@hotmeshio/long-tail 0.24.1 → 0.25.0

package/build/api/escalations/accumulate.js

@@ -177,6 +177,10 @@ async function gateReciprocal(input, auth) {
     }
     return { reciprocal: { id: row.id, payload: input.payload } };
 }
+/** The reciprocal of an add, stamped with who added it, as the container is. */
+function completedBy(reciprocal, userId) {
+    return reciprocal ? { ...reciprocal, metadata: { resolved_by: userId } } : undefined;
+}
 /** Validates the item payload against the container's versioned role form. */
 async function gatePayload(escalation, payload, userId) {
     if (payload === undefined)
@@ -245,7 +249,7 @@ async function accumulateItem(input, auth) {
             actor: initiator.actor,
             assertClaim: input.assertClaim ? auth.userId : undefined,
             resolvedBy: await (0, resolve_1.resolverIdentity)(auth),
-            reciprocal: reciprocal.reciprocal,
+            reciprocal: completedBy(reciprocal.reciprocal, auth.userId),
         });
         return accumulateOutcomeResult(result, itemKey, escalation.workflow_id);
     }
@@ -291,7 +295,7 @@ async function accumulateItemBySignalKey(input, auth) {
             metadata: { ...metadata, resolved_by: auth.userId },
             actor: initiator.actor,
             resolvedBy: await (0, resolve_1.resolverIdentity)(auth),
-            reciprocal: reciprocal.reciprocal,
+            reciprocal: completedBy(reciprocal.reciprocal, auth.userId),
         });
         return accumulateOutcomeResult(result, itemKey, escalation.workflow_id);
     }
@@ -344,7 +348,7 @@ async function accumulateItemByMetadata(input, auth) {
                 actor: initiator.actor,
                 resolvedBy,
                 roles: allowedRoles ?? undefined,
-                reciprocal: reciprocal.reciprocal,
+                reciprocal: completedBy(reciprocal.reciprocal, auth.userId),
             });
             if (result.outcome === 'not-found')
                 return { status: 404, error: NO_ACCUMULATOR_FOR_FACET };
@@ -364,7 +368,7 @@ async function accumulateItemByMetadata(input, auth) {
             metadata: outcome,
             actor: initiator.actor,
             resolvedBy,
-            reciprocal: reciprocal.reciprocal,
+            reciprocal: completedBy(reciprocal.reciprocal, auth.userId),
         });
         if (result.outcome === 'not-found') {
             return { status: 409, error: 'A concurrent change is already in progress for this escalation' };

package/build/api/escalations/metadata.js

@@ -175,12 +175,13 @@ async function resolveByMetadata(input, auth) {
         // writing; the payload validates here, then a second asserted pass claims
         // + resolves the same row with pending re-checked inside the statement.
         const enforcing = await (0, enforcement_cache_1.getEnforcingRoles)();
-        let result = await escalationService.resolveByMetadataAtomic(input.key, input.value, resolveUserId, input.resolverPayload, input.metadata, writeAllRoles, writeSelfRoles, enforcing.size > 0 ? [...enforcing] : null, input.assertId ?? null, input.extraFacets, input.availability);
+        const outcome = { ...input.metadata, resolved_by: auth.userId };
+        let result = await escalationService.resolveByMetadataAtomic(input.key, input.value, resolveUserId, input.resolverPayload, outcome, writeAllRoles, writeSelfRoles, enforcing.size > 0 ? [...enforcing] : null, input.assertId ?? null, input.extraFacets, input.availability);
         if (result.outcome === 'validation_required' && result.row) {
             const report = await (0, resolver_validation_1.checkResolverPayload)(result.row, input.resolverPayload, undefined, resolveUserId);
             if (report)
                 return (0, resolve_1.validationFailure)(report);
-            result = await escalationService.resolveByMetadataAtomic(input.key, input.value, resolveUserId, input.resolverPayload, input.metadata, writeAllRoles, writeSelfRoles, null, result.row.id, input.extraFacets, input.availability);
+            result = await escalationService.resolveByMetadataAtomic(input.key, input.value, resolveUserId, input.resolverPayload, outcome, writeAllRoles, writeSelfRoles, null, result.row.id, input.extraFacets, input.availability);
             // The asserted row left pending between the two passes — a concurrent
             // resolution won the row; surface it as the conflict it is.
             if (result.outcome === 'not_found') {
@@ -199,7 +200,7 @@ async function resolveByMetadata(input, auth) {
         // Atomic conditional escalation (signal_key set) — SDK resolve atomically marks
         // resolved AND delivers the signal to the waiting condition(), resuming the workflow.
         if (result.signalKey) {
-            const resolved = await escalationService.resolveEscalation(result.escalationId, input.resolverPayload);
+            const resolved = await escalationService.resolveEscalation(result.escalationId, input.resolverPayload, outcome);
             if (!resolved) {
                 return { status: 409, error: 'Escalation not available for resolution' };
             }

package/build/api/escalations/related.d.ts

@@ -1,7 +1,7 @@
 import type { LTApiAuth, LTApiResult } from '../../types/sdk';
 /**
  * Aggregate every related set the role's list schema declares, for one page
- * of host rows. One statement per (set, split) pair, whatever the page size.
+ * of host rows. One statement per (set, aggregate) pair, whatever the page size.
  */
 export declare function getRelatedAggregates(input: {
     role: string;

