@hotmeshio/long-tail 0.1.13 → 0.1.14

package/build/modules/utils.js

@@ -0,0 +1,84 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sanitizeToolName = sanitizeToolName;
+exports.sanitizeServerName = sanitizeServerName;
+/**
+ * Sanitize a value for use as an MCP tool name or HotMesh graph topic
+ * (the `subscribes` field in a YAML DAG).
+ *
+ * ## Why snake_case
+ *
+ * MCP tool names become the `subscribes` topic in a HotMesh YAML DAG.
+ * That topic is how the system routes incoming messages to the correct
+ * workflow. The same value also appears in `worker` activity `topic`
+ * fields and in the `mcp_<server>_<tool>` activity type encoding.
+ *
+ * Because the activity type uses underscores to delimit server from tool
+ * (`mcp_longtail_take_screenshot`), both the server name (letters only)
+ * and the tool name (snake_case) must avoid dashes, dots, or other
+ * separators that would create ambiguity when parsing activity types.
+ *
+ * ## Risks if violated
+ *
+ * - Dashes in tool names cause `parseMcpActivityType()` to mis-split
+ *   the server/tool boundary in activity type strings.
+ * - Dots or special chars can produce invalid HotMesh topic subscriptions
+ *   that silently fail to route.
+ * - Mixed conventions across entry points (builder, planner, discovery)
+ *   cause topic collisions or deployment failures when merging workflows
+ *   into a single app namespace.
+ *
+ * ## Contract
+ *
+ * Input:  any string (LLM output, user input, URL slug, etc.)
+ * Output: lowercase letters, digits, and underscores only.
+ *         Runs of non-alphanumeric chars become a single underscore.
+ *         No leading or trailing underscores.
+ *
+ * This is the ONE canonical backend implementation. The dashboard has an
+ * identical copy at `dashboard/src/lib/sanitize.ts`. No other file in
+ * the platform may inline this logic.
+ */
+function sanitizeToolName(value) {
+    return value
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '_')
+        .replace(/^_|_$/g, '');
+}
+/**
+ * Sanitize a value for use as an MCP server name (the HotMesh `app.id`
+ * and Postgres schema name that isolates one server's workflows from another).
+ *
+ * ## Why lowercase alphanumeric, leading letter
+ *
+ * The server name becomes:
+ *   1. A Postgres schema name — must start with a letter; letters and digits
+ *      are safe without quoting.
+ *   2. The first segment in the `mcp_<server>_<tool>` activity type encoding.
+ *      Because underscores delimit server from tool, the server name itself
+ *      must never contain underscores (or dashes, dots, etc.).
+ *
+ * ## Risks if violated
+ *
+ * - Underscores or dashes in the server name make `parseMcpActivityType()`
+ *   split incorrectly — it uses the first `_` after `mcp_` as the boundary.
+ * - A leading digit produces an invalid Postgres schema name that requires
+ *   quoting and breaks HotMesh's unquoted SQL paths.
+ * - Special characters can cause silent deployment failures or schema
+ *   creation errors.
+ *
+ * ## Contract
+ *
+ * Input:  any string (LLM suggestion, user input, etc.)
+ * Output: lowercase letters and digits only, guaranteed to start with a letter.
+ *         All non-alphanumeric chars are stripped (not replaced).
+ *         Leading digits are stripped so the result starts with a letter.
+ *         Default: 'longtail' if the result is empty after sanitization.
+ *
+ * This is the ONE canonical backend implementation. The dashboard has an
+ * identical copy at `dashboard/src/lib/sanitize.ts`. No other file in
+ * the platform may inline this logic.
+ */
+function sanitizeServerName(value) {
+    return value.toLowerCase().replace(/[^a-z0-9]/g, '').replace(/^[0-9]+/, '');
+}

package/build/routes/file-browser.d.ts

@@ -0,0 +1,2 @@
+declare const router: import("express-serve-static-core").Router;
+export default router;

