@hotmeshio/long-tail 0.30.4 → 0.31.0

package/dashboard/dist/assets/{yaml-workflows-Dyln3od-.js → yaml-workflows-C20qHo3L.js}

@@ -1,2 +1,2 @@
-import{u as l,b as a,c as s}from"./vendor-query-DvWWuNIB.js";import{m as r}from"./index-ygxyAKcc.js";function f(e={}){const o=new URLSearchParams;return e.status&&o.set("status",e.status),e.graph_topic&&o.set("graph_topic",e.graph_topic),e.app_id&&o.set("app_id",e.app_id),e.search&&o.set("search",e.search),e.set_id&&o.set("set_id",e.set_id),e.limit&&o.set("limit",String(e.limit)),e.offset!==void 0&&o.set("offset",String(e.offset)),l({queryKey:["yamlWorkflows",e],queryFn:()=>r(`/yaml-workflows?${o}`)})}function m(){return l({queryKey:["yamlWorkflowAppIds"],queryFn:()=>r("/yaml-workflows/app-ids")})}function c(e){return l({queryKey:["yamlWorkflows",e],queryFn:()=>r(`/yaml-workflows/${e}`),enabled:!!e})}function w(){const e=a();return s({mutationFn:o=>r("/yaml-workflows",{method:"POST",body:JSON.stringify(o)}),onSuccess:()=>{e.invalidateQueries({queryKey:["yamlWorkflows"],refetchType:"all"})}})}function k(){const e=a();return s({mutationFn:o=>r(`/yaml-workflows/${o}/deploy`,{method:"POST"}),onSuccess:()=>{e.invalidateQueries({queryKey:["yamlWorkflows"],refetchType:"all"})}})}function p(){const e=a();return s({mutationFn:o=>r(`/yaml-workflows/${o}/activate`,{method:"POST"}),onSuccess:()=>{e.invalidateQueries({queryKey:["yamlWorkflows"],refetchType:"all"})}})}function d(){const e=a();return s({mutationFn:({id:o,data:t,sync:n,execute_as:u})=>r(`/yaml-workflows/${o}/invoke`,{method:"POST",body:JSON.stringify({data:t,sync:n,...u?{execute_as:u}:{}})}),onSuccess:()=>{e.invalidateQueries({queryKey:["yamlWorkflows"],refetchType:"all"})}})}function h(){const e=a();return s({mutationFn:({id:o,task_queue:t,compilation_feedback:n})=>r(`/yaml-workflows/${o}/regenerate`,{method:"POST",body:JSON.stringify({task_queue:t,compilation_feedback:n})}),onSuccess:()=>{e.invalidateQueries({queryKey:["yamlWorkflows"],refetchType:"all"})}})}function q(){const e=a();return s({mutationFn:o=>r(`/yaml-workflows/${o}/archive`,{method:"POST"}),onSuccess:()=>{e.invalidateQueries({queryKey:["yamlWorkflows"],refetchType:"all"})}})}function W(){const e=a();return s({mutationFn:o=>r(`/yaml-workflows/${o}/restore`,{method:"POST"}),onSuccess:()=>{e.invalidateQueries({queryKey:["yamlWorkflows"],refetchType:"all"}),e.invalidateQueries({queryKey:["yamlWorkflow"],refetchType:"all"})}})}function S(){const e=a();return s({mutationFn:({id:o,...t})=>r(`/yaml-workflows/${o}`,{method:"PUT",body:JSON.stringify(t)}),onSuccess:()=>{e.invalidateQueries({queryKey:["yamlWorkflows"],refetchType:"all"})}})}function v(){const e=a();return s({mutationFn:o=>r(`/yaml-workflows/${o}`,{method:"DELETE"}),onSuccess:()=>{e.invalidateQueries({queryKey:["yamlWorkflows"],refetchType:"all"})}})}function T(e){return l({queryKey:["yamlWorkflows",e,"versions"],queryFn:()=>r(`/yaml-workflows/${e}/versions`),enabled:!!e})}function F(e,o){return l({queryKey:["yamlWorkflows",e,"versions",o],queryFn:()=>r(`/yaml-workflows/${e}/versions/${o}`),enabled:!!e&&o!==null})}export{m as a,S as b,c,T as d,k as e,p as f,q as g,W as h,v as i,h as j,F as k,d as l,w as m,f as u};
-//# sourceMappingURL=yaml-workflows-Dyln3od-.js.map
+import{u as l,b as a,c as s}from"./vendor-query-DvWWuNIB.js";import{m as r}from"./index-C_dAJUzh.js";function f(e={}){const o=new URLSearchParams;return e.status&&o.set("status",e.status),e.graph_topic&&o.set("graph_topic",e.graph_topic),e.app_id&&o.set("app_id",e.app_id),e.search&&o.set("search",e.search),e.set_id&&o.set("set_id",e.set_id),e.limit&&o.set("limit",String(e.limit)),e.offset!==void 0&&o.set("offset",String(e.offset)),l({queryKey:["yamlWorkflows",e],queryFn:()=>r(`/yaml-workflows?${o}`)})}function m(){return l({queryKey:["yamlWorkflowAppIds"],queryFn:()=>r("/yaml-workflows/app-ids")})}function c(e){return l({queryKey:["yamlWorkflows",e],queryFn:()=>r(`/yaml-workflows/${e}`),enabled:!!e})}function w(){const e=a();return s({mutationFn:o=>r("/yaml-workflows",{method:"POST",body:JSON.stringify(o)}),onSuccess:()=>{e.invalidateQueries({queryKey:["yamlWorkflows"],refetchType:"all"})}})}function k(){const e=a();return s({mutationFn:o=>r(`/yaml-workflows/${o}/deploy`,{method:"POST"}),onSuccess:()=>{e.invalidateQueries({queryKey:["yamlWorkflows"],refetchType:"all"})}})}function p(){const e=a();return s({mutationFn:o=>r(`/yaml-workflows/${o}/activate`,{method:"POST"}),onSuccess:()=>{e.invalidateQueries({queryKey:["yamlWorkflows"],refetchType:"all"})}})}function d(){const e=a();return s({mutationFn:({id:o,data:t,sync:n,execute_as:u})=>r(`/yaml-workflows/${o}/invoke`,{method:"POST",body:JSON.stringify({data:t,sync:n,...u?{execute_as:u}:{}})}),onSuccess:()=>{e.invalidateQueries({queryKey:["yamlWorkflows"],refetchType:"all"})}})}function h(){const e=a();return s({mutationFn:({id:o,task_queue:t,compilation_feedback:n})=>r(`/yaml-workflows/${o}/regenerate`,{method:"POST",body:JSON.stringify({task_queue:t,compilation_feedback:n})}),onSuccess:()=>{e.invalidateQueries({queryKey:["yamlWorkflows"],refetchType:"all"})}})}function q(){const e=a();return s({mutationFn:o=>r(`/yaml-workflows/${o}/archive`,{method:"POST"}),onSuccess:()=>{e.invalidateQueries({queryKey:["yamlWorkflows"],refetchType:"all"})}})}function W(){const e=a();return s({mutationFn:o=>r(`/yaml-workflows/${o}/restore`,{method:"POST"}),onSuccess:()=>{e.invalidateQueries({queryKey:["yamlWorkflows"],refetchType:"all"}),e.invalidateQueries({queryKey:["yamlWorkflow"],refetchType:"all"})}})}function S(){const e=a();return s({mutationFn:({id:o,...t})=>r(`/yaml-workflows/${o}`,{method:"PUT",body:JSON.stringify(t)}),onSuccess:()=>{e.invalidateQueries({queryKey:["yamlWorkflows"],refetchType:"all"})}})}function v(){const e=a();return s({mutationFn:o=>r(`/yaml-workflows/${o}`,{method:"DELETE"}),onSuccess:()=>{e.invalidateQueries({queryKey:["yamlWorkflows"],refetchType:"all"})}})}function T(e){return l({queryKey:["yamlWorkflows",e,"versions"],queryFn:()=>r(`/yaml-workflows/${e}/versions`),enabled:!!e})}function F(e,o){return l({queryKey:["yamlWorkflows",e,"versions",o],queryFn:()=>r(`/yaml-workflows/${e}/versions/${o}`),enabled:!!e&&o!==null})}export{m as a,S as b,c,T as d,k as e,p as f,q as g,W as h,v as i,h as j,F as k,d as l,w as m,f as u};
+//# sourceMappingURL=yaml-workflows-C20qHo3L.js.map

package/dashboard/dist/assets/{yaml-workflows-Dyln3od-.js.map → yaml-workflows-C20qHo3L.js.map}

