@hotmeshio/long-tail 0.10.1 → 0.10.3

package/README.md

@@ -231,6 +231,7 @@ All modes share PostgreSQL and scale independently. See [Cloud Deployment](https
 | [Compiler](https://github.com/hotmeshio/long-tail/blob/main/docs/compiler.md) | `ltc compile` — durable TypeScript to YAML DAGs |
 | [CLI](https://github.com/hotmeshio/long-tail/blob/main/docs/cli.md) | `ltc` — terminal access to workflows, escalations, knowledge, MCP |
 | [Escalation Strategies](https://github.com/hotmeshio/long-tail/blob/main/docs/escalation-strategies.md) | Default, MCP triage, custom handlers |
+| [Schema Enforcement](https://github.com/hotmeshio/long-tail/blob/main/docs/schema-enforcement.md) | form_schema as an enforced API contract on every resolve surface |
 | [Faceted Routing](https://github.com/hotmeshio/long-tail/blob/main/docs/faceted-routing.md) | Query and atomically claim the queue by facets; dispatcher pattern |
 | [SDK](https://github.com/hotmeshio/long-tail/blob/main/docs/sdk.md) | Embedded usage, `createClient`, event subscriptions |
 | [Architecture](https://github.com/hotmeshio/long-tail/blob/main/docs/architecture.md) | Project structure, conventions, discovery |

package/build/api/bot-accounts.d.ts

@@ -4,11 +4,15 @@ import type { LTApiResult, LTApiAuth } from '../types/sdk';
  *
  * @param input.limit — maximum number of bots to return (default 50)
  * @param input.offset — number of bots to skip for pagination (default 0)
+ * @param input.status — filter by account status
+ * @param input.search — free-text match on display name, external id, or description
  * @returns `{ status: 200, data: Bot[] }` paginated list of bots
  */
 export declare function listBots(input: {
     limit?: number;
     offset?: number;
+    status?: string;
+    search?: string;
 }): Promise<LTApiResult>;
 /**
  * Retrieve a single bot account by ID.

package/build/api/bot-accounts.js

@@ -51,13 +51,15 @@ const user_1 = require("../services/user");
  *
  * @param input.limit — maximum number of bots to return (default 50)
  * @param input.offset — number of bots to skip for pagination (default 0)
+ * @param input.status — filter by account status
+ * @param input.search — free-text match on display name, external id, or description
  * @returns `{ status: 200, data: Bot[] }` paginated list of bots
  */
 async function listBots(input) {
     try {
         const limit = input.limit ?? 50;
         const offset = input.offset ?? 0;
-        const result = await iam.listBots(limit, offset);
+        const result = await iam.listBots(limit, offset, { status: input.status, search: input.search });
         return { status: 200, data: result };
     }
     catch (err) {

package/build/api/escalations/metadata.js

@@ -38,6 +38,9 @@ exports.claimByMetadata = claimByMetadata;
 exports.resolveByMetadata = resolveByMetadata;
 const escalationService = __importStar(require("../../services/escalation"));
 const helpers_1 = require("./helpers");
+const resolver_validation_1 = require("../../services/escalation/resolver-validation");
+const enforcement_cache_1 = require("../../services/role/enforcement-cache");
+const resolve_1 = require("./resolve");
 /**
  * Find escalations by a metadata key-value pair.
  *
@@ -130,7 +133,24 @@ async function resolveByMetadata(input, auth) {
         const writeScope = await (0, helpers_1.getEscalationWriteScope)(auth.userId);
         const writeAllRoles = writeScope.global ? null : writeScope.allRoles;
         const writeSelfRoles = writeScope.global ? null : writeScope.selfRoles;
-        const result = await escalationService.resolveByMetadataAtomic(input.key, input.value, resolveUserId, input.resolverPayload, input.metadata, writeAllRoles, writeSelfRoles);
+        // Schema enforcement rides the atomic statement: with the cached enforcing
+        // set empty (the common case) the single-call behavior is unchanged. When
+        // the picked row's role enforces, the statement returns the row WITHOUT
+        // writing; the payload validates here, then a second asserted pass claims
+        // + resolves the same row with pending re-checked inside the statement.
+        const enforcing = await (0, enforcement_cache_1.getEnforcingRoles)();
+        let result = await escalationService.resolveByMetadataAtomic(input.key, input.value, resolveUserId, input.resolverPayload, input.metadata, writeAllRoles, writeSelfRoles, enforcing.size > 0 ? [...enforcing] : null);
+        if (result.outcome === 'validation_required' && result.row) {
+            const report = await (0, resolver_validation_1.checkResolverPayload)(result.row, input.resolverPayload);
+            if (report)
+                return (0, resolve_1.validationFailure)(report);
+            result = await escalationService.resolveByMetadataAtomic(input.key, input.value, resolveUserId, input.resolverPayload, input.metadata, writeAllRoles, writeSelfRoles, null, result.row.id);
+            // The asserted row left pending between the two passes — a concurrent
+            // resolution won the row; surface it as the conflict it is.
+            if (result.outcome === 'not_found') {
+                return { status: 409, error: 'A concurrent resolution is already in progress for this escalation' };
+            }
+        }
         if (result.outcome === 'not_found') {
             return { status: 404, error: 'No pending escalation found for this metadata, or insufficient role permissions' };
         }