package/build/routes/file-browser.js

@@ -0,0 +1,112 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const express_1 = require("express");
+const path_1 = __importDefault(require("path"));
+const api = __importStar(require("../api/files"));
+const storage_1 = require("../lib/storage");
+const mime_1 = require("../lib/storage/mime");
+const router = (0, express_1.Router)();
+/**
+ * GET /api/file-browser/browse
+ * List files and directories at a given prefix.
+ * Query: ?prefix=screenshots/&pageSize=100&continuationToken=...
+ */
+router.get('/browse', async (req, res) => {
+    const result = await api.browseFiles({
+        prefix: req.query.prefix,
+        pageSize: req.query.pageSize ? parseInt(req.query.pageSize, 10) : undefined,
+        continuationToken: req.query.continuationToken,
+    });
+    res.status(result.status).json(result.data ?? { error: result.error });
+});
+/**
+ * GET /api/file-browser/metadata/*
+ * Get metadata for a single file.
+ */
+router.get('/metadata/{*filePath}', async (req, res) => {
+    const raw = req.params.filePath;
+    const filePath = Array.isArray(raw) ? raw.join('/') : raw;
+    if (!filePath) {
+        res.status(400).json({ error: 'File path required' });
+        return;
+    }
+    const result = await api.getFileMetadata({ filePath });
+    res.status(result.status).json(result.data ?? { error: result.error });
+});
+/**
+ * POST /api/file-browser/signed-url
+ * Generate a time-limited signed URL for sharing.
+ * Body: { path, expiresIn } — expiresIn in seconds (3600, 21600, 86400, 604800, 2592000)
+ */
+router.post('/signed-url', async (req, res) => {
+    const { path: filePath, expiresIn } = req.body;
+    if (!filePath || !expiresIn) {
+        res.status(400).json({ error: 'path and expiresIn are required' });
+        return;
+    }
+    const result = await api.generateSignedUrl({
+        filePath,
+        expiresIn: typeof expiresIn === 'number' ? expiresIn : parseInt(expiresIn, 10),
+    });
+    res.status(result.status).json(result.data ?? { error: result.error });
+});
+/**
+ * GET /api/file-browser/download/*
+ * Download a file with Content-Disposition: attachment.
+ */
+router.get('/download/{*filePath}', async (req, res) => {
+    const raw = req.params.filePath;
+    const filePath = Array.isArray(raw) ? raw.join('/') : raw;
+    if (!filePath) {
+        res.status(400).json({ error: 'File path required' });
+        return;
+    }
+    try {
+        const stream = await (0, storage_1.getStorageBackend)().createReadStream(filePath);
+        const fileName = path_1.default.basename(filePath);
+        const contentType = (0, mime_1.mimeFromPath)(filePath);
+        res.setHeader('Content-Type', contentType);
+        res.setHeader('Content-Disposition', `attachment; filename="${fileName}"`);
+        stream.pipe(res);
+    }
+    catch {
+        res.status(404).json({ error: 'File not found' });
+    }
+});
+exports.default = router;

package/build/routes/files.js

@@ -4,26 +4,15 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const express_1 = require("express");
-const path_1 = __importDefault(require("path"));
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
 const storage_1 = require("../lib/storage");
+const mime_1 = require("../lib/storage/mime");
 const router = (0, express_1.Router)();
-const MIME_TYPES = {
-    '.png': 'image/png',
-    '.jpg': 'image/jpeg',
-    '.jpeg': 'image/jpeg',
-    '.gif': 'image/gif',
-    '.svg': 'image/svg+xml',
-    '.webp': 'image/webp',
-    '.pdf': 'application/pdf',
-    '.json': 'application/json',
-    '.txt': 'text/plain',
-    '.html': 'text/html',
-    '.csv': 'text/csv',
-    '.xml': 'application/xml',
-};
 /**
  * GET /api/files/*
  * Serve files from managed file storage.
+ * Supports optional signed token (?token=<jwt>) for authenticated access
+ * to locally-generated signed URLs.
  */
 router.get('/{*filePath}', async (req, res) => {
     const raw = req.params.filePath;
@@ -32,10 +21,29 @@ router.get('/{*filePath}', async (req, res) => {
         res.status(400).json({ error: 'File path required' });
         return;
     }
+    // Validate signed token if provided
+    const token = req.query.token;
+    if (token) {
+        const secret = process.env.JWT_SECRET;
+        if (!secret) {
+            res.status(500).json({ error: 'Server not configured for signed URLs' });
+            return;
+        }
+        try {
+            const decoded = jsonwebtoken_1.default.verify(token, secret);
+            if (decoded.purpose !== 'file-download' || decoded.filePath !== filePath.replace(/^\/+/, '')) {
+                res.status(403).json({ error: 'Token does not match requested file' });
+                return;
+            }
+        }
+        catch {
+            res.status(403).json({ error: 'Invalid or expired token' });
+            return;
+        }
+    }
     try {
         const stream = await (0, storage_1.getStorageBackend)().createReadStream(filePath);
-        const ext = path_1.default.extname(filePath).toLowerCase();
-        const contentType = MIME_TYPES[ext] || 'application/octet-stream';
+        const contentType = (0, mime_1.mimeFromPath)(filePath);
         res.setHeader('Content-Type', contentType);
         res.setHeader('Cache-Control', 'public, max-age=300');
         stream.pipe(res);

