@hotmeshio/long-tail 0.30.5 → 0.31.1

package/build/api/labels/errors.d.ts

@@ -0,0 +1,3 @@
+import type { LTApiResult } from '../../types/sdk';
+/** A refused label request as an API result; anything else is a 500. */
+export declare function labelFailure(err: any): LTApiResult;

package/build/api/labels/errors.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.labelFailure = labelFailure;
+const labels_1 = require("../../services/labels");
+/** A refused label request as an API result; anything else is a 500. */
+function labelFailure(err) {
+    if (err instanceof labels_1.LabelRequestError)
+        return { status: err.status, error: err.message };
+    if (err instanceof labels_1.LabelTemplateValidationError || err instanceof labels_1.LabelTemplateConflictError) {
+        return { status: err.status, error: err.message };
+    }
+    if (err?.status === 400 || err?.status === 409)
+        return { status: err.status, error: err.message };
+    return { status: 500, error: err?.message ?? 'label request failed' };
+}

package/build/api/labels/index.d.ts

@@ -0,0 +1,2 @@
+export { listLabelTemplates, getLabelTemplate, upsertLabelTemplate, deleteLabelTemplate, listLabelMedia, listLabelTransports, } from './templates';
+export { previewLabels, issueLabels, reissueBadge, listLabelJobs, getLabelJob, reprintLabelJob } from './issue';

package/build/api/labels/index.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.reprintLabelJob = exports.getLabelJob = exports.listLabelJobs = exports.reissueBadge = exports.issueLabels = exports.previewLabels = exports.listLabelTransports = exports.listLabelMedia = exports.deleteLabelTemplate = exports.upsertLabelTemplate = exports.getLabelTemplate = exports.listLabelTemplates = void 0;
+var templates_1 = require("./templates");
+Object.defineProperty(exports, "listLabelTemplates", { enumerable: true, get: function () { return templates_1.listLabelTemplates; } });
+Object.defineProperty(exports, "getLabelTemplate", { enumerable: true, get: function () { return templates_1.getLabelTemplate; } });
+Object.defineProperty(exports, "upsertLabelTemplate", { enumerable: true, get: function () { return templates_1.upsertLabelTemplate; } });
+Object.defineProperty(exports, "deleteLabelTemplate", { enumerable: true, get: function () { return templates_1.deleteLabelTemplate; } });
+Object.defineProperty(exports, "listLabelMedia", { enumerable: true, get: function () { return templates_1.listLabelMedia; } });
+Object.defineProperty(exports, "listLabelTransports", { enumerable: true, get: function () { return templates_1.listLabelTransports; } });
+var issue_1 = require("./issue");
+Object.defineProperty(exports, "previewLabels", { enumerable: true, get: function () { return issue_1.previewLabels; } });
+Object.defineProperty(exports, "issueLabels", { enumerable: true, get: function () { return issue_1.issueLabels; } });
+Object.defineProperty(exports, "reissueBadge", { enumerable: true, get: function () { return issue_1.reissueBadge; } });
+Object.defineProperty(exports, "listLabelJobs", { enumerable: true, get: function () { return issue_1.listLabelJobs; } });
+Object.defineProperty(exports, "getLabelJob", { enumerable: true, get: function () { return issue_1.getLabelJob; } });
+Object.defineProperty(exports, "reprintLabelJob", { enumerable: true, get: function () { return issue_1.reprintLabelJob; } });