@@ -1 +1 @@
-{"version":3,"file":"yaml-workflows-Dyln3od-.js","sources":["../../src/api/yaml-workflows.ts"],"sourcesContent":["import { useQuery, useMutation, useQueryClient } from '@tanstack/react-query';\nimport { apiFetch } from './client';\nimport type { LTYamlWorkflowRecord, LTYamlWorkflowStatus, LTYamlWorkflowVersion } from './types';\n\ninterface YamlWorkflowListResponse {\n  workflows: LTYamlWorkflowRecord[];\n  total: number;\n}\n\ninterface YamlWorkflowFilters {\n  status?: LTYamlWorkflowStatus;\n  graph_topic?: string;\n  app_id?: string;\n  search?: string;\n  set_id?: string;\n  limit?: number;\n  offset?: number;\n}\n\nexport function useYamlWorkflows(filters: YamlWorkflowFilters = {}) {\n  const params = new URLSearchParams();\n  if (filters.status) params.set('status', filters.status);\n  if (filters.graph_topic) params.set('graph_topic', filters.graph_topic);\n  if (filters.app_id) params.set('app_id', filters.app_id);\n  if (filters.search) params.set('search', filters.search);\n  if (filters.set_id) params.set('set_id', filters.set_id);\n  if (filters.limit) params.set('limit', String(filters.limit));\n  if (filters.offset !== undefined) params.set('offset', String(filters.offset));\n\n  return useQuery<YamlWorkflowListResponse>({\n    queryKey: ['yamlWorkflows', filters],\n    queryFn: () => apiFetch(`/yaml-workflows?${params}`),\n  });\n}\n\nexport function useYamlWorkflowAppIds() {\n  return useQuery<{ app_ids: string[] }>({\n    queryKey: ['yamlWorkflowAppIds'],\n    queryFn: () => apiFetch('/yaml-workflows/app-ids'),\n  });\n}\n\nexport function useYamlWorkflowByTopic(graphTopic: string | undefined, appId?: string) {\n  return useQuery<YamlWorkflowListResponse>({\n    queryKey: ['yamlWorkflows', 'byTopic', graphTopic, appId],\n    queryFn: () => {\n      const params = new URLSearchParams({ graph_topic: graphTopic!, limit: '1' });\n      if (appId) params.set('app_id', appId);\n      return apiFetch(`/yaml-workflows?${params}`);\n    },\n    enabled: !!graphTopic,\n  });\n}\n\nexport function useYamlWorkflow(id: string) {\n  return useQuery<LTYamlWorkflowRecord>({\n    queryKey: ['yamlWorkflows', id],\n    queryFn: () => apiFetch(`/yaml-workflows/${id}`),\n    enabled: !!id,\n  });\n}\n\nexport function useCreateYamlWorkflow() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: (input: {\n      workflow_id: string;\n      task_queue: string;\n      workflow_name: string;\n      name: string;\n      description?: string;\n      app_id?: string;\n      subscribes?: string;\n      tags?: string[];\n      compilation_feedback?: string;\n    }) =>\n      apiFetch<LTYamlWorkflowRecord>('/yaml-workflows', {\n        method: 'POST',\n        body: JSON.stringify(input),\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n    },\n  });\n}\n\nexport function useDeployYamlWorkflow() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: (id: string) =>\n      apiFetch<LTYamlWorkflowRecord>(`/yaml-workflows/${id}/deploy`, {\n        method: 'POST',\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n    },\n  });\n}\n\nexport function useActivateYamlWorkflow() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: (id: string) =>\n      apiFetch<LTYamlWorkflowRecord>(`/yaml-workflows/${id}/activate`, {\n        method: 'POST',\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n    },\n  });\n}\n\nexport function useInvokeYamlWorkflow() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: ({ id, data, sync, execute_as }: { id: string; data: Record<string, unknown>; sync?: boolean; execute_as?: string }) =>\n      apiFetch<{ result?: unknown; job_id?: string }>(`/yaml-workflows/${id}/invoke`, {\n        method: 'POST',\n        body: JSON.stringify({ data, sync, ...(execute_as ? { execute_as } : {}) }),\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n    },\n  });\n}\n\nexport function useRegenerateYamlWorkflow() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: ({ id, task_queue, compilation_feedback }: { id: string; task_queue?: string; compilation_feedback?: string }) =>\n      apiFetch<LTYamlWorkflowRecord>(`/yaml-workflows/${id}/regenerate`, {\n        method: 'POST',\n        body: JSON.stringify({ task_queue, compilation_feedback }),\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n    },\n  });\n}\n\nexport function useArchiveYamlWorkflow() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: (id: string) =>\n      apiFetch<LTYamlWorkflowRecord>(`/yaml-workflows/${id}/archive`, {\n        method: 'POST',\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n    },\n  });\n}\n\nexport function useRestoreYamlWorkflow() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: (id: string) =>\n      apiFetch<LTYamlWorkflowRecord>(`/yaml-workflows/${id}/restore`, {\n        method: 'POST',\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflow'], refetchType: 'all' });\n    },\n  });\n}\n\nexport function useUpdateYamlWorkflow() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: ({ id, ...updates }: { id: string; yaml_content?: string; name?: string; description?: string; input_schema?: Record<string, unknown>; output_schema?: Record<string, unknown>; tags?: string[]; app_id?: string; graph_topic?: string }) =>\n      apiFetch<LTYamlWorkflowRecord>(`/yaml-workflows/${id}`, {\n        method: 'PUT',\n        body: JSON.stringify(updates),\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n    },\n  });\n}\n\nexport function useDeleteYamlWorkflow() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: (id: string) =>\n      