package/build/routes/index.js

@@ -23,6 +23,7 @@ const settings_1 = __importDefault(require("./settings"));
 const mcp_runs_1 = __importDefault(require("./mcp-runs"));
 const namespaces_1 = __importDefault(require("./namespaces"));
 const files_1 = __importDefault(require("./files"));
+const file_browser_1 = __importDefault(require("./file-browser"));
 const controlplane_1 = __importDefault(require("./controlplane"));
 const bot_accounts_1 = __importDefault(require("./bot-accounts"));
 const docs_1 = __importDefault(require("./docs"));
@@ -49,6 +50,7 @@ router.use('/insight', insight_1.default);
 router.use('/yaml-workflows', yaml_workflows_1.default);
 router.use('/mcp-runs', mcp_runs_1.default);
 router.use('/namespaces', namespaces_1.default);
+router.use('/file-browser', file_browser_1.default);
 router.use('/controlplane', controlplane_1.default);
 router.use('/bot-accounts', bot_accounts_1.default);
 router.use('/docs', docs_1.default);

package/build/routes/mcp-runs.js

@@ -60,6 +60,8 @@ router.get('/', async (req, res) => {
         entity: req.query.entity || undefined,
         search: req.query.search || undefined,
         status: req.query.status || undefined,
+        sort_by: req.query.sort_by || undefined,
+        order: req.query.order || undefined,
     });
     res.status(result.status).json(result.data ?? { error: result.error });
 });

package/build/routes/workflow-sets.js

@@ -79,6 +79,15 @@ router.put('/:id/plan', async (req, res) => {
     });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
+/**
+ * POST /api/workflow-sets/:id/add
+ * Add additional workflows to an existing set from a new specification.
+ */
+router.post('/:id/add', async (req, res) => {
+    const { specification } = req.body;
+    const result = await api.addToWorkflowSet({ id: req.params.id, specification }, req.auth ? { userId: req.auth.userId } : undefined);
+    res.status(result.status).json(result.data ?? { error: result.error });
+});
 /**
  * POST /api/workflow-sets/:id/build
  * Trigger the build phase (resume the planner workflow).

package/build/routes/yaml-workflows/deployment.js

@@ -76,4 +76,12 @@ router.post('/:id/archive', async (req, res) => {
     const result = await api.archiveYamlWorkflow({ id: req.params.id });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
+/**
+ * POST /api/yaml-workflows/:id/restore
+ * Restore an archived YAML workflow back to draft status for redeployment.
+ */
+router.post('/:id/restore', async (req, res) => {
+    const result = await api.restoreYamlWorkflow({ id: req.params.id });
+    res.status(result.status).json(result.data ?? { error: result.error });
+});
 exports.default = router;

package/build/services/insight/index.d.ts

@@ -44,6 +44,19 @@ export interface WorkflowPlannerInput {
     setId: string;
     wait?: boolean;
     userId?: string;
+    /** When adding to an existing set, pass the current plan items so the planner avoids duplicates. */
+    existingPlan?: Array<{
+        name: string;
+        description: string;
+        namespace: string;
+    }>;
+    /** Sibling schemas from already-built workflows for composition context. */
+    existingSchemas?: Array<{
+        name: string;
+        input_schema: Record<string, unknown>;
+        output_schema: Record<string, unknown>;
+        graph_topic: string;
+    }>;
 }
 export declare function startWorkflowPlanner(input: WorkflowPlannerInput): Promise<McpQueryResult>;
 export declare function describeWorkflow(input: DescribeInput): Promise<DescribeResult>;

