@hotmeshio/long-tail 0.30.5 → 0.31.0

package/build/lib/labels/transports.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The label transport registry: named routes from issued labels to printers,
+ * registered at startup. Sending is a capability, not a side effect, so a
+ * name with no transport fails loudly instead of printing nothing.
+ */
+import type { LTLabelTransport } from '../../types/labels';
+export declare const LABEL_TRANSPORT_NOT_CONFIGURED = "No label transport is registered under that name; pass start({ labels: { transports } })";
+declare class LTLabelTransportRegistry {
+    private transports;
+    /** Register a transport by name; replaces one registered before under the same name. */
+    register(name: string, transport: LTLabelTransport): void;
+    has(name: string): boolean;
+    /** The registered transports, by name, with the formats each accepts. */
+    list(): Array<{
+        name: string;
+        formats: LTLabelTransport['formats'];
+    }>;
+    get(name: string): LTLabelTransport;
+    /** Forget every transport (tests). */
+    clear(): void;
+}
+export declare const labelTransportRegistry: LTLabelTransportRegistry;
+export {};

package/build/lib/labels/transports.js

@@ -0,0 +1,39 @@
+"use strict";
+/**
+ * The label transport registry: named routes from issued labels to printers,
+ * registered at startup. Sending is a capability, not a side effect, so a
+ * name with no transport fails loudly instead of printing nothing.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.labelTransportRegistry = exports.LABEL_TRANSPORT_NOT_CONFIGURED = void 0;
+exports.LABEL_TRANSPORT_NOT_CONFIGURED = 'No label transport is registered under that name; pass start({ labels: { transports } })';
+class LTLabelTransportRegistry {
+    constructor() {
+        this.transports = new Map();
+    }
+    /** Register a transport by name; replaces one registered before under the same name. */
+    register(name, transport) {
+        if (!/^[a-z0-9][a-z0-9-]{0,62}$/.test(name)) {
+            throw new Error(`label transport name "${name}" must be lowercase letters, digits and dashes`);
+        }
+        this.transports.set(name, transport);
+    }
+    has(name) {
+        return this.transports.has(name);
+    }
+    /** The registered transports, by name, with the formats each accepts. */
+    list() {
+        return [...this.transports].map(([name, t]) => ({ name, formats: [...t.formats] }));
+    }
+    get(name) {
+        const transport = this.transports.get(name);
+        if (!transport)
+            throw new Error(`${exports.LABEL_TRANSPORT_NOT_CONFIGURED} (asked for "${name}")`);
+        return transport;
+    }
+    /** Forget every transport (tests). */
+    clear() {
+        this.transports.clear();
+    }
+}
+exports.labelTransportRegistry = new LTLabelTransportRegistry();

package/build/modules/auth.d.ts

@@ -57,6 +57,8 @@ export declare const requireAdmin: RequestHandler<import("express-serve-static-c
 export declare const requireBuilder: RequestHandler<import("express-serve-static-core").ParamsDictionary, any, any, import("qs").ParsedQs, Record<string, any>>;
 /** Role-management access: admin access or the 'engineer' role. Backend twin of `isBuilder || isOps`. */
 export declare const requireRoleManager: RequestHandler<import("express-serve-static-core").ParamsDictionary, any, any, import("qs").ParsedQs, Record<string, any>>;
+/** Credential access: superadmin or the 'credential-issuer' role. Gates badge printing and reissue. */
+export declare const requireCredentialIssuer: RequestHandler<import("express-serve-static-core").ParamsDictionary, any, any, import("qs").ParsedQs, Record<string, any>>;
 /** Reads of one workflow run (`:workflowId`): builder access, or the person who started it or it runs as. */
 export declare const requireWorkflowReader: RequestHandler;
 /**

