@hotmeshio/long-tail 0.1.15 → 0.1.17

package/build/api/escalations/resolve.js

@@ -159,6 +159,7 @@ async function resolveViaTriage(escalation, resolverPayload, triageEnvelope) {
         workflowId: triageWorkflowId,
         expire: defaults_1.JOB_EXPIRE_SECS,
         entity: 'mcpTriageRouter',
+        signalIn: false,
     });
     await escalationService.resolveEscalation(escalation.id, {
         ...resolverPayload,

package/build/api/files.d.ts

@@ -10,6 +10,10 @@ export declare function getFileMetadata(input: {
 export declare function deleteFile(input: {
     filePath: string;
 }): Promise<LTApiResult>;
+export declare function uploadFile(input: {
+    path: string;
+    buffer: Buffer;
+}): Promise<LTApiResult>;
 export declare function generateSignedUrl(input: {
     filePath: string;
     expiresIn: number;

package/build/api/files.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.browseFiles = browseFiles;
 exports.getFileMetadata = getFileMetadata;
 exports.deleteFile = deleteFile;
+exports.uploadFile = uploadFile;
 exports.generateSignedUrl = generateSignedUrl;
 const storage_1 = require("../lib/storage");
 const mime_1 = require("../lib/storage/mime");
@@ -43,6 +44,19 @@ async function deleteFile(input) {
         return { status: 500, error: err.message };
     }
 }
+async function uploadFile(input) {
+    try {
+        const result = await (0, storage_1.getStorageBackend)().write(input.path, input.buffer);
+        const contentType = (0, mime_1.mimeFromPath)(input.path);
+        return {
+            status: 200,
+            data: { path: input.path, size: result.size, content_type: contentType },
+        };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}
 async function generateSignedUrl(input) {
     if (!ALLOWED_EXPIRY.includes(input.expiresIn)) {
         return {

package/build/api/settings.js

@@ -38,9 +38,6 @@ async function getSettings() {
                     natsWsUrl: hasNats
                         ? (process.env.VITE_NATS_WS_URL || process.env.NATS_WS_URL || null)
                         : null,
-                    natsToken: hasNats
-                        ? (process.env.NATS_TOKEN || null)
-                        : null,
                 },
             },
         };

package/build/api/workflows/config.js

@@ -95,6 +95,11 @@ async function getWorkflowConfig(input) {
  */
 async function upsertWorkflowConfig(input) {
     try {
+        // Validate cron expression before persisting
+        if (input.cron_schedule) {
+            const { validateCronSchedule } = await Promise.resolve().then(() => __importStar(require('../../services/cron')));
+            validateCronSchedule(input.cron_schedule);
+        }
         const config = await configService.upsertWorkflowConfig({
             workflow_type: input.type,
             invocable: input.invocable ?? false,