package/build/services/insight/index.js

@@ -11,6 +11,7 @@ exports.describeWorkflow = describeWorkflow;
 const hotmesh_1 = require("@hotmeshio/hotmesh");
 const db_1 = require("../../lib/db");
 const defaults_1 = require("../../modules/defaults");
+const utils_1 = require("../../modules/utils");
 const llm_1 = require("../llm");
 const prompts_1 = require("./prompts");
 // ── MCP query invocation ─────────────────────────────────────────────────────
@@ -76,13 +77,13 @@ async function startWorkflowBuilder(input) {
     };
 }
 async function startWorkflowPlanner(input) {
-    const { specification, setId, wait = true, userId } = input;
+    const { specification, setId, wait = true, userId, existingPlan, existingSchemas } = input;
     const startTime = Date.now();
     const client = new hotmesh_1.Durable.Client({ connection: (0, db_1.getConnection)() });
     const workflowId = `wf-planner-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
     const handle = await client.workflow.start({
         args: [{
-                data: { specification, setId },
+                data: { specification, setId, existingPlan, existingSchemas },
                 metadata: { source: 'dashboard' },
                 lt: { userId },
             }],
@@ -126,11 +127,7 @@ async function describeWorkflow(input) {
     const raw = response.content || '{}';
     const cleaned = raw.replace(/^```(?:json)?\s*/m, '').replace(/\s*```$/m, '').trim();
     const parsed = JSON.parse(cleaned);
-    const toolName = (parsed.tool_name || '')
-        .toLowerCase()
-        .replace(/[^a-z0-9]+/g, '-')
-        .replace(/^-|-$/g, '')
-        .slice(0, 60);
+    const toolName = (0, utils_1.sanitizeToolName)(parsed.tool_name || '').slice(0, 60);
     return {
         tool_name: toolName || undefined,
         description: parsed.description || prompt,

package/build/services/insight/prompts.d.ts

@@ -1,4 +1,4 @@
 /**
  * Externalized LLM prompt constants for the insight service.
  */
-export declare const DESCRIBE_WORKFLOW_SYSTEM_PROMPT = "You generate concise workflow descriptions, tool names, and discovery tags.\n\nGiven a user's original query and the execution result, produce:\n1. A short, descriptive tool name as a lowercase kebab-case slug (e.g. \"screenshot-all-nav-pages\", \"fetch-order-status\", \"translate-content\"). The name should describe what the workflow does, not be generic like \"query-complete\".\n2. A clear, reusable description of what this workflow does (not what the user asked, but what the workflow accomplishes as a reusable tool). Write it as if describing a tool in a catalog. 2-3 sentences max.\n3. Discovery tags \u2014 lowercase keywords that help find this workflow when similar future queries are made.\n\nReturn ONLY a JSON object:\n{ \"tool_name\": \"...\", \"description\": \"...\", \"tags\": [\"tag1\", \"tag2\", ...] }";
+export declare const DESCRIBE_WORKFLOW_SYSTEM_PROMPT = "You generate concise workflow descriptions, tool names, and discovery tags.\n\nGiven a user's original query and the execution result, produce:\n1. A short, descriptive tool name in snake_case (e.g. \"screenshot_all_nav_pages\", \"fetch_order_status\", \"translate_content\"). Only lowercase letters, digits, and underscores. The name should describe what the workflow does, not be generic like \"query_complete\".\n2. A clear, reusable description of what this workflow does (not what the user asked, but what the workflow accomplishes as a reusable tool). Write it as if describing a tool in a catalog. 2-3 sentences max.\n3. Discovery tags \u2014 lowercase keywords that help find this workflow when similar future queries are made.\n\nReturn ONLY a JSON object:\n{ \"tool_name\": \"...\", \"description\": \"...\", \"tags\": [\"tag1\", \"tag2\", ...] }";

package/build/services/insight/prompts.js

@@ -7,7 +7,7 @@ exports.DESCRIBE_WORKFLOW_SYSTEM_PROMPT = void 0;
 exports.DESCRIBE_WORKFLOW_SYSTEM_PROMPT = `You generate concise workflow descriptions, tool names, and discovery tags.
 
