@hotmeshio/long-tail 0.18.0 → 0.19.0

package/build/services/escalation/queries.d.ts

@@ -54,6 +54,19 @@ export declare function listFacetKeys(opts: {
     selfRoles?: string[];
     meUserId?: string;
 }): Promise<string[]>;
+/**
+ * Distinct VALUES for one metadata facet key, visible to the caller — feeds
+ * the value picker (e.g. facility → [north, south]) so a bound scope offers
+ * real choices. Role-scoped with the same predicate as {@link listFacetKeys};
+ * the key is parameterized (never interpolated) and charset-validated, so a
+ * malformed key returns [] rather than reaching an unguarded path.
+ */
+export declare function listFacetValues(key: string, opts: {
+    global?: boolean;
+    visibleRoles?: string[];
+    selfRoles?: string[];
+    meUserId?: string;
+}): Promise<string[]>;
 export declare function getEscalationStats(visibleRoles?: string[], period?: string): Promise<EscalationStats>;
 export declare function listDistinctTypes(): Promise<string[]>;
 export declare function listEscalations(filters: {
@@ -108,4 +121,4 @@ export declare function listAvailableEscalations(filters: {
 export declare function invalidateEscalationAggregates(): void;
 /** Test hook: drop cached period metrics AND escalation stats so tests observe fresh rows. */
 export declare function resetStationMetricsCache(): void;
-export declare function getStationMetrics(visibleRoles: string[] | undefined, period?: string): Promise<StationMetric[]>;
+export declare function getStationMetrics(visibleRoles: string[] | undefined, period?: string, facets?: Record<string, unknown>): Promise<StationMetric[]>;

package/build/services/escalation/queries.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.searchEscalationsFaceted = searchEscalationsFaceted;
 exports.getEscalationWithFormSchema = getEscalationWithFormSchema;
 exports.listFacetKeys = listFacetKeys;
+exports.listFacetValues = listFacetValues;
 exports.getEscalationStats = getEscalationStats;
 exports.listDistinctTypes = listDistinctTypes;
 exports.listEscalations = listEscalations;
@@ -42,13 +43,13 @@ function buildSearchOrderBy(sortBy, order) {
     }
     return 'priority ASC, created_at ASC';
 }
-const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const uuid_1 = require("../../lib/uuid");
 /**
  * The id arm of the correlation search binds a uuid param only when the term
  * parses as one — comparing `id::text = $term` casts the uuid column and has
  * no index path, which drags the whole OR into a full history scan.
  */
-const asUuidOrNull = (term) => term && UUID_RE.test(term) ? term : null;
+const asUuidOrNull = (term) => term && uuid_1.UUID_RE.test(term) ? term : null;
 /**
  * Server-side free-text search over the `lt_escalations` view. Runs when a
  * caller supplies a non-empty `search` term — the SDK `client.list()` cannot do
@@ -155,6 +156,9 @@ async function searchEscalationsFaceted(opts) {
  * cast is guarded, so a non-numeric pin simply falls through to the latest form.
  */
 async function getEscalationWithFormSchema(id) {
+    // A non-UUID is definitionally not-found — it must never reach the uuid cast.
+    if (!(0, uuid_1.isUuid)(id))
+        return null;
     await (0, client_1.ensureEscalationCompatView)();
     const pool = (0, db_1.getPool)();
     const { rows } = await pool.query(`SELECT e.*, COALESCE(ps.form_schema, r.form_schema) AS resolved_form_schema
@@ -216,6 +220,39 @@ async function listFacetKeys(opts) {
     }
     return [...actualKeys].sort();
 }
+// Mirrors the server-side facet key rule — metadata keys become a JSON path,
+// so a lookup key is strictly validated before it reaches SQL.
+const FACET_KEY_RE = /^[a-zA-Z0-9_]+$/;
+/**
+ * Distinct VALUES for one metadata facet key, visible to the caller — feeds
+ * the value picker (e.g. facility → [north, south]) so a bound scope offers
+ * real choices. Role-scoped with the same predicate as {@link listFacetKeys};
+ * the key is parameterized (never interpolated) and charset-validated, so a
+ * malformed key returns [] rather than reaching an unguarded path.
+ */
+async function listFacetValues(key, opts) {
+    if (!FACET_KEY_RE.test(key))
+        return [];
+    await (0, client_1.ensureEscalationCompatView)();
+    const pool = (0, db_1.getPool)();
+    const params = [key];
+    const clauses = ["jsonb_typeof(metadata) = 'object'", 'metadata ? $1'];
+    if (!opts.global) {
+        const ai = params.push(opts.visibleRoles?.length ? opts.visibleRoles : null);
+        const si = params.push(opts.selfRoles?.length ? opts.selfRoles : null);
+        const mi = params.push(opts.meUserId || null);
+        clauses.push(`(($${ai}::text[] IS NULL AND $${si}::text[] IS NULL)
+        OR ($${ai}::text[] IS NOT NULL AND role = ANY($${ai}))
+        OR ($${si}::text[] IS NOT NULL AND role = ANY($${si}) AND assigned_to = $${mi}))`);
+    }
+    const { rows } = await pool.query(`SELECT DISTINCT metadata->>$1 AS value
+       FROM public.lt_escalations
+      WHERE ${clauses.join('\n        AND ')}
+        AND metadata->>$1 IS NOT NULL
+      ORDER BY value
+      LIMIT 200`, params);
+    return rows.map((r) => r.value);
+}
 // Escalation stats back the home + overview surfaces and refresh on every
 // escalation event. As of hotmesh 0.25.0 the SDK stats query reads three
 // bounded, index-only sources (pending backlog, created window, resolved
@@ -388,7 +425,7 @@ function resetStationMetricsCache() {
     invalidateEscalationAggregates();
 }
 const toNum = (v) => (v != null ? Number(v) : null);
-async function getStationMetrics(visibleRoles, period) {
+async function getStationMetrics(visibleRoles, period, facets) {
     await (0, client_1.ensureEscalationCompatView)();
     // hasOwnProperty: a caller-supplied period like 'constructor' must fall back
     // to 24h, not resolve to an inherited Object.prototype member.
@@ -396,13 +433,18 @@ async function getStationMetrics(visibleRoles, period) {
         ? types_1.VALID_PERIODS[period]
         : '24 hours';
     const roles = visibleRoles ?? null;
+    // Facet scope rides both queries as a GIN-served `metadata @>` arm; null = no
+    // filter. It never widens role scope — it only narrows within it.
+    const facetJson = facets && Object.keys(facets).length ? JSON.stringify(facets) : null;
     const pool = (0, db_1.getPool)();
     // Live counts: always fresh (cheap — bounded pending working set).
-    // Period metrics: cached ~30s, single-flight (expensive percentile sort).
-    const cacheKey = `${period ?? '24h'}::${roles ? [...roles].sort().join(',') : 'ALL'}`;
+    // Period metrics: cached ~30s, single-flight (expensive percentile sort). The
+    // facet scope is part of the cache key — a scoped board never reads unscoped
+    // rows, and vice versa.
+    const cacheKey = `${period ?? '24h'}::${roles ? [...roles].sort().join(',') : 'ALL'}::${facetJson ?? ''}`;
     const [countsResult, periodRows] = await Promise.all([
-        pool.query(sql_1.STATION_LIVE_COUNTS_SQL, [roles]),
-        stationPeriodCache.resolve(cacheKey, async () => (await pool.query(sql_1.STATION_PERIOD_METRICS_SQL, [roles, intervalStr])).rows),
+        pool.query(sql_1.STATION_LIVE_COUNTS_SQL, [roles, facetJson]),
+        stationPeriodCache.resolve(cacheKey, async () => (await pool.query(sql_1.STATION_PERIOD_METRICS_SQL, [roles, intervalStr, facetJson])).rows),
     ]);
     const periodByRole = new Map(periodRows.map((r) => [r.role, r]));
     return countsResult.rows.map((c) => {

