@hotmeshio/long-tail 0.31.1 → 0.32.0

package/build/api/escalations/create.js

@@ -38,6 +38,7 @@ const escalationService = __importStar(require("../../services/escalation"));
 const roleService = __importStar(require("../../services/role"));
 const schema_validator_1 = require("../../services/role/schema-validator");
 const escalation_1 = require("../../types/escalation");
+const capabilities_1 = require("../../modules/capabilities");
 const helpers_1 = require("./helpers");
 // ── Create ────────────────────────────────────────────────────────────────
 /**
@@ -80,15 +81,20 @@ async function createEscalation(input, auth) {
         // stamped here — omitting it means the resolve UI renders the role's latest
         // form at fetch time.
         const metadata = input.metadata ?? {};
-        // Lookup refs ride the envelope under a reserved key with a fixed
-        // contract: version required — a ref pins an immutable knowledge edition,
-        // never a moving target.
+        // Lookup and file refs ride the envelope under reserved keys with fixed
+        // contracts, checked before the row exists.
+        let carriesFiles = false;
         if (input.envelope) {
             try {
                 const envelopeObj = JSON.parse(input.envelope);
-                if (envelopeObj && typeof envelopeObj === 'object'
-                    && envelopeObj[escalation_1.ESCALATION_ENVELOPE_KEYS.LOOKUPS] !== undefined) {
-                    (0, escalation_1.assertLookupRefs)(envelopeObj[escalation_1.ESCALATION_ENVELOPE_KEYS.LOOKUPS]);
+                if (envelopeObj && typeof envelopeObj === 'object') {
+                    if (envelopeObj[escalation_1.ESCALATION_ENVELOPE_KEYS.LOOKUPS] !== undefined) {
+                        (0, escalation_1.assertLookupRefs)(envelopeObj[escalation_1.ESCALATION_ENVELOPE_KEYS.LOOKUPS]);
+                    }
+                    if (envelopeObj[escalation_1.ESCALATION_ENVELOPE_KEYS.FILES] !== undefined) {
+                        (0, escalation_1.assertFileRefs)(envelopeObj[escalation_1.ESCALATION_ENVELOPE_KEYS.FILES]);
+                        carriesFiles = true;
+                    }
                 }
             }
             catch (refErr) {
@@ -98,6 +104,11 @@ async function createEscalation(input, auth) {
                 return { status: 400, error: refErr.message };
             }
         }
+        // A file ref grants every reader of the row a link to that object, so
+        // naming one takes the same authority as reading storage directly.
+        if (carriesFiles && !(await (0, capabilities_1.mayBuild)(auth))) {
+            return { status: 403, error: 'Referencing stored files takes builder access (superadmin or engineer)' };
+        }
         const metadataSchema = await roleService.getRoleMetadataSchema(role);
         if (metadataSchema) {
             let validate;

package/build/api/escalations/files.d.ts

@@ -0,0 +1,18 @@
+import type { LTApiResult, LTApiAuth } from '../../types/sdk';
+/**
+ * Sign an escalation's stored files.
+ *
+ * The refs on `envelope.files` ARE the grant: any user who may read the
+ * escalation receives a time-limited link to exactly the files it names,
+ * nothing else in storage. A link lives for the ref's `expiresIn` (else the
+ * default), stretched to cover the reader's own live claim, within the
+ * configured bounds. A ref that is malformed or cannot be signed answers
+ * with `error`; the batch never fails.
+ *
+ * @param input.id: escalation UUID
+ * @param auth: authenticated user context (must hold the escalation's role)
+ * @returns `{ status: 200, data: { files: [{ as, path, name, contentType, url?, expiresAt?, error? }] } }`
+ */
+export declare function getEscalationFiles(input: {
+    id: string;
+}, auth: LTApiAuth): Promise<LTApiResult>;

package/build/api/escalations/files.js

@@ -0,0 +1,73 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getEscalationFiles = getEscalationFiles;
+const escalationService = __importStar(require("../../services/escalation"));
+const file_links_1 = require("../../services/escalation/file-links");
+const helpers_1 = require("./helpers");
+/**
+ * Sign an escalation's stored files.
+ *
+ * The refs on `envelope.files` ARE the grant: any user who may read the
+ * escalation receives a time-limited link to exactly the files it names,
+ * nothing else in storage. A link lives for the ref's `expiresIn` (else the
+ * default), stretched to cover the reader's own live claim, within the
+ * configured bounds. A ref that is malformed or cannot be signed answers
+ * with `error`; the batch never fails.
+ *
+ * @param input.id: escalation UUID
+ * @param auth: authenticated user context (must hold the escalation's role)
+ * @returns `{ status: 200, data: { files: [{ as, path, name, contentType, url?, expiresAt?, error? }] } }`
+ */
+async function getEscalationFiles(input, auth) {
+    try {
+        const escalation = await escalationService.getEscalation(input.id);
+        if (!escalation) {
+            return { status: 404, error: 'Escalation not found' };
+        }
+        const denied = await (0, helpers_1.assertReadAccess)(auth.userId, escalation);
+        if (denied)
+            return denied;
+        const refs = (0, file_links_1.readFileRefs)(escalation.envelope);
+        if (refs.length === 0) {
+            return { status: 200, data: { files: [] } };
+        }
+        const files = await (0, file_links_1.signFileRefs)(refs, (0, file_links_1.claimSecondsLeft)(escalation, auth.userId));
+        return { status: 200, data: { files } };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}

