@hotmeshio/long-tail 0.18.1 → 0.19.1

package/build/api/escalations/index.d.ts

@@ -1,5 +1,5 @@
 export { createEscalation } from './create';
-export { listEscalations, listAvailableEscalations, listDistinctTypes, listFacetKeys, getEscalationStats, getStationMetrics } from './list';
+export { listEscalations, listAvailableEscalations, listDistinctTypes, listFacetKeys, listFacetValues, getEscalationStats, getStationMetrics } from './list';
 export { getEscalation, getEscalationsByWorkflowId, escalateToRole } from './single';
 export { getEscalationLookups } from './lookups';
 export { claimEscalation, releaseEscalation } from './claim';

package/build/api/escalations/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.timelineByFacet = exports.aggregateByFacets = exports.claimByFacets = exports.claimGroups = exports.searchByFacets = exports.bulkCancel = exports.cancelSingleEscalation = exports.resolveByMetadata = exports.claimByMetadata = exports.findByMetadata = exports.resolveBatchItemByMetadata = exports.resolveBatchItemBySignalKey = exports.resolveBatchItem = exports.resolveAllOrNone = exports.resolveByIds = exports.resolveBySignalKey = exports.resolveEscalation = exports.bulkTriage = exports.bulkEscalate = exports.bulkUnassign = exports.bulkAssign = exports.bulkClaim = exports.updatePriority = exports.releaseExpiredClaims = exports.releaseEscalation = exports.claimEscalation = exports.getEscalationLookups = exports.escalateToRole = exports.getEscalationsByWorkflowId = exports.getEscalation = exports.getStationMetrics = exports.getEscalationStats = exports.listFacetKeys = exports.listDistinctTypes = exports.listAvailableEscalations = exports.listEscalations = exports.createEscalation = void 0;
+exports.timelineByFacet = exports.aggregateByFacets = exports.claimByFacets = exports.claimGroups = exports.searchByFacets = exports.bulkCancel = exports.cancelSingleEscalation = exports.resolveByMetadata = exports.claimByMetadata = exports.findByMetadata = exports.resolveBatchItemByMetadata = exports.resolveBatchItemBySignalKey = exports.resolveBatchItem = exports.resolveAllOrNone = exports.resolveByIds = exports.resolveBySignalKey = exports.resolveEscalation = exports.bulkTriage = exports.bulkEscalate = exports.bulkUnassign = exports.bulkAssign = exports.bulkClaim = exports.updatePriority = exports.releaseExpiredClaims = exports.releaseEscalation = exports.claimEscalation = exports.getEscalationLookups = exports.escalateToRole = exports.getEscalationsByWorkflowId = exports.getEscalation = exports.getStationMetrics = exports.getEscalationStats = exports.listFacetValues = exports.listFacetKeys = exports.listDistinctTypes = exports.listAvailableEscalations = exports.listEscalations = exports.createEscalation = void 0;
 var create_1 = require("./create");
 Object.defineProperty(exports, "createEscalation", { enumerable: true, get: function () { return create_1.createEscalation; } });
 var list_1 = require("./list");
@@ -8,6 +8,7 @@ Object.defineProperty(exports, "listEscalations", { enumerable: true, get: funct
 Object.defineProperty(exports, "listAvailableEscalations", { enumerable: true, get: function () { return list_1.listAvailableEscalations; } });
 Object.defineProperty(exports, "listDistinctTypes", { enumerable: true, get: function () { return list_1.listDistinctTypes; } });
 Object.defineProperty(exports, "listFacetKeys", { enumerable: true, get: function () { return list_1.listFacetKeys; } });
+Object.defineProperty(exports, "listFacetValues", { enumerable: true, get: function () { return list_1.listFacetValues; } });
 Object.defineProperty(exports, "getEscalationStats", { enumerable: true, get: function () { return list_1.getEscalationStats; } });
 Object.defineProperty(exports, "getStationMetrics", { enumerable: true, get: function () { return list_1.getStationMetrics; } });
 var single_1 = require("./single");