package/build/api/yaml-workflows/crud.js

@@ -49,6 +49,23 @@ const builder_regenerate_1 = require("../../services/yaml-workflow/builder-regen
 const task_1 = require("../../services/task");
 const utils_1 = require("../../modules/utils");
 const helpers_1 = require("./helpers");
+/**
+ * Strip the qualified `{slug}__` prefix from mcp_tool_name entries.
+ * The builder LLM sometimes echoes the qualified name (e.g.
+ * "long_tail_playwright_cli__capture_page") instead of the short
+ * tool name ("capture_page"). MCP servers register tools by short
+ * name, so the qualified form fails at runtime.
+ */
+function normalizeManifestToolNames(manifest) {
+    if (!manifest)
+        return manifest;
+    for (const entry of manifest) {
+        if (entry.mcp_tool_name?.includes('__')) {
+            entry.mcp_tool_name = entry.mcp_tool_name.slice(entry.mcp_tool_name.indexOf('__') + 2);
+        }
+    }
+    return manifest;
+}
 /**
  * List YAML workflows with optional filtering and pagination.
  *
@@ -157,7 +174,7 @@ async function createYamlWorkflow(input) {
             graph_topic: result.graphTopic,
             input_schema: result.inputSchema,
             output_schema: result.outputSchema,
-            activity_manifest: result.activityManifest,
+            activity_manifest: normalizeManifestToolNames(result.activityManifest),
             tags: mergedTags,
             source_workflow_id: workflow_id,
             source_workflow_type: workflow_name,
@@ -242,7 +259,7 @@ async function createYamlWorkflowDirect(input) {
             graph_topic: graphTopic,
             input_schema: input_schema || {},
             output_schema: {},
-            activity_manifest: activity_manifest || [],
+            activity_manifest: normalizeManifestToolNames(activity_manifest) || [],
             tags: tags || [],
             original_prompt: description,
             category: 'builder',
@@ -300,6 +317,9 @@ async function getYamlWorkflow(input) {
 async function updateYamlWorkflow(input) {
     try {
         const { id, ...fields } = input;
+        if (fields.activity_manifest) {
+            normalizeManifestToolNames(fields.activity_manifest);
+        }
         const wf = await yamlDb.updateYamlWorkflow(id, fields);
         if (!wf) {
             return { status: 404, error: 'YAML workflow not found' };
@@ -352,7 +372,7 @@ async function regenerateYamlWorkflow(input) {
                 yaml_content: result.yaml,
                 input_schema: result.inputSchema,
                 output_schema: result.outputSchema,
-                activity_manifest: result.activityManifest,
+                activity_manifest: normalizeManifestToolNames(result.activityManifest),
                 tags: result.tags,
             });
             return { status: 200, data: updated };
@@ -383,7 +403,7 @@ async function regenerateYamlWorkflow(input) {
             yaml_content: result.yaml,
             input_schema: result.inputSchema,
             output_schema: result.outputSchema,
-            activity_manifest: result.activityManifest,
+            activity_manifest: normalizeManifestToolNames(result.activityManifest),
             tags: result.tags,
             metadata: { input_field_meta: result.inputFieldMeta },
         });
@@ -464,7 +484,7 @@ async function createYamlWorkflowFromDurable(input) {
             graph_topic: result.graphTopic,
             input_schema: result.inputSchema,
             output_schema: result.outputSchema,
-            activity_manifest: result.activityManifest,
+            activity_manifest: normalizeManifestToolNames(result.activityManifest),
             tags: mergedTags,
             source_workflow_type: 'durable',
             original_prompt: description,

package/build/index.d.ts

@@ -14,7 +14,7 @@ export { ltConfig } from './modules/ltconfig';
 export { eventRegistry } from './lib/events';
 export { NatsEventAdapter } from './lib/events/nats';
 export { InMemoryEventAdapter } from './lib/events/memory';
-export { SocketIOEventAdapter } from './lib/events/socketio';
+export { SocketIOEventAdapter, type SocketIOAuthenticator } from './lib/events/socketio';
 export { publishMilestoneEvent, publishTaskEvent, publishEscalationEvent, publishWorkflowEvent } from './lib/events/publish';
 export { telemetryRegistry } from './lib/telemetry';
 export { HoneycombTelemetryAdapter } from './lib/telemetry/honeycomb';
@@ -37,7 +37,6 @@ export { getActivityIdentity } from './services/iam/activity';
 export { getToolContext } from './services/iam/context';
 export { registerMcpTool } from './services/mcp/register-tool';
 export { getSystemWorkers, builtinMcpServerFactories } from './system';
-export { seedSystemMcpServers } from './system/seed';
 export { CallbackEventAdapter } from './lib/events/callback';
 export { createClient } from './sdk';
 export type { LTClient, LTClientOptions } from './sdk';