package/build/api/labels/issue.d.ts

@@ -0,0 +1,54 @@
+import type { LTApiAuth, LTApiResult } from '../../types/sdk';
+import type { LabelIssueRequest, LabelLayoutRequest, LabelOutput, LabelSource } from '../../types/labels';
+/**
+ * Lay out a print job without printing or recording it. Sensitive templates
+ * come back masked: positions without codes.
+ *
+ * @returns `{ status: 200, data: { template, sheet, warnings, labelCount } }`
+ */
+export declare function previewLabels(input: {
+    template: string;
+    source: LabelSource;
+    layout?: LabelLayoutRequest;
+}, auth: LTApiAuth): Promise<LTApiResult>;
+/**
+ * Issue labels: recorded in the label ledger before any code is composed.
+ * Sensitive templates (every identity template) need `confirm: true`.
+ *
+ * @returns `{ status: 200, data: { job, replay, warnings, sheet?, pdf?, zpl?, receipt? } }`;
+ *   400 bad request, 403 no access, 404 unknown template, 428 confirmation required,
+ *   502 the transport failed after the job was recorded
+ */
+export declare function issueLabels(input: LabelIssueRequest, auth: LTApiAuth): Promise<LTApiResult>;
+/**
+ * Rotate a user's badge credential and print the new badge in one act. The
+ * old code stops resolving immediately. Needs credentialIssuer and `confirm`.
+ */
+export declare function reissueBadge(input: {
+    userId: string;
+    template: string;
+    layout?: LabelLayoutRequest;
+    output: LabelOutput;
+    confirm?: boolean;
+}, auth: LTApiAuth): Promise<LTApiResult>;
+/** Label history as the caller may see it: credential issuers see every job; others see item jobs and their own. */
+export declare function listLabelJobs(input: {
+    template?: string;
+    subjectUserId?: string;
+    limit?: number;
+    offset?: number;
+}, auth: LTApiAuth): Promise<LTApiResult>;
+export declare function getLabelJob(input: {
+    id: string;
+}, auth: LTApiAuth): Promise<LTApiResult>;
+/**
+ * Print a recorded job again from its source, with the template as it is
+ * now: the whole job, or `indices` of its labels. A new job is recorded.
+ */
+export declare function reprintLabelJob(input: {
+    id: string;
+    indices?: number[];
+    output: LabelOutput;
+    layout?: LabelLayoutRequest;
+    confirm?: boolean;
+}, auth: LTApiAuth): Promise<LTApiResult>;

