@hotmeshio/long-tail 0.5.12 → 0.6.0

package/build/api/escalations/list.js

@@ -35,11 +35,21 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.listEscalations = listEscalations;
 exports.listAvailableEscalations = listAvailableEscalations;
+exports.listFacetKeys = listFacetKeys;
 exports.listDistinctTypes = listDistinctTypes;
 exports.getEscalationStats = getEscalationStats;
 const escalationService = __importStar(require("../../services/escalation"));
 const helpers_1 = require("./helpers");
-// ── List routes ────────────────────────────────────────────────────────────
+/** True when the caller asked for anything the plain list path can't express. */
+function hasFacetQuery(i) {
+    return !!(i.facets ||
+        i.block?.length ||
+        i.range?.length ||
+        i.exists?.length ||
+        i.orderBy?.length ||
+        i.roles?.length ||
+        i.available != null);
+}
 /**
  * List escalations with optional filters.
  *
@@ -61,10 +71,40 @@ const helpers_1 = require("./helpers");
  */
 async function listEscalations(input, auth) {
     try {
-        const visibleRoles = await (0, helpers_1.getVisibleRoles)(auth.userId);
-        if (visibleRoles && visibleRoles.length === 0) {
+        const scope = await (0, helpers_1.getEscalationReadScope)(auth.userId);
+        if (!scope.global && scope.allRoles.length === 0 && scope.selfRoles.length === 0) {
             return { status: 200, data: { escalations: [], total: 0 } };
         }
+        // Faceted path: the read-scope predicate composes with the full FacetQuery
+        // language (facets/block/range/exists/metadata-sort) IN SQL — the caller's
+        // role(s) can only NARROW within their scope, never widen past it.
+        if (hasFacetQuery(input)) {
+            const result = await escalationService.searchEscalationsFaceted({
+                global: scope.global,
+                visibleRoles: scope.global ? undefined : scope.allRoles,
+                selfRoles: scope.global ? undefined : scope.selfRoles,
+                meUserId: auth.userId,
+                facet: {
+                    role: input.role,
+                    roles: input.roles,
+                    status: input.status,
+                    available: input.available ?? (input.claimed ? false : undefined),
+                    facets: input.facets,
+                    block: input.block,
+                    range: input.range,
+                    exists: input.exists,
+                    orderBy: input.orderBy,
+                },
+                type: input.type,
+                subtype: input.subtype,
+                priority: input.priority,
+                assigned_to: input.assigned_to,
+                search: input.search,
+                limit: input.limit ?? 50,
+                offset: input.offset ?? 0,
+            });
+            return { status: 200, data: result };
+        }
         const result = await escalationService.listEscalations({
             status: input.status,
             role: input.role,
@@ -78,7 +118,9 @@ async function listEscalations(input, auth) {
             sort_by: input.sort_by,
             order: input.order,
             search: input.search,
-            visibleRoles,
+            visibleRoles: scope.global ? undefined : scope.allRoles,
+            selfRoles: scope.global ? undefined : scope.selfRoles,
+            meUserId: auth.userId,
         });
         return { status: 200, data: result };
     }
@@ -105,10 +147,37 @@ async function listEscalations(input, auth) {
  */
 async function listAvailableEscalations(input, auth) {
     try {
-        const visibleRoles = await (0, helpers_1.getVisibleRoles)(auth.userId);
-        if (visibleRoles && visibleRoles.length === 0) {
+        const scope = await (0, helpers_1.getEscalationReadScope)(auth.userId);
+        if (!scope.global && scope.allRoles.length === 0 && scope.selfRoles.length === 0) {
             return { status: 200, data: { escalations: [], total: 0 } };
         }
+        // Faceted path — same as listEscalations but pinned to the available pool.
