@hotmeshio/long-tail 0.30.4 → 0.31.0

package/build/index.d.ts

@@ -22,6 +22,7 @@ export { InMemoryEventAdapter } from './lib/events/memory';
 export { SocketIOEventAdapter, type SocketIOAuthenticator } from './lib/events/socketio';
 export { publishMilestoneEvent, publishTaskEvent, publishEscalationEvent, publishActivityEvent, publishWorkflowEvent, publishAgentEvent, publishKnowledgeEvent } from './lib/events/publish';
 export { messagingRegistry, MemoryMessagingProvider, DELIVERY } from './lib/messaging';
+export { labelTransportRegistry } from './lib/labels/transports';
 export { NatsMessagingProvider } from './lib/messaging/nats/provider';
 export { renderNatsConf, type NatsConfOptions, type EdgeAccount, type NatsUser } from './lib/messaging/nats/render-conf';
 export { jsPermissions } from './lib/messaging/nats/permissions';

package/build/index.js

@@ -36,8 +36,8 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PinoLoggerAdapter = exports.loggerRegistry = exports.HoneycombTelemetryAdapter = exports.telemetryRegistry = exports.jsPermissions = exports.renderNatsConf = exports.NatsMessagingProvider = exports.DELIVERY = exports.MemoryMessagingProvider = exports.messagingRegistry = exports.publishKnowledgeEvent = exports.publishAgentEvent = exports.publishWorkflowEvent = exports.publishActivityEvent = exports.publishEscalationEvent = exports.publishTaskEvent = exports.publishMilestoneEvent = exports.SocketIOEventAdapter = exports.InMemoryEventAdapter = exports.NatsEventAdapter = exports.eventRegistry = exports.ltConfig = exports.seedConfigTopics = exports.seedSystemTopics = exports.TopicService = exports.displayGtin = exports.normalizeGtin = exports.isValidGtin = exports.assertValidScanIdentityRule = exports.assertValidScanSteps = exports.assertValidScanScheme = exports.UserService = exports.ConfigService = exports.EscalationService = exports.TaskService = exports.setAuthAdapter = exports.signToken = exports.requireAdmin = exports.requireAuth = exports.createAuthMiddleware = exports.JwtAuthAdapter = exports.conditionalAccumulator = exports.conditionLT = exports.conditional = exports.executeLT = exports.createLTActivityInterceptor = exports.createLTInterceptor = exports.registerLT = exports.midnightTheme = exports.start = void 0;
-exports.LTExpressAdapter = exports.Machines = exports.api = exports.KnowledgeApi = exports.resolveCredential = exports.mimeFromPath = exports.getStorageBackend = exports.listOAuthConnections = exports.getFreshAccessToken = exports.createClient = exports.CallbackEventAdapter = exports.builtinMcpServerFactories = exports.getSystemAgents = exports.getSystemWorkers = exports.registerMcpTool = exports.getToolContext = exports.getActivityIdentity = exports.McpEscalationStrategy = exports.DefaultEscalationStrategy = exports.escalationStrategyRegistry = exports.McpVisionServer = exports.McpTranslationServer = exports.McpServer = exports.McpClient = exports.McpService = exports.BuiltInMcpAdapter = exports.mcpRegistry = exports.defaultMaintenanceConfig = exports.maintenanceRegistry = void 0;