package/build/api/labels/issue.js

@@ -0,0 +1,144 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.previewLabels = previewLabels;
+exports.issueLabels = issueLabels;
+exports.reissueBadge = reissueBadge;
+exports.listLabelJobs = listLabelJobs;
+exports.getLabelJob = getLabelJob;
+exports.reprintLabelJob = reprintLabelJob;
+const labels = __importStar(require("../../services/labels"));
+const capabilities_1 = require("../../modules/capabilities");
+const logger_1 = require("../../lib/logger");
+const errors_1 = require("./errors");
+/**
+ * Lay out a print job without printing or recording it. Sensitive templates
+ * come back masked: positions without codes.
+ *
+ * @returns `{ status: 200, data: { template, sheet, warnings, labelCount } }`
+ */
+async function previewLabels(input, auth) {
+    try {
+        return { status: 200, data: await labels.previewLabels(input, auth) };
+    }
+    catch (err) {
+        return (0, errors_1.labelFailure)(err);
+    }
+}
+/**
+ * Issue labels: recorded in the label ledger before any code is composed.
+ * Sensitive templates (every identity template) need `confirm: true`.
+ *
+ * @returns `{ status: 200, data: { job, replay, warnings, sheet?, pdf?, zpl?, receipt? } }`;
+ *   400 bad request, 403 no access, 404 unknown template, 428 confirmation required,
+ *   502 the transport failed after the job was recorded
+ */
+async function issueLabels(input, auth) {
+    try {
+        const result = await labels.issueLabels(input, auth);
+        logger_1.loggerRegistry.info(`[long-tail] labels issued: job=${result.job.id} template=${input.template} labels=${result.job.label_count} output=${input.output}${result.replay ? ' replay' : ''}`);
+        return { status: 200, data: result };
+    }
+    catch (err) {
+        return (0, errors_1.labelFailure)(err);
+    }
+}
+/**
+ * Rotate a user's badge credential and print the new badge in one act. The
+ * old code stops resolving immediately. Needs credentialIssuer and `confirm`.
+ */
+async function reissueBadge(input, auth) {
+    try {
+        const result = await labels.reissueBadge(input, auth);
+        logger_1.loggerRegistry.info(`[long-tail] badge reissued: job=${result.reissueJobId} template=${input.template}`);
+        return { status: 200, data: result };
+    }
+    catch (err) {
+        return (0, errors_1.labelFailure)(err);
+    }
+}
+/** Label history as the caller may see it: credential issuers see every job; others see item jobs and their own. */
+async function listLabelJobs(input, auth) {
+    try {
+        const jobs = await labels.listLabelJobs({ ...input, readerId: auth.userId, seesCredentials: await (0, capabilities_1.mayIssueCredentials)(auth) });
+        return { status: 200, data: { jobs } };
+    }
+    catch (err) {
+        return (0, errors_1.labelFailure)(err);
+    }
+}
+async function readableJob(id, auth) {
+    const job = await labels.getLabelJob(id);
+    if (!job)
+        return null;
+    if (job.sensitive && job.requested_by !== auth.userId && !(await (0, capabilities_1.mayIssueCredentials)(auth)))
+        return null;
+    return job;
+}
+async function getLabelJob(input, auth) {
+    try {
+        const { isUuid } = await Promise.resolve().then(() => __importStar(require('../../lib/uuid')));
+        const job = isUuid(input.id) ? await readableJob(input.id, auth) : null;
+        return job ? { status: 200, data: job } : { status: 404, error: 'Label job not found' };
+    }
+    catch (err) {
+        return (0, errors_1.labelFailure)(err);
+    }
+}
+/**
+ * Print a recorded job again from its source, with the template as it is
+ * now: the whole job, or `indices` of its labels. A new job is recorded.
+ */
+async function reprintLabelJob(input, auth) {
+    try {
+        const { isUuid } = await Promise.resolve().then(() => __importStar(require('../../lib/uuid')));
+        const job = isUuid(input.id) ? await readableJob(input.id, auth) : null;
+        if (!job || job.action !== 'print' || !job.template_name)
+            return { status: 404, error: 'Label job not found' };
+        const named = job.subject_user_ids ?? job.targets ?? [];
+        const only = input.indices?.length ? input.indices.map((i) => named[i]).filter((v) => v !== undefined) : undefined;
+        return issueLabels({
+            template: job.template_name,
+            source: job.source,
+            layout: input.layout,
+            output: input.output,
+            confirm: input.confirm,
+            only,
+        }, auth);
+    }
+    catch (err) {
+        return (0, errors_1.labelFailure)(err);
+    }
+}

package/build/api/labels/templates.d.ts

@@ -0,0 +1,29 @@
+import type { LTApiResult } from '../../types/sdk';
+import type { LabelTemplateInput } from '../../types/labels';
+/**
+ * List label templates, optionally for one scan scheme.
+ *
+ * @param input.scheme — scheme version to filter by
+ * @returns `{ status: 200, data: { templates } }`
+ */
+export declare function listLabelTemplates(input?: {
+    scheme?: number;
+}): Promise<LTApiResult>;
+/** One label template by name; 404 when absent. */
+export declare function getLabelTemplate(input: {
+    name: string;
+}): Promise<LTApiResult>;
+/**
+ * Create or replace a label template. With `expected_revision`, the write
+ * lands only on that revision (409 otherwise).
+ */
+export declare function upsertLabelTemplate(input: LabelTemplateInput & {
+    expected_revision?: number;
+}): Promise<LTApiResult>;
+export declare function deleteLabelTemplate(input: {
+    name: string;
+}): Promise<LTApiResult>;
+/** Media presets and the deployment's default. */
+export declare function listLabelMedia(): Promise<LTApiResult>;
+/** Registered printer transports by name. */
+export declare function listLabelTransports(): Promise<LTApiResult>;

