돌려준다** ────────────
+ * 막은 쪽이 이유를 말한다. `true`/`false` 하나면 화면이 「왜 안 되나」를 **다시 세게 되고**, 그러면
+ * 정의가 두 곳이 된다 — 이 판단을 한 곳으로 모은 이유가 없어진다.
+ *
+ * 그래서 처음에 `{ok:true} | {ok:false, code}` 로 두었는데, 이 패키지의 `server/tsconfig.json` 은
+ * **`strict: false`** 라 `strictNullChecks` 가 없고, 그러면 TS 가 **boolean 판별자로 union 을 안
+ * 좁힌다.** `if (r.ok) return` 뒤에서 `r.code` 를 읽으면 컴파일이 깨진다 — 하루에 소비자 둘이
+ * 연달아 걸렸고 그중 하나는 서버를 아예 못 뜨게 했다.
+ *
+ * 그래서 **한 객체에 선택 칸**이다. `if (standing.refusal)` 하나로 어디서나 읽힌다.
+ * [합의했다] ADR-0047 ⑤(개정)
+ *
+ * ```
+ * approval-line-missing    결재선 자체가 없다           누가 결재하는지를 정해야 한다
+ * approval-role-empty      역할은 있는데 사람이 없다      그 역할에 사람을 넣어야 한다
+ * approval-person-absent   지목한 사람이 여기 없다        다른 사람을 지목하거나 그 사람을 넣어야 한다
+ * ```
+ *
+ * 관리자가 할 일이 다르므로 코드가 셋이다.
+ *
+ * ── 참조는 세지 않는다 ───────────────────────────────────────────────────
+ * `participation: 'reference'` 는 의견만 내고 결재를 막지 않는다. 참조자 역할이 비었다고 거절하면
+ * **결재와 무관한 이유로** 막는 것이 된다. 참조만 있는 결재선은 결재 없이 끝나므로 「없다」로 읽는다.
+ *
+ * ── 읽는 것은 부르는 쪽이 넘긴다 ─────────────────────────────────────────
+ * 포트 하나를 받는다. 이 판단이 `manager` 를 받으면 TypeORM 을 알게 되어 순수 시험이 서지 않고,
+ * **어느 도메인으로 좁혔나**가 부르는 쪽에서 안 보이게 된다. 포트의 수명은 **판정 하나**다 — 더
+ * 오래 살면 역할에 사람을 넣은 직후에도 옛 답을 내놓는다.
+ *
+ * ── 사람을 직접 지목한 자리도 읽는다 ─────────────────────────────────────
+ * 「이 제품은 역할만 쓴다」로 닫지 않는다. 그렇게 두면 **없는 사람을 지목한 결재선이 「찼다」로
+ * 그려지고 상신 순간 터진다** — 역할에서 고친 그 모양이 사람 축으로 다시 나는 것이고, 「없음」이
+ * 안전하지 않은 쪽으로 기우는 것이다. 게다가 이 정의는 워크리스트의 `ApprovalLineItem` 을 읽는
+ * 공용 자리라, 다른 제품이 사람을 지목하는 날 조용히 틀린다.
+ *
+ * `Myself` · `MyDepartment` · `MySupervisor` 는 **상신할 때 그 사람으로 풀리는** 자리라 미리 셀 것이
+ * 없다. 부서 지목(`Department`)은 부서장이 있어야 풀리는데 그 코드는 아직 없다 — 지어내지 않는다.
+ *
+ * [합의했다] operato-application/adr/ADR-0047.md ③⑤
+ * ═══════════════════════════════════════════════════════════════════════════
+ */
+/** 결재선 한 자리 — `ApprovalLineItem` 중 이 판단이 보는 칸만. */
+export interface ApprovalSeat {
+    /** `OrgMemberTargetType` — 역할이면 `'Role'`. */
+    type?: string;
+    /** 역할이면 role id, 사람이면 user id. */
+    value?: string;
+    /** 편집기가 고른 대상. 편집기는 `value` 를 안 쓰고 여기에만 적는다(§`seatRoleId`). */
+    approver?: {
+        id?: string;
+    };
+    /** 비어 있으면 결재다(`ApprovalLineItem.participation` 의 규약). */
+    participation?: string;
+}
+export type ApprovalLineRefusal = 'approval-line-missing' | 'approval-role-empty' | 'approval-person-absent';
+export interface ApprovalLineStanding {
+    /** 이 결재선이 지나는 자리 수. 안 서는 결재선이면 0. */
+    approvers: number;
+    /**
+     * 왜 안 서나 — **있으면 안 서는 것이다.** 없으면 선다.
+     *
+     * `params` 는 그 코드가 가리키는 것 하나다: 역할이 비었으면 그 역할, 사람이 없으면 그 사람.
+     */
+    refusal?: {
+        code: ApprovalLineRefusal;
+        params?: {
+            role?: string;
+            personId?: string;
+        };
+    };
+}
+/** A line that does not stand, as a refusal. The params are the one thing the code points at. */
+export declare function approvalLineRefusal(refusal: NonNullable<ApprovalLineStanding['refusal']>): Refusal;
+/** 결재선의 자리가 실제로 사람으로 풀리나 — 읽는 것은 부르는 쪽 일이다. */
+export interface ApprovalSeatReader {
+    /** 그 역할에 사람이 하나 이상 있나. */
+    roleHasMembers(roleId: string): Promise<boolean>;
+    /** 지목한 그 사람이 이 공장에 있고 계정이 붙어 있나. */
+    personIsHere(personId: string): Promise<boolean>;
+}
+/**
+ * A seat's role, read the way submission reads it (`create-approval`, `resolve-judgeable-seats`).
+ *
+ * The approval line editor writes what it picked under `approver` and leaves `value` empty; seeded
+ * lines carry both. Reading `value` alone here drew 「결재자 없음」 on the door screen for a line that
+ * submits. One function, so the screen and submission cannot read a seat two ways again.
+ */
+export declare function seatRoleId(seat?: ApprovalSeat | null): string | undefined;
+/** A person seat, read the way submission reads it (`getSystemUserFromOrgMemberItem`: approver first). */
+export declare function seatPersonId(seat?: ApprovalSeat | null): string | undefined;
+export declare function judgeApprovalLine(line: ApprovalSeat[] | undefined | null, reader: ApprovalSeatReader): Promise<ApprovalLineStanding>;
+/** 결재선에서 **역할을 지목한 자리**의 id 들 — 부르는 쪽이 미리 읽어 둘 때 쓴다. */
+export declare function rolesNamedIn(line: ApprovalSeat[] | undefined | null): string[];

