@hotmeshio/long-tail 0.19.1 → 0.21.0

package/build/api/escalations/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.timelineByFacet = exports.aggregateByFacets = exports.claimByFacets = exports.claimGroups = exports.searchByFacets = exports.bulkCancel = exports.cancelSingleEscalation = exports.resolveByMetadata = exports.claimByMetadata = exports.findByMetadata = exports.resolveBatchItemByMetadata = exports.resolveBatchItemBySignalKey = exports.resolveBatchItem = exports.resolveAllOrNone = exports.resolveByIds = exports.resolveBySignalKey = exports.resolveEscalation = exports.bulkTriage = exports.bulkEscalate = exports.bulkUnassign = exports.bulkAssign = exports.bulkClaim = exports.updatePriority = exports.releaseExpiredClaims = exports.releaseEscalation = exports.claimEscalation = exports.getEscalationLookups = exports.escalateToRole = exports.getEscalationsByWorkflowId = exports.getEscalation = exports.getStationMetrics = exports.getEscalationStats = exports.listFacetValues = exports.listFacetKeys = exports.listDistinctTypes = exports.listAvailableEscalations = exports.listEscalations = exports.createEscalation = void 0;
+exports.timelineByFacet = exports.aggregateByFacets = exports.claimByFacets = exports.claimGroups = exports.searchByFacets = exports.bulkCancel = exports.cancelSingleEscalation = exports.resolveByMetadata = exports.claimByMetadata = exports.findByMetadata = exports.itemsView = exports.getEscalationItems = exports.removeItemByMetadata = exports.removeItemBySignalKey = exports.removeItem = exports.accumulateItemByMetadata = exports.accumulateItemBySignalKey = exports.accumulateItem = exports.resolveBatchItemByMetadata = exports.resolveBatchItemBySignalKey = exports.resolveBatchItem = exports.resolveAllOrNone = exports.resolveByIds = exports.resolveBySignalKey = exports.resolveEscalation = exports.bulkTriage = exports.bulkEscalate = exports.bulkUnassign = exports.bulkAssign = exports.bulkClaim = exports.updatePriority = exports.releaseExpiredClaims = exports.releaseEscalation = exports.claimEscalation = exports.getEscalationLookups = exports.escalateToRole = exports.getEscalationsByWorkflowId = exports.getEscalation = exports.getStationMetrics = exports.getEscalationStats = exports.listFacetValues = exports.listFacetKeys = exports.listDistinctTypes = exports.listAvailableEscalations = exports.listEscalations = exports.createEscalation = void 0;
 var create_1 = require("./create");
 Object.defineProperty(exports, "createEscalation", { enumerable: true, get: function () { return create_1.createEscalation; } });
 var list_1 = require("./list");
@@ -37,6 +37,15 @@ var resolve_batch_1 = require("./resolve-batch");
 Object.defineProperty(exports, "resolveBatchItem", { enumerable: true, get: function () { return resolve_batch_1.resolveBatchItem; } });
 Object.defineProperty(exports, "resolveBatchItemBySignalKey", { enumerable: true, get: function () { return resolve_batch_1.resolveBatchItemBySignalKey; } });
 Object.defineProperty(exports, "resolveBatchItemByMetadata", { enumerable: true, get: function () { return resolve_batch_1.resolveBatchItemByMetadata; } });
+var accumulate_1 = require("./accumulate");
+Object.defineProperty(exports, "accumulateItem", { enumerable: true, get: function () { return accumulate_1.accumulateItem; } });
+Object.defineProperty(exports, "accumulateItemBySignalKey", { enumerable: true, get: function () { return accumulate_1.accumulateItemBySignalKey; } });
+Object.defineProperty(exports, "accumulateItemByMetadata", { enumerable: true, get: function () { return accumulate_1.accumulateItemByMetadata; } });
+Object.defineProperty(exports, "removeItem", { enumerable: true, get: function () { return accumulate_1.removeItem; } });
+Object.defineProperty(exports, "removeItemBySignalKey", { enumerable: true, get: function () { return accumulate_1.removeItemBySignalKey; } });
+Object.defineProperty(exports, "removeItemByMetadata", { enumerable: true, get: function () { return accumulate_1.removeItemByMetadata; } });
+Object.defineProperty(exports, "getEscalationItems", { enumerable: true, get: function () { return accumulate_1.getEscalationItems; } });
+Object.defineProperty(exports, "itemsView", { enumerable: true, get: function () { return accumulate_1.itemsView; } });
 var metadata_1 = require("./metadata");
 Object.defineProperty(exports, "findByMetadata", { enumerable: true, get: function () { return metadata_1.findByMetadata; } });
 Object.defineProperty(exports, "claimByMetadata", { enumerable: true, get: function () { return metadata_1.claimByMetadata; } });