package/build/api/escalations/index.d.ts

@@ -2,6 +2,7 @@ export { createEscalation } from './create';
 export { listEscalations, listAvailableEscalations, listDistinctTypes, listFacetKeys, listFacetValues, getEscalationStats, getStationMetrics } from './list';
 export { getEscalation, getEscalationsByWorkflowId, escalateToRole } from './single';
 export { getEscalationLookups } from './lookups';
+export { getEscalationFiles } from './files';
 export { claimEscalation, releaseEscalation } from './claim';
 export { releaseExpiredClaims, updatePriority, bulkClaim, bulkAssign, bulkUnassign, bulkEscalate, bulkTriage } from './bulk';
 export { resolveEscalation, resolveBySignalKey, resolveByIds, resolveAllOrNone } from './resolve';

package/build/api/escalations/index.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.claimGroups = exports.searchByFacets = exports.bulkCancel = exports.cancelSingleEscalation = exports.resolveByMetadata = exports.claimByMetadata = exports.findByMetadata = exports.itemsView = exports.getEscalationItemsBySignalKey = exports.getEscalationItems = exports.removeItemByMetadata = exports.removeItemBySignalKey = exports.removeItem = exports.accumulateItemByMetadata = exports.accumulateItemBySignalKey = exports.accumulateItem = exports.ROSTER_SCAN_OUTCOMES = exports.runRosterScan = exports.ROSTER_ACTION_OUTCOMES = exports.runRosterAction = exports.unflagBatchItem = exports.flagBatchItem = exports.resolveBatchItemByMetadata = exports.resolveBatchItemBySignalKey = exports.resolveBatchItem = exports.resolveAllOrNone = exports.resolveByIds = exports.resolveBySignalKey = exports.resolveEscalation = exports.bulkTriage = exports.bulkEscalate = exports.bulkUnassign = exports.bulkAssign = exports.bulkClaim = exports.updatePriority = exports.releaseExpiredClaims = exports.releaseEscalation = exports.claimEscalation = exports.getEscalationLookups = exports.escalateToRole = exports.getEscalationsByWorkflowId = exports.getEscalation = exports.getStationMetrics = exports.getEscalationStats = exports.listFacetValues = exports.listFacetKeys = exports.listDistinctTypes = exports.listAvailableEscalations = exports.listEscalations = exports.createEscalation = void 0;
-exports.getRelatedRows = exports.getRelatedAggregates = exports.timelineByFacet = exports.aggregateByFacets = exports.claimByFacets = void 0;
+exports.searchByFacets = exports.bulkCancel = exports.cancelSingleEscalation = exports.resolveByMetadata = exports.claimByMetadata = exports.findByMetadata = exports.itemsView = exports.getEscalationItemsBySignalKey = exports.getEscalationItems = exports.removeItemByMetadata = exports.removeItemBySignalKey = exports.removeItem = exports.accumulateItemByMetadata = exports.accumulateItemBySignalKey = exports.accumulateItem = exports.ROSTER_SCAN_OUTCOMES = exports.runRosterScan = exports.ROSTER_ACTION_OUTCOMES = exports.runRosterAction = exports.unflagBatchItem = exports.flagBatchItem = exports.resolveBatchItemByMetadata = exports.resolveBatchItemBySignalKey = exports.resolveBatchItem = exports.resolveAllOrNone = exports.resolveByIds = exports.resolveBySignalKey = exports.resolveEscalation = exports.bulkTriage = exports.bulkEscalate = exports.bulkUnassign = exports.bulkAssign = exports.bulkClaim = exports.updatePriority = exports.releaseExpiredClaims = exports.releaseEscalation = exports.claimEscalation = exports.getEscalationFiles = exports.getEscalationLookups = exports.escalateToRole = exports.getEscalationsByWorkflowId = exports.getEscalation = exports.getStationMetrics = exports.getEscalationStats = exports.listFacetValues = exports.listFacetKeys = exports.listDistinctTypes = exports.listAvailableEscalations = exports.listEscalations = exports.createEscalation = void 0;
+exports.getRelatedRows = exports.getRelatedAggregates = exports.timelineByFacet = exports.aggregateByFacets = exports.claimByFacets = exports.claimGroups = void 0;
 var create_1 = require("./create");
 Object.defineProperty(exports, "createEscalation", { enumerable: true, get: function () { return create_1.createEscalation; } });
 var list_1 = require("./list");
@@ -18,6 +18,8 @@ Object.defineProperty(exports, "getEscalationsByWorkflowId", { enumerable: true,
 Object.defineProperty(exports, "escalateToRole", { enumerable: true, get: function () { return single_1.escalateToRole; } });
 var lookups_1 = require("./lookups");
 Object.defineProperty(exports, "getEscalationLookups", { enumerable: true, get: function () { return lookups_1.getEscalationLookups; } });
+var files_1 = require("./files");
+Object.defineProperty(exports, "getEscalationFiles", { enumerable: true, get: function () { return files_1.getEscalationFiles; } });
 var claim_1 = require("./claim");
 Object.defineProperty(exports, "claimEscalation", { enumerable: true, get: function () { return claim_1.claimEscalation; } });
 Object.defineProperty(exports, "releaseEscalation", { enumerable: true, get: function () { return claim_1.releaseEscalation; } });