+exports.loggerRegistry = exports.HoneycombTelemetryAdapter = exports.telemetryRegistry = exports.jsPermissions = exports.renderNatsConf = exports.NatsMessagingProvider = exports.labelTransportRegistry = exports.DELIVERY = exports.MemoryMessagingProvider = exports.messagingRegistry = exports.publishKnowledgeEvent = exports.publishAgentEvent = exports.publishWorkflowEvent = exports.publishActivityEvent = exports.publishEscalationEvent = exports.publishTaskEvent = exports.publishMilestoneEvent = exports.SocketIOEventAdapter = exports.InMemoryEventAdapter = exports.NatsEventAdapter = exports.eventRegistry = exports.ltConfig = exports.seedConfigTopics = exports.seedSystemTopics = exports.TopicService = exports.displayGtin = exports.normalizeGtin = exports.isValidGtin = exports.assertValidScanIdentityRule = exports.assertValidScanSteps = exports.assertValidScanScheme = exports.UserService = exports.ConfigService = exports.EscalationService = exports.TaskService = exports.setAuthAdapter = exports.signToken = exports.requireAdmin = exports.requireAuth = exports.createAuthMiddleware = exports.JwtAuthAdapter = exports.conditionalAccumulator = exports.conditionLT = exports.conditional = exports.executeLT = exports.createLTActivityInterceptor = exports.createLTInterceptor = exports.registerLT = exports.midnightTheme = exports.start = void 0;
+exports.LTExpressAdapter = exports.Machines = exports.api = exports.KnowledgeApi = exports.resolveCredential = exports.mimeFromPath = exports.getStorageBackend = exports.listOAuthConnections = exports.getFreshAccessToken = exports.createClient = exports.CallbackEventAdapter = exports.builtinMcpServerFactories = exports.getSystemAgents = exports.getSystemWorkers = exports.registerMcpTool = exports.getToolContext = exports.getActivityIdentity = exports.McpEscalationStrategy = exports.DefaultEscalationStrategy = exports.escalationStrategyRegistry = exports.McpVisionServer = exports.McpTranslationServer = exports.McpServer = exports.McpClient = exports.McpService = exports.BuiltInMcpAdapter = exports.mcpRegistry = exports.defaultMaintenanceConfig = exports.maintenanceRegistry = exports.PinoLoggerAdapter = void 0;
 const config_1 = require("./modules/config");
 const logger_1 = require("./lib/logger");
 const midnight_1 = require("./themes/midnight");
@@ -105,6 +105,8 @@ var messaging_1 = require("./lib/messaging");
 Object.defineProperty(exports, "messagingRegistry", { enumerable: true, get: function () { return messaging_1.messagingRegistry; } });
 Object.defineProperty(exports, "MemoryMessagingProvider", { enumerable: true, get: function () { return messaging_1.MemoryMessagingProvider; } });
 Object.defineProperty(exports, "DELIVERY", { enumerable: true, get: function () { return messaging_1.DELIVERY; } });
+var transports_1 = require("./lib/labels/transports");
+Object.defineProperty(exports, "labelTransportRegistry", { enumerable: true, get: function () { return transports_1.labelTransportRegistry; } });
 var provider_1 = require("./lib/messaging/nats/provider");
 Object.defineProperty(exports, "NatsMessagingProvider", { enumerable: true, get: function () { return provider_1.NatsMessagingProvider; } });
 var render_conf_1 = require("./lib/messaging/nats/render-conf");