package/build/api/roles.d.ts

@@ -1,3 +1,4 @@
+import { type RolePin, type RolePortal } from '../services/role/types';
 import type { LTApiResult } from '../types/sdk';
 /**
  * List all distinct role names in the system.
@@ -89,11 +90,9 @@ export declare function updateRole(input: {
     /** The escalation LIST schema — rich formatting for this role's list page. */
     list_schema?: Record<string, any> | null;
     /** Pinned-view seeds for the role's members: [{ label, url, badge? }] or null to clear. */
-    default_pins?: {
-        label: string;
-        url: string;
-        badge?: boolean;
-    }[] | null;
+    default_pins?: RolePin[] | null;
+    /** The role's named portals, each rows of pin cells; null to clear. */
+    portals?: RolePortal[] | null;
     properties?: Record<string, any> | null;
     ops_visible?: boolean;
     /** Make this role's sequence the home Pace Board's default segment (single-holder: setting it clears the previous holder). */

package/build/api/roles.js

@@ -48,6 +48,7 @@ exports.getRoleListSchema = getRoleListSchema;
 exports.listRoleListSchemaVersions = listRoleListSchemaVersions;
 exports.deleteRole = deleteRole;
 const roleService = __importStar(require("../services/role"));
+const types_1 = require("../services/role/types");
 const facet_sql_1 = require("../services/escalation/facet-sql");
 /**
  * List all distinct role names in the system.
@@ -201,6 +202,50 @@ async function replaceEscalationTargets(input) {
         return { status: 500, error: err.message };
     }
 }
+/** A pinned view: a non-blank label over a dashboard-relative url, optionally badged. */
+function isRolePin(p) {
+    if (!p || typeof p !== 'object')
+        return false;
+    const pin = p;
+    return typeof pin.label === 'string' && pin.label.trim() !== ''
+        && typeof pin.url === 'string' && pin.url.startsWith('/')
+        && (pin.badge === undefined || typeof pin.badge === 'boolean');
+}
+/** Rows of pin cells within the portal bounds; every row carries at least one pin. */
+function isPortalRows(value) {
+    return Array.isArray(value)
+        && value.length >= 1 && value.length <= types_1.PORTAL_LIMITS.MAX_ROWS
+        && value.every((row) => Array.isArray(row)
+            && row.length >= 1 && row.length <= types_1.PORTAL_LIMITS.MAX_COLS
+            && row.every(isRolePin));
+}
+/** A count tile: a pin plus an optional blurb. */
+function isPortalCount(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const blurb = value.blurb;
+    return isRolePin(value) && (blurb === undefined || typeof blurb === 'string');
+}
+/** A named portal: slug key, non-blank label, a valid matrix, optional bounded counts. */
+function isRolePortal(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const portal = value;
+    const countsOk = portal.counts === undefined
+        || (Array.isArray(portal.counts) && portal.counts.length <= types_1.PORTAL_LIMITS.MAX_COUNTS && portal.counts.every(isPortalCount));
+    return typeof portal.key === 'string' && types_1.PORTAL_KEY.test(portal.key)
+        && typeof portal.label === 'string' && portal.label.trim() !== ''
+        && isPortalRows(portal.rows)
+        && countsOk;
+}
+/** The role's portals: bounded in number, every key unique. */
+function isPortalList(value) {
+    if (!Array.isArray(value) || value.length < 1 || value.length > types_1.PORTAL_LIMITS.MAX_PORTALS)
+        return false;
+    if (!value.every(isRolePortal))
+        return false;
+    return new Set(value.map((p) => p.key)).size === value.length;
+}
 /**
  * Update role metadata. Fields omitted from input are left unchanged.
  * form_schema, metadata_schema, and parent_role can be set to null to clear them.
@@ -241,14 +286,17 @@ async function updateRole(input) {
             return { status: 400, error: 'parent_role must reference a different role' };
         }
         if (input.default_pins != null) {
-            const pinsValid = Array.isArray(input.default_pins) && input.default_pins.every((p) => p && typeof p === 'object'
-                && typeof p.label === 'string' && p.label.trim() !== ''
-                && typeof p.url === 'string' && p.url.startsWith('/')
-                && (p.badge === undefined || typeof p.badge === 'boolean'));
+            const pinsValid = Array.isArray(input.default_pins) && input.default_pins.every(isRolePin);
             if (!pinsValid) {
                 return { status: 400, error: 'default_pins must be [{ label, url, badge? }] with dashboard-relative urls' };
             }
         }
+        if (input.portals != null && !isPortalList(input.portals)) {
+            return {
+                status: 400,
+                error: `portals must be 1..${types_1.PORTAL_LIMITS.MAX_PORTALS} of { key (slug, unique), label, rows, counts? }, rows being 1..${types_1.PORTAL_LIMITS.MAX_ROWS} rows of 1..${types_1.PORTAL_LIMITS.MAX_COLS} pins [{ label, url, badge? }] with dashboard-relative urls, counts up to ${types_1.PORTAL_LIMITS.MAX_COUNTS} of { label, url, blurb? }`,
+            };
+        }
         if (input.upstream_roles != null) {
             if (!Array.isArray(input.upstream_roles) || input.upstream_roles.some((u) => typeof u !== 'string' || !u.trim())) {
                 return { status: 400, error: 'upstream_roles must be an array of role names' };
@@ -269,6 +317,7 @@ async function updateRole(input) {
             metadata_schema: input.metadata_schema,
             list_schema: input.list_schema,
             default_pins: input.default_pins,
+            portals: input.portals,
             properties: input.properties,
             ops_visible: input.ops_visible,
             ops_home_default: input.ops_home_default,