package/build/api/escalations/related.js

@@ -84,16 +84,24 @@ async function resolveQueryRoles(query, readScope) {
     const restricted = readScope.global ? [] : roles.filter((r) => !readScope.allRoles.includes(r));
     return { roles, roleLabels, restricted };
 }
-/** The split paths the declared columns ask of one set ('' when unsplit). */
-function splitsFor(relations, set) {
-    const splits = new Set(relations.columns.filter((c) => c.related === set).map((c) => c.splitBy ?? ''));
-    if (!splits.size)
-        splits.add('');
-    return [...splits];
+/** The distinct aggregates the declared columns ask of one set; an unsplit count when none does. */
+function asksFor(relations, set, source) {
+    const asks = new Map();
+    for (const col of relations.columns.filter((c) => c.related === set)) {
+        const key = (0, list_schema_1.relatedAggregateKey)(col, source);
+        if (asks.has(key))
+            continue;
+        asks.set(key, (0, list_schema_1.isExtremeAggregate)(col.aggregate)
+            ? { key, extreme: { fold: col.aggregate, path: (0, list_schema_1.relatedValuePath)(source, col.value) } }
+            : { key, ...(col.splitBy ? { splitBy: col.splitBy } : {}) });
+    }
+    if (!asks.size)
+        asks.set('', { key: '' });
+    return [...asks.values()];
 }
 /**
  * Aggregate every related set the role's list schema declares, for one page
- * of host rows. One statement per (set, split) pair, whatever the page size.
+ * of host rows. One statement per (set, aggregate) pair, whatever the page size.
  */
 async function getRelatedAggregates(input, auth) {
     try {
@@ -118,11 +126,13 @@ async function getRelatedAggregates(input, auth) {
             const result = { source: decl.source, aggregates: {} };
             if (decl.source === list_schema_1.RELATED_SOURCES.ITEMS) {
                 const roles = new Set();
-                for (const splitBy of splitsFor(relations, name)) {
-                    const read = await escalationService.aggregateRelatedItems({
-                        hostIds, scope, splitBy: splitBy || undefined,
-                    });
-                    result.aggregates[splitBy] = read.aggregates;
+                for (const ask of asksFor(relations, name, decl.source)) {
+                    if (ask.extreme) {
+                        result.aggregates[ask.key] = await escalationService.extremeRelatedItems({ hostIds, scope, ...ask.extreme });
+                        continue;
+                    }
+                    const read = await escalationService.aggregateRelatedItems({ hostIds, scope, splitBy: ask.splitBy });
+                    result.aggregates[ask.key] = read.aggregates;
                     read.roles.forEach((r) => roles.add(r));
                 }
                 if (roles.size)
@@ -142,14 +152,14 @@ async function getRelatedAggregates(input, auth) {
                     else
                         unresolved.push(host.id);
                 }
-                for (const splitBy of splitsFor(relations, name)) {
-                    const agg = await escalationService.aggregateRelatedQuery({
-                        hosts: matched, roles: resolved.roles, status: decl.query.status ?? DEFAULT_STATUS, scope,
-                        splitBy: splitBy || undefined,
-                    });
+                for (const ask of asksFor(relations, name, decl.source)) {
+                    const query = { hosts: matched, roles: resolved.roles, status: decl.query.status ?? DEFAULT_STATUS, scope };
+                    const agg = ask.extreme
+                        ? await escalationService.extremeRelatedQuery({ ...query, ...ask.extreme })
+                        : await escalationService.aggregateRelatedQuery({ ...query, splitBy: ask.splitBy });
                     for (const id of unresolved)
                         agg[id] = { count: 0, unresolved: true };
-                    result.aggregates[splitBy] = agg;
+                    result.aggregates[ask.key] = agg;
                 }
             }
             data.sets[name] = result;

package/build/lib/db/schemas/040_oauth_client_consent.sql

@@ -0,0 +1,15 @@
+-- Migration 040: when a person last consented to a grant for an OAuth client
+--
+-- Registration needs no sign-in, so a client that never reaches consent is
+-- deleted after the retention window. A client someone has consented to is
+-- kept, so the app can always reconnect with the client id it holds.
+
+ALTER TABLE lt_oauth_clients ADD COLUMN IF NOT EXISTS last_consent_at TIMESTAMPTZ;
+
+-- Clients consented to before this migration: their newest grant.
+UPDATE lt_oauth_clients c
+SET last_consent_at = g.created_at
+FROM (
+  SELECT client_id, MAX(created_at) AS created_at FROM lt_oauth_grants GROUP BY client_id
+) g
+WHERE c.client_id = g.client_id AND c.last_consent_at IS NULL;

package/build/modules/config.d.ts

@@ -30,6 +30,10 @@ export declare const config: {
     JWT_SECRET: string;
     LT_SEED_SERVICE_KEYS: boolean;
     LT_OAUTH_ISSUER: string;
+    /** Spent, expired and revoked OAuth rows are deleted once older than this many days. */
+    OAUTH_RETENTION_DAYS: number;
+    /** Least time between one process's OAuth sweeps. A sweep runs on an OAuth write. */
+    OAUTH_SWEEP_SECONDS: number;
     HONEYCOMB_API_KEY: string;
     ROLE_ENFORCEMENT_CACHE_TTL_MS: number;
     LT_ANALYTICS_MAX_GROUPS: number;

