Release: merge beta into main

.github/dependabot.yml

@@ -26,6 +26,16 @@ updates:
     ignore:
       - dependency-name: "typescript"
         update-types: ["version-update:semver-major"]
+      # vue-router 5 peers `vite: ^7.3.0 || ^8.0.0` and expects a Vite
+      # toolchain. Measured, not assumed, and the result is SPLIT: integriq and
+      # zaakafhandelapp fail their build on `Can't resolve 'vue-router'`, while
+      # openregister and learniq build clean on 5.3.0. Held because a bump that
+      # breaks some apps and not others cannot be merged unattended, and the
+      # difference is not yet understood. Adopting it fleet-wide is a
+      # Vite migration, not a bump. versioniq is already on Vite and is the
+      # natural pilot.
+      - dependency-name: "vue-router"
+        update-types: ["version-update:semver-major"]
       - dependency-name: "webpack-cli"
         update-types: ["version-update:semver-major"]
       - dependency-name: "@babel/core"

appinfo/info.xml

@@ -51,7 +51,7 @@ Vrij en open source onder de EUPL-1.2-licentie.
         version is <= the stored one, and unlike the SCHEMA path it has no
         content-differs escape hatch to fall back on.
     -->
-    <version>1.1.5-unstable.20260830174202</version>
+    <version>1.1.6-unstable.20260831045941</version>
     <licence>EUPL-1.2</licence>
     <author mail="info@conduction.nl" homepage="https://www.conduction.nl/">Conduction</author>
     <namespace>Decidiq</namespace>

appinfo/routes.php

@@ -37,6 +37,10 @@
         // First-time setup wizard (ADR-042) - the standard CnSetupWizard contract.
         ['name' => 'setup#status',    'url' => '/api/setup/status',            'verb' => 'GET'],
         ['name' => 'setup#runAction', 'url' => '/api/setup/action/{actionId}', 'verb' => 'POST', 'requirements' => ['actionId' => '[a-z0-9\\-]+']],
+        // A `choice` step POSTs its answer here before it advances; the
+        // `run-action` step that follows reads it back, because runAction()
+        // carries no body and so cannot carry the answer itself.
+        ['name' => 'setup#saveConfig', 'url' => '/api/setup/config',           'verb' => 'POST'],
         ['name' => 'settings#getPublicationConfig', 'url' => '/api/settings/publication-config', 'verb' => 'GET'],
         ['name' => 'settings#setPublicationConfig', 'url' => '/api/settings/publication-config', 'verb' => 'PUT'],
 

l10n/.schema-l10n-baseline.json

@@ -1,3 +1,3 @@
 {
-  "uncovered": 1634
+  "uncovered": 1632
 }

l10n/en.js

@@ -1738,7 +1738,20 @@ OC.L10N.register(
         "No meetings": "No meetings",
         "Previous month": "Previous month",
         "Table": "Table",
-        "Today": "Today"
+        "Today": "Today",
+        "Source app": "Source app",
+        "External reference": "External reference",
+        "App id of the fleet app this route was held on behalf of (e.g. dossiq). Empty for routes authored in decidiq itself. Half of the idempotency key; never an authorization input.": "App id of the fleet app this route was held on behalf of (e.g. dossiq). Empty for routes authored in decidiq itself. Half of the idempotency key; never an authorization input.",
+        "The producing app's own id for the route this one was migrated from. Paired with sourceApp it identifies the origin, so a repeated command updates this route rather than creating another.": "The producing app's own id for the route this one was migrated from. Paired with sourceApp it identifies the origin, so a repeated command updates this route rather than creating another.",
+        "consultationType=tender: the winning party recorded when the award decision is made (status=awarded). Decidiq owns publish/manage/award only; authoring is procest and bidding is pipelinq.": "consultationType=tender: the winning party recorded when the award decision is made (status=awarded). Decidiq owns publish/manage/award only; authoring is procest and bidding is pipelinq.",
+        "schema.org annotation matching the ORI type (ChooseAction / Event / CreativeWork).": "schema.org annotation matching the ORI type (ChooseAction / Event / CreativeWork).",
+        "consultationType=tender: public tender reference/notice number.": "consultationType=tender: public tender reference/notice number.",
+        "Association or VvE": "Association or VvE",
+        "Company board": "Company board",
+        "Every schema, generated values": "Every schema, generated values",
+        "Municipality": "Municipality",
+        "None, I will set this up myself": "None, I will set this up myself",
+        "Works council": "Works council"
     },
     "nplurals=2; plural=(n != 1);"
 )