package/build/lib/db/schemas/044_label_sheets.sql

@@ -0,0 +1,65 @@
+-- Migration 044: label templates and the label ledger
+--
+-- lt_config_label_templates: what one printed label shows for a scan scheme.
+-- `codes` lists the rules printed on the label, each beside its caption, in
+-- order: [{ category, caption?, tone }]. `text` holds the title and up to two
+-- lines, written in label tokens ({target}, {item.<facet>}, {user.<key>}).
+-- `revision` advances on every change; `source` says who declared it.
+-- Templates on an identity scheme are always sensitive.
+--
+-- lt_label_jobs: one row per credential event or label print, written before
+-- any code leaves the server. It holds who asked, what template (snapshot),
+-- and who or what the labels name. Identity codes are never stored: identity
+-- jobs record subject_user_ids, item jobs record targets. Rows are never
+-- deleted by the platform.
+
+CREATE TABLE IF NOT EXISTS lt_config_label_templates (
+  name            TEXT PRIMARY KEY CHECK (name ~ '^[a-z0-9][a-z0-9-]{0,62}$'),
+  scheme_version  INT NOT NULL REFERENCES lt_config_scan_schemes(version) ON DELETE CASCADE,
+  title           TEXT NOT NULL,
+  description     TEXT,
+  codes           JSONB NOT NULL,
+  text            JSONB NOT NULL DEFAULT '{}'::jsonb,
+  symbology       TEXT NOT NULL DEFAULT 'code128'
+                    CHECK (symbology IN ('code128', 'qrcode', 'datamatrix')),
+  human_readable  BOOLEAN NOT NULL DEFAULT true,
+  media           TEXT,
+  sensitive       BOOLEAN NOT NULL DEFAULT false,
+  enabled         BOOLEAN NOT NULL DEFAULT true,
+  revision        INT NOT NULL DEFAULT 1,
+  source          TEXT NOT NULL DEFAULT 'api' CHECK (source IN ('code', 'api')),
+  created_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  updated_at      TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS lt_config_label_templates_scheme_idx
+  ON lt_config_label_templates (scheme_version);
+
+DROP TRIGGER IF EXISTS trg_lt_config_label_templates_updated_at ON lt_config_label_templates;
+CREATE TRIGGER trg_lt_config_label_templates_updated_at
+  BEFORE UPDATE ON lt_config_label_templates
+  FOR EACH ROW EXECUTE FUNCTION lt_set_updated_at();
+
+CREATE TABLE IF NOT EXISTS lt_label_jobs (
+  id                 UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  action             TEXT NOT NULL CHECK (action IN ('print', 'reissue', 'bind')),
+  requested_by       UUID,
+  idempotency_key    TEXT UNIQUE,
+  template_name      TEXT,
+  template_revision  INT,
+  template_snapshot  JSONB,
+  scheme_version     INT,
+  scheme_kind        TEXT,
+  sensitive          BOOLEAN NOT NULL DEFAULT false,
+  source             JSONB NOT NULL DEFAULT '{}'::jsonb,
+  subject_user_ids   UUID[],
+  targets            TEXT[],
+  label_count        INT NOT NULL DEFAULT 0,
+  media              JSONB,
+  output             TEXT,
+  created_at         TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS lt_label_jobs_created_idx ON lt_label_jobs (created_at DESC);
+CREATE INDEX IF NOT EXISTS lt_label_jobs_requester_idx ON lt_label_jobs (requested_by, created_at DESC);
+CREATE INDEX IF NOT EXISTS lt_label_jobs_subjects_idx ON lt_label_jobs USING GIN (subject_user_ids);

package/build/lib/db/schemas/045_label_job_delivery.sql

@@ -0,0 +1,14 @@
+-- Migration 045: delivery stamps on the label ledger
+--
+-- A job sent through a printer transport is recorded first, then delivered.
+-- delivery_claimed_at is a short lease one process takes before sending, so
+-- a retried request (same idempotency key) re-sends only an undelivered job
+-- whose lease has lapsed: never twice at once, never lost after a crash
+-- between record and send. delivered_at is stamped once the transport
+-- accepts. These two columns are the only ones the platform updates.
+
+ALTER TABLE lt_label_jobs
+  ADD COLUMN IF NOT EXISTS delivery_claimed_at TIMESTAMPTZ,
+  ADD COLUMN IF NOT EXISTS delivered_at TIMESTAMPTZ;
+
+CREATE INDEX IF NOT EXISTS lt_label_jobs_template_idx ON lt_label_jobs (template_name, created_at DESC);

package/build/lib/labels/transports.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The label transport registry: named routes from issued labels to printers,
+ * registered at startup. Sending is a capability, not a side effect, so a
+ * name with no transport fails loudly instead of printing nothing.
+ */
+import type { LTLabelTransport } from '../../types/labels';
+export declare const LABEL_TRANSPORT_NOT_CONFIGURED = "No label transport is registered under that name; pass start({ labels: { transports } })";
+declare class LTLabelTransportRegistry {
+    private transports;
+    /** Register a transport by name; replaces one registered before under the same name. */
+    register(name: string, transport: LTLabelTransport): void;
+    has(name: string): boolean;
+    /** The registered transports, by name, with the formats each accepts. */
+    list(): Array<{
+        name: string;
+        formats: LTLabelTransport['formats'];
+    }>;
+    get(name: string): LTLabelTransport;
+    /** Forget every transport (tests). */
+    clear(): void;
+}
+export declare const labelTransportRegistry: LTLabelTransportRegistry;
+export {};

