@things-factory/worklist 10.1.29 → 10.1.31

package/dist-server/service/work-door/pass-work-door.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.passWorkDoor = passWorkDoor;
+const approval_line_standing_js_1 = require("./approval-line-standing.js");
+const work_door_event_js_1 = require("./work-door-event.js");
+const work_door_journal_service_js_1 = require("./work-door-journal-service.js");
+const approval_line_standing_js_2 = require("./approval-line-standing.js");
+/** A manager that is not in a transaction commits each statement where it stands. */
+function assertOpenTransaction(tx) {
+    if (tx?.queryRunner?.isTransactionActive) {
+        return;
+    }
+    throw new Error('passWorkDoor: must run inside the transaction that does the work - ' +
+        'a plain manager commits the log line on its own, and then the log says something happened that did not');
+}
+async function passWorkDoor(reading, passage) {
+    assertOpenTransaction(passage.tx);
+    const { door } = reading;
+    if (door.kind === 'assignment') {
+        throw new Error(`passWorkDoor: "${door.name}" is an assignment door, and an assignment door has no approval line - ` +
+            'what it waits for is a role bound to it, which is a different question with a different answer');
+    }
+    /* Declared unused: the work happens, and the line says it was that and not an empty line. */
+    if (reading.notUsed) {
+        return await ran(work_door_event_js_1.WorkDoorEvent.RanNotUsed, reading, passage);
+    }
+    const standing = await (0, approval_line_standing_js_1.judgeApprovalLine)(reading.activity?.approvalLine, passage.seats);
+    if (!standing.refusal) {
+        return { go: 'raise', standing };
+    }
+    const whenNoLine = door.whenNoLine === 'as-established'
+        ? reading.establishedByApproval
+            ? 'refuse'
+            : 'run'
+        : door.whenNoLine;
+    if (whenNoLine === 'refuse') {
+        return { go: 'refuse', refusal: (0, approval_line_standing_js_2.approvalLineRefusal)(standing.refusal) };
+    }
+    return await ran(work_door_event_js_1.WorkDoorEvent.RanWithoutLine, reading, passage);
+}
+async function ran(kind, reading, passage) {
+    const noted = await (0, work_door_journal_service_js_1.noteWorkDoor)(passage.tx, passage.domain, { kind, door: reading.door.name, subject: reading.subject }, passage.user);
+    return { go: 'run', noted: noted.id, because: kind };
+}
+//# sourceMappingURL=pass-work-door.js.map