package/build/api/scan-codes/execute.js

@@ -171,6 +171,8 @@ async function executeStep(step, index, ctx) {
             return (0, verbs_1.releaseStep)(step, ctx);
         case types_1.SCAN_VERBS.CANCEL:
             return (0, verbs_1.cancelStep)(step, ctx);
+        case types_1.SCAN_VERBS.ACCUMULATE:
+            return (0, verbs_1.accumulateStep)(step, ctx);
         default:
             throw new Error(`unknown scan verb "${step.verb}"`);
     }

package/build/api/scan-codes/verbs.d.ts

@@ -13,3 +13,18 @@ export declare function releaseStep(step: ScanStep, ctx: StepContext): Promise<L
  */
 export declare function dispatchChoiceVerb(step: ScanStep, ctx: StepContext, row: Record<string, any>): Promise<LTApiResult<ScanExecuteResponse>>;
 export declare function cancelStep(step: ScanStep, ctx: StepContext): Promise<LTApiResult<ScanExecuteResponse> | null>;
+/**
+ * Adds the scanned item to an accumulator. Two modes, one atomic write:
+ *
+ * - Item-locate (`params.accumulate.containerFacet`): the scan locates the
+ *   item's own pending row through the scheme facet, reads the container
+ *   facet value it carries, and adds the target to the container that shares
+ *   it, writing the item row as the reciprocal in the same statement. An
+ *   item with no row, or no container facet, falls through.
+ * - Container-locate (no `containerFacet`): the scan locates the container
+ *   by the scheme facet and adds `params.itemKey` (template).
+ *
+ * The write is the SDK's guarded statement; the locate only picks ids. A
+ * container already holding the item answers conflict, never a second add.
+ */
+export declare function accumulateStep(step: ScanStep, ctx: StepContext): Promise<LTApiResult<ScanExecuteResponse> | null>;

