@hotmeshio/long-tail 0.10.2 → 0.10.4

package/build/services/escalation/crud.d.ts

@@ -191,12 +191,16 @@ export declare function claimByMetadata(key: string, value: string, userId: stri
 }) | null>;
 export interface ResolveByMetadataResult {
     /**
-     * 'resolved'        = done atomically in SQL (no signal backing).
-     * 'signal_required' = signal backing present, caller must deliver the signal.
-     * 'conflict'        = signal_id row already claimed by a concurrent caller; skip re-signal.
-     * 'not_found'       = no pending escalation matched the metadata filter.
+     * 'resolved'            = done atomically in SQL (no signal backing).
+     * 'signal_required'     = signal backing present, caller must deliver the signal.
+     * 'conflict'            = signal_id row already claimed by a concurrent caller; skip re-signal.
+     * 'not_found'           = no pending escalation matched the metadata filter.
+     * 'validation_required' = the target's role enforces its schema; NOTHING was
+     *                         written. The caller validates the payload against
+     *                         `row`, then re-invokes with assertId = row.id (and
+     *                         no enforcing set) to claim + resolve.
      */
-    outcome: 'resolved' | 'signal_required' | 'conflict' | 'not_found';
+    outcome: 'resolved' | 'signal_required' | 'conflict' | 'not_found' | 'validation_required';
     /** The resolved escalation (when outcome = 'resolved') */
     escalation?: LTEscalationRecord;
     /** Legacy conditionLT signal info (when signalId is set, caller uses handle.signal) */
@@ -207,6 +211,14 @@ export interface ResolveByMetadataResult {
     workflowId?: string;
     workflowType?: string;
     taskQueue?: string;
+    /** The unmodified target row fields the schema gate validates against (when outcome = 'validation_required') */
+    row?: {
+        id: string;
+        role: string | null;
+        metadata: Record<string, any> | null;
+        envelope: string | null;
+        escalation_payload: string | null;
+    };
 }
 /**
  * Atomic resolve by metadata with signal guard, in a single CTE.
@@ -218,4 +230,4 @@ export interface ResolveByMetadataResult {
  * business logic over the shared table, so it runs as one atomic statement on
  * `hmsh_escalations` rather than through the generic SDK resolve.
  */
-export declare function resolveByMetadataAtomic(key: string, value: string, userId: string, resolverPayload: Record<string, any>, metadata?: Record<string, any>, writeAllRoles?: string[] | null, writeSelfRoles?: string[] | null): Promise<ResolveByMetadataResult>;
+export declare function resolveByMetadataAtomic(key: string, value: string, userId: string, resolverPayload: Record<string, any>, metadata?: Record<string, any>, writeAllRoles?: string[] | null, writeSelfRoles?: string[] | null, enforcingRoles?: string[] | null, assertId?: string | null): Promise<ResolveByMetadataResult>;

package/build/services/escalation/crud.js

@@ -512,7 +512,7 @@ async function claimByMetadata(key, value, userId, durationMinutes = 30, metadat
  * business logic over the shared table, so it runs as one atomic statement on
  * `hmsh_escalations` rather than through the generic SDK resolve.
  */
-async function resolveByMetadataAtomic(key, value, userId, resolverPayload, metadata, writeAllRoles, writeSelfRoles) {
+async function resolveByMetadataAtomic(key, value, userId, resolverPayload, metadata, writeAllRoles, writeSelfRoles, enforcingRoles, assertId) {
     await (0, client_1.ensureEscalationCompatView)();
     const pool = (0, db_1.getPool)();
     const filter = JSON.stringify({ [key]: value });
@@ -522,10 +522,26 @@ async function resolveByMetadataAtomic(key, value, userId, resolverPayload, meta
     // (possibly empty); the write_self branch matches only rows assigned to userId.
     const allRoles = writeAllRoles ?? null;
     const selfRoles = writeSelfRoles ?? null;
-    const { rows } = await pool.query(sql_1.RESOLVE_BY_METADATA_ATOMIC, [filter, userId, payloadJson, metaPatch, allRoles, selfRoles]);
+    const { rows } = await pool.query(sql_1.RESOLVE_BY_METADATA_ATOMIC, [filter, userId, payloadJson, metaPatch, allRoles, selfRoles,
+        enforcingRoles?.length ? enforcingRoles : null, assertId ?? null]);
     if (rows.length === 0)
         return { outcome: 'not_found' };
     const row = rows[0];
+    // Enforcing-role target — nothing written; hand the row's validation surface
+    // back so the API layer can run the schema gate and re-invoke with assertId.
+    if (row.outcome === 'validation_required') {
+        return {
+            outcome: 'validation_required',
+            escalationId: row.target_id,
+            row: {
+                id: row.target_id,
+                role: row.target_role ?? null,
+                metadata: row.target_metadata ?? null,
+                envelope: row.target_envelope ?? null,
+                escalation_payload: row.target_escalation_payload ?? null,
+            },
+        };
+    }
     if (row.outcome === 'resolved') {
         const escalation = (0, map_1.toEscalationRecord)(row);
         publishEscalationChange({

package/build/services/escalation/index.d.ts

@@ -2,5 +2,6 @@ export * from './types';
 export * from './crud';
 export * from './bulk';
 export * from './queries';
+export * from './resolver-validation';
 export { ensureEscalationCompatView } from './client';
 export { ensureFacetReady, searchByFacets, searchGroups, countByFacets, claimGroups, claimByFacets, } from './facets';

package/build/services/escalation/index.js

@@ -19,6 +19,7 @@ __exportStar(require("./types"), exports);
 __exportStar(require("./crud"), exports);
 __exportStar(require("./bulk"), exports);
 __exportStar(require("./queries"), exports);
+__exportStar(require("./resolver-validation"), exports);
 var client_1 = require("./client");
 Object.defineProperty(exports, "ensureEscalationCompatView", { enumerable: true, get: function () { return client_1.ensureEscalationCompatView; } });
 var facets_1 = require("./facets");

package/build/services/escalation/resolver-validation.d.ts

@@ -0,0 +1,28 @@
+import { type LTFieldViolation, type LTValidationErrorBody } from '../../types/validation';
+/** The row fields the gate reads — every resolve surface already holds these. */
+export interface ResolvableEscalationRow {
+    id: string;
+    role: string | null;
+    metadata?: Record<string, any> | null;
+    envelope?: string | null;
+    escalation_payload?: string | null;
+    [key: string]: any;
+}
+/** A failed check: which role's contract rejected, at which version, and why. */
+export interface ResolverSchemaViolationReport {
+    role: string;
+    schemaVersion: number | null;
+    violations: LTFieldViolation[];
+}
+/**
+ * Validate a submitted resolverPayload against the escalation's enforced form
+ * schema. Returns null when the resolution may proceed (role does not enforce,
+ * no schema to enforce, or the payload passes); otherwise the violation report.
+ *
+ * `loadEnvelope` lets a caller supply a richer envelope read (e.g. the by-id
+ * surface's task fallback); by default the row's own envelope column is used.
+ * It is only invoked when the role actually enforces.
+ */
+export declare function checkResolverPayload(escalation: ResolvableEscalationRow, resolverPayload: Record<string, any>, loadEnvelope?: () => Promise<Record<string, any>>): Promise<ResolverSchemaViolationReport | null>;
+/** The canonical 422 body for a violation report (types/validation.ts). */
+export declare function toValidationErrorBody(report: ResolverSchemaViolationReport): LTValidationErrorBody;

