@hotmeshio/long-tail 0.30.5 → 0.31.0

package/dashboard/dist/assets/{yaml-workflows-D97Bz6li.js → yaml-workflows-C20qHo3L.js}

@@ -1,2 +1,2 @@
-import{u as l,b as a,c as s}from"./vendor-query-DvWWuNIB.js";import{m as r}from"./index-CU2UW2y6.js";function f(e={}){const o=new URLSearchParams;return e.status&&o.set("status",e.status),e.graph_topic&&o.set("graph_topic",e.graph_topic),e.app_id&&o.set("app_id",e.app_id),e.search&&o.set("search",e.search),e.set_id&&o.set("set_id",e.set_id),e.limit&&o.set("limit",String(e.limit)),e.offset!==void 0&&o.set("offset",String(e.offset)),l({queryKey:["yamlWorkflows",e],queryFn:()=>r(`/yaml-workflows?${o}`)})}function m(){return l({queryKey:["yamlWorkflowAppIds"],queryFn:()=>r("/yaml-workflows/app-ids")})}function c(e){return l({queryKey:["yamlWorkflows",e],queryFn:()=>r(`/yaml-workflows/${e}`),enabled:!!e})}function w(){const e=a();return s({mutationFn:o=>r("/yaml-workflows",{method:"POST",body:JSON.stringify(o)}),onSuccess:()=>{e.invalidateQueries({queryKey:["yamlWorkflows"],refetchType:"all"})}})}function k(){const e=a();return s({mutationFn:o=>r(`/yaml-workflows/${o}/deploy`,{method:"POST"}),onSuccess:()=>{e.invalidateQueries({queryKey:["yamlWorkflows"],refetchType:"all"})}})}function p(){const e=a();return s({mutationFn:o=>r(`/yaml-workflows/${o}/activate`,{method:"POST"}),onSuccess:()=>{e.invalidateQueries({queryKey:["yamlWorkflows"],refetchType:"all"})}})}function d(){const e=a();return s({mutationFn:({id:o,data:t,sync:n,execute_as:u})=>r(`/yaml-workflows/${o}/invoke`,{method:"POST",body:JSON.stringify({data:t,sync:n,...u?{execute_as:u}:{}})}),onSuccess:()=>{e.invalidateQueries({queryKey:["yamlWorkflows"],refetchType:"all"})}})}function h(){const e=a();return s({mutationFn:({id:o,task_queue:t,compilation_feedback:n})=>r(`/yaml-workflows/${o}/regenerate`,{method:"POST",body:JSON.stringify({task_queue:t,compilation_feedback:n})}),onSuccess:()=>{e.invalidateQueries({queryKey:["yamlWorkflows"],refetchType:"all"})}})}function q(){const e=a();return s({mutationFn:o=>r(`/yaml-workflows/${o}/archive`,{method:"POST"}),onSuccess:()=>{e.invalidateQueries({queryKey:["yamlWorkflows"],refetchType:"all"})}})}function W(){const e=a();return s({mutationFn:o=>r(`/yaml-workflows/${o}/restore`,{method:"POST"}),onSuccess:()=>{e.invalidateQueries({queryKey:["yamlWorkflows"],refetchType:"all"}),e.invalidateQueries({queryKey:["yamlWorkflow"],refetchType:"all"})}})}function S(){const e=a();return s({mutationFn:({id:o,...t})=>r(`/yaml-workflows/${o}`,{method:"PUT",body:JSON.stringify(t)}),onSuccess:()=>{e.invalidateQueries({queryKey:["yamlWorkflows"],refetchType:"all"})}})}function v(){const e=a();return s({mutationFn:o=>r(`/yaml-workflows/${o}`,{method:"DELETE"}),onSuccess:()=>{e.invalidateQueries({queryKey:["yamlWorkflows"],refetchType:"all"})}})}function T(e){return l({queryKey:["yamlWorkflows",e,"versions"],queryFn:()=>r(`/yaml-workflows/${e}/versions`),enabled:!!e})}function F(e,o){return l({queryKey:["yamlWorkflows",e,"versions",o],queryFn:()=>r(`/yaml-workflows/${e}/versions/${o}`),enabled:!!e&&o!==null})}export{m as a,S as b,c,T as d,k as e,p as f,q as g,W as h,v as i,h as j,F as k,d as l,w as m,f as u};
-//# sourceMappingURL=yaml-workflows-D97Bz6li.js.map
+import{u as l,b as a,c as s}from"./vendor-query-DvWWuNIB.js";import{m as r}from"./index-C_dAJUzh.js";function f(e={}){const o=new URLSearchParams;return e.status&&o.set("status",e.status),e.graph_topic&&o.set("graph_topic",e.graph_topic),e.app_id&&o.set("app_id",e.app_id),e.search&&o.set("search",e.search),e.set_id&&o.set("set_id",e.set_id),e.limit&&o.set("limit",String(e.limit)),e.offset!==void 0&&o.set("offset",String(e.offset)),l({queryKey:["yamlWorkflows",e],queryFn:()=>r(`/yaml-workflows?${o}`)})}function m(){return l({queryKey:["yamlWorkflowAppIds"],queryFn:()=>r("/yaml-workflows/app-ids")})}function c(e){return l({queryKey:["yamlWorkflows",e],queryFn:()=>r(`/yaml-workflows/${e}`),enabled:!!e})}function w(){const e=a();return s({mutationFn:o=>r("/yaml-workflows",{method:"POST",body:JSON.stringify(o)}),onSuccess:()=>{e.invalidateQueries({queryKey:["yamlWorkflows"],refetchType:"all"})}})}function k(){const e=a();return s({mutationFn:o=>r(`/yaml-workflows/${o}/deploy`,{method:"POST"}),onSuccess:()=>{e.invalidateQueries({queryKey:["yamlWorkflows"],refetchType:"all"})}})}function p(){const e=a();return s({mutationFn:o=>r(`/yaml-workflows/${o}/activate`,{method:"POST"}),onSuccess:()=>{e.invalidateQueries({queryKey:["yamlWorkflows"],refetchType:"all"})}})}function d(){const e=a();return s({mutationFn:({id:o,data:t,sync:n,execute_as:u})=>r(`/yaml-workflows/${o}/invoke`,{method:"POST",body:JSON.stringify({data:t,sync:n,...u?{execute_as:u}:{}})}),onSuccess:()=>{e.invalidateQueries({queryKey:["yamlWorkflows"],refetchType:"all"})}})}function h(){const e=a();return s({mutationFn:({id:o,task_queue:t,compilation_feedback:n})=>r(`/yaml-workflows/${o}/regenerate`,{method:"POST",body:JSON.stringify({task_queue:t,compilation_feedback:n})}),onSuccess:()=>{e.invalidateQueries({queryKey:["yamlWorkflows"],refetchType:"all"})}})}function q(){const e=a();return s({mutationFn:o=>r(`/yaml-workflows/${o}/archive`,{method:"POST"}),onSuccess:()=>{e.invalidateQueries({queryKey:["yamlWorkflows"],refetchType:"all"})}})}function W(){const e=a();return s({mutationFn:o=>r(`/yaml-workflows/${o}/restore`,{method:"POST"}),onSuccess:()=>{e.invalidateQueries({queryKey:["yamlWorkflows"],refetchType:"all"}),e.invalidateQueries({queryKey:["yamlWorkflow"],refetchType:"all"})}})}function S(){const e=a();return s({mutationFn:({id:o,...t})=>r(`/yaml-workflows/${o}`,{method:"PUT",body:JSON.stringify(t)}),onSuccess:()=>{e.invalidateQueries({queryKey:["yamlWorkflows"],refetchType:"all"})}})}function v(){const e=a();return s({mutationFn:o=>r(`/yaml-workflows/${o}`,{method:"DELETE"}),onSuccess:()=>{e.invalidateQueries({queryKey:["yamlWorkflows"],refetchType:"all"})}})}function T(e){return l({queryKey:["yamlWorkflows",e,"versions"],queryFn:()=>r(`/yaml-workflows/${e}/versions`),enabled:!!e})}function F(e,o){return l({queryKey:["yamlWorkflows",e,"versions",o],queryFn:()=>r(`/yaml-workflows/${e}/versions/${o}`),enabled:!!e&&o!==null})}export{m as a,S as b,c,T as d,k as e,p as f,q as g,W as h,v as i,h as j,F as k,d as l,w as m,f as u};
+//# sourceMappingURL=yaml-workflows-C20qHo3L.js.map

package/dashboard/dist/assets/{yaml-workflows-D97Bz6li.js.map → yaml-workflows-C20qHo3L.js.map}