package/dist-server/service/work-door/approval-line-standing.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.approvalLineRefusal = approvalLineRefusal;
+exports.seatRoleId = seatRoleId;
+exports.seatPersonId = seatPersonId;
+exports.judgeApprovalLine = judgeApprovalLine;
+exports.rolesNamedIn = rolesNamedIn;
+const shell_1 = require("@things-factory/shell");
+const LINE_REFUSAL_ENGLISH = {
+    'approval-line-missing': 'this form has no approval line. set who approves it.',
+    'approval-role-empty': 'nobody holds the role {role} named in the approval line. add a person to that role.',
+    'approval-person-absent': 'the person named in the approval line is not in this site. name someone else in the approval line.'
+};
+/** A line that does not stand, as a refusal. The params are the one thing the code points at. */
+function approvalLineRefusal(refusal) {
+    const params = { role: refusal.params?.role ?? null, personId: refusal.params?.personId ?? null };
+    return new shell_1.Refusal(refusal.code, params, LINE_REFUSAL_ENGLISH[refusal.code].replace('{role}', params.role ?? ''));
+}
+/**
+ * A seat's role, read the way submission reads it (`create-approval`, `resolve-judgeable-seats`).
+ *
+ * The approval line editor writes what it picked under `approver` and leaves `value` empty; seeded
+ * lines carry both. Reading `value` alone here drew 「결재자 없음」 on the door screen for a line that
+ * submits. One function, so the screen and submission cannot read a seat two ways again.
+ */
+function seatRoleId(seat) {
+    return seat?.value || seat?.approver?.id || undefined;
+}
+/** A person seat, read the way submission reads it (`getSystemUserFromOrgMemberItem`: approver first). */
+function seatPersonId(seat) {
+    return seat?.approver?.id || seat?.value || undefined;
+}
+const REFERENCE = 'reference';
+const ROLE = 'Role';
+const PERSON = 'Employee';
+async function judgeApprovalLine(line, reader) {
+    const seats = (line ?? []).filter(seat => seat?.participation !== REFERENCE);
+    if (!seats.length) {
+        return { approvers: 0, refusal: { code: 'approval-line-missing' } };
+    }
+    for (const seat of seats) {
+        if (seat?.type === ROLE) {
+            const role = seatRoleId(seat);
+            if (!role || !(await reader.roleHasMembers(role))) {
+                return { approvers: 0, refusal: { code: 'approval-role-empty', params: { role: role ?? '' } } };
+            }
+            continue;
+        }
+        if (seat?.type === PERSON) {
+            const person = seatPersonId(seat);
+            if (!person || !(await reader.personIsHere(person))) {
+                return { approvers: 0, refusal: { code: 'approval-person-absent', params: { personId: person ?? '' } } };
+            }
+        }
+    }
+    return { approvers: seats.length };
+}
+/** 결재선에서 **역할을 지목한 자리**의 id 들 — 부르는 쪽이 미리 읽어 둘 때 쓴다. */
+function rolesNamedIn(line) {
+    return (line ?? [])
+        .filter(seat => seat?.participation !== REFERENCE && seat?.type === ROLE)
+        .map(seat => seatRoleId(seat))
+        .filter((one) => !!one);
+}
+//# sourceMappingURL=approval-line-standing.js.map