package/build/modules/auth.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.requireWorkflowReader = exports.requireRoleManager = exports.requireBuilder = exports.requireAdmin = exports.requireCredentialAuth = exports.requireAuth = exports.JwtAuthAdapter = void 0;
+exports.requireWorkflowReader = exports.requireCredentialIssuer = exports.requireRoleManager = exports.requireBuilder = exports.requireAdmin = exports.requireCredentialAuth = exports.requireAuth = exports.JwtAuthAdapter = void 0;
 exports.createAuthMiddleware = createAuthMiddleware;
 exports.setAuthAdapter = setAuthAdapter;
 exports.signToken = signToken;
@@ -201,6 +201,8 @@ exports.requireAdmin = requireCapability(capabilities_1.mayAdminister, 'Forbidde
 exports.requireBuilder = requireCapability(capabilities_1.mayBuild, 'Forbidden: builder access required');
 /** Role-management access: admin access or the 'engineer' role. Backend twin of `isBuilder || isOps`. */
 exports.requireRoleManager = requireCapability(capabilities_1.mayManageRoles, 'Forbidden: role-management access required');
+/** Credential access: superadmin or the 'credential-issuer' role. Gates badge printing and reissue. */
+exports.requireCredentialIssuer = requireCapability(capabilities_1.mayIssueCredentials, 'Forbidden: credential-issuer access required');
 /** Reads of one workflow run (`:workflowId`): builder access, or the person who started it or it runs as. */
 const requireWorkflowReader = async (req, res, next) => {
     try {

package/build/modules/capabilities.d.ts

@@ -19,10 +19,14 @@ export type GrantDecision = {
     allowed: false;
     error: string;
 };
+/** Holders of this role may print and reissue identity credentials (badges). */
+export declare const CREDENTIAL_ISSUER_ROLE = "credential-issuer";
 /** Admin or superadmin claim, or a superadmin in the database. */
 export declare function mayAdminister(principal: CapabilityPrincipal | undefined): Promise<boolean>;
 /** Superadmin (claim or database), or holder of the engineer role. */
 export declare function mayBuild(principal: CapabilityPrincipal | undefined): Promise<boolean>;
+/** Superadmin (claim or database), or holder of the credential-issuer role. Admin type alone never grants it. */
+export declare function mayIssueCredentials(principal: CapabilityPrincipal | undefined): Promise<boolean>;
 /**
  * Builder access, or the person a workflow run was started by or runs as,
  * read from the run's own start envelope.
@@ -51,7 +55,7 @@ export declare function mayRevokeRole(callerId: string, targetId: string, role:
 /**
  * Every capability the principal holds, with the same outcomes as the
  * predicates above. A superadmin claim costs no lookup; anyone else costs
- * at most one superadmin lookup and one engineer-role lookup.
+ * at most one superadmin lookup and two role lookups.
  */
 export declare function resolveCapabilities(principal: CapabilityPrincipal | undefined): Promise<CapabilitySet>;
 /**