package/dist-server/service/work-door/pass-work-door.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pass-work-door.js","sourceRoot":"","sources":["../../../server/service/work-door/pass-work-door.ts"],"names":[],"mappings":";;AA6EA,oCAyCC;AAjHD,2EAAmH;AACnH,6DAAoD;AACpD,iFAA6D;AAC7D,2EAAiE;AAyDjE,qFAAqF;AACrF,SAAS,qBAAqB,CAAC,EAAoC;IACjE,IAAK,EAA0D,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC;QAClG,OAAM;IACR,CAAC;IAED,MAAM,IAAI,KAAK,CACb,qEAAqE;QACnE,wGAAwG,CAC3G,CAAA;AACH,CAAC;AAEM,KAAK,UAAU,YAAY,CAChC,OAAwB,EACxB,OAAwB;IAExB,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAEjC,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAA;IAExB,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,kBAAkB,IAAI,CAAC,IAAI,yEAAyE;YAClG,gGAAgG,CACnG,CAAA;IACH,CAAC;IAED,6FAA6F;IAC7F,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,MAAM,GAAG,CAAC,kCAAa,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;IAC9D,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,IAAA,6CAAiB,EACtC,OAAO,CAAC,QAAQ,EAAE,YAAuD,EACzE,OAAO,CAAC,KAAK,CACd,CAAA;IAED,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;IAClC,CAAC;IAED,MAAM,UAAU,GACd,IAAI,CAAC,UAAU,KAAK,gBAAgB;QAClC,CAAC,CAAC,OAAO,CAAC,qBAAqB;YAC7B,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,KAAK;QACT,CAAC,CAAC,IAAI,CAAC,UAAU,CAAA;IAErB,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAA,+CAAmB,EAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAA;IACzE,CAAC;IAED,OAAO,MAAM,GAAG,CAAC,kCAAa,CAAC,cAAc,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;AAClE,CAAC;AAED,KAAK,UAAU,GAAG,CAChB,IAA6D,EAC7D,OAAwB,EACxB,OAAwB;IAExB,MAAM,KAAK,GAAG,MAAM,IAAA,2CAAY,EAC9B,OAAO,CAAC,EAAE,EACV,OAAO,CAAC,MAAM,EACd,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,EAC3D,OAAO,CAAC,IAAI,CACb,CAAA;IAED,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AACtD,CAAC","sourcesContent":["import { EntityManager } from 'typeorm'\n\nimport { Domain, Refusal } from '@things-factory/shell'\nimport { User } from '@things-factory/auth-base'\n\nimport { judgeApprovalLine, type ApprovalLineStanding, type ApprovalSeatReader } from './approval-line-standing.js'\nimport { WorkDoorEvent } from './work-door-event.js'\nimport { noteWorkDoor } from './work-door-journal-service.js'\nimport { approvalLineRefusal } from './approval-line-standing.js'\nimport type { WorkDoorDeclaration } from './work-door-declaration.js'\n\n/**\n * **One place decides, and the same place writes it down** (ADR-0077 decision 1).\n *\n * ═══════════════════════════════════════════════════════════════════════════\n * ── Why judgement and record are one call ─────────────────────────────────\n * Until now each application door read the approval line itself and decided what to do, which is why\n * eight of operato-plant's doors run with no line and none of them leaves a trace: the place that\n * knew a step had been skipped was not the place that wrote anything down, and there were eight of\n * them. Joined here, a door cannot take the `run` branch without the line being written - there is\n * no branch to take that skips it.\n *\n * ── The transaction is not a convenience ──────────────────────────────────\n * `tx` is the caller's **open** transaction, not a manager. The line and the work it describes have\n * to commit together: the line first and the work failing leaves a log that says something happened\n * that did not, and the reverse leaves the silent pass this log exists to end. A plain manager\n * commits each statement where it stands, so passing one is the same bug the outbox sequence has\n * one layer down - and there it burned 200 numbers before anyone noticed.\n *\n * ── `as-established` asks the door, it does not guess ─────────────────────\n * A door whose branch turns on the row's own history (a non-working period withdrawn: declared\n * through approval, withdrawn through approval) answers `establishedByApproval` itself. This\n * function reads that one flag. Putting the judgement here would mean the worklist knew what a\n * non-working period is.\n * ═══════════════════════════════════════════════════════════════════════════\n */\nexport interface WorkDoorReading {\n  door: WorkDoorDeclaration\n  /** The activity as installed in this domain, if it is installed at all. */\n  activity?: { id?: string; approvalLine?: unknown[] } | null\n  /** What this is about, as the application names it. Two strings; nothing is read inside them. */\n  subject: { kind: string; id: string }\n  /** `as-established` doors only: did the row this is about come about through approval? */\n  establishedByApproval?: boolean\n  /** True when this domain has declared it does not use this door. */\n  notUsed?: boolean\n}\n\nexport interface WorkDoorPassage {\n  /** The caller's open transaction - the work and the log line commit together. */\n  tx: EntityManager\n  domain: Domain\n  user?: User\n  /** Reads whether a seat in the line resolves to a person. */\n  seats: ApprovalSeatReader\n}\n\nexport type WorkDoorVerdict =\n  /** The line stands. The caller raises it for approval; the instance is the record. */\n  | { go: 'raise'; standing: ApprovalLineStanding }\n  /** No approval here. The work happens, and this is the id of the line written about it. */\n  | { go: 'run'; noted: string; because: WorkDoorEvent.RanWithoutLine | WorkDoorEvent.RanNotUsed }\n  /** The caller is refused, in words that say what to go and fix. */\n  | { go: 'refuse'; refusal: Refusal }\n\n/** A manager that is not in a transaction commits each statement where it stands. */\nfunction assertOpenTransaction(tx: EntityManager | undefined | null): void {\n  if ((tx as { queryRunner?: { isTransactionActive?: boolean } })?.queryRunner?.isTransactionActive) {\n    return\n  }\n\n  throw new Error(\n    'passWorkDoor: must run inside the transaction that does the work - ' +\n      'a plain manager commits the log line on its own, and then the log says something happened that did not'\n  )\n}\n\nexport async function passWorkDoor(\n  reading: WorkDoorReading,\n  passage: WorkDoorPassage\n): Promise<WorkDoorVerdict> {\n  assertOpenTransaction(passage.tx)\n\n  const { door } = reading\n\n  if (door.kind === 'assignment') {\n    throw new Error(\n      `passWorkDoor: \"${door.name}\" is an assignment door, and an assignment door has no approval line - ` +\n        'what it waits for is a role bound to it, which is a different question with a different answer'\n    )\n  }\n\n  /* Declared unused: the work happens, and the line says it was that and not an empty line. */\n  if (reading.notUsed) {\n    return await ran(WorkDoorEvent.RanNotUsed, reading, passage)\n  }\n\n  const standing = await judgeApprovalLine(\n    reading.activity?.approvalLine as Parameters<typeof judgeApprovalLine>[0],\n    passage.seats\n  )\n\n  if (!standing.refusal) {\n    return { go: 'raise', standing }\n  }\n\n  const whenNoLine =\n    door.whenNoLine === 'as-established'\n      ? reading.establishedByApproval\n        ? 'refuse'\n        : 'run'\n      : door.whenNoLine\n\n  if (whenNoLine === 'refuse') {\n    return { go: 'refuse', refusal: approvalLineRefusal(standing.refusal) }\n  }\n\n  return await ran(WorkDoorEvent.RanWithoutLine, reading, passage)\n}\n\nasync function ran(\n  kind: WorkDoorEvent.RanWithoutLine | WorkDoorEvent.RanNotUsed,\n  reading: WorkDoorReading,\n  passage: WorkDoorPassage\n): Promise<WorkDoorVerdict> {\n  const noted = await noteWorkDoor(\n    passage.tx,\n    passage.domain,\n    { kind, door: reading.door.name, subject: reading.subject },\n    passage.user\n  )\n\n  return { go: 'run', noted: noted.id, because: kind }\n}\n"]}