package/build/api/labels/templates.js

@@ -0,0 +1,98 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.listLabelTemplates = listLabelTemplates;
+exports.getLabelTemplate = getLabelTemplate;
+exports.upsertLabelTemplate = upsertLabelTemplate;
+exports.deleteLabelTemplate = deleteLabelTemplate;
+exports.listLabelMedia = listLabelMedia;
+exports.listLabelTransports = listLabelTransports;
+const labels = __importStar(require("../../services/labels"));
+const transports_1 = require("../../lib/labels/transports");
+const errors_1 = require("./errors");
+/**
+ * List label templates, optionally for one scan scheme.
+ *
+ * @param input.scheme — scheme version to filter by
+ * @returns `{ status: 200, data: { templates } }`
+ */
+async function listLabelTemplates(input = {}) {
+    try {
+        return { status: 200, data: { templates: await labels.listLabelTemplates(input.scheme) } };
+    }
+    catch (err) {
+        return (0, errors_1.labelFailure)(err);
+    }
+}
+/** One label template by name; 404 when absent. */
+async function getLabelTemplate(input) {
+    try {
+        const template = await labels.getLabelTemplate(input.name);
+        return template ? { status: 200, data: template } : { status: 404, error: 'Label template not found' };
+    }
+    catch (err) {
+        return (0, errors_1.labelFailure)(err);
+    }
+}
+/**
+ * Create or replace a label template. With `expected_revision`, the write
+ * lands only on that revision (409 otherwise).
+ */
+async function upsertLabelTemplate(input) {
+    try {
+        const { expected_revision, ...template } = input;
+        return { status: 200, data: await labels.upsertLabelTemplate(template, expected_revision) };
+    }
+    catch (err) {
+        return (0, errors_1.labelFailure)(err);
+    }
+}
+async function deleteLabelTemplate(input) {
+    try {
+        const deleted = await labels.deleteLabelTemplate(input.name);
+        return deleted ? { status: 200, data: { deleted: true } } : { status: 404, error: 'Label template not found' };
+    }
+    catch (err) {
+        return (0, errors_1.labelFailure)(err);
+    }
+}
+/** Media presets and the deployment's default. */
+async function listLabelMedia() {
+    return { status: 200, data: { media: labels.labelMediaPresets(), defaultMedia: labels.defaultLabelMediaId() } };
+}
+/** Registered printer transports by name. */
+async function listLabelTransports() {
+    return { status: 200, data: { transports: transports_1.labelTransportRegistry.list() } };
+}

package/build/api/users.d.ts

@@ -1,4 +1,4 @@
-import type { LTApiResult } from '../types/sdk';
+import type { LTApiAuth, LTApiResult } from '../types/sdk';
 import type { LTRoleType } from '../types';
 /**
  * List users with optional filters for role, role type, status, and pagination.
@@ -92,13 +92,17 @@ export declare function updateUser(input: {
  * (`remove`); a key absent from the patch is kept. `rename` preserves the
  * value with no key-absent window. Identity-binding keys (badge scan
  * scheme target facets) assert uniqueness among active users in the same
- * statement.
+ * statement. Touching an identity key binds a credential: it needs the
+ * credentialIssuer capability and is recorded in lt_label_jobs by the same
+ * statement as the patch.
  *
  * @param input.id — the user's unique identifier
  * @param input.set — properties to set (typed JSON values)
  * @param input.remove — property keys to delete
  * @param input.rename — `{ oldKey: newKey }` renames, values preserved
- * @returns `{ status: 200, data: User }`; 400 malformed patch; 404 unknown
+ * @param auth — the caller; required to touch an identity key
+ * @returns `{ status: 200, data: User }` with identity keys redacted; 400
+ *   malformed patch; 403 identity key without credentialIssuer; 404 unknown
  *   user; 409 when an identity value already belongs to another active user
  */
 export declare function patchUserProperties(input: {
@@ -106,7 +110,7 @@ export declare function patchUserProperties(input: {
     set?: Record<string, unknown>;
     remove?: string[];
     rename?: Record<string, string>;
-}): Promise<LTApiResult>;
+}, auth?: LTApiAuth): Promise<LTApiResult>;
 /**
  * The property keys the platform itself resolves identities against — every
  * enabled identity scan scheme's target facet. The dashboard marks these as