 Given a user's original query and the execution result, produce:
-1. A short, descriptive tool name as a lowercase kebab-case slug (e.g. "screenshot-all-nav-pages", "fetch-order-status", "translate-content"). The name should describe what the workflow does, not be generic like "query-complete".
+1. A short, descriptive tool name in snake_case (e.g. "screenshot_all_nav_pages", "fetch_order_status", "translate_content"). Only lowercase letters, digits, and underscores. The name should describe what the workflow does, not be generic like "query_complete".
 2. A clear, reusable description of what this workflow does (not what the user asked, but what the workflow accomplishes as a reusable tool). Write it as if describing a tool in a catalog. 2-3 sentences max.
 3. Discovery tags — lowercase keywords that help find this workflow when similar future queries are made.
 

package/build/services/mcp-runs/queries.d.ts

@@ -5,6 +5,8 @@ export interface ListJobsParams {
     entity?: string;
     search?: string;
     status?: string;
+    sort_by?: string;
+    order?: 'asc' | 'desc';
 }
 interface JobRow {
     workflow_id: string;

package/build/services/mcp-runs/queries.js

@@ -5,6 +5,15 @@ exports.listJobs = listJobs;
 const db_1 = require("../../lib/db");
 const hotmesh_utils_1 = require("../hotmesh-utils");
 const sql_1 = require("./sql");
+const SORTABLE_COLUMNS = new Set(['created_at', 'updated_at', 'entity', 'status']);
+function buildOrderBy(sortBy, order) {
+    if (!sortBy || !SORTABLE_COLUMNS.has(sortBy)) {
+        return '(CASE WHEN j.status > 0 THEN 0 ELSE 1 END), j.created_at DESC';
+    }
+    const dir = order === 'asc' ? 'ASC' : 'DESC';
+    const col = sortBy === 'status' ? '(CASE WHEN j.status > 0 THEN 0 WHEN j.status = 0 THEN 1 ELSE 2 END)' : `j.${sortBy}`;
+    return `${col} ${dir}`;
+}
 /**
  * Return distinct entity names from job runs + yaml workflow graph_topics.
  */
@@ -55,9 +64,10 @@ async function listJobs(params) {
     }
     const where = conditions.length > 0 ? `WHERE ${conditions.join(' AND ')}` : '';
     const keyPrefix = `hmsh:${appId}:j:`;
+    const orderBy = buildOrderBy(params.sort_by, params.order);
     const [countResult, dataResult] = await Promise.all([
         pool.query((0, sql_1.COUNT_JOBS)(schema, where), values),
-        pool.query((0, sql_1.LIST_JOBS)(schema, appId, where, idx++, idx++), [...values, limit, offset]),
+        pool.query((0, sql_1.LIST_JOBS)(schema, appId, where, idx++, idx++, orderBy), [...values, limit, offset]),
     ]);
     const jobs = dataResult.rows.map((row) => ({
         workflow_id: row.key.startsWith(keyPrefix) ? row.key.slice(keyPrefix.length) : row.key,

package/build/services/mcp-runs/sql.d.ts

@@ -4,4 +4,4 @@ export declare const ACTIVE_GRAPH_TOPICS = "SELECT DISTINCT graph_topic FROM lt_
 export declare const COUNT_JOBS: (schema: string, where: string) => string;
 export declare const GET_JOB: (schema: string) => string;
 export declare const GET_JOB_ATTRIBUTES: (schema: string) => string;
-export declare const LIST_JOBS: (schema: string, appId: string, where: string, limitIdx: number, offsetIdx: number) => string;
+export declare const LIST_JOBS: (schema: string, appId: string, where: string, limitIdx: number, offsetIdx: number, orderBy?: string) => string;

package/build/services/mcp-runs/sql.js

@@ -18,7 +18,7 @@ exports.GET_JOB = GET_JOB;
 const GET_JOB_ATTRIBUTES = (schema) => `SELECT symbol, dimension, value FROM ${schema}.jobs_attributes WHERE job_id = $1 ORDER BY symbol, dimension`;
 exports.GET_JOB_ATTRIBUTES = GET_JOB_ATTRIBUTES;
 // ─── Queries (queries.ts) ───────────────────────────────────────────────────
-const LIST_JOBS = (schema, appId, where, limitIdx, offsetIdx) => `WITH ju_symbols AS (
+const LIST_JOBS = (schema, appId, where, limitIdx, offsetIdx, orderBy) => `WITH ju_symbols AS (
      SELECT value FROM ${schema}.symbols
      WHERE key LIKE 'keys:%' AND field = 'metadata/ju'
    )
@@ -33,6 +33,6 @@ const LIST_JOBS = (schema, appId, where, limitIdx, offsetIdx) => `WITH ju_symbol
      AND ju.symbol IN (SELECT value FROM ju_symbols)
      AND (ju.dimension IS NULL OR ju.dimension = '')
    ${where}
-   ORDER BY (CASE WHEN j.status > 0 THEN 0 ELSE 1 END), j.created_at DESC
+   ORDER BY ${orderBy || '(CASE WHEN j.status > 0 THEN 0 ELSE 1 END), j.created_at DESC'}
    LIMIT $${limitIdx} OFFSET $${offsetIdx}`;
 exports.LIST_JOBS = LIST_JOBS;

