@hotmeshio/long-tail 0.6.2 → 0.7.0

package/build/api/escalations/create.js

@@ -32,10 +32,32 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createEscalation = createEscalation;
+const ajv_1 = __importDefault(require("ajv"));
 const escalationService = __importStar(require("../../services/escalation"));
+const roleService = __importStar(require("../../services/role"));
 const helpers_1 = require("./helpers");
+// strict: false — role metadata_schemas use the project's house extension
+// keywords (x-lt-widget etc., the same style as seeded form_schemas); Ajv 8's
+// strict mode throws at compile on any unknown keyword, which would turn every
+// metadata-bearing create for that role into a 500.
+const ajv = new ajv_1.default({ allErrors: true, strict: false });
+// Compiled validators cached per role, keyed by the schema's serialized form
+// so an admin's schema edit invalidates the stale validator on the next create.
+const validatorCache = new Map();
+function compileRoleValidator(role, schema) {
+    const key = JSON.stringify(schema);
+    const cached = validatorCache.get(role);
+    if (cached && cached.key === key)
+        return cached.validate;
+    const validate = ajv.compile(schema);
+    validatorCache.set(role, { key, validate });
+    return validate;
+}
 // ── Create ────────────────────────────────────────────────────────────────
 /**
  * Create a standalone escalation (not tied to a workflow).
@@ -70,6 +92,29 @@ async function createEscalation(input, auth) {
         if (denied) {
             return { status: 403, error: `You must have write access to the "${role}" role or be a superadmin to create escalations for it` };
         }
+        // Validate metadata against the role's declared schema (if any).
+        if (input.metadata) {
+            const schema = await roleService.getRoleMetadataSchema(role);
+            if (schema) {
+                let validate;
+                try {
+                    validate = compileRoleValidator(role, schema);
+                }
+                catch (compileErr) {
+                    // A broken stored schema is the role admin's bug, not the creator's —
+                    // name it explicitly instead of surfacing an opaque 500.
+                    return {
+                        status: 422,
+                        error: `metadata_schema for role "${role}" is not a valid JSON Schema: ${compileErr.message}`,
+                    };
+                }
+                const valid = validate(input.metadata);
+                if (!valid) {
+                    const msgs = (validate.errors ?? []).map((e) => `${e.instancePath || '(root)'} ${e.message}`).join('; ');
+                    return { status: 400, error: `metadata does not match the role schema: ${msgs}` };
+                }
+            }
+        }
         const escalation = await escalationService.createEscalation({
             type,
             subtype: input.subtype ?? type,

package/build/api/escalations/index.d.ts

@@ -1,5 +1,5 @@
 export { createEscalation } from './create';
-export { listEscalations, listAvailableEscalations, listDistinctTypes, listFacetKeys, getEscalationStats } from './list';
+export { listEscalations, listAvailableEscalations, listDistinctTypes, listFacetKeys, getEscalationStats, getStationMetrics } from './list';
 export { getEscalation, getEscalationsByWorkflowId, escalateToRole } from './single';
 export { claimEscalation, releaseEscalation } from './claim';
 export { releaseExpiredClaims, updatePriority, bulkClaim, bulkAssign, bulkEscalate, bulkTriage } from './bulk';