package/build/api/scan-codes/verbs.js

@@ -39,14 +39,17 @@ exports.escalateStep = escalateStep;
 exports.releaseStep = releaseStep;
 exports.dispatchChoiceVerb = dispatchChoiceVerb;
 exports.cancelStep = cancelStep;
+exports.accumulateStep = accumulateStep;
 const scanCodeService = __importStar(require("../../services/scan-code"));
 const escalationService = __importStar(require("../../services/escalation"));
 const metadata_1 = require("../escalations/metadata");
+const accumulate_1 = require("../escalations/accumulate");
 const create_1 = require("../escalations/create");
 const claim_1 = require("../escalations/claim");
 const helpers_1 = require("../escalations/helpers");
 const types_1 = require("../../types");
 const context_1 = require("./context");
+const locate_1 = require("./locate");
 // ── Mutating verbs — each a single atomic operation under the ACTOR's RBAC ──
 // ctx.auth is the effective actor: the badged person when a grant rode the
 // request, otherwise the authenticated principal. Attribution and write
@@ -203,3 +206,65 @@ async function cancelStep(step, ctx) {
         return (0, context_1.conflict)('Escalation is not cancellable (already terminal)');
     return (0, context_1.executed)(cancelled, step);
 }
+/**
+ * Adds the scanned item to an accumulator. Two modes, one atomic write:
+ *
+ * - Item-locate (`params.accumulate.containerFacet`): the scan locates the
+ *   item's own pending row through the scheme facet, reads the container
+ *   facet value it carries, and adds the target to the container that shares
+ *   it, writing the item row as the reciprocal in the same statement. An
+ *   item with no row, or no container facet, falls through.
+ * - Container-locate (no `containerFacet`): the scan locates the container
+ *   by the scheme facet and adds `params.itemKey` (template).
+ *
+ * The write is the SDK's guarded statement; the locate only picks ids. A
+ * container already holding the item answers conflict, never a second add.
+ */
+async function accumulateStep(step, ctx) {
+    const tpl = (0, context_1.templateContext)(ctx);
+    const payload = step.params?.resolverPayload
+        ? scanCodeService.interpolateScanTemplate(step.params.resolverPayload, tpl)
+        : undefined;
+    const metadata = { ...(0, context_1.interpolatedMetadata)(step, ctx), ...(0, context_1.provenance)(ctx) };
+    const options = step.params?.accumulate;
+    let request;
+    if (options?.containerFacet) {
+        const located = await (0, locate_1.locateForStep)(step, ctx, 1);
+        const item = located?.escalations[0];
+        if (!item)
+            return null;
+        const containerValue = item.metadata?.[options.containerFacet];
+        if (containerValue === undefined || containerValue === null || containerValue === '')
+            return null;
+        request = {
+            key: options.containerFacet,
+            value: String(containerValue),
+            itemKey: ctx.parsed.target,
+            payload,
+            metadata,
+            restrictRoles: options.containerRoles,
+            ...(options.reciprocal === false ? {} : { reciprocal: { id: item.id } }),
+        };
+    }
+    else {
+        request = {
+            key: ctx.scheme.target_facet,
+            value: ctx.parsed.target,
+            itemKey: scanCodeService.interpolateScanTemplate(step.params.itemKey, tpl),
+            payload,
+            metadata,
+            restrictRoles: step.query?.roles,
+        };
+    }
+    const result = await (0, accumulate_1.accumulateItemByMetadata)(request, ctx.auth);
+    if (result.status === 404)
+        return null;
+    if (result.status === 403)
+        return (0, context_1.forbidden)(result.error);
+    if (result.status === 409)
+        return (0, context_1.conflict)(result.error);
+    if (result.status !== 200)
+        return result;
+    const escalation = result.data.escalationId ? { id: result.data.escalationId, ...result.data } : undefined;
+    return (0, context_1.executed)(escalation, step);
+}

package/build/api/workflows/config.d.ts

@@ -1,3 +1,4 @@
+import { type EscalationLookupRef } from '../../types/escalation';
 import type { LTApiResult } from '../../types/sdk';
 /**
  * List all registered workflow configurations.
@@ -38,6 +39,7 @@ export declare function getWorkflowConfig(input: {
  * @param input.envelope_schema — JSON template that pre-fills the invoke form
  * @param input.input_schema — x-lt-* JSON Schema for the rich invoke form; invoke validates data against it
  * @param input.icon — curated icon name (WORKFLOW_ICONS); anything else is refused
+ * @param input.input_lookups: versioned knowledge refs the invoke form reads as `lookup.<as ?? key>`; malformed refs are refused
  * @param input.resolver_schema — JSON Schema for resolver payload validation
  * @param input.cron_schedule — cron expression for scheduled execution
  * @returns `{ status: 200, data: <saved config> }`
@@ -57,6 +59,7 @@ export declare function upsertWorkflowConfig(input: {
     envelope_schema?: any;
     input_schema?: any;
     icon?: string | null;
+    input_lookups?: EscalationLookupRef[] | null;
     resolver_schema?: any;
     cron_schedule?: string | null;
     read_safe?: boolean;