package/build/index.js

@@ -36,8 +36,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createClient = exports.CallbackEventAdapter = exports.seedSystemMcpServers = exports.builtinMcpServerFactories = exports.getSystemWorkers = exports.registerMcpTool = exports.getToolContext = exports.getActivityIdentity = exports.seedExamples = exports.exampleWorkers = exports.McpEscalationStrategy = exports.DefaultEscalationStrategy = exports.escalationStrategyRegistry = exports.McpVisionServer = exports.McpTranslationServer = exports.McpServer = exports.McpClient = exports.McpService = exports.BuiltInMcpAdapter = exports.mcpRegistry = exports.defaultMaintenanceConfig = exports.maintenanceRegistry = exports.PinoLoggerAdapter = exports.loggerRegistry = exports.HoneycombTelemetryAdapter = exports.telemetryRegistry = exports.publishWorkflowEvent = exports.publishEscalationEvent = exports.publishTaskEvent = exports.publishMilestoneEvent = exports.SocketIOEventAdapter = exports.InMemoryEventAdapter = exports.NatsEventAdapter = exports.eventRegistry = exports.ltConfig = exports.UserService = exports.ConfigService = exports.EscalationService = exports.TaskService = exports.signToken = exports.requireAdmin = exports.requireAuth = exports.createAuthMiddleware = exports.JwtAuthAdapter = exports.conditionLT = exports.executeLT = exports.createLTActivityInterceptor = exports.createLTInterceptor = exports.registerLT = exports.start = void 0;
-exports.api = void 0;
+exports.api = exports.createClient = exports.CallbackEventAdapter = exports.builtinMcpServerFactories = exports.getSystemWorkers = exports.registerMcpTool = exports.getToolContext = exports.getActivityIdentity = exports.seedExamples = exports.exampleWorkers = exports.McpEscalationStrategy = exports.DefaultEscalationStrategy = exports.escalationStrategyRegistry = exports.McpVisionServer = exports.McpTranslationServer = exports.McpServer = exports.McpClient = exports.McpService = exports.BuiltInMcpAdapter = exports.mcpRegistry = exports.defaultMaintenanceConfig = exports.maintenanceRegistry = exports.PinoLoggerAdapter = exports.loggerRegistry = exports.HoneycombTelemetryAdapter = exports.telemetryRegistry = exports.publishWorkflowEvent = exports.publishEscalationEvent = exports.publishTaskEvent = exports.publishMilestoneEvent = exports.SocketIOEventAdapter = exports.InMemoryEventAdapter = exports.NatsEventAdapter = exports.eventRegistry = exports.ltConfig = exports.UserService = exports.ConfigService = exports.EscalationService = exports.TaskService = exports.signToken = exports.requireAdmin = exports.requireAuth = exports.createAuthMiddleware = exports.JwtAuthAdapter = exports.conditionLT = exports.executeLT = exports.createLTActivityInterceptor = exports.createLTInterceptor = exports.registerLT = exports.start = void 0;
 const config_1 = require("./modules/config");
 const logger_1 = require("./lib/logger");
 const start_1 = require("./start");
@@ -118,8 +117,6 @@ Object.defineProperty(exports, "registerMcpTool", { enumerable: true, get: funct
 var system_1 = require("./system");
 Object.defineProperty(exports, "getSystemWorkers", { enumerable: true, get: function () { return system_1.getSystemWorkers; } });
 Object.defineProperty(exports, "builtinMcpServerFactories", { enumerable: true, get: function () { return system_1.builtinMcpServerFactories; } });
-var seed_1 = require("./system/seed");
-Object.defineProperty(exports, "seedSystemMcpServers", { enumerable: true, get: function () { return seed_1.seedSystemMcpServers; } });
 var callback_1 = require("./lib/events/callback");
 Object.defineProperty(exports, "CallbackEventAdapter", { enumerable: true, get: function () { return callback_1.CallbackEventAdapter; } });
 var sdk_1 = require("./sdk");

package/build/lib/db/schemas/002_seed.sql

@@ -1,18 +1,6 @@
--- System seed data: built-in MCP server, system workflow configs, escalation chains.
--- Example workflow configs are seeded at runtime when examples: true.
-
--- ─── Built-in MCP server ───────────────────────────────────────────────────
-
-INSERT INTO lt_mcp_servers (name, description, transport_type, transport_config, auto_connect, status)
-VALUES (
-  'long-tail-db-query',
-  'Built-in read-only query server for tasks, escalations, processes, and system health',
-  'stdio',
-  '{"builtin": true}'::jsonb,
-  false,
-  'connected'
-)
-ON CONFLICT (name) DO NOTHING;
+-- System seed data: escalation chains.
+-- Workflow configs and MCP server definitions are seeded at startup
+-- via inline config on worker and factory declarations.
 