package/build/services/escalation/sql.d.ts

@@ -80,6 +80,7 @@ export declare const RESOLVE_BY_METADATA_ATOMIC = "WITH target AS MATERIALIZED (
  * Live counts — pending, active claims, and priority (past-threshold) per role.
  *
  * $1 TEXT[] — role filter (NULL = all roles / superadmin).
+ * $2 JSONB  — metadata facet scope (NULL = no filter; `metadata @>`, GIN-served).
  *
  * Hits idx_hmsh_esc_pending_role_created (role, created_at DESC) WHERE
  * status='pending'. The pending working set is bounded by real backlog depth,
@@ -102,13 +103,14 @@ export declare const RESOLVE_BY_METADATA_ATOMIC = "WITH target AS MATERIALIZED (
  * with a facet configured, items missing the key or holding an unparseable
  * value do not count (NULL age never passes the comparison).
  */
-export declare const STATION_LIVE_COUNTS_SQL = "\nWITH role_targets AS (\n  SELECT role, sla_minutes, priority_threshold_minutes, priority_facet\n  FROM lt_roles\n  WHERE ($1::text[] IS NULL OR role = ANY($1::text[]))\n),\nlive_counts AS (\n  SELECT\n    e.role,\n    COUNT(*)                                                                         AS pending,\n    COUNT(*) FILTER (WHERE e.assigned_to IS NOT NULL AND e.assigned_until > NOW())  AS claimed,\n    COUNT(*) FILTER (\n      WHERE COALESCE(rt.priority_threshold_minutes, rt.sla_minutes) IS NOT NULL\n        AND (e.assigned_to IS NULL OR e.assigned_until IS NULL OR e.assigned_until <= NOW())\n        AND CASE\n          WHEN rt.priority_facet IS NULL THEN e.created_at\n          WHEN pg_input_is_valid(e.metadata->>rt.priority_facet, 'timestamptz')\n            THEN (e.metadata->>rt.priority_facet)::timestamptz\n          ELSE NULL\n        END < NOW() - (COALESCE(rt.priority_threshold_minutes, rt.sla_minutes) * INTERVAL '1 minute')\n    )                                                                                AS priority_count\n  FROM hmsh_escalations e\n  JOIN role_targets rt ON rt.role = e.role\n  WHERE e.status = 'pending'\n  GROUP BY e.role\n)\nSELECT\n  rt.role,\n  COALESCE(lc.pending,        0) AS pending,\n  COALESCE(lc.claimed,        0) AS claimed,\n  COALESCE(lc.priority_count, 0) AS priority_count\nFROM role_targets rt\nLEFT JOIN live_counts lc ON lc.role = rt.role\nORDER BY rt.role\n";
+export declare const STATION_LIVE_COUNTS_SQL = "\nWITH role_targets AS (\n  SELECT role, sla_minutes, priority_threshold_minutes, priority_facet\n  FROM lt_roles\n  WHERE ($1::text[] IS NULL OR role = ANY($1::text[]))\n),\nlive_counts AS (\n  SELECT\n    e.role,\n    COUNT(*)                                                                         AS pending,\n    COUNT(*) FILTER (WHERE e.assigned_to IS NOT NULL AND e.assigned_until > NOW())  AS claimed,\n    COUNT(*) FILTER (\n      WHERE COALESCE(rt.priority_threshold_minutes, rt.sla_minutes) IS NOT NULL\n        AND (e.assigned_to IS NULL OR e.assigned_until IS NULL OR e.assigned_until <= NOW())\n        AND CASE\n          WHEN rt.priority_facet IS NULL THEN e.created_at\n          WHEN pg_input_is_valid(e.metadata->>rt.priority_facet, 'timestamptz')\n            THEN (e.metadata->>rt.priority_facet)::timestamptz\n          ELSE NULL\n        END < NOW() - (COALESCE(rt.priority_threshold_minutes, rt.sla_minutes) * INTERVAL '1 minute')\n    )                                                                                AS priority_count\n  FROM hmsh_escalations e\n  JOIN role_targets rt ON rt.role = e.role\n  WHERE e.status = 'pending'\n    AND ($2::jsonb IS NULL OR e.metadata @> $2::jsonb)\n  GROUP BY e.role\n)\nSELECT\n  rt.role,\n  COALESCE(lc.pending,        0) AS pending,\n  COALESCE(lc.claimed,        0) AS claimed,\n  COALESCE(lc.priority_count, 0) AS priority_count\nFROM role_targets rt\nLEFT JOIN live_counts lc ON lc.role = rt.role\nORDER BY rt.role\n";
 /**
  * Period metrics — resolved count, throughput efficiency, and P99/P50/avg/max
  * latency for wait (queue time) and work (processing) per role.
  *
  * $1 TEXT[]   — role filter (NULL = all roles / superadmin).
  * $2 INTERVAL — time window (e.g. '24 hours', '15 minutes').
+ * $3 JSONB    — metadata facet scope (NULL = no filter; `metadata @>`, GIN-served).
  *
  * Hits idx_hmsh_esc_resolved_cover (role, resolved_at DESC, claimed_at,
  * created_at) WHERE status='resolved' — a covering index, so the percentile
@@ -119,4 +121,4 @@ export declare const STATION_LIVE_COUNTS_SQL = "\nWITH role_targets AS (\n  SELE
  * mix of resolved + in-flight — a clean "how did completed work perform?" read.
  * throughput_pct is NULL when the role has no target_per_hour (NULLIF guard).
  */