package/build/modules/capabilities.js

@@ -33,8 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.CREDENTIAL_ISSUER_ROLE = void 0;
 exports.mayAdminister = mayAdminister;
 exports.mayBuild = mayBuild;
+exports.mayIssueCredentials = mayIssueCredentials;
 exports.mayReadWorkflowRun = mayReadWorkflowRun;
 exports.mayManageRoles = mayManageRoles;
 exports.mayGrantRole = mayGrantRole;
@@ -47,9 +49,14 @@ const user_1 = require("../services/user");
 const export_1 = require("../services/export");
 const uuid_1 = require("../lib/uuid");
 const BUILDER_ROLE = 'engineer';
-async function hasBuilderRole(userId) {
+/** Holders of this role may print and reissue identity credentials (badges). */
+exports.CREDENTIAL_ISSUER_ROLE = 'credential-issuer';
+async function holdsRole(userId, role) {
     const { hasRole } = await Promise.resolve().then(() => __importStar(require('../services/user/roles')));
-    return hasRole(userId, BUILDER_ROLE);
+    return hasRole(userId, role);
+}
+async function hasBuilderRole(userId) {
+    return holdsRole(userId, BUILDER_ROLE);
 }
 /** Admin or superadmin claim, or a superadmin in the database. */
 async function mayAdminister(principal) {
@@ -69,6 +76,18 @@ async function mayBuild(principal) {
         return true;
     return hasBuilderRole(principal.userId);
 }
+/** Superadmin (claim or database), or holder of the credential-issuer role. Admin type alone never grants it. */
+async function mayIssueCredentials(principal) {
+    if (!principal?.userId)
+        return false;
+    if (principal.grantRoles)
+        return capabilitiesFromRoles(principal.grantRoles).credentialIssuer;
+    if (principal.role === 'superadmin')
+        return true;
+    if (await (0, user_1.isSuperAdmin)(principal.userId))
+        return true;
+    return holdsRole(principal.userId, exports.CREDENTIAL_ISSUER_ROLE);
+}
 /**
  * Builder access, or the person a workflow run was started by or runs as,
  * read from the run's own start envelope.
@@ -148,15 +167,19 @@ function capabilitiesFromRoles(roles) {
     const superadmin = roles.some((r) => r.type === 'superadmin');
     const admin = superadmin || roles.some((r) => r.type === 'admin');
     const engineer = roles.some((r) => r.role === BUILDER_ROLE);
-    return { caller: true, admin, builder: superadmin || engineer, roleManager: admin || engineer, superadmin };
+    const issuer = roles.some((r) => r.role === exports.CREDENTIAL_ISSUER_ROLE);
+    return {
+        caller: true, admin, builder: superadmin || engineer, roleManager: admin || engineer, superadmin,
+        credentialIssuer: superadmin || issuer,
+    };
 }
 const NO_CAPABILITIES = {
-    caller: false, admin: false, builder: false, roleManager: false, superadmin: false,
+    caller: false, admin: false, builder: false, roleManager: false, superadmin: false, credentialIssuer: false,
 };
 /**
  * Every capability the principal holds, with the same outcomes as the
  * predicates above. A superadmin claim costs no lookup; anyone else costs
- * at most one superadmin lookup and one engineer-role lookup.
+ * at most one superadmin lookup and two role lookups.
  */
 async function resolveCapabilities(principal) {
     if (!principal?.userId)
@@ -164,11 +187,18 @@ async function resolveCapabilities(principal) {
     if (principal.grantRoles)
         return capabilitiesFromRoles(principal.grantRoles);
     if (principal.role === 'superadmin' || (await (0, user_1.isSuperAdmin)(principal.userId))) {
-        return { caller: true, admin: true, builder: true, roleManager: true, superadmin: true };
+        return { caller: true, admin: true, builder: true, roleManager: true, superadmin: true, credentialIssuer: true };
     }
     const admin = principal.role === 'admin';
-    const engineer = await hasBuilderRole(principal.userId);
-    return { caller: true, admin, builder: engineer, roleManager: admin || engineer, superadmin: false };
+    const { hasRole } = await Promise.resolve().then(() => __importStar(require('../services/user/roles')));
+    const [engineer, issuer] = await Promise.all([
+        hasRole(principal.userId, BUILDER_ROLE),
+        hasRole(principal.userId, exports.CREDENTIAL_ISSUER_ROLE),
+    ]);
+    return {
+        caller: true, admin, builder: engineer, roleManager: admin || engineer, superadmin: false,
+        credentialIssuer: issuer,
+    };
 }
 /**
  * Capability checks for one request. `caller` needs only an authenticated

package/build/modules/config.d.ts

@@ -41,5 +41,15 @@ export declare const config: {
     LT_ANALYTICS_CACHE_TTL_MS: number;
     LT_ANALYTICS_PAST_CACHE_TTL_MS: number;
     LT_ANALYTICS_CACHE_MAX_ENTRIES: number;
+    /** Identity keys (badge tokens) leave user reads and need credentialIssuer to write. `false` keeps the earlier behavior. */
+    LT_PROTECT_IDENTITY_KEYS: boolean;
+    /** Label sheets: the media a job prints on when neither the job nor the template names one. */
+    LT_LABELS_DEFAULT_MEDIA: string;
+    /** Most labels one print job may hold. */
+    LT_LABELS_MAX_PER_JOB: number;
+    /** Most identity credentials (badges) one print job may hold. */
+    LT_LABELS_MAX_CREDENTIALS_PER_JOB: number;
+    /** How long one process holds a print job's delivery before a retry may send it. */
+    LT_LABELS_DELIVERY_LEASE_SECONDS: number;
 };
 export declare const postgres_options: Record<string, unknown>;

