@hotmeshio/long-tail 0.1.12 → 0.1.14

package/docs/self-test.md

@@ -0,0 +1,106 @@
+# The Self-Test: Long Tail Wraps Its Own API
+
+## The Tool That Wanted to Extend Itself
+
+Long Tail ships with a schema-exchange tool — a baseline capability for exchanging data with any external service under schema enforcement. The tool validates requests before sending and responses after receiving. It doesn't know HTTP from Playwright. It knows endpoints, schemas, and whether the data matched.
+
+This is the story of what happened when someone pointed that tool at Long Tail's own API.
+
+---
+
+## The Starting Point
+
+Long Tail has a REST API. It has endpoints for authentication, for listing registered MCP servers, for querying compiled workflows. Every deployment uses these endpoints — the dashboard calls them, integrations call them, crons call them.
+
+But nobody had ever formalized what those endpoints return. The shapes were implicit — TypeScript interfaces in the codebase, but nothing the runtime could assert against. If a deployment changed a response shape, you found out when the dashboard broke. Or when a customer's integration broke. Or, worst case, you didn't find out at all because the consumer silently swallowed the new shape and produced wrong results downstream.
+
+The schema-exchange tool exists precisely for this problem. It doesn't care whether the endpoint is Epic's FHIR server or Long Tail's own API. The principle is the same: endpoint + schema + validated exchange.
+
+---
+
+## Wrapping the API
+
+An engineer opens Plan Mode in the dashboard and pastes three endpoint specifications:
+
+```
+Long Tail API (base: http://localhost:3000/api)
+
+POST /auth/login
+  Request: { username: string, password: string }
+  Response: { token: string, user: { id: string, external_id: string, display_name: string, roles: [{ role: string, type: string }] } }
+
+GET /mcp/servers (requires Bearer token)
+  Response: { servers: [{ id: string, name: string, description: string, tags: string[], status: string, tool_manifest: [{ name: string, description: string }] }] }
+
+GET /yaml-workflows (requires Bearer token)
+  Response: { workflows: [{ id: string, name: string, app_id: string, status: string, graph_topic: string, tags: string[] }], total: number }
+```
+
+The planner decomposes this into three leaf workflows. The builder discovers the `exchange` tool in the inventory, reads the compile hints, and constructs each workflow as a trigger → exchange → output DAG with embedded schemas.
+
+All three deploy under a server namespace: `longtailapi`.
+
+---
+
+## What the Compiled Tools Do
+
+**`login`** — Takes a username and password. Validates the request body (both strings, both required) against the request schema before sending. Calls POST /auth/login. Validates the response (must have `token` string and `user` object with required fields). Returns the token and user profile.
+
+If someone changes the login response — adds a field, removes `display_name`, changes `roles` from an array to a string — the schema validation catches it. `validated: false`, with a human-readable error explaining exactly what changed.
+
+**`list_servers`** — Takes a bearer token. Calls GET /mcp/servers. Validates the response (must be an object with a `servers` array, each server must have `id`, `name`, `tags`). Returns the server list.
+
+This tool can answer the question: "does the schema-exchange server exist?" If `long-tail-schema-exchange` isn't in the returned list, the tool that's asking the question knows its own infrastructure is broken. The snake eating its own tail.
+
+**`list_workflows`** — Takes a bearer token. Calls GET /yaml-workflows. Validates the response (must be an object with `workflows` array and `total` number). Returns the compiled tool inventory.
+
+This tool can check whether the `longtailapi` tools themselves are deployed and active. It can verify that the very workflows it belongs to are in the list. Self-referential validation — the compiled tool confirms its own existence.
+
+---
+
+## The Composition: Self-Health-Check
+
+The three leaf tools compose into a single workflow: `self_health_check`.
+
+1. **Login** — authenticate with a service account
+2. **List servers** — verify all expected MCP servers are registered
+3. **List workflows** — verify all expected compiled tools are deployed
+
+Each step validates its response schema. If any step fails validation, the workflow knows exactly what changed — not "the API is down" but "the `servers` response is missing the `tags` field on server objects."
+
+Schedule it on cron. Every midnight, the platform checks its own API surface against the schemas it captured when the tools were compiled. Schema drift is caught within 24 hours, automatically, without a human looking at anything.
+
+---
+
+## Why This Matters
+
+This isn't a testing framework. It's the same schema-exchange primitive that wraps Epic's FHIR endpoints or Stripe's payment API or any other external service. The fact that it can wrap Long Tail's own API is a proof point, not a special case.
+
+The proof point is:
+
+1. **Any API surface can be formalized as compiled tools.** Paste the endpoint specs. Get schema-validated, cron-testable tools. No MCP server to hand-write. No integration code. The schema is the integration.
+
+2. **Schema drift detection is automatic.** The response_schema embedded in each compiled tool is the contract. When the contract breaks, the tool reports exactly what changed. Not "500 error" — the actual structural diff.
+
+3. **The tools compose.** Login → use token → check servers → check workflows. Each step is independently testable, independently schedulable, independently versionable. But together they form a health check that validates the entire platform surface.
+
+4. **The platform can extend itself.** The schema-exchange tool is a baseline capability. The compiled API tools are built from it. The health check composes them. Every layer uses the same machinery. New endpoints are absorbed the same way — paste, compile, deploy, schedule.
+
+This is the starting point the Epic story describes: "The engineering team registers a custom MCP server that wraps the FHIR endpoints their referral workflows need." Except here, the engineering team is us, the FHIR endpoints are our own API, and the custom MCP server assembled itself from pasted specs and a schema-exchange primitive.
+
+The SOPs come next. But the plumbing works.
+
+---
+
+## The Integration Test
+
+The file `tests/integration/schema-exchange.test.ts` proves this end-to-end:
+
+1. Calls `exchange` to login (POST /auth/login with request + response schema)
+2. Calls `exchange` to list servers (GET /mcp/servers with response schema)
+3. Asserts the schema-exchange server exists in the response
+4. Calls `exchange` to list workflows (GET /yaml-workflows with response schema)
+5. Deliberately uses a wrong schema to prove drift detection
+6. Deliberately sends a malformed request to prove pre-send rejection
+
+If any assertion fails, the schema-exchange tool isn't doing its job. If they all pass, the platform can wrap any API — including its own.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hotmeshio/long-tail",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "description": "Long Tail Workflows — Durable AI workflows with human-in-the-loop escalation. Powered by PostgreSQL.",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",
@@ -61,12 +61,14 @@
   "dependencies": {
     "@anthropic-ai/sdk": "^0.92.0",
     "@aws-sdk/client-s3": "^3.1017.0",
-    "@hotmeshio/hotmesh": "^0.14.4",
+    "@aws-sdk/s3-request-presigner": "^3.1045.0",
+    "@hotmeshio/hotmesh": "^0.14.7",
     "@modelcontextprotocol/sdk": "^1.27.1",
     "@opentelemetry/exporter-trace-otlp-proto": "^0.215.0",
     "@opentelemetry/resources": "^2.5.1",
     "@opentelemetry/sdk-node": "^0.215.0",
     "@opentelemetry/semantic-conventions": "^1.39.0",
+    "ajv": "^8.20.0",
     "arctic": "^3.7.0",
     "bcryptjs": "^2.4.3",
     "express": "^5.1.0",