package/build/api/users.js

@@ -45,6 +45,20 @@ exports.getUserRoles = getUserRoles;
 exports.addUserRole = addUserRole;
 exports.removeUserRole = removeUserRole;
 const userService = __importStar(require("../services/user"));
+const capabilities_1 = require("../modules/capabilities");
+/** A user as the API returns it: identity keys redacted. */
+async function asRead(user) {
+    return userService.redactIdentityKeys(user, await userService.getIdentityPropertyKeys());
+}
+/** A refusal when a wholesale metadata write names an identity key; bindings go through patchUserProperties. */
+async function identityKeyInMetadata(metadata) {
+    if (!metadata || !userService.identityKeysProtected())
+        return null;
+    const named = (await userService.getIdentityPropertyKeys()).filter((k) => k in metadata);
+    if (named.length === 0)
+        return null;
+    return { status: 400, error: `"${named[0]}" is an identity binding; set it with patchUserProperties` };
+}
 /**
  * List users with optional filters for role, role type, status, and pagination.
  *
@@ -59,7 +73,8 @@ const userService = __importStar(require("../services/user"));
 async function listUsers(input) {
     try {
         const result = await userService.listUsers(input);
-        return { status: 200, data: result };
+        const keys = await userService.getIdentityPropertyKeys();
+        return { status: 200, data: { ...result, users: result.users.map((u) => userService.redactIdentityKeys(u, keys)) } };
     }
     catch (err) {
         return { status: 500, error: err.message };
@@ -95,7 +110,7 @@ async function getUser(input) {
         if (!user) {
             return { status: 404, error: 'User not found' };
         }
-        return { status: 200, data: user };
+        return { status: 200, data: await asRead(user) };
     }
     catch (err) {
         return { status: 500, error: err.message };
@@ -119,6 +134,9 @@ async function createUser(input) {
         if (!input.external_id) {
             return { status: 400, error: 'external_id is required' };
         }
+        const identityRefusal = await identityKeyInMetadata(input.metadata);
+        if (identityRefusal)
+            return identityRefusal;
         if (input.roles) {
             for (const r of input.roles) {
                 if (!r.role || !r.type || !userService.isValidRoleType(r.type)) {
@@ -148,7 +166,7 @@ async function createUser(input) {
             roles: input.roles,
             metadata: input.metadata,
         });
-        return { status: 201, data: user };
+        return { status: 201, data: await asRead(user) };
     }
     catch (err) {
         if (err.code === '23505') {
@@ -173,11 +191,14 @@ async function createUser(input) {
 async function updateUser(input) {
     try {
         const { id, ...fields } = input;
+        const identityRefusal = await identityKeyInMetadata(fields.metadata);
+        if (identityRefusal)
+            return identityRefusal;
         const user = await userService.updateUser(id, fields);
         if (!user) {
             return { status: 404, error: 'User not found' };
         }
-        return { status: 200, data: user };
+        return { status: 200, data: await asRead(user) };
     }
     catch (err) {
         return { status: 500, error: err.message };
@@ -189,26 +210,43 @@ async function updateUser(input) {
  * (`remove`); a key absent from the patch is kept. `rename` preserves the
  * value with no key-absent window. Identity-binding keys (badge scan
  * scheme target facets) assert uniqueness among active users in the same
- * statement.
+ * statement. Touching an identity key binds a credential: it needs the
+ * credentialIssuer capability and is recorded in lt_label_jobs by the same
+ * statement as the patch.
  *
  * @param input.id — the user's unique identifier
  * @param input.set — properties to set (typed JSON values)
  * @param input.remove — property keys to delete
  * @param input.rename — `{ oldKey: newKey }` renames, values preserved
- * @returns `{ status: 200, data: User }`; 400 malformed patch; 404 unknown
+ * @param auth — the caller; required to touch an identity key
+ * @returns `{ status: 200, data: User }` with identity keys redacted; 400
+ *   malformed patch; 403 identity key without credentialIssuer; 404 unknown
  *   user; 409 when an identity value already belongs to another active user
  */
-async function patchUserProperties(input) {
+async function patchUserProperties(input, auth) {
     try {
-        const user = await userService.patchUserProperties(input.id, {
-            set: input.set,
-            remove: input.remove,
-            rename: input.rename,
-        });
+        const ops = { set: input.set, remove: input.remove, rename: input.rename };
+        const touched = await userService.identityKeysTouched(ops);
+        let user;
+        const protectedKeys = userService.identityKeysProtected();
+        if (touched.length > 0 && (protectedKeys || auth)) {
+            if (protectedKeys && (!auth || !(await (0, capabilities_1.mayIssueCredentials)(auth)))) {
+                return { status: 403, error: `"${touched[0]}" is an identity binding; credential-issuer access required` };
+            }
+            const recorded = await userService.patchUserPropertiesRecorded(input.id, ops, {
+                action: 'bind',
+                requested_by: auth.userId,
+                source: { keys: touched },
+            });
+            user = recorded?.user ?? null;
+        }
+        else {
+            user = await userService.patchUserProperties(input.id, ops);
+        }
         if (!user) {
             return { status: 404, error: 'User not found' };
         }
-        return { status: 200, data: user };
+        return { status: 200, data: await asRead(user) };
     }
     catch (err) {
         if (err.status === 400 || err.status === 409) {