package/build/modules/config.js

@@ -67,6 +67,16 @@ exports.config = {
     LT_ANALYTICS_CACHE_TTL_MS: parseInt(process.env.LT_ANALYTICS_CACHE_TTL_MS || '30000', 10),
     LT_ANALYTICS_PAST_CACHE_TTL_MS: parseInt(process.env.LT_ANALYTICS_PAST_CACHE_TTL_MS || '600000', 10),
     LT_ANALYTICS_CACHE_MAX_ENTRIES: parseInt(process.env.LT_ANALYTICS_CACHE_MAX_ENTRIES || '512', 10),
+    /** Identity keys (badge tokens) leave user reads and need credentialIssuer to write. `false` keeps the earlier behavior. */
+    LT_PROTECT_IDENTITY_KEYS: process.env.LT_PROTECT_IDENTITY_KEYS !== 'false',
+    /** Label sheets: the media a job prints on when neither the job nor the template names one. */
+    LT_LABELS_DEFAULT_MEDIA: process.env.LT_LABELS_DEFAULT_MEDIA || 'a4-l7160',
+    /** Most labels one print job may hold. */
+    LT_LABELS_MAX_PER_JOB: positiveInt('LT_LABELS_MAX_PER_JOB', 1000),
+    /** Most identity credentials (badges) one print job may hold. */
+    LT_LABELS_MAX_CREDENTIALS_PER_JOB: positiveInt('LT_LABELS_MAX_CREDENTIALS_PER_JOB', 200),
+    /** How long one process holds a print job's delivery before a retry may send it. */
+    LT_LABELS_DELIVERY_LEASE_SECONDS: positiveInt('LT_LABELS_DELIVERY_LEASE_SECONDS', 120),
 };
 exports.postgres_options = {
     host: exports.config.POSTGRES_HOST,

package/build/routes/index.js

@@ -38,6 +38,7 @@ const capabilities_1 = __importDefault(require("./capabilities"));
 const topics_1 = __importDefault(require("./topics"));
 const nats_credentials_1 = __importDefault(require("./nats-credentials"));
 const scan_codes_1 = __importDefault(require("./scan-codes"));
+const labels_1 = __importDefault(require("./labels"));
 const domain_1 = __importDefault(require("./domain"));
 const announcements_1 = __importDefault(require("./announcements"));
 const machines_1 = __importDefault(require("./machines"));
@@ -79,6 +80,7 @@ router.use('/agents', agents_1.default);
 router.use('/capabilities', capabilities_1.default);
 router.use('/topics', topics_1.default);
 router.use('/scan-codes', scan_codes_1.default);
+router.use('/labels', labels_1.default);
 router.use('/domain', domain_1.default);
 router.use('/announcements', announcements_1.default);
 router.use('/machines', machines_1.default);

package/build/routes/labels.d.ts

@@ -0,0 +1,2 @@
+declare const router: import("express-serve-static-core").Router;
+export default router;