package/build/lib/labels/transports.js

@@ -0,0 +1,39 @@
+"use strict";
+/**
+ * The label transport registry: named routes from issued labels to printers,
+ * registered at startup. Sending is a capability, not a side effect, so a
+ * name with no transport fails loudly instead of printing nothing.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.labelTransportRegistry = exports.LABEL_TRANSPORT_NOT_CONFIGURED = void 0;
+exports.LABEL_TRANSPORT_NOT_CONFIGURED = 'No label transport is registered under that name; pass start({ labels: { transports } })';
+class LTLabelTransportRegistry {
+    constructor() {
+        this.transports = new Map();
+    }
+    /** Register a transport by name; replaces one registered before under the same name. */
+    register(name, transport) {
+        if (!/^[a-z0-9][a-z0-9-]{0,62}$/.test(name)) {
+            throw new Error(`label transport name "${name}" must be lowercase letters, digits and dashes`);
+        }
+        this.transports.set(name, transport);
+    }
+    has(name) {
+        return this.transports.has(name);
+    }
+    /** The registered transports, by name, with the formats each accepts. */
+    list() {
+        return [...this.transports].map(([name, t]) => ({ name, formats: [...t.formats] }));
+    }
+    get(name) {
+        const transport = this.transports.get(name);
+        if (!transport)
+            throw new Error(`${exports.LABEL_TRANSPORT_NOT_CONFIGURED} (asked for "${name}")`);
+        return transport;
+    }
+    /** Forget every transport (tests). */
+    clear() {
+        this.transports.clear();
+    }
+}
+exports.labelTransportRegistry = new LTLabelTransportRegistry();

package/build/modules/auth.d.ts

@@ -57,6 +57,8 @@ export declare const requireAdmin: RequestHandler<import("express-serve-static-c
 export declare const requireBuilder: RequestHandler<import("express-serve-static-core").ParamsDictionary, any, any, import("qs").ParsedQs, Record<string, any>>;
 /** Role-management access: admin access or the 'engineer' role. Backend twin of `isBuilder || isOps`. */
 export declare const requireRoleManager: RequestHandler<import("express-serve-static-core").ParamsDictionary, any, any, import("qs").ParsedQs, Record<string, any>>;
+/** Credential access: superadmin or the 'credential-issuer' role. Gates badge printing and reissue. */
+export declare const requireCredentialIssuer: RequestHandler<import("express-serve-static-core").ParamsDictionary, any, any, import("qs").ParsedQs, Record<string, any>>;
 /** Reads of one workflow run (`:workflowId`): builder access, or the person who started it or it runs as. */
 export declare const requireWorkflowReader: RequestHandler;
 /**

package/build/modules/auth.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.requireWorkflowReader = exports.requireRoleManager = exports.requireBuilder = exports.requireAdmin = exports.requireCredentialAuth = exports.requireAuth = exports.JwtAuthAdapter = void 0;
+exports.requireWorkflowReader = exports.requireCredentialIssuer = exports.requireRoleManager = exports.requireBuilder = exports.requireAdmin = exports.requireCredentialAuth = exports.requireAuth = exports.JwtAuthAdapter = void 0;
 exports.createAuthMiddleware = createAuthMiddleware;
 exports.setAuthAdapter = setAuthAdapter;
 exports.signToken = signToken;
@@ -201,6 +201,8 @@ exports.requireAdmin = requireCapability(capabilities_1.mayAdminister, 'Forbidde
 exports.requireBuilder = requireCapability(capabilities_1.mayBuild, 'Forbidden: builder access required');
 /** Role-management access: admin access or the 'engineer' role. Backend twin of `isBuilder || isOps`. */
 exports.requireRoleManager = requireCapability(capabilities_1.mayManageRoles, 'Forbidden: role-management access required');
+/** Credential access: superadmin or the 'credential-issuer' role. Gates badge printing and reissue. */
+exports.requireCredentialIssuer = requireCapability(capabilities_1.mayIssueCredentials, 'Forbidden: credential-issuer access required');
 /** Reads of one workflow run (`:workflowId`): builder access, or the person who started it or it runs as. */
 const requireWorkflowReader = async (req, res, next) => {
     try {