+        if (hasFacetQuery(input)) {
+            const result = await escalationService.searchEscalationsFaceted({
+                global: scope.global,
+                visibleRoles: scope.global ? undefined : scope.allRoles,
+                selfRoles: scope.global ? undefined : scope.selfRoles,
+                meUserId: auth.userId,
+                facet: {
+                    role: input.role,
+                    roles: input.roles,
+                    status: 'pending',
+                    available: true,
+                    facets: input.facets,
+                    block: input.block,
+                    range: input.range,
+                    exists: input.exists,
+                    orderBy: input.orderBy,
+                },
+                type: input.type,
+                subtype: input.subtype,
+                priority: input.priority,
+                search: input.search,
+                limit: input.limit ?? 50,
+                offset: input.offset ?? 0,
+            });
+            return { status: 200, data: result };
+        }
         const result = await escalationService.listAvailableEscalations({
             role: input.role,
             type: input.type,
@@ -119,7 +188,9 @@ async function listAvailableEscalations(input, auth) {
             sort_by: input.sort_by,
             order: input.order,
             search: input.search,
-            visibleRoles,
+            visibleRoles: scope.global ? undefined : scope.allRoles,
+            selfRoles: scope.global ? undefined : scope.selfRoles,
+            meUserId: auth.userId,
         });
         return { status: 200, data: result };
     }
@@ -127,6 +198,31 @@ async function listAvailableEscalations(input, auth) {
         return { status: 500, error: err.message };
     }
 }
+/**
+ * List the distinct top-level metadata facet KEYS visible to the caller. Powers the
+ * faceted-query UI's key autocomplete — only keys that actually exist in the caller's
+ * (role-scoped) escalations are offered, never description-only text.
+ *
+ * @returns `{ status: 200, data: { keys: string[] } }`
+ */
+async function listFacetKeys(_input, auth) {
+    try {
+        const scope = await (0, helpers_1.getEscalationReadScope)(auth.userId);
+        if (!scope.global && scope.allRoles.length === 0 && scope.selfRoles.length === 0) {
+            return { status: 200, data: { keys: [] } };
+        }
+        const keys = await escalationService.listFacetKeys({
+            global: scope.global,
+            visibleRoles: scope.global ? undefined : scope.allRoles,
+            selfRoles: scope.global ? undefined : scope.selfRoles,
+            meUserId: auth.userId,
+        });
+        return { status: 200, data: { keys } };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}
 /**
  * List all distinct escalation type values.
  *
@@ -150,8 +246,11 @@ async function listDistinctTypes() {
  */
 async function getEscalationStats(input, auth) {
     try {
-        const visibleRoles = await (0, helpers_1.getVisibleRoles)(auth.userId);
-        if (visibleRoles && visibleRoles.length === 0) {
+        // Aggregate stats reflect read_all roles only. read_self memberships get the
+        // single-item surface (auto user-mode), not a queue-overview dashboard, so
+        // their items are deliberately not aggregated here (and not leaked in counts).
+        const scope = await (0, helpers_1.getEscalationReadScope)(auth.userId);
+        if (!scope.global && scope.allRoles.length === 0) {
             return {
                 status: 200,
                 data: {
@@ -164,7 +263,7 @@ async function getEscalationStats(input, auth) {
                 },
             };
         }
-        const stats = await escalationService.getEscalationStats(visibleRoles, input.period);
+        const stats = await escalationService.getEscalationStats(scope.global ? undefined : scope.allRoles, input.period);
         return { status: 200, data: stats };
     }
     catch (err) {

package/build/api/escalations/metadata.js

@@ -37,7 +37,6 @@ exports.findByMetadata = findByMetadata;
 exports.claimByMetadata = claimByMetadata;
 exports.resolveByMetadata = resolveByMetadata;
 const escalationService = __importStar(require("../../services/escalation"));
-const userService = __importStar(require("../../services/user"));
 const helpers_1 = require("./helpers");
 /**
  * Find escalations by a metadata key-value pair.