package/build/routes/labels.js

@@ -0,0 +1,135 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const http_1 = require("../lib/http");
+const api = __importStar(require("../api/labels"));
+const auth_1 = require("../modules/auth");
+const router = (0, http_1.Router)();
+/** An issue result: PDF and ZPL as files, a sheet as JSON. Codes are never cached. */
+function sendIssued(res, result) {
+    res.set('Cache-Control', 'no-store');
+    if (result.status !== 200) {
+        res.status(result.status).json({ error: result.error });
+        return;
+    }
+    const { pdf, zpl, ...rest } = result.data;
+    res.set('X-LT-Label-Job', rest.job.id);
+    if (rest.warnings?.length)
+        res.set('X-LT-Label-Warnings', String(rest.warnings.length));
+    if (pdf) {
+        res.type('application/pdf').set('Content-Disposition', `attachment; filename="labels-${rest.job.id}.pdf"`).send(Buffer.from(pdf));
+        return;
+    }
+    if (zpl) {
+        res.type('application/vnd.zebra-zpl').set('Content-Disposition', `attachment; filename="labels-${rest.job.id}.zpl"`).send(zpl);
+        return;
+    }
+    res.json(rest);
+}
+// ── Templates ─────────────────────────────────────────────────────────────
+/** GET /api/labels/templates?scheme=14 */
+router.get('/templates', async (req, res) => {
+    const scheme = req.query.scheme ? Number(req.query.scheme) : undefined;
+    const result = await api.listLabelTemplates({ scheme });
+    res.status(result.status).json(result.data ?? { error: result.error });
+});
+/** GET /api/labels/templates/:name */
+router.get('/templates/:name', async (req, res) => {
+    const result = await api.getLabelTemplate({ name: String(req.params.name) });
+    res.status(result.status).json(result.data ?? { error: result.error });
+});
+/** PUT /api/labels/templates/:name — body is the template; `expected_revision` guards a concurrent edit. */
+router.put('/templates/:name', auth_1.requireRoleManager, async (req, res) => {
+    const result = await api.upsertLabelTemplate({ ...(req.body || {}), name: String(req.params.name) });
+    res.status(result.status).json(result.data ?? { error: result.error });
+});
+/** DELETE /api/labels/templates/:name */
+router.delete('/templates/:name', auth_1.requireRoleManager, async (req, res) => {
+    const result = await api.deleteLabelTemplate({ name: String(req.params.name) });
+    res.status(result.status).json(result.data ?? { error: result.error });
+});
+/** GET /api/labels/media — presets and the default media. */
+router.get('/media', async (_req, res) => {
+    const result = await api.listLabelMedia();
+    res.status(result.status).json(result.data);
+});
+/** GET /api/labels/transports — registered printer transports. */
+router.get('/transports', async (_req, res) => {
+    const result = await api.listLabelTransports();
+    res.status(result.status).json(result.data);
+});
+// ── Print ─────────────────────────────────────────────────────────────────
+/** POST /api/labels/preview — { template, source, layout? }. Sensitive templates come back masked. */
+router.post('/preview', async (req, res) => {
+    const { template, source, layout } = req.body || {};
+    const result = await api.previewLabels({ template, source, layout }, req.auth);
+    res.set('Cache-Control', 'no-store');
+    res.status(result.status).json(result.data ?? { error: result.error });
+});
+/**
+ * POST /api/labels/issue — { template, source, layout?, output, confirm?, idempotencyKey?, destination? }.
+ * output: sheet (JSON), pdf, zpl, or transport:<name>.
+ */
+router.post('/issue', async (req, res) => {
+    const { template, source, layout, output, confirm, idempotencyKey, destination, only } = req.body || {};
+    sendIssued(res, await api.issueLabels({ template, source, layout, output, confirm, idempotencyKey, destination, only }, req.auth));
+});
+/** POST /api/labels/badges/reissue — { userId, template, layout?, output, confirm }. */
+router.post('/badges/reissue', async (req, res) => {
+    const { userId, template, layout, output, confirm } = req.body || {};
+    sendIssued(res, await api.reissueBadge({ userId, template, layout, output, confirm }, req.auth));
+});
+// ── History ───────────────────────────────────────────────────────────────
+/** GET /api/labels/jobs?template=&subjectUserId=&limit=&offset= */
+router.get('/jobs', async (req, res) => {
+    const result = await api.listLabelJobs({
+        template: req.query.template,
+        subjectUserId: req.query.subjectUserId,
+        limit: req.query.limit ? Number(req.query.limit) : undefined,
+        offset: req.query.offset ? Number(req.query.offset) : undefined,
+    }, req.auth);
+    res.status(result.status).json(result.data ?? { error: result.error });
+});
+/** GET /api/labels/jobs/:id */
+router.get('/jobs/:id', async (req, res) => {
+    const result = await api.getLabelJob({ id: String(req.params.id) }, req.auth);
+    res.status(result.status).json(result.data ?? { error: result.error });
+});
+/** POST /api/labels/jobs/:id/reprint — { indices?, output, layout?, confirm? } */
+router.post('/jobs/:id/reprint', async (req, res) => {
+    const { indices, output, layout, confirm } = req.body || {};
+    sendIssued(res, await api.reprintLabelJob({ id: String(req.params.id), indices, output, layout, confirm }, req.auth));
+});
+exports.default = router;