package/build/modules/config.js

@@ -45,6 +45,10 @@ exports.config = {
     LT_SEED_SERVICE_KEYS: process.env.LT_SEED_SERVICE_KEYS === 'true',
     // Enables the OAuth authorization server for /mcp when start() passes no auth.oauthServer.
     LT_OAUTH_ISSUER: process.env.LT_OAUTH_ISSUER || '',
+    /** Spent, expired and revoked OAuth rows are deleted once older than this many days. */
+    OAUTH_RETENTION_DAYS: positiveInt('OAUTH_RETENTION_DAYS', 7),
+    /** Least time between one process's OAuth sweeps. A sweep runs on an OAuth write. */
+    OAUTH_SWEEP_SECONDS: positiveInt('OAUTH_SWEEP_SECONDS', 600),
     HONEYCOMB_API_KEY: process.env.HONEYCOMB_API_KEY || '',
     // Resolver schema enforcement: TTL for the cached enforcing-role set and
     // latest role form schemas. Bounds cross-container staleness after a role

package/build/modules/maintenance.d.ts

@@ -11,7 +11,7 @@ import type { LTMaintenanceConfig } from '../types/maintenance';
  *    (preserves jdata, udata, jmark, hmark — exports always work)
  * 4. Hard-delete pruned jobs older than 180 days
  * 5. Delete OAuth server rows (expired codes and tokens, unused or revoked
- *    grants, clients with no live grant) older than 7 days
+ *    grants, clients never consented to) older than 7 days
  *
  * Conservative defaults — execution artifacts (activity inputs, stream
  * history) are needed for rich export data. Pruning too early strips

package/build/modules/maintenance.js

@@ -13,7 +13,7 @@ exports.defaultMaintenanceConfig = void 0;
  *    (preserves jdata, udata, jmark, hmark — exports always work)
  * 4. Hard-delete pruned jobs older than 180 days
  * 5. Delete OAuth server rows (expired codes and tokens, unused or revoked
- *    grants, clients with no live grant) older than 7 days
+ *    grants, clients never consented to) older than 7 days
  *
  * Conservative defaults — execution artifacts (activity inputs, stream
  * history) are needed for rich export data. Pruning too early strips

package/build/services/auth/oauth-server/index.d.ts

@@ -1,3 +1,3 @@
-export { REFRESH_REUSE_GRACE_SECONDS, createSecret, hashSecret, pkceChallenge, registerClient, getClient, issueAuthorizationCode, exchangeAuthorizationCode, rotateRefreshToken, getLiveGrant, revokeByRefreshToken, revokeGrant, listGrants, pruneOAuthServer, type RevokedGrant, type OAuthPruneCounts, } from './store';
+export { REFRESH_REUSE_GRACE_SECONDS, createSecret, hashSecret, pkceChallenge, registerClient, getClient, issueAuthorizationCode, exchangeAuthorizationCode, rotateRefreshToken, getLiveGrant, revokeByRefreshToken, revokeGrant, listGrants, pruneOAuthServer, sweepOAuthServer, type RevokedGrant, type OAuthPruneCounts, } from './store';
 export { signAccessToken, verifyAccessToken, accessTokenPrincipal, type AccessTokenTarget, type LTAccessTokenClaims, } from './access-token';
 export { MCP_SCOPES, PRESET_SCOPE, ACCESS_TOKEN_TYPE, OAUTH_PRINCIPAL_TYPE } from './constants';

package/build/services/auth/oauth-server/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OAUTH_PRINCIPAL_TYPE = exports.ACCESS_TOKEN_TYPE = exports.PRESET_SCOPE = exports.MCP_SCOPES = exports.accessTokenPrincipal = exports.verifyAccessToken = exports.signAccessToken = exports.pruneOAuthServer = exports.listGrants = exports.revokeGrant = exports.revokeByRefreshToken = exports.getLiveGrant = exports.rotateRefreshToken = exports.exchangeAuthorizationCode = exports.issueAuthorizationCode = exports.getClient = exports.registerClient = exports.pkceChallenge = exports.hashSecret = exports.createSecret = exports.REFRESH_REUSE_GRACE_SECONDS = void 0;
+exports.OAUTH_PRINCIPAL_TYPE = exports.ACCESS_TOKEN_TYPE = exports.PRESET_SCOPE = exports.MCP_SCOPES = exports.accessTokenPrincipal = exports.verifyAccessToken = exports.signAccessToken = exports.sweepOAuthServer = exports.pruneOAuthServer = exports.listGrants = exports.revokeGrant = exports.revokeByRefreshToken = exports.getLiveGrant = exports.rotateRefreshToken = exports.exchangeAuthorizationCode = exports.issueAuthorizationCode = exports.getClient = exports.registerClient = exports.pkceChallenge = exports.hashSecret = exports.createSecret = exports.REFRESH_REUSE_GRACE_SECONDS = void 0;
 var store_1 = require("./store");
 Object.defineProperty(exports, "REFRESH_REUSE_GRACE_SECONDS", { enumerable: true, get: function () { return store_1.REFRESH_REUSE_GRACE_SECONDS; } });
 Object.defineProperty(exports, "createSecret", { enumerable: true, get: function () { return store_1.createSecret; } });
@@ -16,6 +16,7 @@ Object.defineProperty(exports, "revokeByRefreshToken", { enumerable: true, get:
 Object.defineProperty(exports, "revokeGrant", { enumerable: true, get: function () { return store_1.revokeGrant; } });
 Object.defineProperty(exports, "listGrants", { enumerable: true, get: function () { return store_1.listGrants; } });
 Object.defineProperty(exports, "pruneOAuthServer", { enumerable: true, get: function () { return store_1.pruneOAuthServer; } });
+Object.defineProperty(exports, "sweepOAuthServer", { enumerable: true, get: function () { return store_1.sweepOAuthServer; } });
 var access_token_1 = require("./access-token");
 Object.defineProperty(exports, "signAccessToken", { enumerable: true, get: function () { return access_token_1.signAccessToken; } });
 Object.defineProperty(exports, "verifyAccessToken", { enumerable: true, get: function () { return access_token_1.verifyAccessToken; } });