package/build/lib/db/schemas/003_workflow_discovery.sql

@@ -1,39 +0,0 @@
--- Workflow discovery: full-text search, original prompt, and category.
-
--- Original prompt that spawned this workflow (richest semantic signal)
-ALTER TABLE lt_yaml_workflows ADD COLUMN IF NOT EXISTS original_prompt TEXT;
-
--- Capability category derived from tool usage patterns
-ALTER TABLE lt_yaml_workflows ADD COLUMN IF NOT EXISTS category TEXT;
-
--- Full-text search vector, auto-maintained by trigger
-ALTER TABLE lt_yaml_workflows ADD COLUMN IF NOT EXISTS search_vector TSVECTOR;
-
--- GIN index on search_vector for fast full-text search
-CREATE INDEX IF NOT EXISTS idx_lt_yaml_workflows_search
-  ON lt_yaml_workflows USING GIN (search_vector);
-
--- Index on category for filtered queries
-CREATE INDEX IF NOT EXISTS idx_lt_yaml_workflows_category
-  ON lt_yaml_workflows (category) WHERE category IS NOT NULL;
-
--- Trigger: rebuild search_vector from name, description, tags, original_prompt, category
-CREATE OR REPLACE FUNCTION lt_yaml_workflows_search_vector_update()
-RETURNS TRIGGER AS $$
-BEGIN
-  NEW.search_vector :=
-    setweight(to_tsvector('english', coalesce(NEW.name, '')), 'A') ||
-    setweight(to_tsvector('english', coalesce(NEW.original_prompt, '')), 'A') ||
-    setweight(to_tsvector('english', coalesce(NEW.description, '')), 'B') ||
-    setweight(to_tsvector('english', coalesce(NEW.category, '')), 'C') ||
-    setweight(to_tsvector('english', coalesce(array_to_string(NEW.tags, ' '), '')), 'C');
-  RETURN NEW;
-END;
-$$ LANGUAGE plpgsql;
-
-CREATE OR REPLACE TRIGGER trg_lt_yaml_workflows_search_vector
-  BEFORE INSERT OR UPDATE ON lt_yaml_workflows
-  FOR EACH ROW EXECUTE FUNCTION lt_yaml_workflows_search_vector_update();
-
--- Backfill search_vector for existing rows
-UPDATE lt_yaml_workflows SET updated_at = NOW();

