@hotmeshio/long-tail 0.18.1 → 0.19.1

package/build/services/invocation-access.d.ts

@@ -0,0 +1,18 @@
+import type { LTWorkflowConfig } from '../types/config';
+export interface InvocationRoleGrant {
+    role: string;
+    type: string;
+}
+export declare const INVOCATION_ROLE_TYPES: {
+    readonly SUPERADMIN: "superadmin";
+    readonly ADMIN: "admin";
+};
+export declare const ADMIN_ROLE = "admin";
+/** Superadmin anywhere, or the named admin role held as admin type, invokes every workflow. */
+export declare function hasGlobalInvocationAccess(roles: readonly InvocationRoleGrant[], authRole?: string): boolean;
+/**
+ * The one invocation predicate, shared by the invoke gate and the per-caller
+ * list so the two can never disagree. An empty invocation_roles list opens
+ * the workflow to every authenticated caller.
+ */
+export declare function canInvokeWorkflow(config: Pick<LTWorkflowConfig, 'invocable' | 'invocation_roles'>, roles: readonly InvocationRoleGrant[], authRole?: string): boolean;

package/build/services/invocation-access.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ADMIN_ROLE = exports.INVOCATION_ROLE_TYPES = void 0;
+exports.hasGlobalInvocationAccess = hasGlobalInvocationAccess;
+exports.canInvokeWorkflow = canInvokeWorkflow;
+exports.INVOCATION_ROLE_TYPES = {
+    SUPERADMIN: 'superadmin',
+    ADMIN: 'admin',
+};
+exports.ADMIN_ROLE = 'admin';
+/** Superadmin anywhere, or the named admin role held as admin type, invokes every workflow. */
+function hasGlobalInvocationAccess(roles, authRole) {
+    if (authRole === exports.INVOCATION_ROLE_TYPES.SUPERADMIN)
+        return true;
+    return roles.some((r) => r.type === exports.INVOCATION_ROLE_TYPES.SUPERADMIN)
+        || roles.some((r) => r.role === exports.ADMIN_ROLE && r.type === exports.INVOCATION_ROLE_TYPES.ADMIN);
+}
+/**
+ * The one invocation predicate, shared by the invoke gate and the per-caller
+ * list so the two can never disagree. An empty invocation_roles list opens
+ * the workflow to every authenticated caller.
+ */
+function canInvokeWorkflow(config, roles, authRole) {
+    if (!config.invocable)
+        return false;
+    if (config.invocation_roles.length === 0)
+        return true;
+    if (hasGlobalInvocationAccess(roles, authRole))
+        return true;
+    const held = new Set(roles.map((r) => r.role));
+    return config.invocation_roles.some((r) => held.has(r));
+}

package/build/services/role/types.d.ts

@@ -17,7 +17,7 @@ export interface EscalationChain {
  *    the detail page, and the scan screens. Multi-role users get full chrome.
  *  - LINK_VARIABLES: RoleLinkVariable[] — metadata facet names members bind
  *    per device. Pins may reference `{lt:name}` as a whole facet value
- *    (e.g. `facets={"facility":"{lt:facility}"}`); the dashboard substitutes
+ *    (e.g. `facets={"region":"{lt:region}"}`); the dashboard substitutes
  *    the device's bound value at render time, falls back to the declared
  *    default, and drops the facet entirely when both are unset.
  */

package/build/services/role/types.js

@@ -16,7 +16,7 @@ exports.ROLE_PROPERTY_KEYS = void 0;
  *    the detail page, and the scan screens. Multi-role users get full chrome.
  *  - LINK_VARIABLES: RoleLinkVariable[] — metadata facet names members bind
  *    per device. Pins may reference `{lt:name}` as a whole facet value
- *    (e.g. `facets={"facility":"{lt:facility}"}`); the dashboard substitutes
+ *    (e.g. `facets={"region":"{lt:region}"}`); the dashboard substitutes
  *    the device's bound value at render time, falls back to the declared
  *    default, and drops the facet entirely when both are unset.
  */

