@hotmeshio/long-tail 0.8.3 → 0.8.5

package/build/api/escalations/create.js

@@ -32,34 +32,13 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createEscalation = createEscalation;
-const ajv_1 = __importDefault(require("ajv"));
 const escalationService = __importStar(require("../../services/escalation"));
 const roleService = __importStar(require("../../services/role"));
+const schema_validator_1 = require("../../services/role/schema-validator");
 const escalation_1 = require("../../types/escalation");
 const helpers_1 = require("./helpers");
-// strict: false — role metadata_schemas use the project's house extension
-// keywords (x-lt-widget etc., the same style as seeded form_schemas); Ajv 8's
-// strict mode throws at compile on any unknown keyword, which would turn every
-// metadata-bearing create for that role into a 500.
-const ajv = new ajv_1.default({ allErrors: true, strict: false });
-// Compiled validators cached per role+version, keyed by the schema's serialized
-// form so an admin's schema edit invalidates the stale validator on the next
-// create. Pinned versions are immutable, but the same key logic covers both.
-const validatorCache = new Map();
-function compileRoleValidator(cacheId, schema) {
-    const key = JSON.stringify(schema);
-    const cached = validatorCache.get(cacheId);
-    if (cached && cached.key === key)
-        return cached.validate;
-    const validate = ajv.compile(schema);
-    validatorCache.set(cacheId, { key, validate });
-    return validate;
-}
 // ── Create ────────────────────────────────────────────────────────────────
 /**
  * Create a standalone escalation (not tied to a workflow).
@@ -94,46 +73,26 @@ async function createEscalation(input, auth) {
         if (denied) {
             return { status: 403, error: `You must have write access to the "${role}" role or be a superadmin to create escalations for it` };
         }
-        // Validate metadata against the role's declared schema (if any). A
-        // metadata.schema_version pin selects that immutable snapshot; a pin that
-        // names a missing version is a 400, never a silent fall-through to latest.
-        if (input.metadata) {
-            const pinned = input.metadata[escalation_1.ESCALATION_METADATA_KEYS.SCHEMA_VERSION];
-            if (pinned !== undefined && (!Number.isInteger(pinned) || pinned < 1)) {
-                return { status: 400, error: `metadata.${escalation_1.ESCALATION_METADATA_KEYS.SCHEMA_VERSION} must be a positive integer` };
-            }
-            let schema;
-            if (pinned !== undefined) {
-                const snapshot = await roleService.getRoleSchema(role, pinned);
-                if (!snapshot) {
-                    return { status: 400, error: `Schema version ${pinned} does not exist for role "${role}"` };
-                }
-                schema = snapshot.metadata_schema;
+        // Validate the caller-supplied metadata against the role's metadata_schema
+        // (the queryable-facet contract). An escalation may carry a form-version pin
+        // (metadata.schema_version) chosen by the workflow author; that is a system
+        // key, not caller data, so it is excluded from validation. No version is
+        // stamped here — omitting it means the resolve UI renders the role's latest
+        // form at fetch time.
+        const metadata = input.metadata ?? {};
+        const metadataSchema = await roleService.getRoleMetadataSchema(role);
+        if (metadataSchema) {
+            let validate;
+            try {
+                validate = (0, schema_validator_1.compileSchemaValidator)(`${role}:meta`, metadataSchema);
             }
-            else {
-                schema = await roleService.getRoleMetadataSchema(role);
+            catch (compileErr) {
+                // A broken stored schema is the role admin's bug, not the creator's.
+                return { status: 422, error: `metadata_schema for role "${role}" is not a valid JSON Schema: ${compileErr.message}` };
             }
-            if (schema) {
-                let validate;
-                try {
-                    validate = compileRoleValidator(`${role}@${pinned ?? 'live'}`, schema);
-                }
-                catch (compileErr) {
-                    // A broken stored schema is the role admin's bug, not the creator's —
-                    // name it explicitly instead of surfacing an opaque 500.
-                    return {
-                        status: 422,
-                        error: `metadata_schema for role "${role}" is not a valid JSON Schema: ${compileErr.message}`,
-                    };
-                }
-                // The pin is a system key, not caller data — strip it so schemas with
-                // additionalProperties: false still validate the caller's bag.
-                const { [escalation_1.ESCALATION_METADATA_KEYS.SCHEMA_VERSION]: _pin, ...callerMetadata } = input.metadata;
-                const valid = validate(callerMetadata);
-                if (!valid) {
-                    const msgs = (validate.errors ?? []).map((e) => `${e.instancePath || '(root)'} ${e.message}`).join('; ');
-                    return { status: 400, error: `metadata does not match the role schema: ${msgs}` };
-                }
+            const { [escalation_1.ESCALATION_METADATA_KEYS.SCHEMA_VERSION]: _pin, ...callerMetadata } = metadata;
+            if (!validate(callerMetadata)) {
+                return { status: 400, error: `metadata does not match the role schema: ${(0, schema_validator_1.formatValidationErrors)(validate)}` };
             }
         }
         const escalation = await escalationService.createEscalation({