package/build/lib/db/schemas/004_query_router.sql

@@ -1,38 +0,0 @@
--- Split mcpQuery into router + dynamic + deterministic workflows.
--- mcpQueryRouter is the new entry point (orchestrator).
--- mcpQuery becomes dynamic-only (leaf).
--- mcpDeterministic invokes compiled YAML workflows (leaf).
-
--- Update existing mcpQuery: no longer directly invocable (called via router)
-UPDATE lt_config_workflows
-SET invocable = false,
-    description = 'Dynamic MCP tool orchestration — LLM agentic loop with raw MCP tools'
-WHERE workflow_type = 'mcpQuery';
-
--- Add mcpQueryRouter (orchestrator — the new entry point)
-INSERT INTO lt_config_workflows
-  (workflow_type, task_queue, default_role, invocable, description, tool_tags, envelope_schema)
-VALUES
-  ('mcpQueryRouter', 'long-tail-system', 'engineer', true,
-   'Do anything with tools — browser automation, file operations, HTTP requests, database queries, document processing, and more',
-   '{}',
-   '{"data": {"prompt": "Describe what you want to accomplish using available tools..."}, "metadata": {"source": "dashboard"}}'::jsonb)
-ON CONFLICT (workflow_type) DO NOTHING;
-
--- Add mcpDeterministic (leaf — invokes compiled YAML workflows)
-INSERT INTO lt_config_workflows
-  (workflow_type, task_queue, default_role, invocable, description, tool_tags)
-VALUES
-  ('mcpDeterministic', 'long-tail-system', 'engineer', false,
-   'Deterministic execution — invokes matched compiled YAML workflows with extracted inputs',
-   '{}')
-ON CONFLICT (workflow_type) DO NOTHING;
-
--- Assign roles
-INSERT INTO lt_config_roles (workflow_type, role)
-SELECT 'mcpQueryRouter', unnest(ARRAY['reviewer', 'engineer', 'admin'])
-ON CONFLICT (workflow_type, role) DO NOTHING;
-
-INSERT INTO lt_config_roles (workflow_type, role)
-SELECT 'mcpDeterministic', unnest(ARRAY['reviewer', 'engineer', 'admin'])
-ON CONFLICT (workflow_type, role) DO NOTHING;

package/build/lib/db/schemas/004_workflow_sets.sql

@@ -1,29 +0,0 @@
--- Workflow sets: groups of related workflows produced by plan mode.
-
-CREATE TABLE IF NOT EXISTS lt_workflow_sets (
-  id                 UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-  name               TEXT UNIQUE NOT NULL,
-  description        TEXT,
-  specification      TEXT NOT NULL,
-  plan               JSONB NOT NULL DEFAULT '[]'::JSONB,
-  namespaces         TEXT[] NOT NULL DEFAULT '{}',
-  status             TEXT NOT NULL DEFAULT 'planning'
-                       CHECK (status IN ('planning','planned','building','deploying','completed','failed')),
-  source_workflow_id TEXT,
-  created_at         TIMESTAMPTZ NOT NULL DEFAULT NOW(),
-  updated_at         TIMESTAMPTZ NOT NULL DEFAULT NOW()
-);
-
-CREATE OR REPLACE TRIGGER trg_lt_workflow_sets_updated_at
-  BEFORE UPDATE ON lt_workflow_sets
-  FOR EACH ROW EXECUTE FUNCTION lt_set_updated_at();
-
--- Extend lt_yaml_workflows with set membership columns
-ALTER TABLE lt_yaml_workflows ADD COLUMN IF NOT EXISTS set_id UUID
-  REFERENCES lt_workflow_sets(id) ON DELETE SET NULL;
-ALTER TABLE lt_yaml_workflows ADD COLUMN IF NOT EXISTS set_role TEXT
-  CHECK (set_role IN ('leaf', 'composition', 'router'));
-ALTER TABLE lt_yaml_workflows ADD COLUMN IF NOT EXISTS set_build_order INTEGER;
-
-CREATE INDEX IF NOT EXISTS idx_lt_yaml_workflows_set_id
-  ON lt_yaml_workflows (set_id) WHERE set_id IS NOT NULL;

package/build/lib/db/schemas/005_triage_router.sql

@@ -1,37 +0,0 @@
--- Split mcpTriage into router + dynamic + deterministic workflows.
--- mcpTriageRouter is the new entry point (orchestrator).
--- mcpTriage becomes dynamic-only (leaf).
--- mcpTriageDeterministic invokes compiled YAML workflows (leaf).
-
--- Update existing mcpTriage: no longer directly invocable (called via router)
-UPDATE lt_config_workflows
-SET invocable = false,
-    description = 'Dynamic MCP triage — LLM agentic loop for escalation remediation'
-WHERE workflow_type = 'mcpTriage';
-
--- Add mcpTriageRouter (orchestrator — the new entry point for triage)
-INSERT INTO lt_config_workflows
-  (workflow_type, task_queue, default_role, invocable, description, tool_tags)
-VALUES
-  ('mcpTriageRouter', 'long-tail-system', 'engineer', false,
-   'Triage router — discovers compiled workflows for remediation, routes to deterministic or dynamic triage',
-   '{}')
-ON CONFLICT (workflow_type) DO NOTHING;
-
--- Add mcpTriageDeterministic (leaf — invokes compiled triage workflows)
-INSERT INTO lt_config_workflows
-  (workflow_type, task_queue, default_role, invocable, description, tool_tags)
-VALUES
-  ('mcpTriageDeterministic', 'long-tail-system', 'engineer', false,
-   'Deterministic triage — invokes matched compiled workflows for escalation remediation',
-   '{}')
-ON CONFLICT (workflow_type) DO NOTHING;
-
--- Assign roles
-INSERT INTO lt_config_roles (workflow_type, role)
-SELECT 'mcpTriageRouter', unnest(ARRAY['reviewer', 'engineer', 'admin'])
-ON CONFLICT (workflow_type, role) DO NOTHING;
-
-INSERT INTO lt_config_roles (workflow_type, role)
-SELECT 'mcpTriageDeterministic', unnest(ARRAY['reviewer', 'engineer', 'admin'])
-ON CONFLICT (workflow_type, role) DO NOTHING;