package/build/api/workflows/config.js

@@ -39,6 +39,8 @@ exports.upsertWorkflowConfig = upsertWorkflowConfig;
 exports.deleteWorkflowConfig = deleteWorkflowConfig;
 const configService = __importStar(require("../../services/config"));
 const workflow_icons_1 = require("../../types/workflow-icons");
+const escalation_1 = require("../../types/escalation");
+const lookup_refs_1 = require("../../services/knowledge/lookup-refs");
 const cron_1 = require("../../services/cron");
 const ltconfig_1 = require("../../modules/ltconfig");
 /**
@@ -97,6 +99,7 @@ async function getWorkflowConfig(input) {
  * @param input.envelope_schema — JSON template that pre-fills the invoke form
  * @param input.input_schema — x-lt-* JSON Schema for the rich invoke form; invoke validates data against it
  * @param input.icon — curated icon name (WORKFLOW_ICONS); anything else is refused
+ * @param input.input_lookups: versioned knowledge refs the invoke form reads as `lookup.<as ?? key>`; malformed refs are refused
  * @param input.resolver_schema — JSON Schema for resolver payload validation
  * @param input.cron_schedule — cron expression for scheduled execution
  * @returns `{ status: 200, data: <saved config> }`
@@ -106,6 +109,17 @@ async function upsertWorkflowConfig(input) {
         if (input.icon && !(0, workflow_icons_1.isWorkflowIcon)(input.icon)) {
             return { status: 400, error: `Unknown workflow icon "${input.icon}"; choose one of WORKFLOW_ICONS` };
         }
+        if (input.input_lookups != null) {
+            try {
+                (0, escalation_1.assertLookupRefs)(input.input_lookups);
+            }
+            catch (err) {
+                return { status: 400, error: err.message };
+            }
+            const missing = await (0, lookup_refs_1.describeMissingLookupRefs)(input.input_lookups);
+            if (missing.length)
+                return { status: 400, error: missing.join('; ') };
+        }
         // Validate cron expression before persisting
         if (input.cron_schedule) {
             const { validateCronSchedule } = await Promise.resolve().then(() => __importStar(require('../../services/cron')));
@@ -126,6 +140,7 @@ async function upsertWorkflowConfig(input) {
             envelope_schema: input.envelope_schema ?? null,
             input_schema: input.input_schema ?? null,
             icon: input.icon ?? null,
+            input_lookups: input.input_lookups ?? null,
             resolver_schema: input.resolver_schema ?? null,
             cron_schedule: input.cron_schedule ?? null,
             read_safe: input.read_safe ?? false,

package/build/api/workflows/index.d.ts

@@ -3,4 +3,5 @@ export { listWorkers, listDiscoveredWorkflows, getCronStatus, } from './discover
 export { listInvocableWorkflows, WORKFLOW_TIERS } from './invocable';
 export type { InvocableWorkflowEntry, WorkflowTier } from './invocable';
 export { checkInvokeInput, inputValidationFailure } from './input-validation';
+export { getWorkflowInputLookups } from './input-lookups';
 export { listWorkflowConfigs, getWorkflowConfig, upsertWorkflowConfig, deleteWorkflowConfig, } from './config';