l10n/en.json

@@ -1737,7 +1737,20 @@
         "No meetings": "No meetings",
         "Previous month": "Previous month",
         "Table": "Table",
-        "Today": "Today"
+        "Today": "Today",
+        "Source app": "Source app",
+        "External reference": "External reference",
+        "App id of the fleet app this route was held on behalf of (e.g. dossiq). Empty for routes authored in decidiq itself. Half of the idempotency key; never an authorization input.": "App id of the fleet app this route was held on behalf of (e.g. dossiq). Empty for routes authored in decidiq itself. Half of the idempotency key; never an authorization input.",
+        "The producing app's own id for the route this one was migrated from. Paired with sourceApp it identifies the origin, so a repeated command updates this route rather than creating another.": "The producing app's own id for the route this one was migrated from. Paired with sourceApp it identifies the origin, so a repeated command updates this route rather than creating another.",
+        "consultationType=tender: the winning party recorded when the award decision is made (status=awarded). Decidiq owns publish/manage/award only; authoring is procest and bidding is pipelinq.": "consultationType=tender: the winning party recorded when the award decision is made (status=awarded). Decidiq owns publish/manage/award only; authoring is procest and bidding is pipelinq.",
+        "schema.org annotation matching the ORI type (ChooseAction / Event / CreativeWork).": "schema.org annotation matching the ORI type (ChooseAction / Event / CreativeWork).",
+        "consultationType=tender: public tender reference/notice number.": "consultationType=tender: public tender reference/notice number.",
+        "Association or VvE": "Association or VvE",
+        "Company board": "Company board",
+        "Every schema, generated values": "Every schema, generated values",
+        "Municipality": "Municipality",
+        "None, I will set this up myself": "None, I will set this up myself",
+        "Works council": "Works council"
     },
     "pluralForm": "nplurals=2; plural=(n != 1);"
 }

l10n/nl.js

@@ -2037,7 +2037,24 @@ OC.L10N.register(
         "{n} meeting(s) exceeded the scheduled time": "{n} vergadering(en) overschreden de geplande tijd",
         "{n} open action items": "{n} openstaande actiepunten",
         "{responded} of {invited} responded": "{responded} van {invited} gereageerd",
-        "{states} states, {transitions} transitions": "{states} statussen, {transitions} overgangen"
+        "{states} states, {transitions} transitions": "{states} statussen, {transitions} overgangen",
+        "Source app": "Bronapplicatie",
+        "External reference": "Externe referentie",
+        "App id of the fleet app this route was held on behalf of (e.g. dossiq). Empty for routes authored in decidiq itself. Half of the idempotency key; never an authorization input.": "App-id van de applicatie waarvoor deze route wordt bewaard (bijvoorbeeld dossiq). Leeg voor routes die in decidiq zelf zijn gemaakt. De helft van de idempotentiesleutel; nooit een autorisatiegrond.",
+        "The producing app's own id for the route this one was migrated from. Paired with sourceApp it identifies the origin, so a repeated command updates this route rather than creating another.": "Het eigen id dat de bronapplicatie gebruikt voor de route waaruit deze is overgenomen. Samen met sourceApp bepaalt het de herkomst, zodat een herhaalde opdracht deze route bijwerkt in plaats van een tweede aanmaakt.",
+        "Which kind of organisation is this for?": "Voor wat voor organisatie is dit?",
+        "Pick the organisation this app runs for and you get a worked example of it: bodies, meetings, decisions and templates that fit. Installing the app plants nothing on its own, so this is the only step that adds data. Choose \"None\" on a production install.": "Kies de organisatie waarvoor deze app draait en je krijgt een uitgewerkt voorbeeld: organen, vergaderingen, besluiten en sjablonen die daarbij passen. De app zet zelf niets klaar, dus dit is de enige stap die gegevens toevoegt. Kies \"Geen\" op een productieomgeving.",
+        "Load the example data": "Laad de voorbeeldgegevens",
+        "Loads the set you picked. The data is obviously sample data, it is safe to run more than once, and you can delete it afterwards.": "Laadt de set die je koos. De gegevens zijn herkenbaar voorbeeldgegevens, je kunt dit meer dan een keer uitvoeren en je kunt ze daarna verwijderen.",
+        "consultationType=tender: the winning party recorded when the award decision is made (status=awarded). Decidiq owns publish/manage/award only; authoring is procest and bidding is pipelinq.": "consultationType=tender: de winnende partij, vastgelegd zodra het gunningsbesluit is genomen (status=awarded). Decidiq beheert alleen publiceren, beheren en gunnen; het opstellen gebeurt in procest en het inschrijven in pipelinq.",
+        "schema.org annotation matching the ORI type (ChooseAction / Event / CreativeWork).": "schema.org-annotatie die hoort bij het ORI-type (ChooseAction / Event / CreativeWork).",
+        "consultationType=tender: public tender reference/notice number.": "consultationType=tender: het openbare aanbestedings- of publicatienummer.",
+        "Association or VvE": "Vereniging of VvE",
+        "Company board": "Raad van bestuur",
+        "Every schema, generated values": "Elk schema, gegenereerde waarden",
+        "Municipality": "Gemeente",
+        "None, I will set this up myself": "Geen, ik richt dit zelf in",
+        "Works council": "Ondernemingsraad"
     },
     "nplurals=2; plural=(n != 1);"
 )