package/build/services/user/auth.js

@@ -16,11 +16,11 @@ const sql_1 = require("./sql");
  */
 async function verifyPassword(externalId, password) {
     const pool = (0, db_1.getPool)();
-    const { rows } = await pool.query(sql_1.GET_USER_BY_EXTERNAL_ID, [externalId]);
+    const { rows } = await pool.query(sql_1.GET_USER_FOR_AUTH, [externalId]);
     if (!rows[0] || !rows[0].password_hash)
         return null;
     const valid = await bcryptjs_1.default.compare(password, rows[0].password_hash);
     if (!valid)
         return null;
-    return (0, crud_1.attachRoles)(rows[0]);
+    return (0, crud_1.getUser)(rows[0].id);
 }

package/build/services/user/crud.d.ts

@@ -3,6 +3,19 @@ import type { CreateUserInput, UpdateUserInput, UserPropertyOps } from './types'
 export declare function attachRoles(user: any): Promise<LTUserRecord>;
 export declare function createUser(input: CreateUserInput): Promise<LTUserRecord>;
 export declare function getUser(id: string): Promise<LTUserRecord | null>;
+export interface UserNameRecord {
+    id: string;
+    display_name: string | null;
+    external_id: string;
+    email: string | null;
+}
+/**
+ * Resolve many user ids to display fields in one query. Non-UUID input is
+ * dropped before the SQL (a bad id is not-found, never a 500), ids are deduped,
+ * and the batch is capped. Returns display fields only — never secrets, scopes,
+ * or metadata.
+ */
+export declare function getUserNames(ids: string[]): Promise<UserNameRecord[]>;
 export declare function getUserByExternalId(externalId: string): Promise<LTUserRecord | null>;
 export declare function getUserByEmail(email: string): Promise<LTUserRecord | null>;
 /**

package/build/services/user/crud.js

@@ -7,6 +7,7 @@ exports.UserPropertyValidationError = exports.UserPropertyConflictError = void 0
 exports.attachRoles = attachRoles;
 exports.createUser = createUser;
 exports.getUser = getUser;
+exports.getUserNames = getUserNames;
 exports.getUserByExternalId = getUserByExternalId;
 exports.getUserByEmail = getUserByEmail;
 exports.getUserByMetadataValue = getUserByMetadataValue;
@@ -18,14 +19,21 @@ exports.listUsers = listUsers;
 const bcryptjs_1 = __importDefault(require("bcryptjs"));
 const db_1 = require("../../lib/db");
 const sql_1 = require("./sql");
+const uuid_1 = require("../../lib/uuid");
 const scan_code_1 = require("../scan-code");
 const scan_code_2 = require("../../types/scan-code");
 const scope_1 = require("./scope");
 // ─── Private helpers (exported for internal use by auth.ts) ──────────────────
+/** Last-line guard: strip credentials before any user record leaves the service, so a stray SELECT * can never leak them. */
+function stripUserSecrets(user) {
+    delete user.password_hash;
+    delete user.oauth_provider_id;
+    return user;
+}
 async function attachRoles(user) {
     const pool = (0, db_1.getPool)();
     const { rows } = await pool.query(sql_1.GET_ROLES_BY_USER_ID, [user.id]);
-    return { ...user, roles: rows };
+    return stripUserSecrets({ ...user, roles: rows });
 }
 async function attachRolesToMany(users) {
     if (users.length === 0)
@@ -45,7 +53,7 @@ async function attachRolesToMany(users) {
         });
         roleMap.set(row.user_id, list);
     }
-    return users.map((u) => ({ ...u, roles: roleMap.get(u.id) || [] }));
+    return users.map((u) => stripUserSecrets({ ...u, roles: roleMap.get(u.id) || [] }));
 }
 // ─── CRUD ─────────────────────────────────────────────────────────────────────
 async function createUser(input) {
@@ -85,6 +93,21 @@ async function getUser(id) {
         return null;
     return attachRoles(rows[0]);
 }
+const MAX_NAME_LOOKUP = 200;
+/**
+ * Resolve many user ids to display fields in one query. Non-UUID input is
+ * dropped before the SQL (a bad id is not-found, never a 500), ids are deduped,
+ * and the batch is capped. Returns display fields only — never secrets, scopes,
+ * or metadata.
+ */
+async function getUserNames(ids) {
+    const clean = [...new Set((0, uuid_1.onlyUuids)(ids))].slice(0, MAX_NAME_LOOKUP);
+    if (clean.length === 0)
+        return [];
+    const pool = (0, db_1.getPool)();
+    const { rows } = await pool.query(sql_1.GET_NAMES_BY_IDS, [clean]);
+    return rows;
+}
 async function getUserByExternalId(externalId) {
     const pool = (0, db_1.getPool)();
     const { rows } = await pool.query(sql_1.GET_USER_BY_EXTERNAL_ID, [externalId]);
@@ -288,7 +311,7 @@ async function listUsers(filters) {
     const offset = filters.offset || 0;
     const [countResult, dataResult] = await Promise.all([
         pool.query(`SELECT COUNT(DISTINCT u.id) FROM lt_users u ${join} ${where}`, values),
-        pool.query(`SELECT DISTINCT u.* FROM lt_users u ${join} ${where} ORDER BY u.created_at DESC LIMIT $${idx++} OFFSET $${idx++}`, [...values, limit, offset]),
+        pool.query(`SELECT DISTINCT ${sql_1.USER_SAFE_COLUMNS_U} FROM lt_users u ${join} ${where} ORDER BY u.created_at DESC LIMIT $${idx++} OFFSET $${idx++}`, [...values, limit, offset]),
     ]);
     return {
         users: await attachRolesToMany(dataResult.rows),