package/dist-server/service/work-door/work-door-declaration.d.ts

@@ -0,0 +1,114 @@
+/**
+ * **What an application declares about its own work doors** (ADR-0069 decision 3, ADR-0077).
+ *
+ * ═══════════════════════════════════════════════════════════════════════════
+ * ── Who says what ─────────────────────────────────────────────────────────
+ * The form is installed by the product at boot, and the plant fills in who approves it. Filling it
+ * in is the declaration that this factory uses that step. So two facts have two owners:
+ *
+ * ```
+ * the list of doors, and what each one is    the application - it declares them here
+ * whether a door stands in this domain       the worklist - it reads the activity and its line
+ * ```
+ *
+ * An application registers its list; the screens and the judgement live here. Without that split the
+ * worklist would have to know operato-plant's activities, and every application would carry its own
+ * copy of the same screen (operato-warehouse asked for it second, which is what moved this).
+ *
+ * ── Registration happens at module import ─────────────────────────────────
+ * Not on a bootstrap hook. A hook runs after the schema is built, which is too late for anything the
+ * schema or a boot-time install reads - `declareAxes` in auth-base carries the same warning.
+ *
+ * ── Labels travel as keys, never as words ─────────────────────────────────
+ * `labelKey` names a translation in the declaring module's own namespace. A word here would put one
+ * product's vocabulary ("plant", "factory floor") on every other product's screen.
+ * ═══════════════════════════════════════════════════════════════════════════
+ */
+/**
+ * What happens when the approval line is empty. **This records what each door already does** - it is
+ * not a new policy (ADR-0077 decision 1).
+ *
+ * - `run` - the work happens and the approval step is skipped. The worklist writes a line saying so;
+ *   until that record existed there was no way to tell it from a factory that approved it.
+ * - `refuse` - the caller is refused and told why the line does not stand.
+ * - `as-established` - the branch depends on **the row's own history**: a period declared through
+ *   approval is withdrawn through approval, and one that stood without approval is simply removed.
+ *   Only a door whose branch turns on the row may use this, and both branches are tested. The
+ *   judgement stays with the door; the worklist asks it which way this row goes.
+ */
+export type WhenNoLine = 'refuse' | 'run' | 'as-established';
+/**
+ * Why a door refuses rather than running. Two doors that both refuse can refuse for different
+ * reasons, and an administrator reads the reason to know whether filling the line is the fix.
+ *
+ * - `irreversible` - what the door does cannot be taken back (`mutation-reversibility`).
+ * - `approval-is-the-act` - the door's whole work **is** the approval. Letting it through with no
+ *   line would put an unsigned controlled document on the floor.
+ * - `lowers-a-control` - the door lowers a control that stands: turning document control off, or
+ *   moving a maintenance due date. Such a door refuses whatever its reversibility says, because the
+ *   time that passed under the lowered control does not come back.
+ */
+export type WhenNoLineBecause = 'irreversible' | 'approval-is-the-act' | 'lowers-a-control';
+interface DoorBase {
+    /** The form name - the same key the callback is found by. Labels change; this does not. */
+    name: string;
+    /** A translation key in the declaring module's namespace. Never a word. */
+    labelKey: string;
+    /**
+     * This door borrows another door's approval line. Written once, in one place: two doors carrying
+     * the same line as a value drift, and then turning a control on and off are approved by different
+     * people (ADR-0047 ⑨).
+     */
+    lineFollows?: string;
+}
+type ApprovalDoor = DoorBase & {
+    kind: 'approval';
+} & ({
+    whenNoLine: 'run';
+    because?: never;
+} | {
+    whenNoLine: 'refuse' | 'as-established';
+    because: WhenNoLineBecause;
+});
+/**
+ * `whenNoLine?: never` is the point of this type: an assignment door has no approval line, so the
+ * field cannot be written here at all. Left optional it would be filled in one day with a value that
+ * reads true and means nothing.
+ */
+type AssignmentDoor = DoorBase & {
+    kind: 'assignment';
+    whenNoLine?: never;
+    because?: never;
+};
+export type WorkDoorDeclaration = ApprovalDoor | AssignmentDoor;
+export interface WorkDoorRegistration {
+    /** The declaring module, as its package's short name. It groups the screen and names the source. */
+    module: string;
+    doors: readonly WorkDoorDeclaration[];
+    /**
+     * The role seats this module offers, by name.
+     *
+     * An approval line points at roles, so a domain with none of them cannot build one - and today
+     * that is found out on the form screen, too late. The door screen counts how many of these stand
+     * here and says what to do first. A domain's own roles are not counted: this number answers "of
+     * what the product offered", and a line built from other roles works just as well.
+     */
+    seats?: readonly string[];
+}
+/**
+ * An application declares its doors. Called at module import time, once per module.
+ *
+ * Re-registering the same module replaces it rather than appending: a module imported twice under a
+ * watch rebuild would otherwise show every door twice, and a screen that double-counts the doors
+ * that need attention is one nobody trusts.
+ */
+export declare function registerWorkDoors(registration: WorkDoorRegistration): void;
+/** Every registration in this installation, in registration order. */
+export declare function registeredWorkDoors(): WorkDoorRegistration[];
+/** Every declared door, flattened, in registration order. */
+export declare function declaredDoors(): WorkDoorDeclaration[];
+/** Every role seat the declaring modules offer, by name, without repeats. */
+export declare function offeredSeatNames(): string[];
+/** One door by form name, whichever module declared it. */
+export declare function declaredDoor(name: string): WorkDoorDeclaration | undefined;
+export {};

package/dist-server/service/work-door/work-door-declaration.js

@@ -0,0 +1,67 @@
+"use strict";
+/**
+ * **What an application declares about its own work doors** (ADR-0069 decision 3, ADR-0077).
+ *
+ * ═══════════════════════════════════════════════════════════════════════════
+ * ── Who says what ─────────────────────────────────────────────────────────
+ * The form is installed by the product at boot, and the plant fills in who approves it. Filling it
+ * in is the declaration that this factory uses that step. So two facts have two owners:
+ *
+ * ```
+ * the list of doors, and what each one is    the application - it declares them here
+ * whether a door stands in this domain       the worklist - it reads the activity and its line
+ * ```
+ *
+ * An application registers its list; the screens and the judgement live here. Without that split the
+ * worklist would have to know operato-plant's activities, and every application would carry its own
+ * copy of the same screen (operato-warehouse asked for it second, which is what moved this).
+ *
+ * ── Registration happens at module import ─────────────────────────────────
+ * Not on a bootstrap hook. A hook runs after the schema is built, which is too late for anything the
+ * schema or a boot-time install reads - `declareAxes` in auth-base carries the same warning.
+ *
+ * ── Labels travel as keys, never as words ─────────────────────────────────
+ * `labelKey` names a translation in the declaring module's own namespace. A word here would put one
+ * product's vocabulary ("plant", "factory floor") on every other product's screen.
+ * ═══════════════════════════════════════════════════════════════════════════
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerWorkDoors = registerWorkDoors;
+exports.registeredWorkDoors = registeredWorkDoors;
+exports.declaredDoors = declaredDoors;
+exports.offeredSeatNames = offeredSeatNames;
+exports.declaredDoor = declaredDoor;
+const registered = new Map();
+/**
+ * An application declares its doors. Called at module import time, once per module.
+ *
+ * Re-registering the same module replaces it rather than appending: a module imported twice under a
+ * watch rebuild would otherwise show every door twice, and a screen that double-counts the doors
+ * that need attention is one nobody trusts.
+ */
+function registerWorkDoors(registration) {
+    registered.set(registration.module, registration);
+}
+/** Every registration in this installation, in registration order. */
+function registeredWorkDoors() {
+    return [...registered.values()];
+}
+/** Every declared door, flattened, in registration order. */
+function declaredDoors() {
+    return [...registered.values()].flatMap(one => [...one.doors]);
+}
+/** Every role seat the declaring modules offer, by name, without repeats. */
+function offeredSeatNames() {
+    return [...new Set([...registered.values()].flatMap(one => [...(one.seats ?? [])]))];
+}
+/** One door by form name, whichever module declared it. */
+function declaredDoor(name) {
+    for (const registration of registered.values()) {
+        const found = registration.doors.find(door => door.name === name);
+        if (found) {
+            return found;
+        }
+    }
+    return undefined;
+}
+//# sourceMappingURL=work-door-declaration.js.map