@@ -1 +1 @@
-{"version":3,"file":"yaml-workflows-D97Bz6li.js","sources":["../../src/api/yaml-workflows.ts"],"sourcesContent":["import { useQuery, useMutation, useQueryClient } from '@tanstack/react-query';\nimport { apiFetch } from './client';\nimport type { LTYamlWorkflowRecord, LTYamlWorkflowStatus, LTYamlWorkflowVersion } from './types';\n\ninterface YamlWorkflowListResponse {\n  workflows: LTYamlWorkflowRecord[];\n  total: number;\n}\n\ninterface YamlWorkflowFilters {\n  status?: LTYamlWorkflowStatus;\n  graph_topic?: string;\n  app_id?: string;\n  search?: string;\n  set_id?: string;\n  limit?: number;\n  offset?: number;\n}\n\nexport function useYamlWorkflows(filters: YamlWorkflowFilters = {}) {\n  const params = new URLSearchParams();\n  if (filters.status) params.set('status', filters.status);\n  if (filters.graph_topic) params.set('graph_topic', filters.graph_topic);\n  if (filters.app_id) params.set('app_id', filters.app_id);\n  if (filters.search) params.set('search', filters.search);\n  if (filters.set_id) params.set('set_id', filters.set_id);\n  if (filters.limit) params.set('limit', String(filters.limit));\n  if (filters.offset !== undefined) params.set('offset', String(filters.offset));\n\n  return useQuery<YamlWorkflowListResponse>({\n    queryKey: ['yamlWorkflows', filters],\n    queryFn: () => apiFetch(`/yaml-workflows?${params}`),\n  });\n}\n\nexport function useYamlWorkflowAppIds() {\n  return useQuery<{ app_ids: string[] }>({\n    queryKey: ['yamlWorkflowAppIds'],\n    queryFn: () => apiFetch('/yaml-workflows/app-ids'),\n  });\n}\n\nexport function useYamlWorkflowByTopic(graphTopic: string | undefined, appId?: string) {\n  return useQuery<YamlWorkflowListResponse>({\n    queryKey: ['yamlWorkflows', 'byTopic', graphTopic, appId],\n    queryFn: () => {\n      const params = new URLSearchParams({ graph_topic: graphTopic!, limit: '1' });\n      if (appId) params.set('app_id', appId);\n      return apiFetch(`/yaml-workflows?${params}`);\n    },\n    enabled: !!graphTopic,\n  });\n}\n\nexport function useYamlWorkflow(id: string) {\n  return useQuery<LTYamlWorkflowRecord>({\n    queryKey: ['yamlWorkflows', id],\n    queryFn: () => apiFetch(`/yaml-workflows/${id}`),\n    enabled: !!id,\n  });\n}\n\nexport function useCreateYamlWorkflow() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: (input: {\n      workflow_id: string;\n      task_queue: string;\n      workflow_name: string;\n      name: string;\n      description?: string;\n      app_id?: string;\n      subscribes?: string;\n      tags?: string[];\n      compilation_feedback?: string;\n    }) =>\n      apiFetch<LTYamlWorkflowRecord>('/yaml-workflows', {\n        method: 'POST',\n        body: JSON.stringify(input),\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n    },\n  });\n}\n\nexport function useDeployYamlWorkflow() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: (id: string) =>\n      apiFetch<LTYamlWorkflowRecord>(`/yaml-workflows/${id}/deploy`, {\n        method: 'POST',\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n    },\n  });\n}\n\nexport function useActivateYamlWorkflow() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: (id: string) =>\n      apiFetch<LTYamlWorkflowRecord>(`/yaml-workflows/${id}/activate`, {\n        method: 'POST',\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n    },\n  });\n}\n\nexport function useInvokeYamlWorkflow() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: ({ id, data, sync, execute_as }: { id: string; data: Record<string, unknown>; sync?: boolean; execute_as?: string }) =>\n      apiFetch<{ result?: unknown; job_id?: string }>(`/yaml-workflows/${id}/invoke`, {\n        method: 'POST',\n        body: JSON.stringify({ data, sync, ...(execute_as ? { execute_as } : {}) }),\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n    },\n  });\n}\n\nexport function useRegenerateYamlWorkflow() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: ({ id, task_queue, compilation_feedback }: { id: string; task_queue?: string; compilation_feedback?: string }) =>\n      apiFetch<LTYamlWorkflowRecord>(`/yaml-workflows/${id}/regenerate`, {\n        method: 'POST',\n        body: JSON.stringify({ task_queue, compilation_feedback }),\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n    },\n  });\n}\n\nexport function useArchiveYamlWorkflow() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: (id: string) =>\n      apiFetch<LTYamlWorkflowRecord>(`/yaml-workflows/${id}/archive`, {\n        method: 'POST',\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n    },\n  });\n}\n\nexport function useRestoreYamlWorkflow() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: (id: string) =>\n      apiFetch<LTYamlWorkflowRecord>(`/yaml-workflows/${id}/restore`, {\n        method: 'POST',\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflow'], refetchType: 'all' });\n    },\n  });\n}\n\nexport function useUpdateYamlWorkflow() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: ({ id, ...updates }: { id: string; yaml_content?: string; name?: string; description?: string; input_schema?: Record<string, unknown>; output_schema?: Record<string, unknown>; tags?: string[]; app_id?: string; graph_topic?: string }) =>\n      apiFetch<LTYamlWorkflowRecord>(`/yaml-workflows/${id}`, {\n        method: 'PUT',\n        body: JSON.stringify(updates),\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n    },\n  });\n}\n\nexport function useDeleteYamlWorkflow() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: (id: string) =>\n      apiFetch<{ deleted: boolean }>(`/yaml-workflows/${id}`, {\n        method: 'DELETE',\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n    },\n  });\n}\n\n// ── Cron scheduling ─────────────────────────────────────────────\n\nexport function useSetYamlCron() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: ({ id, cron_schedule, cron_envelope, execute_as }: {\n      id: string;\n      cron_schedule: string;\n      cron_envelope?: Record<string, unknown> | null;\n      execute_as?: string | null;\n    }) =>\n      apiFetch<LTYamlWorkflowRecord>(`/yaml-workflows/${id}/cron`, {\n        method: 'PUT',\n        body: JSON.stringify({ cron_schedule, cron_envelope, execute_as }),\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n    },\n  });\n}\n\nexport function useClearYamlCron() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: (id: string) =>\n      apiFetch<LTYamlWorkflowRecord>(`/yaml-workflows/${id}/cron`, {\n        method: 'DELETE',\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n    },\n  });\n}\n\n// ── Version history ─────────────────────────────────────────────\n\nexport function useYamlWorkflowVersions(id: string) {\n  return useQuery<{ versions: LTYamlWorkflowVersion[]; total: number }>({\n    queryKey: ['yamlWorkflows', id, 'versions'],\n    queryFn: () => apiFetch(`/yaml-workflows/${id}/versions`),\n    enabled: !!id,\n  });\n}\n\nexport function useYamlWorkflowVersion(id: string, version: number | null) {\n  return useQuery<LTYamlWorkflowVersion>({\n    queryKey: ['yamlWorkflows', id, 'versions', version],\n    queryFn: () => apiFetch(`/yaml-workflows/${id}/versions/${version}`),\n    enabled: !!id && version !== null,\n  });\n}\n"],"names":["useYamlWorkflows","filters","params","useQuery","apiFetch","useYamlWorkflowAppIds","useYamlWorkflow","id","useCreateYamlWorkflow","queryClient","useQueryClient","useMutation","input","useDeployYamlWorkflow","useActivateYamlWorkflow","useInvokeYamlWorkflow","data","sync","execute_as","useRegenerateYamlWorkflow","task_queue","compilation_feedback","useArchiveYamlWorkflow","useRestoreYamlWorkflow","useUpdateYamlWorkflow","updates","useDeleteYamlWorkflow","useYamlWorkflowVersions","useYamlWorkflowVersion","version"],"mappings":"qGAmBO,SAASA,EAAiBC,EAA+B,GAAI,CAClE,MAAMC,EAAS,IAAI,gBACnB,OAAID,EAAQ,QAAQC,EAAO,IAAI,SAAUD,EAAQ,MAAM,EACnDA,EAAQ,aAAaC,EAAO,IAAI,cAAeD,EAAQ,WAAW,EAClEA,EAAQ,QAAQC,EAAO,IAAI,SAAUD,EAAQ,MAAM,EACnDA,EAAQ,QAAQC,EAAO,IAAI,SAAUD,EAAQ,MAAM,EACnDA,EAAQ,QAAQC,EAAO,IAAI,SAAUD,EAAQ,MAAM,EACnDA,EAAQ,OAAOC,EAAO,IAAI,QAAS,OAAOD,EAAQ,KAAK,CAAC,EACxDA,EAAQ,SAAW,QAAWC,EAAO,IAAI,SAAU,OAAOD,EAAQ,MAAM,CAAC,EAEtEE,EAAmC,CACxC,SAAU,CAAC,gBAAiBF,CAAO,EACnC,QAAS,IAAMG,EAAS,mBAAmBF,CAAM,EAAE,CAAA,CACpD,CACH,CAEO,SAASG,GAAwB,CACtC,OAAOF,EAAgC,CACrC,SAAU,CAAC,oBAAoB,EAC/B,QAAS,IAAMC,EAAS,yBAAyB,CAAA,CAClD,CACH,CAcO,SAASE,EAAgBC,EAAY,CAC1C,OAAOJ,EAA+B,CACpC,SAAU,CAAC,gBAAiBI,CAAE,EAC9B,QAAS,IAAMH,EAAS,mBAAmBG,CAAE,EAAE,EAC/C,QAAS,CAAC,CAACA,CAAA,CACZ,CACH,CAEO,SAASC,GAAwB,CACtC,MAAMC,EAAcC,EAAA,EACpB,OAAOC,EAAY,CACjB,WAAaC,GAWXR,EAA+B,kBAAmB,CAChD,OAAQ,OACR,KAAM,KAAK,UAAUQ,CAAK,CAAA,CAC3B,EACH,UAAW,IAAM,CACfH,EAAY,kBAAkB,CAAE,SAAU,CAAC,eAAe,EAAG,YAAa,MAAO,CACnF,CAAA,CACD,CACH,CAEO,SAASI,GAAwB,CACtC,MAAMJ,EAAcC,EAAA,EACpB,OAAOC,EAAY,CACjB,WAAaJ,GACXH,EAA+B,mBAAmBG,CAAE,UAAW,CAC7D,OAAQ,MAAA,CACT,EACH,UAAW,IAAM,CACfE,EAAY,kBAAkB,CAAE,SAAU,CAAC,eAAe,EAAG,YAAa,MAAO,CACnF,CAAA,CACD,CACH,CAEO,SAASK,GAA0B,CACxC,MAAML,EAAcC,EAAA,EACpB,OAAOC,EAAY,CACjB,WAAaJ,GACXH,EAA+B,mBAAmBG,CAAE,YAAa,CAC/D,OAAQ,MAAA,CACT,EACH,UAAW,IAAM,CACfE,EAAY,kBAAkB,CAAE,SAAU,CAAC,eAAe,EAAG,YAAa,MAAO,CACnF,CAAA,CACD,CACH,CAEO,SAASM,GAAwB,CACtC,MAAMN,EAAcC,EAAA,EACpB,OAAOC,EAAY,CACjB,WAAY,CAAC,CAAE,GAAAJ,EAAI,KAAAS,EAAM,KAAAC,EAAM,WAAAC,KAC7Bd,EAAgD,mBAAmBG,CAAE,UAAW,CAC9E,OAAQ,OACR,KAAM,KAAK,UAAU,CAAE,KAAAS,EAAM,KAAAC,EAAM,GAAIC,EAAa,CAAE,WAAAA,CAAA,EAAe,GAAK,CAAA,CAC3E,EACH,UAAW,IAAM,CACfT,EAAY,kBAAkB,CAAE,SAAU,CAAC,eAAe,EAAG,YAAa,MAAO,CACnF,CAAA,CACD,CACH,CAEO,SAASU,GAA4B,CAC1C,MAAMV,EAAcC,EAAA,EACpB,OAAOC,EAAY,CACjB,WAAY,CAAC,CAAE,GAAAJ,EAAI,WAAAa,EAAY,qBAAAC,KAC7BjB,EAA+B,mBAAmBG,CAAE,cAAe,CACjE,OAAQ,OACR,KAAM,KAAK,UAAU,CAAE,WAAAa,EAAY,qBAAAC,EAAsB,CAAA,CAC1D,EACH,UAAW,IAAM,CACfZ,EAAY,kBAAkB,CAAE,SAAU,CAAC,eAAe,EAAG,YAAa,MAAO,CACnF,CAAA,CACD,CACH,CAEO,SAASa,GAAyB,CACvC,MAAMb,EAAcC,EAAA,EACpB,OAAOC,EAAY,CACjB,WAAaJ,GACXH,EAA+B,mBAAmBG,CAAE,WAAY,CAC9D,OAAQ,MAAA,CACT,EACH,UAAW,IAAM,CACfE,EAAY,kBAAkB,CAAE,SAAU,CAAC,eAAe,EAAG,YAAa,MAAO,CACnF,CAAA,CACD,CACH,CAEO,SAASc,GAAyB,CACvC,MAAMd,EAAcC,EAAA,EACpB,OAAOC,EAAY,CACjB,WAAaJ,GACXH,EAA+B,mBAAmBG,CAAE,WAAY,CAC9D,OAAQ,MAAA,CACT,EACH,UAAW,IAAM,CACfE,EAAY,kBAAkB,CAAE,SAAU,CAAC,eAAe,EAAG,YAAa,MAAO,EACjFA,EAAY,kBAAkB,CAAE,SAAU,CAAC,cAAc,EAAG,YAAa,MAAO,CAClF,CAAA,CACD,CACH,CAEO,SAASe,GAAwB,CACtC,MAAMf,EAAcC,EAAA,EACpB,OAAOC,EAAY,CACjB,WAAY,CAAC,CAAE,GAAAJ,EAAI,GAAGkB,KACpBrB,EAA+B,mBAAmBG,CAAE,GAAI,CACtD,OAAQ,MACR,KAAM,KAAK,UAAUkB,CAAO,CAAA,CAC7B,EACH,UAAW,IAAM,CACfhB,EAAY,kBAAkB,CAAE,SAAU,CAAC,eAAe,EAAG,YAAa,MAAO,CACnF,CAAA,CACD,CACH,CAEO,SAASiB,GAAwB,CACtC,MAAMjB,EAAcC,EAAA,EACpB,OAAOC,EAAY,CACjB,WAAaJ,GACXH,EAA+B,mBAAmBG,CAAE,GAAI,CACtD,OAAQ,QAAA,CACT,EACH,UAAW,IAAM,CACfE,EAAY,kBAAkB,CAAE,SAAU,CAAC,eAAe,EAAG,YAAa,MAAO,CACnF,CAAA,CACD,CACH,CAsCO,SAASkB,EAAwBpB,EAAY,CAClD,OAAOJ,EAA+D,CACpE,SAAU,CAAC,gBAAiBI,EAAI,UAAU,EAC1C,QAAS,IAAMH,EAAS,mBAAmBG,CAAE,WAAW,EACxD,QAAS,CAAC,CAACA,CAAA,CACZ,CACH,CAEO,SAASqB,EAAuBrB,EAAYsB,EAAwB,CACzE,OAAO1B,EAAgC,CACrC,SAAU,CAAC,gBAAiBI,EAAI,WAAYsB,CAAO,EACnD,QAAS,IAAMzB,EAAS,mBAAmBG,CAAE,aAAasB,CAAO,EAAE,EACnE,QAAS,CAAC,CAACtB,GAAMsB,IAAY,IAAA,CAC9B,CACH"}