package/build/api/workflows/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.deleteWorkflowConfig = exports.upsertWorkflowConfig = exports.getWorkflowConfig = exports.listWorkflowConfigs = exports.inputValidationFailure = exports.checkInvokeInput = exports.WORKFLOW_TIERS = exports.listInvocableWorkflows = exports.getCronStatus = exports.listDiscoveredWorkflows = exports.listWorkers = exports.exportWorkflow = exports.terminateWorkflow = exports.getWorkflowResult = exports.getWorkflowStatus = exports.invokeWorkflow = void 0;
+exports.deleteWorkflowConfig = exports.upsertWorkflowConfig = exports.getWorkflowConfig = exports.listWorkflowConfigs = exports.getWorkflowInputLookups = exports.inputValidationFailure = exports.checkInvokeInput = exports.WORKFLOW_TIERS = exports.listInvocableWorkflows = exports.getCronStatus = exports.listDiscoveredWorkflows = exports.listWorkers = exports.exportWorkflow = exports.terminateWorkflow = exports.getWorkflowResult = exports.getWorkflowStatus = exports.invokeWorkflow = void 0;
 var invocation_1 = require("./invocation");
 Object.defineProperty(exports, "invokeWorkflow", { enumerable: true, get: function () { return invocation_1.invokeWorkflow; } });
 Object.defineProperty(exports, "getWorkflowStatus", { enumerable: true, get: function () { return invocation_1.getWorkflowStatus; } });
@@ -17,6 +17,8 @@ Object.defineProperty(exports, "WORKFLOW_TIERS", { enumerable: true, get: functi
 var input_validation_1 = require("./input-validation");
 Object.defineProperty(exports, "checkInvokeInput", { enumerable: true, get: function () { return input_validation_1.checkInvokeInput; } });
 Object.defineProperty(exports, "inputValidationFailure", { enumerable: true, get: function () { return input_validation_1.inputValidationFailure; } });
+var input_lookups_1 = require("./input-lookups");
+Object.defineProperty(exports, "getWorkflowInputLookups", { enumerable: true, get: function () { return input_lookups_1.getWorkflowInputLookups; } });
 var config_1 = require("./config");
 Object.defineProperty(exports, "listWorkflowConfigs", { enumerable: true, get: function () { return config_1.listWorkflowConfigs; } });
 Object.defineProperty(exports, "getWorkflowConfig", { enumerable: true, get: function () { return config_1.getWorkflowConfig; } });

package/build/api/workflows/input-lookups.d.ts

@@ -0,0 +1,16 @@
+import type { LTApiResult, LTApiAuth } from '../../types/sdk';
+/**
+ * Resolve the versioned knowledge lookups pinned on a workflow config.
+ *
+ * The refs on `input_lookups` ARE the grant: any caller who may invoke the
+ * workflow may read exactly the pinned editions it names. A ref whose
+ * snapshot does not exist answers with `missing: true`; the batch never
+ * fails.
+ *
+ * @param input.type: workflow type name
+ * @param auth: authenticated caller; must pass the invoke predicate
+ * @returns `{ status: 200, data: { lookups: [{ domain, key, version, as?, data, missing? }] } }`
+ */
+export declare function getWorkflowInputLookups(input: {
+    type: string;
+}, auth: LTApiAuth): Promise<LTApiResult>;

package/build/api/workflows/input-lookups.js

@@ -0,0 +1,69 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getWorkflowInputLookups = getWorkflowInputLookups;
+const configService = __importStar(require("../../services/config"));
+const userService = __importStar(require("../../services/user"));
+const invocation_access_1 = require("../../services/invocation-access");
+const knowledge_1 = require("../../services/knowledge");
+/**
+ * Resolve the versioned knowledge lookups pinned on a workflow config.
+ *
+ * The refs on `input_lookups` ARE the grant: any caller who may invoke the
+ * workflow may read exactly the pinned editions it names. A ref whose
+ * snapshot does not exist answers with `missing: true`; the batch never
+ * fails.
+ *
+ * @param input.type: workflow type name
+ * @param auth: authenticated caller; must pass the invoke predicate
+ * @returns `{ status: 200, data: { lookups: [{ domain, key, version, as?, data, missing? }] } }`
+ */
+async function getWorkflowInputLookups(input, auth) {
+    try {
+        const config = await configService.getWorkflowConfig(input.type);
+        if (!config) {
+            return { status: 404, error: 'Workflow config not found' };
+        }
+        const user = auth.userId ? await userService.getUser(auth.userId) : null;
+        if (!(0, invocation_access_1.canInvokeWorkflow)(config, user?.roles ?? [], auth.role)) {
+            return { status: 403, error: 'Not authorized to invoke this workflow' };
+        }
+        const lookups = await (0, knowledge_1.resolveLookupRefs)(config.input_lookups ?? []);
+        return { status: 200, data: { lookups } };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}