package/build/services/escalation/resolver-validation.js

@@ -0,0 +1,95 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkResolverPayload = checkResolverPayload;
+exports.toValidationErrorBody = toValidationErrorBody;
+/**
+ * Server-side resolver schema enforcement — the API-first counterpart of the
+ * dashboard's pre-submission pass. Every resolve surface (HTTP, SDK, MCP)
+ * calls checkResolverPayload before committing a resolution; roles that opt in
+ * via enforce_schema get their form_schema enforced as an API contract, and
+ * violations surface as the canonical 422 body (types/validation.ts).
+ *
+ * Production shape: the gate consults the cached enforcing-role set first, so
+ * when no involved role enforces, a resolve costs zero additional SQL. Schema
+ * reads for enforcing roles come from the enforcement cache (immutable pinned
+ * snapshots cached indefinitely; latest schemas under a short TTL).
+ *
+ * Schema resolution matches the resolve UI, most specific first:
+ *   1. metadata.form_schema — a full form embedded on the row
+ *   2. the lt_role_schemas snapshot pinned by metadata.schema_version
+ *   3. the role's live (latest) form_schema
+ * A role that enforces but declares no schema has no contract to enforce —
+ * the gate passes.
+ */
+const form_validation_1 = require("../../shared/form-validation");
+const enforcement_cache_1 = require("../role/enforcement-cache");
+const escalation_1 = require("../../types/escalation");
+const validation_1 = require("../../types/validation");
+function parseJsonOrNull(value) {
+    if (!value)
+        return null;
+    try {
+        const parsed = JSON.parse(value);
+        return typeof parsed === 'object' && parsed !== null ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The row's schema-version pin as an integer, mirroring the SQL's guarded cast. */
+function pinnedVersionOf(metadata) {
+    const raw = metadata[escalation_1.ESCALATION_METADATA_KEYS.SCHEMA_VERSION];
+    if (typeof raw === 'number' && Number.isInteger(raw) && raw >= 1)
+        return raw;
+    if (typeof raw === 'string' && /^[0-9]+$/.test(raw))
+        return parseInt(raw, 10);
+    return null;
+}
+/**
+ * Validate a submitted resolverPayload against the escalation's enforced form
+ * schema. Returns null when the resolution may proceed (role does not enforce,
+ * no schema to enforce, or the payload passes); otherwise the violation report.
+ *
+ * `loadEnvelope` lets a caller supply a richer envelope read (e.g. the by-id
+ * surface's task fallback); by default the row's own envelope column is used.
+ * It is only invoked when the role actually enforces.
+ */
+async function checkResolverPayload(escalation, resolverPayload, loadEnvelope) {
+    const role = escalation.role;
+    if (!role)
+        return null;
+    const enforcing = await (0, enforcement_cache_1.getEnforcingRoles)();
+    if (!enforcing.has(role))
+        return null;
+    const metadata = (escalation.metadata ?? {});
+    const pin = pinnedVersionOf(metadata);
+    const embedded = metadata[escalation_1.ESCALATION_METADATA_KEYS.FORM_SCHEMA];
+    const schema = embedded && typeof embedded === 'object'
+        ? embedded
+        : await (0, enforcement_cache_1.getEnforcedFormSchema)(role, pin);
+    if (!schema)
+        return null;
+    const envelope = loadEnvelope
+        ? await loadEnvelope()
+        : parseJsonOrNull(escalation.envelope) ?? {};
+    const violations = (0, form_validation_1.validateResolverPayload)(schema, resolverPayload, {
+        escalation: escalation,
+        metadata,
+        envelope,
+        payload: parseJsonOrNull(escalation.escalation_payload),
+    });
+    if (violations.length === 0)
+        return null;
+    return { role, schemaVersion: pin, violations };
+}
+/** The canonical 422 body for a violation report (types/validation.ts). */
+function toValidationErrorBody(report) {
+    const n = report.violations.length;
+    return {
+        error: `resolverPayload failed schema validation (${n} violation${n === 1 ? '' : 's'})`,
+        code: validation_1.LT_ERROR_CODES.SCHEMA_VALIDATION,
+        violations: report.violations,
+        role: report.role,
+        schemaVersion: report.schemaVersion,
+    };
+}