-export declare const STATION_PERIOD_METRICS_SQL = "\nWITH role_targets AS (\n  SELECT role, target_per_hour\n  FROM lt_roles\n  WHERE ($1::text[] IS NULL OR role = ANY($1::text[]))\n),\nperiod_metrics AS (\n  SELECT\n    e.role,\n    COUNT(*)                                                                         AS resolved,\n    ROUND((PERCENTILE_CONT(0.99) WITHIN GROUP (\n      ORDER BY EXTRACT(EPOCH FROM (e.claimed_at - e.created_at)) / 60)\n      FILTER (WHERE e.claimed_at IS NOT NULL))::numeric, 3)                        AS p99_wait_min,\n    ROUND((PERCENTILE_CONT(0.50) WITHIN GROUP (\n      ORDER BY EXTRACT(EPOCH FROM (e.claimed_at - e.created_at)) / 60)\n      FILTER (WHERE e.claimed_at IS NOT NULL))::numeric, 3)                        AS p50_wait_min,\n    ROUND((AVG(EXTRACT(EPOCH FROM (e.claimed_at - e.created_at)) / 60)\n      FILTER (WHERE e.claimed_at IS NOT NULL))::numeric, 3)                        AS avg_wait_min,\n    ROUND((MAX(EXTRACT(EPOCH FROM (e.claimed_at - e.created_at)) / 60)\n      FILTER (WHERE e.claimed_at IS NOT NULL))::numeric, 3)                        AS max_wait_min,\n    ROUND((PERCENTILE_CONT(0.99) WITHIN GROUP (\n      ORDER BY EXTRACT(EPOCH FROM (e.resolved_at - e.claimed_at)) / 60)\n      FILTER (WHERE e.claimed_at IS NOT NULL))::numeric, 3)                        AS p99_work_min,\n    ROUND((PERCENTILE_CONT(0.50) WITHIN GROUP (\n      ORDER BY EXTRACT(EPOCH FROM (e.resolved_at - e.claimed_at)) / 60)\n      FILTER (WHERE e.claimed_at IS NOT NULL))::numeric, 3)                        AS p50_work_min,\n    ROUND((AVG(EXTRACT(EPOCH FROM (e.resolved_at - e.claimed_at)) / 60)\n      FILTER (WHERE e.claimed_at IS NOT NULL))::numeric, 3)                        AS avg_work_min,\n    ROUND((MAX(EXTRACT(EPOCH FROM (e.resolved_at - e.claimed_at)) / 60)\n      FILTER (WHERE e.claimed_at IS NOT NULL))::numeric, 3)                        AS max_work_min\n  FROM hmsh_escalations e\n  WHERE e.status = 'resolved'\n    AND e.resolved_at >= NOW() - $2::interval\n    AND ($1::text[] IS NULL OR e.role = ANY($1::text[]))\n  GROUP BY e.role\n)\nSELECT\n  rt.role,\n  COALESCE(pm.resolved, 0) AS resolved,\n  ROUND(\n    (COALESCE(pm.resolved, 0)::numeric\n      / NULLIF(rt.target_per_hour::numeric * EXTRACT(EPOCH FROM $2::interval) / 3600.0, 0)\n      * 100\n    )::numeric, 1\n  )                        AS throughput_pct,\n  pm.p99_wait_min,\n  pm.p50_wait_min,\n  pm.avg_wait_min,\n  pm.max_wait_min,\n  pm.p99_work_min,\n  pm.p50_work_min,\n  pm.avg_work_min,\n  pm.max_work_min\nFROM role_targets rt\nLEFT JOIN period_metrics pm ON pm.role = rt.role\nORDER BY rt.role\n";
+export declare const STATION_PERIOD_METRICS_SQL = "\nWITH role_targets AS (\n  SELECT role, target_per_hour\n  FROM lt_roles\n  WHERE ($1::text[] IS NULL OR role = ANY($1::text[]))\n),\nperiod_metrics AS (\n  SELECT\n    e.role,\n    COUNT(*)                                                                         AS resolved,\n    ROUND((PERCENTILE_CONT(0.99) WITHIN GROUP (\n      ORDER BY EXTRACT(EPOCH FROM (e.claimed_at - e.created_at)) / 60)\n      FILTER (WHERE e.claimed_at IS NOT NULL))::numeric, 3)                        AS p99_wait_min,\n    ROUND((PERCENTILE_CONT(0.50) WITHIN GROUP (\n      ORDER BY EXTRACT(EPOCH FROM (e.claimed_at - e.created_at)) / 60)\n      FILTER (WHERE e.claimed_at IS NOT NULL))::numeric, 3)                        AS p50_wait_min,\n    ROUND((AVG(EXTRACT(EPOCH FROM (e.claimed_at - e.created_at)) / 60)\n      FILTER (WHERE e.claimed_at IS NOT NULL))::numeric, 3)                        AS avg_wait_min,\n    ROUND((MAX(EXTRACT(EPOCH FROM (e.claimed_at - e.created_at)) / 60)\n      FILTER (WHERE e.claimed_at IS NOT NULL))::numeric, 3)                        AS max_wait_min,\n    ROUND((PERCENTILE_CONT(0.99) WITHIN GROUP (\n      ORDER BY EXTRACT(EPOCH FROM (e.resolved_at - e.claimed_at)) / 60)\n      FILTER (WHERE e.claimed_at IS NOT NULL))::numeric, 3)                        AS p99_work_min,\n    ROUND((PERCENTILE_CONT(0.50) WITHIN GROUP (\n      ORDER BY EXTRACT(EPOCH FROM (e.resolved_at - e.claimed_at)) / 60)\n      FILTER (WHERE e.claimed_at IS NOT NULL))::numeric, 3)                        AS p50_work_min,\n    ROUND((AVG(EXTRACT(EPOCH FROM (e.resolved_at - e.claimed_at)) / 60)\n      FILTER (WHERE e.claimed_at IS NOT NULL))::numeric, 3)                        AS avg_work_min,\n    ROUND((MAX(EXTRACT(EPOCH FROM (e.resolved_at - e.claimed_at)) / 60)\n      FILTER (WHERE e.claimed_at IS NOT NULL))::numeric, 3)                        AS max_work_min\n  FROM hmsh_escalations e\n  WHERE e.status = 'resolved'\n    AND e.resolved_at >= NOW() - $2::interval\n    AND ($1::text[] IS NULL OR e.role = ANY($1::text[]))\n    AND ($3::jsonb IS NULL OR e.metadata @> $3::jsonb)\n  GROUP BY e.role\n)\nSELECT\n  rt.role,\n  COALESCE(pm.resolved, 0) AS resolved,\n  ROUND(\n    (COALESCE(pm.resolved, 0)::numeric\n      / NULLIF(rt.target_per_hour::numeric * EXTRACT(EPOCH FROM $2::interval) / 3600.0, 0)\n      * 100\n    )::numeric, 1\n  )                        AS throughput_pct,\n  pm.p99_wait_min,\n  pm.p50_wait_min,\n  pm.avg_wait_min,\n  pm.max_wait_min,\n  pm.p99_work_min,\n  pm.p50_work_min,\n  pm.avg_work_min,\n  pm.max_work_min\nFROM role_targets rt\nLEFT JOIN period_metrics pm ON pm.role = rt.role\nORDER BY rt.role\n";