package/build/services/user/index.d.ts

@@ -1,5 +1,5 @@
 export { CreateUserInput, UpdateUserInput, UserPropertyOps, VALID_ROLE_TYPES } from './types';
-export { createUser, getUser, getUserByExternalId, getUserByEmail, getUserByMetadataValue, updateUser, patchUserProperties, getIdentityPropertyKeys, UserPropertyConflictError, UserPropertyValidationError, deleteUser, listUsers, } from './crud';
+export { createUser, getUser, getUserNames, UserNameRecord, getUserByExternalId, getUserByEmail, getUserByMetadataValue, updateUser, patchUserProperties, getIdentityPropertyKeys, UserPropertyConflictError, UserPropertyValidationError, deleteUser, listUsers, } from './crud';
 export { isValidRoleType, addUserRole, grantRoleIfAbsent, removeUserRole, getUserRoles, hasRole, hasRoleType, } from './roles';
 export { isSuperAdmin, isGroupAdmin, canManageRole, hasGlobalEscalationAccess, hasRolesAsAdmin, getRoleScope, getRoleWriteScope } from './rbac';
 export { READ_SCOPES, WRITE_SCOPES, DEFAULT_READ_SCOPE, DEFAULT_WRITE_SCOPE, isValidReadScope, isValidWriteScope, isValidScopePair, effectiveScope, } from './scope';