@@ -50,14 +49,14 @@ async function findByMetadata(input, auth) {
         if (!input.key || !input.value) {
             return { status: 400, error: 'key and value are required' };
         }
-        const result = await escalationService.findByMetadata(input.key, input.value, input.status, input.limit, input.offset);
-        // RBAC: scope to visible roles
-        const visibleRoles = await (0, helpers_1.getVisibleRoles)(auth.userId);
-        if (visibleRoles) {
-            const roleSet = new Set(visibleRoles);
-            result.escalations = result.escalations.filter(e => roleSet.has(e.role));
-            result.total = result.escalations.length;
-        }
+        // RBAC scoped IN SQL: the caller's read scope (read_all roles see every match;
+        // read_self roles see only matches assigned to them) reaches the scoped query's
+        // WHERE and COUNT. Global access → no filter. Never filter a fetched page
+        // controller-side — that shrinks the page and reports a wrong total.
+        const scope = await (0, helpers_1.getEscalationReadScope)(auth.userId);
+        const result = await escalationService.findByMetadata(input.key, input.value, input.status, input.limit, input.offset, scope.global
+            ? undefined
+            : { allRoles: scope.allRoles, selfRoles: scope.selfRoles, meUserId: auth.userId });
         return { status: 200, data: result };
     }
     catch (err) {
@@ -80,8 +79,12 @@ async function claimByMetadata(input, auth) {
         if ('error' in resolved)
             return resolved.error;
         const claimUserId = resolved.userId;
-        // Resolve allowed roles: null = global access (no filter), string[] = scoped
-        const allowedRoles = await resolveAllowedRoles(auth.userId);
+        // Write-scope: global → no filter; otherwise restrict to write_all roles. The
+        // SDK claim-by-metadata uses a flat role filter and cannot enforce write_self
+        // ownership, so self-scope members are excluded from this path (their items
+        // are pre-claimed and acted on by id).
+        const writeScope = await (0, helpers_1.getEscalationWriteScope)(auth.userId);
+        const allowedRoles = writeScope.global ? null : writeScope.allRoles;
         const result = await escalationService.claimByMetadata(input.key, input.value, claimUserId, input.durationMinutes, input.metadata, allowedRoles);
         if (!result) {
             // No rows matched. Check if candidates existed (role mismatch vs no match).
@@ -120,8 +123,14 @@ async function resolveByMetadata(input, auth) {
         if ('error' in resolved)
             return resolved.error;
         const resolveUserId = resolved.userId;
-        const allowedRoles = await resolveAllowedRoles(auth.userId);
-        const result = await escalationService.resolveByMetadataAtomic(input.key, input.value, resolveUserId, input.resolverPayload, input.metadata, allowedRoles);
+        // Write-scope folds into the atomic resolve SQL: global → no filter; otherwise
+        // write_all roles match any item, write_self roles match only items assigned
+        // to the resolver. A non-global caller cannot pass a foreign assignee, so the
+        // self-branch (assigned_to = resolveUserId) is the caller's own items.
+        const writeScope = await (0, helpers_1.getEscalationWriteScope)(auth.userId);
+        const writeAllRoles = writeScope.global ? null : writeScope.allRoles;
+        const writeSelfRoles = writeScope.global ? null : writeScope.selfRoles;
+        const result = await escalationService.resolveByMetadataAtomic(input.key, input.value, resolveUserId, input.resolverPayload, input.metadata, writeAllRoles, writeSelfRoles);
         if (result.outcome === 'not_found') {
             return { status: 404, error: 'No pending escalation found for this metadata, or insufficient role permissions' };
         }
@@ -161,17 +170,3 @@ async function resolveByMetadata(input, auth) {
         return { status: 500, error: err.message };
     }
 }
-// ── Helpers ──────────────────────────────────────────────────────────────────
-/**
- * Resolve the set of roles the caller is allowed to act on.
- * Returns null for global access (superadmin/admin), or string[] for scoped users.
- */
-async function resolveAllowedRoles(userId) {
-    if (await userService.hasGlobalEscalationAccess(userId))
-        return null;
-    const userRoles = await userService.getUserRoles(userId);
-    // Return the user's roles (may be empty → SQL filters out all rows).
-    // System/service accounts that need unrestricted access should be
-    // seeded with the superadmin role via start({ seed: { admin } }).