package/build/services/escalation/sql.d.ts

@@ -36,14 +36,24 @@ export declare function searchEscalationsQuery(orderBy: string): string;
  *
  * $1 = metadata filter (jsonb), $2 = userId, $3 = resolver_payload (jsonb),
  * $4 = metadata patch (jsonb, nullable), $5 = write_all roles (text[], null = global /
- * no filter), $6 = write_self roles (text[], nullable).
+ * no filter), $6 = write_self roles (text[], nullable), $7 = enforcing roles
+ * (text[], null = none), $8 = assert id (uuid, nullable).
  *
  * Write-scope is folded into the same FOR UPDATE statement (no TOCTOU): the row
  * is resolvable if the caller has global access ($5 NULL), or the row's role is in
  * their write_all set, or the row's role is in their write_self set AND it is
  * already assigned to them ($2). assigned_to is indexed, so the self-branch scales.
+ *
+ * Schema enforcement rides as a fifth outcome: when the target's role is in $7,
+ * NOTHING is written — the statement returns 'validation_required' with the
+ * row's role/metadata/envelope so the API layer can validate the payload, then
+ * re-invoke with $8 = the validated row's id and $7 = NULL. The asserted second
+ * pass claims + resolves exactly as a first pass would (state re-asserted:
+ * status must still be pending and the id must still match, so a concurrent
+ * resolution surfaces as zero rows → the caller's conflict handling). This is
+ * the same pick-then-guarded-finish shape the signal outcomes already use.
  */
-export declare const RESOLVE_BY_METADATA_ATOMIC = "WITH target AS MATERIALIZED (\n  SELECT *\n  FROM public.hmsh_escalations\n  WHERE metadata @> $1::jsonb\n    AND status = 'pending'\n    AND (\n         $5::text[] IS NULL\n      OR role = ANY($5)\n      OR (role = ANY($6::text[]) AND assigned_to = $2)\n    )\n  ORDER BY priority ASC, created_at ASC\n  LIMIT 1\n  FOR UPDATE\n),\nclaimed AS (\n  UPDATE public.hmsh_escalations e\n  SET assigned_to = COALESCE(e.assigned_to, $2),\n      claimed_at = COALESCE(e.claimed_at, NOW()),\n      assigned_until = CASE\n        WHEN e.assigned_to IS NOT NULL AND e.assigned_until > NOW() THEN e.assigned_until\n        ELSE NOW() + INTERVAL '5 minutes' END,\n      claim_expires_at = CASE\n        WHEN e.assigned_to IS NOT NULL AND e.assigned_until > NOW() THEN e.claim_expires_at\n        ELSE NOW() + INTERVAL '5 minutes' END,\n      metadata = CASE WHEN $4::jsonb IS NOT NULL\n        THEN COALESCE(e.metadata, '{}'::jsonb) || $4::jsonb\n        ELSE e.metadata END,\n      updated_at = NOW()\n  FROM target\n  WHERE e.id = target.id\n    AND target.signal_key IS NULL\n  RETURNING e.*\n),\nresolved AS (\n  UPDATE public.hmsh_escalations e\n  SET status = 'resolved',\n      resolved_at = NOW(),\n      resolver_payload = $3,\n      updated_at = NOW()\n  FROM claimed\n  WHERE e.id = claimed.id\n    AND (claimed.metadata->>'signal_id') IS NULL\n  RETURNING e.*\n)\nSELECT\n  resolved.*,\n  target.id AS target_id,\n  target.metadata->>'signal_id' AS signal_id,\n  target.signal_key AS signal_key,\n  target.workflow_id AS target_workflow_id,\n  target.workflow_type AS target_workflow_type,\n  target.task_queue AS target_task_queue,\n  (target.assigned_to IS NOT NULL\n    AND target.assigned_until IS NOT NULL\n    AND target.assigned_until > NOW()) AS signal_already_claimed,\n  CASE WHEN resolved.id IS NOT NULL THEN 'resolved' ELSE 'signal_required' END AS outcome\nFROM target\nLEFT JOIN resolved ON resolved.id = target.id";
+export declare const RESOLVE_BY_METADATA_ATOMIC = "WITH target AS MATERIALIZED (\n  SELECT *\n  FROM public.hmsh_escalations\n  WHERE metadata @> $1::jsonb\n    AND status = 'pending'\n    AND (\n         $5::text[] IS NULL\n      OR role = ANY($5)\n      OR (role = ANY($6::text[]) AND assigned_to = $2)\n    )\n    AND ($8::uuid IS NULL OR id = $8::uuid)\n  ORDER BY priority ASC, created_at ASC\n  LIMIT 1\n  FOR UPDATE\n),\nclaimed AS (\n  UPDATE public.hmsh_escalations e\n  SET assigned_to = COALESCE(e.assigned_to, $2),\n      claimed_at = COALESCE(e.claimed_at, NOW()),\n      assigned_until = CASE\n        WHEN e.assigned_to IS NOT NULL AND e.assigned_until > NOW() THEN e.assigned_until\n        ELSE NOW() + INTERVAL '5 minutes' END,\n      claim_expires_at = CASE\n        WHEN e.assigned_to IS NOT NULL AND e.assigned_until > NOW() THEN e.claim_expires_at\n        ELSE NOW() + INTERVAL '5 minutes' END,\n      metadata = CASE WHEN $4::jsonb IS NOT NULL\n        THEN COALESCE(e.metadata, '{}'::jsonb) || $4::jsonb\n        ELSE e.metadata END,\n      updated_at = NOW()\n  FROM target\n  WHERE e.id = target.id\n    AND target.signal_key IS NULL\n    AND ($7::text[] IS NULL OR NOT (target.role = ANY($7)))\n  RETURNING e.*\n),\nresolved AS (\n  UPDATE public.hmsh_escalations e\n  SET status = 'resolved',\n      resolved_at = NOW(),\n      resolver_payload = $3,\n      updated_at = NOW()\n  FROM claimed\n  WHERE e.id = claimed.id\n    AND (claimed.metadata->>'signal_id') IS NULL\n  RETURNING e.*\n)\nSELECT\n  resolved.*,\n  target.id AS target_id,\n  target.role AS target_role,\n  target.metadata AS target_metadata,\n  target.envelope AS target_envelope,\n  target.escalation_payload AS target_escalation_payload,\n  target.metadata->>'signal_id' AS signal_id,\n  target.signal_key AS signal_key,\n  target.workflow_id AS target_workflow_id,\n  target.workflow_type AS target_workflow_type,\n  target.task_queue AS target_task_queue,\n  (target.assigned_to IS NOT NULL\n    AND target.assigned_until IS NOT NULL\n    AND target.assigned_until > NOW()) AS signal_already_claimed,\n  CASE\n    WHEN resolved.id IS NOT NULL THEN 'resolved'\n    WHEN $7::text[] IS NOT NULL AND target.role = ANY($7) THEN 'validation_required'\n    ELSE 'signal_required'\n  END AS outcome\nFROM target\nLEFT JOIN resolved ON resolved.id = target.id";
 /**
  * Live counts — pending, active claims, and priority (past-threshold) per role.
  *