package/build/index.d.ts

@@ -22,6 +22,7 @@ export { InMemoryEventAdapter } from './lib/events/memory';
 export { SocketIOEventAdapter, type SocketIOAuthenticator } from './lib/events/socketio';
 export { publishMilestoneEvent, publishTaskEvent, publishEscalationEvent, publishActivityEvent, publishWorkflowEvent, publishAgentEvent, publishKnowledgeEvent } from './lib/events/publish';
 export { messagingRegistry, MemoryMessagingProvider, DELIVERY } from './lib/messaging';
+export { labelTransportRegistry } from './lib/labels/transports';
 export { NatsMessagingProvider } from './lib/messaging/nats/provider';
 export { renderNatsConf, type NatsConfOptions, type EdgeAccount, type NatsUser } from './lib/messaging/nats/render-conf';
 export { jsPermissions } from './lib/messaging/nats/permissions';

package/build/index.js

@@ -36,8 +36,8 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PinoLoggerAdapter = exports.loggerRegistry = exports.HoneycombTelemetryAdapter = exports.telemetryRegistry = exports.jsPermissions = exports.renderNatsConf = exports.NatsMessagingProvider = exports.DELIVERY = exports.MemoryMessagingProvider = exports.messagingRegistry = exports.publishKnowledgeEvent = exports.publishAgentEvent = exports.publishWorkflowEvent = exports.publishActivityEvent = exports.publishEscalationEvent = exports.publishTaskEvent = exports.publishMilestoneEvent = exports.SocketIOEventAdapter = exports.InMemoryEventAdapter = exports.NatsEventAdapter = exports.eventRegistry = exports.ltConfig = exports.seedConfigTopics = exports.seedSystemTopics = exports.TopicService = exports.displayGtin = exports.normalizeGtin = exports.isValidGtin = exports.assertValidScanIdentityRule = exports.assertValidScanSteps = exports.assertValidScanScheme = exports.UserService = exports.ConfigService = exports.EscalationService = exports.TaskService = exports.setAuthAdapter = exports.signToken = exports.requireAdmin = exports.requireAuth = exports.createAuthMiddleware = exports.JwtAuthAdapter = exports.conditionalAccumulator = exports.conditionLT = exports.conditional = exports.executeLT = exports.createLTActivityInterceptor = exports.createLTInterceptor = exports.registerLT = exports.midnightTheme = exports.start = void 0;
-exports.LTExpressAdapter = exports.Machines = exports.api = exports.KnowledgeApi = exports.resolveCredential = exports.mimeFromPath = exports.getStorageBackend = exports.listOAuthConnections = exports.getFreshAccessToken = exports.createClient = exports.CallbackEventAdapter = exports.builtinMcpServerFactories = exports.getSystemAgents = exports.getSystemWorkers = exports.registerMcpTool = exports.getToolContext = exports.getActivityIdentity = exports.McpEscalationStrategy = exports.DefaultEscalationStrategy = exports.escalationStrategyRegistry = exports.McpVisionServer = exports.McpTranslationServer = exports.McpServer = exports.McpClient = exports.McpService = exports.BuiltInMcpAdapter = exports.mcpRegistry = exports.defaultMaintenanceConfig = exports.maintenanceRegistry = void 0;