-    return userRoles.map(r => r.role);
-}

package/build/api/escalations/resolve.d.ts

@@ -15,7 +15,8 @@ import type { LTApiResult, LTApiAuth } from '../../types/sdk';
 export declare function resolveEscalation(input: {
     id: string;
     resolverPayload: Record<string, any>;
-}, _auth: LTApiAuth): Promise<LTApiResult>;
+    metadata?: Record<string, any>;
+}, auth: LTApiAuth): Promise<LTApiResult>;
 /**
  * Resolve an efficient (atomic) escalation directly by its `signal_key` and
  * resume the waiting workflow in place. For webhook callers that know the
@@ -25,4 +26,21 @@ export declare function resolveEscalation(input: {
 export declare function resolveBySignalKey(input: {
     signalKey: string;
     resolverPayload: Record<string, any>;
+    metadata?: Record<string, any>;
+}, auth: LTApiAuth): Promise<LTApiResult>;
+/**
+ * Resolve a SET of escalations by id in one guarded statement (the public,
+ * set-based sibling of {@link resolveEscalation}). Delegates to the SDK's
+ * `client.resolveMany` via the service layer.
+ *
+ * RBAC: a scoped caller may only resolve rows whose role they hold. `role` is
+ * immutable per escalation, so this authorization read (`getEscalationRoles`)
+ * does not race the guarded `resolveMany` that follows — and global principals
+ * skip it entirely. Use for bookkeeping rows woken collectively; it does NOT
+ * deliver per-row signals (see services `resolveEscalationsByIds`).
+ */
+export declare function resolveByIds(input: {
+    ids: string[];
+    resolverPayload: Record<string, any>;
+    metadata?: Record<string, any>;
 }, auth: LTApiAuth): Promise<LTApiResult>;

package/build/api/escalations/resolve.js

@@ -35,6 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveEscalation = resolveEscalation;
 exports.resolveBySignalKey = resolveBySignalKey;
+exports.resolveByIds = resolveByIds;
 const escalationService = __importStar(require("../../services/escalation"));
 const taskService = __importStar(require("../../services/task"));
 const escalation_strategy_1 = require("../../services/escalation-strategy");
@@ -57,9 +58,9 @@ const helpers_1 = require("./helpers");
  * Password fields in the resolver payload are replaced with ephemeral
  * tokens (15-minute TTL) so plaintext never enters the signal store.
  */
-async function resolveEscalation(input, _auth) {
+async function resolveEscalation(input, auth) {
     try {
-        const { id, resolverPayload } = input;
+        const { id, resolverPayload, metadata } = input;
         if (!resolverPayload) {
             return { status: 400, error: 'resolverPayload is required' };
         }
@@ -70,22 +71,38 @@ async function resolveEscalation(input, _auth) {
             return { status: 409, error: 'Escalation is cancelled' };
         if (escalation.status !== 'pending')
             return { status: 409, error: 'Escalation not available for resolution' };
+        // Hybrid RBAC for resolve ("ack", a write verb). Non-disclosure first: an
+        // escalation the caller cannot even SEE returns 404 (matches resolveBySignalKey —
+        // do not reveal out-of-scope rows). One they CAN see but cannot act on returns an
+        // informative 403 (e.g. a write_self owner whose item isn't assigned to them).
+        // Global access bypasses both.
+        if (await (0, helpers_1.assertReadAccess)(auth.userId, escalation)) {
+            return { status: 404, error: 'Escalation not found' };
+        }
+        const denied = await (0, helpers_1.assertWriteAccess)(auth.userId, escalation);
+        if (denied)
+            return denied;
+        // `metadata` (the outcome patch) is never written separately — it rides WITH the
+        // resolverPayload to whichever path performs the resolve, so it merges inside the
+        // single status='pending'-guarded UPDATE (HotMesh `resolve(metadata)`). Paths that
+        // resolve here pass it as the 3rd arg; paths that resume a workflow carry it on the
+        // signal so the downstream resolve commits it atomically.