package/build/services/user/index.js

@@ -1,11 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PREFERENCES_MAX_BYTES = exports.patchPreferences = exports.getPreferences = exports.seedAdmin = exports.verifyPassword = exports.effectiveScope = exports.isValidScopePair = exports.isValidWriteScope = exports.isValidReadScope = exports.DEFAULT_WRITE_SCOPE = exports.DEFAULT_READ_SCOPE = exports.WRITE_SCOPES = exports.READ_SCOPES = exports.getRoleWriteScope = exports.getRoleScope = exports.hasRolesAsAdmin = exports.hasGlobalEscalationAccess = exports.canManageRole = exports.isGroupAdmin = exports.isSuperAdmin = exports.hasRoleType = exports.hasRole = exports.getUserRoles = exports.removeUserRole = exports.grantRoleIfAbsent = exports.addUserRole = exports.isValidRoleType = exports.listUsers = exports.deleteUser = exports.UserPropertyValidationError = exports.UserPropertyConflictError = exports.getIdentityPropertyKeys = exports.patchUserProperties = exports.updateUser = exports.getUserByMetadataValue = exports.getUserByEmail = exports.getUserByExternalId = exports.getUser = exports.createUser = exports.VALID_ROLE_TYPES = void 0;
+exports.PREFERENCES_MAX_BYTES = exports.patchPreferences = exports.getPreferences = exports.seedAdmin = exports.verifyPassword = exports.effectiveScope = exports.isValidScopePair = exports.isValidWriteScope = exports.isValidReadScope = exports.DEFAULT_WRITE_SCOPE = exports.DEFAULT_READ_SCOPE = exports.WRITE_SCOPES = exports.READ_SCOPES = exports.getRoleWriteScope = exports.getRoleScope = exports.hasRolesAsAdmin = exports.hasGlobalEscalationAccess = exports.canManageRole = exports.isGroupAdmin = exports.isSuperAdmin = exports.hasRoleType = exports.hasRole = exports.getUserRoles = exports.removeUserRole = exports.grantRoleIfAbsent = exports.addUserRole = exports.isValidRoleType = exports.listUsers = exports.deleteUser = exports.UserPropertyValidationError = exports.UserPropertyConflictError = exports.getIdentityPropertyKeys = exports.patchUserProperties = exports.updateUser = exports.getUserByMetadataValue = exports.getUserByEmail = exports.getUserByExternalId = exports.getUserNames = exports.getUser = exports.createUser = exports.VALID_ROLE_TYPES = void 0;
 var types_1 = require("./types");
 Object.defineProperty(exports, "VALID_ROLE_TYPES", { enumerable: true, get: function () { return types_1.VALID_ROLE_TYPES; } });
 var crud_1 = require("./crud");
 Object.defineProperty(exports, "createUser", { enumerable: true, get: function () { return crud_1.createUser; } });
 Object.defineProperty(exports, "getUser", { enumerable: true, get: function () { return crud_1.getUser; } });
+Object.defineProperty(exports, "getUserNames", { enumerable: true, get: function () { return crud_1.getUserNames; } });
 Object.defineProperty(exports, "getUserByExternalId", { enumerable: true, get: function () { return crud_1.getUserByExternalId; } });
 Object.defineProperty(exports, "getUserByEmail", { enumerable: true, get: function () { return crud_1.getUserByEmail; } });
 Object.defineProperty(exports, "getUserByMetadataValue", { enumerable: true, get: function () { return crud_1.getUserByMetadataValue; } });

package/build/services/user/sql.d.ts

@@ -1,10 +1,14 @@
+export declare const USER_SAFE_COLUMNS: string;
+export declare const USER_SAFE_COLUMNS_U: string;
 /** Ensure a role name exists in the lt_roles lookup table (FK target). */