package/build/api/escalations/index.d.ts

@@ -3,7 +3,7 @@ export { listEscalations, listAvailableEscalations, listDistinctTypes, listFacet
 export { getEscalation, getEscalationsByWorkflowId, escalateToRole } from './single';
 export { claimEscalation, releaseEscalation } from './claim';
 export { releaseExpiredClaims, updatePriority, bulkClaim, bulkAssign, bulkEscalate, bulkTriage } from './bulk';
-export { resolveEscalation, resolveBySignalKey, resolveByIds } from './resolve';
+export { resolveEscalation, resolveBySignalKey, resolveByIds, resolveAllOrNone } from './resolve';
 export { findByMetadata, claimByMetadata, resolveByMetadata } from './metadata';
 export { cancelSingleEscalation, bulkCancel } from './cancel';
 export { searchByFacets, claimGroups, claimByFacets } from './facets';

package/build/api/escalations/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.claimByFacets = exports.claimGroups = exports.searchByFacets = exports.bulkCancel = exports.cancelSingleEscalation = exports.resolveByMetadata = exports.claimByMetadata = exports.findByMetadata = exports.resolveByIds = exports.resolveBySignalKey = exports.resolveEscalation = exports.bulkTriage = exports.bulkEscalate = exports.bulkAssign = exports.bulkClaim = exports.updatePriority = exports.releaseExpiredClaims = exports.releaseEscalation = exports.claimEscalation = exports.escalateToRole = exports.getEscalationsByWorkflowId = exports.getEscalation = exports.getStationMetrics = exports.getEscalationStats = exports.listFacetKeys = exports.listDistinctTypes = exports.listAvailableEscalations = exports.listEscalations = exports.createEscalation = void 0;
+exports.claimByFacets = exports.claimGroups = exports.searchByFacets = exports.bulkCancel = exports.cancelSingleEscalation = exports.resolveByMetadata = exports.claimByMetadata = exports.findByMetadata = exports.resolveAllOrNone = exports.resolveByIds = exports.resolveBySignalKey = exports.resolveEscalation = exports.bulkTriage = exports.bulkEscalate = exports.bulkAssign = exports.bulkClaim = exports.updatePriority = exports.releaseExpiredClaims = exports.releaseEscalation = exports.claimEscalation = exports.escalateToRole = exports.getEscalationsByWorkflowId = exports.getEscalation = exports.getStationMetrics = exports.getEscalationStats = exports.listFacetKeys = exports.listDistinctTypes = exports.listAvailableEscalations = exports.listEscalations = exports.createEscalation = void 0;
 var create_1 = require("./create");
 Object.defineProperty(exports, "createEscalation", { enumerable: true, get: function () { return create_1.createEscalation; } });
 var list_1 = require("./list");
@@ -28,6 +28,7 @@ var resolve_1 = require("./resolve");
 Object.defineProperty(exports, "resolveEscalation", { enumerable: true, get: function () { return resolve_1.resolveEscalation; } });
 Object.defineProperty(exports, "resolveBySignalKey", { enumerable: true, get: function () { return resolve_1.resolveBySignalKey; } });
 Object.defineProperty(exports, "resolveByIds", { enumerable: true, get: function () { return resolve_1.resolveByIds; } });
+Object.defineProperty(exports, "resolveAllOrNone", { enumerable: true, get: function () { return resolve_1.resolveAllOrNone; } });
 var metadata_1 = require("./metadata");
 Object.defineProperty(exports, "findByMetadata", { enumerable: true, get: function () { return metadata_1.findByMetadata; } });
 Object.defineProperty(exports, "claimByMetadata", { enumerable: true, get: function () { return metadata_1.claimByMetadata; } });