package/build/api/escalations/metadata.js

@@ -176,12 +176,13 @@ async function resolveByMetadata(input, auth) {
         // writing; the payload validates here, then a second asserted pass claims
         // + resolves the same row with pending re-checked inside the statement.
         const enforcing = await (0, enforcement_cache_1.getEnforcingRoles)();
-        const outcome = { ...input.metadata, resolved_by: auth.userId };
+        let outcome = { ...input.metadata, resolved_by: auth.userId };
         let result = await escalationService.resolveByMetadataAtomic(input.key, input.value, resolveUserId, input.resolverPayload, outcome, writeAllRoles, writeSelfRoles, enforcing.size > 0 ? [...enforcing] : null, input.assertId ?? null, input.extraFacets, input.availability);
         if (result.outcome === 'validation_required' && result.row) {
-            const report = await (0, resolver_validation_1.checkResolverPayload)(result.row, input.resolverPayload, undefined, resolveUserId);
-            if (report)
-                return (0, resolve_1.validationFailure)(report);
+            const { violation, facets } = await (0, resolver_validation_1.assessResolverPayload)(result.row, input.resolverPayload, undefined, resolveUserId);
+            if (violation)
+                return (0, resolve_1.validationFailure)(violation);
+            outcome = { ...input.metadata, ...facets, resolved_by: auth.userId };
             result = await escalationService.resolveByMetadataAtomic(input.key, input.value, resolveUserId, input.resolverPayload, outcome, writeAllRoles, writeSelfRoles, null, result.row.id, input.extraFacets, input.availability);
             // The asserted row left pending between the two passes — a concurrent
             // resolution won the row; surface it as the conflict it is.

package/build/api/escalations/resolve.js

@@ -100,7 +100,7 @@ async function resolveEscalation(input, auth) {
         // the escalation's resolved form schema BEFORE any resolution path runs.
         // Costs nothing when the role does not enforce (cached role set); the
         // task-fallback envelope read only happens for enforcing roles.
-        const violation = await (0, resolver_validation_1.checkResolverPayload)(escalation, resolverPayload, () => reconstructEnvelope(escalation), auth.userId);
+        const { violation, facets } = await (0, resolver_validation_1.assessResolverPayload)(escalation, resolverPayload, () => reconstructEnvelope(escalation), auth.userId);
         if (violation)
             return validationFailure(violation);
         // The resolver payload is stored exactly as submitted — its shape is the
@@ -111,8 +111,10 @@ async function resolveEscalation(input, auth) {
         // `resolved_by` merges into the row's GIN-indexed metadata inside the same
         // atomic resolve, making "who resolved it" `@>`-queryable without a
         // follow-up read.
+        // Review facets (x-lt-confidence facets) are computed by the server, so
+        // they win over a caller's metadata of the same name.
         const resolvedBy = await resolverIdentity(auth);
-        const outcome = { ...metadata, resolved_by: auth.userId };
+        const outcome = { ...metadata, ...facets, resolved_by: auth.userId };
         // `outcome` (the outcome patch) is never written separately — it rides WITH the
         // resolverPayload to whichever path performs the resolve, so it merges inside the
         // single status='pending'-guarded UPDATE (HotMesh `resolve(metadata)`). Paths that
@@ -183,7 +185,7 @@ async function resolveBySignalKey(input, auth) {
             return { status: 404, error: 'Escalation not found' };
         // Schema enforcement — the row (envelope included) is already loaded, so
         // this costs zero extra reads beyond the cached schema.
-        const violation = await (0, resolver_validation_1.checkResolverPayload)(escalation, resolverPayload, undefined, auth.userId);
+        const { violation, facets } = await (0, resolver_validation_1.assessResolverPayload)(escalation, resolverPayload, undefined, auth.userId);
         if (violation)
             return validationFailure(violation);
         // The payload is delivered as the signal the parked workflow's condition()
@@ -191,7 +193,7 @@ async function resolveBySignalKey(input, auth) {
         // Same provenance contract as the interactive path: identity on the signal,
         // resolved_by in the row metadata.
         const resolvedBy = await resolverIdentity(auth);
-        const outcome = { ...metadata, resolved_by: auth.userId };
+        const outcome = { ...metadata, ...facets, resolved_by: auth.userId };
         return resolveViaSignalKey(escalation, resolverPayload, outcome, undefined, resolvedBy);
     }
     catch (err) {