package/build/api/escalations/list.d.ts

@@ -90,6 +90,16 @@ export declare function listAvailableEscalations(input: {
  * @returns `{ status: 200, data: { keys: string[] } }`
  */
 export declare function listFacetKeys(_input: unknown, auth: LTApiAuth): Promise<LTApiResult>;
+/**
+ * Distinct VALUES for one metadata facet key, role-scoped — powers the facet
+ * value picker (e.g. facility → north|south). A missing/malformed key returns
+ * an empty list, never an error.
+ *
+ * @returns `{ status: 200, data: { values: string[] } }`
+ */
+export declare function listFacetValues(input: {
+    key?: string;
+}, auth: LTApiAuth): Promise<LTApiResult>;
 /**
  * List all distinct escalation type values.
  *
@@ -108,4 +118,5 @@ export declare function getEscalationStats(input: {
 }, auth: LTApiAuth): Promise<LTApiResult>;
 export declare function getStationMetrics(input: {
     period?: string;
+    facets?: Record<string, unknown>;
 }, auth: LTApiAuth): Promise<LTApiResult>;

package/build/api/escalations/list.js

@@ -36,6 +36,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.listEscalations = listEscalations;
 exports.listAvailableEscalations = listAvailableEscalations;
 exports.listFacetKeys = listFacetKeys;
+exports.listFacetValues = listFacetValues;
 exports.listDistinctTypes = listDistinctTypes;
 exports.getEscalationStats = getEscalationStats;
 exports.getStationMetrics = getStationMetrics;
@@ -239,6 +240,34 @@ async function listFacetKeys(_input, auth) {
         return { status: 500, error: err.message };
     }
 }
+/**
+ * Distinct VALUES for one metadata facet key, role-scoped — powers the facet
+ * value picker (e.g. facility → north|south). A missing/malformed key returns
+ * an empty list, never an error.
+ *
+ * @returns `{ status: 200, data: { values: string[] } }`
+ */
+async function listFacetValues(input, auth) {
+    try {
+        const key = input?.key;
+        if (!key)
+            return { status: 200, data: { values: [] } };
+        const scope = await (0, helpers_1.getEscalationReadScope)(auth.userId);
+        if (!scope.global && scope.allRoles.length === 0 && scope.selfRoles.length === 0) {
+            return { status: 200, data: { values: [] } };
+        }
+        const values = await escalationService.listFacetValues(key, {
+            global: scope.global,
+            visibleRoles: scope.global ? undefined : scope.allRoles,
+            selfRoles: scope.global ? undefined : scope.selfRoles,
+            meUserId: auth.userId,
+        });
+        return { status: 200, data: { values } };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}
 /**
  * List all distinct escalation type values.
  *
@@ -297,7 +326,7 @@ async function getStationMetrics(input, auth) {
         // elsewhere) — without the selfRoles union, a self-scoped operator would
         // see an empty board on their own lanes.
         if ((0, features_1.getFeatureFlags)().publicPaceBoard) {
-            const stations = await escalationService.getStationMetrics(undefined, input.period);
+            const stations = await escalationService.getStationMetrics(undefined, input.period, input.facets);
             return { status: 200, data: { stations } };
         }
         const scope = await (0, helpers_1.getEscalationReadScope)(auth.userId);
@@ -305,7 +334,7 @@ async function getStationMetrics(input, auth) {
         if (!scope.global && memberRoles.length === 0) {
             return { status: 200, data: { stations: [] } };
         }
-        const stations = await escalationService.getStationMetrics(scope.global ? undefined : memberRoles, input.period);
+        const stations = await escalationService.getStationMetrics(scope.global ? undefined : memberRoles, input.period, input.facets);
         return { status: 200, data: { stations } };
     }
     catch (err) {

package/build/api/users.d.ts

@@ -19,6 +19,17 @@ export declare function listUsers(input: {
     limit?: number;
     offset?: number;
 }): Promise<LTApiResult>;
+/**
+ * Resolve many user ids to display fields (id, display_name, external_id, email)
+ * in one call. Thin projection only — no secrets, scopes, or metadata. Non-UUID
+ * ids are dropped, ids deduped, and the batch capped by the service.
+ *
+ * @param input.ids — the user ids to resolve
+ * @returns `{ status: 200, data: { users: [{ id, display_name, external_id, email }] } }`
+ */
+export declare function getUserNames(input: {
+    ids?: string[];
+}): Promise<LTApiResult>;
 /**
  * Retrieve a single user by ID.
  *