         // Path A: conditionLT signal
         const metadataSignalId = escalation.metadata?.signal_id;
         if (metadataSignalId && escalation.workflow_id && escalation.task_queue && escalation.workflow_type) {
-            return resolveViaConditionSignal(escalation, resolverPayload);
+            return resolveViaConditionSignal(escalation, resolverPayload, metadata);
         }
         // Path B: waitFor signal routing
         const signalRouting = escalation.metadata?.signal_routing;
         if (signalRouting?.signalId) {
-            return resolveViaSignalRouting(escalation, resolverPayload);
+            return resolveViaSignalRouting(escalation, resolverPayload, metadata);
         }
         // Path 0: efficient (atomic) escalation — signal_key resumes in place.
         // The row was written inside the workflow's Leg1 checkpoint via
         // `condition(signalId, config)`. The SDK's resolve marks it resolved AND
         // delivers the signal to `signal_key`, resuming THIS job — no re-run.
         if (escalation.signal_key) {
-            return resolveViaSignalKey(escalation, resolverPayload);
+            return resolveViaSignalKey(escalation, resolverPayload, metadata);
         }
         // Path C: escalation strategy may redirect to triage
         const envelope = await reconstructEnvelope(escalation);
@@ -93,16 +110,16 @@ async function resolveEscalation(input, _auth) {
         if (strategy) {
             const directive = await strategy.onResolution({ escalation, resolverPayload, envelope });
             if (directive.action === 'triage') {
-                return resolveViaTriage(escalation, resolverPayload, directive.triageEnvelope);
+                return resolveViaTriage(escalation, resolverPayload, directive.triageEnvelope, metadata);
             }
         }
-        // Path D: notification-only — no workflow to restart
+        // Path D: notification-only — no workflow to restart. One atomic resolve.
         if (!escalation.workflow_type || !escalation.task_queue) {
-            await escalationService.resolveEscalation(escalation.id, resolverPayload);
+            await escalationService.resolveEscalation(escalation.id, resolverPayload, metadata);
             return { status: 200, data: { acknowledged: true, escalationId: escalation.id } };
         }
         // Path E: standard re-run
-        return resolveViaRerun(escalation, envelope, resolverPayload);
+        return resolveViaRerun(escalation, envelope, resolverPayload, metadata);
     }
     catch (err) {
         return { status: 500, error: err.message };
@@ -116,7 +133,7 @@ async function resolveEscalation(input, _auth) {
  */
 async function resolveBySignalKey(input, auth) {
     try {
-        const { signalKey, resolverPayload } = input;
+        const { signalKey, resolverPayload, metadata } = input;
         if (!signalKey)
             return { status: 400, error: 'signalKey is required' };
         if (!resolverPayload)
@@ -126,11 +143,52 @@ async function resolveBySignalKey(input, auth) {
             return { status: 404, error: 'Escalation not found' };
         if (escalation.status !== 'pending')
             return { status: 409, error: 'Escalation not available for resolution' };
-        const visibleRoles = await (0, helpers_1.getVisibleRoles)(auth.userId);
-        if (visibleRoles && !visibleRoles.includes(escalation.role)) {
+        // Resolve is a write verb — scope-gate it (write_self may resolve only its own item).
+        const denied = await (0, helpers_1.assertWriteAccess)(auth.userId, escalation);
+        if (denied)
             return { status: 404, error: 'Escalation not found' };
+        return resolveViaSignalKey(escalation, resolverPayload, metadata);
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}
+/**
+ * Resolve a SET of escalations by id in one guarded statement (the public,
+ * set-based sibling of {@link resolveEscalation}). Delegates to the SDK's
+ * `client.resolveMany` via the service layer.
+ *
+ * RBAC: a scoped caller may only resolve rows whose role they hold. `role` is
+ * immutable per escalation, so this authorization read (`getEscalationRoles`)
+ * does not race the guarded `resolveMany` that follows — and global principals
+ * skip it entirely. Use for bookkeeping rows woken collectively; it does NOT
+ * deliver per-row signals (see services `resolveEscalationsByIds`).
