@things-factory/worklist 10.1.3 → 10.1.4

package/dist-server/controllers/activity-installation/activity-installation-controller.d.ts

@@ -2,6 +2,7 @@ import { EntityManager } from 'typeorm';
 import { Domain } from '@things-factory/shell';
 import { Activity } from '../../service/activity/activity.js';
 import { InstallableActivity } from '../../service/installable-activity/installable-activity.js';
+import { ActivityReadiness } from '../../service/installable-activity/activity-readiness.js';
 /**
  * 등록된 양식을 **도메인에 실제로 세운다.**
  *
@@ -25,13 +26,47 @@ export declare function installActivity(name: string, domain: Domain, options?:
     manager?: EntityManager;
     user?: any;
 }): Promise<Activity>;
+/**
+ * Work a module has identified as a person's decision and **has not built.**
+ *
+ * Deliberately not an InstallableActivity. A template with no callback can be installed and
+ * issued, and then someone approves a request and nothing happens — on the twin side that means a
+ * person presses approve and no equipment moves. So these live in their own registry: the catalog
+ * reads them, `installActivity` cannot reach them.
+ *
+ * They belong on the screen because the catalog is the plan of record. The question "what is left"
+ * should be answered where people look, not in one person's head.
+ */
+export type IntendedActivity = {
+    /** What the activity's `name` will be once it exists. */
+    key: string;
+    /** What the catalog shows. The activity's own name is usually not a sentence a person reads. */
+    label: string;
+    category?: string;
+    /** What this work is, for the person who will receive it. Draft wording is fine. */
+    guide?: string[];
+    readiness: ActivityReadiness;
+};
 export declare class ActivityInstallations {
     static templates: {
         [name: string]: InstallableActivity;
     };
+    /** Keyed separately from `templates`, so nothing here can be installed by mistake. */
+    static intended: {
+        [key: string]: IntendedActivity;
+    };
     static installActivityTemplate(template: InstallableActivity): void;
+    /**
+     * Declare work that should reach someone's worklist and does not yet.
+     *
+     * A module calls this for each item it has identified. When the real thing is built, delete the
+     * call and register the template instead — the catalog row moves from 예정 to 동작 확인됨 on its
+     * own.
+     */
+    static declareIntendedActivity(intended: IntendedActivity): void;
     static get(name: string): InstallableActivity;
     static list(): InstallableActivity[];
+    static listIntended(): IntendedActivity[];
     /**
      * 액티비티인스턴스의 변화가 발생했을 때, 호출되는 콜백함수
      * @param name 액티비티인스턴스가 속한 액티비티명

package/dist-server/controllers/activity-installation/activity-installation-controller.js

@@ -48,15 +48,38 @@ async function installActivity(name, domain, options = {}) {
 }
 class ActivityInstallations {
     static { this.templates = {}; }
+    /** Keyed separately from `templates`, so nothing here can be installed by mistake. */
+    static { this.intended = {}; }
     static installActivityTemplate(template) {
         ActivityInstallations.templates[template.name] = template;
     }
+    /**
+     * Declare work that should reach someone's worklist and does not yet.
+     *
+     * A module calls this for each item it has identified. When the real thing is built, delete the
+     * call and register the template instead — the catalog row moves from 예정 to 동작 확인됨 on its
+     * own.
+     */
+    static declareIntendedActivity(intended) {
+        if (ActivityInstallations.templates[intended.key]) {
+            /*
+             * Both at once would draw the same work twice and let a reader believe the built one is the
+             * plan. Say so rather than picking a winner.
+             */
+            throw new Error(`declareIntendedActivity: "${intended.key}" is already installed as an activity. ` +
+                'Remove the declaration now that the activity exists.');
+        }
+        ActivityInstallations.intended[intended.key] = intended;
+    }
     static get(name) {
         return ActivityInstallations.templates[name];
     }
     static list() {
         return Object.values(ActivityInstallations.templates);
     }
+    static listIntended() {
+        return Object.values(ActivityInstallations.intended);
+    }
     /**
      * 액티비티인스턴스의 변화가 발생했을 때, 호출되는 콜백함수
      * @param name 액티비티인스턴스가 속한 액티비티명