package/build/services/workflow-sets/db.d.ts

@@ -2,6 +2,7 @@ import type { LTWorkflowSetRecord, LTWorkflowSetStatus, CreateWorkflowSetInput,
 export declare function createWorkflowSet(input: CreateWorkflowSetInput): Promise<LTWorkflowSetRecord>;
 export declare function getWorkflowSet(id: string): Promise<LTWorkflowSetRecord | null>;
 export declare function updateWorkflowSetPlan(id: string, plan: PlanItem[], namespaces: string[]): Promise<LTWorkflowSetRecord | null>;
+export declare function appendWorkflowSetSpecification(id: string, specification: string): Promise<LTWorkflowSetRecord | null>;
 export declare function updateWorkflowSetStatus(id: string, status: LTWorkflowSetStatus): Promise<LTWorkflowSetRecord | null>;
 export declare function updateWorkflowSetSourceWorkflow(id: string, sourceWorkflowId: string): Promise<void>;
 export declare function deleteWorkflowSet(id: string): Promise<boolean>;

package/build/services/workflow-sets/db.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.createWorkflowSet = createWorkflowSet;
 exports.getWorkflowSet = getWorkflowSet;
 exports.updateWorkflowSetPlan = updateWorkflowSetPlan;
+exports.appendWorkflowSetSpecification = appendWorkflowSetSpecification;
 exports.updateWorkflowSetStatus = updateWorkflowSetStatus;
 exports.updateWorkflowSetSourceWorkflow = updateWorkflowSetSourceWorkflow;
 exports.deleteWorkflowSet = deleteWorkflowSet;
@@ -36,6 +37,11 @@ async function updateWorkflowSetPlan(id, plan, namespaces) {
     ]);
     return rows[0] || null;
 }
+async function appendWorkflowSetSpecification(id, specification) {
+    const pool = (0, db_1.getPool)();
+    const { rows } = await pool.query(sql_1.APPEND_WORKFLOW_SET_SPECIFICATION, [id, specification]);
+    return rows[0] || null;
+}
 async function updateWorkflowSetStatus(id, status) {
     const pool = (0, db_1.getPool)();
     const { rows } = await pool.query(sql_1.UPDATE_WORKFLOW_SET_STATUS, [id, status]);

package/build/services/workflow-sets/index.d.ts

@@ -1 +1 @@
-export { createWorkflowSet, getWorkflowSet, updateWorkflowSetPlan, updateWorkflowSetStatus, updateWorkflowSetSourceWorkflow, deleteWorkflowSet, listWorkflowSets, } from './db';
+export { createWorkflowSet, getWorkflowSet, updateWorkflowSetPlan, updateWorkflowSetStatus, updateWorkflowSetSourceWorkflow, appendWorkflowSetSpecification, deleteWorkflowSet, listWorkflowSets, } from './db';

package/build/services/workflow-sets/index.js

@@ -1,11 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.listWorkflowSets = exports.deleteWorkflowSet = exports.updateWorkflowSetSourceWorkflow = exports.updateWorkflowSetStatus = exports.updateWorkflowSetPlan = exports.getWorkflowSet = exports.createWorkflowSet = void 0;
+exports.listWorkflowSets = exports.deleteWorkflowSet = exports.appendWorkflowSetSpecification = exports.updateWorkflowSetSourceWorkflow = exports.updateWorkflowSetStatus = exports.updateWorkflowSetPlan = exports.getWorkflowSet = exports.createWorkflowSet = void 0;
 var db_1 = require("./db");
 Object.defineProperty(exports, "createWorkflowSet", { enumerable: true, get: function () { return db_1.createWorkflowSet; } });
 Object.defineProperty(exports, "getWorkflowSet", { enumerable: true, get: function () { return db_1.getWorkflowSet; } });
 Object.defineProperty(exports, "updateWorkflowSetPlan", { enumerable: true, get: function () { return db_1.updateWorkflowSetPlan; } });
 Object.defineProperty(exports, "updateWorkflowSetStatus", { enumerable: true, get: function () { return db_1.updateWorkflowSetStatus; } });
 Object.defineProperty(exports, "updateWorkflowSetSourceWorkflow", { enumerable: true, get: function () { return db_1.updateWorkflowSetSourceWorkflow; } });
+Object.defineProperty(exports, "appendWorkflowSetSpecification", { enumerable: true, get: function () { return db_1.appendWorkflowSetSpecification; } });
 Object.defineProperty(exports, "deleteWorkflowSet", { enumerable: true, get: function () { return db_1.deleteWorkflowSet; } });
 Object.defineProperty(exports, "listWorkflowSets", { enumerable: true, get: function () { return db_1.listWorkflowSets; } });