package/build/modules/capabilities.d.ts

@@ -19,10 +19,14 @@ export type GrantDecision = {
     allowed: false;
     error: string;
 };
+/** Holders of this role may print and reissue identity credentials (badges). */
+export declare const CREDENTIAL_ISSUER_ROLE = "credential-issuer";
 /** Admin or superadmin claim, or a superadmin in the database. */
 export declare function mayAdminister(principal: CapabilityPrincipal | undefined): Promise<boolean>;
 /** Superadmin (claim or database), or holder of the engineer role. */
 export declare function mayBuild(principal: CapabilityPrincipal | undefined): Promise<boolean>;
+/** Superadmin (claim or database), or holder of the credential-issuer role. Admin type alone never grants it. */
+export declare function mayIssueCredentials(principal: CapabilityPrincipal | undefined): Promise<boolean>;
 /**
  * Builder access, or the person a workflow run was started by or runs as,
  * read from the run's own start envelope.
@@ -51,7 +55,7 @@ export declare function mayRevokeRole(callerId: string, targetId: string, role:
 /**
  * Every capability the principal holds, with the same outcomes as the
  * predicates above. A superadmin claim costs no lookup; anyone else costs
- * at most one superadmin lookup and one engineer-role lookup.
+ * at most one superadmin lookup and two role lookups.
  */
 export declare function resolveCapabilities(principal: CapabilityPrincipal | undefined): Promise<CapabilitySet>;
 /**

package/build/modules/capabilities.js

@@ -33,8 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.CREDENTIAL_ISSUER_ROLE = void 0;
 exports.mayAdminister = mayAdminister;
 exports.mayBuild = mayBuild;
+exports.mayIssueCredentials = mayIssueCredentials;
 exports.mayReadWorkflowRun = mayReadWorkflowRun;
 exports.mayManageRoles = mayManageRoles;
 exports.mayGrantRole = mayGrantRole;
@@ -47,9 +49,14 @@ const user_1 = require("../services/user");
 const export_1 = require("../services/export");
 const uuid_1 = require("../lib/uuid");
 const BUILDER_ROLE = 'engineer';
-async function hasBuilderRole(userId) {
+/** Holders of this role may print and reissue identity credentials (badges). */
+exports.CREDENTIAL_ISSUER_ROLE = 'credential-issuer';
+async function holdsRole(userId, role) {
     const { hasRole } = await Promise.resolve().then(() => __importStar(require('../services/user/roles')));
-    return hasRole(userId, BUILDER_ROLE);
+    return hasRole(userId, role);
+}
+async function hasBuilderRole(userId) {
+    return holdsRole(userId, BUILDER_ROLE);
 }
 /** Admin or superadmin claim, or a superadmin in the database. */
 async function mayAdminister(principal) {
@@ -69,6 +76,18 @@ async function mayBuild(principal) {
         return true;
     return hasBuilderRole(principal.userId);
 }
+/** Superadmin (claim or database), or holder of the credential-issuer role. Admin type alone never grants it. */
+async function mayIssueCredentials(principal) {
+    if (!principal?.userId)
+        return false;
+    if (principal.grantRoles)
+        return capabilitiesFromRoles(principal.grantRoles).credentialIssuer;
+    if (principal.role === 'superadmin')
+        return true;
+    if (await (0, user_1.isSuperAdmin)(principal.userId))
+        return true;
+    return holdsRole(principal.userId, exports.CREDENTIAL_ISSUER_ROLE);
+}
 /**
  * Builder access, or the person a workflow run was started by or runs as,
  * read from the run's own start envelope.
@@ -148,15 +167,19 @@ function capabilitiesFromRoles(roles) {
     const superadmin = roles.some((r) => r.type === 'superadmin');
     const admin = superadmin || roles.some((r) => r.type === 'admin');
     const engineer = roles.some((r) => r.role === BUILDER_ROLE);
-    return { caller: true, admin, builder: superadmin || engineer, roleManager: admin || engineer, superadmin };
+    const issuer = roles.some((r) => r.role === exports.CREDENTIAL_ISSUER_ROLE);
+    return {
+        caller: true, admin, builder: superadmin || engineer, roleManager: admin || engineer, superadmin,
+        credentialIssuer: superadmin || issuer,
+    };
 }
 const NO_CAPABILITIES = {
-    caller: false, admin: false, builder: false, roleManager: false, superadmin: false,
+    caller: false, admin: false, builder: false, roleManager: false, superadmin: false, credentialIssuer: false,
 };
 /**
  * Every capability the principal holds, with the same outcomes as the
  * predicates above. A superadmin claim costs no lookup; anyone else costs
- * at most one superadmin lookup and one engineer-role lookup.
+ * at most one superadmin lookup and two role lookups.
  */
 async function resolveCapabilities(principal) {
     if (!principal?.userId)
@@ -164,11 +187,18 @@ async function resolveCapabilities(principal) {
     if (principal.grantRoles)
         return capabilitiesFromRoles(principal.grantRoles);
     if (principal.role === 'superadmin' || (await (0, user_1.isSuperAdmin)(principal.userId))) {
-        return { caller: true, admin: true, builder: true, roleManager: true, superadmin: true };
+        return { caller: true, admin: true, builder: true, roleManager: true, superadmin: true, credentialIssuer: true };
     }
     const admin = principal.role === 'admin';
-    const engineer = await hasBuilderRole(principal.userId);
-    return { caller: true, admin, builder: engineer, roleManager: admin || engineer, superadmin: false };
+    const { hasRole } = await Promise.resolve().then(() => __importStar(require('../services/user/roles')));
+    const [engineer, issuer] = await Promise.all([
+        hasRole(principal.userId, BUILDER_ROLE),
+        hasRole(principal.userId, exports.CREDENTIAL_ISSUER_ROLE),
+    ]);
+    return {
+        caller: true, admin, builder: engineer, roleManager: admin || engineer, superadmin: false,
+        credentialIssuer: issuer,
+    };
 }
 /**
  * Capability checks for one request. `caller` needs only an authenticated