package/build/api/escalations/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.claimByFacets = exports.claimGroups = exports.searchByFacets = exports.bulkCancel = exports.cancelSingleEscalation = exports.resolveByMetadata = exports.claimByMetadata = exports.findByMetadata = exports.resolveByIds = exports.resolveBySignalKey = exports.resolveEscalation = exports.bulkTriage = exports.bulkEscalate = exports.bulkAssign = exports.bulkClaim = exports.updatePriority = exports.releaseExpiredClaims = exports.releaseEscalation = exports.claimEscalation = exports.escalateToRole = exports.getEscalationsByWorkflowId = exports.getEscalation = exports.getEscalationStats = exports.listFacetKeys = exports.listDistinctTypes = exports.listAvailableEscalations = exports.listEscalations = exports.createEscalation = void 0;
+exports.claimByFacets = exports.claimGroups = exports.searchByFacets = exports.bulkCancel = exports.cancelSingleEscalation = exports.resolveByMetadata = exports.claimByMetadata = exports.findByMetadata = exports.resolveByIds = exports.resolveBySignalKey = exports.resolveEscalation = exports.bulkTriage = exports.bulkEscalate = exports.bulkAssign = exports.bulkClaim = exports.updatePriority = exports.releaseExpiredClaims = exports.releaseEscalation = exports.claimEscalation = exports.escalateToRole = exports.getEscalationsByWorkflowId = exports.getEscalation = exports.getStationMetrics = exports.getEscalationStats = exports.listFacetKeys = exports.listDistinctTypes = exports.listAvailableEscalations = exports.listEscalations = exports.createEscalation = void 0;
 var create_1 = require("./create");
 Object.defineProperty(exports, "createEscalation", { enumerable: true, get: function () { return create_1.createEscalation; } });
 var list_1 = require("./list");
@@ -9,6 +9,7 @@ Object.defineProperty(exports, "listAvailableEscalations", { enumerable: true, g
 Object.defineProperty(exports, "listDistinctTypes", { enumerable: true, get: function () { return list_1.listDistinctTypes; } });
 Object.defineProperty(exports, "listFacetKeys", { enumerable: true, get: function () { return list_1.listFacetKeys; } });
 Object.defineProperty(exports, "getEscalationStats", { enumerable: true, get: function () { return list_1.getEscalationStats; } });
+Object.defineProperty(exports, "getStationMetrics", { enumerable: true, get: function () { return list_1.getStationMetrics; } });
 var single_1 = require("./single");
 Object.defineProperty(exports, "getEscalation", { enumerable: true, get: function () { return single_1.getEscalation; } });
 Object.defineProperty(exports, "getEscalationsByWorkflowId", { enumerable: true, get: function () { return single_1.getEscalationsByWorkflowId; } });

package/build/api/escalations/list.d.ts

@@ -95,3 +95,6 @@ export declare function listDistinctTypes(): Promise<LTApiResult>;
 export declare function getEscalationStats(input: {
     period?: string;
 }, auth: LTApiAuth): Promise<LTApiResult>;
+export declare function getStationMetrics(input: {
+    period?: string;
+}, auth: LTApiAuth): Promise<LTApiResult>;

package/build/api/escalations/list.js

@@ -38,6 +38,7 @@ exports.listAvailableEscalations = listAvailableEscalations;
 exports.listFacetKeys = listFacetKeys;
 exports.listDistinctTypes = listDistinctTypes;
 exports.getEscalationStats = getEscalationStats;
+exports.getStationMetrics = getStationMetrics;
 const escalationService = __importStar(require("../../services/escalation"));
 const helpers_1 = require("./helpers");
 /** True when the caller asked for anything the plain list path can't express. */
@@ -270,3 +271,16 @@ async function getEscalationStats(input, auth) {
         return { status: 500, error: err.message };
     }
 }
+async function getStationMetrics(input, auth) {
+    try {
+        const scope = await (0, helpers_1.getEscalationReadScope)(auth.userId);
+        if (!scope.global && scope.allRoles.length === 0) {
+            return { status: 200, data: { stations: [] } };
+        }
+        const stations = await escalationService.getStationMetrics(scope.global ? undefined : scope.allRoles, input.period);
+        return { status: 200, data: { stations } };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}

package/build/api/roles.d.ts

@@ -75,6 +75,23 @@ export declare function replaceEscalationTargets(input: {
     role: string;
     targets: string[];
 }): Promise<LTApiResult>;
+/**
+ * Update role metadata. Fields omitted from input are left unchanged.
+ * form_schema, metadata_schema, and parent_role can be set to null to clear them.
+ */
+export declare function updateRole(input: {
+    role: string;
+    title?: string | null;
+    description?: string | null;
+    form_schema?: Record<string, any> | null;
+    metadata_schema?: Record<string, any> | null;
+    properties?: Record<string, any> | null;
+    ops_visible?: boolean;
+    parent_role?: string | null;
+    sla_minutes?: number | null;
+    target_per_hour?: number | null;
+    worker_count?: number | null;
+}): Promise<LTApiResult>;
 /**
  * Delete a role from the system. Requires admin privileges.
  *