package/build/api/workflows/input-validation.d.ts

@@ -5,9 +5,10 @@ import type { LTApiResult } from '../../types/sdk';
  * The invoke input gate. A workflow that declares input_schema has its
  * submitted data validated by the same shared pass the dashboard form runs,
  * so a payload the form accepts is accepted here and a rejection lists the
- * exact violations the form would show. No schema, no gate; a data value
- * that is not an object is left to the service's own 400.
+ * exact violations the form would show. Pinned input_lookups resolve into
+ * the `lookup` domain first. No schema, no gate; a data value that is not
+ * an object is left to the service's own 400.
  */
-export declare function checkInvokeInput(config: Pick<LTWorkflowConfig, 'workflow_type' | 'input_schema'> | null | undefined, data: unknown, metadata: Record<string, unknown> | null | undefined): LTValidationErrorBody | null;
+export declare function checkInvokeInput(config: Pick<LTWorkflowConfig, 'workflow_type' | 'input_schema' | 'input_lookups'> | null | undefined, data: unknown, metadata: Record<string, unknown> | null | undefined): Promise<LTValidationErrorBody | null>;
 /** The canonical 422 result; the route serializes `data` as the body. */
 export declare function inputValidationFailure(body: LTValidationErrorBody): LTApiResult;

package/build/api/workflows/input-validation.js

@@ -4,6 +4,7 @@ exports.checkInvokeInput = checkInvokeInput;
 exports.inputValidationFailure = inputValidationFailure;
 const validate_resolver_payload_1 = require("../../shared/form-validation/validate-resolver-payload");
 const invoke_context_1 = require("../../shared/form-validation/invoke-context");
+const lookup_cache_1 = require("../../services/knowledge/lookup-cache");
 const validation_1 = require("../../types/validation");
 function isPlainObject(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
@@ -12,14 +13,16 @@ function isPlainObject(value) {
  * The invoke input gate. A workflow that declares input_schema has its
  * submitted data validated by the same shared pass the dashboard form runs,
  * so a payload the form accepts is accepted here and a rejection lists the
- * exact violations the form would show. No schema, no gate; a data value
- * that is not an object is left to the service's own 400.
+ * exact violations the form would show. Pinned input_lookups resolve into
+ * the `lookup` domain first. No schema, no gate; a data value that is not
+ * an object is left to the service's own 400.
  */
-function checkInvokeInput(config, data, metadata) {
+async function checkInvokeInput(config, data, metadata) {
     const schema = config?.input_schema;
     if (!schema || !isPlainObject(data))
         return null;
-    const violations = (0, validate_resolver_payload_1.validateResolverPayload)(schema, data, (0, invoke_context_1.buildInvokeFormContext)(metadata));
+    const lookup = await (0, lookup_cache_1.resolveLookupContext)(config?.input_lookups);
+    const violations = (0, validate_resolver_payload_1.validateResolverPayload)(schema, data, (0, invoke_context_1.buildInvokeFormContext)(metadata, lookup));
     if (violations.length === 0)
         return null;
     const n = violations.length;

package/build/api/workflows/invocable.js

@@ -65,6 +65,7 @@ function durableEntry(workflowType, taskQueue) {
         envelope_schema: null,
         input_schema: null,
         icon: null,
+        input_lookups: null,
         resolver_schema: null,
         cron_schedule: null,
         execute_as: null,

package/build/api/workflows/invocation.js

@@ -63,7 +63,7 @@ async function invokeWorkflow(input, auth) {
     try {
         await (0, workflow_invocation_1.checkInvocationRoles)(input.type, auth.userId, auth.role);
         const config = await configService.getWorkflowConfig(input.type);
-        const violation = (0, input_validation_1.checkInvokeInput)(config, input.data, input.metadata);
+        const violation = await (0, input_validation_1.checkInvokeInput)(config, input.data, input.metadata);
         if (violation)
             return (0, input_validation_1.inputValidationFailure)(violation);
         const result = await (0, workflow_invocation_1.invokeWorkflow)({