package/build/services/escalation/sql.js

@@ -118,12 +118,22 @@ function searchEscalationsQuery(orderBy) {
  *
  * $1 = metadata filter (jsonb), $2 = userId, $3 = resolver_payload (jsonb),
  * $4 = metadata patch (jsonb, nullable), $5 = write_all roles (text[], null = global /
- * no filter), $6 = write_self roles (text[], nullable).
+ * no filter), $6 = write_self roles (text[], nullable), $7 = enforcing roles
+ * (text[], null = none), $8 = assert id (uuid, nullable).
  *
  * Write-scope is folded into the same FOR UPDATE statement (no TOCTOU): the row
  * is resolvable if the caller has global access ($5 NULL), or the row's role is in
  * their write_all set, or the row's role is in their write_self set AND it is
  * already assigned to them ($2). assigned_to is indexed, so the self-branch scales.
+ *
+ * Schema enforcement rides as a fifth outcome: when the target's role is in $7,
+ * NOTHING is written — the statement returns 'validation_required' with the
+ * row's role/metadata/envelope so the API layer can validate the payload, then
+ * re-invoke with $8 = the validated row's id and $7 = NULL. The asserted second
+ * pass claims + resolves exactly as a first pass would (state re-asserted:
+ * status must still be pending and the id must still match, so a concurrent
+ * resolution surfaces as zero rows → the caller's conflict handling). This is
+ * the same pick-then-guarded-finish shape the signal outcomes already use.
  */
 exports.RESOLVE_BY_METADATA_ATOMIC = `\
 WITH target AS MATERIALIZED (
@@ -136,6 +146,7 @@ WITH target AS MATERIALIZED (
       OR role = ANY($5)
       OR (role = ANY($6::text[]) AND assigned_to = $2)
     )
+    AND ($8::uuid IS NULL OR id = $8::uuid)
   ORDER BY priority ASC, created_at ASC
   LIMIT 1
   FOR UPDATE
@@ -157,6 +168,7 @@ claimed AS (
   FROM target
   WHERE e.id = target.id
     AND target.signal_key IS NULL
+    AND ($7::text[] IS NULL OR NOT (target.role = ANY($7)))
   RETURNING e.*
 ),
 resolved AS (
@@ -173,6 +185,10 @@ resolved AS (
 SELECT
   resolved.*,
   target.id AS target_id,
+  target.role AS target_role,
+  target.metadata AS target_metadata,
+  target.envelope AS target_envelope,
+  target.escalation_payload AS target_escalation_payload,
   target.metadata->>'signal_id' AS signal_id,
   target.signal_key AS signal_key,
   target.workflow_id AS target_workflow_id,
@@ -181,7 +197,11 @@ SELECT
   (target.assigned_to IS NOT NULL
     AND target.assigned_until IS NOT NULL
     AND target.assigned_until > NOW()) AS signal_already_claimed,
-  CASE WHEN resolved.id IS NOT NULL THEN 'resolved' ELSE 'signal_required' END AS outcome
+  CASE
+    WHEN resolved.id IS NOT NULL THEN 'resolved'
+    WHEN $7::text[] IS NOT NULL AND target.role = ANY($7) THEN 'validation_required'
+    ELSE 'signal_required'
+  END AS outcome
 FROM target
 LEFT JOIN resolved ON resolved.id = target.id`;
 // ---------------------------------------------------------------------------

package/build/services/iam/bots.d.ts

@@ -37,7 +37,10 @@ export declare function getBot(id: string): Promise<BotAccountRecord | null>;
 /**
  * List all bot accounts with pagination.
  */
-export declare function listBots(limit?: number, offset?: number): Promise<{
+export declare function listBots(limit?: number, offset?: number, filters?: {
+    status?: string;
+    search?: string;
+}): Promise<{
     bots: BotAccountRecord[];
     total: number;
 }>;

package/build/services/iam/bots.js

@@ -58,11 +58,13 @@ async function getBot(id) {
 /**
  * List all bot accounts with pagination.
  */
-async function listBots(limit = 50, offset = 0) {
+async function listBots(limit = 50, offset = 0, filters = {}) {
     const pool = await (0, db_1.getPool)();
+    const status = filters.status || null;
+    const search = filters.search || null;
     const [{ rows }, countResult] = await Promise.all([
-        pool.query(sql_1.LIST_BOTS, [limit, offset]),
-        pool.query(sql_1.COUNT_BOTS),
+        pool.query(sql_1.LIST_BOTS, [limit, offset, status, search]),
+        pool.query(sql_1.COUNT_BOTS, [status, search]),
     ]);
     // Attach roles to each bot
     const bots = await Promise.all(rows.map(async (row) => {

package/build/services/iam/sql.d.ts

@@ -3,8 +3,8 @@ export declare const INSERT_EPHEMERAL: (expiresExpr: string) => string;
 export declare const EXCHANGE_EPHEMERAL = "\n  UPDATE lt_ephemeral_credentials\n  SET use_count = use_count + 1\n  WHERE token = $1\n    AND (expires_at IS NULL OR expires_at > NOW())\n    AND (max_uses = 0 OR use_count < max_uses)\n  RETURNING value, use_count, max_uses";
 export declare const DELETE_EPHEMERAL = "\n  DELETE FROM lt_ephemeral_credentials WHERE token = $1";
 export declare const CLEANUP_EXPIRED_EPHEMERAL = "\n  DELETE FROM lt_ephemeral_credentials\n  WHERE expires_at IS NOT NULL AND expires_at < NOW()";
-export declare const LIST_BOTS = "\n  SELECT * FROM lt_users\n  WHERE account_type = 'bot'\n  ORDER BY created_at DESC\n  LIMIT $1 OFFSET $2";
-export declare const COUNT_BOTS = "\n  SELECT COUNT(*)::int AS total FROM lt_users WHERE account_type = 'bot'";
+export declare const LIST_BOTS = "\n  SELECT * FROM lt_users\n  WHERE account_type = 'bot'\n    AND ($3::text IS NULL OR status = $3)\n    AND ($4::text IS NULL\n      OR display_name ILIKE '%' || $4 || '%'\n      OR external_id ILIKE '%' || $4 || '%'\n      OR metadata->>'description' ILIKE '%' || $4 || '%')\n  ORDER BY created_at DESC\n  LIMIT $1 OFFSET $2";
+export declare const COUNT_BOTS = "\n  SELECT COUNT(*)::int AS total FROM lt_users\n  WHERE account_type = 'bot'\n    AND ($1::text IS NULL OR status = $1)\n    AND ($2::text IS NULL\n      OR display_name ILIKE '%' || $2 || '%'\n      OR external_id ILIKE '%' || $2 || '%'\n      OR metadata->>'description' ILIKE '%' || $2 || '%')";
 export declare const SET_ACCOUNT_TYPE_BOT = "\n  UPDATE lt_users SET account_type = $1 WHERE id = $2";
 export declare const GET_USER_BY_EXTERNAL_ID = "\n  SELECT id FROM lt_users WHERE external_id = $1";
 export declare const GET_USER_WITH_ROLES_FLEXIBLE = "\n  SELECT u.id, u.external_id, u.display_name, u.status, u.metadata,\n         r.role, r.type AS role_type\n  FROM lt_users u\n  LEFT JOIN lt_user_roles r ON r.user_id = u.id\n  WHERE u.external_id = $1 OR u.id::text = $1\n  ORDER BY r.created_at";

package/build/services/iam/sql.js

@@ -21,13 +21,27 @@ exports.CLEANUP_EXPIRED_EPHEMERAL = `
   DELETE FROM lt_ephemeral_credentials
   WHERE expires_at IS NOT NULL AND expires_at < NOW()`;
 // ─── Bot accounts ───────────────────────────────────────────────────────────
+// $3 = status (nullable), $4 = search (nullable) — free text over the bot's
+// display fields, mirroring listUsers' search so the two Accounts tabs offer
+// the same server-side filter surface.
 exports.LIST_BOTS = `
   SELECT * FROM lt_users
   WHERE account_type = 'bot'
+    AND ($3::text IS NULL OR status = $3)
+    AND ($4::text IS NULL
+      OR display_name ILIKE '%' || $4 || '%'
+      OR external_id ILIKE '%' || $4 || '%'
+      OR metadata->>'description' ILIKE '%' || $4 || '%')
   ORDER BY created_at DESC
   LIMIT $1 OFFSET $2`;
 exports.COUNT_BOTS = `
-  SELECT COUNT(*)::int AS total FROM lt_users WHERE account_type = 'bot'`;
+  SELECT COUNT(*)::int AS total FROM lt_users
+  WHERE account_type = 'bot'
+    AND ($1::text IS NULL OR status = $1)
+    AND ($2::text IS NULL
+      OR display_name ILIKE '%' || $2 || '%'
+      OR external_id ILIKE '%' || $2 || '%'
+      OR metadata->>'description' ILIKE '%' || $2 || '%')`;
 exports.SET_ACCOUNT_TYPE_BOT = `
   UPDATE lt_users SET account_type = $1 WHERE id = $2`;
 exports.GET_USER_BY_EXTERNAL_ID = `