package/build/api/roles.js

@@ -41,6 +41,7 @@ exports.addEscalationChain = addEscalationChain;
 exports.removeEscalationChain = removeEscalationChain;
 exports.getEscalationTargets = getEscalationTargets;
 exports.replaceEscalationTargets = replaceEscalationTargets;
+exports.updateRole = updateRole;
 exports.deleteRole = deleteRole;
 const roleService = __importStar(require("../services/role"));
 /**
@@ -195,6 +196,51 @@ async function replaceEscalationTargets(input) {
         return { status: 500, error: err.message };
     }
 }
+/**
+ * Update role metadata. Fields omitted from input are left unchanged.
+ * form_schema, metadata_schema, and parent_role can be set to null to clear them.
+ */
+async function updateRole(input) {
+    try {
+        if (!input.role) {
+            return { status: 400, error: 'role is required' };
+        }
+        for (const field of ['sla_minutes', 'target_per_hour', 'worker_count']) {
+            const value = input[field];
+            if (value !== undefined && value !== null && (typeof value !== 'number' || !Number.isFinite(value) || value < 0)) {
+                return { status: 400, error: `${field} must be a non-negative number or null` };
+            }
+        }
+        if (input.worker_count != null && !Number.isInteger(input.worker_count)) {
+            return { status: 400, error: 'worker_count must be a whole number' };
+        }
+        if (input.ops_visible !== undefined && typeof input.ops_visible !== 'boolean') {
+            return { status: 400, error: 'ops_visible must be a boolean' };
+        }
+        if (input.parent_role != null && input.parent_role === input.role) {
+            return { status: 400, error: 'parent_role must reference a different role' };
+        }
+        const updated = await roleService.updateRoleMetadata(input.role, {
+            title: input.title,
+            description: input.description,
+            form_schema: input.form_schema,
+            metadata_schema: input.metadata_schema,
+            properties: input.properties,
+            ops_visible: input.ops_visible,
+            parent_role: input.parent_role,
+            sla_minutes: input.sla_minutes,
+            target_per_hour: input.target_per_hour,
+            worker_count: input.worker_count,
+        });
+        if (!updated) {
+            return { status: 404, error: `Role '${input.role}' not found` };
+        }
+        return { status: 200, data: updated };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}
 /**
  * Delete a role from the system. Requires admin privileges.
  *

package/build/bin/ltc.js

@@ -119,6 +119,7 @@ const escCmd = commander_1.program.command('escalations').alias('esc').descripti
 escCmd.command('list')
     .option('--status <status>', 'Filter by status (pending, resolved, cancelled)')
     .option('--role <role>', 'Filter by role')
+    .option('--search <term>', 'Exact-match by correlation id (escalation id, workflow id, or origin id). For a value inside metadata, use --facets')
     .option('--limit <n>', 'Max results')
     .option('--facets <json>', 'Required metadata facets, JSON object (metadata @>), e.g. \'{"filament":"pla"}\'')
     .option('--block <json>', 'Exclude rows containing ANY of these facet sets, JSON array')

package/build/lib/cli/commands/escalations.d.ts

@@ -1,6 +1,7 @@
 interface ListOptions {
     status?: string;
     role?: string;
+    search?: string;
     limit?: string;
     json?: boolean;
     quiet?: boolean;

package/build/lib/cli/commands/escalations.js

@@ -32,6 +32,8 @@ async function listEscalations(opts) {
         params.set('status', opts.status);
     if (opts.role)
         params.set('role', opts.role);
+    if (opts.search)
+        params.set('search', opts.search);
     if (opts.limit)
         params.set('limit', opts.limit);
     // Faceted query elements travel as JSON-encoded query params (the route JSON-parses