package/dist-server/service/work-door/work-door-declaration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"work-door-declaration.js","sourceRoot":"","sources":["../../../server/service/work-door/work-door-declaration.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;;AAgFH,8CAEC;AAGD,kDAEC;AAGD,sCAEC;AAGD,4CAEC;AAGD,oCAUC;AAvCD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAgC,CAAA;AAE1D;;;;;;GAMG;AACH,SAAgB,iBAAiB,CAAC,YAAkC;IAClE,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;AACnD,CAAC;AAED,sEAAsE;AACtE,SAAgB,mBAAmB;IACjC,OAAO,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;AACjC,CAAC;AAED,6DAA6D;AAC7D,SAAgB,aAAa;IAC3B,OAAO,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;AAChE,CAAC;AAED,6EAA6E;AAC7E,SAAgB,gBAAgB;IAC9B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AACtF,CAAC;AAED,2DAA2D;AAC3D,SAAgB,YAAY,CAAC,IAAY;IACvC,KAAK,MAAM,YAAY,IAAI,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;QAEjE,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC","sourcesContent":["/**\n * **What an application declares about its own work doors** (ADR-0069 decision 3, ADR-0077).\n *\n * ═══════════════════════════════════════════════════════════════════════════\n * ── Who says what ─────────────────────────────────────────────────────────\n * The form is installed by the product at boot, and the plant fills in who approves it. Filling it\n * in is the declaration that this factory uses that step. So two facts have two owners:\n *\n * ```\n * the list of doors, and what each one is    the application - it declares them here\n * whether a door stands in this domain       the worklist - it reads the activity and its line\n * ```\n *\n * An application registers its list; the screens and the judgement live here. Without that split the\n * worklist would have to know operato-plant's activities, and every application would carry its own\n * copy of the same screen (operato-warehouse asked for it second, which is what moved this).\n *\n * ── Registration happens at module import ─────────────────────────────────\n * Not on a bootstrap hook. A hook runs after the schema is built, which is too late for anything the\n * schema or a boot-time install reads - `declareAxes` in auth-base carries the same warning.\n *\n * ── Labels travel as keys, never as words ─────────────────────────────────\n * `labelKey` names a translation in the declaring module's own namespace. A word here would put one\n * product's vocabulary (\"plant\", \"factory floor\") on every other product's screen.\n * ═══════════════════════════════════════════════════════════════════════════\n */\n\n/**\n * What happens when the approval line is empty. **This records what each door already does** - it is\n * not a new policy (ADR-0077 decision 1).\n *\n * - `run` - the work happens and the approval step is skipped. The worklist writes a line saying so;\n *   until that record existed there was no way to tell it from a factory that approved it.\n * - `refuse` - the caller is refused and told why the line does not stand.\n * - `as-established` - the branch depends on **the row's own history**: a period declared through\n *   approval is withdrawn through approval, and one that stood without approval is simply removed.\n *   Only a door whose branch turns on the row may use this, and both branches are tested. The\n *   judgement stays with the door; the worklist asks it which way this row goes.\n */\nexport type WhenNoLine = 'refuse' | 'run' | 'as-established'\n\n/**\n * Why a door refuses rather than running. Two doors that both refuse can refuse for different\n * reasons, and an administrator reads the reason to know whether filling the line is the fix.\n *\n * - `irreversible` - what the door does cannot be taken back (`mutation-reversibility`).\n * - `approval-is-the-act` - the door's whole work **is** the approval. Letting it through with no\n *   line would put an unsigned controlled document on the floor.\n * - `lowers-a-control` - the door lowers a control that stands: turning document control off, or\n *   moving a maintenance due date. Such a door refuses whatever its reversibility says, because the\n *   time that passed under the lowered control does not come back.\n */\nexport type WhenNoLineBecause = 'irreversible' | 'approval-is-the-act' | 'lowers-a-control'\n\ninterface DoorBase {\n  /** The form name - the same key the callback is found by. Labels change; this does not. */\n  name: string\n  /** A translation key in the declaring module's namespace. Never a word. */\n  labelKey: string\n  /**\n   * This door borrows another door's approval line. Written once, in one place: two doors carrying\n   * the same line as a value drift, and then turning a control on and off are approved by different\n   * people (ADR-0047 ⑨).\n   */\n  lineFollows?: string\n}\n\ntype ApprovalDoor = DoorBase & { kind: 'approval' } & (\n    | { whenNoLine: 'run'; because?: never }\n    | { whenNoLine: 'refuse' | 'as-established'; because: WhenNoLineBecause }\n  )\n\n/**\n * `whenNoLine?: never` is the point of this type: an assignment door has no approval line, so the\n * field cannot be written here at all. Left optional it would be filled in one day with a value that\n * reads true and means nothing.\n */\ntype AssignmentDoor = DoorBase & { kind: 'assignment'; whenNoLine?: never; because?: never }\n\nexport type WorkDoorDeclaration = ApprovalDoor | AssignmentDoor\n\nexport interface WorkDoorRegistration {\n  /** The declaring module, as its package's short name. It groups the screen and names the source. */\n  module: string\n  doors: readonly WorkDoorDeclaration[]\n  /**\n   * The role seats this module offers, by name.\n   *\n   * An approval line points at roles, so a domain with none of them cannot build one - and today\n   * that is found out on the form screen, too late. The door screen counts how many of these stand\n   * here and says what to do first. A domain's own roles are not counted: this number answers \"of\n   * what the product offered\", and a line built from other roles works just as well.\n   */\n  seats?: readonly string[]\n}\n\nconst registered = new Map<string, WorkDoorRegistration>()\n\n/**\n * An application declares its doors. Called at module import time, once per module.\n *\n * Re-registering the same module replaces it rather than appending: a module imported twice under a\n * watch rebuild would otherwise show every door twice, and a screen that double-counts the doors\n * that need attention is one nobody trusts.\n */\nexport function registerWorkDoors(registration: WorkDoorRegistration): void {\n  registered.set(registration.module, registration)\n}\n\n/** Every registration in this installation, in registration order. */\nexport function registeredWorkDoors(): WorkDoorRegistration[] {\n  return [...registered.values()]\n}\n\n/** Every declared door, flattened, in registration order. */\nexport function declaredDoors(): WorkDoorDeclaration[] {\n  return [...registered.values()].flatMap(one => [...one.doors])\n}\n\n/** Every role seat the declaring modules offer, by name, without repeats. */\nexport function offeredSeatNames(): string[] {\n  return [...new Set([...registered.values()].flatMap(one => [...(one.seats ?? [])]))]\n}\n\n/** One door by form name, whichever module declared it. */\nexport function declaredDoor(name: string): WorkDoorDeclaration | undefined {\n  for (const registration of registered.values()) {\n    const found = registration.doors.find(door => door.name === name)\n\n    if (found) {\n      return found\n    }\n  }\n\n  return undefined\n}\n"]}