package/build/modules/config.d.ts

@@ -41,5 +41,15 @@ export declare const config: {
     LT_ANALYTICS_CACHE_TTL_MS: number;
     LT_ANALYTICS_PAST_CACHE_TTL_MS: number;
     LT_ANALYTICS_CACHE_MAX_ENTRIES: number;
+    /** Identity keys (badge tokens) leave user reads and need credentialIssuer to write. `false` keeps the earlier behavior. */
+    LT_PROTECT_IDENTITY_KEYS: boolean;
+    /** Label sheets: the media a job prints on when neither the job nor the template names one. */
+    LT_LABELS_DEFAULT_MEDIA: string;
+    /** Most labels one print job may hold. */
+    LT_LABELS_MAX_PER_JOB: number;
+    /** Most identity credentials (badges) one print job may hold. */
+    LT_LABELS_MAX_CREDENTIALS_PER_JOB: number;
+    /** How long one process holds a print job's delivery before a retry may send it. */
+    LT_LABELS_DELIVERY_LEASE_SECONDS: number;
 };
 export declare const postgres_options: Record<string, unknown>;

package/build/modules/config.js

@@ -67,6 +67,16 @@ exports.config = {
     LT_ANALYTICS_CACHE_TTL_MS: parseInt(process.env.LT_ANALYTICS_CACHE_TTL_MS || '30000', 10),
     LT_ANALYTICS_PAST_CACHE_TTL_MS: parseInt(process.env.LT_ANALYTICS_PAST_CACHE_TTL_MS || '600000', 10),
     LT_ANALYTICS_CACHE_MAX_ENTRIES: parseInt(process.env.LT_ANALYTICS_CACHE_MAX_ENTRIES || '512', 10),
+    /** Identity keys (badge tokens) leave user reads and need credentialIssuer to write. `false` keeps the earlier behavior. */
+    LT_PROTECT_IDENTITY_KEYS: process.env.LT_PROTECT_IDENTITY_KEYS !== 'false',
+    /** Label sheets: the media a job prints on when neither the job nor the template names one. */
+    LT_LABELS_DEFAULT_MEDIA: process.env.LT_LABELS_DEFAULT_MEDIA || 'a4-l7160',
+    /** Most labels one print job may hold. */
+    LT_LABELS_MAX_PER_JOB: positiveInt('LT_LABELS_MAX_PER_JOB', 1000),
+    /** Most identity credentials (badges) one print job may hold. */
+    LT_LABELS_MAX_CREDENTIALS_PER_JOB: positiveInt('LT_LABELS_MAX_CREDENTIALS_PER_JOB', 200),
+    /** How long one process holds a print job's delivery before a retry may send it. */
+    LT_LABELS_DELIVERY_LEASE_SECONDS: positiveInt('LT_LABELS_DELIVERY_LEASE_SECONDS', 120),
 };
 exports.postgres_options = {
     host: exports.config.POSTGRES_HOST,