+{"version":3,"file":"yaml-workflows-C20qHo3L.js","sources":["../../src/api/yaml-workflows.ts"],"sourcesContent":["import { useQuery, useMutation, useQueryClient } from '@tanstack/react-query';\nimport { apiFetch } from './client';\nimport type { LTYamlWorkflowRecord, LTYamlWorkflowStatus, LTYamlWorkflowVersion } from './types';\n\ninterface YamlWorkflowListResponse {\n  workflows: LTYamlWorkflowRecord[];\n  total: number;\n}\n\ninterface YamlWorkflowFilters {\n  status?: LTYamlWorkflowStatus;\n  graph_topic?: string;\n  app_id?: string;\n  search?: string;\n  set_id?: string;\n  limit?: number;\n  offset?: number;\n}\n\nexport function useYamlWorkflows(filters: YamlWorkflowFilters = {}) {\n  const params = new URLSearchParams();\n  if (filters.status) params.set('status', filters.status);\n  if (filters.graph_topic) params.set('graph_topic', filters.graph_topic);\n  if (filters.app_id) params.set('app_id', filters.app_id);\n  if (filters.search) params.set('search', filters.search);\n  if (filters.set_id) params.set('set_id', filters.set_id);\n  if (filters.limit) params.set('limit', String(filters.limit));\n  if (filters.offset !== undefined) params.set('offset', String(filters.offset));\n\n  return useQuery<YamlWorkflowListResponse>({\n    queryKey: ['yamlWorkflows', filters],\n    queryFn: () => apiFetch(`/yaml-workflows?${params}`),\n  });\n}\n\nexport function useYamlWorkflowAppIds() {\n  return useQuery<{ app_ids: string[] }>({\n    queryKey: ['yamlWorkflowAppIds'],\n    queryFn: () => apiFetch('/yaml-workflows/app-ids'),\n  });\n}\n\nexport function useYamlWorkflowByTopic(graphTopic: string | undefined, appId?: string) {\n  return useQuery<YamlWorkflowListResponse>({\n    queryKey: ['yamlWorkflows', 'byTopic', graphTopic, appId],\n    queryFn: () => {\n      const params = new URLSearchParams({ graph_topic: graphTopic!, limit: '1' });\n      if (appId) params.set('app_id', appId);\n      return apiFetch(`/yaml-workflows?${params}`);\n    },\n    enabled: !!graphTopic,\n  });\n}\n\nexport function useYamlWorkflow(id: string) {\n  return useQuery<LTYamlWorkflowRecord>({\n    queryKey: ['yamlWorkflows', id],\n    queryFn: () => apiFetch(`/yaml-workflows/${id}`),\n    enabled: !!id,\n  });\n}\n\nexport function useCreateYamlWorkflow() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: (input: {\n      workflow_id: string;\n      task_queue: string;\n      workflow_name: string;\n      name: string;\n      description?: string;\n      app_id?: string;\n      subscribes?: string;\n      tags?: string[];\n      compilation_feedback?: string;\n    }) =>\n      apiFetch<LTYamlWorkflowRecord>('/yaml-workflows', {\n        method: 'POST',\n        body: JSON.stringify(input),\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n    },\n  });\n}\n\nexport function useDeployYamlWorkflow() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: (id: string) =>\n      apiFetch<LTYamlWorkflowRecord>(`/yaml-workflows/${id}/deploy`, {\n        method: 'POST',\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n    },\n  });\n}\n\nexport function useActivateYamlWorkflow() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: (id: string) =>\n      apiFetch<LTYamlWorkflowRecord>(`/yaml-workflows/${id}/activate`, {\n        method: 'POST',\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n    },\n  });\n}\n\nexport function useInvokeYamlWorkflow() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: ({ id, data, sync, execute_as }: { id: string; data: Record<string, unknown>; sync?: boolean; execute_as?: string }) =>\n      apiFetch<{ result?: unknown; job_id?: string }>(`/yaml-workflows/${id}/invoke`, {\n        method: 'POST',\n        body: JSON.stringify({ data, sync, ...(execute_as ? { execute_as } : {}) }),\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n    },\n  });\n}\n\nexport function useRegenerateYamlWorkflow() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: ({ id, task_queue, compilation_feedback }: { id: string; task_queue?: string; compilation_feedback?: string }) =>\n      apiFetch<LTYamlWorkflowRecord>(`/yaml-workflows/${id}/regenerate`, {\n        method: 'POST',\n        body: JSON.stringify({ task_queue, compilation_feedback }),\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n    },\n  });\n}\n\nexport function useArchiveYamlWorkflow() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: (id: string) =>\n      apiFetch<LTYamlWorkflowRecord>(`/yaml-workflows/${id}/archive`, {\n        method: 'POST',\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n    },\n  });\n}\n\nexport function useRestoreYamlWorkflow() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: (id: string) =>\n      apiFetch<LTYamlWorkflowRecord>(`/yaml-workflows/${id}/restore`, {\n        method: 'POST',\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflow'], refetchType: 'all' });\n    },\n  });\n}\n\nexport function useUpdateYamlWorkflow() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: ({ id, ...updates }: { id: string; yaml_content?: string; name?: string; description?: string; input_schema?: Record<string, unknown>; output_schema?: Record<string, unknown>; tags?: string[]; app_id?: string; graph_topic?: string }) =>\n      apiFetch<LTYamlWorkflowRecord>(`/yaml-workflows/${id}`, {\n        method: 'PUT',\n        body: JSON.stringify(updates),\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n    },\n  });\n}\n\nexport function useDeleteYamlWorkflow() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: (id: string) =>\n      apiFetch<{ deleted: boolean }>(`/yaml-workflows/${id}`, {\n        method: 