package/build/api/users.js

@@ -34,6 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.listUsers = listUsers;
+exports.getUserNames = getUserNames;
 exports.getUser = getUser;
 exports.createUser = createUser;
 exports.updateUser = updateUser;
@@ -64,6 +65,24 @@ async function listUsers(input) {
         return { status: 500, error: err.message };
     }
 }
+/**
+ * Resolve many user ids to display fields (id, display_name, external_id, email)
+ * in one call. Thin projection only — no secrets, scopes, or metadata. Non-UUID
+ * ids are dropped, ids deduped, and the batch capped by the service.
+ *
+ * @param input.ids — the user ids to resolve
+ * @returns `{ status: 200, data: { users: [{ id, display_name, external_id, email }] } }`
+ */
+async function getUserNames(input) {
+    try {
+        const ids = Array.isArray(input.ids) ? input.ids : [];
+        const users = await userService.getUserNames(ids);
+        return { status: 200, data: { users } };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}
 /**
  * Retrieve a single user by ID.
  *

package/build/api/workflows/config.d.ts

@@ -35,7 +35,9 @@ export declare function getWorkflowConfig(input: {
  * @param input.invocation_roles — roles that can invoke this workflow
  * @param input.consumes — workflow types whose data this workflow consumes
  * @param input.tool_tags — MCP tool tags for discovery
- * @param input.envelope_schema — JSON Schema for envelope.data validation
+ * @param input.envelope_schema — JSON template that pre-fills the invoke form
+ * @param input.input_schema — x-lt-* JSON Schema for the rich invoke form; invoke validates data against it
+ * @param input.icon — curated icon name (WORKFLOW_ICONS); anything else is refused
  * @param input.resolver_schema — JSON Schema for resolver payload validation
  * @param input.cron_schedule — cron expression for scheduled execution
  * @returns `{ status: 200, data: <saved config> }`
@@ -53,6 +55,8 @@ export declare function upsertWorkflowConfig(input: {
     consumes?: string[];
     tool_tags?: string[];
     envelope_schema?: any;
+    input_schema?: any;
+    icon?: string | null;
     resolver_schema?: any;
     cron_schedule?: string | null;
     read_safe?: boolean;

package/build/api/workflows/config.js

@@ -38,6 +38,7 @@ exports.getWorkflowConfig = getWorkflowConfig;
 exports.upsertWorkflowConfig = upsertWorkflowConfig;
 exports.deleteWorkflowConfig = deleteWorkflowConfig;
 const configService = __importStar(require("../../services/config"));
+const workflow_icons_1 = require("../../types/workflow-icons");
 const cron_1 = require("../../services/cron");
 const ltconfig_1 = require("../../modules/ltconfig");
 /**
@@ -93,13 +94,18 @@ async function getWorkflowConfig(input) {
  * @param input.invocation_roles — roles that can invoke this workflow
  * @param input.consumes — workflow types whose data this workflow consumes
  * @param input.tool_tags — MCP tool tags for discovery
- * @param input.envelope_schema — JSON Schema for envelope.data validation
+ * @param input.envelope_schema — JSON template that pre-fills the invoke form
+ * @param input.input_schema — x-lt-* JSON Schema for the rich invoke form; invoke validates data against it
+ * @param input.icon — curated icon name (WORKFLOW_ICONS); anything else is refused
  * @param input.resolver_schema — JSON Schema for resolver payload validation
  * @param input.cron_schedule — cron expression for scheduled execution
  * @returns `{ status: 200, data: <saved config> }`
  */
 async function upsertWorkflowConfig(input) {
     try {
+        if (input.icon && !(0, workflow_icons_1.isWorkflowIcon)(input.icon)) {
+            return { status: 400, error: `Unknown workflow icon "${input.icon}"; choose one of WORKFLOW_ICONS` };
+        }
         // Validate cron expression before persisting
         if (input.cron_schedule) {
             const { validateCronSchedule } = await Promise.resolve().then(() => __importStar(require('../../services/cron')));
@@ -118,6 +124,8 @@ async function upsertWorkflowConfig(input) {
             consumes: input.consumes ?? [],
             tool_tags: input.tool_tags ?? [],
             envelope_schema: input.envelope_schema ?? null,
+            input_schema: input.input_schema ?? null,
+            icon: input.icon ?? null,
             resolver_schema: input.resolver_schema ?? null,
             cron_schedule: input.cron_schedule ?? null,
             read_safe: input.read_safe ?? false,