package/build/services/role/enforcement-cache.d.ts

@@ -0,0 +1,21 @@
+/**
+ * The set of roles with enforce_schema on, cached under the TTL. Callers check
+ * membership before doing ANY validation work — an empty set short-circuits
+ * every resolve surface to its pre-enforcement behavior.
+ */
+export declare function getEnforcingRoles(): Promise<Set<string>>;
+/** Whether this role currently enforces resolver schema validation. */
+export declare function isEnforcingRole(role: string): Promise<boolean>;
+/**
+ * The authoritative form schema for validating a resolve against `role`,
+ * honoring an escalation's version pin. Pinned versions come from the
+ * immutable snapshot cache; unpinned reads come from the TTL'd latest cache.
+ * Null when the role declares no schema (nothing to enforce).
+ */
+export declare function getEnforcedFormSchema(role: string, pinnedVersion?: number | null): Promise<Record<string, any> | null>;
+/**
+ * Drop cached enforcement state after a role write. With a role, drops that
+ * role's latest-schema entry plus the enforcing set; without, drops
+ * everything. Pinned snapshots are immutable and never need invalidation.
+ */
+export declare function invalidateRoleEnforcement(role?: string): void;

package/build/services/role/index.js

@@ -21,6 +21,7 @@ exports.deleteRole = deleteRole;
 const db_1 = require("../../lib/db");
 const user_1 = require("../user");
 const sql_1 = require("./sql");
+const enforcement_cache_1 = require("./enforcement-cache");
 /**
  * Get the roles a given source role can escalate to.
  */
@@ -147,9 +148,13 @@ async function updateRoleMetadata(role, input) {
         provided('upstream_roles'), upstreams,
         provided('list_schema'), input.list_schema != null ? JSON.stringify(input.list_schema) : null,
         provided('default_pins'), input.default_pins != null ? JSON.stringify(input.default_pins) : null,
+        provided('enforce_schema'), input.enforce_schema ?? null,
     ]);
     if (!rows[0])
         return null;
+    // Enforcement state may have changed — drop this role's cached entries so
+    // the resolve gate sees the write immediately in this process.
+    (0, enforcement_cache_1.invalidateRoleEnforcement)(role);
     // The statement's CTEs share one snapshot, so the returned row cannot see
     // the upstream sync it just performed — echo the write, or read when the
     // field wasn't touched.