package/build/routes/escalations/resolve.js

@@ -171,6 +171,24 @@ function registerResolveRoutes(router) {
         }, req.auth);
         res.status(result.status).json(result.data ?? { error: result.error });
     });
+    /**
+     * POST /api/escalations/:id/roster-scan
+     * A scan into a batch roster on this row's form. The field must declare
+     * x-lt-scan accepting the code's scheme; the scan fills the first open entry
+     * whose key is the code, as the person acting (the badged person when
+     * X-LT-Acting-Token rides the request).
+     * Body: { field: string, code: string }
+     */
+    router.post('/:id/roster-scan', async (req, res) => {
+        const token = req.headers[acting_1.ACTING_TOKEN_HEADER];
+        const result = await api.runRosterScan({
+            id: req.params.id,
+            field: req.body?.field,
+            code: req.body?.code,
+            actingToken: typeof token === 'string' && token ? token : undefined,
+        }, req.auth);
+        res.status(result.status).json(result.data ?? { error: result.error });
+    });
     /**
      * POST /api/escalations/:id/resolve
      * Resolve a pending escalation with a human-provided payload. Routes by

package/build/routes/index.js

@@ -38,6 +38,7 @@ const capabilities_1 = __importDefault(require("./capabilities"));
 const topics_1 = __importDefault(require("./topics"));
 const nats_credentials_1 = __importDefault(require("./nats-credentials"));
 const scan_codes_1 = __importDefault(require("./scan-codes"));
+const labels_1 = __importDefault(require("./labels"));
 const domain_1 = __importDefault(require("./domain"));
 const announcements_1 = __importDefault(require("./announcements"));
 const machines_1 = __importDefault(require("./machines"));
@@ -79,6 +80,7 @@ router.use('/agents', agents_1.default);
 router.use('/capabilities', capabilities_1.default);
 router.use('/topics', topics_1.default);
 router.use('/scan-codes', scan_codes_1.default);
+router.use('/labels', labels_1.default);
 router.use('/domain', domain_1.default);
 router.use('/announcements', announcements_1.default);
 router.use('/machines', machines_1.default);

package/build/routes/labels.d.ts

@@ -0,0 +1,2 @@
+declare const router: import("express-serve-static-core").Router;
+export default router;