+ */
+async function resolveByIds(input, auth) {
+    try {
+        const { ids, resolverPayload, metadata } = input;
+        if (!Array.isArray(ids) || ids.length === 0) {
+            return { status: 400, error: 'ids must be a non-empty array' };
         }
-        return resolveViaSignalKey(escalation, resolverPayload);
+        if (!resolverPayload)
+            return { status: 400, error: 'resolverPayload is required' };
+        // Bulk resolve ("ack") is a write verb, gated PER ITEM: write_all roles may
+        // resolve any item in the role; write_self roles may resolve only items assigned
+        // to the caller (same rule single-resolve applies via assertWriteAccess). Global
+        // bypasses. A missing id or any out-of-scope item → 404 (non-disclosure), and
+        // nothing is resolved.
+        const writeScope = await (0, helpers_1.getEscalationWriteScope)(auth.userId);
+        if (!writeScope.global) {
+            const allSet = new Set(writeScope.allRoles);
+            const selfSet = new Set(writeScope.selfRoles);
+            const rows = await escalationService.getEscalationScopeRows(ids);
+            const writable = (r) => allSet.has(r.role) || (selfSet.has(r.role) && r.assigned_to === auth.userId);
+            if (rows.length !== ids.length || !rows.every(writable)) {
+                return { status: 404, error: 'One or more escalations not found' };
+            }
+        }
+        const resolved = await escalationService.resolveEscalationsByIds(ids, resolverPayload, metadata);
+        return { status: 200, data: { resolved: resolved.length, escalationIds: resolved.map((e) => e.id) } };
     }
     catch (err) {
         return { status: 500, error: err.message };
@@ -138,11 +196,18 @@ async function resolveBySignalKey(input, auth) {
 }
 // ── Resolution paths ─────────────────────────────────────────────────────
 /** Path A: lightweight conditionLT signal — inject $escalation_id and signal the running workflow. */
-async function resolveViaConditionSignal(escalation, resolverPayload) {
+async function resolveViaConditionSignal(escalation, resolverPayload, metadata) {
     const signalId = escalation.metadata.signal_id;
     const client = (0, workers_1.createClient)();
     const handle = await client.workflow.getHandle(escalation.task_queue, escalation.workflow_type, escalation.workflow_id);
-    await handle.signal(signalId, { ...resolverPayload, $escalation_id: escalation.id });
+    // The row is resolved downstream by the workflow's `conditionLT` → `ltResolveEscalation`.
+    // Carry the outcome patch on the signal ($escalation_metadata, symmetric to $escalation_id)
+    // so it merges inside that single atomic resolve — never a separate write here.
+    await handle.signal(signalId, {
+        ...resolverPayload,
+        $escalation_id: escalation.id,
+        ...(metadata ? { $escalation_metadata: metadata } : {}),
+    });
     // Event published by service layer (services/escalation/crud.ts)
     return signaledResult(escalation, escalation.workflow_id);
 }
@@ -152,9 +217,11 @@ async function resolveViaConditionSignal(escalation, resolverPayload) {
  * transaction, so the original job resumes in place (no re-run, no separate
  * resolve activity). Password fields are redacted before they enter the signal.
  */
-async function resolveViaSignalKey(escalation, resolverPayload) {
+async function resolveViaSignalKey(escalation, resolverPayload, metadata) {
     const signalPayload = await redactPasswords(resolverPayload, escalation.metadata?.form_schema);
-    const resolved = await escalationService.resolveEscalation(escalation.id, signalPayload);
+    // One atomic call: status→resolved, signal delivered, and the outcome patch merged
+    // into the GIN-indexed metadata — all inside the single WHERE-guarded UPDATE.