package/build/services/role/sql.d.ts

@@ -42,9 +42,19 @@ export declare const DELETE_ROLE = "\n  DELETE FROM lt_roles WHERE role = $1";
  *
  * default_pins ($31 = provided sentinel, $32 = value) is unversioned config:
  * the pinned-view seeds a role hands its members.
+ *
+ * enforce_schema ($33 = provided sentinel, $34 = value) is unversioned config:
+ * the server-side resolver-validation opt-in. The service layer invalidates
+ * the enforcement cache after this statement commits.
  */
-export declare const UPDATE_ROLE_METADATA = "\n  WITH updated AS (\n    UPDATE lt_roles SET\n      title           = CASE WHEN $2::boolean  THEN $3                                ELSE title           END,\n      description     = CASE WHEN $4::boolean  THEN $5                                ELSE description     END,\n      form_schema     = CASE WHEN $6::boolean  THEN $7::jsonb                         ELSE form_schema     END,\n      metadata_schema = CASE WHEN $8::boolean  THEN $9::jsonb                         ELSE metadata_schema END,\n      properties      = CASE WHEN $10::boolean THEN COALESCE($11::jsonb, '{}'::jsonb) ELSE properties      END,\n      ops_visible     = CASE WHEN $12::boolean THEN $13::boolean                      ELSE ops_visible     END,\n      parent_role     = CASE WHEN $14::boolean THEN $15                               ELSE parent_role     END,\n      sla_minutes     = CASE WHEN $16::boolean THEN $17::numeric                      ELSE sla_minutes     END,\n      target_per_hour = CASE WHEN $18::boolean THEN $19::numeric                      ELSE target_per_hour END,\n      worker_count    = CASE WHEN $20::boolean THEN $21::int                          ELSE worker_count    END,\n      priority_threshold_minutes\n                      = CASE WHEN $22::boolean THEN $23::numeric                      ELSE priority_threshold_minutes END,\n      priority_facet  = CASE WHEN $24::boolean THEN $25                               ELSE priority_facet  END,\n      list_schema     = CASE WHEN $29::boolean THEN $30::jsonb                        ELSE list_schema     END,\n      default_pins    = CASE WHEN $31::boolean THEN $32::jsonb                        ELSE default_pins    END,\n      current_schema_version = CASE\n        WHEN ($6::boolean AND $7::jsonb IS DISTINCT FROM form_schema)\n          OR ($8::boolean AND $9::jsonb IS DISTINCT FROM metadata_schema)\n        THEN COALESCE(current_schema_version, 0) + 1\n        ELSE current_schema_version END,\n      current_list_schema_version = CASE\n        WHEN $29::boolean AND $30::jsonb IS DISTINCT FROM list_schema\n        THEN COALESCE(current_list_schema_version, 0) + 1\n        ELSE current_list_schema_version END\n    WHERE role = $1\n    RETURNING\n      role, title, description, form_schema, metadata_schema, properties,\n      ops_visible, parent_role, sla_minutes, target_per_hour, worker_count,\n      priority_threshold_minutes, priority_facet,\n      current_schema_version, list_schema, current_list_schema_version,\n      default_pins\n  ), snapshot AS (\n    INSERT INTO lt_role_schemas (role, version, form_schema, metadata_schema, change_summary)\n    SELECT role, current_schema_version, form_schema, metadata_schema, $26\n    FROM updated\n    WHERE ($6::boolean OR $8::boolean) AND current_schema_version IS NOT NULL\n    ON CONFLICT (role, version) DO NOTHING\n  ), list_snapshot AS (\n    INSERT INTO lt_role_list_schemas (role, version, list_schema, change_summary)\n    SELECT role, current_list_schema_version, list_schema, $26\n    FROM updated\n    WHERE $29::boolean AND current_list_schema_version IS NOT NULL\n    ON CONFLICT (role, version) DO NOTHING\n  ), upstream_prune AS (\n    DELETE FROM lt_role_upstreams\n    WHERE $27::boolean AND role = $1 AND upstream_role <> ALL($28::text[])\n  ), upstream_add AS (\n    INSERT INTO lt_role_upstreams (role, upstream_role)\n    SELECT $1, u FROM unnest($28::text[]) AS u\n    WHERE $27::boolean\n    ON CONFLICT DO NOTHING\n  )\n  SELECT * FROM updated";
+export declare const UPDATE_ROLE_METADATA = "\n  WITH updated AS (\n    UPDATE lt_roles SET\n      title           = CASE WHEN $2::boolean  THEN $3                                ELSE title           END,\n      description     = CASE WHEN $4::boolean  THEN $5                                ELSE description     END,\n      form_schema     = CASE WHEN $6::boolean  THEN $7::jsonb                         ELSE form_schema     END,\n      metadata_schema = CASE WHEN $8::boolean  THEN $9::jsonb                         ELSE metadata_schema END,\n      properties      = CASE WHEN $10::boolean THEN COALESCE($11::jsonb, '{}'::jsonb) ELSE properties      END,\n      ops_visible     = CASE WHEN $12::boolean THEN $13::boolean                      ELSE ops_visible     END,\n      parent_role     = CASE WHEN $14::boolean THEN $15                               ELSE parent_role     END,\n      sla_minutes     = CASE WHEN $16::boolean THEN $17::numeric                      ELSE sla_minutes     END,\n      target_per_hour = CASE WHEN $18::boolean THEN $19::numeric                      ELSE target_per_hour END,\n      worker_count    = CASE WHEN $20::boolean THEN $21::int                          ELSE worker_count    END,\n      priority_threshold_minutes\n                      = CASE WHEN $22::boolean THEN $23::numeric                      ELSE priority_threshold_minutes END,\n      priority_facet  = CASE WHEN $24::boolean THEN $25                               ELSE priority_facet  END,\n      list_schema     = CASE WHEN $29::boolean THEN $30::jsonb                        ELSE list_schema     END,\n      default_pins    = CASE WHEN $31::boolean THEN $32::jsonb                        ELSE default_pins    END,\n      enforce_schema  = CASE WHEN $33::boolean THEN COALESCE($34::boolean, false)     ELSE enforce_schema  END,\n      current_schema_version = CASE\n        WHEN ($6::boolean AND $7::jsonb IS DISTINCT FROM form_schema)\n          OR ($8::boolean AND $9::jsonb IS DISTINCT FROM metadata_schema)\n        THEN COALESCE(current_schema_version, 0) + 1\n        ELSE current_schema_version END,\n      current_list_schema_version = CASE\n        WHEN $29::boolean AND $30::jsonb IS DISTINCT FROM list_schema\n        THEN COALESCE(current_list_schema_version, 0) + 1\n        ELSE current_list_schema_version END\n    