package/build/routes/labels.js

@@ -0,0 +1,135 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const http_1 = require("../lib/http");
+const api = __importStar(require("../api/labels"));
+const auth_1 = require("../modules/auth");
+const router = (0, http_1.Router)();
+/** An issue result: PDF and ZPL as files, a sheet as JSON. Codes are never cached. */
+function sendIssued(res, result) {
+    res.set('Cache-Control', 'no-store');
+    if (result.status !== 200) {
+        res.status(result.status).json({ error: result.error });
+        return;
+    }
+    const { pdf, zpl, ...rest } = result.data;
+    res.set('X-LT-Label-Job', rest.job.id);
+    if (rest.warnings?.length)
+        res.set('X-LT-Label-Warnings', String(rest.warnings.length));
+    if (pdf) {
+        res.type('application/pdf').set('Content-Disposition', `attachment; filename="labels-${rest.job.id}.pdf"`).send(Buffer.from(pdf));
+        return;
+    }
+    if (zpl) {
+        res.type('application/vnd.zebra-zpl').set('Content-Disposition', `attachment; filename="labels-${rest.job.id}.zpl"`).send(zpl);
+        return;
+    }
+    res.json(rest);
+}
+// ── Templates ─────────────────────────────────────────────────────────────
+/** GET /api/labels/templates?scheme=14 */
+router.get('/templates', async (req, res) => {
+    const scheme = req.query.scheme ? Number(req.query.scheme) : undefined;
+    const result = await api.listLabelTemplates({ scheme });
+    res.status(result.status).json(result.data ?? { error: result.error });
+});
+/** GET /api/labels/templates/:name */
+router.get('/templates/:name', async (req, res) => {
+    const result = await api.getLabelTemplate({ name: String(req.params.name) });
+    res.status(result.status).json(result.data ?? { error: result.error });
+});
+/** PUT /api/labels/templates/:name — body is the template; `expected_revision` guards a concurrent edit. */
+router.put('/templates/:name', auth_1.requireRoleManager, async (req, res) => {
+    const result = await api.upsertLabelTemplate({ ...(req.body || {}), name: String(req.params.name) });
+    res.status(result.status).json(result.data ?? { error: result.error });
+});
+/** DELETE /api/labels/templates/:name */
+router.delete('/templates/:name', auth_1.requireRoleManager, async (req, res) => {
+    const result = await api.deleteLabelTemplate({ name: String(req.params.name) });
+    res.status(result.status).json(result.data ?? { error: result.error });
+});
+/** GET /api/labels/media — presets and the default media. */
+router.get('/media', async (_req, res) => {
+    const result = await api.listLabelMedia();
+    res.status(result.status).json(result.data);
+});
+/** GET /api/labels/transports — registered printer transports. */
+router.get('/transports', async (_req, res) => {
+    const result = await api.listLabelTransports();
+    res.status(result.status).json(result.data);
+});
+// ── Print ─────────────────────────────────────────────────────────────────
+/** POST /api/labels/preview — { template, source, layout? }. Sensitive templates come back masked. */
+router.post('/preview', async (req, res) => {
+    const { template, source, layout } = req.body || {};
+    const result = await api.previewLabels({ template, source, layout }, req.auth);
+    res.set('Cache-Control', 'no-store');
+    res.status(result.status).json(result.data ?? { error: result.error });
+});
+/**
+ * POST /api/labels/issue — { template, source, layout?, output, confirm?, idempotencyKey?, destination? }.
+ * output: sheet (JSON), pdf, zpl, or transport:<name>.
+ */
+router.post('/issue', async (req, res) => {
+    const { template, source, layout, output, confirm, idempotencyKey, destination, only } = req.body || {};
+    sendIssued(res, await api.issueLabels({ template, source, layout, output, confirm, idempotencyKey, destination, only }, req.auth));
+});
+/** POST /api/labels/badges/reissue — { userId, template, layout?, output, confirm }. */
+router.post('/badges/reissue', async (req, res) => {
+    const { userId, template, layout, output, confirm } = req.body || {};
+    sendIssued(res, await api.reissueBadge({ userId, template, layout, output, confirm }, req.auth));
+});
+// ── History ───────────────────────────────────────────────────────────────
+/** GET /api/labels/jobs?template=&subjectUserId=&limit=&offset= */
+router.get('/jobs', async (req, res) => {
+    const result = await api.listLabelJobs({
+        template: req.query.template,
+        subjectUserId: req.query.subjectUserId,
+        limit: req.query.limit ? Number(req.query.limit) : undefined,
+        offset: req.query.offset ? Number(req.query.offset) : undefined,
+    }, req.auth);
+    res.status(result.status).json(result.data ?? { error: result.error });
+});
+/** GET /api/labels/jobs/:id */
+router.get('/jobs/:id', async (req, res) => {
+    const result = await api.getLabelJob({ id: String(req.params.id) }, req.auth);
+    res.status(result.status).json(result.data ?? { error: result.error });
+});
+/** POST /api/labels/jobs/:id/reprint — { indices?, output, layout?, confirm? } */
+router.post('/jobs/:id/reprint', async (req, res) => {
+    const { indices, output, layout, confirm } = req.body || {};
+    sendIssued(res, await api.reprintLabelJob({ id: String(req.params.id), indices, output, layout, confirm }, req.auth));
+});
+exports.default = router;

package/build/routes/users.js

@@ -127,7 +127,7 @@ router.patch('/:id/properties', auth_1.requireBuilder, async (req, res) => {
         set,
         remove,
         rename,
-    });
+    }, req.auth);
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**

package/build/services/labels/content.d.ts

@@ -0,0 +1,13 @@
+import { type ScanRule, type ScanScheme } from '../../types';
+import type { LabelContent, LabelWarning } from '../../shared/labels/types';
+import type { LabelTarget, LabelTemplate } from '../../types/labels';
+export interface BuiltContents {
+    contents: LabelContent[];
+    warnings: LabelWarning[];
+}
+/**
+ * Compose every label. A target the scheme cannot carry (a fixed scheme's
+ * target with letters) prints its text without codes and is reported;
+ * identity warnings never repeat the target, which is the credential.
+ */
+export declare function buildLabelContents(template: LabelTemplate, scheme: ScanScheme, rules: ScanRule[], targets: LabelTarget[], masked: boolean): BuiltContents;