package/dist-server/service/work-door/work-door-event.d.ts

@@ -0,0 +1,20 @@
+/**
+ * What happened at a work door — **the enum on its own, with nothing to load.**
+ *
+ * The entity that stores it carries TypeORM decorators, and importing those into a unit test pulls
+ * in the whole storage layer (the repository's jest config says as much: pure logic goes in its own
+ * module and is tested there). So the three names live here, and the entity and the writing side
+ * both read them from this file.
+ *
+ * The three are different events, not three reasons for one event. Read as reasons, the next person
+ * adds a fourth string and nothing tells them the row now means something else - which is why
+ * `subject` and `detail` follow the kind rather than sitting optional beside it.
+ */
+export declare enum WorkDoorEvent {
+    /** The approval line was empty and this door runs anyway - the work happened, unapproved. */
+    RanWithoutLine = "ran-without-line",
+    /** The domain declared it does not use this door, so the work happened without it. */
+    RanNotUsed = "ran-not-used",
+    /** A "we do not use this door" declaration was withdrawn; what it said is kept with the line. */
+    NotUsedWithdrawn = "not-used-withdrawn"
+}

package/dist-server/service/work-door/work-door-event.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkDoorEvent = void 0;
+/**
+ * What happened at a work door — **the enum on its own, with nothing to load.**
+ *
+ * The entity that stores it carries TypeORM decorators, and importing those into a unit test pulls
+ * in the whole storage layer (the repository's jest config says as much: pure logic goes in its own
+ * module and is tested there). So the three names live here, and the entity and the writing side
+ * both read them from this file.
+ *
+ * The three are different events, not three reasons for one event. Read as reasons, the next person
+ * adds a fourth string and nothing tells them the row now means something else - which is why
+ * `subject` and `detail` follow the kind rather than sitting optional beside it.
+ */
+var WorkDoorEvent;
+(function (WorkDoorEvent) {
+    /** The approval line was empty and this door runs anyway - the work happened, unapproved. */
+    WorkDoorEvent["RanWithoutLine"] = "ran-without-line";
+    /** The domain declared it does not use this door, so the work happened without it. */
+    WorkDoorEvent["RanNotUsed"] = "ran-not-used";
+    /** A "we do not use this door" declaration was withdrawn; what it said is kept with the line. */
+    WorkDoorEvent["NotUsedWithdrawn"] = "not-used-withdrawn";
+})(WorkDoorEvent || (exports.WorkDoorEvent = WorkDoorEvent = {}));
+//# sourceMappingURL=work-door-event.js.map

package/dist-server/service/work-door/work-door-event.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"work-door-event.js","sourceRoot":"","sources":["../../../server/service/work-door/work-door-event.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;GAWG;AACH,IAAY,aAOX;AAPD,WAAY,aAAa;IACvB,6FAA6F;IAC7F,oDAAmC,CAAA;IACnC,sFAAsF;IACtF,4CAA2B,CAAA;IAC3B,iGAAiG;IACjG,wDAAuC,CAAA;AACzC,CAAC,EAPW,aAAa,6BAAb,aAAa,QAOxB","sourcesContent":["/**\n * What happened at a work door — **the enum on its own, with nothing to load.**\n *\n * The entity that stores it carries TypeORM decorators, and importing those into a unit test pulls\n * in the whole storage layer (the repository's jest config says as much: pure logic goes in its own\n * module and is tested there). So the three names live here, and the entity and the writing side\n * both read them from this file.\n *\n * The three are different events, not three reasons for one event. Read as reasons, the next person\n * adds a fourth string and nothing tells them the row now means something else - which is why\n * `subject` and `detail` follow the kind rather than sitting optional beside it.\n */\nexport enum WorkDoorEvent {\n  /** The approval line was empty and this door runs anyway - the work happened, unapproved. */\n  RanWithoutLine = 'ran-without-line',\n  /** The domain declared it does not use this door, so the work happened without it. */\n  RanNotUsed = 'ran-not-used',\n  /** A \"we do not use this door\" declaration was withdrawn; what it said is kept with the line. */\n  NotUsedWithdrawn = 'not-used-withdrawn'\n}\n"]}

package/dist-server/service/work-door/work-door-journal-service.d.ts

@@ -0,0 +1,47 @@
+import { EntityManager } from 'typeorm';
+import { Domain } from '@things-factory/shell';
+import { User } from '@things-factory/auth-base';
+import { WorkDoorEvent } from './work-door-event.js';
+import type { WorkDoorJournal } from './work-door-journal.js';
+/**
+ * Writing a line in a work door's log.
+ *
+ * ── The union is the point ────────────────────────────────────────────────
+ * `subject` belongs to something that happened to a row; `detail` belongs to a withdrawn
+ * declaration. An entry type with both optional would compile with either missing, and the first
+ * caller to forget `subject` would write a line saying that something ran, about nothing. So each
+ * kind names exactly what it carries, and `?: never` closes the other field.
+ */
+export type WorkDoorEntry = {
+    kind: WorkDoorEvent.RanWithoutLine | WorkDoorEvent.RanNotUsed;
+    door: string;
+    /** What it was about, as the application names it. The worklist never reads inside these. */
+    subject: {
+        kind: string;
+        id: string;
+    };
+    detail?: never;
+} | {
+    kind: WorkDoorEvent.NotUsedWithdrawn;
+    door: string;
+    subject?: never;
+    /** What the withdrawn declaration said - who declared it, when, and why. */
+    detail: Record<string, unknown>;
+};
+/**
+ * Write one line.
+ *
+ * **`manager` has to be the caller's open transaction.** The line and the work it describes commit
+ * together or not at all: a line that commits first and work that then fails leaves the log saying
+ * something happened that did not, and the other order leaves the work with no trace - which is the
+ * hole this log exists to close. `passWorkDoor` takes the transaction for the same reason, and the
+ * outbox's sequence carries the same rule one layer down.
+ */
+export declare function noteWorkDoor(manager: EntityManager, domain: Domain, entry: WorkDoorEntry, who?: User): Promise<WorkDoorJournal>;
+/**
+ * What the last withdrawn declaration for this door said, if there is one.
+ *
+ * This is the read that makes the log worth writing: somebody declaring "we do not use this door"
+ * again wants to see what was said the previous time.
+ */
+export declare function lastWithdrawnDeclaration(manager: EntityManager, domain: Domain, door: string): Promise<Record<string, unknown> | undefined>;

package/dist-server/service/work-door/work-door-journal-service.js

@@ -0,0 +1,75 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noteWorkDoor = noteWorkDoor;
+exports.lastWithdrawnDeclaration = lastWithdrawnDeclaration;
+const work_door_event_js_1 = require("./work-door-event.js");
+/**
+ * Write one line.
+ *
+ * **`manager` has to be the caller's open transaction.** The line and the work it describes commit
+ * together or not at all: a line that commits first and work that then fails leaves the log saying
+ * something happened that did not, and the other order leaves the work with no trace - which is the
+ * hole this log exists to close. `passWorkDoor` takes the transaction for the same reason, and the
+ * outbox's sequence carries the same rule one layer down.
+ */
+async function noteWorkDoor(manager, domain, entry, who) {
+    /* 엔티티는 여기서 늦게 가져온다 — 이 모듈을 부르는 순수 시험이 저장소 계층을 안 들이게. */
+    const { WorkDoorJournal } = await Promise.resolve().then(() => __importStar(require('./work-door-journal.js')));
+    return await manager.getRepository(WorkDoorJournal).save({
+        domain,
+        kind: entry.kind,
+        door: entry.door,
+        subjectKind: entry.subject?.kind,
+        subjectId: entry.subject?.id,
+        detail: entry.detail,
+        who
+    });
+}
+/**
+ * What the last withdrawn declaration for this door said, if there is one.
+ *
+ * This is the read that makes the log worth writing: somebody declaring "we do not use this door"
+ * again wants to see what was said the previous time.
+ */
+async function lastWithdrawnDeclaration(manager, domain, door) {
+    const { WorkDoorJournal } = await Promise.resolve().then(() => __importStar(require('./work-door-journal.js')));
+    const found = await manager.getRepository(WorkDoorJournal).findOne({
+        where: { domain: { id: domain.id }, door, kind: work_door_event_js_1.WorkDoorEvent.NotUsedWithdrawn },
+        order: { createdAt: 'DESC' }
+    });
+    return found?.detail;
+}
+//# sourceMappingURL=work-door-journal-service.js.map

package/dist-server/service/work-door/work-door-journal-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"work-door-journal-service.js","sourceRoot":"","sources":["../../../server/service/work-door/work-door-journal-service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0CA,oCAkBC;AAQD,4DAaC;AA5ED,6DAAoD;AA4BpD;;;;;;;;GAQG;AACI,KAAK,UAAU,YAAY,CAChC,OAAsB,EACtB,MAAc,EACd,KAAoB,EACpB,GAAU;IAEV,wDAAwD;IACxD,MAAM,EAAE,eAAe,EAAE,GAAG,wDAAa,wBAAwB,GAAC,CAAA;IAElE,OAAO,MAAM,OAAO,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC;QACvD,MAAM;QACN,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI;QAChC,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE;QAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG;KACJ,CAAC,CAAA;AACJ,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,wBAAwB,CAC5C,OAAsB,EACtB,MAAc,EACd,IAAY;IAEZ,MAAM,EAAE,eAAe,EAAE,GAAG,wDAAa,wBAAwB,GAAC,CAAA;IAElE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC;QACjE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,kCAAa,CAAC,gBAAgB,EAAE;QAChF,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;KAC7B,CAAC,CAAA;IAEF,OAAO,KAAK,EAAE,MAAM,CAAA;AACtB,CAAC","sourcesContent":["import { EntityManager } from 'typeorm'\n\nimport { Domain } from '@things-factory/shell'\nimport { User } from '@things-factory/auth-base'\n\nimport { WorkDoorEvent } from './work-door-event.js'\nimport type { WorkDoorJournal } from './work-door-journal.js'\n\n/**\n * Writing a line in a work door's log.\n *\n * ── The union is the point ────────────────────────────────────────────────\n * `subject` belongs to something that happened to a row; `detail` belongs to a withdrawn\n * declaration. An entry type with both optional would compile with either missing, and the first\n * caller to forget `subject` would write a line saying that something ran, about nothing. So each\n * kind names exactly what it carries, and `?: never` closes the other field.\n */\nexport type WorkDoorEntry =\n  | {\n      kind: WorkDoorEvent.RanWithoutLine | WorkDoorEvent.RanNotUsed\n      door: string\n      /** What it was about, as the application names it. The worklist never reads inside these. */\n      subject: { kind: string; id: string }\n      detail?: never\n    }\n  | {\n      kind: WorkDoorEvent.NotUsedWithdrawn\n      door: string\n      subject?: never\n      /** What the withdrawn declaration said - who declared it, when, and why. */\n      detail: Record<string, unknown>\n    }\n\n/**\n * Write one line.\n *\n * **`manager` has to be the caller's open transaction.** The line and the work it describes commit\n * together or not at all: a line that commits first and work that then fails leaves the log saying\n * something happened that did not, and the other order leaves the work with no trace - which is the\n * hole this log exists to close. `passWorkDoor` takes the transaction for the same reason, and the\n * outbox's sequence carries the same rule one layer down.\n */\nexport async function noteWorkDoor(\n  manager: EntityManager,\n  domain: Domain,\n  entry: WorkDoorEntry,\n  who?: User\n): Promise<WorkDoorJournal> {\n  /* 엔티티는 여기서 늦게 가져온다 — 이 모듈을 부르는 순수 시험이 저장소 계층을 안 들이게. */\n  const { WorkDoorJournal } = await import('./work-door-journal.js')\n\n  return await manager.getRepository(WorkDoorJournal).save({\n    domain,\n    kind: entry.kind,\n    door: entry.door,\n    subjectKind: entry.subject?.kind,\n    subjectId: entry.subject?.id,\n    detail: entry.detail,\n    who\n  })\n}\n\n/**\n * What the last withdrawn declaration for this door said, if there is one.\n *\n * This is the read that makes the log worth writing: somebody declaring \"we do not use this door\"\n * again wants to see what was said the previous time.\n */\nexport async function lastWithdrawnDeclaration(\n  manager: EntityManager,\n  domain: Domain,\n  door: string\n): Promise<Record<string, unknown> | undefined> {\n  const { WorkDoorJournal } = await import('./work-door-journal.js')\n\n  const found = await manager.getRepository(WorkDoorJournal).findOne({\n    where: { domain: { id: domain.id }, door, kind: WorkDoorEvent.NotUsedWithdrawn },\n    order: { createdAt: 'DESC' }\n  })\n\n  return found?.detail\n}\n"]}