package/build/api/escalations/resolve.d.ts

@@ -1,3 +1,4 @@
+import type { ResolverSchemaViolationReport } from '../../services/escalation/resolver-validation';
 import type { LTApiResult, LTApiAuth } from '../../types/sdk';
 /**
  * Resolve a pending escalation with a human-provided payload.
@@ -72,3 +73,10 @@ export declare function resolveAllOrNone(input: {
     metadata?: Record<string, any>;
     requireClaimed?: boolean;
 }, auth: LTApiAuth): Promise<LTApiResult>;
+/**
+ * The canonical 422 for a schema-validation rejection. The full body rides in
+ * `data` (routes serialize `data ?? { error }`), so every transport — HTTP,
+ * SDK, CLI, dashboard — receives the same shape: error, code, violations,
+ * role, schemaVersion. `code` also sits on the envelope for SDK branching.
+ */
+export declare function validationFailure(report: ResolverSchemaViolationReport): LTApiResult;

package/build/api/escalations/resolve.js

@@ -37,6 +37,7 @@ exports.resolveEscalation = resolveEscalation;
 exports.resolveBySignalKey = resolveBySignalKey;
 exports.resolveByIds = resolveByIds;
 exports.resolveAllOrNone = resolveAllOrNone;
+exports.validationFailure = validationFailure;
 const escalationService = __importStar(require("../../services/escalation"));
 const taskService = __importStar(require("../../services/task"));
 const escalation_strategy_1 = require("../../services/escalation-strategy");
@@ -45,6 +46,8 @@ const deployer_1 = require("../../services/yaml-workflow/deployer");
 const workers_1 = require("../../workers");
 const defaults_1 = require("../../modules/defaults");
 const helpers_1 = require("./helpers");
+const resolver_validation_1 = require("../../services/escalation/resolver-validation");
+const enforcement_cache_1 = require("../../services/role/enforcement-cache");
 // ── Orchestrator ─────────────────────────────────────────────────────────
 /**
  * Resolve a pending escalation with a human-provided payload.
@@ -90,6 +93,13 @@ async function resolveEscalation(input, auth) {
         const stale = (0, helpers_1.assertLiveClaimant)(auth.userId, escalation);
         if (stale)
             return stale;
+        // Schema enforcement (enforce_schema roles): validate the payload against
+        // the escalation's resolved form schema BEFORE any resolution path runs.
+        // Costs nothing when the role does not enforce (cached role set); the
+        // task-fallback envelope read only happens for enforcing roles.
+        const violation = await (0, resolver_validation_1.checkResolverPayload)(escalation, resolverPayload, () => reconstructEnvelope(escalation));
+        if (violation)
+            return validationFailure(violation);
         // The resolver payload is stored exactly as submitted — its shape is the
         // workflow's contract, formed by the caller (the React app maps the form to
         // the payload via x-lt-bind before submitting). No server-side transform.
@@ -161,6 +171,11 @@ async function resolveBySignalKey(input, auth) {
         const denied = await (0, helpers_1.assertWriteAccess)(auth.userId, escalation);
         if (denied)
             return { status: 404, error: 'Escalation not found' };
+        // Schema enforcement — the row (envelope included) is already loaded, so
+        // this costs zero extra reads beyond the cached schema.
+        const violation = await (0, resolver_validation_1.checkResolverPayload)(escalation, resolverPayload);
+        if (violation)
+            return validationFailure(violation);
         // The payload is delivered as the signal the parked workflow's condition()
         // receives — stored exactly as submitted (the caller formed its shape).
         return resolveViaSignalKey(escalation, resolverPayload, metadata);
@@ -195,17 +210,39 @@ async function resolveByIds(input, auth) {
         // resolve any item in the role; write_self roles may resolve only items assigned
         // to the caller (same rule single-resolve applies via assertWriteAccess). Global
         // bypasses. A missing id or any out-of-scope item → 404 (non-disclosure), and
-        // nothing is resolved.
+        // nothing is resolved. The scope-row read is shared with the enforcement
+        // gate below — one indexed read serves both.
         const writeScope = await (0, helpers_1.getEscalationWriteScope)(auth.userId);
+        const enforcing = await (0, enforcement_cache_1.getEnforcingRoles)();
+        let scopeRows = null;
         if (!writeScope.global) {
             const allSet = new Set(writeScope.allRoles);
             const selfSet = new Set(writeScope.selfRoles);
-            const rows = await escalationService.getEscalationScopeRows(ids);
+            scopeRows = await escalationService.getEscalationScopeRows(ids);