l10n/nl.json

@@ -2036,7 +2036,24 @@
         "{n} meeting(s) exceeded the scheduled time": "{n} vergadering(en) overschreden de geplande tijd",
         "{n} open action items": "{n} openstaande actiepunten",
         "{responded} of {invited} responded": "{responded} van {invited} gereageerd",
-        "{states} states, {transitions} transitions": "{states} statussen, {transitions} overgangen"
+        "{states} states, {transitions} transitions": "{states} statussen, {transitions} overgangen",
+        "Source app": "Bronapplicatie",
+        "External reference": "Externe referentie",
+        "App id of the fleet app this route was held on behalf of (e.g. dossiq). Empty for routes authored in decidiq itself. Half of the idempotency key; never an authorization input.": "App-id van de applicatie waarvoor deze route wordt bewaard (bijvoorbeeld dossiq). Leeg voor routes die in decidiq zelf zijn gemaakt. De helft van de idempotentiesleutel; nooit een autorisatiegrond.",
+        "The producing app's own id for the route this one was migrated from. Paired with sourceApp it identifies the origin, so a repeated command updates this route rather than creating another.": "Het eigen id dat de bronapplicatie gebruikt voor de route waaruit deze is overgenomen. Samen met sourceApp bepaalt het de herkomst, zodat een herhaalde opdracht deze route bijwerkt in plaats van een tweede aanmaakt.",
+        "Which kind of organisation is this for?": "Voor wat voor organisatie is dit?",
+        "Pick the organisation this app runs for and you get a worked example of it: bodies, meetings, decisions and templates that fit. Installing the app plants nothing on its own, so this is the only step that adds data. Choose \"None\" on a production install.": "Kies de organisatie waarvoor deze app draait en je krijgt een uitgewerkt voorbeeld: organen, vergaderingen, besluiten en sjablonen die daarbij passen. De app zet zelf niets klaar, dus dit is de enige stap die gegevens toevoegt. Kies \"Geen\" op een productieomgeving.",
+        "Load the example data": "Laad de voorbeeldgegevens",
+        "Loads the set you picked. The data is obviously sample data, it is safe to run more than once, and you can delete it afterwards.": "Laadt de set die je koos. De gegevens zijn herkenbaar voorbeeldgegevens, je kunt dit meer dan een keer uitvoeren en je kunt ze daarna verwijderen.",
+        "consultationType=tender: the winning party recorded when the award decision is made (status=awarded). Decidiq owns publish/manage/award only; authoring is procest and bidding is pipelinq.": "consultationType=tender: de winnende partij, vastgelegd zodra het gunningsbesluit is genomen (status=awarded). Decidiq beheert alleen publiceren, beheren en gunnen; het opstellen gebeurt in procest en het inschrijven in pipelinq.",
+        "schema.org annotation matching the ORI type (ChooseAction / Event / CreativeWork).": "schema.org-annotatie die hoort bij het ORI-type (ChooseAction / Event / CreativeWork).",
+        "consultationType=tender: public tender reference/notice number.": "consultationType=tender: het openbare aanbestedings- of publicatienummer.",
+        "Association or VvE": "Vereniging of VvE",
+        "Company board": "Raad van bestuur",
+        "Every schema, generated values": "Elk schema, gegenereerde waarden",
+        "Municipality": "Gemeente",
+        "None, I will set this up myself": "Geen, ik richt dit zelf in",
+        "Works council": "Ondernemingsraad"
     },
     "plurals": null,
     "pluralForm": "nplurals=2; plural=(n != 1);"