apiFetch<{ deleted: boolean }>(`/yaml-workflows/${id}`, {\n        method: 'DELETE',\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n    },\n  });\n}\n\n// ── Cron scheduling ─────────────────────────────────────────────\n\nexport function useSetYamlCron() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: ({ id, cron_schedule, cron_envelope, execute_as }: {\n      id: string;\n      cron_schedule: string;\n      cron_envelope?: Record<string, unknown> | null;\n      execute_as?: string | null;\n    }) =>\n      apiFetch<LTYamlWorkflowRecord>(`/yaml-workflows/${id}/cron`, {\n        method: 'PUT',\n        body: JSON.stringify({ cron_schedule, cron_envelope, execute_as }),\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n    },\n  });\n}\n\nexport function useClearYamlCron() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: (id: string) =>\n      apiFetch<LTYamlWorkflowRecord>(`/yaml-workflows/${id}/cron`, {\n        method: 'DELETE',\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n    },\n  });\n}\n\n// ── Version history ─────────────────────────────────────────────\n\nexport function useYamlWorkflowVersions(id: string) {\n  return useQuery<{ versions: LTYamlWorkflowVersion[]; total: number }>({\n    queryKey: ['yamlWorkflows', id, 'versions'],\n    queryFn: () => apiFetch(`/yaml-workflows/${id}/versions`),\n    enabled: !!id,\n  });\n}\n\nexport function useYamlWorkflowVersion(id: string, version: number | null) {\n  return useQuery<LTYamlWorkflowVersion>({\n    queryKey: ['yamlWorkflows', id, 'versions', version],\n    queryFn: () => apiFetch(`/yaml-workflows/${id}/versions/${version}`),\n    enabled: !!id && version !== null,\n  });\n}\n"],"names":["useYamlWorkflows","filters","params","useQuery","apiFetch","useYamlWorkflowAppIds","useYamlWorkflow","id","useCreateYamlWorkflow","queryClient","useQueryClient","useMutation","input","useDeployYamlWorkflow","useActivateYamlWorkflow","useInvokeYamlWorkflow","data","sync","execute_as","useRegenerateYamlWorkflow","task_queue","compilation_feedback","useArchiveYamlWorkflow","useRestoreYamlWorkflow","useUpdateYamlWorkflow","updates","useDeleteYamlWorkflow","useYamlWorkflowVersions","useYamlWorkflowVersion","version"],"mappings":"qGAmBO,SAASA,EAAiBC,EAA+B,GAAI,CAClE,MAAMC,EAAS,IAAI,gBACnB,OAAID,EAAQ,QAAQC,EAAO,IAAI,SAAUD,EAAQ,MAAM,EACnDA,EAAQ,aAAaC,EAAO,IAAI,cAAeD,EAAQ,WAAW,EAClEA,EAAQ,QAAQC,EAAO,IAAI,SAAUD,EAAQ,MAAM,EACnDA,EAAQ,QAAQC,EAAO,IAAI,SAAUD,EAAQ,MAAM,EACnDA,EAAQ,QAAQC,EAAO,IAAI,SAAUD,EAAQ,MAAM,EACnDA,EAAQ,OAAOC,EAAO,IAAI,QAAS,OAAOD,EAAQ,KAAK,CAAC,EACxDA,EAAQ,SAAW,QAAWC,EAAO,IAAI,SAAU,OAAOD,EAAQ,MAAM,CAAC,EAEtEE,EAAmC,CACxC,SAAU,CAAC,gBAAiBF,CAAO,EACnC,QAAS,IAAMG,EAAS,mBAAmBF,CAAM,EAAE,CAAA,CACpD,CACH,CAEO,SAASG,GAAwB,CACtC,OAAOF,EAAgC,CACrC,SAAU,CAAC,oBAAoB,EAC/B,QAAS,IAAMC,EAAS,yBAAyB,CAAA,CAClD,CACH,CAcO,SAASE,EAAgBC,EAAY,CAC1C,OAAOJ,EAA+B,CACpC,SAAU,CAAC,gBAAiBI,CAAE,EAC9B,QAAS,IAAMH,EAAS,mBAAmBG,CAAE,EAAE,EAC/C,QAAS,CAAC,CAACA,CAAA,CACZ,CACH,CAEO,SAASC,GAAwB,CACtC,MAAMC,EAAcC,EAAA,EACpB,OAAOC,EAAY,CACjB,WAAaC,GAWXR,EAA+B,kBAAmB,CAChD,OAAQ,OACR,KAAM,KAAK,UAAUQ,CAAK,CAAA,CAC3B,EACH,UAAW,IAAM,CACfH,EAAY,kBAAkB,CAAE,SAAU,CAAC,eAAe,EAAG,YAAa,MAAO,CACnF,CAAA,CACD,CACH,CAEO,SAASI,GAAwB,CACtC,MAAMJ,EAAcC,EAAA,EACpB,OAAOC,EAAY,CACjB,WAAaJ,GACXH,EAA+B,mBAAmBG,CAAE,UAAW,CAC7D,OAAQ,MAAA,CACT,EACH,UAAW,IAAM,CACfE,EAAY,kBAAkB,CAAE,SAAU,CAAC,eAAe,EAAG,YAAa,MAAO,CACnF,CAAA,CACD,CACH,CAEO,SAASK,GAA0B,CACxC,MAAML,EAAcC,EAAA,EACpB,OAAOC,EAAY,CACjB,WAAaJ,GACXH,EAA+B,mBAAmBG,CAAE,YAAa,CAC/D,OAAQ,MAAA,CACT,EACH,UAAW,IAAM,CACfE,EAAY,kBAAkB,CAAE,SAAU,CAAC,eAAe,EAAG,YAAa,MAAO,CACnF,CAAA,CACD,CACH,CAEO,SAASM,GAAwB,CACtC,MAAMN,EAAcC,EAAA,EACpB,OAAOC,EAAY,CACjB,WAAY,CAAC,CAAE,GAAAJ,EAAI,KAAAS,EAAM,KAAAC,EAAM,WAAAC,KAC7Bd,EAAgD,mBAAmBG,CAAE,UAAW,CAC9E,OAAQ,OACR,KAAM,KAAK,UAAU,CAAE,KAAAS,EAAM,KAAAC,EAAM,GAAIC,EAAa,CAAE,WAAAA,CAAA,EAAe,GAAK,CAAA,CAC3E,EACH,UAAW,IAAM,CACfT,EAAY,kBAAkB,CAAE,SAAU,CAAC,eAAe,EAAG,YAAa,MAAO,CACnF,CAAA,CACD,CACH,CAEO,SAASU,GAA4B,CAC1C,MAAMV,EAAcC,EAAA,EACpB,OAAOC,EAAY,CACjB,WAAY,CAAC,CAAE,GAAAJ,EAAI,WAAAa,EAAY,qBAAAC,KAC7BjB,EAA+B,mBAAmBG,CAAE,cAAe,CACjE,OAAQ,OACR,KAAM,KAAK,UAAU,CAAE,WAAAa,EAAY,qBAAAC,EAAsB,CAAA,CAC1D,EACH,UAAW,IAAM,CACfZ,EAAY,kBAAkB,CAAE,SAAU,CAAC,eAAe,EAAG,YAAa,MAAO,CACnF,CAAA,CACD,CACH,CAEO,SAASa,GAAyB,CACvC,MAAMb,EAAcC,EAAA,EACpB,OAAOC,EAAY,CACjB,WAAaJ,GACXH,EAA+B,mBAAmBG,CAAE,WAAY,CAC9D,OAAQ,MAAA,CACT,EACH,UAAW,IAAM,CACfE,EAAY,kBAAkB,CAAE,SAAU,CAAC,eAAe,EAAG,YAAa,MAAO,CACnF,CAAA,CACD,CACH,CAEO,SAASc,GAAyB,CACvC,MAAMd,EAAcC,EAAA,EACpB,OAAOC,EAAY,CACjB,WAAaJ,GACXH,EAA+B,mBAAmBG,CAAE,WAAY,CAC9D,OAAQ,MAAA,CACT,EACH,UAAW,IAAM,CACfE,EAAY,kBAAkB,CAAE,SAAU,CAAC,eAAe,EAAG,YAAa,MAAO,EACjFA,EAAY,kBAAkB,CAAE,SAAU,CAAC,cAAc,EAAG,YAAa,MAAO,CAClF,CAAA,CACD,CACH,CAEO,SAASe,GAAwB,CACtC,MAAMf,EAAcC,EAAA,EACpB,OAAOC,EAAY,CACjB,WAAY,CAAC,CAAE,GAAAJ,EAAI,GAAGkB,KACpBrB,EAA+B,mBAAmBG,CAAE,GAAI,CACtD,OAAQ,MACR,KAAM,KAAK,UAAUkB,CAAO,CAAA,CAC7B,EACH,UAAW,IAAM,CACfhB,EAAY,kBAAkB,CAAE,SAAU,CAAC,eAAe,EAAG,YAAa,MAAO,CACnF,CAAA,CACD,CACH,CAEO,SAASiB,GAAwB,CACtC,MAAMjB,EAAcC,EAAA,EACpB,OAAOC,EAAY,CACjB,WAAaJ,GACXH,EAA+B,mBAAmBG,CAAE,GAAI,CACtD,OAAQ,QAAA,CACT,EACH,UAAW,IAAM,CACfE,EAAY,kBAAkB,CAAE,SAAU,CAAC,eAAe,EAAG,YAAa,MAAO,CACnF,CAAA,CACD,CACH,CAsCO,SAASkB,EAAwBpB,EAAY,CAClD,OAAOJ,EAA+D,CACpE,SAAU,CAAC,gBAAiBI,EAAI,UAAU,EAC1C,QAAS,IAAMH,EAAS,mBAAmBG,CAAE,WAAW,EACxD,QAAS,CAAC,CAACA,CAAA,CACZ,CACH,CAEO,SAASqB,EAAuBrB,EAAYsB,EAAwB,CACzE,OAAO1B,EAAgC,CACrC,SAAU,CAAC,gBAAiBI,EAAI,WAAYsB,CAAO,EACnD,QAAS,IAAMzB,EAAS,mBAAmBG,CAAE,aAAasB,CAAO,EAAE,EACnE,QAAS,CAAC,CAACtB,GAAMsB,IAAY,IAAA,CAC9B,CACH"}