package/dist-server/controllers/activity-installation/activity-installation-controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"activity-installation-controller.js","sourceRoot":"","sources":["../../../server/controllers/activity-installation/activity-installation-controller.ts"],"names":[],"mappings":";;;AA0BA,0CAgCC;AAxDD,iDAA6D;AAE7D,oEAA6E;AAG7E;;;;;;;;;;;;;;;;;;GAkBG;AACI,KAAK,UAAU,eAAe,CACnC,IAAY,EACZ,MAAc,EACd,UAAmD,EAAE;IAErD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAEhD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd;;WAEG;QACH,MAAM,IAAI,KAAK,CACb,4DAA4D,IAAI,KAAK;YACnE,UAAU,qBAAqB,CAAC,IAAI,EAAE;iBACnC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC;iBACpB,IAAI,CAAC,IAAI,CAAC,EAAE,CAClB,CAAA;IACH,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,OAAO,CAAA;IACjC,MAAM,UAAU,GAAG,IAAA,qBAAa,EAAC,sBAAQ,EAAE,OAAO,CAAC,CAAA;IAEnD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;IAEhF,OAAO,MAAM,UAAU,CAAC,IAAI,CAAC;QAC3B,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;QACnB,GAAI,QAAgB;QACpB,KAAK,EAAE,4BAAc,CAAC,QAAQ;QAC9B,MAAM;QACN,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAE,QAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;QACpD,OAAO,EAAE,IAAI;KACP,CAAC,CAAA;AACX,CAAC;AAED,MAAa,qBAAqB;aACzB,cAAS,GAA4C,EAAE,CAAA;IAE9D,MAAM,CAAC,uBAAuB,CAAC,QAA6B;QAC1D,qBAAqB,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAA;IAC3D,CAAC;IAED,MAAM,CAAC,GAAG,CAAC,IAAY;QACrB,OAAO,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IAC9C,CAAC;IAED,MAAM,CAAC,IAAI;QACT,OAAO,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAA;IACvD,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,gBAAqB,EAAE,eAAsB,EAAE,OAAwB;QACzG,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACjE,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,OAAM;QACR,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,GAAG,mBAAmB,CAAA;QAExC,QAAQ,IAAI,CAAC,MAAM,QAAQ,CAAC,gBAAgB,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,EAAE,OAAO,CAAC,CAAC,CAAA;IACxF,CAAC;;AAhCH,sDAiCC","sourcesContent":["import { EntityManager } from 'typeorm'\n\nimport { Domain, getRepository } from '@things-factory/shell'\n\nimport { Activity, ActivityStatus } from '../../service/activity/activity.js'\nimport { InstallableActivity } from '../../service/installable-activity/installable-activity.js'\n\n/**\n * 등록된 양식을 **도메인에 실제로 세운다.**\n *\n * ── 왜 함수로 내놓나 ───────────────────────────────────────────────────────\n * 앞서는 이 일이 화면 뮤테이션 안에만 있었다. 그래서 양식을 세우는 길이 **사람이 화면에서 누르는 것\n * 하나뿐**이었고, 새로 배포하거나 도메인을 하나 더 만들 때마다 그 클릭을 기억해야 했다. 기억하지\n * 못하면 그 기능이 오류 보고 없이 없다.\n *\n * 앱이 「내 기능이 서려면 이 양식이 있어야 한다」를 아는 경우가 있다. 그런 앱은 기동할 때 스스로\n * 세울 수 있어야 한다. 언제 세울지는 앱이 정하고, 세우는 방법은 여기가 한 벌만 갖는다.\n *\n * ── 있는 것을 덮되 결재선은 건드리지 않는다 ────────────────────────────────\n * 이미 있으면 양식의 선언(모델 · 보는 화면 · 시작 방식)으로 덮는다. 판이 오르면 그 값이 따라와야\n * 하기 때문이다.\n *\n * 그런데 **결재선은 양식의 것이 아니라 그 현장의 것**이다. 누가 결재하는지는 공장이 정한다. 그래서\n * 양식에 결재선 선언이 없으면 이미 있는 결재선이 그대로 남는다 — 판을 올릴 때마다 결재자가 지워지면\n * 그 뒤로 상신이 곧 완료가 된다.\n */\nexport async function installActivity(\n  name: string,\n  domain: Domain,\n  options: { manager?: EntityManager; user?: any } = {}\n): Promise<Activity> {\n  const template = ActivityInstallations.get(name)\n\n  if (!template) {\n    /*\n     * 없는 이름을 세울 수는 없다. 조용히 넘기면 부르는 쪽은 세운 줄 알고, 그 기능은 없는 채로 선다.\n     */\n    throw new Error(\n      `installActivity: there is no installable activity named \"${name}\". ` +\n        `known: ${ActivityInstallations.list()\n          .map(one => one.name)\n          .join(', ')}`\n    )\n  }\n\n  const { manager, user } = options\n  const repository = getRepository(Activity, manager)\n\n  const existing = await repository.findOneBy({ domain: { id: domain.id }, name })\n\n  return await repository.save({\n    ...(existing ?? {}),\n    ...(template as any),\n    state: ActivityStatus.Released,\n    domain,\n    creator: existing ? (existing as any).creator : user,\n    updater: user\n  } as any)\n}\n\nexport class ActivityInstallations {\n  static templates: { [name: string]: InstallableActivity } = {}\n\n  static installActivityTemplate(template: InstallableActivity) {\n    ActivityInstallations.templates[template.name] = template\n  }\n\n  static get(name: string): InstallableActivity {\n    return ActivityInstallations.templates[name]\n  }\n\n  static list(): InstallableActivity[] {\n    return Object.values(ActivityInstallations.templates)\n  }\n\n  /**\n   * 액티비티인스턴스의 변화가 발생했을 때, 호출되는 콜백함수\n   * @param name 액티비티인스턴스가 속한 액티비티명\n   * @param activityInstance 해당 액티비티인스턴스\n   * @param activityThreads 액티비티인스턴스의 변화를 일으킨 원인이 되는 액티비티쓰레드들\n   * @param context 서비스 컨텍스트 : domain, user, translation, ..\n   * @returns\n   */\n  static async callback(name: string, activityInstance: any, activityThreads: any[], context: ResolverContext) {\n    const installableActivity = ActivityInstallations.templates[name]\n    if (!installableActivity) {\n      return\n    }\n\n    const { callback } = installableActivity\n\n    callback && (await callback(activityInstance, { causedBy: activityThreads }, context))\n  }\n}\n"]}
+{"version":3,"file":"activity-installation-controller.js","sourceRoot":"","sources":["../../../server/controllers/activity-installation/activity-installation-controller.ts"],"names":[],"mappings":";;;AA2BA,0CAgCC;AAzDD,iDAA6D;AAE7D,oEAA6E;AAI7E;;;;;;;;;;;;;;;;;;GAkBG;AACI,KAAK,UAAU,eAAe,CACnC,IAAY,EACZ,MAAc,EACd,UAAmD,EAAE;IAErD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAEhD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd;;WAEG;QACH,MAAM,IAAI,KAAK,CACb,4DAA4D,IAAI,KAAK;YACnE,UAAU,qBAAqB,CAAC,IAAI,EAAE;iBACnC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC;iBACpB,IAAI,CAAC,IAAI,CAAC,EAAE,CAClB,CAAA;IACH,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,OAAO,CAAA;IACjC,MAAM,UAAU,GAAG,IAAA,qBAAa,EAAC,sBAAQ,EAAE,OAAO,CAAC,CAAA;IAEnD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;IAEhF,OAAO,MAAM,UAAU,CAAC,IAAI,CAAC;QAC3B,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;QACnB,GAAI,QAAgB;QACpB,KAAK,EAAE,4BAAc,CAAC,QAAQ;QAC9B,MAAM;QACN,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAE,QAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;QACpD,OAAO,EAAE,IAAI;KACP,CAAC,CAAA;AACX,CAAC;AAwBD,MAAa,qBAAqB;aACzB,cAAS,GAA4C,EAAE,CAAA;IAE9D,sFAAsF;aAC/E,aAAQ,GAAwC,EAAE,CAAA;IAEzD,MAAM,CAAC,uBAAuB,CAAC,QAA6B;QAC1D,qBAAqB,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAA;IAC3D,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,uBAAuB,CAAC,QAA0B;QACvD,IAAI,qBAAqB,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAClD;;;eAGG;YACH,MAAM,IAAI,KAAK,CACb,6BAA6B,QAAQ,CAAC,GAAG,yCAAyC;gBAChF,sDAAsD,CACzD,CAAA;QACH,CAAC;QAED,qBAAqB,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAA;IACzD,CAAC;IAED,MAAM,CAAC,GAAG,CAAC,IAAY;QACrB,OAAO,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IAC9C,CAAC;IAED,MAAM,CAAC,IAAI;QACT,OAAO,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAA;IACvD,CAAC;IAED,MAAM,CAAC,YAAY;QACjB,OAAO,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAA;IACtD,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,gBAAqB,EAAE,eAAsB,EAAE,OAAwB;QACzG,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACjE,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,OAAM;QACR,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,GAAG,mBAAmB,CAAA;QAExC,QAAQ,IAAI,CAAC,MAAM,QAAQ,CAAC,gBAAgB,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,EAAE,OAAO,CAAC,CAAC,CAAA;IACxF,CAAC;;AA7DH,sDA8DC","sourcesContent":["import { EntityManager } from 'typeorm'\n\nimport { Domain, getRepository } from '@things-factory/shell'\n\nimport { Activity, ActivityStatus } from '../../service/activity/activity.js'\nimport { InstallableActivity } from '../../service/installable-activity/installable-activity.js'\nimport { ActivityReadiness } from '../../service/installable-activity/activity-readiness.js'\n\n/**\n * 등록된 양식을 **도메인에 실제로 세운다.**\n *\n * ── 왜 함수로 내놓나 ───────────────────────────────────────────────────────\n * 앞서는 이 일이 화면 뮤테이션 안에만 있었다. 그래서 양식을 세우는 길이 **사람이 화면에서 누르는 것\n * 하나뿐**이었고, 새로 배포하거나 도메인을 하나 더 만들 때마다 그 클릭을 기억해야 했다. 기억하지\n * 못하면 그 기능이 오류 보고 없이 없다.\n *\n * 앱이 「내 기능이 서려면 이 양식이 있어야 한다」를 아는 경우가 있다. 그런 앱은 기동할 때 스스로\n * 세울 수 있어야 한다. 언제 세울지는 앱이 정하고, 세우는 방법은 여기가 한 벌만 갖는다.\n *\n * ── 있는 것을 덮되 결재선은 건드리지 않는다 ────────────────────────────────\n * 이미 있으면 양식의 선언(모델 · 보는 화면 · 시작 방식)으로 덮는다. 판이 오르면 그 값이 따라와야\n * 하기 때문이다.\n *\n * 그런데 **결재선은 양식의 것이 아니라 그 현장의 것**이다. 누가 결재하는지는 공장이 정한다. 그래서\n * 양식에 결재선 선언이 없으면 이미 있는 결재선이 그대로 남는다 — 판을 올릴 때마다 결재자가 지워지면\n * 그 뒤로 상신이 곧 완료가 된다.\n */\nexport async function installActivity(\n  name: string,\n  domain: Domain,\n  options: { manager?: EntityManager; user?: any } = {}\n): Promise<Activity> {\n  const template = ActivityInstallations.get(name)\n\n  if (!template) {\n    /*\n     * 없는 이름을 세울 수는 없다. 조용히 넘기면 부르는 쪽은 세운 줄 알고, 그 기능은 없는 채로 선다.\n     */\n    throw new Error(\n      `installActivity: there is no installable activity named \"${name}\". ` +\n        `known: ${ActivityInstallations.list()\n          .map(one => one.name)\n          .join(', ')}`\n    )\n  }\n\n  const { manager, user } = options\n  const repository = getRepository(Activity, manager)\n\n  const existing = await repository.findOneBy({ domain: { id: domain.id }, name })\n\n  return await repository.save({\n    ...(existing ?? {}),\n    ...(template as any),\n    state: ActivityStatus.Released,\n    domain,\n    creator: existing ? (existing as any).creator : user,\n    updater: user\n  } as any)\n}\n\n/**\n * Work a module has identified as a person's decision and **has not built.**\n *\n * Deliberately not an InstallableActivity. A template with no callback can be installed and\n * issued, and then someone approves a request and nothing happens — on the twin side that means a\n * person presses approve and no equipment moves. So these live in their own registry: the catalog\n * reads them, `installActivity` cannot reach them.\n *\n * They belong on the screen because the catalog is the plan of record. The question \"what is left\"\n * should be answered where people look, not in one person's head.\n */\nexport type IntendedActivity = {\n  /** What the activity's `name` will be once it exists. */\n  key: string\n  /** What the catalog shows. The activity's own name is usually not a sentence a person reads. */\n  label: string\n  category?: string\n  /** What this work is, for the person who will receive it. Draft wording is fine. */\n  guide?: string[]\n  readiness: ActivityReadiness\n}\n\nexport class ActivityInstallations {\n  static templates: { [name: string]: InstallableActivity } = {}\n\n  /** Keyed separately from `templates`, so nothing here can be installed by mistake. */\n  static intended: { [key: string]: IntendedActivity } = {}\n\n  static installActivityTemplate(template: InstallableActivity) {\n    ActivityInstallations.templates[template.name] = template\n  }\n\n  /**\n   * Declare work that should reach someone's worklist and does not yet.\n   *\n   * A module calls this for each item it has identified. When the real thing is built, delete the\n   * call and register the template instead — the catalog row moves from 예정 to 동작 확인됨 on its\n   * own.\n   */\n  static declareIntendedActivity(intended: IntendedActivity) {\n    if (ActivityInstallations.templates[intended.key]) {\n      /*\n       * Both at once would draw the same work twice and let a reader believe the built one is the\n       * plan. Say so rather than picking a winner.\n       */\n      throw new Error(\n        `declareIntendedActivity: \"${intended.key}\" is already installed as an activity. ` +\n          'Remove the declaration now that the activity exists.'\n      )\n    }\n\n    ActivityInstallations.intended[intended.key] = intended\n  }\n\n  static get(name: string): InstallableActivity {\n    return ActivityInstallations.templates[name]\n  }\n\n  static list(): InstallableActivity[] {\n    return Object.values(ActivityInstallations.templates)\n  }\n\n  static listIntended(): IntendedActivity[] {\n    return Object.values(ActivityInstallations.intended)\n  }\n\n  /**\n   * 액티비티인스턴스의 변화가 발생했을 때, 호출되는 콜백함수\n   * @param name 액티비티인스턴스가 속한 액티비티명\n   * @param activityInstance 해당 액티비티인스턴스\n   * @param activityThreads 액티비티인스턴스의 변화를 일으킨 원인이 되는 액티비티쓰레드들\n   * @param context 서비스 컨텍스트 : domain, user, translation, ..\n   * @returns\n   */\n  static async callback(name: string, activityInstance: any, activityThreads: any[], context: ResolverContext) {\n    const installableActivity = ActivityInstallations.templates[name]\n    if (!installableActivity) {\n      return\n    }\n\n    const { callback } = installableActivity\n\n    callback && (await callback(activityInstance, { causedBy: activityThreads }, context))\n  }\n}\n"]}