package/build/routes/users.js

@@ -127,7 +127,7 @@ router.patch('/:id/properties', auth_1.requireBuilder, async (req, res) => {
         set,
         remove,
         rename,
-    });
+    }, req.auth);
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**

package/build/services/labels/content.d.ts

@@ -0,0 +1,13 @@
+import { type ScanRule, type ScanScheme } from '../../types';
+import type { LabelContent, LabelWarning } from '../../shared/labels/types';
+import type { LabelTarget, LabelTemplate } from '../../types/labels';
+export interface BuiltContents {
+    contents: LabelContent[];
+    warnings: LabelWarning[];
+}
+/**
+ * Compose every label. A target the scheme cannot carry (a fixed scheme's
+ * target with letters) prints its text without codes and is reported;
+ * identity warnings never repeat the target, which is the credential.
+ */
+export declare function buildLabelContents(template: LabelTemplate, scheme: ScanScheme, rules: ScanRule[], targets: LabelTarget[], masked: boolean): BuiltContents;

package/build/services/labels/content.js

@@ -0,0 +1,81 @@
+"use strict";
+// One LabelContent per target: the template's codes composed under its scheme
+// and its text rendered with the target's facts.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildLabelContents = buildLabelContents;
+const compose_1 = require("../../shared/labels/compose");
+const tokens_1 = require("../../shared/labels/tokens");
+const types_1 = require("../../types");
+const KEYS_NAMED = 6;
+function present(value) {
+    return value !== undefined && value !== null && value !== '' && !(Array.isArray(value) && value.length === 0);
+}
+/**
+ * Tokens a label's text reads that its own facts lack: `line 1 reads
+ * {item.region}, which this label's data doesn't have`. Names the facts it
+ * does have, never their values.
+ */
+function missingTokens(texts, ctx, index) {
+    const warnings = [];
+    const seen = new Set();
+    for (const [where, text] of texts) {
+        for (const token of (0, tokens_1.listLabelTokens)(text)) {
+            const [bag, key] = token.split('.', 2);
+            if ((bag !== 'item' && bag !== 'user') || !key || seen.has(token))
+                continue;
+            const facts = (bag === 'item' ? ctx.item : ctx.user) ?? {};
+            if (present(facts[key]))
+                continue;
+            seen.add(token);
+            const has = Object.keys(facts).filter((k) => present(facts[k]));
+            warnings.push({
+                index,
+                kind: 'missing_token',
+                detail: `${where} reads {${token}}, which this label's data doesn't have` +
+                    (has.length ? ` (it has: ${has.slice(0, KEYS_NAMED).join(', ')}${has.length > KEYS_NAMED ? ', …' : ''})` : ''),
+            });
+        }
+    }
+    return warnings;
+}
+/**
+ * Compose every label. A target the scheme cannot carry (a fixed scheme's
+ * target with letters) prints its text without codes and is reported;
+ * identity warnings never repeat the target, which is the credential.
+ */
+function buildLabelContents(template, scheme, rules, targets, masked) {
+    const identity = scheme.kind === types_1.SCAN_SCHEME_KINDS.IDENTITY;
+    const warnings = [];
+    const contents = targets.map((t, index) => {
+        const ctx = { target: t.target, item: t.item, user: t.user, scheme: { name: scheme.name } };
+        let codes = [];
+        try {
+            codes = template.codes.map((c) => ({
+                code: (0, compose_1.composeScanCode)(scheme, c.category, t.target),
+                // Only template captions carry tokens; a rule's name prints as written.
+                caption: c.caption != null
+                    ? (0, tokens_1.renderLabelText)(c.caption, ctx)
+                    : rules.find((r) => r.category === c.category)?.name ?? '',
+                tone: c.tone,
+            }));
+        }
+        catch (err) {
+            if (!(err instanceof compose_1.ScanComposeError))
+                throw err;
+            warnings.push({ index, kind: 'unparseable', detail: identity ? 'the bound credential does not fit the scheme' : err.message });
+        }
+        const lines = template.text.lines ?? [];
+        warnings.push(...missingTokens([
+            ['the heading', template.text.title ?? ''],
+            ...lines.map((line, i) => [`line ${i + 1}`, line]),
+            ...template.codes.map((c, i) => [`caption ${i + 1}`, c.caption ?? '']),
+        ], ctx, index));
+        return {
+            title: template.text.title ? (0, tokens_1.renderLabelText)(template.text.title, ctx) : undefined,
+            lines: lines.map((line) => (0, tokens_1.renderLabelText)(line, ctx)),
+            codes,
+            masked,
+        };
+    });
+    return { contents, warnings };
+}