package/build/lib/db/migrate.js

@@ -64,8 +64,28 @@ async function migrate() {
             const { rows } = await client.query('SELECT 1 FROM lt_migrations WHERE name = $1', [file]);
             if (rows.length === 0) {
                 const sql = fs.readFileSync(path.join(SCHEMAS_DIR, file), 'utf-8');
-                await client.query(sql);
-                await client.query('INSERT INTO lt_migrations (name) VALUES ($1)', [file]);
+                // Apply the file and record it in ONE transaction. Without this, a crash
+                // between applying the SQL and inserting the tracking row leaves the
+                // migration applied-but-untracked, so the next boot re-runs it. That is
+                // only safe if every migration is idempotent — this wrapper removes that
+                // hidden requirement and makes apply+track atomic across containers
+                // (the advisory lock already serializes them; this closes the gap within
+                // a single file's application).
+                //
+                // Constraint: migration files must NOT use CREATE INDEX CONCURRENTLY —
+                // it is illegal inside a transaction block. Concurrent index builds on
+                // large runtime tables belong in the post-boot path (see
+                // services/escalation/client.ts), not in migrate().
+                try {
+                    await client.query('BEGIN');
+                    await client.query(sql);
+                    await client.query('INSERT INTO lt_migrations (name) VALUES ($1)', [file]);
+                    await client.query('COMMIT');
+                }
+                catch (err) {
+                    await client.query('ROLLBACK').catch(() => { });
+                    throw err;
+                }
                 logger_1.loggerRegistry.info(`[migrate] applied: ${file}`);
             }
         }

package/build/lib/db/schemas/014_roles_v2.sql

@@ -0,0 +1,19 @@
+-- Migration 014: Elevate lt_roles with rich metadata and process dependency graph
+--
+-- New columns:
+--   title        — display name separate from the technical role key
+--   description  — human-readable summary for card layout
+--   form_schema  — role-level template for rendering/validating escalation data
+--                  (used as default; workflow-level resolver_schema overrides)
+--   properties   — open bag for SLA targets, icon, color, station location, etc.
+--   ops_visible  — flag controlling COO /operations view visibility
+--   parent_role  — nullable self-referencing FK for the process dependency graph
+--                  (child references parent; roots have NULL)
+
+ALTER TABLE lt_roles
+  ADD COLUMN IF NOT EXISTS title       TEXT,
+  ADD COLUMN IF NOT EXISTS description TEXT,
+  ADD COLUMN IF NOT EXISTS form_schema JSONB,
+  ADD COLUMN IF NOT EXISTS properties  JSONB NOT NULL DEFAULT '{}',
+  ADD COLUMN IF NOT EXISTS ops_visible BOOLEAN NOT NULL DEFAULT false,
+  ADD COLUMN IF NOT EXISTS parent_role TEXT REFERENCES lt_roles(role);