 export declare const ENSURE_ROLE_EXISTS = "INSERT INTO lt_roles (role) VALUES ($1) ON CONFLICT DO NOTHING";
 /** Fetch roles for a single user, ordered by creation time. granted_by_persona
  *  is the sustaining persona's key (null = direct grant). */
 export declare const GET_ROLES_BY_USER_ID = "SELECT r.role, r.type, r.read_scope, r.write_scope, r.created_at, p.key AS granted_by_persona\n   FROM lt_user_roles r\n   LEFT JOIN lt_personas p ON p.id = r.granted_by_persona\n   WHERE r.user_id = $1 ORDER BY r.created_at";
 /** Fetch a user row by external_id. */
-export declare const GET_USER_BY_EXTERNAL_ID = "SELECT * FROM lt_users WHERE external_id = $1";
+export declare const GET_USER_BY_EXTERNAL_ID: string;
+/** Password-check only: the one query that reads the hash, never returned to a client. */
+export declare const GET_USER_FOR_AUTH = "SELECT id, password_hash FROM lt_users WHERE external_id = $1";
 /**
  * Create a user and its role assignments in ONE atomic statement. The user row,
  * the lt_roles FK targets ($9 = role names), and the lt_user_roles links
@@ -15,9 +19,11 @@ export declare const GET_USER_BY_EXTERNAL_ID = "SELECT * FROM lt_users WHERE ext
  * end, after the sibling role-ensure CTE has run, so brand-new roles are valid
  * FK targets.
  */
-export declare const CREATE_USER_WITH_ROLES = "WITH new_user AS (\n     INSERT INTO lt_users (external_id, email, display_name, status, metadata, password_hash, oauth_provider, oauth_provider_id)\n     VALUES ($1, $2, $3, $4, $5, $6, $7, $8)\n     RETURNING *\n   ), ensured_roles AS (\n     INSERT INTO lt_roles (role)\n     SELECT DISTINCT unnest($9::text[])\n     ON CONFLICT DO NOTHING\n   ), assigned_roles AS (\n     INSERT INTO lt_user_roles (user_id, role, type, read_scope, write_scope)\n     SELECT (SELECT id FROM new_user), x.role, x.type, x.read_scope, x.write_scope\n     FROM unnest($9::text[], $10::text[], $11::text[], $12::text[]) AS x(role, type, read_scope, write_scope)\n     ON CONFLICT DO NOTHING\n   )\n   SELECT * FROM new_user";
-export declare const GET_USER_BY_EMAIL = "SELECT * FROM lt_users WHERE email = $1 LIMIT 1";
-export declare const GET_USER_BY_ID = "SELECT * FROM lt_users WHERE id = $1";
+export declare const CREATE_USER_WITH_ROLES: string;
+export declare const GET_USER_BY_EMAIL: string;
+export declare const GET_USER_BY_ID: string;
+/** Thin identity projection for batch name resolution — display fields only, never secrets, scopes, or metadata. */
+export declare const GET_NAMES_BY_IDS = "SELECT id, display_name, external_id, email FROM lt_users WHERE id = ANY($1)";
 /**
  * Lookup by a caller-named metadata key (e.g. a badge binding). LIMIT 2 so an
  * ambiguous binding — two users carrying the same value — is detectable and
@@ -25,7 +31,7 @@ export declare const GET_USER_BY_ID = "SELECT * FROM lt_users WHERE id = $1";
  * is the people table (small); revisit with a GIN index on metadata if a
  * deployment ever holds tens of thousands of users.
  */
-export declare const GET_USERS_BY_METADATA_VALUE = "SELECT * FROM lt_users WHERE metadata->>$1 = $2 AND status = 'active' LIMIT 2";
+export declare const GET_USERS_BY_METADATA_VALUE: string;
 /** Check if a user exists by id. Lightweight — returns only the id column. */
 export declare const VERIFY_USER_BY_ID = "SELECT id FROM lt_users WHERE id = $1 LIMIT 1";
 /**