package/build/api/escalations/resolve.d.ts

@@ -44,3 +44,31 @@ export declare function resolveByIds(input: {
     resolverPayload: Record<string, any>;
     metadata?: Record<string, any>;
 }, auth: LTApiAuth): Promise<LTApiResult>;
+/**
+ * Atomic all-or-none bulk resolve with PER-ROW payloads — the gang-handoff
+ * sibling of {@link resolveByIds}. Every listed escalation must be pending and
+ * writable by the caller, or NOTHING resolves. Unlike resolveByIds, rows
+ * backing a live `condition()` waiter are first-class: each is woken with its
+ * own payload inside the single atomic statement (same wake contract as
+ * single resolve).
+ *
+ * RBAC matches resolveByIds: per-item write scope, 404 non-disclosure when any
+ * id is missing or out of scope, nothing resolved. `requireClaimed` adds a
+ * SQL-level assertion that every row is currently assigned to the caller —
+ * for claim-then-resolve flows (a broker resolving its claimed gang), this
+ * closes the window where another principal re-claims a member mid-flight.
+ *
+ * Rows whose resolution requires a non-atomic path (legacy signal routing via
+ * `metadata.signal_id` / `metadata.signal_routing`, which need a separate
+ * workflow signal) block the batch with 409 — bulk-resolving them would strand
+ * their workflows. Re-run/triage rows (workflow_type without any signal shape)
+ * resolve as bookkeeping acknowledgements, matching resolveByIds semantics.
+ */
+export declare function resolveAllOrNone(input: {
+    items: Array<{
+        id: string;
+        resolverPayload: Record<string, any>;
+    }>;
+    metadata?: Record<string, any>;
+    requireClaimed?: boolean;
+}, auth: LTApiAuth): Promise<LTApiResult>;