package/build/api/workflows/index.d.ts

@@ -1,3 +1,6 @@
 export { invokeWorkflow, getWorkflowStatus, getWorkflowResult, terminateWorkflow, exportWorkflow, } from './invocation';
 export { listWorkers, listDiscoveredWorkflows, getCronStatus, } from './discovery';
+export { listInvocableWorkflows, WORKFLOW_TIERS } from './invocable';
+export type { InvocableWorkflowEntry, WorkflowTier } from './invocable';
+export { checkInvokeInput, inputValidationFailure } from './input-validation';
 export { listWorkflowConfigs, getWorkflowConfig, upsertWorkflowConfig, deleteWorkflowConfig, } from './config';

package/build/api/workflows/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.deleteWorkflowConfig = exports.upsertWorkflowConfig = exports.getWorkflowConfig = exports.listWorkflowConfigs = exports.getCronStatus = exports.listDiscoveredWorkflows = exports.listWorkers = exports.exportWorkflow = exports.terminateWorkflow = exports.getWorkflowResult = exports.getWorkflowStatus = exports.invokeWorkflow = void 0;
+exports.deleteWorkflowConfig = exports.upsertWorkflowConfig = exports.getWorkflowConfig = exports.listWorkflowConfigs = exports.inputValidationFailure = exports.checkInvokeInput = exports.WORKFLOW_TIERS = exports.listInvocableWorkflows = exports.getCronStatus = exports.listDiscoveredWorkflows = exports.listWorkers = exports.exportWorkflow = exports.terminateWorkflow = exports.getWorkflowResult = exports.getWorkflowStatus = exports.invokeWorkflow = void 0;
 var invocation_1 = require("./invocation");
 Object.defineProperty(exports, "invokeWorkflow", { enumerable: true, get: function () { return invocation_1.invokeWorkflow; } });
 Object.defineProperty(exports, "getWorkflowStatus", { enumerable: true, get: function () { return invocation_1.getWorkflowStatus; } });
@@ -11,6 +11,12 @@ var discovery_1 = require("./discovery");
 Object.defineProperty(exports, "listWorkers", { enumerable: true, get: function () { return discovery_1.listWorkers; } });
 Object.defineProperty(exports, "listDiscoveredWorkflows", { enumerable: true, get: function () { return discovery_1.listDiscoveredWorkflows; } });
 Object.defineProperty(exports, "getCronStatus", { enumerable: true, get: function () { return discovery_1.getCronStatus; } });
+var invocable_1 = require("./invocable");
+Object.defineProperty(exports, "listInvocableWorkflows", { enumerable: true, get: function () { return invocable_1.listInvocableWorkflows; } });
+Object.defineProperty(exports, "WORKFLOW_TIERS", { enumerable: true, get: function () { return invocable_1.WORKFLOW_TIERS; } });
+var input_validation_1 = require("./input-validation");
+Object.defineProperty(exports, "checkInvokeInput", { enumerable: true, get: function () { return input_validation_1.checkInvokeInput; } });
+Object.defineProperty(exports, "inputValidationFailure", { enumerable: true, get: function () { return input_validation_1.inputValidationFailure; } });
 var config_1 = require("./config");
 Object.defineProperty(exports, "listWorkflowConfigs", { enumerable: true, get: function () { return config_1.listWorkflowConfigs; } });
 Object.defineProperty(exports, "getWorkflowConfig", { enumerable: true, get: function () { return config_1.getWorkflowConfig; } });

package/build/api/workflows/input-validation.d.ts

@@ -0,0 +1,13 @@
+import { type LTValidationErrorBody } from '../../types/validation';
+import type { LTWorkflowConfig } from '../../types/config';
+import type { LTApiResult } from '../../types/sdk';
+/**
+ * The invoke input gate. A workflow that declares input_schema has its
+ * submitted data validated by the same shared pass the dashboard form runs,
+ * so a payload the form accepts is accepted here and a rejection lists the
+ * exact violations the form would show. No schema, no gate; a data value
+ * that is not an object is left to the service's own 400.
+ */
+export declare function checkInvokeInput(config: Pick<LTWorkflowConfig, 'workflow_type' | 'input_schema'> | null | undefined, data: unknown, metadata: Record<string, unknown> | null | undefined): LTValidationErrorBody | null;
+/** The canonical 422 result; the route serializes `data` as the body. */
+export declare function inputValidationFailure(body: LTValidationErrorBody): LTApiResult;