WHERE role = $1\n    RETURNING\n      role, title, description, form_schema, metadata_schema, properties,\n      ops_visible, parent_role, sla_minutes, target_per_hour, worker_count,\n      priority_threshold_minutes, priority_facet,\n      current_schema_version, list_schema, current_list_schema_version,\n      default_pins, enforce_schema\n  ), snapshot AS (\n    INSERT INTO lt_role_schemas (role, version, form_schema, metadata_schema, change_summary)\n    SELECT role, current_schema_version, form_schema, metadata_schema, $26\n    FROM updated\n    WHERE ($6::boolean OR $8::boolean) AND current_schema_version IS NOT NULL\n    ON CONFLICT (role, version) DO NOTHING\n  ), list_snapshot AS (\n    INSERT INTO lt_role_list_schemas (role, version, list_schema, change_summary)\n    SELECT role, current_list_schema_version, list_schema, $26\n    FROM updated\n    WHERE $29::boolean AND current_list_schema_version IS NOT NULL\n    ON CONFLICT (role, version) DO NOTHING\n  ), upstream_prune AS (\n    DELETE FROM lt_role_upstreams\n    WHERE $27::boolean AND role = $1 AND upstream_role <> ALL($28::text[])\n  ), upstream_add AS (\n    INSERT INTO lt_role_upstreams (role, upstream_role)\n    SELECT $1, u FROM unnest($28::text[]) AS u\n    WHERE $27::boolean\n    ON CONFLICT DO NOTHING\n  )\n  SELECT * FROM updated";
 export declare const GET_ROLE_FORM_SCHEMA = "\n  SELECT form_schema FROM lt_roles WHERE role = $1";
+/**
+ * The set of roles with server-side resolver validation turned on. Small and
+ * slow-changing — the enforcement cache holds it under a short TTL so the
+ * resolve hot path costs zero SQL when no role (or no involved role) enforces.
+ */
+export declare const LIST_ENFORCING_ROLES = "\n  SELECT role FROM lt_roles WHERE enforce_schema";
 export declare const GET_ROLE_METADATA_SCHEMA = "\n  SELECT metadata_schema FROM lt_roles WHERE role = $1";
 export declare const GET_ROLE_UPSTREAMS = "\n  SELECT upstream_role FROM lt_role_upstreams WHERE role = $1 ORDER BY upstream_role";
 export declare const LIST_ROLE_SCHEMA_VERSIONS = "\n  SELECT\n    s.version,\n    s.form_schema IS NOT NULL     AS has_form_schema,\n    s.metadata_schema IS NOT NULL AS has_metadata_schema,\n    s.change_summary,\n    s.created_at,\n    s.version = r.current_schema_version AS is_current\n  FROM lt_role_schemas s\n  JOIN lt_roles r ON r.role = s.role\n  WHERE s.role = $1\n  ORDER BY s.version DESC";
@@ -61,7 +71,7 @@ export declare const GET_ROLE_LIST_SCHEMA_VERSION = "\n  SELECT s.role, s.versio
  * never versioned its list schema still answers, with version NULL).
  */
 export declare const GET_ROLE_LIST_SCHEMA_CURRENT = "\n  SELECT r.role, r.current_list_schema_version AS version, r.list_schema,\n         s.change_summary, s.created_at,\n         r.current_list_schema_version AS latest_version\n  FROM lt_roles r\n  LEFT JOIN lt_role_list_schemas s\n    ON s.role = r.role AND s.version = r.current_list_schema_version\n  WHERE r.role = $1";
-export declare const LIST_ROLES_WITH_DETAILS = "\n  WITH\n  user_counts AS (\n    SELECT role, COUNT(DISTINCT user_id)::int AS cnt\n    FROM lt_user_roles\n    GROUP BY role\n  ),\n  chain_counts AS (\n    SELECT role, COUNT(*)::int AS cnt\n    FROM (\n      SELECT source_role AS role FROM lt_config_role_escalations\n      UNION ALL\n      SELECT target_role AS role FROM lt_config_role_escalations\n    ) c\n    GROUP BY role\n  ),\n  workflow_counts AS (\n    SELECT role, COUNT(*)::int AS cnt\n    FROM lt_config_roles\n    GROUP BY role\n  ),\n  upstreams AS (\n    SELECT role, array_agg(upstream_role ORDER BY upstream_role) AS ups\n    FROM lt_role_upstreams\n    GROUP BY role\n  )\n  SELECT\n    r.role,\n    r.title,\n    r.description,\n    r.form_schema,\n    r.metadata_schema,\n    r.properties,\n    r.ops_visible,\n    r.parent_role,\n    r.sla_minutes,\n    r.target_per_hour,\n    r.worker_count,\n    r.priority_threshold_minutes,\n    r.priority_facet,\n    r.current_schema_version,\n    r.list_schema,\n    r.current_list_schema_version,\n    r.default_pins,\n    COALESCE(up.ups, '{}') AS upstream_roles,\n    COALESCE(uc.cnt, 0) AS user_count,\n    COALESCE(cc.cnt, 0) AS chain_count,\n    COALESCE(wc.cnt, 0) AS workflow_count\n  FROM lt_roles r\n  LEFT JOIN user_counts uc ON uc.role = r.role\n  LEFT JOIN chain_counts cc ON cc.role = r.role\n  LEFT JOIN workflow_counts wc ON wc.role = r.role\n  LEFT JOIN upstreams up ON up.role = r.role\n  ORDER BY r.role";
+export declare const LIST_ROLES_WITH_DETAILS = "\n  WITH\n  user_counts AS (\n    SELECT role, COUNT(DISTINCT user_id)::int AS cnt\n    FROM lt_user_roles\n    GROUP BY role\n  ),\n  chain_counts AS (\n    SELECT role, COUNT(*)::int AS cnt\n    FROM (\n      SELECT source_role AS role FROM lt_config_role_escalations\n      UNION ALL\n      SELECT target_role AS role FROM lt_config_role_escalations\n    ) c\n    GROUP BY role\n  ),\n  workflow_counts AS (\n    SELECT role, COUNT(*)::int AS cnt\n    FROM lt_config_roles\n    GROUP BY role\n  ),\n  upstreams AS (\n    SELECT role, array_agg(upstream_role ORDER BY upstream_role) AS ups\n    FROM lt_role_upstreams\n    GROUP BY role\n  )\n  SELECT\n    r.role,\n    r.title,\n    r.description,\n    r.form_schema,\n    r.metadata_schema,\n    r.properties,\n    r.ops_visible,\n    r.parent_role,\n    r.sla_minutes,\n    r.target_per_hour,\n    r.worker_count,\n    r.priority_threshold_minutes,\n    r.priority_facet,\n    r.current_schema_version,\n    r.list_schema,\n    r.current_list_schema_version,\n    r.default_pins,\n    r.enforce_schema,\n    COALESCE(up.ups, '{}') AS upstream_roles,\n    COALESCE(uc.cnt, 0) AS user_count,\n    COALESCE(cc.cnt, 0) AS chain_count,\n    COALESCE(wc.cnt, 0) AS workflow_count\n  FROM lt_roles r\n  LEFT JOIN user_counts uc ON uc.role = r.role\n  LEFT JOIN chain_counts cc ON cc.role = r.role\n  LEFT JOIN workflow_counts wc ON wc.role = r.role\n  LEFT JOIN upstreams up ON up.role = r.role\n  ORDER BY r.role";
 export declare const COUNT_USER_ROLE_REFS = "\n  SELECT COUNT(*)::int AS cnt FROM lt_user_roles WHERE role = $1";
 export declare const COUNT_CHAIN_REFS = "\n  SELECT COUNT(*)::int AS cnt\n  FROM lt_config_role_escalations\n  WHERE source_role = $1 OR target_role = $1";
 export declare const COUNT_WORKFLOW_REFS = "\n  SELECT COUNT(*)::int AS cnt FROM lt_config_roles WHERE role = $1";