package/build/api/escalations/resolve.js

@@ -36,6 +36,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveEscalation = resolveEscalation;
 exports.resolveBySignalKey = resolveBySignalKey;
 exports.resolveByIds = resolveByIds;
+exports.resolveAllOrNone = resolveAllOrNone;
 const escalationService = __importStar(require("../../services/escalation"));
 const taskService = __importStar(require("../../services/task"));
 const escalation_strategy_1 = require("../../services/escalation-strategy");
@@ -60,7 +61,7 @@ const helpers_1 = require("./helpers");
  */
 async function resolveEscalation(input, auth) {
     try {
-        const { id, resolverPayload, metadata } = input;
+        const { id, metadata, resolverPayload } = input;
         if (!resolverPayload) {
             return { status: 400, error: 'resolverPayload is required' };
         }
@@ -82,6 +83,9 @@ async function resolveEscalation(input, auth) {
         const denied = await (0, helpers_1.assertWriteAccess)(auth.userId, escalation);
         if (denied)
             return denied;
+        // The resolver payload is stored exactly as submitted — its shape is the
+        // workflow's contract, formed by the caller (the React app maps the form to
+        // the payload via x-lt-bind before submitting). No server-side transform.
         // `metadata` (the outcome patch) is never written separately — it rides WITH the
         // resolverPayload to whichever path performs the resolve, so it merges inside the
         // single status='pending'-guarded UPDATE (HotMesh `resolve(metadata)`). Paths that
@@ -133,7 +137,7 @@ async function resolveEscalation(input, auth) {
  */
 async function resolveBySignalKey(input, auth) {
     try {
-        const { signalKey, resolverPayload, metadata } = input;
+        const { signalKey, metadata, resolverPayload } = input;
         if (!signalKey)
             return { status: 400, error: 'signalKey is required' };
         if (!resolverPayload)
@@ -147,6 +151,8 @@ async function resolveBySignalKey(input, auth) {
         const denied = await (0, helpers_1.assertWriteAccess)(auth.userId, escalation);
         if (denied)
             return { status: 404, error: 'Escalation not found' };
+        // The payload is delivered as the signal the parked workflow's condition()
+        // receives — stored exactly as submitted (the caller formed its shape).
         return resolveViaSignalKey(escalation, resolverPayload, metadata);
     }
     catch (err) {
@@ -166,12 +172,15 @@ async function resolveBySignalKey(input, auth) {
  */
 async function resolveByIds(input, auth) {
     try {
-        const { ids, resolverPayload, metadata } = input;
+        const { ids, metadata } = input;
         if (!Array.isArray(ids) || ids.length === 0) {
             return { status: 400, error: 'ids must be a non-empty array' };
         }
-        if (!resolverPayload)
+        if (!input.resolverPayload)
             return { status: 400, error: 'resolverPayload is required' };
+        // One pre-shaped payload for a homogeneous group of bookkeeping rows, stored
+        // as submitted — the caller forms the payload's shape.
+        const resolverPayload = input.resolverPayload;
         // Bulk resolve ("ack") is a write verb, gated PER ITEM: write_all roles may
         // resolve any item in the role; write_self roles may resolve only items assigned
         // to the caller (same rule single-resolve applies via assertWriteAccess). Global
@@ -194,6 +203,103 @@ async function resolveByIds(input, auth) {
         return { status: 500, error: err.message };
     }
 }
+/**
+ * Atomic all-or-none bulk resolve with PER-ROW payloads — the gang-handoff
+ * sibling of {@link resolveByIds}. Every listed escalation must be pending and
+ * writable by the caller, or NOTHING resolves. Unlike resolveByIds, rows
+ * backing a live `condition()` waiter are first-class: each is woken with its
+ * own payload inside the single atomic statement (same wake contract as
+ * single resolve).
+ *
+ * RBAC matches resolveByIds: per-item write scope, 404 non-disclosure when any
+ * id is missing or out of scope, nothing resolved. `requireClaimed` adds a
+ * SQL-level assertion that every row is currently assigned to the caller —
+ * for claim-then-resolve flows (a broker resolving its claimed gang), this
+ * closes the window where another principal re-claims a member mid-flight.
+ *
+ * Rows whose resolution requires a non-atomic path (legacy signal routing via
+ * `metadata.signal_id` / `metadata.signal_routing`, which need a separate
+ * workflow signal) block the batch with 409 — bulk-resolving them would strand
+ * their workflows. Re-run/triage rows (workflow_type without any signal shape)