package/build/lib/db/schemas/005_unique_graph_topic.sql

@@ -1,7 +0,0 @@
--- Enforce unique graph_topic per app_id for non-archived workflows.
--- Two active/deployed/draft workflows in the same namespace must not
--- share a subscribes topic — deploying them would cause routing collisions.
-
-CREATE UNIQUE INDEX IF NOT EXISTS idx_lt_yaml_workflows_app_topic_unique
-  ON lt_yaml_workflows (app_id, graph_topic)
-  WHERE status != 'archived';

package/build/lib/db/schemas/006_oauth.sql

@@ -1,50 +0,0 @@
--- ── OAuth token storage ─────────────────────────────────────────────────────
--- Encrypted per-user, per-provider OAuth tokens for identity and resource OAuth.
-
-CREATE TABLE IF NOT EXISTS lt_oauth_tokens (
-  id                UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-  user_id           UUID NOT NULL REFERENCES lt_users(id) ON DELETE CASCADE,
-  provider          TEXT NOT NULL,
-  label             TEXT NOT NULL DEFAULT 'default',
-  access_token_enc  TEXT NOT NULL,
-  refresh_token_enc TEXT,
-  token_type        TEXT NOT NULL DEFAULT 'bearer',
-  scopes            TEXT[] NOT NULL DEFAULT '{}',
-  expires_at        TIMESTAMPTZ,
-  provider_user_id  TEXT NOT NULL,
-  provider_email    TEXT,
-  metadata          JSONB,
-  created_at        TIMESTAMPTZ NOT NULL DEFAULT NOW(),
-  updated_at        TIMESTAMPTZ NOT NULL DEFAULT NOW(),
-  UNIQUE (user_id, provider, label)
-);
-
--- Migration: add label column for multiple credentials per provider per user.
--- Existing rows get 'default'. The unique constraint moves from (user_id, provider)
--- to (user_id, provider, label).
-ALTER TABLE lt_oauth_tokens ADD COLUMN IF NOT EXISTS label TEXT NOT NULL DEFAULT 'default';
-
--- Drop old unique constraint if it exists (safe no-op if already migrated)
-DO $$ BEGIN
-  ALTER TABLE lt_oauth_tokens DROP CONSTRAINT IF EXISTS lt_oauth_tokens_user_id_provider_key;
-EXCEPTION WHEN undefined_object THEN NULL;
-END $$;
-
--- Create the new composite unique constraint (idempotent via IF NOT EXISTS on index)
-CREATE UNIQUE INDEX IF NOT EXISTS lt_oauth_tokens_user_id_provider_label_key
-  ON lt_oauth_tokens (user_id, provider, label);
-
-CREATE INDEX IF NOT EXISTS idx_lt_oauth_tokens_provider
-  ON lt_oauth_tokens (provider, user_id);
-
-CREATE OR REPLACE TRIGGER trg_lt_oauth_tokens_updated_at
-  BEFORE UPDATE ON lt_oauth_tokens
-  FOR EACH ROW EXECUTE FUNCTION lt_set_updated_at();
-
--- ── Identity link columns on lt_users ──────────────────────────────────────
-ALTER TABLE lt_users ADD COLUMN IF NOT EXISTS oauth_provider TEXT;
-ALTER TABLE lt_users ADD COLUMN IF NOT EXISTS oauth_provider_id TEXT;
-
-CREATE INDEX IF NOT EXISTS idx_lt_users_oauth
-  ON lt_users (oauth_provider, oauth_provider_id)
-  WHERE oauth_provider IS NOT NULL;

package/build/lib/db/schemas/007_security.sql

@@ -1,27 +0,0 @@
--- ── Service tokens for external MCP servers ─────────────────────────────────
-CREATE TABLE IF NOT EXISTS lt_service_tokens (
-  id           UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-  name         TEXT UNIQUE NOT NULL,
-  token_hash   TEXT NOT NULL,
-  server_id    UUID REFERENCES lt_mcp_servers(id) ON DELETE CASCADE,
-  scopes       TEXT[] NOT NULL DEFAULT '{}',
-  expires_at   TIMESTAMPTZ,
-  last_used_at TIMESTAMPTZ,
-  created_at   TIMESTAMPTZ NOT NULL DEFAULT NOW(),
-  updated_at   TIMESTAMPTZ NOT NULL DEFAULT NOW()
-);
-
-CREATE INDEX IF NOT EXISTS idx_lt_service_tokens_server
-  ON lt_service_tokens (server_id);
-
-CREATE OR REPLACE TRIGGER trg_lt_service_tokens_updated_at
-  BEFORE UPDATE ON lt_service_tokens
-  FOR EACH ROW EXECUTE FUNCTION lt_set_updated_at();
-
--- ── Audit: who initiated escalations ────────────────────────────────────────
-ALTER TABLE lt_escalations ADD COLUMN IF NOT EXISTS created_by UUID REFERENCES lt_users(id);
-CREATE INDEX IF NOT EXISTS idx_lt_escalations_created_by
-  ON lt_escalations (created_by) WHERE created_by IS NOT NULL;
-
--- ── Scope declarations for MCP servers ──────────────────────────────────────
-ALTER TABLE lt_mcp_servers ADD COLUMN IF NOT EXISTS required_scopes TEXT[] NOT NULL DEFAULT '{}';