+    const resolved = await escalationService.resolveEscalation(escalation.id, signalPayload, metadata);
     if (!resolved) {
         return { status: 409, error: 'Escalation not available for resolution' };
     }
@@ -162,15 +229,18 @@ async function resolveViaSignalKey(escalation, resolverPayload) {
     return signaledResult(escalation, escalation.workflow_id || '');
 }
 /** Path B: waitFor signal escalation — signal via YAML engine or Durable handle. */
-async function resolveViaSignalRouting(escalation, resolverPayload) {
+async function resolveViaSignalRouting(escalation, resolverPayload, metadata) {
     const signalRouting = escalation.metadata.signal_routing;
     const signalPayload = await redactPasswords(resolverPayload, escalation.metadata?.form_schema);
     if (signalRouting.engine === 'yaml' && signalRouting.hookTopic && signalRouting.appId) {
+        // YAML resolves transactionally inside the workflow — carry the patch on the signal
+        // so it commits with that resolve, never as a separate write.
         const engine = await (0, deployer_1.getEngine)(signalRouting.appId);
         await engine.signal(signalRouting.hookTopic, {
             ...signalPayload,
             escalationId: escalation.id,
             job_id: signalRouting.jobId,
+            ...(metadata ? { $escalation_metadata: metadata } : {}),
         });
     }
     else if (signalRouting.workflowId) {
@@ -178,16 +248,25 @@ async function resolveViaSignalRouting(escalation, resolverPayload) {
         const handle = await client.workflow.getHandle(signalRouting.taskQueue, signalRouting.workflowType, signalRouting.workflowId);
         await handle.signal(signalRouting.signalId, signalPayload);
     }
-    // YAML workflows resolve transactionally inside the workflow; only resolve here for Durable
+    // Durable resolves here — one atomic call carries the outcome patch.
+    // Persist the SAME redacted payload that was delivered to the signal: the raw
+    // resolverPayload (with plaintext passwords) must never land in resolver_payload.
+    // Ordering is crash-safe-forward: the signal is delivered BEFORE this resolve, so a
+    // crash in between leaves the row `pending` and a retry re-signals (a no-op to an
+    // already-resumed workflow) then resolves — never a resolved row with a stuck workflow.
     if (signalRouting.engine !== 'yaml') {
-        await escalationService.resolveEscalation(escalation.id, resolverPayload);
+        await escalationService.resolveEscalation(escalation.id, signalPayload, metadata);
     }
     // Event published by service layer (services/escalation/crud.ts)
     return signaledResult(escalation, signalRouting.workflowId || signalRouting.appId);
 }
 /** Path C: escalation strategy directed triage — start a triage workflow. */
-async function resolveViaTriage(escalation, resolverPayload, triageEnvelope) {
-    const triageWorkflowId = `triage-${escalation.id}-${Date.now()}`;
+async function resolveViaTriage(escalation, resolverPayload, triageEnvelope, metadata) {
+    // Deterministic id: an escalation is terminal-once, so `triage-<id>` is unique for
+    // its lifetime. A retry after a mid-saga crash re-targets the SAME job key (HotMesh
+    // upserts jobs by (workflowId, app_id)) instead of spawning a duplicate triage —
+    // and the final resolve below is the `status='pending'`-guarded arbiter.
+    const triageWorkflowId = `triage-${escalation.id}`;
     const client = (0, workers_1.createClient)();
     await taskService.createTask({
         workflow_id: triageWorkflowId,
@@ -212,7 +291,7 @@ async function resolveViaTriage(escalation, resolverPayload, triageEnvelope) {
     await escalationService.resolveEscalation(escalation.id, {
         ...resolverPayload,
         _lt: { ...resolverPayload._lt, triaged: true, triageWorkflowId },
-    });
+    }, metadata);
     // Event published by service layer (services/escalation/crud.ts)
     return {
         status: 200,
@@ -220,10 +299,16 @@ async function resolveViaTriage(escalation, resolverPayload, triageEnvelope) {
     };
 }
 /** Path E: standard re-run — inject resolver data and restart the original workflow. */
-async function resolveViaRerun(escalation, envelope, resolverPayload) {
+async function resolveViaRerun(escalation, envelope, resolverPayload, metadata) {
     envelope.resolver = resolverPayload;
-    envelope.lt = { ...envelope.lt, escalationId: escalation.id };
-    const newWorkflowId = `rerun-${escalation.id}-${Date.now()}`;
+    // Carry the outcome patch on the rerun envelope so the downstream resolve (when the
+    // re-run completes) commits it atomically — not a separate write to the old row.