+{"version":3,"file":"yaml-workflows-C20qHo3L.js","sources":["../../src/api/yaml-workflows.ts"],"sourcesContent":["import { useQuery, useMutation, useQueryClient } from '@tanstack/react-query';\nimport { apiFetch } from './client';\nimport type { LTYamlWorkflowRecord, LTYamlWorkflowStatus, LTYamlWorkflowVersion } from './types';\n\ninterface YamlWorkflowListResponse {\n  workflows: LTYamlWorkflowRecord[];\n  total: number;\n}\n\ninterface YamlWorkflowFilters {\n  status?: LTYamlWorkflowStatus;\n  graph_topic?: string;\n  app_id?: string;\n  search?: string;\n  set_id?: string;\n  limit?: number;\n  offset?: number;\n}\n\nexport function useYamlWorkflows(filters: YamlWorkflowFilters = {}) {\n  const params = new URLSearchParams();\n  if (filters.status) params.set('status', filters.status);\n  if (filters.graph_topic) params.set('graph_topic', filters.graph_topic);\n  if (filters.app_id) params.set('app_id', filters.app_id);\n  if (filters.search) params.set('search', filters.search);\n  if (filters.set_id) params.set('set_id', filters.set_id);\n  if (filters.limit) params.set('limit', String(filters.limit));\n  if (filters.offset !== undefined) params.set('offset', String(filters.offset));\n\n  return useQuery<YamlWorkflowListResponse>({\n    queryKey: ['yamlWorkflows', filters],\n    queryFn: () => apiFetch(`/yaml-workflows?${params}`),\n  });\n}\n\nexport function useYamlWorkflowAppIds() {\n  return useQuery<{ app_ids: string[] }>({\n    queryKey: ['yamlWorkflowAppIds'],\n    queryFn: () => apiFetch('/yaml-workflows/app-ids'),\n  });\n}\n\nexport function useYamlWorkflowByTopic(graphTopic: string | undefined, appId?: string) {\n  return useQuery<YamlWorkflowListResponse>({\n    queryKey: ['yamlWorkflows', 'byTopic', graphTopic, appId],\n    queryFn: () => {\n      const params = new URLSearchParams({ graph_topic: graphTopic!, limit: '1' });\n      if (appId) params.set('app_id', appId);\n      return apiFetch(`/yaml-workflows?${params}`);\n    },\n    enabled: !!graphTopic,\n  });\n}\n\nexport function useYamlWorkflow(id: string) {\n  return useQuery<LTYamlWorkflowRecord>({\n    queryKey: ['yamlWorkflows', id],\n    queryFn: () => apiFetch(`/yaml-workflows/${id}`),\n    enabled: !!id,\n  });\n}\n\nexport function useCreateYamlWorkflow() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: (input: {\n      workflow_id: string;\n      task_queue: string;\n      workflow_name: string;\n      name: string;\n      description?: string;\n      app_id?: string;\n      subscribes?: string;\n      tags?: string[];\n      compilation_feedback?: string;\n    }) =>\n      apiFetch<LTYamlWorkflowRecord>('/yaml-workflows', {\n        method: 'POST',\n        body: JSON.stringify(input),\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n    },\n  });\n}\n\nexport function useDeployYamlWorkflow() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: (id: string) =>\n      apiFetch<LTYamlWorkflowRecord>(`/yaml-workflows/${id}/deploy`, {\n        method: 'POST',\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n    },\n  });\n}\n\nexport function useActivateYamlWorkflow() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: (id: string) =>\n      apiFetch<LTYamlWorkflowRecord>(`/yaml-workflows/${id}/activate`, {\n        method: 'POST',\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n    },\n  });\n}\n\nexport function useInvokeYamlWorkflow() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: ({ id, data, sync, execute_as }: { id: string; data: Record<string, unknown>; sync?: boolean; execute_as?: string }) =>\n      apiFetch<{ result?: unknown; job_id?: string }>(`/yaml-workflows/${id}/invoke`, {\n        method: 'POST',\n        body: JSON.stringify({ data, sync, ...(execute_as ? { execute_as } : {}) }),\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n    },\n  });\n}\n\nexport function useRegenerateYamlWorkflow() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: ({ id, task_queue, compilation_feedback }: { id: string; task_queue?: string; compilation_feedback?: string }) =>\n      apiFetch<LTYamlWorkflowRecord>(`/yaml-workflows/${id}/regenerate`, {\n        method: 'POST',\n        body: JSON.stringify({ task_queue, compilation_feedback }),\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n    },\n  });\n}\n\nexport function useArchiveYamlWorkflow() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: (id: string) =>\n      apiFetch<LTYamlWorkflowRecord>(`/yaml-workflows/${id}/archive`, {\n        method: 'POST',\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n    },\n  });\n}\n\nexport function useRestoreYamlWorkflow() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: (id: string) =>\n      apiFetch<LTYamlWorkflowRecord>(`/yaml-workflows/${id}/restore`, {\n        method: 'POST',\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflow'], refetchType: 'all' });\n    },\n  });\n}\n\nexport function useUpdateYamlWorkflow() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: ({ id, ...updates }: { id: string; yaml_content?: string; name?: string; description?: string; input_schema?: Record<string, unknown>; output_schema?: Record<string, unknown>; tags?: string[]; app_id?: string; graph_topic?: string }) =>\n      apiFetch<LTYamlWorkflowRecord>(`/yaml-workflows/${id}`, {\n        method: 'PUT',\n        body: JSON.stringify(updates),\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n    },\n  });\n}\n\nexport function useDeleteYamlWorkflow() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: (id: string) =>\n      