package/build/services/user/sql.js

@@ -1,7 +1,15 @@
 "use strict";
 // ─── Shared queries (used by multiple modules) ──────────────────────────────
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.IS_GROUP_ADMIN = exports.GET_ROLE_SCOPE = exports.HAS_ROLE_TYPE = exports.HAS_ROLE = exports.DELETE_USER_ROLE = exports.INSERT_USER_ROLE_IF_ABSENT = exports.UPSERT_USER_ROLE = exports.GET_ROLES_BY_USER_IDS = exports.DELETE_USER_BY_ID = exports.GET_USER_WITH_ROLES = exports.PATCH_USER_PROPERTIES = exports.VERIFY_USER_BY_ID = exports.GET_USERS_BY_METADATA_VALUE = exports.GET_USER_BY_ID = exports.GET_USER_BY_EMAIL = exports.CREATE_USER_WITH_ROLES = exports.GET_USER_BY_EXTERNAL_ID = exports.GET_ROLES_BY_USER_ID = exports.ENSURE_ROLE_EXISTS = void 0;
+exports.IS_GROUP_ADMIN = exports.GET_ROLE_SCOPE = exports.HAS_ROLE_TYPE = exports.HAS_ROLE = exports.DELETE_USER_ROLE = exports.INSERT_USER_ROLE_IF_ABSENT = exports.UPSERT_USER_ROLE = exports.GET_ROLES_BY_USER_IDS = exports.DELETE_USER_BY_ID = exports.GET_USER_WITH_ROLES = exports.PATCH_USER_PROPERTIES = exports.VERIFY_USER_BY_ID = exports.GET_USERS_BY_METADATA_VALUE = exports.GET_NAMES_BY_IDS = exports.GET_USER_BY_ID = exports.GET_USER_BY_EMAIL = exports.CREATE_USER_WITH_ROLES = exports.GET_USER_FOR_AUTH = exports.GET_USER_BY_EXTERNAL_ID = exports.GET_ROLES_BY_USER_ID = exports.ENSURE_ROLE_EXISTS = exports.USER_SAFE_COLUMNS_U = exports.USER_SAFE_COLUMNS = void 0;
+/**
+ * Every lt_users column a client may see. password_hash and oauth_provider_id
+ * are credentials and never appear here — no user read path selects them (the
+ * password check has its own GET_USER_FOR_AUTH). `U` prefixes for a joined list.
+ */
+const USER_COLS = ['id', 'external_id', 'email', 'display_name', 'status', 'account_type', 'oauth_provider', 'metadata', 'created_at', 'updated_at', 'preferences'];
+exports.USER_SAFE_COLUMNS = USER_COLS.join(', ');
+exports.USER_SAFE_COLUMNS_U = USER_COLS.map((c) => `u.${c}`).join(', ');
 /** Ensure a role name exists in the lt_roles lookup table (FK target). */
 exports.ENSURE_ROLE_EXISTS = 'INSERT INTO lt_roles (role) VALUES ($1) ON CONFLICT DO NOTHING';
 /** Fetch roles for a single user, ordered by creation time. granted_by_persona
@@ -11,7 +19,9 @@ exports.GET_ROLES_BY_USER_ID = `SELECT r.role, r.type, r.read_scope, r.write_sco
    LEFT JOIN lt_personas p ON p.id = r.granted_by_persona
    WHERE r.user_id = $1 ORDER BY r.created_at`;
 /** Fetch a user row by external_id. */
-exports.GET_USER_BY_EXTERNAL_ID = 'SELECT * FROM lt_users WHERE external_id = $1';
+exports.GET_USER_BY_EXTERNAL_ID = `SELECT ${exports.USER_SAFE_COLUMNS} FROM lt_users WHERE external_id = $1`;
+/** Password-check only: the one query that reads the hash, never returned to a client. */
+exports.GET_USER_FOR_AUTH = 'SELECT id, password_hash FROM lt_users WHERE external_id = $1';
 // ─── User CRUD ───────────────────────────────────────────────────────────────
 /**
  * Create a user and its role assignments in ONE atomic statement. The user row,
@@ -37,9 +47,11 @@ exports.CREATE_USER_WITH_ROLES = `WITH new_user AS (
      FROM unnest($9::text[], $10::text[], $11::text[], $12::text[]) AS x(role, type, read_scope, write_scope)
      ON CONFLICT DO NOTHING
    )
-   SELECT * FROM new_user`;
-exports.GET_USER_BY_EMAIL = `SELECT * FROM lt_users WHERE email = $1 LIMIT 1`;
-exports.GET_USER_BY_ID = 'SELECT * FROM lt_users WHERE id = $1';
+   SELECT ${exports.USER_SAFE_COLUMNS} FROM new_user`;
+exports.GET_USER_BY_EMAIL = `SELECT ${exports.USER_SAFE_COLUMNS} FROM lt_users WHERE email = $1 LIMIT 1`;
+exports.GET_USER_BY_ID = `SELECT ${exports.USER_SAFE_COLUMNS} FROM lt_users WHERE id = $1`;
+/** Thin identity projection for batch name resolution — display fields only, never secrets, scopes, or metadata. */
+exports.GET_NAMES_BY_IDS = 'SELECT id, display_name, external_id, email FROM lt_users WHERE id = ANY($1)';
 /**
  * Lookup by a caller-named metadata key (e.g. a badge binding). LIMIT 2 so an
  * ambiguous binding — two users carrying the same value — is detectable and
@@ -47,7 +59,7 @@ exports.GET_USER_BY_ID = 'SELECT * FROM lt_users WHERE id = $1';
  * is the people table (small); revisit with a GIN index on metadata if a
  * deployment ever holds tens of thousands of users.
  */
-exports.GET_USERS_BY_METADATA_VALUE = `SELECT * FROM lt_users WHERE metadata->>$1 = $2 AND status = 'active' LIMIT 2`;
+exports.GET_USERS_BY_METADATA_VALUE = `SELECT ${exports.USER_SAFE_COLUMNS} FROM lt_users WHERE metadata->>$1 = $2 AND status = 'active' LIMIT 2`;
 /** Check if a user exists by id. Lightweight — returns only the id column. */
 exports.VERIFY_USER_BY_ID = 'SELECT id FROM lt_users WHERE id = $1 LIMIT 1';
 /**