package/build/index.js

@@ -168,6 +168,66 @@ async function main() {
             },
         },
         examples: true,
+        // Code-owned declaration for the reviewer queue the examples route to: a
+        // portal that leads with the queue's counts and lays its lists beneath.
+        // `reset` keeps the declaration applied on every boot.
+        roles: [
+            {
+                role: 'reviewer',
+                title: 'Reviewer',
+                reset: true,
+                portals: [
+                    {
+                        key: 'review-desk',
+                        label: 'Review desk',
+                        counts: [
+                            { label: 'Waiting', url: '/escalations/available?role=reviewer', blurb: 'Unclaimed items in the queue' },
+                            { label: 'In progress', url: '/escalations/available?role=reviewer&status=claimed', blurb: 'Claimed and being worked' },
+                            { label: 'Resolved', url: '/escalations/available?role=reviewer&status=resolved', blurb: 'Closed out by a reviewer' },
+                            { label: 'Expired', url: '/escalations/available?role=reviewer&status=expired', blurb: 'Timed out before anyone acted' },
+                            { label: 'Cancelled', url: '/escalations/available?role=reviewer&status=cancelled', blurb: 'Withdrawn by the workflow' },
+                        ],
+                        rows: [
+                            [
+                                { label: 'Waiting', url: '/escalations/available?role=reviewer&view=table&layout=compact', badge: true },
+                                { label: 'In progress', url: '/escalations/available?role=reviewer&status=claimed&view=table&layout=compact', badge: true },
+                            ],
+                        ],
+                    },
+                ],
+            },
+            {
+                // The rollup-bin example's container queue: the list shows each
+                // bin's fill level from the accumulator facets.
+                role: 'bin',
+                title: 'Bin',
+                description: 'Open containers filling with scanned bags. Ships at max or when the window closes.',
+                reset: true,
+                list_schema: {
+                    'x-lt-layout': 'facet-table',
+                    'x-lt-columns': [
+                        { label: 'Bin', value: '{{metadata.binKey}}' },
+                        { label: 'Held', value: '{{metadata.accumulate_count}}' },
+                        { label: 'Max', value: '{{metadata.accumulate_max}}', priority: 2 },
+                        { label: 'Open since', value: '{{escalation.created_at}}', format: 'age', priority: 2 },
+                    ],
+                },
+            },
+            {
+                role: 'bag',
+                title: 'Bag',
+                description: 'Bags waiting to be scanned into a bin.',
+                reset: true,
+                list_schema: {
+                    'x-lt-layout': 'facet-table',
+                    'x-lt-columns': [
+                        { label: 'Order', value: '{{metadata.orderId}}' },
+                        { label: 'Bin', value: '{{metadata.binKey}}', priority: 2 },
+                        { label: 'Waiting', value: '{{escalation.created_at}}', format: 'age', priority: 2 },
+                    ],
+                },
+            },
+        ],
         features: {
             // The examples ship the full scan demo (schemes 10/11); surface it.
             scanCodes: true,

package/build/lib/db/schemas/035_workflow_input_lookups.sql

@@ -0,0 +1,9 @@
+-- Migration 035: workflow input lookups
+--
+-- One opt-in column on the workflow registration:
+--   input_lookups: versioned knowledge refs ({ domain, key, version, as? }[])
+--                   the invoke form reads under the `lookup.<as ?? key>`
+--                   context domain. NULL renders the form with no lookups.
+
+ALTER TABLE lt_config_workflows
+  ADD COLUMN IF NOT EXISTS input_lookups JSONB;

package/build/lib/db/schemas/036_role_portals.sql

@@ -0,0 +1,12 @@
+-- Migration 036: Role portals
+--
+-- portals is a role-owned list of named portal views. Each portal is a matrix
+-- of pins: rows of cells, each cell a pinned view ({ label, url, badge? }).
+-- The dashboard renders a portal as one page of live list panels at
+-- /portal/:role/:portal, the visual form of the role's pinned views: one
+-- portal for urgent items by facility, another for the team's focus of the
+-- day, each cell named for a person and scoped to their facets. Unversioned
+-- config, like default_pins; null means the role declares no portal.
+
+ALTER TABLE lt_roles
+  ADD COLUMN IF NOT EXISTS portals JSONB;

package/build/routes/escalations/accumulate.d.ts

@@ -0,0 +1,7 @@
+import type { Router } from 'express';
+/**
+ * Open-accumulator routes. The literal single-segment paths are registered
+ * before the parameterized routes so /:id never shadows them; the /:id/*
+ * forms run as the effective work actor (badge continuity at a station).
+ */
+export declare function registerAccumulateRoutes(router: Router): void;