package/build/lib/db/schemas/008_bot_accounts.sql

@@ -1,30 +0,0 @@
--- 008_bot_accounts.sql
--- Bot/service account support for universal IAM.
--- Bots live in lt_users (account_type = 'bot') and authenticate via API keys.
-
--- Add account_type column to lt_users to distinguish human vs bot accounts.
-ALTER TABLE lt_users ADD COLUMN IF NOT EXISTS account_type TEXT NOT NULL DEFAULT 'user';
-
--- Apply check constraint (idempotent: skip if already exists).
-DO $$ BEGIN
-  ALTER TABLE lt_users ADD CONSTRAINT lt_users_account_type_check
-    CHECK (account_type IN ('user', 'bot'));
-EXCEPTION
-  WHEN duplicate_object THEN NULL;
-END $$;
-
--- Bot API keys — similar to lt_service_tokens but scoped to a user (bot) account.
-CREATE TABLE IF NOT EXISTS lt_bot_api_keys (
-  id           UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-  name         TEXT NOT NULL,
-  user_id      UUID NOT NULL REFERENCES lt_users(id) ON DELETE CASCADE,
-  key_hash     TEXT NOT NULL,
-  scopes       TEXT[] NOT NULL DEFAULT '{}',
-  expires_at   TIMESTAMPTZ,
-  last_used_at TIMESTAMPTZ,
-  created_at   TIMESTAMPTZ NOT NULL DEFAULT NOW(),
-  updated_at   TIMESTAMPTZ NOT NULL DEFAULT NOW(),
-  UNIQUE (user_id, name)
-);
-
-CREATE INDEX IF NOT EXISTS idx_bot_api_keys_user_id ON lt_bot_api_keys (user_id);

package/build/lib/db/schemas/009_audit_trail.sql

@@ -1,7 +0,0 @@
--- 009_audit_trail.sql
--- Add IAM audit columns to lt_tasks for identity traceability.
-
-ALTER TABLE lt_tasks ADD COLUMN IF NOT EXISTS initiated_by UUID REFERENCES lt_users(id) ON DELETE SET NULL;
-ALTER TABLE lt_tasks ADD COLUMN IF NOT EXISTS principal_type TEXT DEFAULT 'user';
-
-CREATE INDEX IF NOT EXISTS idx_lt_tasks_initiated_by ON lt_tasks (initiated_by) WHERE initiated_by IS NOT NULL;

package/build/lib/db/schemas/010_credential_providers.sql

@@ -1,4 +0,0 @@
--- Add credential_providers column to lt_mcp_servers
--- Declares which credential providers a server's tools need
-ALTER TABLE lt_mcp_servers
-  ADD COLUMN IF NOT EXISTS credential_providers TEXT[] NOT NULL DEFAULT '{}';

package/build/lib/db/schemas/011_system_workflow_configs.sql

@@ -1,37 +0,0 @@
--- Ensure all system leaf workflows have config entries.
--- Migrations 004/005 tried to UPDATE these but they were never seeded —
--- the interceptor needs config entries to wrap workflows with lifecycle events.
-
-INSERT INTO lt_config_workflows
-  (workflow_type, task_queue, default_role, invocable, description, tool_tags)
-VALUES
-  ('mcpQuery', 'long-tail-system', 'engineer', false,
-   'Dynamic MCP tool orchestration — LLM agentic loop with raw MCP tools',
-   '{}'),
-  ('mcpTriage', 'long-tail-system', 'engineer', false,
-   'Dynamic MCP triage — LLM agentic loop for escalation remediation',
-   '{}'),
-  ('mcpWorkflowBuilder', 'long-tail-system', 'engineer', false,
-   'Direct pipeline builder — LLM constructs DAG from tool schemas',
-   '{}'),
-  ('mcpWorkflowPlanner', 'long-tail-system', 'engineer', false,
-   'Plan mode — decomposes specifications into multi-workflow sets',
-   '{}')
-ON CONFLICT (workflow_type) DO NOTHING;
-
--- Assign roles
-INSERT INTO lt_config_roles (workflow_type, role)
-SELECT 'mcpQuery', unnest(ARRAY['reviewer', 'engineer', 'admin'])
-ON CONFLICT (workflow_type, role) DO NOTHING;
-
-INSERT INTO lt_config_roles (workflow_type, role)
-SELECT 'mcpTriage', unnest(ARRAY['reviewer', 'engineer', 'admin'])
-ON CONFLICT (workflow_type, role) DO NOTHING;
-
-INSERT INTO lt_config_roles (workflow_type, role)
-SELECT 'mcpWorkflowBuilder', unnest(ARRAY['reviewer', 'engineer', 'admin'])
-ON CONFLICT (workflow_type, role) DO NOTHING;
-
-INSERT INTO lt_config_roles (workflow_type, role)
-SELECT 'mcpWorkflowPlanner', unnest(ARRAY['reviewer', 'engineer', 'admin'])
-ON CONFLICT (workflow_type, role) DO NOTHING;

package/build/lib/db/schemas/012_drop_modality.sql

@@ -1,6 +0,0 @@
--- Remove delivery modality — the concept was never used for actual routing.
--- Alpha cleanup: drop from config, escalations, and tasks tables.
-
-ALTER TABLE lt_config_workflows DROP COLUMN IF EXISTS default_modality;
-ALTER TABLE lt_escalations DROP COLUMN IF EXISTS modality;
-ALTER TABLE lt_tasks DROP COLUMN IF EXISTS modality;

package/build/lib/db/schemas/013_execute_as.sql

@@ -1,9 +0,0 @@
--- Add execute_as to workflow configs: proxy invocation identity.
--- When set, workflows run as the named bot instead of the invoking user.
-
-ALTER TABLE lt_config_workflows ADD COLUMN IF NOT EXISTS execute_as TEXT;
-
--- Add executing_as to tasks: records the actual executing principal
--- (may differ from initiated_by when proxy invocation is used).
-
-ALTER TABLE lt_tasks ADD COLUMN IF NOT EXISTS executing_as TEXT;

package/build/lib/db/schemas/014_ephemeral_credentials.sql

@@ -1,16 +0,0 @@
--- Ephemeral credential store for sensitive fields in waitFor signal payloads.
--- Supports max_uses (0 = unlimited) and TTL-based expiry.
-
-CREATE TABLE IF NOT EXISTS lt_ephemeral_credentials (
-  token       UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-  value       BYTEA NOT NULL,
-  label       TEXT,
-  max_uses    INTEGER NOT NULL DEFAULT 0,
-  use_count   INTEGER NOT NULL DEFAULT 0,
-  expires_at  TIMESTAMPTZ,
-  created_at  TIMESTAMPTZ NOT NULL DEFAULT NOW()
-);
-
-CREATE INDEX IF NOT EXISTS idx_lt_ephemeral_expiry
-  ON lt_ephemeral_credentials (expires_at)
-  WHERE expires_at IS NOT NULL;

package/build/lib/db/schemas/015_knowledge.sql

@@ -1,23 +0,0 @@
--- Long Tail Knowledge Store
--- Persistent JSONB memory for autonomous agents. Each entry lives in a domain
--- (lightweight namespace) and is keyed by a human-readable string.
-
-CREATE TABLE IF NOT EXISTS lt_knowledge (
-  id          UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-  domain      TEXT NOT NULL,
-  key         TEXT NOT NULL,
-  data        JSONB NOT NULL DEFAULT '{}',
-  tags        TEXT[] NOT NULL DEFAULT '{}',
-  created_at  TIMESTAMPTZ NOT NULL DEFAULT NOW(),
-  updated_at  TIMESTAMPTZ NOT NULL DEFAULT NOW(),
-  UNIQUE(domain, key)
-);
-
-CREATE INDEX IF NOT EXISTS idx_lt_knowledge_domain ON lt_knowledge (domain);
-CREATE INDEX IF NOT EXISTS idx_lt_knowledge_tags ON lt_knowledge USING GIN (tags);
-CREATE INDEX IF NOT EXISTS idx_lt_knowledge_data ON lt_knowledge USING GIN (data);
-
-DROP TRIGGER IF EXISTS lt_knowledge_updated_at ON lt_knowledge;
-CREATE TRIGGER lt_knowledge_updated_at
-  BEFORE UPDATE ON lt_knowledge
-  FOR EACH ROW EXECUTE FUNCTION lt_set_updated_at();

package/build/lib/db/schemas/016_streamable_http.sql

@@ -1,7 +0,0 @@
--- Allow 'streamable-http' as a transport type for MCP servers
-ALTER TABLE lt_mcp_servers
-  DROP CONSTRAINT IF EXISTS lt_mcp_servers_transport_type_check;
-
-ALTER TABLE lt_mcp_servers
-  ADD CONSTRAINT lt_mcp_servers_transport_type_check
-  CHECK (transport_type IN ('stdio', 'sse', 'streamable-http'));