package/build/services/workflow-invocation.js

@@ -46,6 +46,7 @@ exports.InvocationError = void 0;
 exports.invokeWorkflow = invokeWorkflow;
 exports.checkInvocationRoles = checkInvocationRoles;
 const hotmesh_1 = require("@hotmeshio/hotmesh");
+const invocation_access_1 = require("./invocation-access");
 const workers_1 = require("../workers");
 const configService = __importStar(require("./config"));
 const userService = __importStar(require("./user"));
@@ -152,15 +153,9 @@ async function checkInvocationRoles(workflowType, userId, authRole) {
     if (!user) {
         throw new InvocationError('User not registered', 403);
     }
-    const userRoles = user.roles.map((r) => r.role);
-    const hasInvocationRole = wfConfig.invocation_roles.some((r) => userRoles.includes(r));
-    if (!hasInvocationRole) {
-        // superadmin and admin/admin bypass role checks
-        const hasGlobalAccess = user.roles.some((r) => r.type === 'superadmin')
-            || user.roles.some((r) => r.role === 'admin' && r.type === 'admin');
-        if (!hasGlobalAccess) {
-            throw new InvocationError('Insufficient role for invocation', 403);
-        }
+    // invocable is resolveTaskQueue's concern; this gate decides roles only.
+    if (!(0, invocation_access_1.canInvokeWorkflow)({ ...wfConfig, invocable: true }, user.roles, authRole)) {
+        throw new InvocationError('Insufficient role for invocation', 403);
     }
 }
 /**

package/build/shared/form-validation/index.d.ts

@@ -19,3 +19,4 @@ export * from './x-lt-options';
 export * from './ctx-path';
 export * from './field-validator';
 export * from './validate-resolver-payload';
+export * from './invoke-context';

package/build/shared/form-validation/index.js

@@ -35,3 +35,4 @@ __exportStar(require("./x-lt-options"), exports);
 __exportStar(require("./ctx-path"), exports);
 __exportStar(require("./field-validator"), exports);
 __exportStar(require("./validate-resolver-payload"), exports);
+__exportStar(require("./invoke-context"), exports);

package/build/shared/form-validation/invoke-context.d.ts

@@ -0,0 +1,7 @@
+import type { ResolverValidationContext } from './validate-resolver-payload';
+/**
+ * The context an invoke form validates and renders against. The pass itself
+ * supplies the live values under `input` and `resolver`; the envelope
+ * metadata is the only other domain an invoke form can reference.
+ */
+export declare function buildInvokeFormContext(metadata: Record<string, unknown> | null | undefined): ResolverValidationContext;

package/build/shared/form-validation/invoke-context.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildInvokeFormContext = buildInvokeFormContext;
+/**
+ * The context an invoke form validates and renders against. The pass itself
+ * supplies the live values under `input` and `resolver`; the envelope
+ * metadata is the only other domain an invoke form can reference.
+ */
+function buildInvokeFormContext(metadata) {
+    return { metadata: metadata ?? {} };
+}

package/build/shared/form-validation/validate-resolver-payload.d.ts

@@ -31,7 +31,7 @@ export type { FieldError } from './field-validator';
  * dynamic constraints against. `resolver` is supplied by the pass itself
  * (the flat form values under validation) — callers provide the rest.
  */
-export type ResolverValidationContext = Omit<ShowIfContext, 'resolver'>;
+export type ResolverValidationContext = Omit<ShowIfContext, 'resolver' | 'input'>;
 /**
  * Validate FLAT form values against the form schema. This is the dashboard's
  * entry point (the values the user edits, keyed by field name).

package/build/shared/form-validation/validate-resolver-payload.js

@@ -44,6 +44,7 @@ function validateResolverForm(schema, formValues, ctx) {
     const liveCtx = {
         ...(ctx ?? {}),
         resolver: formValues,
+        input: formValues,
     };
     const errors = [];
     for (const [field, fieldSchema] of Object.entries(properties)) {

package/build/shared/form-validation/x-lt-help.d.ts

@@ -1,5 +1,5 @@
-/** The token domains a help template may reference. */
-export declare const HELP_DOMAINS: readonly ["escalation", "metadata", "envelope", "payload", "resolver", "lookup"];
+/** The token domains a help template may reference. `input` is the invoke-form name for the live values `resolver` also carries. */
+export declare const HELP_DOMAINS: readonly ["escalation", "metadata", "envelope", "payload", "resolver", "lookup", "input"];
 export type HelpDomain = (typeof HELP_DOMAINS)[number];
 export type HelpTokenContext = Partial<Record<HelpDomain, Record<string, unknown> | null>>;
 /** Replace every `{{domain.path}}` token with its value from the context. */