package/build/services/auth/oauth-server/sql.d.ts

@@ -1,7 +1,7 @@
 export declare const INSERT_CLIENT = "\n  INSERT INTO lt_oauth_clients (client_id, client_name, redirect_uris)\n  VALUES ($1, $2, $3)\n  RETURNING client_id, client_name, redirect_uris, created_at";
 export declare const GET_CLIENT = "\n  SELECT client_id, client_name, redirect_uris, created_at\n  FROM lt_oauth_clients WHERE client_id = $1";
-/** Create the grant and its authorization code together. */
-export declare const ISSUE_CODE = "\n  WITH g AS (\n    INSERT INTO lt_oauth_grants (user_id, client_id, policy, scope)\n    VALUES ($1, $2, $3, $4)\n    RETURNING id\n  )\n  INSERT INTO lt_oauth_codes (code_hash, grant_id, redirect_uri, code_challenge, resource, expires_at)\n  SELECT $5, g.id, $6, $7, $8, NOW() + make_interval(secs => $9) FROM g\n  RETURNING grant_id";
+/** Create the grant and its authorization code together, and stamp the client's consent. */
+export declare const ISSUE_CODE = "\n  WITH g AS (\n    INSERT INTO lt_oauth_grants (user_id, client_id, policy, scope)\n    VALUES ($1, $2, $3, $4)\n    RETURNING id\n  ),\n  consented AS (\n    UPDATE lt_oauth_clients SET last_consent_at = NOW() WHERE client_id = $2\n  )\n  INSERT INTO lt_oauth_codes (code_hash, grant_id, redirect_uri, code_challenge, resource, expires_at)\n  SELECT $5, g.id, $6, $7, $8, NOW() + make_interval(secs => $9) FROM g\n  RETURNING grant_id";
 /**
  * Consume a code and issue the first refresh token. The code must be unused,
  * unexpired, for this client and redirect URI, and match the PKCE challenge;
@@ -46,5 +46,8 @@ export declare const PRUNE_CODES = "\n  DELETE FROM lt_oauth_codes WHERE expires
  * left with no refresh token and no code: never exchanged, or long unused.
  */
 export declare const PRUNE_GRANTS = "\n  DELETE FROM lt_oauth_grants g\n  WHERE g.revoked_at < NOW() - $1::interval\n     OR (g.created_at < NOW() - $1::interval\n         AND NOT EXISTS (SELECT 1 FROM lt_oauth_refresh_tokens t WHERE t.grant_id = g.id)\n         AND NOT EXISTS (SELECT 1 FROM lt_oauth_codes c WHERE c.grant_id = g.id))";
-/** Clients registered longer ago than the window with no live grant. */
-export declare const PRUNE_CLIENTS = "\n  DELETE FROM lt_oauth_clients c\n  WHERE c.created_at < NOW() - $1::interval\n    AND NOT EXISTS (SELECT 1 FROM lt_oauth_grants g WHERE g.client_id = c.client_id AND g.revoked_at IS NULL)";
+/**
+ * Clients registered longer ago than the window that no one ever consented to.
+ * A client with a consent is kept: the app holds its client id to reconnect.
+ */
+export declare const PRUNE_CLIENTS = "\n  DELETE FROM lt_oauth_clients c\n  WHERE c.last_consent_at IS NULL AND c.created_at < NOW() - $1::interval\n    AND NOT EXISTS (SELECT 1 FROM lt_oauth_grants g WHERE g.client_id = c.client_id)";