+ * resolve as bookkeeping acknowledgements, matching resolveByIds semantics.
+ */
+async function resolveAllOrNone(input, auth) {
+    try {
+        const { items, metadata, requireClaimed } = input;
+        if (!Array.isArray(items) || items.length === 0) {
+            return { status: 400, error: 'items must be a non-empty array' };
+        }
+        if (items.length > defaults_1.ESCALATION_BULK_RESOLVE_MAX) {
+            return { status: 400, error: `items exceeds the maximum of ${defaults_1.ESCALATION_BULK_RESOLVE_MAX}` };
+        }
+        const wellFormed = items.every((i) => i && typeof i.id === 'string' && i.id.length > 0
+            && i.resolverPayload && typeof i.resolverPayload === 'object');
+        if (!wellFormed) {
+            return { status: 400, error: 'every item requires an id and a resolverPayload object' };
+        }
+        const ids = items.map((i) => i.id);
+        if (new Set(ids).size !== ids.length) {
+            return { status: 400, error: 'items must not repeat ids' };
+        }
+        // One indexed read serves every pre-flight gate below (scope, path shape,
+        // redaction schema). Role and signal routing are immutable per escalation,
+        // so none of these checks race the guarded statement that follows — and
+        // row STATE (pending, assignee) is re-asserted inside that statement.
+        const rows = await escalationService.getEscalationsByIds(ids);
+        const rowById = new Map(rows.map((r) => [r.id, r]));
+        // Per-item write scope, same rule as resolveByIds: write_all roles may
+        // resolve any item in the role; write_self only items assigned to the
+        // caller. A missing id or any out-of-scope item → 404 (non-disclosure),
+        // nothing resolved. Global bypasses; the store then reports precise
+        // per-row blockers (including not-found) via the 409 below.
+        const writeScope = await (0, helpers_1.getEscalationWriteScope)(auth.userId);
+        if (!writeScope.global) {
+            const allSet = new Set(writeScope.allRoles);
+            const selfSet = new Set(writeScope.selfRoles);
+            const writable = (r) => (!!r.role && allSet.has(r.role)) ||
+                (!!r.role && selfSet.has(r.role) && r.assigned_to === auth.userId);
+            if (rows.length !== ids.length || !rows.every(writable)) {
+                return { status: 404, error: 'One or more escalations not found' };
+            }
+        }
+        // Fail loud on rows the atomic statement cannot wake: legacy signal shapes
+        // resume their workflow via a separate handle.signal, so bulk-resolving the
+        // row would mark it settled while the workflow stays parked forever.
+        const unsupported = rows.filter((r) => {
+            const meta = (r.metadata ?? {});
+            return !r.signal_key && (meta.signal_id || meta.signal_routing?.signalId);
+        });
+        if (unsupported.length > 0) {
+            const failed = unsupported.map((r) => ({ id: r.id, reason: 'unsupported-resolution-path' }));
+            // error rides inside data too: routes serialize `data ?? { error }`, and
+            // the 409 body must carry BOTH the message and the blocking ids
+            const error = 'One or more escalations require the single-resolve path (legacy signal routing)';
+            return { status: 409, error, data: { error, failedIds: failed.map((f) => f.id), failed } };
+        }
+        // Per-row password redaction against each row's own form schema — the
+        // payload enters the signal store and the audit record; plaintext never.
+        const serviceItems = await Promise.all(items.map(async (item) => ({
+            id: item.id,
+            resolverPayload: await redactPasswords(item.resolverPayload, rowById.get(item.id)?.metadata?.form_schema),
+        })));
+        const result = await escalationService.resolveEscalationsAllOrNone(serviceItems, metadata, requireClaimed ? auth.userId : undefined);
+        if (!result.ok) {
+            const error = 'One or more escalations blocked the batch; nothing was resolved';
+            return {
+                status: 409,
+                error,
+                data: { error, failedIds: result.failed.map((f) => f.id), failed: result.failed },
+            };
+        }
+        return {
+            status: 200,
+            data: { resolved: result.escalations.length, escalationIds: result.escalations.map((e) => e.id) },
+        };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}
 // ── Resolution paths ─────────────────────────────────────────────────────
 /** Path A: lightweight conditionLT signal — inject $escalation_id and signal the running workflow. */
 async function resolveViaConditionSignal(escalation, resolverPayload, metadata) {