package/build/services/workflow-sets/sql.d.ts

@@ -2,5 +2,6 @@ export declare const CREATE_WORKFLOW_SET = "\n  INSERT INTO lt_workflow_sets (na
 export declare const GET_WORKFLOW_SET = "\n  SELECT * FROM lt_workflow_sets WHERE id = $1";
 export declare const UPDATE_WORKFLOW_SET_PLAN = "\n  UPDATE lt_workflow_sets\n  SET plan = $2, namespaces = $3, status = 'planned', updated_at = NOW()\n  WHERE id = $1\n  RETURNING *";
 export declare const UPDATE_WORKFLOW_SET_STATUS = "\n  UPDATE lt_workflow_sets\n  SET status = $2, updated_at = NOW()\n  WHERE id = $1\n  RETURNING *";
+export declare const APPEND_WORKFLOW_SET_SPECIFICATION = "\n  UPDATE lt_workflow_sets\n  SET specification = specification || E'\\n\\n---\\n\\n' || $2, updated_at = NOW()\n  WHERE id = $1\n  RETURNING *";
 export declare const DELETE_WORKFLOW_SET = "\n  DELETE FROM lt_workflow_sets WHERE id = $1";
 export declare const LIST_WORKFLOW_SETS_BASE = "\n  SELECT * FROM lt_workflow_sets";

package/build/services/workflow-sets/sql.js

@@ -1,7 +1,7 @@
 "use strict";
 // ─── Workflow set CRUD ──────────────────────────────────────────────────────
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LIST_WORKFLOW_SETS_BASE = exports.DELETE_WORKFLOW_SET = exports.UPDATE_WORKFLOW_SET_STATUS = exports.UPDATE_WORKFLOW_SET_PLAN = exports.GET_WORKFLOW_SET = exports.CREATE_WORKFLOW_SET = void 0;
+exports.LIST_WORKFLOW_SETS_BASE = exports.DELETE_WORKFLOW_SET = exports.APPEND_WORKFLOW_SET_SPECIFICATION = exports.UPDATE_WORKFLOW_SET_STATUS = exports.UPDATE_WORKFLOW_SET_PLAN = exports.GET_WORKFLOW_SET = exports.CREATE_WORKFLOW_SET = void 0;
 exports.CREATE_WORKFLOW_SET = `
   INSERT INTO lt_workflow_sets (name, description, specification, plan, namespaces, source_workflow_id)
   VALUES ($1, $2, $3, $4, $5, $6)
@@ -18,6 +18,11 @@ exports.UPDATE_WORKFLOW_SET_STATUS = `
   SET status = $2, updated_at = NOW()
   WHERE id = $1
   RETURNING *`;
+exports.APPEND_WORKFLOW_SET_SPECIFICATION = `
+  UPDATE lt_workflow_sets
+  SET specification = specification || E'\\n\\n---\\n\\n' || $2, updated_at = NOW()
+  WHERE id = $1
+  RETURNING *`;
 exports.DELETE_WORKFLOW_SET = `
   DELETE FROM lt_workflow_sets WHERE id = $1`;
 exports.LIST_WORKFLOW_SETS_BASE = `