package/build/api/workflows/input-validation.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkInvokeInput = checkInvokeInput;
+exports.inputValidationFailure = inputValidationFailure;
+const validate_resolver_payload_1 = require("../../shared/form-validation/validate-resolver-payload");
+const invoke_context_1 = require("../../shared/form-validation/invoke-context");
+const validation_1 = require("../../types/validation");
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * The invoke input gate. A workflow that declares input_schema has its
+ * submitted data validated by the same shared pass the dashboard form runs,
+ * so a payload the form accepts is accepted here and a rejection lists the
+ * exact violations the form would show. No schema, no gate; a data value
+ * that is not an object is left to the service's own 400.
+ */
+function checkInvokeInput(config, data, metadata) {
+    const schema = config?.input_schema;
+    if (!schema || !isPlainObject(data))
+        return null;
+    const violations = (0, validate_resolver_payload_1.validateResolverPayload)(schema, data, (0, invoke_context_1.buildInvokeFormContext)(metadata));
+    if (violations.length === 0)
+        return null;
+    const n = violations.length;
+    return {
+        error: `data failed input schema validation (${n} violation${n === 1 ? '' : 's'})`,
+        code: validation_1.LT_ERROR_CODES.SCHEMA_VALIDATION,
+        violations,
+        role: null,
+        schemaVersion: null,
+        workflowType: config.workflow_type,
+    };
+}
+/** The canonical 422 result; the route serializes `data` as the body. */
+function inputValidationFailure(body) {
+    return { status: 422, error: body.error, code: body.code, data: body };
+}

package/build/api/workflows/invocable.d.ts

@@ -0,0 +1,19 @@
+import type { LTWorkflowConfig } from '../../types/config';
+import type { LTApiResult, LTApiAuth } from '../../types/sdk';
+export declare const WORKFLOW_TIERS: {
+    readonly DURABLE: "durable";
+    readonly REGISTERED: "registered";
+    readonly CERTIFIED: "certified";
+};
+export type WorkflowTier = (typeof WORKFLOW_TIERS)[keyof typeof WORKFLOW_TIERS];
+export type InvocableWorkflowEntry = LTWorkflowConfig & {
+    tier: WorkflowTier;
+};
+/**
+ * The workflows the caller may invoke, decided by the same predicate the
+ * invoke gate runs. Callers with global access also see active durable
+ * workers that carry no registration row, as the invoke gate admits them.
+ *
+ * @returns `{ status: 200, data: { workflows: InvocableWorkflowEntry[] } }`
+ */
+export declare function listInvocableWorkflows(auth: LTApiAuth): Promise<LTApiResult>;

package/build/api/workflows/invocable.js

@@ -0,0 +1,106 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WORKFLOW_TIERS = void 0;
+exports.listInvocableWorkflows = listInvocableWorkflows;
+const configService = __importStar(require("../../services/config"));
+const userService = __importStar(require("../../services/user"));
+const invocation_access_1 = require("../../services/invocation-access");
+const registry_1 = require("../../services/workers/registry");
+exports.WORKFLOW_TIERS = {
+    DURABLE: 'durable',
+    REGISTERED: 'registered',
+    CERTIFIED: 'certified',
+};
+function tierOf(config) {
+    if (!config)
+        return exports.WORKFLOW_TIERS.DURABLE;
+    return config.certified ? exports.WORKFLOW_TIERS.CERTIFIED : exports.WORKFLOW_TIERS.REGISTERED;
+}
+/** An active worker with no registration row, shaped like a config so one list type serves the page. */
+function durableEntry(workflowType, taskQueue) {
+    return {
+        workflow_type: workflowType,
+        invocable: true,
+        certified: false,
+        task_queue: taskQueue,
+        default_role: 'reviewer',
+        description: null,
+        roles: [],
+        invocation_roles: [],
+        consumes: [],
+        tool_tags: [],
+        envelope_schema: null,
+        input_schema: null,
+        icon: null,
+        resolver_schema: null,
+        cron_schedule: null,
+        execute_as: null,
+        read_safe: false,
+        tier: exports.WORKFLOW_TIERS.DURABLE,
+    };
+}
+/**
+ * The workflows the caller may invoke, decided by the same predicate the
+ * invoke gate runs. Callers with global access also see active durable
+ * workers that carry no registration row, as the invoke gate admits them.
+ *
+ * @returns `{ status: 200, data: { workflows: InvocableWorkflowEntry[] } }`
+ */
+async function listInvocableWorkflows(auth) {
+    try {
+        const [configs, user] = await Promise.all([
+            configService.listWorkflowConfigs(),
+            auth.userId ? userService.getUser(auth.userId) : Promise.resolve(null),
+        ]);
+        const roles = user?.roles ?? [];
+        const workflows = configs
+            .filter((c) => (0, invocation_access_1.canInvokeWorkflow)(c, roles, auth.role))
+            .map((c) => ({ ...c, tier: tierOf(c) }));
+        if ((0, invocation_access_1.hasGlobalInvocationAccess)(roles, auth.role)) {
+            const registered = new Set(configs.map((c) => c.workflow_type));
+            for (const [name, { taskQueue }] of (0, registry_1.getRegisteredWorkers)()) {
+                if (registered.has(name) || registry_1.SYSTEM_WORKFLOWS.has(name))
+                    continue;
+                workflows.push(durableEntry(name, taskQueue));
+            }
+        }
+        workflows.sort((a, b) => a.workflow_type.localeCompare(b.workflow_type));
+        return { status: 200, data: { workflows } };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}