package/dist-server/service/work-door/approval-line-standing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-line-standing.js","sourceRoot":"","sources":["../../../server/service/work-door/approval-line-standing.ts"],"names":[],"mappings":";;AA2FA,kDAIC;AAiBD,gCAEC;AAGD,oCAEC;AAMD,8CA+BC;AAGD,oCAKC;AApKD,iDAA+C;AAoF/C,MAAM,oBAAoB,GAAwC;IAChE,uBAAuB,EAAE,sDAAsD;IAC/E,qBAAqB,EAAE,qFAAqF;IAC5G,wBAAwB,EAAE,oGAAoG;CAC/H,CAAA;AAED,iGAAiG;AACjG,SAAgB,mBAAmB,CAAC,OAAqD;IACvF,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,IAAI,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,IAAI,IAAI,EAAE,CAAA;IAEjG,OAAO,IAAI,eAAO,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAA;AACnH,CAAC;AAUD;;;;;;GAMG;AACH,SAAgB,UAAU,CAAC,IAA0B;IACnD,OAAO,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,SAAS,CAAA;AACvD,CAAC;AAED,0GAA0G;AAC1G,SAAgB,YAAY,CAAC,IAA0B;IACrD,OAAO,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,IAAI,EAAE,KAAK,IAAI,SAAS,CAAA;AACvD,CAAC;AAED,MAAM,SAAS,GAAG,WAAW,CAAA;AAC7B,MAAM,IAAI,GAAG,MAAM,CAAA;AACnB,MAAM,MAAM,GAAG,UAAU,CAAA;AAElB,KAAK,UAAU,iBAAiB,CACrC,IAAuC,EACvC,MAA0B;IAE1B,MAAM,KAAK,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,aAAa,KAAK,SAAS,CAAC,CAAA;IAE5E,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,EAAE,CAAA;IACrE,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,EAAE,IAAI,KAAK,IAAI,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;YAE7B,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBAClD,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,EAAE,CAAA;YACjG,CAAC;YAED,SAAQ;QACV,CAAC;QAED,IAAI,IAAI,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;YAEjC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACpD,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,EAAE,CAAA;YAC1G,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,CAAA;AACpC,CAAC;AAED,wDAAwD;AACxD,SAAgB,YAAY,CAAC,IAAuC;IAClE,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;SAChB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,aAAa,KAAK,SAAS,IAAI,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;SACxE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;SAC7B,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;AAC1C,CAAC","sourcesContent":["import { Refusal } from '@things-factory/shell'\n\n/**\n * 결재선이 **차 있나** — 순수 판단. DB 도 TypeORM 도 모른다.\n *\n * ═══════════════════════════════════════════════════════════════════════════\n * ── 「있다」와 「찼다」가 다르다 ───────────────────────────────────────────\n * 앞서는 `approvalLine?.length` 만 셌다. 그러면 **역할을 지목해 놓고 그 역할에 사람이 하나도 없는**\n * 결재선이 「찼다」로 읽힌다. 문 현황 화면은 「이 문은 섰습니다」라고 그리고, 현장이 상신을 누르는\n * 순간 워크리스트가 `approver is not set` 으로 던진다 — **준비됐다고 말해 놓고 쓸 때 터지는** 부류다.\n *\n * 실 테넌트에서 이것이 예외가 아니다. 미라텍에는 이 제품이 세운 역할이 하나도 없다\n * (§`project_mes_roles_locked_behind_demo`). 역할을 지목한 결재선은 거기서 전부 빈 자리를 가리킨다.\n *\n * ── 불을 돌려주지 않는다. 그리고 **union 으로도 안 돌려준다** ────────────\n * 막은 쪽이 이유를 말한다. `true`/`false` 하나면 화면이 「왜 안 되나」를 **다시 세게 되고**, 그러면\n * 정의가 두 곳이 된다 — 이 판단을 한 곳으로 모은 이유가 없어진다.\n *\n * 그래서 처음에 `{ok:true} | {ok:false, code}` 로 두었는데, 이 패키지의 `server/tsconfig.json` 은\n * **`strict: false`** 라 `strictNullChecks` 가 없고, 그러면 TS 가 **boolean 판별자로 union 을 안\n * 좁힌다.** `if (r.ok) return` 뒤에서 `r.code` 를 읽으면 컴파일이 깨진다 — 하루에 소비자 둘이\n * 연달아 걸렸고 그중 하나는 서버를 아예 못 뜨게 했다.\n *\n * 그래서 **한 객체에 선택 칸**이다. `if (standing.refusal)` 하나로 어디서나 읽힌다.\n * [합의했다] ADR-0047 ⑤(개정)\n *\n * ```\n * approval-line-missing    결재선 자체가 없다           누가 결재하는지를 정해야 한다\n * approval-role-empty      역할은 있는데 사람이 없다      그 역할에 사람을 넣어야 한다\n * approval-person-absent   지목한 사람이 여기 없다        다른 사람을 지목하거나 그 사람을 넣어야 한다\n * ```\n *\n * 관리자가 할 일이 다르므로 코드가 셋이다.\n *\n * ── 참조는 세지 않는다 ───────────────────────────────────────────────────\n * `participation: 'reference'` 는 의견만 내고 결재를 막지 않는다. 참조자 역할이 비었다고 거절하면\n * **결재와 무관한 이유로** 막는 것이 된다. 참조만 있는 결재선은 결재 없이 끝나므로 「없다」로 읽는다.\n *\n * ── 읽는 것은 부르는 쪽이 넘긴다 ─────────────────────────────────────────\n * 포트 하나를 받는다. 이 판단이 `manager` 를 받으면 TypeORM 을 알게 되어 순수 시험이 서지 않고,\n * **어느 도메인으로 좁혔나**가 부르는 쪽에서 안 보이게 된다. 포트의 수명은 **판정 하나**다 — 더\n * 오래 살면 역할에 사람을 넣은 직후에도 옛 답을 내놓는다.\n *\n * ── 사람을 직접 지목한 자리도 읽는다 ─────────────────────────────────────\n * 「이 제품은 역할만 쓴다」로 닫지 않는다. 그렇게 두면 **없는 사람을 지목한 결재선이 「찼다」로\n * 그려지고 상신 순간 터진다** — 역할에서 고친 그 모양이 사람 축으로 다시 나는 것이고, 「없음」이\n * 안전하지 않은 쪽으로 기우는 것이다. 게다가 이 정의는 워크리스트의 `ApprovalLineItem` 을 읽는\n * 공용 자리라, 다른 제품이 사람을 지목하는 날 조용히 틀린다.\n *\n * `Myself` · `MyDepartment` · `MySupervisor` 는 **상신할 때 그 사람으로 풀리는** 자리라 미리 셀 것이\n * 없다. 부서 지목(`Department`)은 부서장이 있어야 풀리는데 그 코드는 아직 없다 — 지어내지 않는다.\n *\n * [합의했다] operato-application/adr/ADR-0047.md ③⑤\n * ═══════════════════════════════════════════════════════════════════════════\n */\n\n/** 결재선 한 자리 — `ApprovalLineItem` 중 이 판단이 보는 칸만. */\nexport interface ApprovalSeat {\n  /** `OrgMemberTargetType` — 역할이면 `'Role'`. */\n  type?: string\n  /** 역할이면 role id, 사람이면 user id. */\n  value?: string\n  /** 편집기가 고른 대상. 편집기는 `value` 를 안 쓰고 여기에만 적는다(§`seatRoleId`). */\n  approver?: { id?: string }\n  /** 비어 있으면 결재다(`ApprovalLineItem.participation` 의 규약). */\n  participation?: string\n}\n\nexport type ApprovalLineRefusal = 'approval-line-missing' | 'approval-role-empty' | 'approval-person-absent'\n\nexport interface ApprovalLineStanding {\n  /** 이 결재선이 지나는 자리 수. 안 서는 결재선이면 0. */\n  approvers: number\n  /**\n   * 왜 안 서나 — **있으면 안 서는 것이다.** 없으면 선다.\n   *\n   * `params` 는 그 코드가 가리키는 것 하나다: 역할이 비었으면 그 역할, 사람이 없으면 그 사람.\n   */\n  refusal?: {\n    code: ApprovalLineRefusal\n    params?: { role?: string; personId?: string }\n  }\n}\n\nconst LINE_REFUSAL_ENGLISH: Record<ApprovalLineRefusal, string> = {\n  'approval-line-missing': 'this form has no approval line. set who approves it.',\n  'approval-role-empty': 'nobody holds the role {role} named in the approval line. add a person to that role.',\n  'approval-person-absent': 'the person named in the approval line is not in this site. name someone else in the approval line.'\n}\n\n/** A line that does not stand, as a refusal. The params are the one thing the code points at. */\nexport function approvalLineRefusal(refusal: NonNullable<ApprovalLineStanding['refusal']>): Refusal {\n  const params = { role: refusal.params?.role ?? null, personId: refusal.params?.personId ?? null }\n\n  return new Refusal(refusal.code, params, LINE_REFUSAL_ENGLISH[refusal.code].replace('{role}', params.role ?? ''))\n}\n\n/** 결재선의 자리가 실제로 사람으로 풀리나 — 읽는 것은 부르는 쪽 일이다. */\nexport interface ApprovalSeatReader {\n  /** 그 역할에 사람이 하나 이상 있나. */\n  roleHasMembers(roleId: string): Promise<boolean>\n  /** 지목한 그 사람이 이 공장에 있고 계정이 붙어 있나. */\n  personIsHere(personId: string): Promise<boolean>\n}\n\n/**\n * A seat's role, read the way submission reads it (`create-approval`, `resolve-judgeable-seats`).\n *\n * The approval line editor writes what it picked under `approver` and leaves `value` empty; seeded\n * lines carry both. Reading `value` alone here drew 「결재자 없음」 on the door screen for a line that\n * submits. One function, so the screen and submission cannot read a seat two ways again.\n */\nexport function seatRoleId(seat?: ApprovalSeat | null): string | undefined {\n  return seat?.value || seat?.approver?.id || undefined\n}\n\n/** A person seat, read the way submission reads it (`getSystemUserFromOrgMemberItem`: approver first). */\nexport function seatPersonId(seat?: ApprovalSeat | null): string | undefined {\n  return seat?.approver?.id || seat?.value || undefined\n}\n\nconst REFERENCE = 'reference'\nconst ROLE = 'Role'\nconst PERSON = 'Employee'\n\nexport async function judgeApprovalLine(\n  line: ApprovalSeat[] | undefined | null,\n  reader: ApprovalSeatReader\n): Promise<ApprovalLineStanding> {\n  const seats = (line ?? []).filter(seat => seat?.participation !== REFERENCE)\n\n  if (!seats.length) {\n    return { approvers: 0, refusal: { code: 'approval-line-missing' } }\n  }\n\n  for (const seat of seats) {\n    if (seat?.type === ROLE) {\n      const role = seatRoleId(seat)\n\n      if (!role || !(await reader.roleHasMembers(role))) {\n        return { approvers: 0, refusal: { code: 'approval-role-empty', params: { role: role ?? '' } } }\n      }\n\n      continue\n    }\n\n    if (seat?.type === PERSON) {\n      const person = seatPersonId(seat)\n\n      if (!person || !(await reader.personIsHere(person))) {\n        return { approvers: 0, refusal: { code: 'approval-person-absent', params: { personId: person ?? '' } } }\n      }\n    }\n  }\n\n  return { approvers: seats.length }\n}\n\n/** 결재선에서 **역할을 지목한 자리**의 id 들 — 부르는 쪽이 미리 읽어 둘 때 쓴다. */\nexport function rolesNamedIn(line: ApprovalSeat[] | undefined | null): string[] {\n  return (line ?? [])\n    .filter(seat => seat?.participation !== REFERENCE && seat?.type === ROLE)\n    .map(seat => seatRoleId(seat))\n    .filter((one): one is string => !!one)\n}\n"]}