package/build/lib/db/schemas/015_role_ops.sql

@@ -0,0 +1,50 @@
+-- Migration 015: Role operational columns
+--
+-- Promotes the COO operational triangle to first-class typed columns on lt_roles
+-- instead of loose keys inside the properties JSONB bag.
+--
+-- Triangle: if you know any two, the third is derived.
+--   throughput = worker_count / (sla_minutes / 60)
+--   worker_count = target_per_hour × (sla_minutes / 60)
+--   sla_minutes  = worker_count / target_per_hour × 60
+--
+-- Also formalises metadata_schema: a JSON Schema document that declares the
+-- expected shape of lt_escalations.metadata for escalations created under
+-- this role. Drives faceted-query key autocomplete and creation-time validation.
+--
+-- properties remains a free user-owned JSONB bag — no reserved keys.
+
+ALTER TABLE lt_roles
+  ADD COLUMN IF NOT EXISTS sla_minutes      NUMERIC,
+  ADD COLUMN IF NOT EXISTS target_per_hour  NUMERIC,
+  ADD COLUMN IF NOT EXISTS worker_count     NUMERIC,
+  ADD COLUMN IF NOT EXISTS metadata_schema  JSONB;
+
+-- Migrate values that lived in the properties bag (common key names).
+-- The bag is user-owned free text, so every cast is guarded: only JSON numbers
+-- and numeric strings are promoted. An unparseable value (e.g. "30 min") is
+-- left in the bag rather than aborting the migration transaction and
+-- crash-looping every container at boot.
+UPDATE lt_roles
+SET sla_minutes = (properties->>'sla_minutes')::numeric
+WHERE sla_minutes IS NULL
+  AND (jsonb_typeof(properties->'sla_minutes') = 'number'
+       OR properties->>'sla_minutes' ~ '^[0-9]+(\.[0-9]+)?$');
+
+UPDATE lt_roles
+SET sla_minutes = (properties->>'tat_minutes')::numeric
+WHERE sla_minutes IS NULL
+  AND (jsonb_typeof(properties->'tat_minutes') = 'number'
+       OR properties->>'tat_minutes' ~ '^[0-9]+(\.[0-9]+)?$');
+
+UPDATE lt_roles
+SET target_per_hour = (properties->>'target_per_hour')::numeric
+WHERE target_per_hour IS NULL
+  AND (jsonb_typeof(properties->'target_per_hour') = 'number'
+       OR properties->>'target_per_hour' ~ '^[0-9]+(\.[0-9]+)?$');
+
+UPDATE lt_roles
+SET worker_count = (properties->>'worker_count')::numeric
+WHERE worker_count IS NULL
+  AND (jsonb_typeof(properties->'worker_count') = 'number'
+       OR properties->>'worker_count' ~ '^[0-9]+(\.[0-9]+)?$');

package/build/lib/db/schemas/016_station_metrics_indexes.sql

@@ -0,0 +1,13 @@
+-- Station-metrics indexes on hmsh_escalations
+--
+-- hmsh_escalations is created by HotMesh at runtime, AFTER migrate() runs.
+-- These indexes cannot be created here because the table does not yet exist
+-- when this migration file executes.
+--
+-- The indexes are created in services/escalation/client.ts:installEscalationCompatView()
+-- which runs after HotMesh has bootstrapped, under advisory lock 8675310.
+-- That is the single authoritative creation path.
+--
+-- This migration file exists only to claim the 016 slot in the sequence
+-- so the numbering stays stable. It is intentionally a no-op.
+SELECT 1;

package/build/lib/events/system-events.js

@@ -12,6 +12,9 @@ const ESCALATION_STATUS_BY_VERB = {
     reassigned: 'pending',
     resolved: 'resolved',
     cancelled: 'cancelled',
+    // hotmesh 0.25.1: the SLA timer on a condition(config + timeout) wait fired
+    // first — the engine transitioned the row and emitted .expired.
+    expired: 'expired',
 };
 /**
  * Translate a HotMesh `SystemEvent` into long-tail's `LTEvent`. Escalation

package/build/modules/auth.d.ts

@@ -59,6 +59,15 @@ export declare const requireAdmin: RequestHandler;
  * This is the backend equivalent of the dashboard's `isBuilder` check.
  */
 export declare const requireBuilder: RequestHandler;
+/**
+ * Middleware that requires role-management access. Must be placed AFTER requireAuth.
+ *
+ * Grants access to superadmins, admin-type users, and engineers — the backend
+ * equivalent of the dashboard's `isBuilder || isOps`. Ops (admin type) manage
+ * users and roles; builders (superadmin, engineer) are a superset. This is the
+ * gate for reading and writing role definitions.
+ */
+export declare const requireRoleManager: RequestHandler;
 /**
  * Generate a JWT token. Utility for tests and token provisioning.
  */