 -- ─── Escalation chains ─────────────────────────────────────────────────────
 
@@ -24,69 +12,3 @@ INSERT INTO lt_config_role_escalations (source_role, target_role) VALUES
   ('admin',     'engineer'),
   ('admin',     'superadmin')
 ON CONFLICT DO NOTHING;
-
--- ─── System workflow configs ────────────────────────────────────────────────
-
-INSERT INTO lt_config_workflows
-  (workflow_type, task_queue, default_role, invocable, description, tool_tags)
-VALUES
-  ('mcpQuery', 'long-tail-system', 'engineer', false,
-   'Dynamic MCP tool orchestration — LLM agentic loop with raw MCP tools',
-   '{}'),
-  ('mcpTriage', 'long-tail-system', 'engineer', false,
-   'Dynamic MCP triage — LLM agentic loop for escalation remediation',
-   '{}'),
-  ('mcpWorkflowBuilder', 'long-tail-system', 'engineer', false,
-   'Direct pipeline builder — LLM constructs DAG from tool schemas',
-   '{}'),
-  ('mcpWorkflowPlanner', 'long-tail-system', 'engineer', false,
-   'Plan mode — decomposes specifications into multi-workflow sets',
-   '{}')
-ON CONFLICT (workflow_type) DO NOTHING;
-
--- Query router (orchestrator entry point)
-INSERT INTO lt_config_workflows
-  (workflow_type, task_queue, default_role, invocable, description, tool_tags, envelope_schema)
-VALUES
-  ('mcpQueryRouter', 'long-tail-system', 'engineer', true,
-   'Do anything with tools — browser automation, file operations, HTTP requests, database queries, document processing, and more',
-   '{}',
-   '{"data": {"prompt": "Describe what you want to accomplish using available tools..."}, "metadata": {"source": "dashboard"}}'::jsonb)
-ON CONFLICT (workflow_type) DO NOTHING;
-
--- Deterministic execution (compiled YAML workflows)
-INSERT INTO lt_config_workflows
-  (workflow_type, task_queue, default_role, invocable, description, tool_tags)
-VALUES
-  ('mcpDeterministic', 'long-tail-system', 'engineer', false,
-   'Deterministic execution — invokes matched compiled YAML workflows with extracted inputs',
-   '{}')
-ON CONFLICT (workflow_type) DO NOTHING;
-
--- Triage router
-INSERT INTO lt_config_workflows
-  (workflow_type, task_queue, default_role, invocable, description, tool_tags)
-VALUES
-  ('mcpTriageRouter', 'long-tail-system', 'engineer', false,
-   'Triage router — discovers compiled workflows for remediation, routes to deterministic or dynamic triage',
-   '{}')
-ON CONFLICT (workflow_type) DO NOTHING;
-
--- Triage deterministic
-INSERT INTO lt_config_workflows
-  (workflow_type, task_queue, default_role, invocable, description, tool_tags)
-VALUES
-  ('mcpTriageDeterministic', 'long-tail-system', 'engineer', false,
-   'Deterministic triage — invokes matched compiled workflows for escalation remediation',
-   '{}')
-ON CONFLICT (workflow_type) DO NOTHING;
-
--- ─── Assign roles to all system workflows ──────────────────────────────────
-
-INSERT INTO lt_config_roles (workflow_type, role)
-SELECT wt, unnest(ARRAY['reviewer', 'engineer', 'admin'])
-FROM unnest(ARRAY[
-  'mcpQuery', 'mcpTriage', 'mcpWorkflowBuilder', 'mcpWorkflowPlanner',
-  'mcpQueryRouter', 'mcpDeterministic', 'mcpTriageRouter', 'mcpTriageDeterministic'
-]) AS wt
-ON CONFLICT (workflow_type, role) DO NOTHING;