package/dist-server/service/work-door/index.d.ts

@@ -0,0 +1,15 @@
+import { WorkDoorNotUsed } from './work-door-not-used.js';
+import { WorkDoorJournal } from './work-door-journal.js';
+import { WorkDoorResolver } from './work-door-resolver.js';
+export declare const entities: (typeof WorkDoorNotUsed | typeof WorkDoorJournal)[];
+export declare const resolvers: (typeof WorkDoorResolver)[];
+export * from './approval-line-standing.js';
+export * from './activity-lookup.js';
+export * from './work-door.js';
+export * from './work-door-declaration.js';
+export * from './work-door-journal.js';
+export * from './work-door-journal-service.js';
+export * from './work-door-not-used.js';
+export * from './work-door-service.js';
+export * from './work-door-type.js';
+export * from './pass-work-door.js';

package/dist-server/service/work-door/index.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolvers = exports.entities = void 0;
+const tslib_1 = require("tslib");
+const work_door_not_used_js_1 = require("./work-door-not-used.js");
+const work_door_journal_js_1 = require("./work-door-journal.js");
+const work_door_resolver_js_1 = require("./work-door-resolver.js");
+exports.entities = [work_door_not_used_js_1.WorkDoorNotUsed, work_door_journal_js_1.WorkDoorJournal];
+exports.resolvers = [work_door_resolver_js_1.WorkDoorResolver];
+tslib_1.__exportStar(require("./approval-line-standing.js"), exports);
+tslib_1.__exportStar(require("./activity-lookup.js"), exports);
+tslib_1.__exportStar(require("./work-door.js"), exports);
+tslib_1.__exportStar(require("./work-door-declaration.js"), exports);
+tslib_1.__exportStar(require("./work-door-journal.js"), exports);
+tslib_1.__exportStar(require("./work-door-journal-service.js"), exports);
+tslib_1.__exportStar(require("./work-door-not-used.js"), exports);
+tslib_1.__exportStar(require("./work-door-service.js"), exports);
+tslib_1.__exportStar(require("./work-door-type.js"), exports);
+tslib_1.__exportStar(require("./pass-work-door.js"), exports);
+//# sourceMappingURL=index.js.map

package/dist-server/service/work-door/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../server/service/work-door/index.ts"],"names":[],"mappings":";;;;AAAA,mEAAyD;AACzD,iEAAwD;AACxD,mEAA0D;AAE7C,QAAA,QAAQ,GAAG,CAAC,uCAAe,EAAE,sCAAe,CAAC,CAAA;AAC7C,QAAA,SAAS,GAAG,CAAC,wCAAgB,CAAC,CAAA;AAE3C,sEAA2C;AAC3C,+DAAoC;AACpC,yDAA8B;AAC9B,qEAA0C;AAC1C,iEAAsC;AACtC,yEAA8C;AAC9C,kEAAuC;AACvC,iEAAsC;AACtC,8DAAmC;AACnC,8DAAmC","sourcesContent":["import { WorkDoorNotUsed } from './work-door-not-used.js'\nimport { WorkDoorJournal } from './work-door-journal.js'\nimport { WorkDoorResolver } from './work-door-resolver.js'\n\nexport const entities = [WorkDoorNotUsed, WorkDoorJournal]\nexport const resolvers = [WorkDoorResolver]\n\nexport * from './approval-line-standing.js'\nexport * from './activity-lookup.js'\nexport * from './work-door.js'\nexport * from './work-door-declaration.js'\nexport * from './work-door-journal.js'\nexport * from './work-door-journal-service.js'\nexport * from './work-door-not-used.js'\nexport * from './work-door-service.js'\nexport * from './work-door-type.js'\nexport * from './pass-work-door.js'\n"]}

package/dist-server/service/work-door/pass-work-door.d.ts

@@ -0,0 +1,74 @@
+import { EntityManager } from 'typeorm';
+import { Domain, Refusal } from '@things-factory/shell';
+import { User } from '@things-factory/auth-base';
+import { type ApprovalLineStanding, type ApprovalSeatReader } from './approval-line-standing.js';
+import { WorkDoorEvent } from './work-door-event.js';
+import type { WorkDoorDeclaration } from './work-door-declaration.js';
+/**
+ * **One place decides, and the same place writes it down** (ADR-0077 decision 1).
+ *
+ * ═══════════════════════════════════════════════════════════════════════════
+ * ── Why judgement and record are one call ─────────────────────────────────
+ * Until now each application door read the approval line itself and decided what to do, which is why
+ * eight of operato-plant's doors run with no line and none of them leaves a trace: the place that
+ * knew a step had been skipped was not the place that wrote anything down, and there were eight of
+ * them. Joined here, a door cannot take the `run` branch without the line being written - there is
+ * no branch to take that skips it.
+ *
+ * ── The transaction is not a convenience ──────────────────────────────────
+ * `tx` is the caller's **open** transaction, not a manager. The line and the work it describes have
+ * to commit together: the line first and the work failing leaves a log that says something happened
+ * that did not, and the reverse leaves the silent pass this log exists to end. A plain manager
+ * commits each statement where it stands, so passing one is the same bug the outbox sequence has
+ * one layer down - and there it burned 200 numbers before anyone noticed.
+ *
+ * ── `as-established` asks the door, it does not guess ─────────────────────
+ * A door whose branch turns on the row's own history (a non-working period withdrawn: declared
+ * through approval, withdrawn through approval) answers `establishedByApproval` itself. This
+ * function reads that one flag. Putting the judgement here would mean the worklist knew what a
+ * non-working period is.
+ * ═══════════════════════════════════════════════════════════════════════════
+ */
+export interface WorkDoorReading {
+    door: WorkDoorDeclaration;
+    /** The activity as installed in this domain, if it is installed at all. */
+    activity?: {
+        id?: string;
+        approvalLine?: unknown[];
+    } | null;
+    /** What this is about, as the application names it. Two strings; nothing is read inside them. */
+    subject: {
+        kind: string;
+        id: string;
+    };
+    /** `as-established` doors only: did the row this is about come about through approval? */
+    establishedByApproval?: boolean;
+    /** True when this domain has declared it does not use this door. */
+    notUsed?: boolean;
+}
+export interface WorkDoorPassage {
+    /** The caller's open transaction - the work and the log line commit together. */
+    tx: EntityManager;
+    domain: Domain;
+    user?: User;
+    /** Reads whether a seat in the line resolves to a person. */
+    seats: ApprovalSeatReader;
+}
+export type WorkDoorVerdict = 
+/** The line stands. The caller raises it for approval; the instance is the record. */
+{
+    go: 'raise';
+    standing: ApprovalLineStanding;
+}
+/** No approval here. The work happens, and this is the id of the line written about it. */
+ | {
+    go: 'run';
+    noted: string;
+    because: WorkDoorEvent.RanWithoutLine | WorkDoorEvent.RanNotUsed;
+}
+/** The caller is refused, in words that say what to go and fix. */
+ | {
+    go: 'refuse';
+    refusal: Refusal;
+};
+export declare function passWorkDoor(reading: WorkDoorReading, passage: WorkDoorPassage): Promise<WorkDoorVerdict>;