package/dist-server/service/work-door/work-door-journal.d.ts

@@ -0,0 +1,30 @@
+import { Domain } from '@things-factory/shell';
+import { WorkDoorEvent } from './work-door-event.js';
+import { User } from '@things-factory/auth-base';
+export declare class WorkDoorJournal {
+    readonly id: string;
+    domain?: Domain;
+    domainId?: string;
+    kind: WorkDoorEvent;
+    /** The form name, the key the callback is found by - not the label, which changes. */
+    door: string;
+    /**
+     * What it was about, as two strings. **The worklist does not know the application's entities**, so
+     * a lot, a job order and a screen all arrive the same way: a kind the application names and the id
+     * it knows the row by.
+     *
+     * Empty for `not-used-withdrawn`: withdrawing a declaration is about the door itself.
+     */
+    subjectKind?: string;
+    subjectId?: string;
+    /**
+     * Only `not-used-withdrawn` carries this: what the withdrawn declaration said (who declared it,
+     * when, and why they said this factory does not use the door). Deleting the declaration would
+     * otherwise take that with it (ADR-0064 ③), and declaring it again is when somebody wants to read
+     * what was said last time.
+     */
+    detail?: Record<string, unknown>;
+    who?: User;
+    createdAt: Date;
+}
+export { WorkDoorEvent };

package/dist-server/service/work-door/work-door-journal.js

@@ -0,0 +1,94 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkDoorEvent = exports.WorkDoorJournal = void 0;
+const tslib_1 = require("tslib");
+const typeorm_1 = require("typeorm");
+const type_graphql_1 = require("type-graphql");
+const shell_1 = require("@things-factory/shell");
+const work_door_event_js_1 = require("./work-door-event.js");
+Object.defineProperty(exports, "WorkDoorEvent", { enumerable: true, get: function () { return work_door_event_js_1.WorkDoorEvent; } });
+const auth_base_1 = require("@things-factory/auth-base");
+/**
+ * **A work door's log** — what happened at a door when no approval instance was left behind
+ * (ADR-0077 decision 1).
+ *
+ * ═══════════════════════════════════════════════════════════════════════════
+ * ── Why a row is needed at all ────────────────────────────────────────────
+ * A door that was approved leaves an `ActivityInstance`, and the instance is the record. A door
+ * whose approval line is empty leaves **nothing**: the work simply happens. Counted on 2026-09-19,
+ * eight of operato-plant's approval doors run that way, and none of them writes a trace - a
+ * production correction made in a factory with no approval line is stored exactly like one that was
+ * approved, and exactly like one made in a factory that does not use approvals at all. Three
+ * different situations, one appearance.
+ *
+ * That matters where it is read: an auditor asking "who approved this correction" gets silence, and
+ * silence reads as "nobody looked" whether or not anybody was ever supposed to.
+ *
+ * ── Why the kinds are a closed list ───────────────────────────────────────
+ * The three are different events, not three reasons for one event. Reading them as reasons is how a
+ * log turns into a bag: the next person adds a fourth string and nothing tells them the row now
+ * means something else. `subject` and `detail` follow the kind (see `work-door-journal-service`),
+ * which is why the writing side takes a union rather than an object with everything optional.
+ * ═══════════════════════════════════════════════════════════════════════════
+ */
+(0, type_graphql_1.registerEnumType)(work_door_event_js_1.WorkDoorEvent, {
+    name: 'WorkDoorEvent',
+    description: 'what happened at a work door that left no approval instance behind'
+});
+let WorkDoorJournal = class WorkDoorJournal {
+};
+exports.WorkDoorJournal = WorkDoorJournal;
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ primary: true, type: 'uuid', generated: 'uuid' }),
+    (0, type_graphql_1.Field)(type => type_graphql_1.ID),
+    tslib_1.__metadata("design:type", String)
+], WorkDoorJournal.prototype, "id", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.ManyToOne)(type => shell_1.Domain),
+    tslib_1.__metadata("design:type", shell_1.Domain)
+], WorkDoorJournal.prototype, "domain", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.RelationId)((row) => row.domain),
+    tslib_1.__metadata("design:type", String)
+], WorkDoorJournal.prototype, "domainId", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)(),
+    (0, type_graphql_1.Field)(type => work_door_event_js_1.WorkDoorEvent, { description: 'what happened' }),
+    tslib_1.__metadata("design:type", String)
+], WorkDoorJournal.prototype, "kind", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)(),
+    (0, type_graphql_1.Field)({ description: 'the form name of the door this happened at' }),
+    tslib_1.__metadata("design:type", String)
+], WorkDoorJournal.prototype, "door", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ nullable: true }),
+    (0, type_graphql_1.Field)({ nullable: true, description: 'the kind of thing this was about, as the application names it' }),
+    tslib_1.__metadata("design:type", String)
+], WorkDoorJournal.prototype, "subjectKind", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ nullable: true }),
+    (0, type_graphql_1.Field)({ nullable: true, description: 'the id of the thing this was about' }),
+    tslib_1.__metadata("design:type", String)
+], WorkDoorJournal.prototype, "subjectId", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ type: 'simple-json', nullable: true }),
+    (0, type_graphql_1.Field)(type => shell_1.ScalarObject, { nullable: true, description: 'what the withdrawn declaration said' }),
+    tslib_1.__metadata("design:type", Object)
+], WorkDoorJournal.prototype, "detail", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.ManyToOne)(type => auth_base_1.User, { nullable: true }),
+    (0, type_graphql_1.Field)(type => auth_base_1.User, { nullable: true }),
+    tslib_1.__metadata("design:type", auth_base_1.User)
+], WorkDoorJournal.prototype, "who", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.CreateDateColumn)(),
+    (0, type_graphql_1.Field)({ description: 'when this happened' }),
+    tslib_1.__metadata("design:type", Date)
+], WorkDoorJournal.prototype, "createdAt", void 0);
+exports.WorkDoorJournal = WorkDoorJournal = tslib_1.__decorate([
+    (0, typeorm_1.Entity)(),
+    (0, typeorm_1.Index)('ix_work_door_journal_0', (row) => [row.domain, row.door, row.createdAt]),
+    (0, type_graphql_1.ObjectType)({ description: 'What happened at a work door that left no approval instance behind' })
+], WorkDoorJournal);
+//# sourceMappingURL=work-door-journal.js.map