apiFetch<{ deleted: boolean }>(`/yaml-workflows/${id}`, {\n        method: 'DELETE',\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n    },\n  });\n}\n\n// ── Cron scheduling ─────────────────────────────────────────────\n\nexport function useSetYamlCron() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: ({ id, cron_schedule, cron_envelope, execute_as }: {\n      id: string;\n      cron_schedule: string;\n      cron_envelope?: Record<string, unknown> | null;\n      execute_as?: string | null;\n    }) =>\n      apiFetch<LTYamlWorkflowRecord>(`/yaml-workflows/${id}/cron`, {\n        method: 'PUT',\n        body: JSON.stringify({ cron_schedule, cron_envelope, execute_as }),\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n    },\n  });\n}\n\nexport function useClearYamlCron() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: (id: string) =>\n      apiFetch<LTYamlWorkflowRecord>(`/yaml-workflows/${id}/cron`, {\n        method: 'DELETE',\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n    },\n  });\n}\n\n// ── Version history ─────────────────────────────────────────────\n\nexport function useYamlWorkflowVersions(id: string) {\n  return useQuery<{ versions: LTYamlWorkflowVersion[]; total: number }>({\n    queryKey: ['yamlWorkflows', id, 'versions'],\n    queryFn: () => apiFetch(`/yaml-workflows/${id}/versions`),\n    enabled: !!id,\n  });\n}\n\nexport function useYamlWorkflowVersion(id: string, version: number | null) {\n  return useQuery<LTYamlWorkflowVersion>({\n    queryKey: ['yamlWorkflows', id, 'versions', version],\n    queryFn: () => apiFetch(`/yaml-workflows/${id}/versions/${version}`),\n    enabled: !!id && version !== null,\n  });\n}\n"],"names":["useYamlWorkflows","filters","params","useQuery","apiFetch","useYamlWorkflowAppIds","useYamlWorkflow","id","useCreateYamlWorkflow","queryClient","useQueryClient","useMutation","input","useDeployYamlWorkflow","useActivateYamlWorkflow","useInvokeYamlWorkflow","data","sync","execute_as","useRegenerateYamlWorkflow","task_queue","compilation_feedback","useArchiveYamlWorkflow","useRestoreYamlWorkflow","useUpdateYamlWorkflow","updates","useDeleteYamlWorkflow","useYamlWorkflowVersions","useYamlWorkflowVersion","version"],"mappings":"qGAmBO,SAASA,EAAiBC,EAA+B,GAAI,CAClE,MAAMC,EAAS,IAAI,gBACnB,OAAID,EAAQ,QAAQC,EAAO,IAAI,SAAUD,EAAQ,MAAM,EACnDA,EAAQ,aAAaC,EAAO,IAAI,cAAeD,EAAQ,WAAW,EAClEA,EAAQ,QAAQC,EAAO,IAAI,SAAUD,EAAQ,MAAM,EACnDA,EAAQ,QAAQC,EAAO,IAAI,SAAUD,EAAQ,MAAM,EACnDA,EAAQ,QAAQC,EAAO,IAAI,SAAUD,EAAQ,MAAM,EACnDA,EAAQ,OAAOC,EAAO,IAAI,QAAS,OAAOD,EAAQ,KAAK,CAAC,EACxDA,EAAQ,SAAW,QAAWC,EAAO,IAAI,SAAU,OAAOD,EAAQ,MAAM,CAAC,EAEtEE,EAAmC,CACxC,SAAU,CAAC,gBAAiBF,CAAO,EACnC,QAAS,IAAMG,EAAS,mBAAmBF,CAAM,EAAE,CAAA,CACpD,CACH,CAEO,SAASG,GAAwB,CACtC,OAAOF,EAAgC,CACrC,SAAU,CAAC,oBAAoB,EAC/B,QAAS,IAAMC,EAAS,yBAAyB,CAAA,CAClD,CACH,CAcO,SAASE,EAAgBC,EAAY,CAC1C,OAAOJ,EAA+B,CACpC,SAAU,CAAC,gBAAiBI,CAAE,EAC9B,QAAS,IAAMH,EAAS,mBAAmBG,CAAE,EAAE,EAC/C,QAAS,CAAC,CAACA,CAAA,CACZ,CACH,CAEO,SAASC,GAAwB,CACtC,MAAMC,EAAcC,EAAA,EACpB,OAAOC,EAAY,CACjB,WAAaC,GAWXR,EAA+B,kBAAmB,CAChD,OAAQ,OACR,KAAM,KAAK,UAAUQ,CAAK,CAAA,CAC3B,EACH,UAAW,IAAM,CACfH,EAAY,kBAAkB,CAAE,SAAU,CAAC,eAAe,EAAG,YAAa,MAAO,CACnF,CAAA,CACD,CACH,CAEO,SAASI,GAAwB,CACtC,MAAMJ,EAAcC,EAAA,EACpB,OAAOC,EAAY,CACjB,WAAaJ,GACXH,EAA+B,mBAAmBG,CAAE,UAAW,CAC7D,OAAQ,MAAA,CACT,EACH,UAAW,IAAM,CACfE,EAAY,kBAAkB,CAAE,SAAU,CAAC,eAAe,EAAG,YAAa,MAAO,CACnF,CAAA,CACD,CACH,CAEO,SAASK,GAA0B,CACxC,MAAML,EAAcC,EAAA,EACpB,OAAOC,EAAY,CACjB,WAAaJ,GACXH,EAA+B,mBAAmBG,CAAE,YAAa,CAC/D,OAAQ,MAAA,CACT,EACH,UAAW,IAAM,CACfE,EAAY,kBAAkB,CAAE,SAAU,CAAC,eAAe,EAAG,YAAa,MAAO,CACnF,CAAA,CACD,CACH,CAEO,SAASM,GAAwB,CACtC,MAAMN,EAAcC,EAAA,EACpB,OAAOC,EAAY,CACjB,WAAY,CAAC,CAAE,GAAAJ,EAAI,KAAAS,EAAM,KAAAC,EAAM,WAAAC,KAC7Bd,EAAgD,mBAAmBG,CAAE,UAAW,CAC9E,OAAQ,OACR,KAAM,KAAK,UAAU,CAAE,KAAAS,EAAM,KAAAC,EAAM,GAAIC,EAAa,CAAE,WAAAA,CAAA,EAAe,GAAK,CAAA,CAC3E,EACH,UAAW,IAAM,CACfT,EAAY,kBAAkB,CAAE,SAAU,CAAC,eAAe,EAAG,YAAa,MAAO,CACnF,CAAA,CACD,CACH,CAEO,SAASU,GAA4B,CAC1C,MAAMV,EAAcC,EAAA,EACpB,OAAOC,EAAY,CACjB,WAAY,CAAC,CAAE,GAAAJ,EAAI,WAAAa,EAAY,qBAAAC,KAC7BjB,EAA+B,mBAAmBG,CAAE,cAAe,CACjE,OAAQ,OACR,KAAM,KAAK,UAAU,CAAE,WAAAa,EAAY,qBAAAC,EAAsB,CAAA,CAC1D,EACH,UAAW,IAAM,CACfZ,EAAY,kBAAkB,CAAE,SAAU,CAAC,eAAe,EAAG,YAAa,MAAO,CACnF,CAAA,CACD,CACH,CAEO,SAASa,GAAyB,CACvC,MAAMb,EAAcC,EAAA,EACpB,OAAOC,EAAY,CACjB,WAAaJ,GACXH,EAA+B,mBAAmBG,CAAE,WAAY,CAC9D,OAAQ,MAAA,CACT,EACH,UAAW,IAAM,CACfE,EAAY,kBAAkB,CAAE,SAAU,CAAC,eAAe,EAAG,YAAa,MAAO,CACnF,CAAA,CACD,CACH,CAEO,SAASc,GAAyB,CACvC,MAAMd,EAAcC,EAAA,EACpB,OAAOC,EAAY,CACjB,WAAaJ,GACXH,EAA+B,mBAAmBG,CAAE,WAAY,CAC9D,OAAQ,MAAA,CACT,EACH,UAAW,IAAM,CACfE,EAAY,kBAAkB,CAAE,SAAU,CAAC,eAAe,EAAG,YAAa,MAAO,EACjFA,EAAY,kBAAkB,CAAE,SAAU,CAAC,cAAc,EAAG,YAAa,MAAO,CAClF,CAAA,CACD,CACH,CAEO,SAASe,GAAwB,CACtC,MAAMf,EAAcC,EAAA,EACpB,OAAOC,EAAY,CACjB,WAAY,CAAC,CAAE,GAAAJ,EAAI,GAAGkB,KACpBrB,EAA+B,mBAAmBG,CAAE,GAAI,CACtD,OAAQ,MACR,KAAM,KAAK,UAAUkB,CAAO,CAAA,CAC7B,EACH,UAAW,IAAM,CACfhB,EAAY,kBAAkB,CAAE,SAAU,CAAC,eAAe,EAAG,YAAa,MAAO,CACnF,CAAA,CACD,CACH,CAEO,SAASiB,GAAwB,CACtC,MAAMjB,EAAcC,EAAA,EACpB,OAAOC,EAAY,CACjB,WAAaJ,GACXH,EAA+B,mBAAmBG,CAAE,GAAI,CACtD,OAAQ,QAAA,CACT,EACH,UAAW,IAAM,CACfE,EAAY,kBAAkB,CAAE,SAAU,CAAC,eAAe,EAAG,YAAa,MAAO,CACnF,CAAA,CACD,CACH,CAsCO,SAASkB,EAAwBpB,EAAY,CAClD,OAAOJ,EAA+D,CACpE,SAAU,CAAC,gBAAiBI,EAAI,UAAU,EAC1C,QAAS,IAAMH,EAAS,mBAAmBG,CAAE,WAAW,EACxD,QAAS,CAAC,CAACA,CAAA,CACZ,CACH,CAEO,SAASqB,EAAuBrB,EAAYsB,EAAwB,CACzE,OAAO1B,EAAgC,CACrC,SAAU,CAAC,gBAAiBI,EAAI,WAAYsB,CAAO,EACnD,QAAS,IAAMzB,EAAS,mBAAmBG,CAAE,aAAasB,CAAO,EAAE,EACnE,QAAS,CAAC,CAACtB,GAAMsB,IAAY,IAAA,CAC9B,CACH"}