package/dist-server/service/work-door/pass-work-door.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.passWorkDoor = passWorkDoor;
+const approval_line_standing_js_1 = require("./approval-line-standing.js");
+const work_door_event_js_1 = require("./work-door-event.js");
+const work_door_journal_service_js_1 = require("./work-door-journal-service.js");
+const approval_line_standing_js_2 = require("./approval-line-standing.js");
+/** A manager that is not in a transaction commits each statement where it stands. */
+function assertOpenTransaction(tx) {
+    if (tx?.queryRunner?.isTransactionActive) {
+        return;
+    }
+    throw new Error('passWorkDoor: must run inside the transaction that does the work - ' +
+        'a plain manager commits the log line on its own, and then the log says something happened that did not');
+}
+async function passWorkDoor(reading, passage) {
+    assertOpenTransaction(passage.tx);
+    const { door } = reading;
+    if (door.kind === 'assignment') {
+        throw new Error(`passWorkDoor: "${door.name}" is an assignment door, and an assignment door has no approval line - ` +
+            'what it waits for is a role bound to it, which is a different question with a different answer');
+    }
+    /* Declared unused: the work happens, and the line says it was that and not an empty line. */
+    if (reading.notUsed) {
+        return await ran(work_door_event_js_1.WorkDoorEvent.RanNotUsed, reading, passage);
+    }
+    const standing = await (0, approval_line_standing_js_1.judgeApprovalLine)(reading.activity?.approvalLine, passage.seats);
+    if (!standing.refusal) {
+        return { go: 'raise', standing };
+    }
+    const whenNoLine = door.whenNoLine === 'as-established'
+        ? reading.establishedByApproval
+            ? 'refuse'
+            : 'run'
+        : door.whenNoLine;
+    if (whenNoLine === 'refuse') {
+        return { go: 'refuse', refusal: (0, approval_line_standing_js_2.approvalLineRefusal)(standing.refusal) };
+    }
+    return await ran(work_door_event_js_1.WorkDoorEvent.RanWithoutLine, reading, passage);
+}
+async function ran(kind, reading, passage) {
+    const noted = await (0, work_door_journal_service_js_1.noteWorkDoor)(passage.tx, passage.domain, { kind, door: reading.door.name, subject: reading.subject }, passage.user);
+    return { go: 'run', noted: noted.id, because: kind };
+}
+//# sourceMappingURL=pass-work-door.js.map

package/dist-server/service/work-door/pass-work-door.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pass-work-door.js","sourceRoot":"","sources":["../../../server/service/work-door/pass-work-door.ts"],"names":[],"mappings":";;AA6EA,oCAyCC;AAjHD,2EAAmH;AACnH,6DAAoD;AACpD,iFAA6D;AAC7D,2EAAiE;AAyDjE,qFAAqF;AACrF,SAAS,qBAAqB,CAAC,EAAoC;IACjE,IAAK,EAA0D,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC;QAClG,OAAM;IACR,CAAC;IAED,MAAM,IAAI,KAAK,CACb,qEAAqE;QACnE,wGAAwG,CAC3G,CAAA;AACH,CAAC;AAEM,KAAK,UAAU,YAAY,CAChC,OAAwB,EACxB,OAAwB;IAExB,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAEjC,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAA;IAExB,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,kBAAkB,IAAI,CAAC,IAAI,yEAAyE;YAClG,gGAAgG,CACnG,CAAA;IACH,CAAC;IAED,6FAA6F;IAC7F,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,MAAM,GAAG,CAAC,kCAAa,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;IAC9D,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,IAAA,6CAAiB,EACtC,OAAO,CAAC,QAAQ,EAAE,YAAuD,EACzE,OAAO,CAAC,KAAK,CACd,CAAA;IAED,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;IAClC,CAAC;IAED,MAAM,UAAU,GACd,IAAI,CAAC,UAAU,KAAK,gBAAgB;QAClC,CAAC,CAAC,OAAO,CAAC,qBAAqB;YAC7B,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,KAAK;QACT,CAAC,CAAC,IAAI,CAAC,UAAU,CAAA;IAErB,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAA,+CAAmB,EAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAA;IACzE,CAAC;IAED,OAAO,MAAM,GAAG,CAAC,kCAAa,CAAC,cAAc,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;AAClE,CAAC;AAED,KAAK,UAAU,GAAG,CAChB,IAA6D,EAC7D,OAAwB,EACxB,OAAwB;IAExB,MAAM,KAAK,GAAG,MAAM,IAAA,2CAAY,EAC9B,OAAO,CAAC,EAAE,EACV,OAAO,CAAC,MAAM,EACd,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,EAC3D,OAAO,CAAC,IAAI,CACb,CAAA;IAED,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AACtD,CAAC","sourcesContent":["import { EntityManager } from 'typeorm'\n\nimport { Domain, Refusal } from '@things-factory/shell'\nimport { User } from '@things-factory/auth-base'\n\nimport { judgeApprovalLine, type ApprovalLineStanding, type ApprovalSeatReader } from './approval-line-standing.js'\nimport { WorkDoorEvent } from './work-door-event.js'\nimport { noteWorkDoor } from './work-door-journal-service.js'\nimport { approvalLineRefusal } from './approval-line-standing.js'\nimport type { WorkDoorDeclaration } from './work-door-declaration.js'\n\n/**\n * **One place decides, and the same place writes it down** (ADR-0077 decision 1).\n *\n * ═══════════════════════════════════════════════════════════════════════════\n * ── Why judgement and record are one call ─────────────────────────────────\n * Until now each application door read the approval line itself and decided what to do, which is why\n * eight of operato-plant's doors run with no line and none of them leaves a trace: the place that\n * knew a step had been skipped was not the place that wrote anything down, and there were eight of\n * them. Joined here, a door cannot take the `run` branch without the line being written - there is\n * no branch to take that skips it.\n *\n * ── The transaction is not a convenience ──────────────────────────────────\n * `tx` is the caller's **open** transaction, not a manager. The line and the work it describes have\n * to commit together: the line first and the work failing leaves a log that says something happened\n * that did not, and the reverse leaves the silent pass this log exists to end. A plain manager\n * commits each statement where it stands, so passing one is the same bug the outbox sequence has\n * one layer down - and there it burned 200 numbers before anyone noticed.\n *\n * ── `as-established` asks the door, it does not guess ─────────────────────\n * A door whose branch turns on the row's own history (a non-working period withdrawn: declared\n * through approval, withdrawn through approval) answers `establishedByApproval` itself. This\n * function reads that one flag. Putting the judgement here would mean the worklist knew what a\n * non-working period is.\n * ═══════════════════════════════════════════════════════════════════════════\n */\nexport interface WorkDoorReading {\n  door: WorkDoorDeclaration\n  /** The activity as installed in this domain, if it is installed at all. */\n  activity?: { id?: string; approvalLine?: unknown[] } | null\n  /** What this is about, as the application names it. Two strings; nothing is read inside them. */\n  subject: { kind: string; id: string }\n  /** `as-established` doors only: did the row this is about come about through approval? */\n  establishedByApproval?: boolean\n  /** True when this domain has declared it does not use this door. */\n  notUsed?: boolean\n}\n\nexport interface WorkDoorPassage {\n  /** The caller's open transaction - the work and the log line commit together. */\n  tx: EntityManager\n  domain: Domain\n  user?: User\n  /** Reads whether a seat in the line resolves to a person. */\n  seats: ApprovalSeatReader\n}\n\nexport type WorkDoorVerdict =\n  /** The line stands. The caller raises it for approval; the instance is the record. */\n  | { go: 'raise'; standing: ApprovalLineStanding }\n  /** No approval here. The work happens, and this is the id of the line written about it. */\n  | { go: 'run'; noted: string; because: WorkDoorEvent.RanWithoutLine | WorkDoorEvent.RanNotUsed }\n  /** The caller is refused, in words that say what to go and fix. */\n  | { go: 'refuse'; refusal: Refusal }\n\n/** A manager that is not in a transaction commits each statement where it stands. */\nfunction assertOpenTransaction(tx: EntityManager | undefined | null): void {\n  if ((tx as { queryRunner?: { isTransactionActive?: boolean } })?.queryRunner?.isTransactionActive) {\n    return\n  }\n\n  throw new Error(\n    'passWorkDoor: must run inside the transaction that does the work - ' +\n      'a plain manager commits the log line on its own, and then the log says something happened that did not'\n  )\n}\n\nexport async function passWorkDoor(\n  reading: WorkDoorReading,\n  passage: WorkDoorPassage\n): Promise<WorkDoorVerdict> {\n  assertOpenTransaction(passage.tx)\n\n  const { door } = reading\n\n  if (door.kind === 'assignment') {\n    throw new Error(\n      `passWorkDoor: \"${door.name}\" is an assignment door, and an assignment door has no approval line - ` +\n        'what it waits for is a role bound to it, which is a different question with a different answer'\n    )\n  }\n\n  /* Declared unused: the work happens, and the line says it was that and not an empty line. */\n  if (reading.notUsed) {\n    return await ran(WorkDoorEvent.RanNotUsed, reading, passage)\n  }\n\n  const standing = await judgeApprovalLine(\n    reading.activity?.approvalLine as Parameters<typeof judgeApprovalLine>[0],\n    passage.seats\n  )\n\n  if (!standing.refusal) {\n    return { go: 'raise', standing }\n  }\n\n  const whenNoLine =\n    door.whenNoLine === 'as-established'\n      ? reading.establishedByApproval\n        ? 'refuse'\n        : 'run'\n      : door.whenNoLine\n\n  if (whenNoLine === 'refuse') {\n    return { go: 'refuse', refusal: approvalLineRefusal(standing.refusal) }\n  }\n\n  return await ran(WorkDoorEvent.RanWithoutLine, reading, passage)\n}\n\nasync function ran(\n  kind: WorkDoorEvent.RanWithoutLine | WorkDoorEvent.RanNotUsed,\n  reading: WorkDoorReading,\n  passage: WorkDoorPassage\n): Promise<WorkDoorVerdict> {\n  const noted = await noteWorkDoor(\n    passage.tx,\n    passage.domain,\n    { kind, door: reading.door.name, subject: reading.subject },\n    passage.user\n  )\n\n  return { go: 'run', noted: noted.id, because: kind }\n}\n"]}