package/build/api/escalations/single.js

@@ -51,14 +51,18 @@ const helpers_1 = require("./helpers");
  */
 async function getEscalation(input, auth) {
     try {
-        const escalation = await escalationService.getEscalation(input.id);
-        if (!escalation) {
+        // One query: the escalation plus its role's form, resolved to the version the
+        // row pinned (or the role's latest) and embedded as `form_schema`. The resolve
+        // UI renders from this without a second schema call, and the form is never
+        // stored on the row — it is JOINed in from the roles tables.
+        const detail = await escalationService.getEscalationWithFormSchema(input.id);
+        if (!detail) {
             return { status: 404, error: 'Escalation not found' };
         }
-        const denied = await (0, helpers_1.assertReadAccess)(auth.userId, escalation);
+        const denied = await (0, helpers_1.assertReadAccess)(auth.userId, detail.escalation);
         if (denied)
             return denied;
-        return { status: 200, data: escalation };
+        return { status: 200, data: { ...detail.escalation, form_schema: detail.form_schema } };
     }
     catch (err) {
         return { status: 500, error: err.message };

package/build/api/roles.d.ts

@@ -83,6 +83,7 @@ export declare function updateRole(input: {
     role: string;
     title?: string | null;
     description?: string | null;
+    /** The escalation resolve FORM schema (the JIT UI). Fields may carry x-lt-bind. */
     form_schema?: Record<string, any> | null;
     metadata_schema?: Record<string, any> | null;
     properties?: Record<string, any> | null;

package/build/lib/db/index.js

@@ -8,7 +8,18 @@ const config_1 = require("../../modules/config");
 let pool = null;
 function getPool() {
     if (!pool) {
-        pool = new pg_1.Pool(config_1.postgres_options);
+        pool = new pg_1.Pool({
+            ...config_1.postgres_options,
+            // Long-tail's shared tables live in public. Postgres's default
+            // search_path is `"$user", public`: if any schema shares the connecting
+            // role's name (e.g. a HotMesh app schema named after the DB user), every
+            // unqualified statement — including CREATE TABLE in migrations — silently
+            // resolves there instead of public, forking the data across two schemas.
+            // Pinning the session search_path makes resolution independent of role
+            // and schema naming. HotMesh connections (getConnection) are unaffected:
+            // the engine fully qualifies its app schemas.
+            options: '-c search_path=public',
+        });
     }
     return pool;
 }

package/build/lib/db/migrate.js

@@ -47,7 +47,34 @@ async function migrate() {
     // Uses a dedicated client so the lock is held for the entire sequence.
     const client = await pool.connect();
     try {
+        // Migrations define the shared public tables, so resolution is pinned on
+        // this client even if a future caller wires a pool without the pool-level
+        // search_path option. Without this, a schema named after the DB role
+        // (default search_path `"$user", public`) captures every unqualified
+        // CREATE TABLE below.
+        await client.query('SET search_path TO public');
         await client.query('SELECT pg_advisory_lock(8675309)');
+        // Fail loudly on a pre-existing split: an lt_migrations table in any other
+        // schema means a prior boot ran with `"$user"` shadowing public and forked
+        // the tables. Booting through it would either fork the data further or
+        // re-run every migration against empty public tables while the live rows
+        // sit in the shadow schema. An operator must consolidate first (move the
+        // live lt_* tables to public, archive the stale copies).
+        const drift = await client.query(`
+      SELECT n.nspname
+      FROM pg_class c
+      JOIN pg_namespace n ON n.oid = c.relnamespace
+      WHERE c.relname = 'lt_migrations' AND c.relkind = 'r' AND n.nspname <> 'public'
+    `);
+        if (drift.rows.length > 0) {
+            const schemas = drift.rows.map((r) => r.nspname).join(', ');
+            throw new Error(`[migrate] lt_migrations exists in non-public schema(s): ${schemas}. ` +
+                'Long-tail tables must live in the public schema. This usually means the ' +
+                'database user shares a name with another schema, so the default ' +
+                'search_path ("$user", public) captured earlier migrations. Consolidate ' +
+                'the schemas (ALTER TABLE ... SET SCHEMA public for the live lt_* tables, ' +
+                'archive stale public copies) before starting the app.');
+        }
         // ensure migration tracking table
         await client.query(`
       CREATE TABLE IF NOT EXISTS lt_migrations (

package/build/modules/defaults.d.ts

@@ -49,6 +49,8 @@ export declare const QUERY_LIMIT_MAX: number;
 export declare const YAML_LIST_LIMIT: number;
 /** Default page size for YAML workflow version history. */
 export declare const YAML_VERSION_LIMIT: number;
+/** Maximum items per atomic bulk resolve (POST /escalations/resolve-all-or-none). */
+export declare const ESCALATION_BULK_RESOLVE_MAX: number;
 /**
  * Claim duration presets shown in the dashboard (minutes).
  * Override via JSON array, e.g. LT_CLAIM_DURATION_OPTIONS='[15,30,60,480]'