package/build/api/workflows/invocation.js

@@ -43,6 +43,8 @@ const exportService = __importStar(require("../../services/export"));
 const task_1 = require("../../services/task");
 const workflow_invocation_1 = require("../../services/workflow-invocation");
 const crud_1 = require("../../services/escalation/crud");
+const configService = __importStar(require("../../services/config"));
+const input_validation_1 = require("./input-validation");
 function isResolveError(err) {
     return err?.message?.includes('Cannot resolve workflow');
 }
@@ -60,6 +62,10 @@ function isResolveError(err) {
 async function invokeWorkflow(input, auth) {
     try {
         await (0, workflow_invocation_1.checkInvocationRoles)(input.type, auth.userId, auth.role);
+        const config = await configService.getWorkflowConfig(input.type);
+        const violation = (0, input_validation_1.checkInvokeInput)(config, input.data, input.metadata);
+        if (violation)
+            return (0, input_validation_1.inputValidationFailure)(violation);
         const result = await (0, workflow_invocation_1.invokeWorkflow)({
             workflowType: input.type,
             data: input.data || {},

package/build/lib/db/schemas/034_workflow_input_schema.sql

@@ -0,0 +1,13 @@
+-- Migration 034: workflow input form and icon
+--
+-- Two opt-in columns on the workflow registration:
+--   input_schema — an x-lt-* JSON Schema the dashboard renders as the invoke
+--                  form and the invoke API validates submitted data against.
+--                  NULL keeps the legacy envelope_schema template form.
+--   icon         — a curated icon name (WORKFLOW_ICONS) shown in place of the
+--                  tier glyph on the Invoke page and registry. NULL keeps the
+--                  tier glyph.
+
+ALTER TABLE lt_config_workflows
+  ADD COLUMN IF NOT EXISTS input_schema JSONB,
+  ADD COLUMN IF NOT EXISTS icon TEXT;

package/build/lib/uuid.d.ts

@@ -0,0 +1,11 @@
+/**
+ * UUID shape guard for open input reaching uuid-typed columns. Postgres
+ * throws `invalid input syntax for type uuid` on a bad cast, so every
+ * caller-supplied id must pass this gate BEFORE it reaches SQL — a
+ * non-UUID string is definitionally not-found, never a 500.
+ */
+export declare const UUID_RE: RegExp;
+export declare function isUuid(value: unknown): value is string;
+/** The UUID members of a caller-supplied id list; non-UUIDs are dropped —
+ *  they can match nothing, exactly like a well-formed id that does not exist. */
+export declare function onlyUuids(ids: string[]): string[];

package/build/lib/uuid.js

@@ -0,0 +1,20 @@
+"use strict";
+/**
+ * UUID shape guard for open input reaching uuid-typed columns. Postgres
+ * throws `invalid input syntax for type uuid` on a bad cast, so every
+ * caller-supplied id must pass this gate BEFORE it reaches SQL — a
+ * non-UUID string is definitionally not-found, never a 500.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UUID_RE = void 0;
+exports.isUuid = isUuid;
+exports.onlyUuids = onlyUuids;
+exports.UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function isUuid(value) {
+    return typeof value === 'string' && exports.UUID_RE.test(value);
+}
+/** The UUID members of a caller-supplied id list; non-UUIDs are dropped —
+ *  they can match nothing, exactly like a well-formed id that does not exist. */
+function onlyUuids(ids) {
+    return ids.filter((id) => isUuid(id));
+}