package/dist-server/service/work-door/work-door-declaration.d.ts

@@ -0,0 +1,135 @@
+/**
+ * **What an application declares about its own work doors** (ADR-0069 decision 3, ADR-0077).
+ *
+ * ═══════════════════════════════════════════════════════════════════════════
+ * ── Who says what ─────────────────────────────────────────────────────────
+ * The form is installed by the product at boot, and the plant fills in who approves it. Filling it
+ * in is the declaration that this factory uses that step. So two facts have two owners:
+ *
+ * ```
+ * the list of doors, and what each one is    the application - it declares them here
+ * whether a door stands in this domain       the worklist - it reads the activity and its line
+ * ```
+ *
+ * An application registers its list; the screens and the judgement live here. Without that split the
+ * worklist would have to know operato-plant's activities, and every application would carry its own
+ * copy of the same screen (operato-warehouse asked for it second, which is what moved this).
+ *
+ * ── Registration happens at module import ─────────────────────────────────
+ * Not on a bootstrap hook. A hook runs after the schema is built, which is too late for anything the
+ * schema or a boot-time install reads - `declareAxes` in auth-base carries the same warning.
+ *
+ * ── Nobody declares a label ───────────────────────────────────────────────
+ * The screen's label key is computed from `name` (`activityTKey(name, 'label')`), the same key the
+ * activity catalog reads. A declared key used to ride here, and operato-plant built it from the
+ * PascalCase name while its translations are kebab-cased - the door screen printed twenty-four raw
+ * keys (:4000, 2026-09-24). A key nobody picks is a key nobody can pick wrong.
+ * ═══════════════════════════════════════════════════════════════════════════
+ */
+/**
+ * What happens when the approval line is empty. **This records what each door already does** - it is
+ * not a new policy (ADR-0077 decision 1).
+ *
+ * - `run` - the work happens and the approval step is skipped. The worklist writes a line saying so;
+ *   until that record existed there was no way to tell it from a factory that approved it.
+ * - `refuse` - the caller is refused and told why the line does not stand.
+ * - `as-established` - the branch depends on **the row's own history**: a period declared through
+ *   approval is withdrawn through approval, and one that stood without approval is simply removed.
+ *   Only a door whose branch turns on the row may use this, and both branches are tested. The
+ *   judgement stays with the door; the worklist asks it which way this row goes.
+ */
+export type WhenNoLine = 'refuse' | 'run' | 'as-established';
+/**
+ * Why a door refuses rather than running. Two doors that both refuse can refuse for different
+ * reasons, and an administrator reads the reason to know whether filling the line is the fix.
+ *
+ * - `irreversible` - what the door does cannot be taken back (`mutation-reversibility`).
+ * - `approval-is-the-act` - the door's whole work **is** the approval. Letting it through with no
+ *   line would put an unsigned controlled document on the floor.
+ * - `lowers-a-control` - the door lowers a control that stands: turning document control off, or
+ *   moving a maintenance due date. Such a door refuses whatever its reversibility says, because the
+ *   time that passed under the lowered control does not come back.
+ */
+export type WhenNoLineBecause = 'irreversible' | 'approval-is-the-act' | 'lowers-a-control';
+interface DoorBase {
+    /** The form name - the same key the callback is found by. Labels change; this does not. */
+    name: string;
+    /**
+     * @deprecated **Not read.** The label key is computed from `name`. Kept optional only so a
+     * declaration built against the previous release still compiles; operato-plant and
+     * operato-warehouse drop it, and then this line goes (worklist-ux-handoff, 2026-09-24).
+     */
+    labelKey?: string;
+    /**
+     * This door borrows another door's approval line. Written once, in one place: two doors carrying
+     * the same line as a value drift, and then turning a control on and off are approved by different
+     * people (ADR-0047 ⑨).
+     */
+    lineFollows?: string;
+}
+type ApprovalDoor = DoorBase & {
+    kind: 'approval';
+} & ({
+    whenNoLine: 'run';
+    because?: never;
+} | {
+    whenNoLine: 'refuse' | 'as-established';
+    because: WhenNoLineBecause;
+});
+/**
+ * `whenNoLine?: never` is the point of this type: an assignment door has no approval line, so the
+ * field cannot be written here at all. Left optional it would be filled in one day with a value that
+ * reads true and means nothing.
+ */
+type AssignmentDoor = DoorBase & {
+    kind: 'assignment';
+    whenNoLine?: never;
+    because?: never;
+};
+export type WorkDoorDeclaration = ApprovalDoor | AssignmentDoor;
+export interface WorkDoorRegistration {
+    /** The declaring module, as its package's short name. It groups the screen and names the source. */
+    module: string;
+    doors: readonly WorkDoorDeclaration[];
+    /**
+     * The role seats this module offers, by name.
+     *
+     * An approval line points at roles, so a domain with none of them cannot build one - and today
+     * that is found out on the form screen, too late. The door screen counts how many of these stand
+     * here and says what to do first. A domain's own roles are not counted: this number answers "of
+     * what the product offered", and a line built from other roles works just as well.
+     */
+    seats?: readonly string[];
+}
+/**
+ * An application declares its doors. Called at module import time, once per module.
+ *
+ * Re-registering the same module replaces it rather than appending: a module imported twice under a
+ * watch rebuild would otherwise show every door twice, and a screen that double-counts the doors
+ * that need attention is one nobody trusts.
+ */
+export declare function registerWorkDoors(registration: WorkDoorRegistration): void;
+/** Every registration in this installation, in registration order. */
+export declare function registeredWorkDoors(): WorkDoorRegistration[];
+/** Every declared door, flattened, in registration order. */
+export declare function declaredDoors(): WorkDoorDeclaration[];
+/** Every role seat the declaring modules offer, by name, without repeats. */
+export declare function offeredSeatNames(): string[];
+/** One door by form name, whichever module declared it. */
+export declare function declaredDoor(name: string): WorkDoorDeclaration | undefined;
+/**
+ * **Can this door be declared unused?** Not when it refuses on an empty line (ADR-0077 decision 3).
+ *
+ * "We do not use this door" means the work runs with no approval step (`ran-not-used`). `refuse`
+ * means the work cannot stand without an approval line. The two cannot hold for one door, and each of
+ * the three reasons says why: what an `irreversible` door does cannot be taken back, an
+ * `approval-is-the-act` door's work is the approval, and a `lowers-a-control` door lowers a control
+ * that stands. Accepting the declaration would leave the door screen showing the door as off while
+ * the product still demands approval - or, if the product honoured it, run those three kinds of work
+ * unapproved.
+ *
+ * Answers the reason, so the refusal can say which one. `run`, `as-established` and assignment doors
+ * answer nothing - they can be declared unused as before.
+ */
+export declare function whyNotUsedCannotBeDeclared(door: WorkDoorDeclaration): WhenNoLineBecause | undefined;
+export {};

package/dist-server/service/work-door/work-door-declaration.js

@@ -0,0 +1,87 @@
+"use strict";
+/**
+ * **What an application declares about its own work doors** (ADR-0069 decision 3, ADR-0077).
+ *
+ * ═══════════════════════════════════════════════════════════════════════════
+ * ── Who says what ─────────────────────────────────────────────────────────
+ * The form is installed by the product at boot, and the plant fills in who approves it. Filling it
+ * in is the declaration that this factory uses that step. So two facts have two owners:
+ *
+ * ```
+ * the list of doors, and what each one is    the application - it declares them here
+ * whether a door stands in this domain       the worklist - it reads the activity and its line
+ * ```
+ *
+ * An application registers its list; the screens and the judgement live here. Without that split the
+ * worklist would have to know operato-plant's activities, and every application would carry its own
+ * copy of the same screen (operato-warehouse asked for it second, which is what moved this).
+ *
+ * ── Registration happens at module import ─────────────────────────────────
+ * Not on a bootstrap hook. A hook runs after the schema is built, which is too late for anything the
+ * schema or a boot-time install reads - `declareAxes` in auth-base carries the same warning.
+ *
+ * ── Nobody declares a label ───────────────────────────────────────────────
+ * The screen's label key is computed from `name` (`activityTKey(name, 'label')`), the same key the
+ * activity catalog reads. A declared key used to ride here, and operato-plant built it from the
+ * PascalCase name while its translations are kebab-cased - the door screen printed twenty-four raw
+ * keys (:4000, 2026-09-24). A key nobody picks is a key nobody can pick wrong.
+ * ═══════════════════════════════════════════════════════════════════════════
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerWorkDoors = registerWorkDoors;
+exports.registeredWorkDoors = registeredWorkDoors;
+exports.declaredDoors = declaredDoors;
+exports.offeredSeatNames = offeredSeatNames;
+exports.declaredDoor = declaredDoor;
+exports.whyNotUsedCannotBeDeclared = whyNotUsedCannotBeDeclared;
+const registered = new Map();
+/**
+ * An application declares its doors. Called at module import time, once per module.
+ *
+ * Re-registering the same module replaces it rather than appending: a module imported twice under a
+ * watch rebuild would otherwise show every door twice, and a screen that double-counts the doors
+ * that need attention is one nobody trusts.
+ */
+function registerWorkDoors(registration) {
+    registered.set(registration.module, registration);
+}
+/** Every registration in this installation, in registration order. */
+function registeredWorkDoors() {
+    return [...registered.values()];
+}
+/** Every declared door, flattened, in registration order. */
+function declaredDoors() {
+    return [...registered.values()].flatMap(one => [...one.doors]);
+}
+/** Every role seat the declaring modules offer, by name, without repeats. */
+function offeredSeatNames() {
+    return [...new Set([...registered.values()].flatMap(one => [...(one.seats ?? [])]))];
+}
+/** One door by form name, whichever module declared it. */
+function declaredDoor(name) {
+    for (const registration of registered.values()) {
+        const found = registration.doors.find(door => door.name === name);
+        if (found) {
+            return found;
+        }
+    }
+    return undefined;
+}
+/**
+ * **Can this door be declared unused?** Not when it refuses on an empty line (ADR-0077 decision 3).
+ *
+ * "We do not use this door" means the work runs with no approval step (`ran-not-used`). `refuse`
+ * means the work cannot stand without an approval line. The two cannot hold for one door, and each of
+ * the three reasons says why: what an `irreversible` door does cannot be taken back, an
+ * `approval-is-the-act` door's work is the approval, and a `lowers-a-control` door lowers a control
+ * that stands. Accepting the declaration would leave the door screen showing the door as off while
+ * the product still demands approval - or, if the product honoured it, run those three kinds of work
+ * unapproved.
+ *
+ * Answers the reason, so the refusal can say which one. `run`, `as-established` and assignment doors
+ * answer nothing - they can be declared unused as before.
+ */
+function whyNotUsedCannotBeDeclared(door) {
+    return door.kind === 'approval' && door.whenNoLine === 'refuse' ? door.because : undefined;
+}
+//# sourceMappingURL=work-door-declaration.js.map