+exports.loggerRegistry = exports.HoneycombTelemetryAdapter = exports.telemetryRegistry = exports.jsPermissions = exports.renderNatsConf = exports.NatsMessagingProvider = exports.labelTransportRegistry = exports.DELIVERY = exports.MemoryMessagingProvider = exports.messagingRegistry = exports.publishKnowledgeEvent = exports.publishAgentEvent = exports.publishWorkflowEvent = exports.publishActivityEvent = exports.publishEscalationEvent = exports.publishTaskEvent = exports.publishMilestoneEvent = exports.SocketIOEventAdapter = exports.InMemoryEventAdapter = exports.NatsEventAdapter = exports.eventRegistry = exports.ltConfig = exports.seedConfigTopics = exports.seedSystemTopics = exports.TopicService = exports.displayGtin = exports.normalizeGtin = exports.isValidGtin = exports.assertValidScanIdentityRule = exports.assertValidScanSteps = exports.assertValidScanScheme = exports.UserService = exports.ConfigService = exports.EscalationService = exports.TaskService = exports.setAuthAdapter = exports.signToken = exports.requireAdmin = exports.requireAuth = exports.createAuthMiddleware = exports.JwtAuthAdapter = exports.conditionalAccumulator = exports.conditionLT = exports.conditional = exports.executeLT = exports.createLTActivityInterceptor = exports.createLTInterceptor = exports.registerLT = exports.midnightTheme = exports.start = void 0;
+exports.LTExpressAdapter = exports.Machines = exports.api = exports.KnowledgeApi = exports.resolveCredential = exports.mimeFromPath = exports.getStorageBackend = exports.listOAuthConnections = exports.getFreshAccessToken = exports.createClient = exports.CallbackEventAdapter = exports.builtinMcpServerFactories = exports.getSystemAgents = exports.getSystemWorkers = exports.registerMcpTool = exports.getToolContext = exports.getActivityIdentity = exports.McpEscalationStrategy = exports.DefaultEscalationStrategy = exports.escalationStrategyRegistry = exports.McpVisionServer = exports.McpTranslationServer = exports.McpServer = exports.McpClient = exports.McpService = exports.BuiltInMcpAdapter = exports.mcpRegistry = exports.defaultMaintenanceConfig = exports.maintenanceRegistry = exports.PinoLoggerAdapter = void 0;
 const config_1 = require("./modules/config");
 const logger_1 = require("./lib/logger");
 const midnight_1 = require("./themes/midnight");
@@ -105,6 +105,8 @@ var messaging_1 = require("./lib/messaging");
 Object.defineProperty(exports, "messagingRegistry", { enumerable: true, get: function () { return messaging_1.messagingRegistry; } });
 Object.defineProperty(exports, "MemoryMessagingProvider", { enumerable: true, get: function () { return messaging_1.MemoryMessagingProvider; } });
 Object.defineProperty(exports, "DELIVERY", { enumerable: true, get: function () { return messaging_1.DELIVERY; } });
+var transports_1 = require("./lib/labels/transports");
+Object.defineProperty(exports, "labelTransportRegistry", { enumerable: true, get: function () { return transports_1.labelTransportRegistry; } });
 var provider_1 = require("./lib/messaging/nats/provider");
 Object.defineProperty(exports, "NatsMessagingProvider", { enumerable: true, get: function () { return provider_1.NatsMessagingProvider; } });
 var render_conf_1 = require("./lib/messaging/nats/render-conf");