package/build/services/labels/errors.d.ts

@@ -0,0 +1,5 @@
+/** A label request refused before anything printed: bad input, access, or a missing confirmation. */
+export declare class LabelRequestError extends Error {
+    status: 400 | 403 | 404 | 409 | 428 | 502;
+    constructor(status: 400 | 403 | 404 | 409 | 428 | 502, message: string);
+}

package/build/services/labels/errors.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LabelRequestError = void 0;
+/** A label request refused before anything printed: bad input, access, or a missing confirmation. */
+class LabelRequestError extends Error {
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+        this.name = 'LabelRequestError';
+    }
+}
+exports.LabelRequestError = LabelRequestError;

package/build/services/labels/index.d.ts

@@ -0,0 +1,11 @@
+export * from './templates';
+export { previewLabels, issueLabels, assertMayPrint, type LabelPreview, type LabelIssueResult } from './issue';
+export { reissueBadge, type ReissueRequest } from './reissue';
+export { getLabelJob, listLabelJobs, recordLabelJob } from './jobs';
+export { resolveLabelTargets, parseListSource, expandRangeSource, markResolvedTargets } from './targets';
+export { buildLabelContents } from './content';
+export { verifyLabels } from './verify';
+export { mintIdentityToken } from './token';
+export { renderSheetPdf, registerLabelFonts, scalePath, type LabelFonts } from './render-pdf';
+export { labelMediaPresets, defaultLabelMediaId, mediaForJob, registerLabelMedia, setDefaultLabelMedia, resetLabelMedia, } from './media';
+export { LabelRequestError } from './errors';