package/dist-server/service/work-door/work-door-declaration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"work-door-declaration.js","sourceRoot":"","sources":["../../../server/service/work-door/work-door-declaration.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;;AAoFH,8CAEC;AAGD,kDAEC;AAGD,sCAEC;AAGD,4CAEC;AAGD,oCAUC;AAgBD,gEAEC;AAzDD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAgC,CAAA;AAE1D;;;;;;GAMG;AACH,SAAgB,iBAAiB,CAAC,YAAkC;IAClE,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;AACnD,CAAC;AAED,sEAAsE;AACtE,SAAgB,mBAAmB;IACjC,OAAO,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;AACjC,CAAC;AAED,6DAA6D;AAC7D,SAAgB,aAAa;IAC3B,OAAO,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;AAChE,CAAC;AAED,6EAA6E;AAC7E,SAAgB,gBAAgB;IAC9B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AACtF,CAAC;AAED,2DAA2D;AAC3D,SAAgB,YAAY,CAAC,IAAY;IACvC,KAAK,MAAM,YAAY,IAAI,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;QAEjE,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAgB,0BAA0B,CAAC,IAAyB;IAClE,OAAO,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;AAC5F,CAAC","sourcesContent":["/**\n * **What an application declares about its own work doors** (ADR-0069 decision 3, ADR-0077).\n *\n * ═══════════════════════════════════════════════════════════════════════════\n * ── Who says what ─────────────────────────────────────────────────────────\n * The form is installed by the product at boot, and the plant fills in who approves it. Filling it\n * in is the declaration that this factory uses that step. So two facts have two owners:\n *\n * ```\n * the list of doors, and what each one is    the application - it declares them here\n * whether a door stands in this domain       the worklist - it reads the activity and its line\n * ```\n *\n * An application registers its list; the screens and the judgement live here. Without that split the\n * worklist would have to know operato-plant's activities, and every application would carry its own\n * copy of the same screen (operato-warehouse asked for it second, which is what moved this).\n *\n * ── Registration happens at module import ─────────────────────────────────\n * Not on a bootstrap hook. A hook runs after the schema is built, which is too late for anything the\n * schema or a boot-time install reads - `declareAxes` in auth-base carries the same warning.\n *\n * ── Nobody declares a label ───────────────────────────────────────────────\n * The screen's label key is computed from `name` (`activityTKey(name, 'label')`), the same key the\n * activity catalog reads. A declared key used to ride here, and operato-plant built it from the\n * PascalCase name while its translations are kebab-cased - the door screen printed twenty-four raw\n * keys (:4000, 2026-09-24). A key nobody picks is a key nobody can pick wrong.\n * ═══════════════════════════════════════════════════════════════════════════\n */\n\n/**\n * What happens when the approval line is empty. **This records what each door already does** - it is\n * not a new policy (ADR-0077 decision 1).\n *\n * - `run` - the work happens and the approval step is skipped. The worklist writes a line saying so;\n *   until that record existed there was no way to tell it from a factory that approved it.\n * - `refuse` - the caller is refused and told why the line does not stand.\n * - `as-established` - the branch depends on **the row's own history**: a period declared through\n *   approval is withdrawn through approval, and one that stood without approval is simply removed.\n *   Only a door whose branch turns on the row may use this, and both branches are tested. The\n *   judgement stays with the door; the worklist asks it which way this row goes.\n */\nexport type WhenNoLine = 'refuse' | 'run' | 'as-established'\n\n/**\n * Why a door refuses rather than running. Two doors that both refuse can refuse for different\n * reasons, and an administrator reads the reason to know whether filling the line is the fix.\n *\n * - `irreversible` - what the door does cannot be taken back (`mutation-reversibility`).\n * - `approval-is-the-act` - the door's whole work **is** the approval. Letting it through with no\n *   line would put an unsigned controlled document on the floor.\n * - `lowers-a-control` - the door lowers a control that stands: turning document control off, or\n *   moving a maintenance due date. Such a door refuses whatever its reversibility says, because the\n *   time that passed under the lowered control does not come back.\n */\nexport type WhenNoLineBecause = 'irreversible' | 'approval-is-the-act' | 'lowers-a-control'\n\ninterface DoorBase {\n  /** The form name - the same key the callback is found by. Labels change; this does not. */\n  name: string\n  /**\n   * @deprecated **Not read.** The label key is computed from `name`. Kept optional only so a\n   * declaration built against the previous release still compiles; operato-plant and\n   * operato-warehouse drop it, and then this line goes (worklist-ux-handoff, 2026-09-24).\n   */\n  labelKey?: string\n  /**\n   * This door borrows another door's approval line. Written once, in one place: two doors carrying\n   * the same line as a value drift, and then turning a control on and off are approved by different\n   * people (ADR-0047 ⑨).\n   */\n  lineFollows?: string\n}\n\ntype ApprovalDoor = DoorBase & { kind: 'approval' } & (\n    | { whenNoLine: 'run'; because?: never }\n    | { whenNoLine: 'refuse' | 'as-established'; because: WhenNoLineBecause }\n  )\n\n/**\n * `whenNoLine?: never` is the point of this type: an assignment door has no approval line, so the\n * field cannot be written here at all. Left optional it would be filled in one day with a value that\n * reads true and means nothing.\n */\ntype AssignmentDoor = DoorBase & { kind: 'assignment'; whenNoLine?: never; because?: never }\n\nexport type WorkDoorDeclaration = ApprovalDoor | AssignmentDoor\n\nexport interface WorkDoorRegistration {\n  /** The declaring module, as its package's short name. It groups the screen and names the source. */\n  module: string\n  doors: readonly WorkDoorDeclaration[]\n  /**\n   * The role seats this module offers, by name.\n   *\n   * An approval line points at roles, so a domain with none of them cannot build one - and today\n   * that is found out on the form screen, too late. The door screen counts how many of these stand\n   * here and says what to do first. A domain's own roles are not counted: this number answers \"of\n   * what the product offered\", and a line built from other roles works just as well.\n   */\n  seats?: readonly string[]\n}\n\nconst registered = new Map<string, WorkDoorRegistration>()\n\n/**\n * An application declares its doors. Called at module import time, once per module.\n *\n * Re-registering the same module replaces it rather than appending: a module imported twice under a\n * watch rebuild would otherwise show every door twice, and a screen that double-counts the doors\n * that need attention is one nobody trusts.\n */\nexport function registerWorkDoors(registration: WorkDoorRegistration): void {\n  registered.set(registration.module, registration)\n}\n\n/** Every registration in this installation, in registration order. */\nexport function registeredWorkDoors(): WorkDoorRegistration[] {\n  return [...registered.values()]\n}\n\n/** Every declared door, flattened, in registration order. */\nexport function declaredDoors(): WorkDoorDeclaration[] {\n  return [...registered.values()].flatMap(one => [...one.doors])\n}\n\n/** Every role seat the declaring modules offer, by name, without repeats. */\nexport function offeredSeatNames(): string[] {\n  return [...new Set([...registered.values()].flatMap(one => [...(one.seats ?? [])]))]\n}\n\n/** One door by form name, whichever module declared it. */\nexport function declaredDoor(name: string): WorkDoorDeclaration | undefined {\n  for (const registration of registered.values()) {\n    const found = registration.doors.find(door => door.name === name)\n\n    if (found) {\n      return found\n    }\n  }\n\n  return undefined\n}\n\n/**\n * **Can this door be declared unused?** Not when it refuses on an empty line (ADR-0077 decision 3).\n *\n * \"We do not use this door\" means the work runs with no approval step (`ran-not-used`). `refuse`\n * means the work cannot stand without an approval line. The two cannot hold for one door, and each of\n * the three reasons says why: what an `irreversible` door does cannot be taken back, an\n * `approval-is-the-act` door's work is the approval, and a `lowers-a-control` door lowers a control\n * that stands. Accepting the declaration would leave the door screen showing the door as off while\n * the product still demands approval - or, if the product honoured it, run those three kinds of work\n * unapproved.\n *\n * Answers the reason, so the refusal can say which one. `run`, `as-established` and assignment doors\n * answer nothing - they can be declared unused as before.\n */\nexport function whyNotUsedCannotBeDeclared(door: WorkDoorDeclaration): WhenNoLineBecause | undefined {\n  return door.kind === 'approval' && door.whenNoLine === 'refuse' ? door.because : undefined\n}\n"]}