'DELETE',\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n    },\n  });\n}\n\n// ── Cron scheduling ─────────────────────────────────────────────\n\nexport function useSetYamlCron() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: ({ id, cron_schedule, cron_envelope, execute_as }: {\n      id: string;\n      cron_schedule: string;\n      cron_envelope?: Record<string, unknown> | null;\n      execute_as?: string | null;\n    }) =>\n      apiFetch<LTYamlWorkflowRecord>(`/yaml-workflows/${id}/cron`, {\n        method: 'PUT',\n        body: JSON.stringify({ cron_schedule, cron_envelope, execute_as }),\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n    },\n  });\n}\n\nexport function useClearYamlCron() {\n  const queryClient = useQueryClient();\n  return useMutation({\n    mutationFn: (id: string) =>\n      apiFetch<LTYamlWorkflowRecord>(`/yaml-workflows/${id}/cron`, {\n        method: 'DELETE',\n      }),\n    onSuccess: () => {\n      queryClient.invalidateQueries({ queryKey: ['yamlWorkflows'], refetchType: 'all' });\n    },\n  });\n}\n\n// ── Version history ─────────────────────────────────────────────\n\nexport function useYamlWorkflowVersions(id: string) {\n  return useQuery<{ versions: LTYamlWorkflowVersion[]; total: number }>({\n    queryKey: ['yamlWorkflows', id, 'versions'],\n    queryFn: () => apiFetch(`/yaml-workflows/${id}/versions`),\n    enabled: !!id,\n  });\n}\n\nexport function useYamlWorkflowVersion(id: string, version: number | null) {\n  return useQuery<LTYamlWorkflowVersion>({\n    queryKey: ['yamlWorkflows', id, 'versions', version],\n    queryFn: () => apiFetch(`/yaml-workflows/${id}/versions/${version}`),\n    enabled: !!id && version !== null,\n  });\n}\n"],"names":["useYamlWorkflows","filters","params","useQuery","apiFetch","useYamlWorkflowAppIds","useYamlWorkflow","id","useCreateYamlWorkflow","queryClient","useQueryClient","useMutation","input","useDeployYamlWorkflow","useActivateYamlWorkflow","useInvokeYamlWorkflow","data","sync","execute_as","useRegenerateYamlWorkflow","task_queue","compilation_feedback","useArchiveYamlWorkflow","useRestoreYamlWorkflow","useUpdateYamlWorkflow","updates","useDeleteYamlWorkflow","useYamlWorkflowVersions","useYamlWorkflowVersion","version"],"mappings":"qGAmBO,SAASA,EAAiBC,EAA+B,GAAI,CAClE,MAAMC,EAAS,IAAI,gBACnB,OAAID,EAAQ,QAAQC,EAAO,IAAI,SAAUD,EAAQ,MAAM,EACnDA,EAAQ,aAAaC,EAAO,IAAI,cAAeD,EAAQ,WAAW,EAClEA,EAAQ,QAAQC,EAAO,IAAI,SAAUD,EAAQ,MAAM,EACnDA,EAAQ,QAAQC,EAAO,IAAI,SAAUD,EAAQ,MAAM,EACnDA,EAAQ,QAAQC,EAAO,IAAI,SAAUD,EAAQ,MAAM,EACnDA,EAAQ,OAAOC,EAAO,IAAI,QAAS,OAAOD,EAAQ,KAAK,CAAC,EACxDA,EAAQ,SAAW,QAAWC,EAAO,IAAI,SAAU,OAAOD,EAAQ,MAAM,CAAC,EAEtEE,EAAmC,CACxC,SAAU,CAAC,gBAAiBF,CAAO,EACnC,QAAS,IAAMG,EAAS,mBAAmBF,CAAM,EAAE,CAAA,CACpD,CACH,CAEO,SAASG,GAAwB,CACtC,OAAOF,EAAgC,CACrC,SAAU,CAAC,oBAAoB,EAC/B,QAAS,IAAMC,EAAS,yBAAyB,CAAA,CAClD,CACH,CAcO,SAASE,EAAgBC,EAAY,CAC1C,OAAOJ,EAA+B,CACpC,SAAU,CAAC,gBAAiBI,CAAE,EAC9B,QAAS,IAAMH,EAAS,mBAAmBG,CAAE,EAAE,EAC/C,QAAS,CAAC,CAACA,CAAA,CACZ,CACH,CAEO,SAASC,GAAwB,CACtC,MAAMC,EAAcC,EAAA,EACpB,OAAOC,EAAY,CACjB,WAAaC,GAWXR,EAA+B,kBAAmB,CAChD,OAAQ,OACR,KAAM,KAAK,UAAUQ,CAAK,CAAA,CAC3B,EACH,UAAW,IAAM,CACfH,EAAY,kBAAkB,CAAE,SAAU,CAAC,eAAe,EAAG,YAAa,MAAO,CACnF,CAAA,CACD,CACH,CAEO,SAASI,GAAwB,CACtC,MAAMJ,EAAcC,EAAA,EACpB,OAAOC,EAAY,CACjB,WAAaJ,GACXH,EAA+B,mBAAmBG,CAAE,UAAW,CAC7D,OAAQ,MAAA,CACT,EACH,UAAW,IAAM,CACfE,EAAY,kBAAkB,CAAE,SAAU,CAAC,eAAe,EAAG,YAAa,MAAO,CACnF,CAAA,CACD,CACH,CAEO,SAASK,GAA0B,CACxC,MAAML,EAAcC,EAAA,EACpB,OAAOC,EAAY,CACjB,WAAaJ,GACXH,EAA+B,mBAAmBG,CAAE,YAAa,CAC/D,OAAQ,MAAA,CACT,EACH,UAAW,IAAM,CACfE,EAAY,kBAAkB,CAAE,SAAU,CAAC,eAAe,EAAG,YAAa,MAAO,CACnF,CAAA,CACD,CACH,CAEO,SAASM,GAAwB,CACtC,MAAMN,EAAcC,EAAA,EACpB,OAAOC,EAAY,CACjB,WAAY,CAAC,CAAE,GAAAJ,EAAI,KAAAS,EAAM,KAAAC,EAAM,WAAAC,KAC7Bd,EAAgD,mBAAmBG,CAAE,UAAW,CAC9E,OAAQ,OACR,KAAM,KAAK,UAAU,CAAE,KAAAS,EAAM,KAAAC,EAAM,GAAIC,EAAa,CAAE,WAAAA,CAAA,EAAe,GAAK,CAAA,CAC3E,EACH,UAAW,IAAM,CACfT,EAAY,kBAAkB,CAAE,SAAU,CAAC,eAAe,EAAG,YAAa,MAAO,CACnF,CAAA,CACD,CACH,CAEO,SAASU,GAA4B,CAC1C,MAAMV,EAAcC,EAAA,EACpB,OAAOC,EAAY,CACjB,WAAY,CAAC,CAAE,GAAAJ,EAAI,WAAAa,EAAY,qBAAAC,KAC7BjB,EAA+B,mBAAmBG,CAAE,cAAe,CACjE,OAAQ,OACR,KAAM,KAAK,UAAU,CAAE,WAAAa,EAAY,qBAAAC,EAAsB,CAAA,CAC1D,EACH,UAAW,IAAM,CACfZ,EAAY,kBAAkB,CAAE,SAAU,CAAC,eAAe,EAAG,YAAa,MAAO,CACnF,CAAA,CACD,CACH,CAEO,SAASa,GAAyB,CACvC,MAAMb,EAAcC,EAAA,EACpB,OAAOC,EAAY,CACjB,WAAaJ,GACXH,EAA+B,mBAAmBG,CAAE,WAAY,CAC9D,OAAQ,MAAA,CACT,EACH,UAAW,IAAM,CACfE,EAAY,kBAAkB,CAAE,SAAU,CAAC,eAAe,EAAG,YAAa,MAAO,CACnF,CAAA,CACD,CACH,CAEO,SAASc,GAAyB,CACvC,MAAMd,EAAcC,EAAA,EACpB,OAAOC,EAAY,CACjB,WAAaJ,GACXH,EAA+B,mBAAmBG,CAAE,WAAY,CAC9D,OAAQ,MAAA,CACT,EACH,UAAW,IAAM,CACfE,EAAY,kBAAkB,CAAE,SAAU,CAAC,eAAe,EAAG,YAAa,MAAO,EACjFA,EAAY,kBAAkB,CAAE,SAAU,CAAC,cAAc,EAAG,YAAa,MAAO,CAClF,CAAA,CACD,CACH,CAEO,SAASe,GAAwB,CACtC,MAAMf,EAAcC,EAAA,EACpB,OAAOC,EAAY,CACjB,WAAY,CAAC,CAAE,GAAAJ,EAAI,GAAGkB,KACpBrB,EAA+B,mBAAmBG,CAAE,GAAI,CACtD,OAAQ,MACR,KAAM,KAAK,UAAUkB,CAAO,CAAA,CAC7B,EACH,UAAW,IAAM,CACfhB,EAAY,kBAAkB,CAAE,SAAU,CAAC,eAAe,EAAG,YAAa,MAAO,CACnF,CAAA,CACD,CACH,CAEO,SAASiB,GAAwB,CACtC,MAAMjB,EAAcC,EAAA,EACpB,OAAOC,EAAY,CACjB,WAAaJ,GACXH,EAA+B,mBAAmBG,CAAE,GAAI,CACtD,OAAQ,QAAA,CACT,EACH,UAAW,IAAM,CACfE,EAAY,kBAAkB,CAAE,SAAU,CAAC,eAAe,EAAG,YAAa,MAAO,CACnF,CAAA,CACD,CACH,CAsCO,SAASkB,EAAwBpB,EAAY,CAClD,OAAOJ,EAA+D,CACpE,SAAU,CAAC,gBAAiBI,EAAI,UAAU,EAC1C,QAAS,IAAMH,EAAS,mBAAmBG,CAAE,WAAW,EACxD,QAAS,CAAC,CAACA,CAAA,CACZ,CACH,CAEO,SAASqB,EAAuBrB,EAAYsB,EAAwB,CACzE,OAAO1B,EAAgC,CACrC,SAAU,CAAC,gBAAiBI,EAAI,WAAYsB,CAAO,EACnD,QAAS,IAAMzB,EAAS,mBAAmBG,CAAE,aAAasB,CAAO,EAAE,EACnE,QAAS,CAAC,CAACtB,GAAMsB,IAAY,IAAA,CAC9B,CACH"}