package/build/services/auth/oauth-server/sql.js

@@ -17,12 +17,15 @@ exports.INSERT_CLIENT = `
 exports.GET_CLIENT = `
   SELECT client_id, client_name, redirect_uris, created_at
   FROM lt_oauth_clients WHERE client_id = $1`;
-/** Create the grant and its authorization code together. */
+/** Create the grant and its authorization code together, and stamp the client's consent. */
 exports.ISSUE_CODE = `
   WITH g AS (
     INSERT INTO lt_oauth_grants (user_id, client_id, policy, scope)
     VALUES ($1, $2, $3, $4)
     RETURNING id
+  ),
+  consented AS (
+    UPDATE lt_oauth_clients SET last_consent_at = NOW() WHERE client_id = $2
   )
   INSERT INTO lt_oauth_codes (code_hash, grant_id, redirect_uri, code_challenge, resource, expires_at)
   SELECT $5, g.id, $6, $7, $8, NOW() + make_interval(secs => $9) FROM g
@@ -149,8 +152,11 @@ exports.PRUNE_GRANTS = `
      OR (g.created_at < NOW() - $1::interval
          AND NOT EXISTS (SELECT 1 FROM lt_oauth_refresh_tokens t WHERE t.grant_id = g.id)
          AND NOT EXISTS (SELECT 1 FROM lt_oauth_codes c WHERE c.grant_id = g.id))`;
-/** Clients registered longer ago than the window with no live grant. */
+/**
+ * Clients registered longer ago than the window that no one ever consented to.
+ * A client with a consent is kept: the app holds its client id to reconnect.
+ */
 exports.PRUNE_CLIENTS = `
   DELETE FROM lt_oauth_clients c
-  WHERE c.created_at < NOW() - $1::interval
-    AND NOT EXISTS (SELECT 1 FROM lt_oauth_grants g WHERE g.client_id = c.client_id AND g.revoked_at IS NULL)`;
+  WHERE c.last_consent_at IS NULL AND c.created_at < NOW() - $1::interval
+    AND NOT EXISTS (SELECT 1 FROM lt_oauth_grants g WHERE g.client_id = c.client_id)`;

package/build/services/auth/oauth-server/store.d.ts

@@ -82,7 +82,14 @@ export interface OAuthPruneCounts {
 /**
  * Delete what the authorization server no longer needs, older than the
  * window (a Postgres interval): spent and expired refresh tokens and codes,
- * then grants with neither left or revoked, then clients with no live grant.
+ * then grants with neither left or revoked, then clients never consented to.
  * Each step reads what the one before it left.
  */
 export declare function pruneOAuthServer(olderThan: string): Promise<OAuthPruneCounts>;
+/**
+ * Delete what the server no longer needs, older than OAUTH_RETENTION_DAYS.
+ * Each OAuth write calls it, and it runs at most once per OAUTH_SWEEP_SECONDS
+ * in a process, so the tables stay bounded with or without a maintenance
+ * schedule. A failed sweep is logged and never fails the write.
+ */
+export declare function sweepOAuthServer(): Promise<void>;

package/build/services/auth/oauth-server/store.js

@@ -47,8 +47,11 @@ exports.revokeByRefreshToken = revokeByRefreshToken;
 exports.revokeGrant = revokeGrant;
 exports.listGrants = listGrants;
 exports.pruneOAuthServer = pruneOAuthServer;
+exports.sweepOAuthServer = sweepOAuthServer;
 const crypto = __importStar(require("crypto"));
 const db_1 = require("../../../lib/db");
+const logger_1 = require("../../../lib/logger");
+const config_1 = require("../../../modules/config");
 const uuid_1 = require("../../../lib/uuid");
 const sql_1 = require("./sql");
 /** A refresh token reused within this many seconds is treated as a client retry. */
@@ -69,6 +72,7 @@ async function registerClient(input) {
     const { rows } = await (0, db_1.getPool)().query(sql_1.INSERT_CLIENT, [
         `ltc_${createSecret()}`, input.clientName ?? null, input.redirectUris,
     ]);
+    void sweepOAuthServer();
     return rows[0];
 }
 /** A client id as registerClient issues it; anything else names no client and never reaches SQL. */
@@ -90,6 +94,7 @@ async function issueAuthorizationCode(input) {
         input.userId, input.clientId, input.policy, input.scope,
         hashSecret(code), input.redirectUri, input.codeChallenge, input.resource ?? null, input.ttlSeconds,
     ]);
+    void sweepOAuthServer();
     return { code, grantId: rows[0].grant_id };
 }
 /**
@@ -110,6 +115,7 @@ async function exchangeAuthorizationCode(input) {
         await pool.query(sql_1.REVOKE_ON_CODE_REUSE, [codeHash]);
         return null;
     }
+    void sweepOAuthServer();
     const { resource, ...snapshot } = rows[0];
     return { snapshot, resource, refreshToken };
 }
@@ -124,8 +130,10 @@ async function rotateRefreshToken(input) {
     const next = createSecret();
     const oldHash = hashSecret(input.refreshToken);
     const { rows } = await pool.query(sql_1.ROTATE_REFRESH_TOKEN, [oldHash, hashSecret(next), input.refreshTtlSeconds, input.clientId]);
-    if (rows[0])
+    if (rows[0]) {
+        void sweepOAuthServer();
         return { snapshot: rows[0], refreshToken: next };
+    }
     const reuse = await pool.query(sql_1.REVOKE_ON_REFRESH_REUSE, [oldHash, exports.REFRESH_REUSE_GRACE_SECONDS]);
     return { snapshot: null, revoked: reuse.rows[0] ?? null };
 }
@@ -158,7 +166,7 @@ async function listGrants(userId) {
 /**
  * Delete what the authorization server no longer needs, older than the
  * window (a Postgres interval): spent and expired refresh tokens and codes,
- * then grants with neither left or revoked, then clients with no live grant.
+ * then grants with neither left or revoked, then clients never consented to.
  * Each step reads what the one before it left.
  */
 async function pruneOAuthServer(olderThan) {
@@ -169,3 +177,24 @@ async function pruneOAuthServer(olderThan) {
     const clients = (await pool.query(sql_1.PRUNE_CLIENTS, [olderThan])).rowCount ?? 0;
     return { refreshTokens, codes, grants, clients };
 }
+let nextSweepAt = 0;
+/**
+ * Delete what the server no longer needs, older than OAUTH_RETENTION_DAYS.
+ * Each OAuth write calls it, and it runs at most once per OAUTH_SWEEP_SECONDS
+ * in a process, so the tables stay bounded with or without a maintenance
+ * schedule. A failed sweep is logged and never fails the write.
+ */
+async function sweepOAuthServer() {
+    const now = Date.now();
+    if (now < nextSweepAt)
+        return;
+    nextSweepAt = now + config_1.config.OAUTH_SWEEP_SECONDS * 1000;
+    try {
+        const counts = await pruneOAuthServer(`${config_1.config.OAUTH_RETENTION_DAYS} days`);
+        if (Object.values(counts).some(Boolean))
+            logger_1.loggerRegistry.info(`[lt-oauth] swept: ${JSON.stringify(counts)}`);
+    }
+    catch (err) {
+        logger_1.loggerRegistry.warn(`[lt-oauth] sweep failed: ${err?.message}`);
+    }
+}