package/build/services/labels/index.js

@@ -0,0 +1,52 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LabelRequestError = exports.resetLabelMedia = exports.setDefaultLabelMedia = exports.registerLabelMedia = exports.mediaForJob = exports.defaultLabelMediaId = exports.labelMediaPresets = exports.scalePath = exports.registerLabelFonts = exports.renderSheetPdf = exports.mintIdentityToken = exports.verifyLabels = exports.buildLabelContents = exports.markResolvedTargets = exports.expandRangeSource = exports.parseListSource = exports.resolveLabelTargets = exports.recordLabelJob = exports.listLabelJobs = exports.getLabelJob = exports.reissueBadge = exports.assertMayPrint = exports.issueLabels = exports.previewLabels = void 0;
+__exportStar(require("./templates"), exports);
+var issue_1 = require("./issue");
+Object.defineProperty(exports, "previewLabels", { enumerable: true, get: function () { return issue_1.previewLabels; } });
+Object.defineProperty(exports, "issueLabels", { enumerable: true, get: function () { return issue_1.issueLabels; } });
+Object.defineProperty(exports, "assertMayPrint", { enumerable: true, get: function () { return issue_1.assertMayPrint; } });
+var reissue_1 = require("./reissue");
+Object.defineProperty(exports, "reissueBadge", { enumerable: true, get: function () { return reissue_1.reissueBadge; } });
+var jobs_1 = require("./jobs");
+Object.defineProperty(exports, "getLabelJob", { enumerable: true, get: function () { return jobs_1.getLabelJob; } });
+Object.defineProperty(exports, "listLabelJobs", { enumerable: true, get: function () { return jobs_1.listLabelJobs; } });
+Object.defineProperty(exports, "recordLabelJob", { enumerable: true, get: function () { return jobs_1.recordLabelJob; } });
+var targets_1 = require("./targets");
+Object.defineProperty(exports, "resolveLabelTargets", { enumerable: true, get: function () { return targets_1.resolveLabelTargets; } });
+Object.defineProperty(exports, "parseListSource", { enumerable: true, get: function () { return targets_1.parseListSource; } });
+Object.defineProperty(exports, "expandRangeSource", { enumerable: true, get: function () { return targets_1.expandRangeSource; } });
+Object.defineProperty(exports, "markResolvedTargets", { enumerable: true, get: function () { return targets_1.markResolvedTargets; } });
+var content_1 = require("./content");
+Object.defineProperty(exports, "buildLabelContents", { enumerable: true, get: function () { return content_1.buildLabelContents; } });
+var verify_1 = require("./verify");
+Object.defineProperty(exports, "verifyLabels", { enumerable: true, get: function () { return verify_1.verifyLabels; } });
+var token_1 = require("./token");
+Object.defineProperty(exports, "mintIdentityToken", { enumerable: true, get: function () { return token_1.mintIdentityToken; } });
+var render_pdf_1 = require("./render-pdf");
+Object.defineProperty(exports, "renderSheetPdf", { enumerable: true, get: function () { return render_pdf_1.renderSheetPdf; } });
+Object.defineProperty(exports, "registerLabelFonts", { enumerable: true, get: function () { return render_pdf_1.registerLabelFonts; } });
+Object.defineProperty(exports, "scalePath", { enumerable: true, get: function () { return render_pdf_1.scalePath; } });
+var media_1 = require("./media");
+Object.defineProperty(exports, "labelMediaPresets", { enumerable: true, get: function () { return media_1.labelMediaPresets; } });
+Object.defineProperty(exports, "defaultLabelMediaId", { enumerable: true, get: function () { return media_1.defaultLabelMediaId; } });
+Object.defineProperty(exports, "mediaForJob", { enumerable: true, get: function () { return media_1.mediaForJob; } });
+Object.defineProperty(exports, "registerLabelMedia", { enumerable: true, get: function () { return media_1.registerLabelMedia; } });
+Object.defineProperty(exports, "setDefaultLabelMedia", { enumerable: true, get: function () { return media_1.setDefaultLabelMedia; } });
+Object.defineProperty(exports, "resetLabelMedia", { enumerable: true, get: function () { return media_1.resetLabelMedia; } });
+var errors_1 = require("./errors");
+Object.defineProperty(exports, "LabelRequestError", { enumerable: true, get: function () { return errors_1.LabelRequestError; } });

package/build/services/labels/issue.d.ts

@@ -0,0 +1,38 @@
+import type { LabelSheet, LabelWarning } from '../../shared/labels/types';
+import type { LTApiAuth } from '../../types/sdk';
+import type { LabelIssueRequest, LabelJob, LabelLayoutRequest, LabelSource, LabelTemplate } from '../../types/labels';
+import type { LabelTransportReceipt } from '../../types/labels';
+export interface LabelPreview {
+    template: LabelTemplate;
+    sheet: LabelSheet;
+    warnings: LabelWarning[];
+    labelCount: number;
+}
+export interface LabelIssueResult {
+    job: LabelJob;
+    /** True when the idempotency key was used before: nothing printed again. */
+    replay: boolean;
+    warnings: LabelWarning[];
+    sheet?: LabelSheet;
+    pdf?: Uint8Array;
+    zpl?: string;
+    receipt?: LabelTransportReceipt;
+    /** Transport outputs: true once delivered; false when another request holds the delivery. */
+    delivered?: boolean;
+}
+/** Identity labels need credentialIssuer; item labels need admin or role management. */
+export declare function assertMayPrint(identity: boolean, auth: LTApiAuth): Promise<void>;
+/**
+ * Lay out a job without printing it. Sensitive templates are masked: the
+ * preview shows where each code goes, never the code. Nothing is recorded.
+ */
+export declare function previewLabels(req: {
+    template: string;
+    source: LabelSource;
+    layout?: LabelLayoutRequest;
+}, auth: LTApiAuth): Promise<LabelPreview>;
+/**
+ * Issue a job: check access and confirmation, record it, then compose and
+ * deliver the codes as a sheet, a PDF, ZPL, or through a transport.
+ */
+export declare function issueLabels(req: LabelIssueRequest, auth: LTApiAuth): Promise<LabelIssueResult>;