package/build/modules/auth.js

@@ -36,7 +36,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.requireBuilder = exports.requireAdmin = exports.requireAuth = exports.JwtAuthAdapter = void 0;
+exports.requireRoleManager = exports.requireBuilder = exports.requireAdmin = exports.requireAuth = exports.JwtAuthAdapter = void 0;
 exports.createAuthMiddleware = createAuthMiddleware;
 exports.setAuthAdapter = setAuthAdapter;
 exports.signToken = signToken;
@@ -257,6 +257,43 @@ const requireBuilder = async (req, res, next) => {
     }
 };
 exports.requireBuilder = requireBuilder;
+/**
+ * Middleware that requires role-management access. Must be placed AFTER requireAuth.
+ *
+ * Grants access to superadmins, admin-type users, and engineers — the backend
+ * equivalent of the dashboard's `isBuilder || isOps`. Ops (admin type) manage
+ * users and roles; builders (superadmin, engineer) are a superset. This is the
+ * gate for reading and writing role definitions.
+ */
+const requireRoleManager = async (req, res, next) => {
+    try {
+        if (!req.auth?.userId) {
+            res.status(403).json({ error: 'Forbidden' });
+            return;
+        }
+        // Fast path: trust the JWT role claim for admin/superadmin
+        if (req.auth.role === 'admin' || req.auth.role === 'superadmin') {
+            next();
+            return;
+        }
+        // Slow path: check database for superadmin role type
+        if (await (0, user_1.isSuperAdmin)(req.auth.userId)) {
+            next();
+            return;
+        }
+        // Check database for engineer role (builder)
+        const { hasRole } = await Promise.resolve().then(() => __importStar(require('../services/user/roles')));
+        if (await hasRole(req.auth.userId, 'engineer')) {
+            next();
+            return;
+        }
+        res.status(403).json({ error: 'Forbidden: role-management access required' });
+    }
+    catch {
+        res.status(403).json({ error: 'Forbidden' });
+    }
+};
+exports.requireRoleManager = requireRoleManager;
 /**
  * Generate a JWT token. Utility for tests and token provisioning.
  */

package/build/routes/escalations/list.js

@@ -153,6 +153,16 @@ function registerListRoutes(router) {
         const result = await api.listFacetKeys(undefined, req.auth);
         res.status(result.status).json(result.data ?? { error: result.error });
     });
+    /**
+     * GET /api/escalations/station-metrics
+     * Per-role P99/P50/avg/max wait + work times, resolved count, and in-arrears
+     * count. Drives the Operations station pace chart.
+     * RBAC: superadmin sees all; others scoped to their roles.
+     */
+    router.get('/station-metrics', async (req, res) => {
+        const result = await api.getStationMetrics({ period: req.query.period || undefined }, req.auth);
+        res.status(result.status).json(result.data ?? { error: result.error });
+    });
     /**
      * GET /api/escalations/stats
      * Aggregated escalation statistics.