package/build/services/escalation/accumulate.d.ts

@@ -8,6 +8,8 @@ export interface AccumulateReciprocal {
     roles?: string[];
     /** Stored as the reciprocal entry's payload. */
     payload?: Record<string, any>;
+    /** Merge patch for the reciprocal row's metadata, same statement. */
+    metadata?: Record<string, any>;
 }
 export interface AccumulateItemInput {
     itemKey: string;
@@ -43,7 +45,7 @@ export interface AccumulateItemServiceOutcome {
 export interface RemoveItemInput {
     itemKey: string;
     actor?: string;
-    reciprocal?: Omit<AccumulateReciprocal, 'payload'>;
+    reciprocal?: Omit<AccumulateReciprocal, 'payload' | 'metadata'>;
 }
 export interface RemoveItemServiceOutcome {
     outcome: RemoveAccumulatedItemOutcome;

package/build/services/escalation/facet-sql.js

@@ -13,7 +13,9 @@ exports.buildFacetOrder = buildFacetOrder;
 exports.buildGroupOrder = buildGroupOrder;
 // Top-level columns a caller may sort/range on directly. Anything else must be a
 // `metadata.<key>` facet. Keeps interpolation to a fixed, audited set.
-const ORDER_COLUMNS = new Set(['priority', 'created_at', 'updated_at', 'status', 'role']);
+const ORDER_COLUMNS = new Set(['priority', 'created_at', 'updated_at', 'resolved_at', 'status', 'role']);
+// Columns a pending row leaves empty: they sort after every value, either direction.
+const NULLABLE_ORDER_COLUMNS = new Set(['resolved_at']);
 const RANGE_OPS = new Set(['<', '<=', '>', '>=', '=']);
 // Metadata keys are interpolated (as a JSON path), so they are strictly validated.
 // Exported so role config (priority_facet) validates keys against the same rule.
@@ -140,7 +142,7 @@ function buildFacetOrder(orderBy) {
     for (const o of orderBy) {
         const dir = o.direction === 'desc' ? 'DESC' : 'ASC';
         if (ORDER_COLUMNS.has(o.field)) {
-            parts.push(`${o.field} ${dir}`);
+            parts.push(`${o.field} ${dir}${NULLABLE_ORDER_COLUMNS.has(o.field) ? ' NULLS LAST' : ''}`);
         }
         else if (o.field.startsWith('metadata.')) {
             const key = o.field.slice('metadata.'.length);

package/build/services/escalation/index.d.ts

@@ -14,3 +14,4 @@ export { searchEscalationsGrouped } from './grouped-list';
 export type { EscalationGroup } from './grouped-list';
 export { aggregateRelatedItems, listRelatedItems, aggregateRelatedQuery, listRelatedQueryRows, readRelatedHosts, } from './related';
 export type { RelatedQueryHost } from './related';
+export { extremeRelatedItems, extremeRelatedQuery } from './related-extremes';