package/build/modules/defaults.js

@@ -9,7 +9,7 @@
  * Grouped by domain so related knobs live together.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.YAML_LINE_WIDTH = exports.STOP_WORDS = exports.CLAIM_DURATION_OPTIONS = exports.YAML_VERSION_LIMIT = exports.YAML_LIST_LIMIT = exports.QUERY_LIMIT_MAX = exports.QUERY_LIMIT_DEFAULT = exports.CONFIG_CACHE_TTL_MS = exports.MCP_TOOL_TIMEOUT_MS = exports.WORKFLOW_SYNC_TIMEOUT_MS = exports.JOB_EXPIRE_SECS = exports.WORKFLOW_EXPIRE_SECS = exports.TOOL_ARG_LIMIT_CAP = exports.TOOL_ROUNDS_MCP_QUERY = exports.TOOL_ROUNDS_TRIAGE = exports.TOOL_RESULT_MAX_CHARS = exports.LLM_MAX_INPUT_CHARS = exports.LLM_MAX_ARRAY_ITEMS = exports.LLM_MAX_TOKENS_VISION = exports.LLM_MAX_TOKENS_JSON = exports.LLM_MAX_TOKENS_DEFAULT = exports.LLM_BASE_URL = exports.LLM_MODEL_SECONDARY = exports.LLM_MODEL_PRIMARY = void 0;
+exports.YAML_LINE_WIDTH = exports.STOP_WORDS = exports.CLAIM_DURATION_OPTIONS = exports.ESCALATION_BULK_RESOLVE_MAX = exports.YAML_VERSION_LIMIT = exports.YAML_LIST_LIMIT = exports.QUERY_LIMIT_MAX = exports.QUERY_LIMIT_DEFAULT = exports.CONFIG_CACHE_TTL_MS = exports.MCP_TOOL_TIMEOUT_MS = exports.WORKFLOW_SYNC_TIMEOUT_MS = exports.JOB_EXPIRE_SECS = exports.WORKFLOW_EXPIRE_SECS = exports.TOOL_ARG_LIMIT_CAP = exports.TOOL_ROUNDS_MCP_QUERY = exports.TOOL_ROUNDS_TRIAGE = exports.TOOL_RESULT_MAX_CHARS = exports.LLM_MAX_INPUT_CHARS = exports.LLM_MAX_ARRAY_ITEMS = exports.LLM_MAX_TOKENS_VISION = exports.LLM_MAX_TOKENS_JSON = exports.LLM_MAX_TOKENS_DEFAULT = exports.LLM_BASE_URL = exports.LLM_MODEL_SECONDARY = exports.LLM_MODEL_PRIMARY = void 0;
 function envInt(key, fallback) {
     const v = process.env[key];
     if (v === undefined || v === '')
@@ -67,6 +67,8 @@ exports.YAML_LIST_LIMIT = envInt('LT_YAML_LIST_LIMIT', 50);
 /** Default page size for YAML workflow version history. */
 exports.YAML_VERSION_LIMIT = envInt('LT_YAML_VERSION_LIMIT', 20);
 // ── Escalation ──────────────────────────────────────────────────────
+/** Maximum items per atomic bulk resolve (POST /escalations/resolve-all-or-none). */
+exports.ESCALATION_BULK_RESOLVE_MAX = envInt('LT_ESCALATION_BULK_RESOLVE_MAX', 100);
 /**
  * Claim duration presets shown in the dashboard (minutes).
  * Override via JSON array, e.g. LT_CLAIM_DURATION_OPTIONS='[15,30,60,480]'