package/dashboard/dist/assets/CredentialsPage-DJablIbs.js

@@ -1,2 +0,0 @@
-import{A as v,B as C,j as e,O as c,z as P}from"./index-BYZX9tOb.js";import{a as n}from"./vendor-query-DLp59M9_.js";import{P as D}from"./PageHeader-BcTVF9ul.js";import{T as E}from"./TimeAgo-BZdLdrIh.js";import{C as j}from"./ConfirmDeleteModal-DZMgmlof.js";import{a9 as V,C as y,ac as k,j as A}from"./vendor-icons-T4r2DSPD.js";import"./vendor-react-Co3Y8ikm.js";import"./Modal-BuTvD0pz.js";const d={anthropic:{name:"Anthropic",helpText:'Run "claude setup-token" for an OAuth token, or use an API key from console.anthropic.com.',placeholder:"sk-ant-oat01-... or sk-ant-api03-..."},openai:{name:"OpenAI",helpText:"Create an API key at platform.openai.com/api-keys.",placeholder:"sk-..."}};function z(){var m,p;const{data:r,isLoading:u}=v(),i=C(),[a,l]=n.useState(null),[b,N]=n.useState(!1),[t,g]=n.useState("anthropic"),o=(r==null?void 0:r.connections)??[],x=()=>{a&&i.mutate({provider:a.provider,label:a.label},{onSuccess:()=>l(null)})},h=s=>`/api/auth/oauth/connect/${s}?token=${encodeURIComponent(P()||"")}&returnTo=/credentials`;return e.jsxDEV("div",{children:[e.jsxDEV(D,{title:"Credentials",actions:e.jsxDEV("button",{onClick:()=>N(s=>!s),className:"btn-primary text-xs inline-flex items-center gap-1.5",children:[e.jsxDEV(V,{className:"w-3.5 h-3.5"},void 0,!1,{fileName:"/app/dashboard/src/pages/settings/CredentialsPage.tsx",lineNumber:57,columnNumber:13},this),"Add Credential"]},void 0,!0,{fileName:"/app/dashboard/src/pages/settings/CredentialsPage.tsx",lineNumber:53,columnNumber:11},this)},void 0,!1,{fileName:"/app/dashboard/src/pages/settings/CredentialsPage.tsx",lineNumber:50,columnNumber:7},this),e.jsxDEV("p",{className:"text-sm text-text-secondary mb-6",children:"Manage credentials used by tools when invoked on your behalf. Each credential is encrypted at rest and resolved automatically during tool execution."},void 0,!1,{fileName:"/app/dashboard/src/pages/settings/CredentialsPage.tsx",lineNumber:63,columnNumber:7},this),b&&e.jsxDEV("div",{className:"mb-6 p-4 bg-surface-raised border border-surface-border rounded-md space-y-3",children:[e.jsxDEV("div",{className:"flex items-center gap-3",children:[e.jsxDEV("label",{className:"text-xs text-text-secondary font-medium",children:"Provider"},void 0,!1,{fileName:"/app/dashboard/src/pages/settings/CredentialsPage.tsx",lineNumber:72,columnNumber:13},this),e.jsxDEV("div",{className:"relative",children:[e.jsxDEV("select",{value:t,onChange:s=>g(s.target.value),className:"input text-xs pr-7 appearance-none",children:Object.entries(d).map(([s,f])=>e.jsxDEV("option",{value:s,children:f.name},s,!1,{fileName:"/app/dashboard/src/pages/settings/CredentialsPage.tsx",lineNumber:80,columnNumber:19},this))},void 0,!1,{fileName:"/app/dashboard/src/pages/settings/CredentialsPage.tsx",lineNumber:74,columnNumber:15},this),e.jsxDEV(y,{className:"absolute right-2 top-1/2 -translate-y-1/2 w-3 h-3 text-text-tertiary pointer-events-none"},void 0,!1,{fileName:"/app/dashboard/src/pages/settings/CredentialsPage.tsx",lineNumber:83,columnNumber:15},this)]},void 0,!0,{fileName:"/app/dashboard/src/pages/settings/CredentialsPage.tsx",lineNumber:73,columnNumber:13},this)]},void 0,!0,{fileName:"/app/dashboard/src/pages/settings/CredentialsPage.tsx",lineNumber:71,columnNumber:11},this),e.jsxDEV("p",{className:"text-xs text-text-tertiary",children:(m=d[t])==null?void 0:m.helpText},void 0,!1,{fileName:"/app/dashboard/src/pages/settings/CredentialsPage.tsx",lineNumber:86,columnNumber:11},this),e.jsxDEV("a",{href:h(t),className:"btn-primary text-xs inline-flex items-center gap-1.5",children:[e.jsxDEV(c,{provider:t,className:"w-3.5 h-3.5"},void 0,!1,{fileName:"/app/dashboard/src/pages/settings/CredentialsPage.tsx",lineNumber:93,columnNumber:13},this),"Connect ",(p=d[t])==null?void 0:p.name]},void 0,!0,{fileName:"/app/dashboard/src/pages/settings/CredentialsPage.tsx",lineNumber:89,columnNumber:11},this)]},void 0,!0,{fileName:"/app/dashboard/src/pages/settings/CredentialsPage.tsx",lineNumber:70,columnNumber:9},this),u?e.jsxDEV("div",{className:"animate-pulse space-y-3",children:[1,2].map(s=>e.jsxDEV("div",{className:"h-16 bg-surface-sunken rounded"},s,!1,{fileName:"/app/dashboard/src/pages/settings/CredentialsPage.tsx",lineNumber:103,columnNumber:13},this))},void 0,!1,{fileName:"/app/dashboard/src/pages/settings/CredentialsPage.tsx",lineNumber:101,columnNumber:9},this):o.length===0?e.jsxDEV("div",{className:"text-center py-16 text-text-tertiary",children:[e.jsxDEV(k,{className:"w-10 h-10 mx-auto mb-3 opacity-40"},void 0,!1,{fileName:"/app/dashboard/src/pages/settings/CredentialsPage.tsx",lineNumber:108,columnNumber:11},this),e.jsxDEV("p",{className:"text-sm",children:"No credentials registered."