+    envelope.lt = { ...envelope.lt, escalationId: escalation.id, escalationMetadata: metadata };
+    // Deterministic id (see resolveViaTriage): `rerun-<id>` is unique per escalation
+    // lifetime, so a retry re-targets the same job rather than spawning a duplicate
+    // re-run. The old escalation is resolved downstream by the interceptor when the
+    // re-run executes (services/interceptor/lifecycle.ts), which is `pending`-guarded.
+    const newWorkflowId = `rerun-${escalation.id}`;
     const client = (0, workers_1.createClient)();
     await client.workflow.start({
         workflowName: escalation.workflow_type,

package/build/api/escalations/single.js

@@ -37,7 +37,6 @@ exports.getEscalation = getEscalation;
 exports.getEscalationsByWorkflowId = getEscalationsByWorkflowId;
 exports.escalateToRole = escalateToRole;
 const escalationService = __importStar(require("../../services/escalation"));
-const userService = __importStar(require("../../services/user"));
 const roleService = __importStar(require("../../services/role"));
 const helpers_1 = require("./helpers");
 // ── Single-escalation routes ───────────────────────────────────────────────
@@ -56,13 +55,9 @@ async function getEscalation(input, auth) {
         if (!escalation) {
             return { status: 404, error: 'Escalation not found' };
         }
-        const hasGlobal = await (0, helpers_1.hasGlobalEscalationAccess)(auth.userId);
-        if (!hasGlobal) {
-            const userHasRole = await userService.hasRole(auth.userId, escalation.role);
-            if (!userHasRole) {
-                return { status: 403, error: 'Not authorized to view this escalation' };
-            }
-        }
+        const denied = await (0, helpers_1.assertReadAccess)(auth.userId, escalation);
+        if (denied)
+            return denied;
         return { status: 200, data: escalation };
     }
     catch (err) {
@@ -108,6 +103,11 @@ async function escalateToRole(input, auth) {
         if (escalation.status !== 'pending') {
             return { status: 409, error: 'Escalation is not pending' };
         }
+        // Escalating routes the item to another role — a queue-management verb that
+        // self-scope owners and read-only members may not perform.
+        const manageDenied = await (0, helpers_1.assertQueueManageAccess)(auth.userId, escalation.role);
+        if (manageDenied)
+            return manageDenied;
         const canEscalate = await roleService.canEscalateTo(auth.userId, escalation.role, targetRole);
         if (!canEscalate) {
             return { status: 403, error: 'Not authorized to escalate to this role' };

package/build/api/users.d.ts

@@ -6,6 +6,7 @@ import type { LTRoleType } from '../types';
  * @param input.role — filter by role name
  * @param input.roleType — filter by role type (superadmin, admin, member)
  * @param input.status — filter by user status
+ * @param input.search — free-text match on display name, email, or external_id
  * @param input.limit — maximum number of users to return
  * @param input.offset — number of users to skip for pagination
  * @returns `{ status: 200, data: User[] }` on success
@@ -14,6 +15,7 @@ export declare function listUsers(input: {
     role?: string;
     roleType?: LTRoleType;
     status?: string;
+    search?: string;
     limit?: number;
     offset?: number;
 }): Promise<LTApiResult>;
@@ -47,6 +49,8 @@ export declare function createUser(input: {
     roles?: {
         role: string;
         type: string;
+        read_scope?: string;
+        write_scope?: string;
     }[];
     metadata?: Record<string, any>;
 }): Promise<LTApiResult>;
@@ -103,6 +107,8 @@ export declare function addUserRole(input: {
     id: string;
     role: string;
     type: string;
+    read_scope?: string;
+    write_scope?: string;
 }): Promise<LTApiResult>;
 /**
  * Remove a role from a user. Requires admin privileges.