package/build/routes/escalations/resolve.js

@@ -66,6 +66,24 @@ function registerResolveRoutes(router) {
         }, req.auth);
         res.status(result.status).json(result.data ?? { error: result.error });
     });
+    /**
+     * POST /api/escalations/resolve-all-or-none
+     * Atomic bulk resolve with per-row payloads: every listed escalation resolves
+     * with its own resolverPayload in one statement, or nothing resolves. Rows
+     * backing a live condition() waiter are woken with their own payload (same
+     * wake contract as /:id/resolve). 409 returns { error, failedIds, failed }
+     * naming exactly the rows that blocked the batch. Max 100 items per call.
+     * Body: { items: Array<{ id: string, resolverPayload: Record<string, any> }>,
+     *         metadata?: Record<string, any>, requireClaimed?: boolean }
+     */
+    router.post('/resolve-all-or-none', async (req, res) => {
+        const result = await api.resolveAllOrNone({
+            items: req.body?.items,
+            metadata: req.body?.metadata,
+            requireClaimed: req.body?.requireClaimed,
+        }, req.auth);
+        res.status(result.status).json(result.data ?? { error: result.error });
+    });
     /**
      * POST /api/escalations/:id/resolve
      * Resolve a pending escalation with a human-provided payload. Routes by

package/build/scripts/twin-farm.d.ts

@@ -3,16 +3,19 @@
  *
  * Spins up the whole DIGITAL side of the physical/digital twin farm from one
  * command and plays every human part automatically, so a single run exercises
- * the full lifecycle: register → advertise → dispatch → print → settle, plus the
- * failure detour (cancel → service → back in the pool). The PHYSICAL side is the
- * app's farm-manager backend — `mock` by default (self-contained), or `http`
- * against a real print-farm-manager host once you wire the office up.
+ * the full lifecycle: onboard (register + bind) → advertise → dispatch → print →
+ * reconcile → settle, plus the failure detours (autonomous fail → inspect, and
+ * filament runout → change → resume). The PHYSICAL side is the app's Bambu
+ * backend — `BAMBU_BACKEND=mock` by default (a deterministic in-repo simulation),
+ * or `http` against a real Farm Manager Server once the office link is wired.
+ *
+ * Faults are injected deterministically via each order unit's `simOutcome` (the
+ * mock honors it), so the service escalations fire on demand — no racing.
  *
  * Usage:
  *   npm run twin:farm
  *   FLEET=6 ORDERS=10 UNITS=2 npm run twin:farm
- *   FAIL_PCT=25 npm run twin:farm                 # rehearse dead-machine → service
- *   FARM_MANAGER_URL=http://192.168.1.50:4000 npm run twin:farm   # preflight the office link
+ *   FAIL_PCT=30 FAIL_MODE=filament_runout npm run twin:farm   # fault → service → recover
  *   FLEET=4 ORDERS=4 KEEP=1 npm run twin:farm     # leave twins running to poke in the UI
  *
  * Env vars:
@@ -24,17 +27,13 @@
  *   FILAMENTS         comma-separated filament pool the fleet + orders draw from
  *                     (default "pla,petg")
  *   ARRIVAL_S         average seconds between order arrivals (default 2)
- *   FAIL_PCT          percent of print jobs to cancel mid-print, exercising the
- *                     service path (default 0). Best-effort: it races the
- *                     physical side, so raise MOCK_PRINT_SECONDS on the app for
- *                     a wider window (see README).
- *   POLL_MS           poll interval ms (default 750)
+ *   FAIL_PCT          percent of orders with one faulted unit (default 0)
+ *   FAIL_MODE         the injected fault: filament_runout | failed (default filament_runout)
+ *   POLL_MS           servicer/registrar poll interval ms (default 750)
  *   BROKER_IDLE       idle broker ticks before it self-terminates (default 40)
  *   RUN_BROKER        launch a broker (default 1; set 0 if one already runs)
  *   KEEP              1 = leave twins advertising at the end (default 0 = retire
  *                     them with a power-down so nothing lingers between runs)
- *   FARM_MANAGER_URL  optional: GET this before running and report reachability,
- *                     a preflight for the office laptop → farm-manager-host link
  *
  * Capabilities: each twin is registered with a capability profile (xl/pdac/soft).
  * By default the fleet is fully capable and only filament routes; set FLEET_CAPS