package/build/services/escalation/sql.js

@@ -270,6 +270,7 @@ LEFT JOIN written ON written.id = target.id`;
  * Live counts — pending, active claims, and priority (past-threshold) per role.
  *
  * $1 TEXT[] — role filter (NULL = all roles / superadmin).
+ * $2 JSONB  — metadata facet scope (NULL = no filter; `metadata @>`, GIN-served).
  *
  * Hits idx_hmsh_esc_pending_role_created (role, created_at DESC) WHERE
  * status='pending'. The pending working set is bounded by real backlog depth,
@@ -316,6 +317,7 @@ live_counts AS (
   FROM hmsh_escalations e
   JOIN role_targets rt ON rt.role = e.role
   WHERE e.status = 'pending'
+    AND ($2::jsonb IS NULL OR e.metadata @> $2::jsonb)
   GROUP BY e.role
 )
 SELECT
@@ -333,6 +335,7 @@ ORDER BY rt.role
  *
  * $1 TEXT[]   — role filter (NULL = all roles / superadmin).
  * $2 INTERVAL — time window (e.g. '24 hours', '15 minutes').
+ * $3 JSONB    — metadata facet scope (NULL = no filter; `metadata @>`, GIN-served).
  *
  * Hits idx_hmsh_esc_resolved_cover (role, resolved_at DESC, claimed_at,
  * created_at) WHERE status='resolved' — a covering index, so the percentile
@@ -377,6 +380,7 @@ period_metrics AS (
   WHERE e.status = 'resolved'
     AND e.resolved_at >= NOW() - $2::interval
     AND ($1::text[] IS NULL OR e.role = ANY($1::text[]))
+    AND ($3::jsonb IS NULL OR e.metadata @> $3::jsonb)
   GROUP BY e.role
 )
 SELECT

package/build/services/role/types.d.ts

@@ -15,13 +15,31 @@ export interface EscalationChain {
  *    MEMBER of exactly this one role, the dashboard drops the left nav, the
  *    role's escalation list becomes home, and navigation is held to the list,
  *    the detail page, and the scan screens. Multi-role users get full chrome.
+ *  - LINK_VARIABLES: RoleLinkVariable[] — metadata facet names members bind
+ *    per device. Pins may reference `{lt:name}` as a whole facet value
+ *    (e.g. `facets={"region":"{lt:region}"}`); the dashboard substitutes
+ *    the device's bound value at render time, falls back to the declared
+ *    default, and drops the facet entirely when both are unset.
  */
 export declare const ROLE_PROPERTY_KEYS: {
     readonly ON_CANCEL: "on_cancel";
     readonly ON_TIMEOUT: "on_timeout";
     readonly WORKED_BY: "worked_by";
     readonly KIOSK: "kiosk";
+    readonly LINK_VARIABLES: "link_variables";
 };
+/**
+ * One link-variable declaration inside `properties.link_variables`. `name` is
+ * the metadata facet key (facet-key charset); `label` is the human annotation
+ * the binding modal shows; `default` is the value used when the device has no
+ * binding. Values are strings — jsonb containment is type-sensitive, so
+ * numeric facets are not templatable.
+ */
+export interface RoleLinkVariable {
+    name: string;
+    label?: string;
+    default?: string;
+}
 export interface RoleDetail {
     role: string;
     title: string | null;