package/dashboard/dist/index.html

@@ -8,11 +8,11 @@
     <link rel="preconnect" href="https://fonts.googleapis.com" />
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
     <link href="https://fonts.googleapis.com/css2?family=Plus+Jakarta+Sans:wght@300;400;500;600;700&family=JetBrains+Mono:wght@400;500&display=swap" rel="stylesheet" />
-    <script type="module" crossorigin src="./assets/index-CU2UW2y6.js"></script>
+    <script type="module" crossorigin src="./assets/index-C_dAJUzh.js"></script>
     <link rel="modulepreload" crossorigin href="./assets/vendor-query-DvWWuNIB.js">
     <link rel="modulepreload" crossorigin href="./assets/vendor-react-_9U4mKFr.js">
-    <link rel="modulepreload" crossorigin href="./assets/vendor-icons-en0_uSRD.js">
-    <link rel="stylesheet" crossorigin href="./assets/index-BmzscsXK.css">
+    <link rel="modulepreload" crossorigin href="./assets/vendor-icons-ed7mYQw4.js">
+    <link rel="stylesheet" crossorigin href="./assets/index-BUmz0NMg.css">
   </head>
   <body>
     <div id="root"></div>

package/docs/api/http/labels.md

@@ -0,0 +1,115 @@
+# Labels API
+
+Label templates, label sheets, badge reissue and the label ledger. All
+endpoints require authentication. See [label-sheets.md](../../label-sheets.md)
+for templates, sources, media and the credential rules.
+
+| Endpoint | Access |
+|---|---|
+| `GET /api/labels/templates[?scheme=]`, `GET /api/labels/templates/:name` | Any signed-in user |
+| `PUT /api/labels/templates/:name`, `DELETE /api/labels/templates/:name` | Role management |
+| `GET /api/labels/media`, `GET /api/labels/transports` | Any signed-in user |
+| `POST /api/labels/preview`, `POST /api/labels/issue`, `POST /api/labels/jobs/:id/reprint` | Item templates: admin or role management. Identity templates: `credentialIssuer`. |
+| `POST /api/labels/badges/reissue` | `credentialIssuer` |
+| `GET /api/labels/jobs`, `GET /api/labels/jobs/:id` | Any signed-in user; badge jobs only for credential issuers and their requester |
+
+## Upsert a template
+
+```
+PUT /api/labels/templates/:name
+```
+
+```json
+{
+  "scheme_version": 14,
+  "title": "Container",
+  "codes": [
+    { "category": "0", "tone": "solid" },
+    { "category": "1", "caption": "Check out", "tone": "outline" }
+  ],
+  "text": { "title": "{target}", "lines": ["{item.subtitle}"] },
+  "symbology": "code128",
+  "media": "a4-l7160",
+  "expected_revision": 3
+}
+```
+
+**Response 200:** the stored template with its new `revision`. **400** names
+the first problem (unknown token, a category with no rule, a credential token).
+**409** when `expected_revision` is stale.
+
+## Preview
+
+```
+POST /api/labels/preview
+```
+
+```json
+{
+  "template": "container",
+  "source": { "kind": "range", "prefix": "A-", "from": 1, "to": 40 },
+  "layout": { "media": "a4-l7160", "startPosition": 7 }
+}
+```
+
+**Response 200:** `{ template, sheet, warnings, labelCount }`. `sheet` holds
+pages of placed labels in millimetres. Sensitive templates come back masked.
+Nothing is recorded.
+
+## Issue
+
+```
+POST /api/labels/issue
+```
+
+```json
+{
+  "template": "associate-badge",
+  "source": { "kind": "users", "userIds": ["2f0c…"] },
+  "layout": { "media": "a4-cr80", "cutMarks": true },
+  "output": "pdf",
+  "confirm": true,
+  "idempotencyKey": "optional-key",
+  "destination": "optional, passed to a transport"
+}
+```
+
+| `output` | Response |
+|---|---|
+| `sheet` | JSON `{ job, replay, warnings, sheet }` |
+| `pdf` | `application/pdf` attachment |
+| `zpl` | `application/vnd.zebra-zpl` attachment (thermal media only) |
+| `transport:<name>` | JSON `{ job, replay, warnings, receipt }` |
+
+Every response carries `Cache-Control: no-store` and `X-LT-Label-Job: <job id>`.
+
+| Status | Meaning |
+|---|---|
+| 400 | Bad source, layout or output (ZPL on sheet stock, a pasted badge list) |
+| 403 | No print access for this template |
+| 404 | Unknown or disabled template |
+| 428 | A sensitive template without `confirm: true` |
+| 502 | The transport failed; the job is recorded |
+
+## Reissue a badge
+
+```
+POST /api/labels/badges/reissue
+```
+
+```json
+{ "userId": "2f0c…", "template": "associate-badge", "output": "sheet", "confirm": true }
+```
+
+Rotates the user's credential and prints the new badge. The response is an
+issue response with `reissueJobId`, the ledger row of the rotation.
+
+## History
+
+```
+GET /api/labels/jobs?template=&subjectUserId=&limit=&offset=
+POST /api/labels/jobs/:id/reprint   { "indices": [0, 3], "output": "sheet", "confirm": true }
+```
+
+A reprint prints the job's source again with the template as it is now, the
+whole job or the labels at `indices`, and records a new job.

package/docs/api/http/users.md

@@ -2,6 +2,8 @@
 
 Users represent the humans who claim and resolve escalations. Each user has a unique `external_id` that maps to your application's identity system. All endpoints require authentication. Creating, updating, patching, and deleting users require builder access (superadmin or the `engineer` role). Adding and removing roles require admin access and follow the assignment rules in the [Roles API](roles.md#scoped-role-assignment). Only a superadmin may grant the `superadmin` type or change a superadmin account.
 
+User records leave identity keys (the target facets of identity scan schemes, such as `badge_id`) out of `metadata` and list the ones a user carries in `identity_bound`. A wholesale `metadata` write refuses identity keys and keeps the ones it leaves out; setting or removing one through `PATCH /api/users/:id/properties` needs the `credentialIssuer` capability and is recorded in the label ledger. These protections are on by default; `labels.protectIdentityKeys: false` keeps the earlier behavior. See [label-sheets.md](../../label-sheets.md#badges-are-credentials).
+
 For service identities (CI bots, schedulers, automated agents), use the [Service Accounts API](service-accounts.md) instead. Service accounts share the same RBAC system but authenticate with API keys rather than passwords or OAuth.
 
 ## List users

package/docs/api/mcp/admin.md

@@ -1,6 +1,6 @@
 # Admin
 
-Unified system management: tasks, escalations, workflows, diagnostics, agents, bot accounts, control plane, pipelines, topics, users, roles, personas, scan codes, announcements, and settings.
+Unified system management: tasks, escalations, workflows, diagnostics, agents, bot accounts, control plane, pipelines, topics, users, roles, personas, scan codes, label sheets, announcements, and settings.
 
 | Property | Value |
 |----------|-------|
@@ -2055,6 +2055,81 @@ Delete one scan rule by scheme version and category.
 | scheme_version | integer | Yes | Scheme version |
 | category | string | Yes | Rule category |
 
+## Label Sheets
+
+Label templates say what one printed label of a scan scheme shows. See [label-sheets.md](../../label-sheets.md).
+
+### list_label_templates
+
+List label templates: the scheme each prints, its codes with captions, text, symbology and default media.
+
+| | |
+|---|---|
+| Read-safe | Yes |
+
+**Parameters:**
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| scheme | integer | No | Only templates for this scheme version |
+
+### upsert_label_template
+
+Create or replace a label template. Codes are 1 to 4 of the scheme's rules, each beside a caption in a `solid`, `outline` or `plain` band; the title and up to two lines are written in label tokens.
+
+| | |
+|---|---|
+| Read-safe | No |
+
+**Parameters:**
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| name | string | Yes | Template id: lowercase letters, digits and dashes |
+| scheme_version | integer | Yes | The scheme whose codes the label prints |
+| title | string | Yes | Display name |
+| codes | array | Yes | `{ category, caption?, tone }` |
+| text | object | No | `{ title?, lines? }` in label tokens |
+| symbology | string | No | `code128`, `qrcode` or `datamatrix` |
+| human_readable | boolean | No | Print the code as text under the symbol |
+| media | string | No | Default media preset id |
+| sensitive | boolean | No | Confirm and record subjects when printing |
+| enabled | boolean | No | |
+| expected_revision | integer | No | Write only if the stored revision matches |
+
+### delete_label_template
+
+Delete one label template by name.
+
+| | |
+|---|---|
+| Read-safe | No |
+
+**Parameters:**
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| name | string | Yes | Template name |
+
+### render_label_sheet
+
+Issue a sheet of item labels as the caller and store it as a PDF (sheet stock) or ZPL (thermal media). Returns the job id, the file ref, a link valid for ten minutes, and warnings for codes that would fail on the floor. Sensitive and identity (badge) templates are refused.
+
+| | |
+|---|---|
+| Read-safe | No |
+
+**Parameters:**
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| template | string | Yes | Template name |
+| source | object | Yes | `list`, `range`, `escalations` or `facets` source |
+| format | string | Yes | `pdf` or `zpl` |
+| media | string | No | Media preset id |
+| startPosition | integer | No | First label to print on the first sheet |
+| copies | integer | No | Copies of each label |
+
 ## Announcements
 
 ### publish_announcement

package/docs/code-owned-configuration.md

@@ -63,7 +63,7 @@ The domain dictionary's override lives beside its declaration:
 | MCP servers | `mcp.serverFactories[].config` | description, tags, category, compile hints, credential providers | tool manifest, connection status |
 | Agents | `agents[]` | description, status, goals, rules, domain, schedules | capabilities, metadata, run history |
 | Agent subscriptions | `agents[].subscriptions` | reaction fields on (agent, topic) | `enabled` — the admin kill-switch |
-| Scan schemes | `scanSchemes[]` | whole scheme + its rules (one ownership unit; `enabled` is declarative here) | — |
+| Scan schemes | `scanSchemes[]` | whole scheme + its rules + its label templates (one ownership unit; `enabled` is declarative here) | the label ledger |
 | Domain dictionary | `mcp.domainDictionary` (inline) or `mcp.domainDictionaryPath` | whole document (version bumps once per change) | — |
 | Graph workflows | `graphWorkflows[]` | always compare-and-apply: description/schema sync, redeploy on YAML version bump | run history |
 | Machine lines | `machines.lines[]` | the whole line definition (`lt_machine_lines`; version bumps once per change) | lines declared through the API, their bot accounts, their rows |

package/docs/iam.md

@@ -251,6 +251,18 @@ The same keystore carries **acting-identity grants** for shared station devices.
 