lib/AppInfo/Application.php

@@ -24,6 +24,7 @@
 namespace OCA\Decidiq\AppInfo;
 
 use OCA\Decidiq\AppInfo\Registrar\AppHostRegistrar;
+use OCA\Decidiq\AppInfo\Registrar\CrossAppEventRegistrar;
 use OCA\Decidiq\AppInfo\Registrar\DomainServiceRegistrar;
 use OCA\Decidiq\AppInfo\Registrar\IntegrationLeafRegistrar;
 use OCA\Decidiq\AppInfo\Registrar\ObjectListenerRegistrar;
@@ -46,7 +47,8 @@
  * than accumulating here:
  *
  *   - {@see AppHostRegistrar}            AppHost boilerplate adoption (ADR-040 / ADR-022).
- *   - {@see DomainServiceRegistrar}      decision events, MCP tools, eIDAS, translation.
+ *   - {@see CrossAppEventRegistrar}      inbound cross-app command listeners (ADR-041).
+ *   - {@see DomainServiceRegistrar}      MCP tools, eIDAS, translation.
  *   - {@see PlatformIntegrationRegistrar} search, object-write guards, dashboard widget.
  *   - {@see IntegrationLeafRegistrar}    server-side half of the OR integration leaves (ADR-066).
  *   - {@see ObjectListenerRegistrar}     boot()-time filtered object-lifecycle subscriptions.
@@ -140,6 +142,7 @@ public function register(IRegistrationContext $context): void {
 		// them.
 		// @spec openspec/changes/migrate-comments-to-talk-leaf/tasks.md#task-2.1.
 		// @spec openspec/specs/user-settings/spec.md
+		(new CrossAppEventRegistrar())->register(context: $context);
 		(new DomainServiceRegistrar())->register(context: $context);
 