package/build/services/role/sql.js

@@ -1,7 +1,7 @@
 "use strict";
 // ─── Escalation chain queries ───────────────────────────────────────────────
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.COUNT_ACTIVE_ESCALATION_REFS = exports.COUNT_WORKFLOW_REFS = exports.COUNT_CHAIN_REFS = exports.COUNT_USER_ROLE_REFS = exports.LIST_ROLES_WITH_DETAILS = exports.GET_ROLE_LIST_SCHEMA_CURRENT = exports.GET_ROLE_LIST_SCHEMA_VERSION = exports.LIST_ROLE_LIST_SCHEMA_VERSIONS = exports.GET_ROLE_SCHEMA_CURRENT = exports.GET_ROLE_SCHEMA_VERSION = exports.LIST_ROLE_SCHEMA_VERSIONS = exports.GET_ROLE_UPSTREAMS = exports.GET_ROLE_METADATA_SCHEMA = exports.GET_ROLE_FORM_SCHEMA = exports.UPDATE_ROLE_METADATA = exports.DELETE_ROLE = exports.LIST_ROLES = exports.ENSURE_ROLE_EXISTS = exports.CHECK_ESCALATION_CHAIN_EXISTS = exports.DELETE_ESCALATION_CHAINS_BY_SOURCE = exports.DELETE_ESCALATION_CHAIN = exports.ADD_ESCALATION_CHAIN = exports.INSERT_ESCALATION_CHAIN = exports.GET_ALL_ESCALATION_CHAINS = exports.GET_ESCALATION_TARGETS = void 0;
+exports.COUNT_ACTIVE_ESCALATION_REFS = exports.COUNT_WORKFLOW_REFS = exports.COUNT_CHAIN_REFS = exports.COUNT_USER_ROLE_REFS = exports.LIST_ROLES_WITH_DETAILS = exports.GET_ROLE_LIST_SCHEMA_CURRENT = exports.GET_ROLE_LIST_SCHEMA_VERSION = exports.LIST_ROLE_LIST_SCHEMA_VERSIONS = exports.GET_ROLE_SCHEMA_CURRENT = exports.GET_ROLE_SCHEMA_VERSION = exports.LIST_ROLE_SCHEMA_VERSIONS = exports.GET_ROLE_UPSTREAMS = exports.GET_ROLE_METADATA_SCHEMA = exports.LIST_ENFORCING_ROLES = exports.GET_ROLE_FORM_SCHEMA = exports.UPDATE_ROLE_METADATA = exports.DELETE_ROLE = exports.LIST_ROLES = exports.ENSURE_ROLE_EXISTS = exports.CHECK_ESCALATION_CHAIN_EXISTS = exports.DELETE_ESCALATION_CHAINS_BY_SOURCE = exports.DELETE_ESCALATION_CHAIN = exports.ADD_ESCALATION_CHAIN = exports.INSERT_ESCALATION_CHAIN = exports.GET_ALL_ESCALATION_CHAINS = exports.GET_ESCALATION_TARGETS = void 0;
 exports.GET_ESCALATION_TARGETS = `
   SELECT target_role
   FROM lt_config_role_escalations
@@ -76,6 +76,10 @@ exports.DELETE_ROLE = `
  *
  * default_pins ($31 = provided sentinel, $32 = value) is unversioned config:
  * the pinned-view seeds a role hands its members.
+ *
+ * enforce_schema ($33 = provided sentinel, $34 = value) is unversioned config:
+ * the server-side resolver-validation opt-in. The service layer invalidates
+ * the enforcement cache after this statement commits.
  */
 exports.UPDATE_ROLE_METADATA = `
   WITH updated AS (
@@ -95,6 +99,7 @@ exports.UPDATE_ROLE_METADATA = `
       priority_facet  = CASE WHEN $24::boolean THEN $25                               ELSE priority_facet  END,
       list_schema     = CASE WHEN $29::boolean THEN $30::jsonb                        ELSE list_schema     END,
       default_pins    = CASE WHEN $31::boolean THEN $32::jsonb                        ELSE default_pins    END,
+      enforce_schema  = CASE WHEN $33::boolean THEN COALESCE($34::boolean, false)     ELSE enforce_schema  END,
       current_schema_version = CASE
         WHEN ($6::boolean AND $7::jsonb IS DISTINCT FROM form_schema)
           OR ($8::boolean AND $9::jsonb IS DISTINCT FROM metadata_schema)
@@ -110,7 +115,7 @@ exports.UPDATE_ROLE_METADATA = `
       ops_visible, parent_role, sla_minutes, target_per_hour, worker_count,
       priority_threshold_minutes, priority_facet,
       current_schema_version, list_schema, current_list_schema_version,
-      default_pins
+      default_pins, enforce_schema
   ), snapshot AS (
     INSERT INTO lt_role_schemas (role, version, form_schema, metadata_schema, change_summary)
     SELECT role, current_schema_version, form_schema, metadata_schema, $26
@@ -135,6 +140,13 @@ exports.UPDATE_ROLE_METADATA = `
   SELECT * FROM updated`;
 exports.GET_ROLE_FORM_SCHEMA = `
   SELECT form_schema FROM lt_roles WHERE role = $1`;
+/**
+ * The set of roles with server-side resolver validation turned on. Small and
+ * slow-changing — the enforcement cache holds it under a short TTL so the
+ * resolve hot path costs zero SQL when no role (or no involved role) enforces.
+ */
+exports.LIST_ENFORCING_ROLES = `
+  SELECT role FROM lt_roles WHERE enforce_schema`;
 exports.GET_ROLE_METADATA_SCHEMA = `
   SELECT metadata_schema FROM lt_roles WHERE role = $1`;
 exports.GET_ROLE_UPSTREAMS = `
@@ -245,6 +257,7 @@ exports.LIST_ROLES_WITH_DETAILS = `
     r.list_schema,
     r.current_list_schema_version,
     r.default_pins,
+    r.enforce_schema,
     COALESCE(up.ups, '{}') AS upstream_roles,
     COALESCE(uc.cnt, 0) AS user_count,
     COALESCE(cc.cnt, 0) AS chain_count,

package/build/services/role/types.d.ts

@@ -54,6 +54,13 @@ export interface RoleDetail {
     list_schema: Record<string, any> | null;
     /** Version of the live list_schema; null until the role first carries one. */
     current_list_schema_version: number | null;
+    /**
+     * When true, every resolve surface validates the submitted resolverPayload
+     * against the escalation's resolved form schema (same pass the dashboard
+     * runs) and rejects violations with 422 before any state changes. Opt-in
+     * per role; false leaves resolution behavior unchanged.
+     */
+    enforce_schema: boolean;
     /**
      * Pinned-view seeds this role hands its members: [{ label, url, badge? }].
      * On first render, a member without an own pin of the same label sees these
@@ -133,6 +140,8 @@ export interface UpdateRoleInput {
     worker_count?: number | null;
     priority_threshold_minutes?: number | null;
     priority_facet?: string | null;
+    /** Turn server-side resolver schema validation on/off for this role. */
+    enforce_schema?: boolean;
     /**
      * Replace the upstream-input set (omitted = preserve; null or [] = clear).
      * Every entry must name an existing role other than this one.

package/build/shared/form-validation/derive-field-label.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Human-readable label for a schema field.
+ *
+ * Resolution order:
+ * 1. The JSON Schema `title` keyword — the author's explicit label, always wins.
+ * 2. Snake/kebab keys become Title Case: `left_quantity` → `Left Quantity`.
+ * 3. Single-token keys pass through unchanged: `PO`, `SKU`, `LEFTQUANTITY` —
+ *    a run of capitals carries no word boundaries to recover, and lowercasing
+ *    would mangle acronyms. Authors who want prose labels declare `title`.
+ *
+ * Used everywhere a field name faces a human: form labels, dictionary lists,
+ * the errors panel, and metadata displays.
+ */
+export declare function deriveFieldLabel(key: string, fieldSchema?: Record<string, unknown> | null): string;

package/build/shared/form-validation/derive-field-label.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deriveFieldLabel = deriveFieldLabel;
+/**
+ * Human-readable label for a schema field.
+ *
+ * Resolution order:
+ * 1. The JSON Schema `title` keyword — the author's explicit label, always wins.
+ * 2. Snake/kebab keys become Title Case: `left_quantity` → `Left Quantity`.
+ * 3. Single-token keys pass through unchanged: `PO`, `SKU`, `LEFTQUANTITY` —
+ *    a run of capitals carries no word boundaries to recover, and lowercasing
+ *    would mangle acronyms. Authors who want prose labels declare `title`.
+ *
+ * Used everywhere a field name faces a human: form labels, dictionary lists,
+ * the errors panel, and metadata displays.
+ */
+function deriveFieldLabel(key, fieldSchema) {
+    const title = fieldSchema?.title;
+    if (typeof title === 'string' && title.trim().length > 0)
+        return title.trim();
+    const words = key.split(/[_-]+/).filter(Boolean);
+    if (words.length <= 1)
+        return key;
+    return words
+        .map((w) => (isCapsToken(w) ? w : w.charAt(0).toUpperCase() + w.slice(1)))
+        .join(' ');
+}
+/** All-caps tokens (PO, SKU, ID) keep their casing inside multi-word keys. */
+function isCapsToken(word) {
+    return word.length > 1 && word === word.toUpperCase() && /[A-Z]/.test(word);
+}