package/build/services/escalation/index.js

@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.readRelatedHosts = exports.listRelatedQueryRows = exports.aggregateRelatedQuery = exports.listRelatedItems = exports.aggregateRelatedItems = exports.searchEscalationsGrouped = exports.AnalyticsInputError = exports.resetAnalyticsCaches = exports.resolveEntitySystem = exports.timelineByFacet = exports.aggregateByFacets = exports.claimByFacets = exports.claimGroups = exports.countByFacets = exports.searchGroups = exports.searchByFacets = exports.ensureFacetReady = exports.ensureEscalationCompatView = exports.claimAssertedByMetadata = void 0;
+exports.extremeRelatedQuery = exports.extremeRelatedItems = exports.readRelatedHosts = exports.listRelatedQueryRows = exports.aggregateRelatedQuery = exports.listRelatedItems = exports.aggregateRelatedItems = exports.searchEscalationsGrouped = exports.AnalyticsInputError = exports.resetAnalyticsCaches = exports.resolveEntitySystem = exports.timelineByFacet = exports.aggregateByFacets = exports.claimByFacets = exports.claimGroups = exports.countByFacets = exports.searchGroups = exports.searchByFacets = exports.ensureFacetReady = exports.ensureEscalationCompatView = exports.claimAssertedByMetadata = void 0;
 __exportStar(require("./types"), exports);
 __exportStar(require("./crud"), exports);
 var claim_asserted_1 = require("./claim-asserted");
@@ -48,3 +48,6 @@ Object.defineProperty(exports, "listRelatedItems", { enumerable: true, get: func
 Object.defineProperty(exports, "aggregateRelatedQuery", { enumerable: true, get: function () { return related_1.aggregateRelatedQuery; } });
 Object.defineProperty(exports, "listRelatedQueryRows", { enumerable: true, get: function () { return related_1.listRelatedQueryRows; } });
 Object.defineProperty(exports, "readRelatedHosts", { enumerable: true, get: function () { return related_1.readRelatedHosts; } });
+var related_extremes_1 = require("./related-extremes");
+Object.defineProperty(exports, "extremeRelatedItems", { enumerable: true, get: function () { return related_extremes_1.extremeRelatedItems; } });
+Object.defineProperty(exports, "extremeRelatedQuery", { enumerable: true, get: function () { return related_extremes_1.extremeRelatedQuery; } });

package/build/services/escalation/related-extremes.d.ts

@@ -0,0 +1,17 @@
+import { type RelatedExtreme, type RelatedHostAggregate } from '../../shared/list-schema';
+import { type RelatedQueryInput } from './related';
+import type { ReadScopeInput } from './read-scope-sql';
+type Aggregates = Record<string, RelatedHostAggregate>;
+/** The least or greatest `payload.<path>` among each host's items. */
+export declare function extremeRelatedItems(opts: {
+    hostIds: string[];
+    scope: ReadScopeInput;
+    fold: RelatedExtreme;
+    path: string;
+}): Promise<Aggregates>;
+/** The least or greatest `metadata.<key>` among the rows sharing each host's facets. */
+export declare function extremeRelatedQuery(input: RelatedQueryInput & {
+    fold: RelatedExtreme;
+    path: string;
+}): Promise<Aggregates>;
+export {};

package/build/services/escalation/related-extremes.js

@@ -0,0 +1,65 @@
+"use strict";
+// ---------------------------------------------------------------------------
+// min/max over a related set: the least or greatest item payload value, or
+// related row metadata value, per host. One statement per (set, value) pair,
+// under the same read scope as the set's counts.
+// ---------------------------------------------------------------------------
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extremeRelatedItems = extremeRelatedItems;
+exports.extremeRelatedQuery = extremeRelatedQuery;
+const db_1 = require("../../lib/db");
+const list_schema_1 = require("../../shared/list-schema");
+const client_1 = require("./client");
+const related_1 = require("./related");
+const NUMBER_TEXT = '^-?[0-9]+(\\.[0-9]+)?([eE][-+]?[0-9]+)?$';
+/**
+ * Per host: how many values, whether every one is numeric, and the extreme
+ * as a number and as text. `v` is the jsonb value; objects, arrays, nulls and
+ * blanks are not values. Text compares in code-unit order, as the dashboard folds.
+ */
+function extremeSelect(fold, hostId, v, from) {
+    const fn = fold === list_schema_1.RELATED_AGGREGATES.MIN ? 'min' : 'max';
+    return `SELECT host_id, count(*)::int AS n, bool_and(t ~ '${NUMBER_TEXT}') AS numeric,
+       ${fn}(CASE WHEN t ~ '${NUMBER_TEXT}' THEN t::numeric END)::text AS num,
+       ${fn}(t COLLATE "C") AS txt
+     FROM (SELECT h_id AS host_id, x #>> '{}' AS t
+       FROM (SELECT ${hostId}::text AS h_id, ${v} AS x ${from}) raw
+       WHERE jsonb_typeof(x) IN ('string', 'number', 'boolean') AND x #>> '{}' <> '') vals
+     GROUP BY host_id`;
+}
+function foldExtremeRows(rows, hostIds) {
+    const out = {};
+    for (const id of hostIds)
+        out[id] = { count: 0 };
+    for (const row of rows) {
+        if (!out[row.host_id])
+            continue;
+        const value = row.numeric && row.num !== null ? Number(row.num) : row.txt;
+        out[row.host_id] = value === null ? { count: row.n } : { count: row.n, value };
+    }
+    return out;
+}
+/** The least or greatest `payload.<path>` among each host's items. */
+async function extremeRelatedItems(opts) {
+    if (!opts.hostIds.length)
+        return {};
+    await (0, client_1.ensureEscalationCompatView)();
+    const params = [];
+    const cte = (0, related_1.itemEntriesCte)(params, opts.scope, opts.hostIds);
+    const pi = params.push(opts.path.slice(list_schema_1.SPLIT_PATHS.PAYLOAD.length).split('.'));
+    const v = `(CASE WHEN en.acc THEN en.entry->'payload' ELSE en.entry END) #> $${pi}::text[]`;
+    const { rows } = await (0, db_1.getPool)().query(`WITH ${cte} ${extremeSelect(opts.fold, 'en.host_id', v, 'FROM entries en')}`, params);
+    return foldExtremeRows(rows, opts.hostIds);
+}
+/** The least or greatest `metadata.<key>` among the rows sharing each host's facets. */
+async function extremeRelatedQuery(input) {
+    const hostIds = input.hosts.map((h) => h.hostId);
+    if (!hostIds.length || !input.roles.length)
+        return foldExtremeRows([], hostIds);
+    await (0, client_1.ensureEscalationCompatView)();
+    const params = [];
+    const from = (0, related_1.querySetFrom)(params, input);
+    const ki = params.push(input.path.slice(list_schema_1.SPLIT_PATHS.METADATA.length));
+    const { rows } = await (0, db_1.getPool)().query(extremeSelect(input.fold, 'h.host_id', `e.metadata->$${ki}`, from), params);
+    return foldExtremeRows(rows, hostIds);
+}