package/build/bin/ltc.js

@@ -210,7 +210,7 @@ escCmd.command('claim-by-facets')
     .option('--json', 'JSON output')
     .action(wrap(esc.claimByFacets));
 escCmd.command('aggregate-facets')
-    .description('Grouped analytics over escalation intervals: membership at an instant, or dwell over a window')
+    .description('Grouped analytics over escalation intervals: membership at an instant, dwell over a window, or rows resolved in a window')
     .option('--role <role>', 'Single pond role')
     .option('--roles <json>', 'Multiple roles, JSON array (no role at all = every pond; global principals only)')
     .option('--entity <key>', "Entity facet key (e.g. serialNumber) — scopes to every role declaring it (the entity's system)")
@@ -223,7 +223,9 @@ escCmd.command('aggregate-facets')
     .option('--group-facets <list>', 'Comma-separated metadata keys to group by')
     .option('--as-of <iso>', 'Membership at this ISO instant (default: now; past reconstructs the live set then)')
     .option('--window <json>', 'Dwell window {"from":"...","to":"..."} — switches the measure to dwell')
-    .option('--distinct-by <key>', 'Count DISTINCT of this facet (entities, not rows; membership only)')
+    .option('--resolved <json>', 'Count rows resolved in this window {"from":"...","to":"..."}; needs a role scope')
+    .option('--bucket <unit>', 'With --resolved: count per day, week or month (UTC)')
+    .option('--distinct-by <key>', 'Count DISTINCT of this facet (entities, not rows; membership and resolved)')
     .option('--live-statuses <list>', 'Comma-separated statuses considered live (default: pending)')
     .option('--order-by <json>', 'Result-group order, JSON array e.g. \'[{"field":"count","direction":"desc"}]\'')
     .option('--limit <n>', 'Max result groups')

package/build/index.d.ts

@@ -4,6 +4,8 @@ export { registerLT, createLTInterceptor } from './services/interceptor';
 export { createLTActivityInterceptor } from './services/interceptor/activity-interceptor';
 export { executeLT } from './services/orchestrator';
 export { conditional, conditionLT, conditionalAccumulator } from './services/orchestrator/condition';
+export { readConfidenceSpec, buildFormReview, summarizeReview, differsFromProposal, trancheFor, CONFIDENCE_TONES, type ConfidenceSpec, type ConfidenceTranche, type FieldReview, } from './shared/form-validation/x-lt-confidence';
+export { buildReviewFacets, REVIEW_FACET_KEYS, REVIEW_OUTCOMES, type ReviewFacets, } from './shared/form-validation/x-lt-confidence-facets';
 export type { ConditionEscalationConfig, ConditionAccumulatorConfig } from './services/orchestrator/condition';
 export type { ExecuteLTOptions } from './services/orchestrator/types';
 export { JwtAuthAdapter, createAuthMiddleware, requireAuth, requireAdmin, signToken, setAuthAdapter } from './modules/auth';

package/build/index.js

@@ -36,8 +36,8 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.loggerRegistry = exports.HoneycombTelemetryAdapter = exports.telemetryRegistry = exports.jsPermissions = exports.renderNatsConf = exports.NatsMessagingProvider = exports.labelTransportRegistry = exports.DELIVERY = exports.MemoryMessagingProvider = exports.messagingRegistry = exports.publishKnowledgeEvent = exports.publishAgentEvent = exports.publishWorkflowEvent = exports.publishActivityEvent = exports.publishEscalationEvent = exports.publishTaskEvent = exports.publishMilestoneEvent = exports.SocketIOEventAdapter = exports.InMemoryEventAdapter = exports.NatsEventAdapter = exports.eventRegistry = exports.ltConfig = exports.seedConfigTopics = exports.seedSystemTopics = exports.TopicService = exports.displayGtin = exports.normalizeGtin = exports.isValidGtin = exports.assertValidScanIdentityRule = exports.assertValidScanSteps = exports.assertValidScanScheme = exports.UserService = exports.ConfigService = exports.EscalationService = exports.TaskService = exports.setAuthAdapter = exports.signToken = exports.requireAdmin = exports.requireAuth = exports.createAuthMiddleware = exports.JwtAuthAdapter = exports.conditionalAccumulator = exports.conditionLT = exports.conditional = exports.executeLT = exports.createLTActivityInterceptor = exports.createLTInterceptor = exports.registerLT = exports.midnightTheme = exports.start = void 0;
-exports.LTExpressAdapter = exports.Machines = exports.api = exports.KnowledgeApi = exports.resolveCredential = exports.mimeFromPath = exports.getStorageBackend = exports.listOAuthConnections = exports.getFreshAccessToken = exports.createClient = exports.CallbackEventAdapter = exports.builtinMcpServerFactories = exports.getSystemAgents = exports.getSystemWorkers = exports.registerMcpTool = exports.getToolContext = exports.getActivityIdentity = exports.McpEscalationStrategy = exports.DefaultEscalationStrategy = exports.escalationStrategyRegistry = exports.McpVisionServer = exports.McpTranslationServer = exports.McpServer = exports.McpClient = exports.McpService = exports.BuiltInMcpAdapter = exports.mcpRegistry = exports.defaultMaintenanceConfig = exports.maintenanceRegistry = exports.PinoLoggerAdapter = void 0;
+exports.messagingRegistry = exports.publishKnowledgeEvent = exports.publishAgentEvent = exports.publishWorkflowEvent = exports.publishActivityEvent = exports.publishEscalationEvent = exports.publishTaskEvent = exports.publishMilestoneEvent = exports.SocketIOEventAdapter = exports.InMemoryEventAdapter = exports.NatsEventAdapter = exports.eventRegistry = exports.ltConfig = exports.seedConfigTopics = exports.seedSystemTopics = exports.TopicService = exports.displayGtin = exports.normalizeGtin = exports.isValidGtin = exports.assertValidScanIdentityRule = exports.assertValidScanSteps = exports.assertValidScanScheme = exports.UserService = exports.ConfigService = exports.EscalationService = exports.TaskService = exports.setAuthAdapter = exports.signToken = exports.requireAdmin = exports.requireAuth = exports.createAuthMiddleware = exports.JwtAuthAdapter = exports.REVIEW_OUTCOMES = exports.REVIEW_FACET_KEYS = exports.buildReviewFacets = exports.CONFIDENCE_TONES = exports.trancheFor = exports.differsFromProposal = exports.summarizeReview = exports.buildFormReview = exports.readConfidenceSpec = exports.conditionalAccumulator = exports.conditionLT = exports.conditional = exports.executeLT = exports.createLTActivityInterceptor = exports.createLTInterceptor = exports.registerLT = exports.midnightTheme = exports.start = void 0;
+exports.LTExpressAdapter = exports.Machines = exports.api = exports.KnowledgeApi = exports.resolveCredential = exports.mimeFromPath = exports.getStorageBackend = exports.listOAuthConnections = exports.getFreshAccessToken = exports.createClient = exports.CallbackEventAdapter = exports.builtinMcpServerFactories = exports.getSystemAgents = exports.getSystemWorkers = exports.registerMcpTool = exports.getToolContext = exports.getActivityIdentity = exports.McpEscalationStrategy = exports.DefaultEscalationStrategy = exports.escalationStrategyRegistry = exports.McpVisionServer = exports.McpTranslationServer = exports.McpServer = exports.McpClient = exports.McpService = exports.BuiltInMcpAdapter = exports.mcpRegistry = exports.defaultMaintenanceConfig = exports.maintenanceRegistry = exports.PinoLoggerAdapter = exports.loggerRegistry = exports.HoneycombTelemetryAdapter = exports.telemetryRegistry = exports.jsPermissions = exports.renderNatsConf = exports.NatsMessagingProvider = exports.labelTransportRegistry = exports.DELIVERY = exports.MemoryMessagingProvider = void 0;
 const config_1 = require("./modules/config");
 const logger_1 = require("./lib/logger");
 const midnight_1 = require("./themes/midnight");
@@ -60,6 +60,17 @@ var condition_1 = require("./services/orchestrator/condition");
 Object.defineProperty(exports, "conditional", { enumerable: true, get: function () { return condition_1.conditional; } });
 Object.defineProperty(exports, "conditionLT", { enumerable: true, get: function () { return condition_1.conditionLT; } });
 Object.defineProperty(exports, "conditionalAccumulator", { enumerable: true, get: function () { return condition_1.conditionalAccumulator; } });
+var x_lt_confidence_1 = require("./shared/form-validation/x-lt-confidence");
+Object.defineProperty(exports, "readConfidenceSpec", { enumerable: true, get: function () { return x_lt_confidence_1.readConfidenceSpec; } });
+Object.defineProperty(exports, "buildFormReview", { enumerable: true, get: function () { return x_lt_confidence_1.buildFormReview; } });
+Object.defineProperty(exports, "summarizeReview", { enumerable: true, get: function () { return x_lt_confidence_1.summarizeReview; } });
+Object.defineProperty(exports, "differsFromProposal", { enumerable: true, get: function () { return x_lt_confidence_1.differsFromProposal; } });
+Object.defineProperty(exports, "trancheFor", { enumerable: true, get: function () { return x_lt_confidence_1.trancheFor; } });
+Object.defineProperty(exports, "CONFIDENCE_TONES", { enumerable: true, get: function () { return x_lt_confidence_1.CONFIDENCE_TONES; } });
+var x_lt_confidence_facets_1 = require("./shared/form-validation/x-lt-confidence-facets");
+Object.defineProperty(exports, "buildReviewFacets", { enumerable: true, get: function () { return x_lt_confidence_facets_1.buildReviewFacets; } });
+Object.defineProperty(exports, "REVIEW_FACET_KEYS", { enumerable: true, get: function () { return x_lt_confidence_facets_1.REVIEW_FACET_KEYS; } });
+Object.defineProperty(exports, "REVIEW_OUTCOMES", { enumerable: true, get: function () { return x_lt_confidence_facets_1.REVIEW_OUTCOMES; } });
 var auth_1 = require("./modules/auth");
 Object.defineProperty(exports, "JwtAuthAdapter", { enumerable: true, get: function () { return auth_1.JwtAuthAdapter; } });
 Object.defineProperty(exports, "createAuthMiddleware", { enumerable: true, get: function () { return auth_1.createAuthMiddleware; } });

package/build/lib/cli/commands/escalations.d.ts

@@ -80,6 +80,8 @@ export declare function aggregateByFacets(opts: {
     groupState?: boolean;
     asOf?: string;
     window?: string;
+    resolved?: string;
+    bucket?: string;
     distinctBy?: string;
     liveStatuses?: string;
     orderBy?: string;

package/build/lib/cli/commands/escalations.js

@@ -236,6 +236,7 @@ async function claimByFacets(opts) {
 }
 // --- Analytics commands -------------------------------------------------------
 const AGG_COLUMNS = [
+    { key: 'bucket', label: 'Bucket', width: 12, format: (v) => (v ? String(v).slice(0, 10) : '') },
     { key: 'state', label: 'State', width: 16 },
     { key: 'role', label: 'Role', width: 16 },
     { key: 'subtype', label: 'Subtype', width: 16 },
@@ -275,10 +276,17 @@ async function aggregateByFacets(opts) {
         groupBy.facets = opts.groupFacets.split(',').map((s) => s.trim());
     if (opts.groupState)
         groupBy.state = true;
-    // --window switches the measure to dwell; otherwise membership (at --as-of, default now).
-    const measure = opts.window
-        ? { kind: 'dwell', window: parseJsonOption('--window', opts.window) }
-        : { kind: 'membership', ...(opts.asOf ? { asOf: opts.asOf } : {}) };
+    // --resolved counts rows resolved in a window, --window measures dwell;
+    // otherwise membership (at --as-of, default now).
+    if (opts.resolved && opts.window)
+        throw new Error('Use one of --resolved (rows resolved) or --window (dwell)');
+    if (opts.bucket && !opts.resolved)
+        throw new Error('--bucket applies to --resolved');
+    const measure = opts.resolved
+        ? { kind: 'resolved', window: parseJsonOption('--resolved', opts.resolved), ...(opts.bucket ? { bucket: opts.bucket } : {}) }
+        : opts.window
+            ? { kind: 'dwell', window: parseJsonOption('--window', opts.window) }
+            : { kind: 'membership', ...(opts.asOf ? { asOf: opts.asOf } : {}) };
     const body = { query, groupBy, measure };
     if (opts.distinctBy)
         body.distinctBy = opts.distinctBy;

package/build/lib/storage/s3.js

@@ -99,6 +99,7 @@ class S3StorageBackend {
             Bucket: this.bucket,
             Key: normalizeKey(key),
             Body: data,
+            ContentType: (0, mime_1.mimeFromPath)(key),
             ...(options?.sha256 ? { Metadata: { [SHA256_METADATA]: options.sha256 } } : {}),
         }));
         return { ref: key, size: data.length };

package/build/modules/config.d.ts

@@ -38,9 +38,18 @@ export declare const config: {
     ROLE_ENFORCEMENT_CACHE_TTL_MS: number;
     LT_ANALYTICS_MAX_GROUPS: number;
     LT_ANALYTICS_MAX_WINDOW_DAYS: number;
+    LT_ANALYTICS_MAX_RESOLVED_WINDOW_DAYS: number;
     LT_ANALYTICS_CACHE_TTL_MS: number;
     LT_ANALYTICS_PAST_CACHE_TTL_MS: number;
     LT_ANALYTICS_CACHE_MAX_ENTRIES: number;
+    /**
+     * Escalation file links: the default signed-link lifetime, and its bounds.
+     * A ref's expiresIn and the reader's live claim stretch the link within
+     * these bounds; nothing signs past the max.
+     */
+    LT_ESCALATION_FILE_URL_TTL_SECONDS: number;
+    LT_ESCALATION_FILE_URL_MIN_SECONDS: number;
+    LT_ESCALATION_FILE_URL_MAX_SECONDS: number;
     /** Identity keys (badge tokens) leave user reads and need credentialIssuer to write. `false` keeps the earlier behavior. */
     LT_PROTECT_IDENTITY_KEYS: boolean;
     /** Label sheets: the media a job prints on when neither the job nor the template names one. */

package/build/modules/config.js

@@ -64,9 +64,18 @@ exports.config = {
     // live longer; MAX_ENTRIES LRU-bounds the past cache.
     LT_ANALYTICS_MAX_GROUPS: parseInt(process.env.LT_ANALYTICS_MAX_GROUPS || '5000', 10),
     LT_ANALYTICS_MAX_WINDOW_DAYS: parseInt(process.env.LT_ANALYTICS_MAX_WINDOW_DAYS || '35', 10),
+    LT_ANALYTICS_MAX_RESOLVED_WINDOW_DAYS: parseInt(process.env.LT_ANALYTICS_MAX_RESOLVED_WINDOW_DAYS || '366', 10),
     LT_ANALYTICS_CACHE_TTL_MS: parseInt(process.env.LT_ANALYTICS_CACHE_TTL_MS || '30000', 10),
     LT_ANALYTICS_PAST_CACHE_TTL_MS: parseInt(process.env.LT_ANALYTICS_PAST_CACHE_TTL_MS || '600000', 10),
     LT_ANALYTICS_CACHE_MAX_ENTRIES: parseInt(process.env.LT_ANALYTICS_CACHE_MAX_ENTRIES || '512', 10),
+    /**
+     * Escalation file links: the default signed-link lifetime, and its bounds.
+     * A ref's expiresIn and the reader's live claim stretch the link within
+     * these bounds; nothing signs past the max.
+     */
+    LT_ESCALATION_FILE_URL_TTL_SECONDS: positiveInt('LT_ESCALATION_FILE_URL_TTL_SECONDS', 900),
+    LT_ESCALATION_FILE_URL_MIN_SECONDS: positiveInt('LT_ESCALATION_FILE_URL_MIN_SECONDS', 60),
+    LT_ESCALATION_FILE_URL_MAX_SECONDS: positiveInt('LT_ESCALATION_FILE_URL_MAX_SECONDS', 14400),
     /** Identity keys (badge tokens) leave user reads and need credentialIssuer to write. `false` keeps the earlier behavior. */
     LT_PROTECT_IDENTITY_KEYS: process.env.LT_PROTECT_IDENTITY_KEYS !== 'false',
     /** Label sheets: the media a job prints on when neither the job nor the template names one. */

package/build/routes/escalations/single.js

@@ -67,6 +67,17 @@ function registerSingleRoutes(router) {
         const result = await api.getEscalationLookups({ id: req.params.id }, req.auth);
         res.status(result.status).json(result.data ?? { error: result.error });
     });
+    /**
+     * GET /api/escalations/:id/files
+     * Sign the escalation's stored files. The refs on the row are the grant:
+     * readers of the escalation receive time-limited links to exactly the
+     * files it names.
+     */
+    router.get('/:id/files', async (req, res) => {
+        const result = await api.getEscalationFiles({ id: req.params.id }, req.auth);
+        res.set('Cache-Control', 'no-store');
+        res.status(result.status).json(result.data ?? { error: result.error });
+    });
     /**
      * GET /api/escalations/:id
      * Get a single escalation by ID.

package/build/sdk/index.d.ts

@@ -131,6 +131,9 @@ export declare function createClient(options?: LTClientOptions): {
         getLookups: (input: {
             id: string;
         }, auth?: LTApiAuth) => Promise<LTApiResult<any>>;
+        getFiles: (input: {
+            id: string;
+        }, auth?: LTApiAuth) => Promise<LTApiResult<any>>;
         getByWorkflowId: typeof escalationsApi.getEscalationsByWorkflowId;
         escalate: (input: {
             id: string;
@@ -537,6 +540,7 @@ export declare function createClient(options?: LTClientOptions): {
         getMetadata: typeof filesApi.getFileMetadata;
         delete: typeof filesApi.deleteFile;
         generateSignedUrl: typeof filesApi.generateSignedUrl;
+        upload: typeof filesApi.uploadFile;
     };
     knowledge: {
         listDomains: typeof knowledgeApi.listDomains;

package/build/sdk/index.js

@@ -125,6 +125,7 @@ function createClient(options = {}) {
             getStationMetrics: bindAuth(escalationsApi.getStationMetrics, auth),
             get: bindAuth(escalationsApi.getEscalation, auth),
             getLookups: bindAuth(escalationsApi.getEscalationLookups, auth),
+            getFiles: bindAuth(escalationsApi.getEscalationFiles, auth),
             getByWorkflowId: escalationsApi.getEscalationsByWorkflowId,
             escalate: bindAuth(escalationsApi.escalateToRole, auth),
             claim: bindAuth(escalationsApi.claimEscalation, auth),
@@ -361,6 +362,7 @@ function createClient(options = {}) {
             getMetadata: filesApi.getFileMetadata,
             delete: filesApi.deleteFile,
             generateSignedUrl: filesApi.generateSignedUrl,
+            upload: filesApi.uploadFile,
         },
         // ── Knowledge ─────────────────────────────────────────────────────────
         knowledge: {

package/build/services/escalation/aggregate-resolved-sql.d.ts

@@ -0,0 +1,19 @@
+import type { AnalyticsWindow, ResolvedBucket } from '../../types';
+/** The bucket, validated against the closed set; it inlines into date_trunc. */
+export declare function resolveBucket(bucket: unknown): ResolvedBucket | null;
+export declare function buildResolvedAggregate(input: {
+    window: AnalyticsWindow;
+    bucket: ResolvedBucket | null;
+    where: string;
+    params: unknown[];
+    groupSelect: string[];
+    groupKeys: string[];
+    order: string;
+    distinctBy?: string;
+    pageLimit: number;
+    offset: number;
+}): {
+    sql: string;
+    params: unknown[];
+    nowAnchored: boolean;
+};

package/build/services/escalation/aggregate-resolved-sql.js

@@ -0,0 +1,57 @@
+"use strict";
+// ---------------------------------------------------------------------------
+// The resolved measure: rows resolved within a half-open window, counted per
+// group and optionally per UTC calendar bucket. `status = 'resolved'` inlines
+// as a literal and the role scope is required, so the planner reads the
+// role-led idx_hmsh_esc_resolved_cover range (role, resolved_at) instead of
+// sweeping every queue's history. Cost grows with the rows resolved in the
+// window for the scoped roles.
+// ---------------------------------------------------------------------------
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveBucket = resolveBucket;
+exports.buildResolvedAggregate = buildResolvedAggregate;
+const config_1 = require("../../modules/config");
+const aggregate_validate_1 = require("./aggregate-validate");
+const types_1 = require("../../types");
+/** The bucket, validated against the closed set; it inlines into date_trunc. */
+function resolveBucket(bucket) {
+    if (bucket === undefined)
+        return null;
+    if (!types_1.RESOLVED_BUCKETS.includes(bucket)) {
+        throw new aggregate_validate_1.AnalyticsInputError(`measure.bucket "${String(bucket)}" is not one of ${types_1.RESOLVED_BUCKETS.join(', ')}`);
+    }
+    return bucket;
+}
+function buildResolvedAggregate(input) {
+    const win = (0, aggregate_validate_1.resolveWindow)(input.window, 'measure.window', {
+        days: config_1.config.LT_ANALYTICS_MAX_RESOLVED_WINDOW_DAYS,
+        envVar: 'LT_ANALYTICS_MAX_RESOLVED_WINDOW_DAYS',
+    });
+    if (!win)
+        throw new aggregate_validate_1.AnalyticsInputError('measure.window is required for resolved');
+    const { params } = input;
+    params.push(win.from.toISOString());
+    const fromP = `$${params.length}::timestamptz`;
+    params.push(win.to.toISOString());
+    const toP = `$${params.length}::timestamptz`;
+    const select = [...input.groupSelect];
+    const keys = [...input.groupKeys];
+    if (input.bucket) {
+        select.unshift(`(date_trunc('${input.bucket}', resolved_at AT TIME ZONE 'UTC') AT TIME ZONE 'UTC') AS bucket`);
+        keys.unshift('bucket');
+    }
+    const countExpr = input.distinctBy
+        ? `count(DISTINCT (metadata->>'${input.distinctBy}'))::int`
+        : 'count(*)::int';
+    const groupBySql = keys.length ? `GROUP BY ${keys.join(', ')}\n` : '';
+    params.push(input.pageLimit + 1, input.offset);
+    const sql = `SELECT ${[...select, `${countExpr} AS "count"`, 'count(*)::int AS sample_count'].join(',\n       ')}
+FROM public.lt_escalations
+WHERE ${input.where}
+  AND status = 'resolved'
+  AND resolved_at >= ${fromP}
+  AND resolved_at < ${toP}
+${groupBySql}ORDER BY ${input.order}
+LIMIT $${params.length - 1} OFFSET $${params.length}`;
+    return { sql, params, nowAnchored: win.nowAnchored };
+}

package/build/services/escalation/aggregate-sql.d.ts

@@ -9,10 +9,13 @@ export interface BuiltAggregateQuery {
     facets: string[];
     /** true when grouped by the derived state label (groupBy.state). */
     stateGrouped: boolean;
-    measureKind: 'membership' | 'dwell';
+    measureKind: AggregateMeasureKind;
+    /** true when the resolved measure groups by calendar bucket. */
+    bucketed: boolean;
     /** true = the anchor touches now (short cache); false = fully past (immutable). */
     nowAnchored: boolean;
 }
+export type AggregateMeasureKind = 'membership' | 'dwell' | 'resolved';
 /** Per-role state naming, from lt_roles.entity_state_source. */
 export type StateSources = Record<string, 'role' | 'subtype'>;
 export interface BuiltTimelineQuery {
@@ -23,6 +26,8 @@ export interface BuiltTimelineQuery {
     facets: string[];
     nowAnchored: boolean;
 }
+/** The projected-facet output alias; the key is FACET_KEY-validated. */
+export declare function facetAlias(key: string): string;
 /**
  * Build the grouped aggregate (membership or dwell) as one parameterized
  * query. `query.entity` must be RESOLVED by the caller before building