package/dashboard/dist/index.html

@@ -8,11 +8,11 @@
     <link rel="preconnect" href="https://fonts.googleapis.com" />
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
     <link href="https://fonts.googleapis.com/css2?family=Plus+Jakarta+Sans:wght@300;400;500;600;700&family=JetBrains+Mono:wght@400;500&display=swap" rel="stylesheet" />
-    <script type="module" crossorigin src="./assets/index-ygxyAKcc.js"></script>
+    <script type="module" crossorigin src="./assets/index-C_dAJUzh.js"></script>
     <link rel="modulepreload" crossorigin href="./assets/vendor-query-DvWWuNIB.js">
     <link rel="modulepreload" crossorigin href="./assets/vendor-react-_9U4mKFr.js">
-    <link rel="modulepreload" crossorigin href="./assets/vendor-icons-en0_uSRD.js">
-    <link rel="stylesheet" crossorigin href="./assets/index-BmzscsXK.css">
+    <link rel="modulepreload" crossorigin href="./assets/vendor-icons-ed7mYQw4.js">
+    <link rel="stylesheet" crossorigin href="./assets/index-BUmz0NMg.css">
   </head>
   <body>
     <div id="root"></div>

package/docs/api/http/escalations.md

@@ -1168,6 +1168,21 @@ The request is a pointer. The server re-reads the action from the row's pinned f
 | 422 | `code_mismatch` | The entered code does not name the entry's code |
 | 409 | | The action or the entry is no longer offered |
 
+```
+POST /api/escalations/:id/roster-scan
+```
+
+A scan into a batch [roster](../../hitl/x-lt-scan.md#a-batch-roster-takes-scans) on this row's form. **Body:** `{ field, code }`: the roster field and the code as scanned.
+
+The field must be a batch roster that declares `x-lt-scan` accepting the code's scheme. The server re-reads the roster, fills the first open entry whose key is the code (a filled entry moves on to the next) with `{ scannedCode }` as its payload, as the person acting, under their RBAC. With `X-LT-Acting-Token`, the person acting is the badged person; one use is spent when the fill runs and returned when it does not land.
+
+| Status | `outcome` | Meaning |
+|--------|-----------|---------|
+| 409 | `not_accepted` | The field takes no scans |
+| 422 | `not_accepted` | The field does not take this code's scheme |
+| 422 | `unexpected` | No open entry is this code (the error says when every one is already checked off) |
+| 401 | `not_primed` | The badge expired or was spent |
+
 Otherwise the answer is the act's own.
 
 ## Accumulate items

package/docs/api/http/labels.md

@@ -0,0 +1,115 @@
+# Labels API
+
+Label templates, label sheets, badge reissue and the label ledger. All
+endpoints require authentication. See [label-sheets.md](../../label-sheets.md)
+for templates, sources, media and the credential rules.
+
+| Endpoint | Access |
+|---|---|
+| `GET /api/labels/templates[?scheme=]`, `GET /api/labels/templates/:name` | Any signed-in user |
+| `PUT /api/labels/templates/:name`, `DELETE /api/labels/templates/:name` | Role management |
+| `GET /api/labels/media`, `GET /api/labels/transports` | Any signed-in user |
+| `POST /api/labels/preview`, `POST /api/labels/issue`, `POST /api/labels/jobs/:id/reprint` | Item templates: admin or role management. Identity templates: `credentialIssuer`. |
+| `POST /api/labels/badges/reissue` | `credentialIssuer` |
+| `GET /api/labels/jobs`, `GET /api/labels/jobs/:id` | Any signed-in user; badge jobs only for credential issuers and their requester |
+
+## Upsert a template
+
+```
+PUT /api/labels/templates/:name
+```
+
+```json
+{
+  "scheme_version": 14,
+  "title": "Container",
+  "codes": [
+    { "category": "0", "tone": "solid" },
+    { "category": "1", "caption": "Check out", "tone": "outline" }
+  ],
+  "text": { "title": "{target}", "lines": ["{item.subtitle}"] },
+  "symbology": "code128",
+  "media": "a4-l7160",
+  "expected_revision": 3
+}
+```
+
+**Response 200:** the stored template with its new `revision`. **400** names
+the first problem (unknown token, a category with no rule, a credential token).
+**409** when `expected_revision` is stale.
+
+## Preview
+
+```
+POST /api/labels/preview
+```
+
+```json
+{
+  "template": "container",
+  "source": { "kind": "range", "prefix": "A-", "from": 1, "to": 40 },
+  "layout": { "media": "a4-l7160", "startPosition": 7 }
+}
+```
+
+**Response 200:** `{ template, sheet, warnings, labelCount }`. `sheet` holds
+pages of placed labels in millimetres. Sensitive templates come back masked.
+Nothing is recorded.
+
+## Issue
+
+```
+POST /api/labels/issue
+```
+
+```json
+{
+  "template": "associate-badge",
+  "source": { "kind": "users", "userIds": ["2f0c…"] },
+  "layout": { "media": "a4-cr80", "cutMarks": true },
+  "output": "pdf",
+  "confirm": true,
+  "idempotencyKey": "optional-key",
+  "destination": "optional, passed to a transport"
+}
+```
+
+| `output` | Response |
+|---|---|
+| `sheet` | JSON `{ job, replay, warnings, sheet }` |
+| `pdf` | `application/pdf` attachment |
+| `zpl` | `application/vnd.zebra-zpl` attachment (thermal media only) |
+| `transport:<name>` | JSON `{ job, replay, warnings, receipt }` |
+
+Every response carries `Cache-Control: no-store` and `X-LT-Label-Job: <job id>`.
+
+| Status | Meaning |
+|---|---|
+| 400 | Bad source, layout or output (ZPL on sheet stock, a pasted badge list) |
+| 403 | No print access for this template |
+| 404 | Unknown or disabled template |
+| 428 | A sensitive template without `confirm: true` |
+| 502 | The transport failed; the job is recorded |
+
+## Reissue a badge
+
+```
+POST /api/labels/badges/reissue
+```
+
+```json
+{ "userId": "2f0c…", "template": "associate-badge", "output": "sheet", "confirm": true }
+```
+
+Rotates the user's credential and prints the new badge. The response is an
+issue response with `reissueJobId`, the ledger row of the rotation.
+
+## History
+
+```
+GET /api/labels/jobs?template=&subjectUserId=&limit=&offset=
+POST /api/labels/jobs/:id/reprint   { "indices": [0, 3], "output": "sheet", "confirm": true }
+```
+
+A reprint prints the job's source again with the template as it is now, the
+whole job or the labels at `indices`, and records a new job.

package/docs/api/http/users.md

@@ -2,6 +2,8 @@
 
 Users represent the humans who claim and resolve escalations. Each user has a unique `external_id` that maps to your application's identity system. All endpoints require authentication. Creating, updating, patching, and deleting users require builder access (superadmin or the `engineer` role). Adding and removing roles require admin access and follow the assignment rules in the [Roles API](roles.md#scoped-role-assignment). Only a superadmin may grant the `superadmin` type or change a superadmin account.
 