package/build/routes/roles.js

@@ -58,7 +58,7 @@ router.get('/details', async (_req, res) => {
  * Create a standalone role. Requires admin.
  * Body: { role: string }
  */
-router.post('/', auth_1.requireBuilder, async (req, res) => {
+router.post('/', auth_1.requireRoleManager, async (req, res) => {
     const { role } = req.body || {};
     const result = await api.createRole({ role });
     res.status(result.status).json(result.data ?? { error: result.error });
@@ -76,7 +76,7 @@ router.get('/escalation-chains', async (_req, res) => {
  * Add a single escalation chain entry. Requires admin.
  * Body: { source_role: string, target_role: string }
  */
-router.post('/escalation-chains', auth_1.requireBuilder, async (req, res) => {
+router.post('/escalation-chains', auth_1.requireRoleManager, async (req, res) => {
     const { source_role, target_role } = req.body || {};
     const result = await api.addEscalationChain({ source_role, target_role });
     res.status(result.status).json(result.data ?? { error: result.error });
@@ -86,12 +86,23 @@ router.post('/escalation-chains', auth_1.requireBuilder, async (req, res) => {
  * Remove a single escalation chain entry. Requires admin.
  * Body: { source_role: string, target_role: string }
  */
-router.delete('/escalation-chains', auth_1.requireBuilder, async (req, res) => {
+router.delete('/escalation-chains', auth_1.requireRoleManager, async (req, res) => {
     const { source_role, target_role } = req.body || {};
     const result = await api.removeEscalationChain({ source_role, target_role });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 // ── Parameterized routes (must come AFTER named routes) ───────────────────
+/**
+ * PATCH /api/roles/:role
+ * Update role metadata. Requires admin.
+ * Body: { title?, description?, form_schema?, metadata_schema?, properties?, ops_visible?, parent_role?, sla_minutes?, target_per_hour?, worker_count? }
+ */
+router.patch('/:role', auth_1.requireRoleManager, async (req, res) => {
+    // URL is the resource identity — a `role` key in the body must not redirect
+    // the write to a different row.
+    const result = await api.updateRole({ ...req.body, role: req.params.role });
+    res.status(result.status).json(result.data ?? { error: result.error });
+});
 /**
  * GET /api/roles/:role/escalation-targets
  * Get allowed escalation targets for a specific role.
@@ -105,7 +116,7 @@ router.get('/:role/escalation-targets', async (req, res) => {
  * Replace escalation targets for a role. Requires admin.
  * Body: { targets: string[] }
  */
-router.put('/:role/escalation-targets', auth_1.requireBuilder, async (req, res) => {
+router.put('/:role/escalation-targets', auth_1.requireRoleManager, async (req, res) => {
     const { targets } = req.body || {};
     const result = await api.replaceEscalationTargets({ role: req.params.role, targets });
     res.status(result.status).json(result.data ?? { error: result.error });
@@ -114,7 +125,7 @@ router.put('/:role/escalation-targets', auth_1.requireBuilder, async (req, res)
  * DELETE /api/roles/:role
  * Delete a role if it has no references. Requires admin.
  */
-router.delete('/:role', auth_1.requireBuilder, async (req, res) => {
+router.delete('/:role', auth_1.requireRoleManager, async (req, res) => {
     const result = await api.deleteRole({ role: req.params.role });
     res.status(result.status).json(result.data ?? { error: result.error });
 });

package/build/scripts/ortho-populate.d.ts

@@ -0,0 +1,37 @@
+/**
+ * ortho-populate — Populate the Operations dashboard with ortho pipeline history.
+ *
+ * Adapted from the boilerplate's 08-day-resolver.ts pattern:
+ *   - concurrent claim loop + resolve loop + watchdog via Promise.all
+ *   - hold time read from esc.claimed_at (API), not tracked in memory
+ *   - simple resolve payload { approved: true, station: role }
+ *
+ * Usage:
+ *   npx ts-node scripts/ortho-populate.ts
+ *   ORDERS=50 HOLD_S=3 npx ts-node scripts/ortho-populate.ts
+ *   ORDERS=5  HOLD_S=0 POLL_MS=500 npx ts-node scripts/ortho-populate.ts
+ *
+ * Env vars:
+ *   ORDERS    — number of orders to run (default 20)
+ *   HOLD_S    — seconds to hold each escalation before resolving (default 2)
+ *   POLL_MS   — poll interval ms (default 1000)
+ *   BASE_URL  — server URL (default http://localhost:3000)
+ */
+declare const BASE_URL: string;
+declare const ORDERS: number;
+declare const HOLD_S: number;
+declare const POLL_MS: number;
+declare const ORTHO_ROLES: string[];
+declare let token: string;
+declare let userId: string;
+declare let totalClaimed: number;
+declare let totalResolved: number;
+declare function ts(): string;
+declare function sleep(ms: number): Promise<unknown>;
+declare function ageSeconds(iso: string): number;
+declare function api(method: string, path: string, body?: unknown): Promise<any>;
+declare function login(): Promise<void>;
+declare function claimBatch(batchTag: string): Promise<number>;
+declare function resolveBatch(batchTag: string): Promise<number>;
+declare function runOrders(batchTag: string, target: number): Promise<void>;
+declare function main(): Promise<void>;