package/build/services/role/types.js

@@ -14,10 +14,16 @@ exports.ROLE_PROPERTY_KEYS = void 0;
  *    MEMBER of exactly this one role, the dashboard drops the left nav, the
  *    role's escalation list becomes home, and navigation is held to the list,
  *    the detail page, and the scan screens. Multi-role users get full chrome.
+ *  - LINK_VARIABLES: RoleLinkVariable[] — metadata facet names members bind
+ *    per device. Pins may reference `{lt:name}` as a whole facet value
+ *    (e.g. `facets={"region":"{lt:region}"}`); the dashboard substitutes
+ *    the device's bound value at render time, falls back to the declared
+ *    default, and drops the facet entirely when both are unset.
  */
 exports.ROLE_PROPERTY_KEYS = {
     ON_CANCEL: 'on_cancel',
     ON_TIMEOUT: 'on_timeout',
     WORKED_BY: 'worked_by',
     KIOSK: 'kiosk',
+    LINK_VARIABLES: 'link_variables',
 };

package/build/services/user/auth.js

@@ -16,11 +16,11 @@ const sql_1 = require("./sql");
  */
 async function verifyPassword(externalId, password) {
     const pool = (0, db_1.getPool)();
-    const { rows } = await pool.query(sql_1.GET_USER_BY_EXTERNAL_ID, [externalId]);
+    const { rows } = await pool.query(sql_1.GET_USER_FOR_AUTH, [externalId]);
     if (!rows[0] || !rows[0].password_hash)
         return null;
     const valid = await bcryptjs_1.default.compare(password, rows[0].password_hash);
     if (!valid)
         return null;
-    return (0, crud_1.attachRoles)(rows[0]);
+    return (0, crud_1.getUser)(rows[0].id);
 }

package/build/services/user/crud.d.ts

@@ -3,6 +3,19 @@ import type { CreateUserInput, UpdateUserInput, UserPropertyOps } from './types'
 export declare function attachRoles(user: any): Promise<LTUserRecord>;
 export declare function createUser(input: CreateUserInput): Promise<LTUserRecord>;
 export declare function getUser(id: string): Promise<LTUserRecord | null>;
+export interface UserNameRecord {
+    id: string;
+    display_name: string | null;
+    external_id: string;
+    email: string | null;
+}
+/**
+ * Resolve many user ids to display fields in one query. Non-UUID input is
+ * dropped before the SQL (a bad id is not-found, never a 500), ids are deduped,
+ * and the batch is capped. Returns display fields only — never secrets, scopes,
+ * or metadata.
+ */
+export declare function getUserNames(ids: string[]): Promise<UserNameRecord[]>;
 export declare function getUserByExternalId(externalId: string): Promise<LTUserRecord | null>;
 export declare function getUserByEmail(email: string): Promise<LTUserRecord | null>;
 /**

package/build/services/user/crud.js

@@ -7,6 +7,7 @@ exports.UserPropertyValidationError = exports.UserPropertyConflictError = void 0
 exports.attachRoles = attachRoles;
 exports.createUser = createUser;
 exports.getUser = getUser;
+exports.getUserNames = getUserNames;
 exports.getUserByExternalId = getUserByExternalId;
 exports.getUserByEmail = getUserByEmail;
 exports.getUserByMetadataValue = getUserByMetadataValue;
@@ -18,14 +19,21 @@ exports.listUsers = listUsers;
 const bcryptjs_1 = __importDefault(require("bcryptjs"));
 const db_1 = require("../../lib/db");
 const sql_1 = require("./sql");
+const uuid_1 = require("../../lib/uuid");
 const scan_code_1 = require("../scan-code");
 const scan_code_2 = require("../../types/scan-code");
 const scope_1 = require("./scope");
 // ─── Private helpers (exported for internal use by auth.ts) ──────────────────
+/** Last-line guard: strip credentials before any user record leaves the service, so a stray SELECT * can never leak them. */
+function stripUserSecrets(user) {
+    delete user.password_hash;
+    delete user.oauth_provider_id;
+    return user;
+}
 async function attachRoles(user) {
     const pool = (0, db_1.getPool)();
     const { rows } = await pool.query(sql_1.GET_ROLES_BY_USER_ID, [user.id]);
-    return { ...user, roles: rows };
+    return stripUserSecrets({ ...user, roles: rows });
 }
 async function attachRolesToMany(users) {
     if (users.length === 0)
@@ -45,7 +53,7 @@ async function attachRolesToMany(users) {
         });
         roleMap.set(row.user_id, list);
     }
-    return users.map((u) => ({ ...u, roles: roleMap.get(u.id) || [] }));
+    return users.map((u) => stripUserSecrets({ ...u, roles: roleMap.get(u.id) || [] }));
 }
 // ─── CRUD ─────────────────────────────────────────────────────────────────────
 async function createUser(input) {
@@ -85,6 +93,21 @@ async function getUser(id) {
         return null;
     return attachRoles(rows[0]);
 }
+const MAX_NAME_LOOKUP = 200;
+/**
+ * Resolve many user ids to display fields in one query. Non-UUID input is
+ * dropped before the SQL (a bad id is not-found, never a 500), ids are deduped,
+ * and the batch is capped. Returns display fields only — never secrets, scopes,
+ * or metadata.
+ */
+async function getUserNames(ids) {
+    const clean = [...new Set((0, uuid_1.onlyUuids)(ids))].slice(0, MAX_NAME_LOOKUP);
+    if (clean.length === 0)
+        return [];
+    const pool = (0, db_1.getPool)();
+    const { rows } = await pool.query(sql_1.GET_NAMES_BY_IDS, [clean]);
+    return rows;
+}
 async function getUserByExternalId(externalId) {
     const pool = (0, db_1.getPool)();
     const { rows } = await pool.query(sql_1.GET_USER_BY_EXTERNAL_ID, [externalId]);
@@ -288,7 +311,7 @@ async function listUsers(filters) {
     const offset = filters.offset || 0;
     const [countResult, dataResult] = await Promise.all([
         pool.query(`SELECT COUNT(DISTINCT u.id) FROM lt_users u ${join} ${where}`, values),
-        pool.query(`SELECT DISTINCT u.* FROM lt_users u ${join} ${where} ORDER BY u.created_at DESC LIMIT $${idx++} OFFSET $${idx++}`, [...values, limit, offset]),
+        pool.query(`SELECT DISTINCT ${sql_1.USER_SAFE_COLUMNS_U} FROM lt_users u ${join} ${where} ORDER BY u.created_at DESC LIMIT $${idx++} OFFSET $${idx++}`, [...values, limit, offset]),
     ]);
     return {
         users: await attachRolesToMany(dataResult.rows),