+User records leave identity keys (the target facets of identity scan schemes, such as `badge_id`) out of `metadata` and list the ones a user carries in `identity_bound`. A wholesale `metadata` write refuses identity keys and keeps the ones it leaves out; setting or removing one through `PATCH /api/users/:id/properties` needs the `credentialIssuer` capability and is recorded in the label ledger. These protections are on by default; `labels.protectIdentityKeys: false` keeps the earlier behavior. See [label-sheets.md](../../label-sheets.md#badges-are-credentials).
+
 For service identities (CI bots, schedulers, automated agents), use the [Service Accounts API](service-accounts.md) instead. Service accounts share the same RBAC system but authenticate with API keys rather than passwords or OAuth.
 
 ## List users

package/docs/api/mcp/admin.md

@@ -1,6 +1,6 @@
 # Admin
 
-Unified system management: tasks, escalations, workflows, diagnostics, agents, bot accounts, control plane, pipelines, topics, users, roles, personas, scan codes, announcements, and settings.
+Unified system management: tasks, escalations, workflows, diagnostics, agents, bot accounts, control plane, pipelines, topics, users, roles, personas, scan codes, label sheets, announcements, and settings.
 
 | Property | Value |
 |----------|-------|
@@ -2055,6 +2055,81 @@ Delete one scan rule by scheme version and category.
 | scheme_version | integer | Yes | Scheme version |
 | category | string | Yes | Rule category |
 
+## Label Sheets
+
+Label templates say what one printed label of a scan scheme shows. See [label-sheets.md](../../label-sheets.md).
+
+### list_label_templates
+
+List label templates: the scheme each prints, its codes with captions, text, symbology and default media.
+
+| | |
+|---|---|
+| Read-safe | Yes |
+
+**Parameters:**
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| scheme | integer | No | Only templates for this scheme version |
+
+### upsert_label_template
+
+Create or replace a label template. Codes are 1 to 4 of the scheme's rules, each beside a caption in a `solid`, `outline` or `plain` band; the title and up to two lines are written in label tokens.
+
+| | |
+|---|---|
+| Read-safe | No |
+
+**Parameters:**
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| name | string | Yes | Template id: lowercase letters, digits and dashes |
+| scheme_version | integer | Yes | The scheme whose codes the label prints |
+| title | string | Yes | Display name |
+| codes | array | Yes | `{ category, caption?, tone }` |
+| text | object | No | `{ title?, lines? }` in label tokens |
+| symbology | string | No | `code128`, `qrcode` or `datamatrix` |
+| human_readable | boolean | No | Print the code as text under the symbol |
+| media | string | No | Default media preset id |
+| sensitive | boolean | No | Confirm and record subjects when printing |
+| enabled | boolean | No | |
+| expected_revision | integer | No | Write only if the stored revision matches |
+
+### delete_label_template
+
+Delete one label template by name.
+
+| | |
+|---|---|
+| Read-safe | No |
+
+**Parameters:**
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| name | string | Yes | Template name |
+
+### render_label_sheet
+
+Issue a sheet of item labels as the caller and store it as a PDF (sheet stock) or ZPL (thermal media). Returns the job id, the file ref, a link valid for ten minutes, and warnings for codes that would fail on the floor. Sensitive and identity (badge) templates are refused.
+
+| | |
+|---|---|
+| Read-safe | No |
+
+**Parameters:**
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| template | string | Yes | Template name |
+| source | object | Yes | `list`, `range`, `escalations` or `facets` source |
+| format | string | Yes | `pdf` or `zpl` |
+| media | string | No | Media preset id |
+| startPosition | integer | No | First label to print on the first sheet |
+| copies | integer | No | Copies of each label |
+
 ## Announcements
 
 ### publish_announcement

package/docs/code-owned-configuration.md

@@ -63,7 +63,7 @@ The domain dictionary's override lives beside its declaration:
 | MCP servers | `mcp.serverFactories[].config` | description, tags, category, compile hints, credential providers | tool manifest, connection status |
 | Agents | `agents[]` | description, status, goals, rules, domain, schedules | capabilities, metadata, run history |
 | Agent subscriptions | `agents[].subscriptions` | reaction fields on (agent, topic) | `enabled` — the admin kill-switch |
-| Scan schemes | `scanSchemes[]` | whole scheme + its rules (one ownership unit; `enabled` is declarative here) | — |
+| Scan schemes | `scanSchemes[]` | whole scheme + its rules + its label templates (one ownership unit; `enabled` is declarative here) | the label ledger |
 | Domain dictionary | `mcp.domainDictionary` (inline) or `mcp.domainDictionaryPath` | whole document (version bumps once per change) | — |
 | Graph workflows | `graphWorkflows[]` | always compare-and-apply: description/schema sync, redeploy on YAML version bump | run history |
 | Machine lines | `machines.lines[]` | the whole line definition (`lt_machine_lines`; version bumps once per change) | lines declared through the API, their bot accounts, their rows |

package/docs/dashboard.md

@@ -275,7 +275,7 @@ Accessible at `/admin/roles/:role`. One page per role — a quiet header carryin
 - **Escalations List Schema** — shows the list-schema version in use and links to the [Escalations List Schema](#escalations-list-schema) editor page.
 - **Metadata Schema** — JSON Schema that validates each escalation's `metadata` at creation time. Its keys appear in faceted search autocomplete.
 
-**Members** — who holds the role: admins manage it; members work its queue according to their read/write work-surface scope (read = which items appear; write = which they can claim and resolve). A `member` grant carries a scope chosen from five named profiles: full worker (`all`/`all`, default), see-all-act-own (`all`/`self`), own-items-only (`self`/`self`), read-only auditor (`all`/`none`), and read-only own (`self`/`none`). The picker enforces **write ⊆ read**. `admin` and `superadmin` grants always work the whole queue. **Badge at this station** sets how a badge behaves on this role's devices (`properties.badge_grant`): how long a badge scan lasts and how many acts it covers, e.g. ten minutes and unlimited at a high-volume placing bench, one act per scan at a workstation. Empty fields keep the badge scheme's policy. See [Scan codes — identity schemes](scan-codes.md#identity-schemes-and-acting-identity). **After a scan completes** sets where a station locked to this role returns once a scan act completes its row (`properties.scan_done`): the role's home or a route, after a pause on the done copy. See [Scan codes — the return](scan-codes.md#after-a-scan-completes-the-return).
+**Members** — who holds the role: admins manage it; members work its queue according to their read/write work-surface scope (read = which items appear; write = which they can claim and resolve). A `member` grant carries a scope chosen from five named profiles: full worker (`all`/`all`, default), see-all-act-own (`all`/`self`), own-items-only (`self`/`self`), read-only auditor (`all`/`none`), and read-only own (`self`/`none`). The picker enforces **write ⊆ read**. `admin` and `superadmin` grants always work the whole queue. **Badge at this station** sets how a badge behaves on this role's devices (`properties.badge_grant`): how long a badge scan lasts and how many acts it covers, e.g. ten minutes and unlimited at a high-volume placing bench, one act per scan at a workstation. Empty fields keep the badge scheme's policy. See [Scan codes — identity schemes](scan-codes.md#identity-schemes-and-acting-identity). **After a scan completes** sets where a station locked to this role returns once a scan act completes its row (`properties.scan_done`): the role's home or a route, after a pause on the done copy, with an optional button that returns at once. See [Scan codes — the return](scan-codes.md#after-a-scan-completes-the-return).
 