},void 0,!1,{fileName:"/app/dashboard/src/pages/settings/CredentialsPage.tsx",lineNumber:109,columnNumber:11},this),e.jsxDEV("p",{className:"text-xs mt-1",children:"Add a credential to enable tool authentication."},void 0,!1,{fileName:"/app/dashboard/src/pages/settings/CredentialsPage.tsx",lineNumber:110,columnNumber:11},this)]},void 0,!0,{fileName:"/app/dashboard/src/pages/settings/CredentialsPage.tsx",lineNumber:107,columnNumber:9},this):e.jsxDEV("div",{className:"space-y-2",children:o.map(s=>e.jsxDEV("div",{className:"group/row flex items-center gap-4 px-4 py-3 bg-surface-raised border border-surface-border rounded-md",children:[e.jsxDEV(c,{provider:s.provider,className:"w-6 h-6 shrink-0"},void 0,!1,{fileName:"/app/dashboard/src/pages/settings/CredentialsPage.tsx",lineNumber:119,columnNumber:15},this),e.jsxDEV("div",{className:"flex-1 min-w-0",children:[e.jsxDEV("div",{className:"flex items-center gap-2",children:[e.jsxDEV("span",{className:"text-sm text-text-primary font-medium capitalize",children:s.provider},void 0,!1,{fileName:"/app/dashboard/src/pages/settings/CredentialsPage.tsx",lineNumber:123,columnNumber:19},this),s.label!=="default"&&e.jsxDEV("span",{className:"text-[10px] px-1.5 py-0.5 bg-surface-sunken rounded text-text-tertiary",children:s.label},void 0,!1,{fileName:"/app/dashboard/src/pages/settings/CredentialsPage.tsx",lineNumber:127,columnNumber:21},this),s.credential_type&&e.jsxDEV("span",{className:"text-[10px] px-1.5 py-0.5 bg-accent-faint rounded text-accent",children:s.credential_type},void 0,!1,{fileName:"/app/dashboard/src/pages/settings/CredentialsPage.tsx",lineNumber:132,columnNumber:21},this)]},void 0,!0,{fileName:"/app/dashboard/src/pages/settings/CredentialsPage.tsx",lineNumber:122,columnNumber:17},this),e.jsxDEV("div",{className:"flex items-center gap-3 mt-0.5",children:[s.email&&e.jsxDEV("span",{className:"text-xs text-text-tertiary",children:s.email},void 0,!1,{fileName:"/app/dashboard/src/pages/settings/CredentialsPage.tsx",lineNumber:139,columnNumber:21},this),s.expires_at&&e.jsxDEV("span",{className:"text-xs text-text-tertiary",children:["Expires ",e.jsxDEV(E,{date:s.expires_at},void 0,!1,{fileName:"/app/dashboard/src/pages/settings/CredentialsPage.tsx",lineNumber:143,columnNumber:31},this)]},void 0,!0,{fileName:"/app/dashboard/src/pages/settings/CredentialsPage.tsx",lineNumber:142,columnNumber:21},this)]},void 0,!0,{fileName:"/app/dashboard/src/pages/settings/CredentialsPage.tsx",lineNumber:137,columnNumber:17},this)]},void 0,!0,{fileName:"/app/dashboard/src/pages/settings/CredentialsPage.tsx",lineNumber:121,columnNumber:15},this),e.jsxDEV("button",{onClick:()=>l({provider:s.provider,label:s.label}),className:"opacity-0 group-hover/row:opacity-100 transition-opacity text-text-tertiary hover:text-status-error",title:"Revoke credential",children:e.jsxDEV(A,{className:"w-4 h-4"},void 0,!1,{fileName:"/app/dashboard/src/pages/settings/CredentialsPage.tsx",lineNumber:154,columnNumber:17},this)},void 0,!1,{fileName:"/app/dashboard/src/pages/settings/CredentialsPage.tsx",lineNumber:149,columnNumber:15},this)]},`${s.provider}-${s.label}`,!0,{fileName:"/app/dashboard/src/pages/settings/CredentialsPage.tsx",lineNumber:115,columnNumber:13},this))},void 0,!1,{fileName:"/app/dashboard/src/pages/settings/CredentialsPage.tsx",lineNumber:113,columnNumber:9},this),e.jsxDEV(j,{open:!!a,onClose:()=>l(null),onConfirm:x,title:"Revoke Credential",description:e.jsxDEV(e.Fragment,{children:["Revoke the"," ",e.jsxDEV("span",{className:"font-medium text-text-primary capitalize",children:a==null?void 0:a.provider},void 0,!1,{fileName:"/app/dashboard/src/pages/settings/CredentialsPage.tsx",lineNumber:169,columnNumber:13},this),(a==null?void 0:a.label)!=="default"&&e.jsxDEV(e.Fragment,{children:[" (",a==null?void 0:a.label,")"]},void 0,!0,{fileName:"/app/dashboard/src/pages/settings/CredentialsPage.tsx",lineNumber:173,columnNumber:15},this)," ","credential? Tools will no longer be able to use this credential."]},void 0,!0,{fileName:"/app/dashboard/src/pages/settings/CredentialsPage.tsx",lineNumber:167,columnNumber:11},this),isPending:i.isPending,error:i.error},void 0,!1,{fileName:"/app/dashboard/src/pages/settings/CredentialsPage.tsx",lineNumber:161,columnNumber:7},this)]},void 0,!0,{fileName:"/app/dashboard/src/pages/settings/CredentialsPage.tsx",lineNumber:49,columnNumber:5},this)}export{z as CredentialsPage};
-//# sourceMappingURL=CredentialsPage-DJablIbs.js.map