package/build/services/user/index.d.ts

@@ -1,5 +1,5 @@
 export { CreateUserInput, UpdateUserInput, UserPropertyOps, VALID_ROLE_TYPES } from './types';
-export { createUser, getUser, getUserByExternalId, getUserByEmail, getUserByMetadataValue, updateUser, patchUserProperties, getIdentityPropertyKeys, UserPropertyConflictError, UserPropertyValidationError, deleteUser, listUsers, } from './crud';
+export { createUser, getUser, getUserNames, UserNameRecord, getUserByExternalId, getUserByEmail, getUserByMetadataValue, updateUser, patchUserProperties, getIdentityPropertyKeys, UserPropertyConflictError, UserPropertyValidationError, deleteUser, listUsers, } from './crud';
 export { isValidRoleType, addUserRole, grantRoleIfAbsent, removeUserRole, getUserRoles, hasRole, hasRoleType, } from './roles';
 export { isSuperAdmin, isGroupAdmin, canManageRole, hasGlobalEscalationAccess, hasRolesAsAdmin, getRoleScope, getRoleWriteScope } from './rbac';
 export { READ_SCOPES, WRITE_SCOPES, DEFAULT_READ_SCOPE, DEFAULT_WRITE_SCOPE, isValidReadScope, isValidWriteScope, isValidScopePair, effectiveScope, } from './scope';

package/build/services/user/index.js

@@ -1,11 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PREFERENCES_MAX_BYTES = exports.patchPreferences = exports.getPreferences = exports.seedAdmin = exports.verifyPassword = exports.effectiveScope = exports.isValidScopePair = exports.isValidWriteScope = exports.isValidReadScope = exports.DEFAULT_WRITE_SCOPE = exports.DEFAULT_READ_SCOPE = exports.WRITE_SCOPES = exports.READ_SCOPES = exports.getRoleWriteScope = exports.getRoleScope = exports.hasRolesAsAdmin = exports.hasGlobalEscalationAccess = exports.canManageRole = exports.isGroupAdmin = exports.isSuperAdmin = exports.hasRoleType = exports.hasRole = exports.getUserRoles = exports.removeUserRole = exports.grantRoleIfAbsent = exports.addUserRole = exports.isValidRoleType = exports.listUsers = exports.deleteUser = exports.UserPropertyValidationError = exports.UserPropertyConflictError = exports.getIdentityPropertyKeys = exports.patchUserProperties = exports.updateUser = exports.getUserByMetadataValue = exports.getUserByEmail = exports.getUserByExternalId = exports.getUser = exports.createUser = exports.VALID_ROLE_TYPES = void 0;
+exports.PREFERENCES_MAX_BYTES = exports.patchPreferences = exports.getPreferences = exports.seedAdmin = exports.verifyPassword = exports.effectiveScope = exports.isValidScopePair = exports.isValidWriteScope = exports.isValidReadScope = exports.DEFAULT_WRITE_SCOPE = exports.DEFAULT_READ_SCOPE = exports.WRITE_SCOPES = exports.READ_SCOPES = exports.getRoleWriteScope = exports.getRoleScope = exports.hasRolesAsAdmin = exports.hasGlobalEscalationAccess = exports.canManageRole = exports.isGroupAdmin = exports.isSuperAdmin = exports.hasRoleType = exports.hasRole = exports.getUserRoles = exports.removeUserRole = exports.grantRoleIfAbsent = exports.addUserRole = exports.isValidRoleType = exports.listUsers = exports.deleteUser = exports.UserPropertyValidationError = exports.UserPropertyConflictError = exports.getIdentityPropertyKeys = exports.patchUserProperties = exports.updateUser = exports.getUserByMetadataValue = exports.getUserByEmail = exports.getUserByExternalId = exports.getUserNames = exports.getUser = exports.createUser = exports.VALID_ROLE_TYPES = void 0;
 var types_1 = require("./types");
 Object.defineProperty(exports, "VALID_ROLE_TYPES", { enumerable: true, get: function () { return types_1.VALID_ROLE_TYPES; } });
 var crud_1 = require("./crud");
 Object.defineProperty(exports, "createUser", { enumerable: true, get: function () { return crud_1.createUser; } });
 Object.defineProperty(exports, "getUser", { enumerable: true, get: function () { return crud_1.getUser; } });
+Object.defineProperty(exports, "getUserNames", { enumerable: true, get: function () { return crud_1.getUserNames; } });
 Object.defineProperty(exports, "getUserByExternalId", { enumerable: true, get: function () { return crud_1.getUserByExternalId; } });
 Object.defineProperty(exports, "getUserByEmail", { enumerable: true, get: function () { return crud_1.getUserByEmail; } });
 Object.defineProperty(exports, "getUserByMetadataValue", { enumerable: true, get: function () { return crud_1.getUserByMetadataValue; } });