package/dist-server/service/activity/credential-field.d.ts

@@ -0,0 +1,35 @@
+/**
+ * **This framework cannot hold a credential yet, so it refuses to be handed one.**
+ *
+ * An activity's model decides what goes into `ActivityInstance.input`, and that column is
+ * `simple-json` in the clear. There is no way to mark a field as secret, nothing masks it on the
+ * approval screen, the payload copy button copies whatever is there, and the two history entities
+ * keep their own copy of the same value. A token entered today would be readable in four places.
+ *
+ * Nothing declares one right now — every registered activity across both repos was checked and
+ * none has a credential-shaped field. So this is a door being closed while it costs nothing, not
+ * a leak being patched.
+ *
+ * ── Why refuse instead of building the sealing (2026-09-09) ───────────────
+ * The architect lane ruled the shape: a `secret?: boolean` flag on the model item (not a new
+ * ActivityModelItemType — "how is this typed in" and "is this a secret" are different axes, and a
+ * renderer missing the new case would fall through `default` and print the value), sealing at the
+ * value level rather than the column (the column is filtered on, and sealing it whole would kill
+ * that), and the stored shape travelling outward unchanged so there is nothing left to mask.
+ *
+ * Built now, that machinery would harden with no one using it. Built at first real use, all three
+ * parts land together. Until then this refusal keeps the gap from being walked into.
+ *
+ * It has to run at save time, not in a test: models are authored on screen, so no test sees them.
+ */
+/** Does this field name say it holds a credential? */
+export declare function looksLikeCredential(name: string): boolean;
+/**
+ * Refuse a model that declares a credential field, and say what to do about it.
+ *
+ * The message names the field, because a model can carry many and "one of them" would send the
+ * author looking.
+ */
+export declare function assertNoCredentialField(model: {
+    name?: string;
+}[] | undefined, activityName?: string): void;

package/dist-server/service/activity/credential-field.js

@@ -0,0 +1,89 @@
+"use strict";
+/**
+ * **This framework cannot hold a credential yet, so it refuses to be handed one.**
+ *
+ * An activity's model decides what goes into `ActivityInstance.input`, and that column is
+ * `simple-json` in the clear. There is no way to mark a field as secret, nothing masks it on the
+ * approval screen, the payload copy button copies whatever is there, and the two history entities
+ * keep their own copy of the same value. A token entered today would be readable in four places.
+ *
+ * Nothing declares one right now — every registered activity across both repos was checked and
+ * none has a credential-shaped field. So this is a door being closed while it costs nothing, not
+ * a leak being patched.
+ *
+ * ── Why refuse instead of building the sealing (2026-09-09) ───────────────
+ * The architect lane ruled the shape: a `secret?: boolean` flag on the model item (not a new
+ * ActivityModelItemType — "how is this typed in" and "is this a secret" are different axes, and a
+ * renderer missing the new case would fall through `default` and print the value), sealing at the
+ * value level rather than the column (the column is filtered on, and sealing it whole would kill
+ * that), and the stored shape travelling outward unchanged so there is nothing left to mask.
+ *
+ * Built now, that machinery would harden with no one using it. Built at first real use, all three
+ * parts land together. Until then this refusal keeps the gap from being walked into.
+ *
+ * It has to run at save time, not in a test: models are authored on screen, so no test sees them.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.looksLikeCredential = looksLikeCredential;
+exports.assertNoCredentialField = assertNoCredentialField;
+/**
+ * The noun a credential field ends with.
+ *
+ * **The last word, not any word.** `apiToken` is a token; `tokenCount` is a number of them and
+ * `tokenizer` is neither. Matching anywhere in the name refuses all three, and refusing a
+ * legitimate field is not free — the author is blocked with nowhere to go.
+ */
+const CREDENTIAL_NOUNS = ['secret', 'token', 'password', 'passwd', 'credential', 'passphrase'];
+/**
+ * Two words that only mean a credential together.
+ *
+ * `key` alone is far too common (`orderKey`, `groupKey`), so it is only read as a secret when the
+ * word before it says which kind.
+ */
+const CREDENTIAL_PAIRS = ['apikey', 'accesskey', 'privatekey', 'secretkey', 'sshkey', 'signingkey'];
+/**
+ * Split a field name into lowercase words, across camelCase, snake_case, kebab and dots.
+ *
+ * Segments rather than substrings, so the rule can look at where the word sits rather than merely
+ * whether it appears.
+ */
+function wordsOf(name) {
+    return String(name || '')
+        .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
+        .split(/[^a-zA-Z0-9]+/)
+        .map(word => word.toLowerCase())
+        .filter(Boolean);
+}
+/** Does this field name say it holds a credential? */
+function looksLikeCredential(name) {
+    const words = wordsOf(name);
+    if (!words.length) {
+        return false;
+    }
+    const last = words[words.length - 1];
+    if (CREDENTIAL_NOUNS.includes(last)) {
+        return true;
+    }
+    const pair = words.length > 1 ? words[words.length - 2] + last : '';
+    return CREDENTIAL_PAIRS.includes(pair);
+}
+/**
+ * Refuse a model that declares a credential field, and say what to do about it.
+ *
+ * The message names the field, because a model can carry many and "one of them" would send the
+ * author looking.
+ */
+function assertNoCredentialField(model, activityName) {
+    const offenders = (model || []).map(item => item?.name).filter(name => name && looksLikeCredential(name));
+    if (!offenders.length) {
+        return;
+    }
+    throw new Error(`[activity] ${activityName ? `"${activityName}" ` : ''}declares ${offenders.length > 1 ? 'fields' : 'a field'} ` +
+        `that would hold a credential: ${offenders.join(', ')}. ` +
+        'Worklist stores an activity input as plain JSON, shows it on the approval screen, lets it be ' +
+        'copied, and keeps a copy in two history tables — a secret put there is readable in four ' +
+        'places. Sealing secret values is designed but not built (secret flag + value-level sealing + ' +
+        'display, to land together at first real use). Raise it to the architect lane rather than ' +
+        'working around this.');
+}
+//# sourceMappingURL=credential-field.js.map

package/dist-server/service/activity/credential-field.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-field.js","sourceRoot":"","sources":["../../../server/service/activity/credential-field.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;;AAkCH,kDAgBC;AAQD,0DAgBC;AAxED;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,CAAC,CAAA;AAE9F;;;;;GAKG;AACH,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAA;AAEnG;;;;;GAKG;AACH,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;SACtB,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,KAAK,CAAC,eAAe,CAAC;SACtB,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;SAC/B,MAAM,CAAC,OAAO,CAAC,CAAA;AACpB,CAAC;AAED,sDAAsD;AACtD,SAAgB,mBAAmB,CAAC,IAAY;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE3B,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAEpC,IAAI,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;IAEnE,OAAO,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;AACxC,CAAC;AAED;;;;;GAKG;AACH,SAAgB,uBAAuB,CAAC,KAAsC,EAAE,YAAqB;IACnG,MAAM,SAAS,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAA;IAEzG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QACtB,OAAM;IACR,CAAC;IAED,MAAM,IAAI,KAAK,CACb,cAAc,YAAY,CAAC,CAAC,CAAC,IAAI,YAAY,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,GAAG;QAC9G,iCAAiC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QACzD,+FAA+F;QAC/F,0FAA0F;QAC1F,+FAA+F;QAC/F,2FAA2F;QAC3F,sBAAsB,CACzB,CAAA;AACH,CAAC","sourcesContent":["/**\n * **This framework cannot hold a credential yet, so it refuses to be handed one.**\n *\n * An activity's model decides what goes into `ActivityInstance.input`, and that column is\n * `simple-json` in the clear. There is no way to mark a field as secret, nothing masks it on the\n * approval screen, the payload copy button copies whatever is there, and the two history entities\n * keep their own copy of the same value. A token entered today would be readable in four places.\n *\n * Nothing declares one right now — every registered activity across both repos was checked and\n * none has a credential-shaped field. So this is a door being closed while it costs nothing, not\n * a leak being patched.\n *\n * ── Why refuse instead of building the sealing (2026-09-09) ───────────────\n * The architect lane ruled the shape: a `secret?: boolean` flag on the model item (not a new\n * ActivityModelItemType — \"how is this typed in\" and \"is this a secret\" are different axes, and a\n * renderer missing the new case would fall through `default` and print the value), sealing at the\n * value level rather than the column (the column is filtered on, and sealing it whole would kill\n * that), and the stored shape travelling outward unchanged so there is nothing left to mask.\n *\n * Built now, that machinery would harden with no one using it. Built at first real use, all three\n * parts land together. Until then this refusal keeps the gap from being walked into.\n *\n * It has to run at save time, not in a test: models are authored on screen, so no test sees them.\n */\n\n/**\n * The noun a credential field ends with.\n *\n * **The last word, not any word.** `apiToken` is a token; `tokenCount` is a number of them and\n * `tokenizer` is neither. Matching anywhere in the name refuses all three, and refusing a\n * legitimate field is not free — the author is blocked with nowhere to go.\n */\nconst CREDENTIAL_NOUNS = ['secret', 'token', 'password', 'passwd', 'credential', 'passphrase']\n\n/**\n * Two words that only mean a credential together.\n *\n * `key` alone is far too common (`orderKey`, `groupKey`), so it is only read as a secret when the\n * word before it says which kind.\n */\nconst CREDENTIAL_PAIRS = ['apikey', 'accesskey', 'privatekey', 'secretkey', 'sshkey', 'signingkey']\n\n/**\n * Split a field name into lowercase words, across camelCase, snake_case, kebab and dots.\n *\n * Segments rather than substrings, so the rule can look at where the word sits rather than merely\n * whether it appears.\n */\nfunction wordsOf(name: string): string[] {\n  return String(name || '')\n    .replace(/([a-z0-9])([A-Z])/g, '$1 $2')\n    .split(/[^a-zA-Z0-9]+/)\n    .map(word => word.toLowerCase())\n    .filter(Boolean)\n}\n\n/** Does this field name say it holds a credential? */\nexport function looksLikeCredential(name: string): boolean {\n  const words = wordsOf(name)\n\n  if (!words.length) {\n    return false\n  }\n\n  const last = words[words.length - 1]\n\n  if (CREDENTIAL_NOUNS.includes(last)) {\n    return true\n  }\n\n  const pair = words.length > 1 ? words[words.length - 2] + last : ''\n\n  return CREDENTIAL_PAIRS.includes(pair)\n}\n\n/**\n * Refuse a model that declares a credential field, and say what to do about it.\n *\n * The message names the field, because a model can carry many and \"one of them\" would send the\n * author looking.\n */\nexport function assertNoCredentialField(model: { name?: string }[] | undefined, activityName?: string): void {\n  const offenders = (model || []).map(item => item?.name).filter(name => name && looksLikeCredential(name))\n\n  if (!offenders.length) {\n    return\n  }\n\n  throw new Error(\n    `[activity] ${activityName ? `\"${activityName}\" ` : ''}declares ${offenders.length > 1 ? 'fields' : 'a field'} ` +\n      `that would hold a credential: ${offenders.join(', ')}. ` +\n      'Worklist stores an activity input as plain JSON, shows it on the approval screen, lets it be ' +\n      'copied, and keeps a copy in two history tables — a secret put there is readable in four ' +\n      'places. Sealing secret values is designed but not built (secret flag + value-level sealing + ' +\n      'display, to land together at first real use). Raise it to the architect lane rather than ' +\n      'working around this.'\n  )\n}\n"]}

package/dist-server/service/activity/credential-guard-subscriber.d.ts

@@ -0,0 +1,19 @@
+import { EntitySubscriberInterface, InsertEvent, UpdateEvent } from 'typeorm';
+import { Activity } from './activity.js';
+/**
+ * **One place, because there are five ways in.**
+ *
+ * Activities are saved by createActivity, updateActivity, multipleUpsertActivities, the importer,
+ * and installActivity. A check written at each of those is not a rule — it is five things to
+ * remember, and the sixth way in arrives without it.
+ *
+ * TypeORM's subscriber is the seam every one of them passes through. Throwing here aborts the
+ * transaction, so a refused model is never half-written.
+ *
+ * A template carrying such a field is caught here too: installActivity saves an Activity from it.
+ */
+export declare class ActivityCredentialGuardSubscriber implements EntitySubscriberInterface<Activity> {
+    listenTo(): typeof Activity;
+    beforeInsert(event: InsertEvent<Activity>): void;
+    beforeUpdate(event: UpdateEvent<Activity>): void;
+}

package/dist-server/service/activity/credential-guard-subscriber.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ActivityCredentialGuardSubscriber = void 0;
+const tslib_1 = require("tslib");
+const typeorm_1 = require("typeorm");
+const activity_js_1 = require("./activity.js");
+const credential_field_js_1 = require("./credential-field.js");
+/**
+ * **One place, because there are five ways in.**
+ *
+ * Activities are saved by createActivity, updateActivity, multipleUpsertActivities, the importer,
+ * and installActivity. A check written at each of those is not a rule — it is five things to
+ * remember, and the sixth way in arrives without it.
+ *
+ * TypeORM's subscriber is the seam every one of them passes through. Throwing here aborts the
+ * transaction, so a refused model is never half-written.
+ *
+ * A template carrying such a field is caught here too: installActivity saves an Activity from it.
+ */
+let ActivityCredentialGuardSubscriber = class ActivityCredentialGuardSubscriber {
+    listenTo() {
+        return activity_js_1.Activity;
+    }
+    beforeInsert(event) {
+        (0, credential_field_js_1.assertNoCredentialField)(event.entity?.model, event.entity?.name);
+    }
+    beforeUpdate(event) {
+        (0, credential_field_js_1.assertNoCredentialField)(event.entity?.model, event.entity?.name);
+    }
+};
+exports.ActivityCredentialGuardSubscriber = ActivityCredentialGuardSubscriber;
+exports.ActivityCredentialGuardSubscriber = ActivityCredentialGuardSubscriber = tslib_1.__decorate([
+    (0, typeorm_1.EventSubscriber)()
+], ActivityCredentialGuardSubscriber);
+//# sourceMappingURL=credential-guard-subscriber.js.map

package/dist-server/service/activity/credential-guard-subscriber.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-guard-subscriber.js","sourceRoot":"","sources":["../../../server/service/activity/credential-guard-subscriber.ts"],"names":[],"mappings":";;;;AAAA,qCAA8F;AAE9F,+CAAwC;AACxC,+DAA+D;AAE/D;;;;;;;;;;;GAWG;AAEI,IAAM,iCAAiC,GAAvC,MAAM,iCAAiC;IAC5C,QAAQ;QACN,OAAO,sBAAQ,CAAA;IACjB,CAAC;IAED,YAAY,CAAC,KAA4B;QACvC,IAAA,6CAAuB,EAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAClE,CAAC;IAED,YAAY,CAAC,KAA4B;QACvC,IAAA,6CAAuB,EAAE,KAAK,CAAC,MAAmB,EAAE,KAAK,EAAG,KAAK,CAAC,MAAmB,EAAE,IAAI,CAAC,CAAA;IAC9F,CAAC;CACF,CAAA;AAZY,8EAAiC;4CAAjC,iCAAiC;IAD7C,IAAA,yBAAe,GAAE;GACL,iCAAiC,CAY7C","sourcesContent":["import { EntitySubscriberInterface, EventSubscriber, InsertEvent, UpdateEvent } from 'typeorm'\n\nimport { Activity } from './activity.js'\nimport { assertNoCredentialField } from './credential-field.js'\n\n/**\n * **One place, because there are five ways in.**\n *\n * Activities are saved by createActivity, updateActivity, multipleUpsertActivities, the importer,\n * and installActivity. A check written at each of those is not a rule — it is five things to\n * remember, and the sixth way in arrives without it.\n *\n * TypeORM's subscriber is the seam every one of them passes through. Throwing here aborts the\n * transaction, so a refused model is never half-written.\n *\n * A template carrying such a field is caught here too: installActivity saves an Activity from it.\n */\n@EventSubscriber()\nexport class ActivityCredentialGuardSubscriber implements EntitySubscriberInterface<Activity> {\n  listenTo() {\n    return Activity\n  }\n\n  beforeInsert(event: InsertEvent<Activity>) {\n    assertNoCredentialField(event.entity?.model, event.entity?.name)\n  }\n\n  beforeUpdate(event: UpdateEvent<Activity>) {\n    assertNoCredentialField((event.entity as Activity)?.model, (event.entity as Activity)?.name)\n  }\n}\n"]}

package/dist-server/service/activity/index.d.ts

@@ -3,6 +3,7 @@ import { ActivityHistory } from "./activity-history.js";
 import { ActivityMutation } from "./activity-mutation.js";
 import { ActivityQuery } from "./activity-query.js";
 import { ActivityHistoryEntitySubscriber } from "./event-subscriber.js";
+import { ActivityCredentialGuardSubscriber } from "./credential-guard-subscriber.js";
 export declare const entities: (typeof Activity | typeof ActivityHistory)[];
 export declare const resolvers: (typeof ActivityMutation | typeof ActivityQuery)[];
-export declare const subscribers: (typeof ActivityHistoryEntitySubscriber)[];
+export declare const subscribers: (typeof ActivityHistoryEntitySubscriber | typeof ActivityCredentialGuardSubscriber)[];

package/dist-server/service/activity/index.js

@@ -6,7 +6,8 @@ const activity_history_js_1 = require("./activity-history.js");
 const activity_mutation_js_1 = require("./activity-mutation.js");
 const activity_query_js_1 = require("./activity-query.js");
 const event_subscriber_js_1 = require("./event-subscriber.js");
+const credential_guard_subscriber_js_1 = require("./credential-guard-subscriber.js");
 exports.entities = [activity_js_1.Activity, activity_history_js_1.ActivityHistory];
 exports.resolvers = [activity_query_js_1.ActivityQuery, activity_mutation_js_1.ActivityMutation];
-exports.subscribers = [event_subscriber_js_1.ActivityHistoryEntitySubscriber];
+exports.subscribers = [event_subscriber_js_1.ActivityHistoryEntitySubscriber, credential_guard_subscriber_js_1.ActivityCredentialGuardSubscriber];
 //# sourceMappingURL=index.js.map

package/dist-server/service/activity/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../server/service/activity/index.ts"],"names":[],"mappings":";;;AAAA,+CAAwC;AACxC,+DAAuD;AACvD,iEAAyD;AACzD,2DAAmD;AACnD,+DAAuE;AAE1D,QAAA,QAAQ,GAAG,CAAC,sBAAQ,EAAE,qCAAe,CAAC,CAAA;AACtC,QAAA,SAAS,GAAG,CAAC,iCAAa,EAAE,uCAAgB,CAAC,CAAA;AAC7C,QAAA,WAAW,GAAG,CAAC,qDAA+B,CAAC,CAAA","sourcesContent":["import { Activity } from \"./activity.js\"\nimport { ActivityHistory } from \"./activity-history.js\"\nimport { ActivityMutation } from \"./activity-mutation.js\"\nimport { ActivityQuery } from \"./activity-query.js\"\nimport { ActivityHistoryEntitySubscriber } from \"./event-subscriber.js\"\n\nexport const entities = [Activity, ActivityHistory]\nexport const resolvers = [ActivityQuery, ActivityMutation]\nexport const subscribers = [ActivityHistoryEntitySubscriber]\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../server/service/activity/index.ts"],"names":[],"mappings":";;;AAAA,+CAAwC;AACxC,+DAAuD;AACvD,iEAAyD;AACzD,2DAAmD;AACnD,+DAAuE;AACvE,qFAAoF;AAEvE,QAAA,QAAQ,GAAG,CAAC,sBAAQ,EAAE,qCAAe,CAAC,CAAA;AACtC,QAAA,SAAS,GAAG,CAAC,iCAAa,EAAE,uCAAgB,CAAC,CAAA;AAC7C,QAAA,WAAW,GAAG,CAAC,qDAA+B,EAAE,kEAAiC,CAAC,CAAA","sourcesContent":["import { Activity } from \"./activity.js\"\nimport { ActivityHistory } from \"./activity-history.js\"\nimport { ActivityMutation } from \"./activity-mutation.js\"\nimport { ActivityQuery } from \"./activity-query.js\"\nimport { ActivityHistoryEntitySubscriber } from \"./event-subscriber.js\"\nimport { ActivityCredentialGuardSubscriber } from \"./credential-guard-subscriber.js\"\n\nexport const entities = [Activity, ActivityHistory]\nexport const resolvers = [ActivityQuery, ActivityMutation]\nexport const subscribers = [ActivityHistoryEntitySubscriber, ActivityCredentialGuardSubscriber]\n"]}

package/dist-server/service/index.d.ts

@@ -6,7 +6,7 @@ export * from './activity/activity.js';
 export * from './installable-activity/installable-activity.js';
 export * from './activity-summary/activity-summary.js';
 export declare const entities: (typeof import("./activity/activity.js").Activity | typeof import("./activity-approval/activity-approval.js").ActivityApproval | typeof import("./activity-thread/activity-thread.js").ActivityThread | typeof import("./activity-instance/activity-instance.js").ActivityInstance | typeof import("./installable-activity/installable-activity.js").InstallableActivity | typeof import("./activity-template/activity-template.js").ActivityTemplate | typeof import("./activity-summary/activity-summary.js").ActivitySummary | typeof import("./activity/activity-history.js").ActivityHistory | typeof import("./activity-instance/activity-instance-history.js").ActivityInstanceHistory | typeof import("./activity-template/activity-template-history.js").ActivityTemplateHistory | typeof import("./activity-thread/activity-thread-history.js").ActivityThreadHistory)[];
-export declare const subscribers: (typeof import("./activity-approval/event-subscriber.js").ActivityApprovalSubscriber | typeof import("./activity/event-subscriber.js").ActivityHistoryEntitySubscriber | typeof import("./activity-instance/event-subscriber.js").ActivityInstanceSubscriber | typeof import("./activity-instance/event-subscriber.js").ActivityInstanceHistoryEntitySubscriber | typeof import("./activity-thread/event-subscriber.js").ActivityThreadSubscriber | typeof import("./activity-thread/event-subscriber.js").ActivityThreadHistoryEntitySubscriber)[];
+export declare const subscribers: (typeof import("./activity-approval/event-subscriber.js").ActivityApprovalSubscriber | typeof import("./activity/event-subscriber.js").ActivityHistoryEntitySubscriber | typeof import("./activity/credential-guard-subscriber.js").ActivityCredentialGuardSubscriber | typeof import("./activity-instance/event-subscriber.js").ActivityInstanceSubscriber | typeof import("./activity-instance/event-subscriber.js").ActivityInstanceHistoryEntitySubscriber | typeof import("./activity-thread/event-subscriber.js").ActivityThreadSubscriber | typeof import("./activity-thread/event-subscriber.js").ActivityThreadHistoryEntitySubscriber)[];
 export declare const schema: {
     resolverClasses: (typeof import("./activity-stats/activity-stats-query.js").ActivityStatsQuery | typeof import("./activity-approval/activity-approval-query.js").ActivityApprovalQuery | typeof import("./activity-approval/activity-approval-mutation.js").ActivityApprovalMutation | typeof import("./activity-approval/activity-approval-subscription.js").ActivityApprovalSubscription | typeof import("./activity/activity-mutation.js").ActivityMutation | typeof import("./activity/activity-query.js").ActivityQuery | typeof import("./activity-instance/activity-instance-mutation.js").ActivityInstanceMutation | typeof import("./activity-instance/activity-instance-query.js").ActivityInstanceQuery | typeof import("./activity-instance/activity-instance-history-query.js").ActivityInstanceHistoryQuery | typeof import("./activity-instance/activity-instance-subscription.js").ActivityInstanceSubscription | typeof import("./activity-template/activity-template-mutation.js").ActivityTemplateMutation | typeof import("./activity-template/activity-template-query.js").ActivityTemplateQuery | typeof import("./activity-thread/activity-thread-mutation.js").ActivityThreadMutation | typeof import("./activity-thread/activity-thread-query.js").ActivityThreadQuery | typeof import("./activity-thread/activity-thread-history-query.js").ActivityThreadHistoryQuery | typeof import("./activity-thread/activity-thread-subscription.js").ActivityThreadSubscription | typeof import("./installable-activity/installable-activity-query.js").InstallableActivityQuery | typeof import("./installable-activity/installable-activity-mutation.js").InstallableActivityMutation | typeof import("./activity-summary/activity-summary-query.js").ActivitySummaryQuery)[];
 };

package/dist-server/service/installable-activity/activity-readiness.d.ts

@@ -0,0 +1,58 @@
+/**
+ * How far along an activity type is, **as declared by the module that registers it.**
+ *
+ * Nobody can compute this at runtime. A module either works end to end or it does not, and only
+ * the people who wrote it know which. So it is declared beside the callback, the way plant declares
+ * its maturity facts — and like those, it can go stale, which is why the declaration also names
+ * the tests that back it up.
+ */
+export declare const ActivityReadinessStage: {
+    /** Registered, and the callback does the real thing. */
+    readonly Working: "working";
+    /** Registered and reachable, but part of the effect is still missing. Say what in `gaps`. */
+    readonly Partial: "partial";
+    /** The type exists so the screen can show it. Issuing one does not accomplish anything yet. */
+    readonly Declared: "declared";
+    /**
+     * Identified as work a person has to decide, and **not built.** Often the model has no place to
+     * put it yet — say what is missing in `gaps`.
+     *
+     * The catalog carries these because it is the plan of record: a reader asking "what is left"
+     * gets the answer on the screen instead of in someone's head.
+     */
+    readonly Planned: "planned";
+    /**
+     * Looked at and **deliberately not a worklist item.** This is a placement decision, not a
+     * backlog entry — the work happens, it just does not reach anyone's inbox. Fact-derived things
+     * live like this: a machine stops and the reason gets filled in at the machine, because nobody
+     * assigned it.
+     *
+     * It sits in the catalog so the next person asking "why is this not here" reads the answer
+     * rather than proposing it again. `notes` says where it does live.
+     *
+     * Kept apart from Planned on purpose. Mixed together, a decision reads as a promise.
+     */
+    readonly NotWorklist: "not-worklist";
+};
+export type ActivityReadinessStage = (typeof ActivityReadinessStage)[keyof typeof ActivityReadinessStage];
+export declare class ActivityTestRecord {
+    passed?: number;
+    total?: number;
+    at?: string;
+    command?: string;
+}
+/**
+ * What a module says about its own activity type — how far along, and what backs that up.
+ *
+ * **Every field is optional and a missing one stays missing.** A module that declares nothing gets
+ * a row saying 「선언 없음」, never a zero and never a green mark. That distinction is the whole
+ * point of the screen: a type nobody has vouched for should look different from one that is
+ * finished, and a count we do not have is not a count of zero.
+ */
+export declare class ActivityReadiness {
+    stage?: ActivityReadinessStage;
+    gaps?: string[];
+    tests?: string[];
+    lastRun?: ActivityTestRecord;
+    notes?: string;
+}

package/dist-server/service/installable-activity/activity-readiness.js

@@ -0,0 +1,105 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ActivityReadiness = exports.ActivityTestRecord = exports.ActivityReadinessStage = void 0;
+const tslib_1 = require("tslib");
+const type_graphql_1 = require("type-graphql");
+/**
+ * How far along an activity type is, **as declared by the module that registers it.**
+ *
+ * Nobody can compute this at runtime. A module either works end to end or it does not, and only
+ * the people who wrote it know which. So it is declared beside the callback, the way plant declares
+ * its maturity facts — and like those, it can go stale, which is why the declaration also names
+ * the tests that back it up.
+ */
+exports.ActivityReadinessStage = {
+    /** Registered, and the callback does the real thing. */
+    Working: 'working',
+    /** Registered and reachable, but part of the effect is still missing. Say what in `gaps`. */
+    Partial: 'partial',
+    /** The type exists so the screen can show it. Issuing one does not accomplish anything yet. */
+    Declared: 'declared',
+    /**
+     * Identified as work a person has to decide, and **not built.** Often the model has no place to
+     * put it yet — say what is missing in `gaps`.
+     *
+     * The catalog carries these because it is the plan of record: a reader asking "what is left"
+     * gets the answer on the screen instead of in someone's head.
+     */
+    Planned: 'planned',
+    /**
+     * Looked at and **deliberately not a worklist item.** This is a placement decision, not a
+     * backlog entry — the work happens, it just does not reach anyone's inbox. Fact-derived things
+     * live like this: a machine stops and the reason gets filled in at the machine, because nobody
+     * assigned it.
+     *
+     * It sits in the catalog so the next person asking "why is this not here" reads the answer
+     * rather than proposing it again. `notes` says where it does live.
+     *
+     * Kept apart from Planned on purpose. Mixed together, a decision reads as a promise.
+     */
+    NotWorklist: 'not-worklist'
+};
+(0, type_graphql_1.registerEnumType)(exports.ActivityReadinessStage, {
+    name: 'ActivityReadinessStage',
+    description: 'how far along an installable activity is, as declared by the module that registers it'
+});
+let ActivityTestRecord = class ActivityTestRecord {
+};
+exports.ActivityTestRecord = ActivityTestRecord;
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ nullable: true, description: 'How many of the covering tests passed' }),
+    tslib_1.__metadata("design:type", Number)
+], ActivityTestRecord.prototype, "passed", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ nullable: true, description: 'How many covering tests ran' }),
+    tslib_1.__metadata("design:type", Number)
+], ActivityTestRecord.prototype, "total", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ nullable: true, description: 'When that run happened, ISO 8601' }),
+    tslib_1.__metadata("design:type", String)
+], ActivityTestRecord.prototype, "at", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ nullable: true, description: 'The command that produced this record' }),
+    tslib_1.__metadata("design:type", String)
+], ActivityTestRecord.prototype, "command", void 0);
+exports.ActivityTestRecord = ActivityTestRecord = tslib_1.__decorate([
+    (0, type_graphql_1.ObjectType)({ description: 'Recorded result of the test run that covers an installable activity' })
+], ActivityTestRecord);
+/**
+ * What a module says about its own activity type — how far along, and what backs that up.
+ *
+ * **Every field is optional and a missing one stays missing.** A module that declares nothing gets
+ * a row saying 「선언 없음」, never a zero and never a green mark. That distinction is the whole
+ * point of the screen: a type nobody has vouched for should look different from one that is
+ * finished, and a count we do not have is not a count of zero.
+ */
+let ActivityReadiness = class ActivityReadiness {
+};
+exports.ActivityReadiness = ActivityReadiness;
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => exports.ActivityReadinessStage, { nullable: true, description: 'Working, partial, or declared only' }),
+    tslib_1.__metadata("design:type", String)
+], ActivityReadiness.prototype, "stage", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => [String], { nullable: true, description: 'What is still missing, when the stage is partial' }),
+    tslib_1.__metadata("design:type", Array)
+], ActivityReadiness.prototype, "gaps", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => [String], {
+        nullable: true,
+        description: 'Repo-relative test files that cover this activity. Named so the claim can be checked.'
+    }),
+    tslib_1.__metadata("design:type", Array)
+], ActivityReadiness.prototype, "tests", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => ActivityTestRecord, { nullable: true, description: 'Result of the last recorded run of those tests' }),
+    tslib_1.__metadata("design:type", ActivityTestRecord)
+], ActivityReadiness.prototype, "lastRun", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ nullable: true, description: 'Anything a reader needs that the fields above do not carry' }),
+    tslib_1.__metadata("design:type", String)
+], ActivityReadiness.prototype, "notes", void 0);
+exports.ActivityReadiness = ActivityReadiness = tslib_1.__decorate([
+    (0, type_graphql_1.ObjectType)({ description: 'What the registering module declares about an installable activity' })
+], ActivityReadiness);
+//# sourceMappingURL=activity-readiness.js.map