package/build/shared/form-validation/x-lt-help.js

@@ -23,8 +23,8 @@ exports.defaultHelpMarkdown = defaultHelpMarkdown;
  * `x-lt-help` is absent.
  */
 const x_lt_bind_1 = require("./x-lt-bind");
-/** The token domains a help template may reference. */
-exports.HELP_DOMAINS = ['escalation', 'metadata', 'envelope', 'payload', 'resolver', 'lookup'];
+/** The token domains a help template may reference. `input` is the invoke-form name for the live values `resolver` also carries. */
+exports.HELP_DOMAINS = ['escalation', 'metadata', 'envelope', 'payload', 'resolver', 'lookup', 'input'];
 const TOKEN_PATTERN = /\{\{\s*([^{}]+?)\s*\}\}/g;
 const MISSING_VALUE = '—';
 function formatTokenValue(value) {

package/build/shared/form-validation/x-lt-show-if.d.ts

@@ -3,5 +3,6 @@ export type ShowIfContext = HelpTokenContext;
 /**
  * Evaluates an x-lt-showIf condition. Returns true when the field should be
  * shown. Returns true when condition is absent, non-string, or context is null.
+ * An array of conditions shows the field only when every one holds.
  */
 export declare function evaluateShowIf(condition: unknown, ctx: ShowIfContext | null | undefined): boolean;

package/build/shared/form-validation/x-lt-show-if.js

@@ -54,8 +54,11 @@ function resolvePath(expr, ctx) {
 /**
  * Evaluates an x-lt-showIf condition. Returns true when the field should be
  * shown. Returns true when condition is absent, non-string, or context is null.
+ * An array of conditions shows the field only when every one holds.
  */
 function evaluateShowIf(condition, ctx) {
+    if (Array.isArray(condition))
+        return condition.every((c) => evaluateShowIf(c, ctx));
     if (typeof condition !== 'string' || condition.length === 0)
         return true;
     if (!ctx)

package/build/start/workers.js

@@ -233,6 +233,8 @@ async function startWorkers(startConfig, workers, builtinMcpServerFactories) {
                         consumes: c.consumes ?? [],
                         tool_tags: c.toolTags ?? [],
                         envelope_schema: c.envelopeSchema ?? null,
+                        input_schema: c.inputSchema ?? null,
+                        icon: c.icon ?? null,
                         resolver_schema: c.resolverSchema ?? null,
                         cron_schedule: c.cronSchedule ?? null,
                         execute_as: c.executeAs ?? null,

package/build/system/mcp-servers/admin/workflows.js

@@ -84,14 +84,24 @@ function registerWorkflowTools(server) {
                 }],
         };
     });
+    // The invoke input gate: data is validated against input_schema when declared.
+    const inputSchemaRejection = async (args) => {
+        const config = await configService.getWorkflowConfig(args.workflow_type);
+        const body = workflowApi.checkInvokeInput(config, args.data ?? {}, args.metadata);
+        return body ? { content: [{ type: 'text', text: JSON.stringify(body) }], isError: true } : null;
+    };
     // mirrors POST /api/workflows/:type/invoke
     server.registerTool('invoke_workflow', {
         title: 'Invoke Workflow',
         description: 'Start a certified workflow by type. The workflow must have invocable=true ' +
-            'in its config. Returns the workflow ID immediately; the workflow runs ' +
-            'durably in the background.',
+            'in its config. Data is validated against the config input_schema when one ' +
+            'is declared (422-shaped error). Returns the workflow ID immediately; the ' +
+            'workflow runs durably in the background.',
         inputSchema: schemas_1.invokeWorkflowSchema,
     }, async (args) => {
+        const rejected = await inputSchemaRejection(args);
+        if (rejected)
+            return rejected;
         const result = await (0, workflow_invocation_1.invokeWorkflow)({
             workflowType: args.workflow_type,
             data: args.data,
@@ -139,6 +149,9 @@ function registerWorkflowTools(server) {
                 isError: true,
             };
         }
+        const rejected = await inputSchemaRejection(args);
+        if (rejected)
+            return rejected;
         const result = await (0, workflow_invocation_1.invokeWorkflow)({
             workflowType: args.workflow_type,
             data: args.data,