package/build/services/user/sql.d.ts

@@ -1,10 +1,14 @@
+export declare const USER_SAFE_COLUMNS: string;
+export declare const USER_SAFE_COLUMNS_U: string;
 /** Ensure a role name exists in the lt_roles lookup table (FK target). */
 export declare const ENSURE_ROLE_EXISTS = "INSERT INTO lt_roles (role) VALUES ($1) ON CONFLICT DO NOTHING";
 /** Fetch roles for a single user, ordered by creation time. granted_by_persona
  *  is the sustaining persona's key (null = direct grant). */
 export declare const GET_ROLES_BY_USER_ID = "SELECT r.role, r.type, r.read_scope, r.write_scope, r.created_at, p.key AS granted_by_persona\n   FROM lt_user_roles r\n   LEFT JOIN lt_personas p ON p.id = r.granted_by_persona\n   WHERE r.user_id = $1 ORDER BY r.created_at";
 /** Fetch a user row by external_id. */
-export declare const GET_USER_BY_EXTERNAL_ID = "SELECT * FROM lt_users WHERE external_id = $1";
+export declare const GET_USER_BY_EXTERNAL_ID: string;
+/** Password-check only: the one query that reads the hash, never returned to a client. */
+export declare const GET_USER_FOR_AUTH = "SELECT id, password_hash FROM lt_users WHERE external_id = $1";
 /**
  * Create a user and its role assignments in ONE atomic statement. The user row,
  * the lt_roles FK targets ($9 = role names), and the lt_user_roles links
@@ -15,9 +19,11 @@ export declare const GET_USER_BY_EXTERNAL_ID = "SELECT * FROM lt_users WHERE ext
  * end, after the sibling role-ensure CTE has run, so brand-new roles are valid
  * FK targets.
  */
-export declare const CREATE_USER_WITH_ROLES = "WITH new_user AS (\n     INSERT INTO lt_users (external_id, email, display_name, status, metadata, password_hash, oauth_provider, oauth_provider_id)\n     VALUES ($1, $2, $3, $4, $5, $6, $7, $8)\n     RETURNING *\n   ), ensured_roles AS (\n     INSERT INTO lt_roles (role)\n     SELECT DISTINCT unnest($9::text[])\n     ON CONFLICT DO NOTHING\n   ), assigned_roles AS (\n     INSERT INTO lt_user_roles (user_id, role, type, read_scope, write_scope)\n     SELECT (SELECT id FROM new_user), x.role, x.type, x.read_scope, x.write_scope\n     FROM unnest($9::text[], $10::text[], $11::text[], $12::text[]) AS x(role, type, read_scope, write_scope)\n     ON CONFLICT DO NOTHING\n   )\n   SELECT * FROM new_user";
-export declare const GET_USER_BY_EMAIL = "SELECT * FROM lt_users WHERE email = $1 LIMIT 1";
-export declare const GET_USER_BY_ID = "SELECT * FROM lt_users WHERE id = $1";
+export declare const CREATE_USER_WITH_ROLES: string;
+export declare const GET_USER_BY_EMAIL: string;
+export declare const GET_USER_BY_ID: string;
+/** Thin identity projection for batch name resolution — display fields only, never secrets, scopes, or metadata. */
+export declare const GET_NAMES_BY_IDS = "SELECT id, display_name, external_id, email FROM lt_users WHERE id = ANY($1)";
 /**
  * Lookup by a caller-named metadata key (e.g. a badge binding). LIMIT 2 so an
  * ambiguous binding — two users carrying the same value — is detectable and
@@ -25,7 +31,7 @@ export declare const GET_USER_BY_ID = "SELECT * FROM lt_users WHERE id = $1";
  * is the people table (small); revisit with a GIN index on metadata if a
  * deployment ever holds tens of thousands of users.
  */
-export declare const GET_USERS_BY_METADATA_VALUE = "SELECT * FROM lt_users WHERE metadata->>$1 = $2 AND status = 'active' LIMIT 2";
+export declare const GET_USERS_BY_METADATA_VALUE: string;
 /** Check if a user exists by id. Lightweight — returns only the id column. */
 export declare const VERIFY_USER_BY_ID = "SELECT id FROM lt_users WHERE id = $1 LIMIT 1";
 /**