 The grant rides scan requests as `actingToken` and is exchanged server-side before anything reads or writes: the verbs run **as the badged person under their own live RBAC**. The grant confers attribution, never privilege — a badged user without write scope on the queue is still denied. Mutations attribute to the person (`assigned_to`, `resolved_by`) with the device recorded beside them (`scanStation` provenance). A dead grant is a loud `not_primed` outcome, never a silent execution as the device. See [scan-codes.md](scan-codes.md#identity-schemes-and-acting-identity).
 
+### Printed credentials
+
+Badge tokens are credentials, so the platform treats printing one as issuing
+one. The `credentialIssuer` capability (superadmin, or the `credential-issuer`
+role; admin type alone does not grant it) gates printing, reissuing, and
+binding identity keys by hand. User reads leave identity keys out of
+`metadata` and name them in `identity_bound`. Every print, reissue, and binding
+writes a row to the label ledger (`lt_label_jobs`) naming the requester and the
+holders before any code is composed. The users API protections are on by
+default; `labels.protectIdentityKeys: false` (or `LT_PROTECT_IDENTITY_KEYS=false`)
+keeps the earlier behavior. See [label-sheets.md](label-sheets.md#badges-are-credentials).
+
 ## Dashboard
 
 The dashboard surfaces IAM across four pages:

package/docs/label-sheets.md

@@ -0,0 +1,267 @@
+# Label Sheets
+
+Every physical thing a floor acts on carries a printed scan code: locations,
+containers, stations, machines, and the badges people scan to act. Label sheets print
+those codes from the scan schemes that read them, on office printers (A4 and
+Letter label stock, ID card stock) and thermal printers (ZPL).
+
+A label is a heading, up to two lines of text, and one to four codes for one
+target, each printed beside the act it names. A container label can print
+**Check in** and **Check out** side by side; the person scanning chooses the
+act by choosing which code to scan. The text is whatever the target's facts
+say: the platform has no notion of what a target is.
+
+## Contents
+
+- [Templates](#templates)
+- [Targets](#targets)
+- [Media and layout](#media-and-layout)
+- [Output](#output)
+- [Checking codes before printing](#checking-codes-before-printing)
+- [Badges are credentials](#badges-are-credentials)
+- [Who may print](#who-may-print)
+- [The label ledger](#the-label-ledger)
+- [Printer transports](#printer-transports)
+- [Declaring templates in code](#declaring-templates-in-code)
+- [Agents](#agents)
+
+## Templates
+
+A template says what one label shows, for one scan scheme. Templates print
+codes the platform mints: schemes with `fixed` or `delimited` encoding.
+
+| Field | Meaning |
+|---|---|
+| `codes` | 1 to 4 of the scheme's rules, in print order. Each has a `caption` (default: the rule's name) and a `tone`: `solid` (white text on a black band), `outline`, or `plain`. Tones tell neighbouring codes apart on black-only stock. |
+| `text.title`, `text.lines` | A heading and up to two lines, written in label tokens. |
+| `symbology` | `code128` (default; shelves scanned from a distance), `qrcode`, or `datamatrix` (small labels). |
+| `human_readable` | Print the code as text under its symbol. |
+| `media` | The default media preset for this template. |
+| `sensitive` | Printing confirms first and records who and what the labels name. Always true on an identity scheme. |
+
+Label tokens:
+
+| Token | Value |
+|---|---|
+| `{target}` | The code's target (action schemes). |
+| `{item.<facet>}` | A facet of the row the target came from, or a column of a pasted list. |
+| `{user.display_name}`, `{user.name}`, `{user.email}`, `{user.roles}`, `{user.<property>}` | The badge holder (identity schemes). |
+| `{scheme.name}` | The scheme's name. |
+
+A token with no value prints empty, and the preview warns about it
+(`missing_token`, naming the facts the label does have). Captions take tokens
+too; a caption left blank prints the rule's name as written. Identity
+credentials never print as text:
+`{target}` and `{user.<identity key>}` are refused on identity templates.
+
+Manage templates on **Admin → Scan Codes → (scheme) → Labels**, through
+`PUT /api/labels/templates/:name`, or with the `upsert_label_template` MCP
+tool. Every write bumps the template's `revision`; an edit that names
+`expected_revision` is refused when someone else saved first.
+
+## Targets
+
+A print job is a template plus a source of targets:
+
+| Source | Targets |
+|---|---|
+| `{ kind: 'range', prefix, from, to, pad, suffix }` | A numbered run: `A-01` to `A-40`. Targets can be printed before anything else is known about them. |
+| `{ kind: 'list', text }` | One target per line. A header row starting with `target` names the other columns, which fill `{item.<column>}`. |
+| `{ kind: 'escalations', ids }` | Rows selected in a list. Each row is read as the caller; its metadata fills `{item.*}`. |
+| `{ kind: 'facets', query }` | Every row a faceted search returns, searched as the caller. The newest row per target wins. |
+| `{ kind: 'users', userIds, role }` | Users carrying the identity scheme's key: the ids given, everyone in `role`, or with neither, every badge holder. The only source an identity template accepts. On **Accounts**, **Print badges** prints the selected users, or with none selected, everyone or everyone in a role. |
+
+A job holds at most `LT_LABELS_MAX_PER_JOB` labels (default 1000) and at most
+`LT_LABELS_MAX_CREDENTIALS_PER_JOB` badges (default 200).
+
+## Media and layout
+
+Shipped presets (`GET /api/labels/media`):
+
+| Family | Presets |
+|---|---|
+| A4 | `a4-l7160` (21 per sheet), `a4-l7163` (14), `a4-l7165` (8), `a4-l7173` (10), `a4-l7651` (65), `a4-a6` (4), `a4-placard` (1), `a4-cr80` (10 ID cards) |
+| Letter | `letter-5160` (30), `letter-5163` (10), `letter-22805` (24 squares), `letter-placard` (1), `letter-cr80` (8 ID cards) |
+| Thermal | `thermal-4x6`, `thermal-4x2`, `thermal-2x1` at 203 dpi |
+
+A job prints on the media it names, then the template's media, then the
+deployment default (`LT_LABELS_DEFAULT_MEDIA`, `a4-l7160` unless set). A job
+can also pass a custom grid: page size, rows and columns, label size,
+margins and gutters, all in millimetres.
+
+Per job:
+
+- `startPosition` skips used labels on the first sheet (counted from 1).
+- `copies` prints each label several times, together.
+- `onePerPage` puts each label on its own page (placards).
+- `cutMarks` prints trim marks for card stock.
+
+Labels lay out to fit their box. When a code would print below the stock's
+minimum bar width (`minModuleMm`, 0.25 mm on the presets) or without its blank
+margin, the job reports a `scale` or `quiet_zone` warning.
+
+## Output
+
+`POST /api/labels/issue` delivers a job as:
+
+| `output` | Result |
+|---|---|
+| `sheet` | The laid-out sheet as JSON. The dashboard prints it through the browser at exact size. |
+| `pdf` | A PDF at the media's exact page size. |
+| `zpl` | ZPL for thermal media, using the printer's own barcode commands. |
+| `transport:<name>` | Sent through a registered [printer transport](#printer-transports). |
+
+PDF text uses Helvetica, which covers Latin names with accents. A deployment
+that prints names in other scripts registers a font with
+`start({ labels: { font: { regular, bold } } })`.
+
+## Checking codes before printing
+
+A preview (`POST /api/labels/preview`) lays out the job without printing or
+recording it, and lists a warning for every label that would fail on the floor:
+
+- `unparseable`: the code does not read back as its scheme, or the scheme is disabled.
+- `rule_disabled`: the code's rule is disabled; scanning it does nothing.
+- `unresolved`: the target names no row today, or the badge holder is not an active user.
+- `missing_token`: the heading, a line or a caption reads `{item.<facet>}` or `{user.<key>}`, and the label's data has no such value.
+- `scale`, `quiet_zone`, `overflow`, `unencodable`: the code or text does not fit the label.
+
+The dashboard prints only after a preview of the same choice. In Chrome, the
+preview can also decode every code on screen and report any it cannot read
+back.
+
+## Badges are credentials
+
+An identity scheme's code acts as a person, so printing one follows its own
+rules:
+
+- Only a credential issuer may print or reissue a badge (see [Who may print](#who-may-print)).
+- A badge preview is masked: it shows where each code goes, never the code.
+- Printing asks for confirmation (`confirm: true`), and the ledger row naming the requester and every holder is written before any code is composed.
+- Badge codes travel in response bodies with `Cache-Control: no-store`, never in URLs, and never in logs or the ledger.
+- User reads (`GET /api/users`, `GET /api/users/:id`, user writes' responses) leave identity keys out of `metadata` and list them in `identity_bound`.
+- Setting or removing an identity key by hand (`PATCH /api/users/:id/properties`) needs the same access and is recorded as a `bind`.
+- Badge scans are unchanged: a scanned token resolves against `lt_users.metadata` on the server, as before.
+
+The user API protections (the last two points, and the refusal of identity keys
+in wholesale `metadata` writes) are on by default.
+`start({ labels: { protectIdentityKeys: false } })` or
+`LT_PROTECT_IDENTITY_KEYS=false` keeps the earlier users API behavior; badge
+printing and reissue still need `credentialIssuer`. Either way, a `metadata`
+replace keeps the identity keys it leaves out.
+
+**Reissue** (`POST /api/labels/badges/reissue`) mints a new credential that
+fits the scheme's encoding, writes it and its ledger row in one statement, and
+prints the new badge. On a delimited identity scheme the credential is
+`target_length` random characters (8 to 64, default 10; **Badge length** on
+the scheme page), and the badge encodes it with its prefix, for example
+`14:0:7KQ2M9XW4H`. On a fixed scheme it is `target_length` digits. Badges of
+any length keep scanning; the length only shapes new ones. Ten characters keep
+a Code 128 badge on an ID card comfortably above the minimum bar width. The old code resolves to no one from that moment. An
+acting grant minted from the old badge before the reissue lasts until its
+`grant_ttl_seconds` runs out.
+
+## Who may print
+
+| Labels | Access |
+|---|---|
+| Item labels (action schemes) | Admin access or role management (admin, superadmin, the `engineer` role). |
+| Badges (identity schemes) | The `credentialIssuer` capability: superadmin, or a holder of the `credential-issuer` role. Admin type alone does not grant it. |
+| Templates | Role management to write; any signed-in user to read. |
+
+## The label ledger
+
+Every print, reissue and binding is a row in `lt_label_jobs`: who asked, when,
+the template and its revision (with a snapshot), the media and output, and
+what the labels name: targets for item labels, user ids for badges. Rows are
+never deleted by the platform; the only columns it updates are the delivery
+stamps of a transport job.
+
+**Admin → Label History** (`GET /api/labels/jobs`) lists the ledger.
+Credential issuers see every row; other readers see item jobs and their own.
+**Print again** (`POST /api/labels/jobs/:id/reprint`) prints a job, or chosen
+labels of it, again from its source with the template as it is now, and
+records a new job. A badge reprint confirms again.
+
+An `idempotencyKey` on an issue request makes it safe to repeat, which is what
+a workflow activity retry does. The repeat records nothing new and prints only
+the labels the first request recorded:
+
+- A sheet, PDF or ZPL output renders those labels again.
+- A transport output is sent under a delivery lease. Claiming the lease is one
+  statement, so concurrent repeats send once. A job already delivered is not
+  sent again. A job whose send failed, or whose sender stopped before the
+  transport accepted, is sent by the next repeat once its lease
+  (`LT_LABELS_DELIVERY_LEASE_SECONDS`, default 120) lapses.
+- A key used before for a different template or output answers `409`.
+
+Workflow activities pass their workflow id as the key.
+
+## Printer transports
+
+A transport routes issued labels to a printer: a thermal printer on the
+network, a print server, a watched folder. Hosts register transports by name:
+
+```typescript
+import type { LTLabelTransport } from '@hotmeshio/long-tail';
+
+const thermal: LTLabelTransport = {
+  formats: ['zpl'],
+  async send({ jobId, payload, destination }) {
+    await sendToPrinter(destination, payload as string);
+    return { accepted: true, detail: jobId };
+  },
+};
+
+start({ labels: { transports: { thermal }, defaultMedia: 'a4-l7160' } });
+```
+
+A job sends with `output: 'transport:thermal'`; `destination` on the request
+passes through to `send` as given, and the transport decides what it names. A name with no registered transport is refused
+before anything is recorded. `GET /api/labels/transports` lists the registered
+names, and the dashboard offers **Send** when one accepts the job's format.
+
+The examples register `storage-drop`, which writes each job to file storage at
+`labels/<jobId>.<format>`.
+
+## Declaring templates in code
+
+Templates declare with their scheme and follow the
+[code-owned configuration](code-owned-configuration.md) contract as one unit
+with it:
+
+```typescript
+scanSchemes: [
+  {
+    version: 14,
+    name: 'Container',
+    target_facet: 'containerId',
+    encoding: 'delimited',
+    rules: [
+      { category: '0', name: 'Check in', steps: [/* … */] },
+      { category: '1', name: 'Check out', steps: [/* … */] },
+    ],
+    labels: [
+      {
+        name: 'container',
+        title: 'Container',
+        codes: [{ category: '0', tone: 'solid' }, { category: '1', tone: 'outline' }],
+        text: { title: '{target}', lines: ['{item.subtitle}'] },
+        media: 'a4-l7160',
+      },
+    ],
+  },
+],
+```
+
+## Agents
+
+The admin MCP server carries `list_label_templates`, `upsert_label_template`,
+`delete_label_template`, and `render_label_sheet`. `render_label_sheet` issues
+item labels as the caller, stores the PDF or ZPL in file storage, and returns
+the job id, the file ref, a link valid for ten minutes, and the warnings.
+It refuses sensitive and identity templates: people print badges.
+
+The `relabel` example workflow shows labels printed from a workflow: it asks a
+person for a label's second line, then prints the label with it through a
+transport, keyed by its workflow id.

package/docs/scan-codes.md

@@ -31,6 +31,7 @@ canonical action surface. A scan is an **ECA rule** over that surface:
 - [Capture on the dashboard](#capture-on-the-dashboard)
 - [Scanner setup](#scanner-setup)
 - [Admin configuration](#admin-configuration)
+- [Printing labels](label-sheets.md)
 - [The printer demo](#the-printer-demo)
 - [The bag and bin demo](#the-bag-and-bin-demo)
 
@@ -788,10 +789,14 @@ checks its entries off the same way: a scan of an accepted scheme, with nothing
 focused, fills the row's first open entry for that code on the server, as the
 person acting. A scan no field accepts runs globally as usual.
 
-Badge tokens are printed credentials: seed them as long random strings,
-bind them server-side (`lt_users.metadata`), and treat badge possession
-with the same physical policy as any badge system. Unknown badges answer
-`identity_unknown` and are auditable.
+Badge tokens are printed credentials: bind them server-side
+(`lt_users.metadata`) as random strings (generated badges are `target_length`
+characters, default 10), and treat badge possession with
+the same physical policy as any badge system. User reads leave identity keys
+out of `metadata` and list them in `identity_bound`. Printing, reissuing and
+binding a badge needs the `credentialIssuer` capability and is recorded in
+the label ledger; see [label-sheets.md](label-sheets.md#badges-are-credentials).
+Unknown badges answer `identity_unknown`.
 
 ## The fallback screen
 
@@ -917,7 +922,8 @@ UPC-A where numeric-only labels are already in circulation.
 at a target facet — its two-digit index is assigned for you. A scheme's detail
 page lists its actions; **Add an action** opens the rule editor:
 
-1. **Name it** — the friendly label printed beside the physical code.
+1. **Name it** — the friendly label printed beside the physical code. Label
+   templates print it there; see [label-sheets.md](label-sheets.md).
 2. **Order the conditions** — each step picks a queue, a held-by filter,
    and its action; steps reorder with arrows. First match wins.
 3. **Set the fallback** — markdown for the no-match screen.