package/dist-server/service/installable-activity/activity-readiness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"activity-readiness.js","sourceRoot":"","sources":["../../../server/service/installable-activity/activity-readiness.ts"],"names":[],"mappings":";;;;AAAA,+CAAkE;AAElE;;;;;;;GAOG;AACU,QAAA,sBAAsB,GAAG;IACpC,wDAAwD;IACxD,OAAO,EAAE,SAAS;IAClB,6FAA6F;IAC7F,OAAO,EAAE,SAAS;IAClB,+FAA+F;IAC/F,QAAQ,EAAE,UAAU;IACpB;;;;;;OAMG;IACH,OAAO,EAAE,SAAS;IAClB;;;;;;;;;;OAUG;IACH,WAAW,EAAE,cAAc;CACnB,CAAA;AAIV,IAAA,+BAAgB,EAAC,8BAAsB,EAAE;IACvC,IAAI,EAAE,wBAAwB;IAC9B,WAAW,EAAE,uFAAuF;CACrG,CAAC,CAAA;AAGK,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;CAY9B,CAAA;AAZY,gDAAkB;AAE7B;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,uCAAuC,EAAE,CAAC;;kDACjE;AAGf;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC;;iDACxD;AAGd;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC;;8CAChE;AAGX;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,uCAAuC,EAAE,CAAC;;mDAChE;6BAXL,kBAAkB;IAD9B,IAAA,yBAAU,EAAC,EAAE,WAAW,EAAE,qEAAqE,EAAE,CAAC;GACtF,kBAAkB,CAY9B;AAED;;;;;;;GAOG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;CAkB7B,CAAA;AAlBY,8CAAiB;AAE5B;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,8BAAsB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC;;gDAC/E;AAG9B;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,kDAAkD,EAAE,CAAC;;+CAC9F;AAMf;IAJC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE;QACvB,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,uFAAuF;KACrG,CAAC;;gDACc;AAGhB;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,gDAAgD,EAAE,CAAC;sCAC3G,kBAAkB;kDAAA;AAG5B;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,4DAA4D,EAAE,CAAC;;gDACvF;4BAjBH,iBAAiB;IAD7B,IAAA,yBAAU,EAAC,EAAE,WAAW,EAAE,oEAAoE,EAAE,CAAC;GACrF,iBAAiB,CAkB7B","sourcesContent":["import { Field, ObjectType, registerEnumType } from 'type-graphql'\n\n/**\n * How far along an activity type is, **as declared by the module that registers it.**\n *\n * Nobody can compute this at runtime. A module either works end to end or it does not, and only\n * the people who wrote it know which. So it is declared beside the callback, the way plant declares\n * its maturity facts — and like those, it can go stale, which is why the declaration also names\n * the tests that back it up.\n */\nexport const ActivityReadinessStage = {\n  /** Registered, and the callback does the real thing. */\n  Working: 'working',\n  /** Registered and reachable, but part of the effect is still missing. Say what in `gaps`. */\n  Partial: 'partial',\n  /** The type exists so the screen can show it. Issuing one does not accomplish anything yet. */\n  Declared: 'declared',\n  /**\n   * Identified as work a person has to decide, and **not built.** Often the model has no place to\n   * put it yet — say what is missing in `gaps`.\n   *\n   * The catalog carries these because it is the plan of record: a reader asking \"what is left\"\n   * gets the answer on the screen instead of in someone's head.\n   */\n  Planned: 'planned',\n  /**\n   * Looked at and **deliberately not a worklist item.** This is a placement decision, not a\n   * backlog entry — the work happens, it just does not reach anyone's inbox. Fact-derived things\n   * live like this: a machine stops and the reason gets filled in at the machine, because nobody\n   * assigned it.\n   *\n   * It sits in the catalog so the next person asking \"why is this not here\" reads the answer\n   * rather than proposing it again. `notes` says where it does live.\n   *\n   * Kept apart from Planned on purpose. Mixed together, a decision reads as a promise.\n   */\n  NotWorklist: 'not-worklist'\n} as const\n\nexport type ActivityReadinessStage = (typeof ActivityReadinessStage)[keyof typeof ActivityReadinessStage]\n\nregisterEnumType(ActivityReadinessStage, {\n  name: 'ActivityReadinessStage',\n  description: 'how far along an installable activity is, as declared by the module that registers it'\n})\n\n@ObjectType({ description: 'Recorded result of the test run that covers an installable activity' })\nexport class ActivityTestRecord {\n  @Field({ nullable: true, description: 'How many of the covering tests passed' })\n  passed?: number\n\n  @Field({ nullable: true, description: 'How many covering tests ran' })\n  total?: number\n\n  @Field({ nullable: true, description: 'When that run happened, ISO 8601' })\n  at?: string\n\n  @Field({ nullable: true, description: 'The command that produced this record' })\n  command?: string\n}\n\n/**\n * What a module says about its own activity type — how far along, and what backs that up.\n *\n * **Every field is optional and a missing one stays missing.** A module that declares nothing gets\n * a row saying 「선언 없음」, never a zero and never a green mark. That distinction is the whole\n * point of the screen: a type nobody has vouched for should look different from one that is\n * finished, and a count we do not have is not a count of zero.\n */\n@ObjectType({ description: 'What the registering module declares about an installable activity' })\nexport class ActivityReadiness {\n  @Field(type => ActivityReadinessStage, { nullable: true, description: 'Working, partial, or declared only' })\n  stage?: ActivityReadinessStage\n\n  @Field(type => [String], { nullable: true, description: 'What is still missing, when the stage is partial' })\n  gaps?: string[]\n\n  @Field(type => [String], {\n    nullable: true,\n    description: 'Repo-relative test files that cover this activity. Named so the claim can be checked.'\n  })\n  tests?: string[]\n\n  @Field(type => ActivityTestRecord, { nullable: true, description: 'Result of the last recorded run of those tests' })\n  lastRun?: ActivityTestRecord\n\n  @Field({ nullable: true, description: 'Anything a reader needs that the fields above do not carry' })\n  notes?: string\n}\n"]}

package/dist-server/service/installable-activity/installable-activity-query.js

@@ -7,6 +7,7 @@ const shell_1 = require("@things-factory/shell");
 const activity_installation_controller_js_1 = require("../../controllers/activity-installation/activity-installation-controller.js");
 const activity_js_1 = require("../activity/activity.js");
 const installable_activity_js_1 = require("./installable-activity.js");
+const approval_line_js_1 = require("../../controllers/activity-approval/approval-line.js");
 const installable_activity_type_js_1 = require("./installable-activity-type.js");
 let InstallableActivityQuery = class InstallableActivityQuery {
     async installableActivity(name, context) {
@@ -20,9 +21,33 @@ let InstallableActivityQuery = class InstallableActivityQuery {
                 domain: { id: domain.id },
                 name: item.name
             });
+            /*
+             * 「이 도메인이 이 단계를 쓰나」를 값으로 낸다 — 판단은 여기서 다시 짜지 않는다.
+             *
+             * `isApprovalStep` 이 참조를 걸러 내는 그 자리다. 화면이 길이를 세면 참조만 있는 결재선을
+             * 「결재자 있음」으로 그리고, 실제로는 그냥 지나간다.
+             */
+            item.approvalSteps = (item.activity?.approvalLine || []).filter(approval_line_js_1.isApprovalStep).length;
         }
-        const total = items.length;
-        return { items, total };
+        /*
+         * Identified-but-unbuilt work comes out of this query too, because the catalog is the plan of
+         * record — "what is left" has to be answerable on the screen.
+         *
+         * Shaped to look like an installable activity so the screen has one list to draw, but it
+         * carries no `activity` (nothing is installed) and no callback. Its stage says planned or
+         * not-worklist, and the screen keeps those apart from the built ones: a decision must not read
+         * as a promise.
+         */
+        const intended = activity_installation_controller_js_1.ActivityInstallations.listIntended().map(one => ({
+            name: one.key,
+            label: one.label,
+            description: undefined,
+            guide: one.guide,
+            category: one.category,
+            readiness: one.readiness
+        }));
+        const merged = [...items, ...intended];
+        return { items: merged, total: merged.length };
     }
 };
 exports.InstallableActivityQuery = InstallableActivityQuery;