             const writable = (r) => allSet.has(r.role) || (selfSet.has(r.role) && r.assigned_to === auth.userId);
-            if (rows.length !== ids.length || !rows.every(writable)) {
+            if (scopeRows.length !== ids.length || !scopeRows.every(writable)) {
                 return { status: 404, error: 'One or more escalations not found' };
             }
         }
+        // Schema enforcement (enforce_schema roles): with the cached enforcing set
+        // empty this path adds zero reads. Otherwise the scope rows identify which
+        // targets enforce, and only those rows load in full for validation — the
+        // one payload is validated against each enforcing row's own context.
+        if (enforcing.size > 0) {
+            const rows = scopeRows ?? await escalationService.getEscalationScopeRows(ids);
+            const involved = rows.filter((r) => enforcing.has(r.role)).map((r) => r.id);
+            if (involved.length > 0) {
+                const fullRows = await escalationService.getEscalationsByIds(involved);
+                const failed = [];
+                for (const row of fullRows) {
+                    const report = await (0, resolver_validation_1.checkResolverPayload)(row, resolverPayload);
+                    if (report)
+                        failed.push({ id: row.id, report });
+                }
+                if (failed.length > 0)
+                    return bulkValidationFailure(failed);
+            }
+        }
         const resolved = await escalationService.resolveEscalationsByIds(ids, resolverPayload, metadata);
         return { status: 200, data: { resolved: resolved.length, escalationIds: resolved.map((e) => e.id) } };
     }
@@ -286,6 +323,24 @@ async function resolveAllOrNone(input, auth) {
             const error = 'One or more escalations require the single-resolve path (legacy signal routing)';
             return { status: 409, error, data: { error, failedIds: failed.map((f) => f.id), failed } };
         }
+        // Schema enforcement (enforce_schema roles): every item validates against
+        // its own row's context before ANYTHING resolves — all-or-none extends to
+        // validation. Rows are already in hand, so the only added reads are the
+        // cached schemas of enforcing roles.
+        const enforcing = await (0, enforcement_cache_1.getEnforcingRoles)();
+        if (enforcing.size > 0) {
+            const failed = [];
+            for (const item of items) {
+                const row = rowById.get(item.id);
+                if (!row || !row.role || !enforcing.has(row.role))
+                    continue;
+                const report = await (0, resolver_validation_1.checkResolverPayload)(row, item.resolverPayload);
+                if (report)
+                    failed.push({ id: item.id, report });
+            }
+            if (failed.length > 0)
+                return bulkValidationFailure(failed);
+        }
         // Per-row password redaction against each row's own form schema — the
         // payload enters the signal store and the audit record; plaintext never.
         const serviceItems = await Promise.all(items.map(async (item) => ({
@@ -448,6 +503,30 @@ function signaledResult(escalation, workflowId) {
         data: { signaled: true, escalationId: escalation.id, workflowId },
     };
 }
+/**
+ * The canonical 422 for a schema-validation rejection. The full body rides in
+ * `data` (routes serialize `data ?? { error }`), so every transport — HTTP,
+ * SDK, CLI, dashboard — receives the same shape: error, code, violations,
+ * role, schemaVersion. `code` also sits on the envelope for SDK branching.
+ */
+function validationFailure(report) {
+    const body = (0, resolver_validation_1.toValidationErrorBody)(report);
+    return { status: 422, error: body.error, code: body.code, data: body };
+}
+/**
+ * The bulk-surface 422: violations from every failing row, each tagged with
+ * its escalationId so callers can attribute them. Role/schemaVersion echo the
+ * first failing report (bulk resolves target homogeneous role groups).
+ */
+function bulkValidationFailure(failed) {
+    const violations = failed.flatMap(({ id, report }) => report.violations.map((v) => ({ ...v, escalationId: id })));
+    const body = {
+        ...(0, resolver_validation_1.toValidationErrorBody)(failed[0].report),
+        error: `resolverPayload failed schema validation for ${failed.length} escalation${failed.length === 1 ? '' : 's'} (${violations.length} violation${violations.length === 1 ? '' : 's'})`,
+        violations,
+    };
+    return { status: 422, error: body.error, code: body.code, data: body };
+}
 /** Replace password fields with ephemeral tokens so plaintext never enters the signal store. */
 async function redactPasswords(payload, formSchema) {
     if (!formSchema?.properties)

package/build/api/me.d.ts

@@ -0,0 +1,16 @@
+import type { LTApiResult, LTApiAuth } from '../types/sdk';
+/**
+ * The caller's preferences document — a generic per-user JSON store for
+ * presentation state (pinned views are the first tenant). Always an object;
+ * an unset store reads as {}.
+ */
+export declare function getMyPreferences(auth: LTApiAuth): Promise<LTApiResult>;
+/**
+ * Shallow-merge a patch into the caller's preferences. Top-level keys
+ * overwrite; a `null` value deletes its key. The patch and the merged
+ * document are both size-capped; the merge itself is a single guarded
+ * UPDATE (no read-then-write).
+ */
+export declare function patchMyPreferences(input: {
+    patch: unknown;
+}, auth: LTApiAuth): Promise<LTApiResult>;

package/build/api/me.js

@@ -0,0 +1,79 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getMyPreferences = getMyPreferences;
+exports.patchMyPreferences = patchMyPreferences;
+const userService = __importStar(require("../services/user"));
+// ── Self-service surface (/api/me) ─────────────────────────────────────────
+// Operations on the AUTHENTICATED user only — no ids, no admin gates.
+/**
+ * The caller's preferences document — a generic per-user JSON store for
+ * presentation state (pinned views are the first tenant). Always an object;
+ * an unset store reads as {}.
+ */
+async function getMyPreferences(auth) {
+    try {
+        const preferences = await userService.getPreferences(auth.userId);
+        return { status: 200, data: { preferences } };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}
+/**
+ * Shallow-merge a patch into the caller's preferences. Top-level keys
+ * overwrite; a `null` value deletes its key. The patch and the merged
+ * document are both size-capped; the merge itself is a single guarded
+ * UPDATE (no read-then-write).
+ */
+async function patchMyPreferences(input, auth) {
+    try {
+        const { patch } = input;
+        if (!patch || typeof patch !== 'object' || Array.isArray(patch)) {
+            return { status: 400, error: 'Body must be a JSON object of preference keys' };
+        }
+        if (JSON.stringify(patch).length > userService.PREFERENCES_MAX_BYTES) {
+            return { status: 413, error: `Preferences patch exceeds ${userService.PREFERENCES_MAX_BYTES} bytes` };
+        }
+        const preferences = await userService.patchPreferences(auth.userId, patch);
+        if (preferences === null) {
+            return { status: 413, error: `Merged preferences would exceed ${userService.PREFERENCES_MAX_BYTES} bytes` };
+        }
+        return { status: 200, data: { preferences } };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}

package/build/api/roles.d.ts

@@ -88,6 +88,12 @@ export declare function updateRole(input: {
     metadata_schema?: Record<string, any> | null;
     /** The escalation LIST schema — rich formatting for this role's list page. */
     list_schema?: Record<string, any> | null;
+    /** Pinned-view seeds for the role's members: [{ label, url, badge? }] or null to clear. */
+    default_pins?: {
+        label: string;
+        url: string;
+        badge?: boolean;
+    }[] | null;
     properties?: Record<string, any> | null;
     ops_visible?: boolean;
     parent_role?: string | null;
@@ -98,6 +104,8 @@ export declare function updateRole(input: {
     priority_threshold_minutes?: number | null;
     /** Escalation metadata key holding the age origin (ISO 8601 UTC timestamp). Falls back to created_at. */
     priority_facet?: string | null;
+    /** Turn server-side resolver schema validation on/off for this role. */
+    enforce_schema?: boolean;
     /** Replace the upstream-input set (omitted = preserve; null or [] = clear). */
     upstream_roles?: string[] | null;
     /** Recorded on the schema snapshot when this update changes a schema field. */

package/build/api/roles.js

@@ -225,9 +225,21 @@ async function updateRole(input) {
         if (input.ops_visible !== undefined && typeof input.ops_visible !== 'boolean') {
             return { status: 400, error: 'ops_visible must be a boolean' };
         }
+        if (input.enforce_schema !== undefined && typeof input.enforce_schema !== 'boolean') {
+            return { status: 400, error: 'enforce_schema must be a boolean' };
+        }
         if (input.parent_role != null && input.parent_role === input.role) {
             return { status: 400, error: 'parent_role must reference a different role' };
         }
+        if (input.default_pins != null) {
+            const pinsValid = Array.isArray(input.default_pins) && input.default_pins.every((p) => p && typeof p === 'object'
+                && typeof p.label === 'string' && p.label.trim() !== ''
+                && typeof p.url === 'string' && p.url.startsWith('/')
+                && (p.badge === undefined || typeof p.badge === 'boolean'));
+            if (!pinsValid) {
+                return { status: 400, error: 'default_pins must be [{ label, url, badge? }] with dashboard-relative urls' };
+            }
+        }
         if (input.upstream_roles != null) {
             if (!Array.isArray(input.upstream_roles) || input.upstream_roles.some((u) => typeof u !== 'string' || !u.trim())) {
                 return { status: 400, error: 'upstream_roles must be an array of role names' };
@@ -247,6 +259,7 @@ async function updateRole(input) {
             form_schema: input.form_schema,
             metadata_schema: input.metadata_schema,
             list_schema: input.list_schema,
+            default_pins: input.default_pins,
             properties: input.properties,
             ops_visible: input.ops_visible,
             parent_role: input.parent_role,
@@ -255,6 +268,7 @@ async function updateRole(input) {
             worker_count: input.worker_count,
             priority_threshold_minutes: input.priority_threshold_minutes,
             priority_facet: input.priority_facet,
+            enforce_schema: input.enforce_schema,
             upstream_roles: input.upstream_roles,
             change_summary: input.change_summary,
         });

package/build/bin/ltc.js

@@ -62,7 +62,16 @@ const envLoaded = fs.existsSync(envPath);
 // ── Error handler ────────────────────────────────────────────────────────
 function handleError(err) {
     const msg = err.message || String(err);
-    console.error(`\n  ${picocolors_1.default.red('✗')} ${msg}\n`);
+    console.error(`\n  ${picocolors_1.default.red('✗')} ${msg}`);
+    // Schema-validation rejections carry field-level violations — print each
+    // one the way the dashboard's errors panel lists them.
+    if (Array.isArray(err.violations)) {
+        for (const v of err.violations) {
+            const where = v.escalationId ? `${v.escalationId} · ${v.field}` : v.field;
+            console.error(`    ${picocolors_1.default.dim('·')} ${picocolors_1.default.bold(where)} — ${v.message}`);
+        }
+    }
+    console.error('');
     process.exit(1);
 }
 function wrap(fn) {

package/build/lib/cli/client.d.ts

@@ -1,6 +1,9 @@
+import { type LTFieldViolation } from '../../types/validation';
 export declare class CLIError extends Error {
     status?: number | undefined;
-    constructor(message: string, status?: number | undefined);
+    /** Field-level violations from a schema_validation 422, when present. */
+    violations?: LTFieldViolation[];
+    constructor(message: string, status?: number | undefined, violations?: LTFieldViolation[]);
 }
 /** Authenticated fetch against the Long Tail API */
 export declare function apiFetch<T = any>(path: string, options?: RequestInit): Promise<T>;

package/build/lib/cli/client.js

@@ -3,11 +3,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CLIError = void 0;
 exports.apiFetch = apiFetch;
 const auth_1 = require("./auth");
+const validation_1 = require("../../types/validation");
 class CLIError extends Error {
-    constructor(message, status) {
+    constructor(message, status, violations) {
         super(message);
         this.status = status;
         this.name = 'CLIError';
+        this.violations = violations;
     }
 }
 exports.CLIError = CLIError;
@@ -25,7 +27,7 @@ async function apiFetch(path, options) {
     });
     const body = await res.json().catch(() => ({ error: `HTTP ${res.status}` }));
     if (!res.ok) {
-        throw new CLIError(body.error || `HTTP ${res.status}`, res.status);
+        throw new CLIError(body.error || `HTTP ${res.status}`, res.status, (0, validation_1.isValidationErrorBody)(body) ? body.violations : undefined);
     }
     return body;
 }

package/build/lib/db/schemas/022_user_preferences.sql

@@ -0,0 +1,18 @@
+-- Migration 022: Per-user preferences + role default pins
+--
+-- lt_users.preferences is a generic per-user JSON store (pinned views are the
+-- first tenant, not the schema): read via GET /api/me/preferences, written via
+-- PATCH with shallow top-level merge (null deletes a key), size-capped at the
+-- API layer. Preferences carry presentation state only — never data and never
+-- authorization; read-scope enforcement stays with the queries a preference
+-- may point at.
+--
+-- lt_roles.default_pins seeds a role's members with the persona's starting
+-- pinned views ([{ label, url, badge? }]). Users promote, hide, or reorder
+-- them through their own preferences.
+
+ALTER TABLE lt_users
+  ADD COLUMN IF NOT EXISTS preferences JSONB;
+
+ALTER TABLE lt_roles
+  ADD COLUMN IF NOT EXISTS default_pins JSONB;

package/build/lib/db/schemas/023_role_enforce_schema.sql

@@ -0,0 +1,18 @@
+-- Migration 023: Role-level resolver schema enforcement
+--
+-- enforce_schema makes the role's form_schema an enforced API contract: every
+-- resolve surface (by id, by signal key, by ids, all-or-none, by metadata, and
+-- the MCP resolve tools) validates the submitted resolverPayload against the
+-- escalation's resolved form schema (metadata.form_schema override, else the
+-- pinned lt_role_schemas snapshot, else the role's latest) and rejects
+-- violations with 422 before any state changes. The validation pass is the
+-- same isomorphic code the dashboard runs pre-submission, so a payload that
+-- passes the client panel passes the gate and a 422 carries the identical
+-- field-error list.
+--
+-- Opt-in per role (default false) so surfaces migrate deliberately: flip it on
+-- a role once its submitters (dashboard, sim workforce, webhooks) are known to
+-- send complete payloads. Roles with it off resolve exactly as before.
+
+ALTER TABLE lt_roles
+  ADD COLUMN IF NOT EXISTS enforce_schema BOOLEAN NOT NULL DEFAULT false;

package/build/lib/typed-resolution.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Typed resolution parsing — the workflow-side half of the resolver contract.
+ *
+ * Server-side enforcement (enforce_schema roles) guarantees a resolution
+ * matched the role's form schema when it was submitted. This module gives
+ * workflow and activity code the consuming half: declare the payload shape
+ * once as a zod schema, and parse the resolution through it to get a TYPED
+ * value with runtime assurance — a drifted or legacy payload fails loud here
+ * instead of propagating `any` into business logic.
+ *
+ *   const IntakeV1 = z.object({ customer: z.object({ name: z.string() }) });
+ *   const intake = parseResolverPayload(IntakeV1, response);
+ *   intake.customer.name; // typed AND runtime-checked
+ */
+import type { ZodType } from 'zod';
+import type { LTFieldViolation } from '../types/validation';
+/**
+ * A resolution that failed its declared zod schema. Carries the same
+ * `{ field, message }` violation list the validation surfaces use, and the
+ * original ZodError as `cause`.
+ */
+export declare class ResolverPayloadTypeError extends Error {
+    violations: LTFieldViolation[];
+    cause?: unknown;
+    constructor(violations: LTFieldViolation[], options?: {
+        cause?: unknown;
+    });
+}
+/**
+ * Parse a resolution payload through its declared zod schema. Returns the
+ * typed value; throws {@link ResolverPayloadTypeError} when the payload does
+ * not conform. The generic flows from the schema to the return value — no
+ * casting at the call site.
+ */
+export declare function parseResolverPayload<T>(schema: ZodType<T>, payload: unknown): T;

package/build/lib/typed-resolution.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ResolverPayloadTypeError = void 0;
+exports.parseResolverPayload = parseResolverPayload;
+/**
+ * A resolution that failed its declared zod schema. Carries the same
+ * `{ field, message }` violation list the validation surfaces use, and the
+ * original ZodError as `cause`.
+ */
+class ResolverPayloadTypeError extends Error {
+    constructor(violations, options) {
+        const n = violations.length;
+        super(`resolver payload failed its declared schema (${n} violation${n === 1 ? '' : 's'}): `
+            + violations.map((v) => `${v.field}: ${v.message}`).join('; '));
+        this.name = 'ResolverPayloadTypeError';
+        this.violations = violations;
+        this.cause = options?.cause;
+    }
+}
+exports.ResolverPayloadTypeError = ResolverPayloadTypeError;
+/**
+ * Parse a resolution payload through its declared zod schema. Returns the
+ * typed value; throws {@link ResolverPayloadTypeError} when the payload does
+ * not conform. The generic flows from the schema to the return value — no
+ * casting at the call site.
+ */
+function parseResolverPayload(schema, payload) {
+    const result = schema.safeParse(payload);
+    if (!result.success) {
+        const violations = result.error.issues.map((issue) => ({
+            field: issue.path.length > 0 ? issue.path.join('.') : '(root)',
+            message: issue.message,
+        }));
+        throw new ResolverPayloadTypeError(violations, { cause: result.error });
+    }
+    return result.data;
+}

package/build/modules/config.d.ts

@@ -12,5 +12,6 @@ export declare const config: {
     NODE_ENV: string;
     JWT_SECRET: string;
     HONEYCOMB_API_KEY: string;
+    ROLE_ENFORCEMENT_CACHE_TTL_MS: number;
 };
 export declare const postgres_options: Record<string, unknown>;

package/build/modules/config.js

@@ -19,6 +19,11 @@ exports.config = {
     NODE_ENV: process.env.NODE_ENV || 'development',
     JWT_SECRET: process.env.JWT_SECRET || '',
     HONEYCOMB_API_KEY: process.env.HONEYCOMB_API_KEY || '',
+    // Resolver schema enforcement: TTL for the cached enforcing-role set and
+    // latest role form schemas. Bounds cross-container staleness after a role
+    // admin flips enforce_schema or edits a schema; pinned snapshots are
+    // immutable and cache indefinitely.
+    ROLE_ENFORCEMENT_CACHE_TTL_MS: parseInt(process.env.ROLE_ENFORCEMENT_CACHE_TTL_MS || '30000', 10),
 };
 exports.postgres_options = {
     host: exports.config.POSTGRES_HOST,

package/build/routes/bot-accounts.js

@@ -43,12 +43,14 @@ router.use(auth_1.requireBuilder);
 /**
  * GET /api/bot-accounts
  * List all bot accounts.
- * Query: ?limit=50&offset=0
+ * Query: ?limit=50&offset=0&status=active&search=mcp
  */
 router.get('/', async (req, res) => {
     const result = await api.listBots({
         limit: req.query.limit ? parseInt(req.query.limit, 10) : undefined,
         offset: req.query.offset ? parseInt(req.query.offset, 10) : undefined,
+        status: req.query.status || undefined,
+        search: req.query.search || undefined,
     });
     res.status(result.status).json(result.data ?? { error: result.error });
 });

package/build/routes/index.js

@@ -14,6 +14,7 @@ const escalations_1 = __importDefault(require("./escalations"));
 const workflows_1 = __importDefault(require("./workflows"));
 const exports_1 = __importDefault(require("./exports"));
 const users_1 = __importDefault(require("./users"));
+const me_1 = __importDefault(require("./me"));
 const roles_1 = __importDefault(require("./roles"));
 const dba_1 = __importDefault(require("./dba"));
 const maintenance_1 = __importDefault(require("./maintenance"));
@@ -51,6 +52,7 @@ router.use('/workflows', workflows_1.default);
 router.use('/workflow-states', exports_1.default);
 router.use('/config/maintenance', maintenance_1.default);
 router.use('/users', users_1.default);
+router.use('/me', me_1.default);
 router.use('/roles', roles_1.default);
 router.use('/dba', dba_1.default);
 router.use('/mcp', mcp_1.default);

package/build/routes/me.d.ts

@@ -0,0 +1,2 @@
+declare const router: import("express-serve-static-core").Router;
+export default router;