package/build/services/user/sql.js

@@ -1,7 +1,15 @@
 "use strict";
 // ─── Shared queries (used by multiple modules) ──────────────────────────────
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.IS_GROUP_ADMIN = exports.GET_ROLE_SCOPE = exports.HAS_ROLE_TYPE = exports.HAS_ROLE = exports.DELETE_USER_ROLE = exports.INSERT_USER_ROLE_IF_ABSENT = exports.UPSERT_USER_ROLE = exports.GET_ROLES_BY_USER_IDS = exports.DELETE_USER_BY_ID = exports.GET_USER_WITH_ROLES = exports.PATCH_USER_PROPERTIES = exports.VERIFY_USER_BY_ID = exports.GET_USERS_BY_METADATA_VALUE = exports.GET_USER_BY_ID = exports.GET_USER_BY_EMAIL = exports.CREATE_USER_WITH_ROLES = exports.GET_USER_BY_EXTERNAL_ID = exports.GET_ROLES_BY_USER_ID = exports.ENSURE_ROLE_EXISTS = void 0;
+exports.IS_GROUP_ADMIN = exports.GET_ROLE_SCOPE = exports.HAS_ROLE_TYPE = exports.HAS_ROLE = exports.DELETE_USER_ROLE = exports.INSERT_USER_ROLE_IF_ABSENT = exports.UPSERT_USER_ROLE = exports.GET_ROLES_BY_USER_IDS = exports.DELETE_USER_BY_ID = exports.GET_USER_WITH_ROLES = exports.PATCH_USER_PROPERTIES = exports.VERIFY_USER_BY_ID = exports.GET_USERS_BY_METADATA_VALUE = exports.GET_NAMES_BY_IDS = exports.GET_USER_BY_ID = exports.GET_USER_BY_EMAIL = exports.CREATE_USER_WITH_ROLES = exports.GET_USER_FOR_AUTH = exports.GET_USER_BY_EXTERNAL_ID = exports.GET_ROLES_BY_USER_ID = exports.ENSURE_ROLE_EXISTS = exports.USER_SAFE_COLUMNS_U = exports.USER_SAFE_COLUMNS = void 0;
+/**
+ * Every lt_users column a client may see. password_hash and oauth_provider_id
+ * are credentials and never appear here — no user read path selects them (the
+ * password check has its own GET_USER_FOR_AUTH). `U` prefixes for a joined list.
+ */
+const USER_COLS = ['id', 'external_id', 'email', 'display_name', 'status', 'account_type', 'oauth_provider', 'metadata', 'created_at', 'updated_at', 'preferences'];
+exports.USER_SAFE_COLUMNS = USER_COLS.join(', ');
+exports.USER_SAFE_COLUMNS_U = USER_COLS.map((c) => `u.${c}`).join(', ');
 /** Ensure a role name exists in the lt_roles lookup table (FK target). */
 exports.ENSURE_ROLE_EXISTS = 'INSERT INTO lt_roles (role) VALUES ($1) ON CONFLICT DO NOTHING';
 /** Fetch roles for a single user, ordered by creation time. granted_by_persona
@@ -11,7 +19,9 @@ exports.GET_ROLES_BY_USER_ID = `SELECT r.role, r.type, r.read_scope, r.write_sco
    LEFT JOIN lt_personas p ON p.id = r.granted_by_persona
    WHERE r.user_id = $1 ORDER BY r.created_at`;
 /** Fetch a user row by external_id. */
-exports.GET_USER_BY_EXTERNAL_ID = 'SELECT * FROM lt_users WHERE external_id = $1';
+exports.GET_USER_BY_EXTERNAL_ID = `SELECT ${exports.USER_SAFE_COLUMNS} FROM lt_users WHERE external_id = $1`;
+/** Password-check only: the one query that reads the hash, never returned to a client. */
+exports.GET_USER_FOR_AUTH = 'SELECT id, password_hash FROM lt_users WHERE external_id = $1';
 // ─── User CRUD ───────────────────────────────────────────────────────────────
 /**
  * Create a user and its role assignments in ONE atomic statement. The user row,
@@ -37,9 +47,11 @@ exports.CREATE_USER_WITH_ROLES = `WITH new_user AS (
      FROM unnest($9::text[], $10::text[], $11::text[], $12::text[]) AS x(role, type, read_scope, write_scope)
      ON CONFLICT DO NOTHING
    )
-   SELECT * FROM new_user`;
-exports.GET_USER_BY_EMAIL = `SELECT * FROM lt_users WHERE email = $1 LIMIT 1`;
-exports.GET_USER_BY_ID = 'SELECT * FROM lt_users WHERE id = $1';
+   SELECT ${exports.USER_SAFE_COLUMNS} FROM new_user`;
+exports.GET_USER_BY_EMAIL = `SELECT ${exports.USER_SAFE_COLUMNS} FROM lt_users WHERE email = $1 LIMIT 1`;
+exports.GET_USER_BY_ID = `SELECT ${exports.USER_SAFE_COLUMNS} FROM lt_users WHERE id = $1`;
+/** Thin identity projection for batch name resolution — display fields only, never secrets, scopes, or metadata. */
+exports.GET_NAMES_BY_IDS = 'SELECT id, display_name, external_id, email FROM lt_users WHERE id = ANY($1)';
 /**
  * Lookup by a caller-named metadata key (e.g. a badge binding). LIMIT 2 so an
  * ambiguous binding — two users carrying the same value — is detectable and
@@ -47,7 +59,7 @@ exports.GET_USER_BY_ID = 'SELECT * FROM lt_users WHERE id = $1';
  * is the people table (small); revisit with a GIN index on metadata if a
  * deployment ever holds tens of thousands of users.
  */
-exports.GET_USERS_BY_METADATA_VALUE = `SELECT * FROM lt_users WHERE metadata->>$1 = $2 AND status = 'active' LIMIT 2`;
+exports.GET_USERS_BY_METADATA_VALUE = `SELECT ${exports.USER_SAFE_COLUMNS} FROM lt_users WHERE metadata->>$1 = $2 AND status = 'active' LIMIT 2`;
 /** Check if a user exists by id. Lightweight — returns only the id column. */
 exports.VERIFY_USER_BY_ID = 'SELECT id FROM lt_users WHERE id = $1 LIMIT 1';
 /**

package/build/start/adapters.js

@@ -16,6 +16,7 @@ const escalation_strategy_1 = require("../services/escalation-strategy");
 const default_1 = require("../services/escalation-strategy/default");
 const mcp_2 = require("../services/escalation-strategy/mcp");
 const features_1 = require("../modules/features");
+const search_1 = require("../modules/search");
 const branding_1 = require("../modules/branding");
 const socket_auth_1 = require("./socket-auth");
 /**
@@ -25,6 +26,7 @@ const socket_auth_1 = require("./socket-auth");
 function registerAdapters(startConfig) {
     // Dashboard feature flags (default permissive; deployment opts out).
     (0, features_1.configureFeatureFlags)(startConfig.features);
+    (0, search_1.configureSearch)(startConfig.search);
     (0, branding_1.configureBranding)(startConfig.branding);
     // Logging (register first so subsequent log calls use it)
     if (startConfig.logging?.adapter) {