 		// Board portal Phase 2 services (audit log, conflict of interest,

lib/AppInfo/Registrar/CrossAppEventRegistrar.php

@@ -0,0 +1,93 @@
+<?php
+
+/**
+ * Decidiq cross-app event registrar.
+ *
+ * Wires the typed events other fleet apps dispatch to command Decidiq, and the
+ * listeners that answer them. Split out of DomainServiceRegistrar because the
+ * set grew: what was one event/listener pair for decisions is now four, one per
+ * thing another app can ask Decidiq to do, and each pair costs that class two
+ * more imports — enough to push it past the coupling threshold, which is how
+ * this extraction was found rather than guessed.
+ *
+ * Per ADR-041 a cross-app COMMAND travels as a typed event. Decidiq's REST
+ * controllers are the door for EXTERNAL callers; they refuse a request with no
+ * signed-in user, which is exactly the state an in-process migration runs in.
+ *
+ * @category AppInfo
+ * @package  OCA\Decidiq\AppInfo\Registrar
+ *
+ * @author    Conduction Development Team <info@conduction.nl>
+ * @copyright 2026 Conduction B.V.
+ * @license   EUPL-1.2 https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
+ *
+ * @link https://conduction.nl
+ *
+ * @spec openspec/changes/approval-route-events/specs/approval-route-events/spec.md
+ *
+ * SPDX-FileCopyrightText: 2026 Conduction B.V. <info@conduction.nl>
+ * SPDX-License-Identifier: EUPL-1.2
+ */
+
+declare(strict_types=1);
+
+namespace OCA\Decidiq\AppInfo\Registrar;
+
+use OCA\Decidiq\Event\ApprovalActionRequestedEvent;
+use OCA\Decidiq\Event\ApprovalRouteRequestedEvent;
+use OCA\Decidiq\Event\DecisionRequestedEvent;
+use OCA\Decidiq\Event\GovernanceBodyRequestedEvent;
+use OCA\Decidiq\Listener\ApprovalActionRequestedListener;
+use OCA\Decidiq\Listener\ApprovalRouteRequestedListener;
+use OCA\Decidiq\Listener\DecisionRequestedListener;
+use OCA\Decidiq\Listener\GovernanceBodyRequestedListener;
+use OCP\AppFramework\Bootstrap\IRegistrationContext;
+
+/**
+ * Registers every inbound cross-app command listener.
+ *
+ * @spec openspec/changes/approval-route-events/specs/approval-route-events/spec.md
+ */
+class CrossAppEventRegistrar {
+
+	/**
+	 * The command contract, as event class => listener class.
+	 *
+	 * A map rather than four call sites, so adding a command is one line and
+	 * the whole inbound surface reads as one list.
+	 *
+	 * @var array<class-string, class-string>
+	 */
+	private const COMMANDS = [
+		// Raise a governance Decision for a consumer's object, and conclude it
+		// back through DecisionConcludedEvent.
+		DecisionRequestedEvent::class => DecisionRequestedListener::class,
+
+		// Hold a governance body — a committee, a board — with its roster.
+		GovernanceBodyRequestedEvent::class => GovernanceBodyRequestedListener::class,
+
+		// Hold a sign-off route, and travel a subject down it. Both delegate to
+		// the EXISTING ApprovalRouteService: these add a door, not a second
+		// engine, so the event path and the REST path cannot answer differently
+		// for the same action.
+		ApprovalRouteRequestedEvent::class => ApprovalRouteRequestedListener::class,
+		ApprovalActionRequestedEvent::class => ApprovalActionRequestedListener::class,
+	];
+
+	/**
+	 * Register every command listener.
+	 *
+	 * @param IRegistrationContext $context The registration context.
+	 *
+	 * @return void
+	 *
+	 * @spec openspec/changes/approval-route-events/specs/approval-route-events/spec.md
+	 */
+	public function register(IRegistrationContext $context): void {
+		foreach (self::COMMANDS as $event => $listener) {
+			$context->registerEventListener(event: $event, listener: $listener);
+		}
+
+	}//end register()
+
+}//end class

lib/AppInfo/Registrar/DomainServiceRegistrar.php

@@ -32,8 +32,6 @@
 
 namespace OCA\Decidiq\AppInfo\Registrar;
 
-use OCA\Decidiq\Event\DecisionRequestedEvent;
-use OCA\Decidiq\Listener\DecisionRequestedListener;
 use OCA\Decidiq\Mcp\DecidiqToolProvider;
 use OCA\Decidiq\Service\EIDASSignatureService;
 use OCA\Decidiq\Service\IEIDASSignatureService;
@@ -73,35 +71,12 @@ class DomainServiceRegistrar {
 	 * @spec openspec/specs/mcp-tools/spec.md
 	 */
 	public function register(IRegistrationContext $context): void {
-		$this->registerDecisionEvents(context: $context);
 		$this->registerMcpToolProvider(context: $context);
 		$this->registerEidasBindings(context: $context);
 		$this->registerTranslationAdapter(context: $context);
 
 	}//end register()
 
-	/**
-	 * The event contract for delegated decisions.
-	 *
-	 * Consumer apps dispatch DecisionRequestedEvent (handled here ->
-	 * createDecision) and listen for DecisionConcludedEvent (emitted from
-	 * DecisionLifecycleService). In-process replacement for the broken
-	 * IntegrationService::getLeaf path.
-	 *
-	 * @param IRegistrationContext $context The registration context
-	 *
-	 * @return void
-	 *
-	 * @spec openspec/changes/decidesk-decision-events/specs/decidesk-decision-events/spec.md
-	 */
-	private function registerDecisionEvents(IRegistrationContext $context): void {
-		$context->registerEventListener(
-			event: DecisionRequestedEvent::class,
-			listener: DecisionRequestedListener::class
-		);
-
-	}//end registerDecisionEvents()
-
 	/**
 	 * Register DecidiqToolProvider as the MCP tool provider for the AI Chat Companion.
 	 *