package/build/services/yaml-workflow/db.d.ts

@@ -21,6 +21,18 @@ export declare function discoverWorkflows(prompt: string, tags: string[], catego
 })[]>;
 export declare function getActiveYamlWorkflows(): Promise<LTYamlWorkflowRecord[]>;
 export declare function listYamlWorkflowsByAppId(appId: string): Promise<LTYamlWorkflowRecord[]>;
+/**
+ * Return the next app-level version for a namespace.
+ *
+ * Each deploy of an app (namespace) must use a strictly increasing integer
+ * version. This queries the current max across all non-archived workflows
+ * in the namespace and returns max + 1.
+ *
+ * A new namespace with no workflows returns '1'.
+ * An existing namespace with one active tool at v1 returns '2' when a
+ * second tool is added — even though that second tool is "version 1" of itself.
+ */
+export declare function getNextAppVersion(appId: string): Promise<string>;
 export declare function getDistinctAppIds(): Promise<string[]>;
 export declare function createVersionSnapshot(workflowId: string, version: number, yamlContent: string, activityManifest: ActivityManifestEntry[] | unknown, inputSchema: Record<string, unknown> | unknown, outputSchema: Record<string, unknown> | unknown, inputFieldMeta?: unknown, changeSummary?: string): Promise<LTYamlWorkflowVersionRecord>;
 export declare function getVersionHistory(workflowId: string, limit?: number, offset?: number): Promise<{

package/build/services/yaml-workflow/db.js

@@ -11,6 +11,7 @@ exports.deleteYamlWorkflow = deleteYamlWorkflow;
 exports.discoverWorkflows = discoverWorkflows;
 exports.getActiveYamlWorkflows = getActiveYamlWorkflows;
 exports.listYamlWorkflowsByAppId = listYamlWorkflowsByAppId;
+exports.getNextAppVersion = getNextAppVersion;
 exports.getDistinctAppIds = getDistinctAppIds;
 exports.createVersionSnapshot = createVersionSnapshot;
 exports.getVersionHistory = getVersionHistory;
@@ -172,6 +173,23 @@ async function listYamlWorkflowsByAppId(appId) {
     const { rows } = await pool.query(sql_1.LIST_BY_APP_ID, [appId]);
     return rows;
 }
+/**
+ * Return the next app-level version for a namespace.
+ *
+ * Each deploy of an app (namespace) must use a strictly increasing integer
+ * version. This queries the current max across all non-archived workflows
+ * in the namespace and returns max + 1.
+ *
+ * A new namespace with no workflows returns '1'.
+ * An existing namespace with one active tool at v1 returns '2' when a
+ * second tool is added — even though that second tool is "version 1" of itself.
+ */
+async function getNextAppVersion(appId) {
+    const pool = (0, db_1.getPool)();
+    const { rows } = await pool.query(sql_1.GET_MAX_APP_VERSION, [appId]);
+    const max = parseInt(rows[0]?.max_version ?? '0', 10);
+    return String(max + 1);
+}
 async function getDistinctAppIds() {
     const pool = (0, db_1.getPool)();
     const { rows } = await pool.query(sql_1.GET_DISTINCT_APP_IDS);

package/build/services/yaml-workflow/generator.js

@@ -50,10 +50,10 @@ const analyze_1 = require("./pipeline/analyze");
 const compile_1 = require("./pipeline/compile");
 const build_1 = require("./pipeline/build");
 const validate_1 = require("./pipeline/validate");
-const build_2 = require("./pipeline/build");
+const utils_1 = require("../../modules/utils");
 // Re-exports for backward compatibility
-var build_3 = require("./pipeline/build");
-Object.defineProperty(exports, "capToolArguments", { enumerable: true, get: function () { return build_3.capToolArguments; } });
+var build_2 = require("./pipeline/build");
+Object.defineProperty(exports, "capToolArguments", { enumerable: true, get: function () { return build_2.capToolArguments; } });
 /**
  * Generate a HotMesh YAML workflow from a completed execution's tool call sequence.
  *
@@ -63,7 +63,7 @@ Object.defineProperty(exports, "capToolArguments", { enumerable: true, get: func
  */
 async function generateYamlFromExecution(options) {
     const appId = options.appId || 'longtail';
-    const graphTopic = options.subscribes || (0, build_2.sanitizeName)(options.name);
+    const graphTopic = (0, utils_1.sanitizeToolName)(options.subscribes || options.name);
     // 1. Export the execution to get events
     const execution = await (0, index_1.exportWorkflowExecution)(options.workflowId, options.taskQueue, options.workflowName);
     // 2. Initialize pipeline context

package/build/services/yaml-workflow/pipeline/build/index.d.ts

@@ -6,7 +6,8 @@
  * Falls back to mechanical heuristics when no plan is available.
  */
 import type { PipelineContext } from '../../types';
-export { capToolArguments, sanitizeName } from './utils';
+export { capToolArguments } from './utils';
+export { sanitizeToolName } from '../../../../modules/utils';
 /**
  * Build pipeline stage: construct the HotMesh YAML DAG.
  *