package/build/services/escalation/related.d.ts

@@ -12,6 +12,8 @@ export interface RelatedQueryInput {
     scope: ReadScopeInput;
 }
 type Aggregates = Record<string, RelatedHostAggregate>;
+/** The hosts and their item entries, read under the caller's scope. */
+export declare function itemEntriesCte(params: unknown[], scope: ReadScopeInput, hostIds: string[]): string;
 /**
  * Count each host's items, optionally split by `payload.<path>` or
  * `reciprocal.metadata.<key>`. A reciprocal split counts only reciprocal rows
@@ -35,6 +37,8 @@ export declare function listRelatedItems(opts: {
     rows: RelatedRow[];
     total: number;
 }>;
+/** The shared FROM/WHERE of a query set: hosts unnested beside their matches. */
+export declare function querySetFrom(params: unknown[], input: RelatedQueryInput): string;
 /**
  * Count the rows that share each host's facets, grouped by role and an
  * optional `metadata.<key>` split. The GIN index serves each host's match.

package/build/services/escalation/related.js

@@ -7,8 +7,10 @@
 // the page size or the item count.
 // ---------------------------------------------------------------------------
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.itemEntriesCte = itemEntriesCte;
 exports.aggregateRelatedItems = aggregateRelatedItems;
 exports.listRelatedItems = listRelatedItems;
+exports.querySetFrom = querySetFrom;
 exports.aggregateRelatedQuery = aggregateRelatedQuery;
 exports.listRelatedQueryRows = listRelatedQueryRows;
 exports.readRelatedHosts = readRelatedHosts;

package/build/services/escalation/resolver-validation.js

@@ -23,6 +23,7 @@ exports.toValidationErrorBody = toValidationErrorBody;
  */
 const form_validation_1 = require("../../shared/form-validation");
 const submit_guard_1 = require("./submit-guard");
+const roster_1 = require("./roster");
 const enforcement_cache_1 = require("../role/enforcement-cache");
 const knowledge_1 = require("../knowledge");
 const escalation_1 = require("../../types/escalation");
@@ -85,6 +86,12 @@ async function checkResolverPayload(escalation, resolverPayload, loadEnvelope, r
         payload: parseJsonOrNull(escalation.escalation_payload),
         ...(lookup ? { lookup } : {}),
     };
+    // Roster counts read the submitted form values (an `in` source may name a
+    // form field), then join the context so showIf and the guard see them.
+    const formValues = (0, form_validation_1.mapPayloadToForm)(resolverPayload, schema);
+    const roster = await (0, roster_1.loadRosterCounts)(schema, { ...ctx, resolver: formValues, input: formValues });
+    if (Object.keys(roster).length)
+        ctx.roster = roster;
     const violations = (0, form_validation_1.validateResolverPayload)(schema, resolverPayload, ctx);
     // The query precondition (x-lt-submit-guard): reject while the embedded query
     // still returns rows. Enforced on the same enforce_schema opt-in as the field

package/build/services/escalation/roster.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Server-side roster counts: the API-first counterpart of the dashboard's
+ * roster widget. For each `x-lt-roster` field of a form schema, the member
+ * rows are read with the same query the widget runs and the shared
+ * `computeRoster` turns them into counts, so `roster.*` showIf conditions and
+ * a roster submit guard evaluate at resolve exactly as the form showed them.
+ *
+ * Member rows are read with `global: true`: a resolver who cannot see a
+ * member must never be told the roster is complete.
+ */
+import { type RosterCounts, type ShowIfContext } from '../../shared/form-validation';
+/** Each roster field's counts, keyed by field name; empty when the schema declares none. */
+export declare function loadRosterCounts(schema: Record<string, unknown> | null | undefined, ctx: ShowIfContext): Promise<Record<string, RosterCounts>>;