package/dist-server/service/work-door/work-door-journal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"work-door-journal.js","sourceRoot":"","sources":["../../../server/service/work-door/work-door-journal.ts"],"names":[],"mappings":";;;;AAAA,qCAAwF;AACxF,+CAAsE;AAEtE,iDAA4D;AAE5D,6DAAoD;AAyF3C,8FAzFA,kCAAa,OAyFA;AAxFtB,yDAAgD;AAEhD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,IAAA,+BAAgB,EAAC,kCAAa,EAAE;IAC9B,IAAI,EAAE,eAAe;IACrB,WAAW,EAAE,oEAAoE;CAClF,CAAC,CAAA;AAKK,IAAM,eAAe,GAArB,MAAM,eAAe;CAoD3B,CAAA;AApDY,0CAAe;AAGjB;IAFR,IAAA,gBAAM,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IAC1D,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,iBAAE,CAAC;;2CACC;AAGnB;IADC,IAAA,mBAAS,EAAC,IAAI,CAAC,EAAE,CAAC,cAAM,CAAC;sCACjB,cAAM;+CAAA;AAGf;IADC,IAAA,oBAAU,EAAC,CAAC,GAAoB,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC;;iDAChC;AAIjB;IAFC,IAAA,gBAAM,GAAE;IACR,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,kCAAa,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;;6CAC5C;AAKnB;IAFC,IAAA,gBAAM,GAAE;IACR,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,4CAA4C,EAAE,CAAC;;6CACzD;AAWZ;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,+DAA+D,EAAE,CAAC;;oDACpF;AAIpB;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC;;kDAC3D;AAUlB;IAFC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC/C,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,oBAAY,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC;;+CACpE;AAIhC;IAFC,IAAA,mBAAS,EAAC,IAAI,CAAC,EAAE,CAAC,gBAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,gBAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;sCAClC,gBAAI;4CAAA;AAIV;IAFC,IAAA,0BAAgB,GAAE;IAClB,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;sCAClC,IAAI;kDAAA;0BAnDJ,eAAe;IAH3B,IAAA,gBAAM,GAAE;IACR,IAAA,eAAK,EAAC,wBAAwB,EAAE,CAAC,GAAoB,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IAChG,IAAA,yBAAU,EAAC,EAAE,WAAW,EAAE,oEAAoE,EAAE,CAAC;GACrF,eAAe,CAoD3B","sourcesContent":["import { Column, CreateDateColumn, Entity, Index, ManyToOne, RelationId } from 'typeorm'\nimport { Field, ID, ObjectType, registerEnumType } from 'type-graphql'\n\nimport { Domain, ScalarObject } from '@things-factory/shell'\n\nimport { WorkDoorEvent } from './work-door-event.js'\nimport { User } from '@things-factory/auth-base'\n\n/**\n * **A work door's log** — what happened at a door when no approval instance was left behind\n * (ADR-0077 decision 1).\n *\n * ═══════════════════════════════════════════════════════════════════════════\n * ── Why a row is needed at all ────────────────────────────────────────────\n * A door that was approved leaves an `ActivityInstance`, and the instance is the record. A door\n * whose approval line is empty leaves **nothing**: the work simply happens. Counted on 2026-09-19,\n * eight of operato-plant's approval doors run that way, and none of them writes a trace - a\n * production correction made in a factory with no approval line is stored exactly like one that was\n * approved, and exactly like one made in a factory that does not use approvals at all. Three\n * different situations, one appearance.\n *\n * That matters where it is read: an auditor asking \"who approved this correction\" gets silence, and\n * silence reads as \"nobody looked\" whether or not anybody was ever supposed to.\n *\n * ── Why the kinds are a closed list ───────────────────────────────────────\n * The three are different events, not three reasons for one event. Reading them as reasons is how a\n * log turns into a bag: the next person adds a fourth string and nothing tells them the row now\n * means something else. `subject` and `detail` follow the kind (see `work-door-journal-service`),\n * which is why the writing side takes a union rather than an object with everything optional.\n * ═══════════════════════════════════════════════════════════════════════════\n */\n\nregisterEnumType(WorkDoorEvent, {\n  name: 'WorkDoorEvent',\n  description: 'what happened at a work door that left no approval instance behind'\n})\n\n@Entity()\n@Index('ix_work_door_journal_0', (row: WorkDoorJournal) => [row.domain, row.door, row.createdAt])\n@ObjectType({ description: 'What happened at a work door that left no approval instance behind' })\nexport class WorkDoorJournal {\n  @Column({ primary: true, type: 'uuid', generated: 'uuid' })\n  @Field(type => ID)\n  readonly id: string\n\n  @ManyToOne(type => Domain)\n  domain?: Domain\n\n  @RelationId((row: WorkDoorJournal) => row.domain)\n  domainId?: string\n\n  @Column()\n  @Field(type => WorkDoorEvent, { description: 'what happened' })\n  kind: WorkDoorEvent\n\n  /** The form name, the key the callback is found by - not the label, which changes. */\n  @Column()\n  @Field({ description: 'the form name of the door this happened at' })\n  door: string\n\n  /**\n   * What it was about, as two strings. **The worklist does not know the application's entities**, so\n   * a lot, a job order and a screen all arrive the same way: a kind the application names and the id\n   * it knows the row by.\n   *\n   * Empty for `not-used-withdrawn`: withdrawing a declaration is about the door itself.\n   */\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'the kind of thing this was about, as the application names it' })\n  subjectKind?: string\n\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'the id of the thing this was about' })\n  subjectId?: string\n\n  /**\n   * Only `not-used-withdrawn` carries this: what the withdrawn declaration said (who declared it,\n   * when, and why they said this factory does not use the door). Deleting the declaration would\n   * otherwise take that with it (ADR-0064 ③), and declaring it again is when somebody wants to read\n   * what was said last time.\n   */\n  @Column({ type: 'simple-json', nullable: true })\n  @Field(type => ScalarObject, { nullable: true, description: 'what the withdrawn declaration said' })\n  detail?: Record<string, unknown>\n\n  @ManyToOne(type => User, { nullable: true })\n  @Field(type => User, { nullable: true })\n  who?: User\n\n  @CreateDateColumn()\n  @Field({ description: 'when this happened' })\n  createdAt: Date\n}\n\nexport { WorkDoorEvent }\n"]}