package/build/lib/db/schemas/044_label_sheets.sql

@@ -0,0 +1,65 @@
+-- Migration 044: label templates and the label ledger
+--
+-- lt_config_label_templates: what one printed label shows for a scan scheme.
+-- `codes` lists the rules printed on the label, each beside its caption, in
+-- order: [{ category, caption?, tone }]. `text` holds the title and up to two
+-- lines, written in label tokens ({target}, {item.<facet>}, {user.<key>}).
+-- `revision` advances on every change; `source` says who declared it.
+-- Templates on an identity scheme are always sensitive.
+--
+-- lt_label_jobs: one row per credential event or label print, written before
+-- any code leaves the server. It holds who asked, what template (snapshot),
+-- and who or what the labels name. Identity codes are never stored: identity
+-- jobs record subject_user_ids, item jobs record targets. Rows are never
+-- deleted by the platform.
+
+CREATE TABLE IF NOT EXISTS lt_config_label_templates (
+  name            TEXT PRIMARY KEY CHECK (name ~ '^[a-z0-9][a-z0-9-]{0,62}$'),
+  scheme_version  INT NOT NULL REFERENCES lt_config_scan_schemes(version) ON DELETE CASCADE,
+  title           TEXT NOT NULL,
+  description     TEXT,
+  codes           JSONB NOT NULL,
+  text            JSONB NOT NULL DEFAULT '{}'::jsonb,
+  symbology       TEXT NOT NULL DEFAULT 'code128'
+                    CHECK (symbology IN ('code128', 'qrcode', 'datamatrix')),
+  human_readable  BOOLEAN NOT NULL DEFAULT true,
+  media           TEXT,
+  sensitive       BOOLEAN NOT NULL DEFAULT false,
+  enabled         BOOLEAN NOT NULL DEFAULT true,
+  revision        INT NOT NULL DEFAULT 1,
+  source          TEXT NOT NULL DEFAULT 'api' CHECK (source IN ('code', 'api')),
+  created_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  updated_at      TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS lt_config_label_templates_scheme_idx
+  ON lt_config_label_templates (scheme_version);
+
+DROP TRIGGER IF EXISTS trg_lt_config_label_templates_updated_at ON lt_config_label_templates;
+CREATE TRIGGER trg_lt_config_label_templates_updated_at
+  BEFORE UPDATE ON lt_config_label_templates
+  FOR EACH ROW EXECUTE FUNCTION lt_set_updated_at();
+
+CREATE TABLE IF NOT EXISTS lt_label_jobs (
+  id                 UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  action             TEXT NOT NULL CHECK (action IN ('print', 'reissue', 'bind')),
+  requested_by       UUID,
+  idempotency_key    TEXT UNIQUE,
+  template_name      TEXT,
+  template_revision  INT,
+  template_snapshot  JSONB,
+  scheme_version     INT,
+  scheme_kind        TEXT,
+  sensitive          BOOLEAN NOT NULL DEFAULT false,
+  source             JSONB NOT NULL DEFAULT '{}'::jsonb,
+  subject_user_ids   UUID[],
+  targets            TEXT[],
+  label_count        INT NOT NULL DEFAULT 0,
+  media              JSONB,
+  output             TEXT,
+  created_at         TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS lt_label_jobs_created_idx ON lt_label_jobs (created_at DESC);
+CREATE INDEX IF NOT EXISTS lt_label_jobs_requester_idx ON lt_label_jobs (requested_by, created_at DESC);
+CREATE INDEX IF NOT EXISTS lt_label_jobs_subjects_idx ON lt_label_jobs USING GIN (subject_user_ids);

package/build/lib/db/schemas/045_label_job_delivery.sql

@@ -0,0 +1,14 @@
+-- Migration 045: delivery stamps on the label ledger
+--
+-- A job sent through a printer transport is recorded first, then delivered.
+-- delivery_claimed_at is a short lease one process takes before sending, so
+-- a retried request (same idempotency key) re-sends only an undelivered job
+-- whose lease has lapsed: never twice at once, never lost after a crash
+-- between record and send. delivered_at is stamped once the transport
+-- accepts. These two columns are the only ones the platform updates.
+
+ALTER TABLE lt_label_jobs
+  ADD COLUMN IF NOT EXISTS delivery_claimed_at TIMESTAMPTZ,
+  ADD COLUMN IF NOT EXISTS delivered_at TIMESTAMPTZ;
+
+CREATE INDEX IF NOT EXISTS lt_label_jobs_template_idx ON lt_label_jobs (template_name, created_at DESC);