package/build/routes/escalations/list.js

@@ -158,6 +158,15 @@ function registerListRoutes(router) {
         const result = await api.listFacetKeys(undefined, req.auth);
         res.status(result.status).json(result.data ?? { error: result.error });
     });
+    /**
+     * GET /api/escalations/facet-values?key=<facet>
+     * Distinct VALUES for one metadata facet key, visible to the caller
+     * (role-scoped). Powers the facet value picker (e.g. facility → north|south).
+     */
+    router.get('/facet-values', async (req, res) => {
+        const result = await api.listFacetValues({ key: req.query.key }, req.auth);
+        res.status(result.status).json(result.data ?? { error: result.error });
+    });
     /**
      * GET /api/escalations/station-metrics
      * Per-role P99/P50/avg/max wait + work times, resolved count, and in-arrears
@@ -165,7 +174,7 @@ function registerListRoutes(router) {
      * RBAC: superadmin sees all; others scoped to their roles.
      */
     router.get('/station-metrics', async (req, res) => {
-        const result = await api.getStationMetrics({ period: req.query.period || undefined }, req.auth);
+        const result = await api.getStationMetrics({ period: req.query.period || undefined, facets: jsonParam(req.query.facets) }, req.auth);
         res.status(result.status).json(result.data ?? { error: result.error });
     });
     /**

package/build/routes/users.js

@@ -55,6 +55,15 @@ router.get('/', async (req, res) => {
     });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
+/**
+ * POST /api/users/names
+ * Batch-resolve user ids to display fields. Body: { ids: string[] }.
+ * Any authenticated user — display names carry no secrets.
+ */
+router.post('/names', async (req, res) => {
+    const result = await api.getUserNames({ ids: req.body?.ids });
+    res.status(result.status).json(result.data ?? { error: result.error });
+});
 /**
  * GET /api/users/system-property-keys
  * The property keys the platform resolves identities against (enabled

package/build/routes/workflows/config.js

@@ -73,6 +73,8 @@ router.put('/:type/config', auth_1.requireAdmin, async (req, res) => {
         consumes: req.body.consumes,
         tool_tags: req.body.tool_tags,
         envelope_schema: req.body.envelope_schema,
+        input_schema: req.body.input_schema,
+        icon: req.body.icon,
         resolver_schema: req.body.resolver_schema,
         cron_schedule: req.body.cron_schedule,
     });

package/build/routes/workflows/discovery.js

@@ -60,6 +60,20 @@ router.get('/discovered', async (req, res) => {
     });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
+// ── Invocable for the caller ────────────────────────────────────────────────
+/**
+ * GET /api/workflows/invocable
+ * The workflows the calling user may invoke, decided by the invoke gate's
+ * own predicate. Drives the dashboard Invoke page and its nav entry.
+ */
+router.get('/invocable', async (req, res) => {
+    const result = await api.listInvocableWorkflows({
+        userId: req.auth?.userId ?? '',
+        role: req.auth?.role,
+        scopes: req.auth?.scopes,
+    });
+    res.status(result.status).json(result.data ?? { error: result.error });
+});
 // ── Cron status ─────────────────────────────────────────────────────────────
 /**
  * GET /api/workflows/cron/status

package/build/scripts/ortho-populate.d.ts

@@ -100,7 +100,7 @@ declare function holdFor(esc: {
 declare function api(method: string, path: string, body?: unknown): Promise<any>;
 declare function login(): Promise<void>;
 declare function ensureSideQuestRoles(): Promise<void>;
-declare function createSideEscalation(role: string, workflowId: string, orderId: string, runId: string, description: string, authorizedAt: string): Promise<boolean>;
+declare function createSideEscalation(role: string, workflowId: string, orderId: string, runId: string, description: string, authorizedAt: string, facility?: string): Promise<boolean>;
 declare function claimBatch(batchTag: string): Promise<number>;
 declare function resolveBatch(batchTag: string, runId: string): Promise<number>;
 interface PlannedOrder {
@@ -108,7 +108,9 @@ interface PlannedOrder {
     wfId: string;
     orderId: string;
     shoes: boolean;
+    facility: string;
 }
+declare const FACILITIES: readonly ["north", "south"];
 declare function runOrders(batchTag: string, runId: string, plan: PlannedOrder[], target: {
     value: number;
 }): Promise<string[]>;