 **Pins** — two live-save groups. **Link Variables** leads: the facet names members bind per device (`properties.link_variables` — name, optional label, optional default). A pin below may reference a variable as a facet value, `facets={"facility":"{lt:facility}"}`; each member device opens it scoped to its own binding (set from the user menu → Link variables), falling back to the declared default or, unbound, applying no filter. A caption under each templated pin previews the binding on the viewing device (`facility = 'soleful'` / `facility = <empty>`). **Default Pins** follows — the pinned-view seeds this role hands its members (`default_pins`): label, dashboard-relative URL, optional badge. A badge counts the list its URL opens, with every list filter it carries (role, type, subtype, priority, search, facets, status), so two pins that differ only by subtype count differently. Members see them in their Pinned nav section from first login (marked role-provided) and may promote, hide, or reorder them via preferences; promoting a templated pin copies the template, so it keeps following the device's bindings. See [Faceted Routing — Link variables](faceted-routing.md#link-variables).
 
@@ -329,7 +329,7 @@ A code encodes **`version:category:target`** (e.g. `10:1:SN-12345`):
 
 **Admin config** lives at `/admin/scan-codes` (scheme list) and `/admin/scan-codes/:version` (a scheme with its rules) — role-manager gated (admin, engineer, superadmin). A scheme carries a name, its target facet, encoding, and — for identity schemes — a grant policy.
 
-**Station surface.** `/scan/station` is a full-screen scan surface with an idle prompt, an info/choice screen (the current reality plus labeled choices when a rule presents options), a badge prompt when identity is required, the hold card while an item is held, and a done screen once an act completes its row (a step's or a choice's `done` copy). A role's `scan_done` returns the station to its home or a route after the done screen, read from the chosen station queue or else from the completed row's role; a step's `follow` keeps the station on the item and holds its next row when it appears. In **kiosk mode** — a login holding exactly one role whose `properties.kiosk` is set, or a read-only station whose Station queue is chosen — the chrome falls away and only the role's list, escalation detail, and this scan screen are reachable. The header **scan** panel offers the same manual entry and capture settings on any page.
+**Station surface.** `/scan/station` is a full-screen scan surface with an idle prompt, an info/choice screen (the current reality plus labeled choices when a rule presents options), a badge prompt when identity is required, the hold card while an item is held, and a done screen once an act completes its row (a step's or a choice's `done` copy, counting down to the return). A step's `open` puts an Open button on the hold card, done screen or refusal, leading into the row (claimed as the person acting when the rule asks) or a faceted list. A role's `scan_done` returns the station to its home or a route after the done screen, read from the chosen station queue or else from the completed row's role; a step's `follow` keeps the station on the item and holds its next row when it appears. In **kiosk mode** — a login holding exactly one role whose `properties.kiosk` is set, or a read-only station whose Station queue is chosen — the chrome falls away and only the role's list, escalation detail, and this scan screen are reachable. The header **scan** panel offers the same manual entry and capture settings on any page.
 
 **Badge scanning grants acting identity.** A scheme of kind `identity` binds a badge value to a person (via a facet on `lt_users.metadata`). Scanning a badge primes an **ephemeral acting grant** minted through the internal keystore; it rides subsequent scans as the `X-LT-Acting-Token` header, and verbs then run **as the badged person under their own RBAC** — attribution, never privilege escalation. A badge on a work form belongs to the submission: the form names who will submit, holds if the wrong badge scans, and consumes the single-use grant on the write. A dead grant (expired, exhausted, revoked) fails loudly rather than executing silently.
 

package/docs/hitl/x-lt-roster.md

@@ -104,6 +104,8 @@ Each `x-lt-actions` entry is one act on the entry:
 
 **Roles and badges.** An action with `roles` shows to everyone. A person without one of the roles is asked for a badge, and the action runs as whoever badges in; a badge without the roles is refused with `refuse`, and the badge is not spent. On a read-only station login every action runs through a badge, as before. A role limit is an act control layered on RBAC: the person must also be allowed to write the row.
 
+**Scans.** A batch roster that declares [`x-lt-scan`](x-lt-scan.md#a-batch-roster-takes-scans) checks its entries off from scans on the open form, as a station fill would, without a button.
+
 On a wait declared with `wakeOnFlag`, a flag ends the wait: the workflow wakes with the items filled so far, `$flags`, and `$trigger: "flag"`, and can route the order (for example, to a manager). Without it, the flag is recorded and the wait continues.
 
 Moving work to another person is a resolve with an outcome. "Send to a manager" above resolves the member row with `outcome: "needs-manager"`; the member's workflow opens a row in the manager's role, where only a manager can resolve it, and the manager's confirm adds the bag to the box.

package/docs/hitl/x-lt-scan.md

@@ -45,6 +45,18 @@ An array scan field reads as a checklist: its prompt while empty, `n of N` besid
 
 The focused field, when it accepts the scan's scheme. Otherwise the first field in `x-lt-order` that accepts it and still has room. Otherwise the first field that accepts it.
 
+## A batch roster takes scans
+
+A [roster](x-lt-roster.md) whose expected set is the row's batch (`expected: { batch: true }`) may declare `x-lt-scan` with its `schemes`. On the open, claimed form, a scan of one of those schemes checks the entry off on the server, with nothing focused: the row's first open entry whose key is the scanned code is filled as the person acting, with `{ scannedCode }` as the entry's payload (`POST /api/escalations/:id/roster-scan`). An entry the list does not expect, or one already checked off, is refused under the roster and nothing is written. On a read-only station login the first scan asks for a badge, and the badge stays primed for the scans that follow, within its grant's uses and lifetime.
+
+```json
+"items": {
+  "type": "string", "readOnly": true, "x-lt-widget": "roster",
+  "x-lt-roster": { "expected": { "batch": true, "labels": "envelope.item_labels" } },
+  "x-lt-scan": { "schemes": [16] }
+}
+```
+
 ## Expected values are checked on both sides
 
 A scan outside `expect` shows as an error directly under the field that refused it, and leaves the field as it was; an accepted scan shows a confirmation in the same place. Either way the field scrolls into view. The same check runs in the shared validator at submit, so a typed value outside `expect` is a field error in the form and a 422 from the API.

package/docs/iam.md

@@ -251,6 +251,18 @@ The same keystore carries **acting-identity grants** for shared station devices.
 
 The grant rides scan requests as `actingToken` and is exchanged server-side before anything reads or writes: the verbs run **as the badged person under their own live RBAC**. The grant confers attribution, never privilege — a badged user without write scope on the queue is still denied. Mutations attribute to the person (`assigned_to`, `resolved_by`) with the device recorded beside them (`scanStation` provenance). A dead grant is a loud `not_primed` outcome, never a silent execution as the device. See [scan-codes.md](scan-codes.md#identity-schemes-and-acting-identity).
 
+### Printed credentials
+
+Badge tokens are credentials, so the platform treats printing one as issuing
+one. The `credentialIssuer` capability (superadmin, or the `credential-issuer`
+role; admin type alone does not grant it) gates printing, reissuing, and
+binding identity keys by hand. User reads leave identity keys out of
+`metadata` and name them in `identity_bound`. Every print, reissue, and binding
+writes a row to the label ledger (`lt_label_jobs`) naming the requester and the
+holders before any code is composed. The users API protections are on by
+default; `labels.protectIdentityKeys: false` (or `LT_PROTECT_IDENTITY_KEYS=false`)
+keeps the earlier behavior. See [label-sheets.md](label-sheets.md#badges-are-credentials).
+
 ## Dashboard
 
 The dashboard surfaces IAM across four pages: