@hotmeshio/long-tail 0.10.10 → 0.10.13

package/build/api/escalations/list.d.ts

@@ -37,6 +37,7 @@ export declare function listEscalations(input: {
     type?: string;
     subtype?: string;
     assigned_to?: string;
+    parent_id?: string;
     claimed?: boolean;
     priority?: number;
     limit?: number;

package/build/api/escalations/list.js

@@ -40,6 +40,7 @@ exports.listDistinctTypes = listDistinctTypes;
 exports.getEscalationStats = getEscalationStats;
 exports.getStationMetrics = getStationMetrics;
 const escalationService = __importStar(require("../../services/escalation"));
+const features_1 = require("../../modules/features");
 const helpers_1 = require("./helpers");
 /** True when the caller asked for anything the plain list path can't express. */
 function hasFacetQuery(i) {
@@ -114,6 +115,7 @@ async function listEscalations(input, auth) {
             type: input.type,
             subtype: input.subtype,
             assigned_to: input.assigned_to,
+            parent_id: input.parent_id,
             claimed: input.claimed,
             priority: input.priority,
             limit: input.limit,
@@ -278,10 +280,16 @@ async function getStationMetrics(input, auth) {
     try {
         // Station metrics are aggregate queue-SHAPE counts (pending/claimed/resolved
         // + jeopardy) per role — the depth of a lane, not the disclosure of any one
-        // item. Membership in a role entitles you to see its shape, so this view
-        // spans every role the user belongs to, including read_scope='self' roles
-        // (whose per-item lists stay narrowed elsewhere). Without the selfRoles
-        // union, a self-scoped operator would see an empty board on their own lanes.
+        // item. With publicPaceBoard (the default) every authenticated caller sees
+        // every station: the board is trends, and per-item lists stay behind their
+        // own RBAC. With the flag off, the view narrows to role membership,
+        // including read_scope='self' roles (whose per-item lists stay narrowed
+        // elsewhere) — without the selfRoles union, a self-scoped operator would
+        // see an empty board on their own lanes.
+        if ((0, features_1.getFeatureFlags)().publicPaceBoard) {
+            const stations = await escalationService.getStationMetrics(undefined, input.period);
+            return { status: 200, data: { stations } };
+        }
         const scope = await (0, helpers_1.getEscalationReadScope)(auth.userId);
         const memberRoles = [...scope.allRoles, ...scope.selfRoles];
         if (!scope.global && memberRoles.length === 0) {

package/build/api/escalations/metadata.d.ts

@@ -1,5 +1,13 @@
 import { type ProvisionIfAbsent } from './helpers';
 import type { LTApiAuth, LTApiResult } from '../../types/sdk';
+/**
+ * Intersect the caller's scope roles with an optional caller-supplied
+ * restriction (e.g. a scan step's expected queues). Global scope with no
+ * restriction stays unfiltered (null); a restriction always applies. An
+ * empty intersection returns [] — which matches nothing in the SQL filter,
+ * the correct fail-closed outcome.
+ */
+export declare function restrictScopeRoles(scopeRoles: string[], global: boolean, restrictRoles?: string[]): string[] | null;
 /**
  * Find escalations by a metadata key-value pair.
  *
@@ -27,6 +35,7 @@ export declare function claimByMetadata(input: {
     assignee?: string;
     metadata?: Record<string, any>;
     provisionIfAbsent?: ProvisionIfAbsent;
+    restrictRoles?: string[];
 }, auth: LTApiAuth): Promise<LTApiResult>;
 /**
  * Resolve an escalation by metadata key-value pair.
@@ -46,4 +55,6 @@ export declare function resolveByMetadata(input: {
     resolverPayload: Record<string, any>;
     assignee?: string;
     metadata?: Record<string, any>;
+    restrictRoles?: string[];
+    extraFacets?: Record<string, any>;
 }, auth: LTApiAuth): Promise<LTApiResult>;

package/build/api/escalations/metadata.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.restrictScopeRoles = restrictScopeRoles;
 exports.findByMetadata = findByMetadata;
 exports.claimByMetadata = claimByMetadata;
 exports.resolveByMetadata = resolveByMetadata;
@@ -41,6 +42,20 @@ const helpers_1 = require("./helpers");
 const resolver_validation_1 = require("../../services/escalation/resolver-validation");
 const enforcement_cache_1 = require("../../services/role/enforcement-cache");
 const resolve_1 = require("./resolve");
+/**
+ * Intersect the caller's scope roles with an optional caller-supplied
+ * restriction (e.g. a scan step's expected queues). Global scope with no
+ * restriction stays unfiltered (null); a restriction always applies. An
+ * empty intersection returns [] — which matches nothing in the SQL filter,
+ * the correct fail-closed outcome.
+ */
+function restrictScopeRoles(scopeRoles, global, restrictRoles) {
+    if (!restrictRoles || restrictRoles.length === 0)
+        return global ? null : scopeRoles;
+    if (global)
+        return restrictRoles;
+    return scopeRoles.filter((r) => restrictRoles.includes(r));
+}
 /**
  * Find escalations by a metadata key-value pair.
  *
@@ -85,9 +100,10 @@ async function claimByMetadata(input, auth) {
         // Write-scope: global → no filter; otherwise restrict to write_all roles. The
         // SDK claim-by-metadata uses a flat role filter and cannot enforce write_self
         // ownership, so self-scope members are excluded from this path (their items
-        // are pre-claimed and acted on by id).
+        // are pre-claimed and acted on by id). An optional caller restriction
+        // (expected queues) intersects with the scope inside the same SQL filter.
         const writeScope = await (0, helpers_1.getEscalationWriteScope)(auth.userId);
-        const allowedRoles = writeScope.global ? null : writeScope.allRoles;
+        const allowedRoles = restrictScopeRoles(writeScope.allRoles, writeScope.global, input.restrictRoles);
         const result = await escalationService.claimByMetadata(input.key, input.value, claimUserId, input.durationMinutes, input.metadata, allowedRoles);
         if (!result) {
             // No rows matched. Check if candidates existed (role mismatch vs no match).
@@ -129,22 +145,26 @@ async function resolveByMetadata(input, auth) {
         // Write-scope folds into the atomic resolve SQL: global → no filter; otherwise
         // write_all roles match any item, write_self roles match only items assigned
         // to the resolver. A non-global caller cannot pass a foreign assignee, so the
-        // self-branch (assigned_to = resolveUserId) is the caller's own items.
+        // self-branch (assigned_to = resolveUserId) is the caller's own items. An
+        // optional caller restriction (expected queues) intersects with both arrays
+        // inside the same SQL filter.
         const writeScope = await (0, helpers_1.getEscalationWriteScope)(auth.userId);
-        const writeAllRoles = writeScope.global ? null : writeScope.allRoles;
-        const writeSelfRoles = writeScope.global ? null : writeScope.selfRoles;
+        const writeAllRoles = restrictScopeRoles(writeScope.allRoles, writeScope.global, input.restrictRoles);
+        const writeSelfRoles = writeScope.global
+            ? (input.restrictRoles?.length ? [] : null)
+            : restrictScopeRoles(writeScope.selfRoles, false, input.restrictRoles);
         // Schema enforcement rides the atomic statement: with the cached enforcing
         // set empty (the common case) the single-call behavior is unchanged. When
         // the picked row's role enforces, the statement returns the row WITHOUT
         // writing; the payload validates here, then a second asserted pass claims
         // + resolves the same row with pending re-checked inside the statement.
         const enforcing = await (0, enforcement_cache_1.getEnforcingRoles)();
-        let result = await escalationService.resolveByMetadataAtomic(input.key, input.value, resolveUserId, input.resolverPayload, input.metadata, writeAllRoles, writeSelfRoles, enforcing.size > 0 ? [...enforcing] : null);
+        let result = await escalationService.resolveByMetadataAtomic(input.key, input.value, resolveUserId, input.resolverPayload, input.metadata, writeAllRoles, writeSelfRoles, enforcing.size > 0 ? [...enforcing] : null, null, input.extraFacets);
         if (result.outcome === 'validation_required' && result.row) {
             const report = await (0, resolver_validation_1.checkResolverPayload)(result.row, input.resolverPayload);
             if (report)
                 return (0, resolve_1.validationFailure)(report);
-            result = await escalationService.resolveByMetadataAtomic(input.key, input.value, resolveUserId, input.resolverPayload, input.metadata, writeAllRoles, writeSelfRoles, null, result.row.id);
+            result = await escalationService.resolveByMetadataAtomic(input.key, input.value, resolveUserId, input.resolverPayload, input.metadata, writeAllRoles, writeSelfRoles, null, result.row.id, input.extraFacets);
             // The asserted row left pending between the two passes — a concurrent
             // resolution won the row; surface it as the conflict it is.
             if (result.outcome === 'not_found') {

package/build/api/roles.d.ts

@@ -96,6 +96,8 @@ export declare function updateRole(input: {
     }[] | null;
     properties?: Record<string, any> | null;
     ops_visible?: boolean;
+    /** Make this role's sequence the home Pace Board's default segment (single-holder: setting it clears the previous holder). */
+    ops_home_default?: boolean;
     parent_role?: string | null;
     sla_minutes?: number | null;
     target_per_hour?: number | null;

package/build/api/roles.js

@@ -225,6 +225,9 @@ async function updateRole(input) {
         if (input.ops_visible !== undefined && typeof input.ops_visible !== 'boolean') {
             return { status: 400, error: 'ops_visible must be a boolean' };
         }
+        if (input.ops_home_default !== undefined && typeof input.ops_home_default !== 'boolean') {
+            return { status: 400, error: 'ops_home_default must be a boolean' };
+        }
         if (input.enforce_schema !== undefined && typeof input.enforce_schema !== 'boolean') {
             return { status: 400, error: 'enforce_schema must be a boolean' };
         }
@@ -262,6 +265,7 @@ async function updateRole(input) {
             default_pins: input.default_pins,
             properties: input.properties,
             ops_visible: input.ops_visible,
+            ops_home_default: input.ops_home_default,
             parent_role: input.parent_role,
             sla_minutes: input.sla_minutes,
             target_per_hour: input.target_per_hour,

package/build/api/scan-codes/config.d.ts

@@ -0,0 +1,22 @@
+import * as scanCodeService from '../../services/scan-code';
+import type { LTApiResult } from '../../types/sdk';
+export declare function listScanSchemes(): Promise<LTApiResult>;
+export declare function getScanScheme(input: {
+    version: number;
+}): Promise<LTApiResult>;
+export declare function upsertScanScheme(input: scanCodeService.ScanSchemeInput): Promise<LTApiResult>;
+export declare function deleteScanScheme(input: {
+    version: number;
+}): Promise<LTApiResult>;
+export declare function listScanRules(input: {
+    version: number;
+}): Promise<LTApiResult>;
+export declare function getScanRule(input: {
+    version: number;
+    category: string;
+}): Promise<LTApiResult>;
+export declare function upsertScanRule(input: scanCodeService.ScanRuleInput): Promise<LTApiResult>;
+export declare function deleteScanRule(input: {
+    version: number;
+    category: string;
+}): Promise<LTApiResult>;

package/build/api/scan-codes/config.js

@@ -0,0 +1,136 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.listScanSchemes = listScanSchemes;
+exports.getScanScheme = getScanScheme;
+exports.upsertScanScheme = upsertScanScheme;
+exports.deleteScanScheme = deleteScanScheme;
+exports.listScanRules = listScanRules;
+exports.getScanRule = getScanRule;
+exports.upsertScanRule = upsertScanRule;
+exports.deleteScanRule = deleteScanRule;
+const scanCodeService = __importStar(require("../../services/scan-code"));
+// ── Scheme CRUD ────────────────────────────────────────────────────────────
+// Admin gating happens at the transport layer (requireAdmin on routes, admin
+// MCP registration) — same convention as workflow config.
+async function listScanSchemes() {
+    try {
+        const schemes = await scanCodeService.listScanSchemes();
+        return { status: 200, data: { schemes } };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}
+async function getScanScheme(input) {
+    try {
+        const scheme = await scanCodeService.getScanScheme(input.version);
+        if (!scheme)
+            return { status: 404, error: `No scan scheme for version ${input.version}` };
+        const rules = await scanCodeService.listScanRules(input.version);
+        return { status: 200, data: { scheme, rules } };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}
+async function upsertScanScheme(input) {
+    try {
+        const scheme = await scanCodeService.upsertScanScheme(input);
+        return { status: 200, data: { scheme } };
+    }
+    catch (err) {
+        // Write-time invariant violations are caller errors, not server faults.
+        return { status: 400, error: err.message };
+    }
+}
+async function deleteScanScheme(input) {
+    try {
+        const deleted = await scanCodeService.deleteScanScheme(input.version);
+        if (!deleted)
+            return { status: 404, error: `No scan scheme for version ${input.version}` };
+        return { status: 200, data: { deleted: true } };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}
+// ── Rule CRUD ──────────────────────────────────────────────────────────────
+async function listScanRules(input) {
+    try {
+        const rules = await scanCodeService.listScanRules(input.version);
+        return { status: 200, data: { rules } };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}
+async function getScanRule(input) {
+    try {
+        const rule = await scanCodeService.getScanRule(input.version, input.category);
+        if (!rule) {
+            return { status: 404, error: `No scan rule for ${input.version}:${input.category}` };
+        }
+        return { status: 200, data: { rule } };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}
+async function upsertScanRule(input) {
+    try {
+        const scheme = await scanCodeService.getScanScheme(input.scheme_version);
+        if (!scheme) {
+            return { status: 404, error: `No scan scheme for version ${input.scheme_version} — create the scheme first` };
+        }
+        const rule = await scanCodeService.upsertScanRule(input);
+        return { status: 200, data: { rule } };
+    }
+    catch (err) {
+        return { status: 400, error: err.message };
+    }
+}
+async function deleteScanRule(input) {
+    try {
+        const deleted = await scanCodeService.deleteScanRule(input.version, input.category);
+        if (!deleted) {
+            return { status: 404, error: `No scan rule for ${input.version}:${input.category}` };
+        }
+        return { status: 200, data: { deleted: true } };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}

package/build/api/scan-codes/execute.d.ts

@@ -0,0 +1,9 @@
+import { type ScanExecuteRequest, type ScanExecuteResponse } from '../../types';
+import type { LTApiAuth, LTApiResult } from '../../types/sdk';
+/**
+ * Execute a raw scan code: parse → load the rule → walk its steps in order.
+ * The first step whose condition matches performs its verb and answers; a
+ * step that matches nothing falls through to the next. Every terminal state
+ * is a structured 200 outcome — the scan surface reports, it doesn't throw.
+ */
+export declare function executeScanCode(input: ScanExecuteRequest, auth: LTApiAuth): Promise<LTApiResult<ScanExecuteResponse>>;