package/build/lib/events/socketio.d.ts

@@ -1,5 +1,10 @@
 import type { Server as HttpServer } from 'http';
 import type { LTEvent, LTEventAdapter } from '../../types';
+/**
+ * Callback to verify a Socket.IO handshake token.
+ * Return `true` to allow the connection, `false` to reject.
+ */
+export type SocketIOAuthenticator = (token: string) => boolean | Promise<boolean>;
 /**
  * Socket.IO event adapter for browser clients.
  *
@@ -10,6 +15,9 @@ import type { LTEvent, LTEventAdapter } from '../../types';
  * `connect()` is called. The startup flow handles this automatically
  * when Socket.IO is the active event transport.
  *
+ * When an `authenticate` callback is provided, Socket.IO middleware
+ * rejects handshakes that do not include a valid `auth.token`.
+ *
  * Usage:
  * ```typescript
  * import { eventRegistry } from '@hotmeshio/long-tail';
@@ -25,6 +33,10 @@ import type { LTEvent, LTEventAdapter } from '../../types';
 export declare class SocketIOEventAdapter implements LTEventAdapter {
     private io;
     private httpServer;
+    private authenticate;
+    constructor(options?: {
+        authenticate?: SocketIOAuthenticator;
+    });
     /** Attach to an HTTP server. Must be called before connect(). */
     attachServer(server: HttpServer): void;
     connect(): Promise<void>;

package/build/lib/events/socketio.js

@@ -13,6 +13,9 @@ const logger_1 = require("../logger");
  * `connect()` is called. The startup flow handles this automatically
  * when Socket.IO is the active event transport.
  *
+ * When an `authenticate` callback is provided, Socket.IO middleware
+ * rejects handshakes that do not include a valid `auth.token`.
+ *
  * Usage:
  * ```typescript
  * import { eventRegistry } from '@hotmeshio/long-tail';
@@ -26,9 +29,10 @@ const logger_1 = require("../logger");
  * ```
  */
 class SocketIOEventAdapter {
-    constructor() {
+    constructor(options) {
         this.io = null;
         this.httpServer = null;
+        this.authenticate = options?.authenticate ?? null;
     }
     /** Attach to an HTTP server. Must be called before connect(). */
     attachServer(server) {
@@ -45,6 +49,25 @@ class SocketIOEventAdapter {
             transports: ['polling', 'websocket'],
             allowEIO3: true,
         });
+        if (this.authenticate) {
+            const verify = this.authenticate;
+            this.io.use(async (socket, next) => {
+                const token = socket.handshake.auth?.token;
+                if (!token) {
+                    return next(new Error('Authentication required'));
+                }
+                try {
+                    const valid = await verify(token);
+                    if (!valid) {
+                        return next(new Error('Authentication failed'));
+                    }
+                    next();
+                }
+                catch {
+                    next(new Error('Authentication failed'));
+                }
+            });
+        }
         this.io.on('connection', (socket) => {
             logger_1.loggerRegistry.info(`[lt-events:socketio] client connected (${socket.id})`);
             socket.on('disconnect', () => {

package/build/lib/storage/mime.js

@@ -21,6 +21,26 @@ exports.MIME_TYPES = {
     '.yaml': 'text/yaml',
     '.yml': 'text/yaml',
     '.md': 'text/markdown',
+    '.ts': 'text/typescript',
+    '.tsx': 'text/typescript',
+    '.jsx': 'application/javascript',
+    '.sh': 'text/x-shellscript',
+    '.py': 'text/x-python',
+    '.rb': 'text/x-ruby',
+    '.go': 'text/x-go',
+    '.rs': 'text/x-rust',
+    '.java': 'text/x-java',
+    '.c': 'text/x-c',
+    '.cpp': 'text/x-c++',
+    '.h': 'text/x-c',
+    '.sql': 'text/x-sql',
+    '.toml': 'text/toml',
+    '.env': 'text/plain',
+    '.log': 'text/plain',
+    '.ini': 'text/plain',
+    '.cfg': 'text/plain',
+    '.conf': 'text/plain',
+    '.scss': 'text/css',
     '.zip': 'application/zip',
     '.gz': 'application/gzip',
 };

package/build/routes/file-browser.js

@@ -123,4 +123,34 @@ router.get('/download/{*filePath}', async (req, res) => {
         res.status(404).json({ error: 'File not found' });
     }
 });
+/**
+ * POST /api/file-browser/upload
+ * Upload a file to storage.
+ * Query: ?path=images/photo.png (target path including filename)
+ * Body: raw file bytes (Content-Type should match the file type)
+ */
+router.post('/upload', async (req, res) => {
+    const targetPath = req.query.path;
+    if (!targetPath) {
+        res.status(400).json({ error: 'path query parameter required (e.g., ?path=images/photo.png)' });
+        return;
+    }
+    // Collect raw body chunks
+    const chunks = [];
+    req.on('data', (chunk) => chunks.push(chunk));
+    req.on('end', async () => {
+        try {
+            const buffer = Buffer.concat(chunks);
+            if (buffer.length === 0) {
+                res.status(400).json({ error: 'Empty file body' });
+                return;
+            }
+            const result = await api.uploadFile({ path: targetPath, buffer });
+            res.status(result.status).json(result.data ?? { error: result.error });
+        }
+        catch (err) {
+            res.status(500).json({ error: err.message });
+        }
+    });
+});
 exports.default = router;

package/build/routes/files.js

@@ -11,8 +11,8 @@ const router = (0, express_1.Router)();
 /**
  * GET /api/files/*
  * Serve files from managed file storage.
- * Supports optional signed token (?token=<jwt>) for authenticated access
- * to locally-generated signed URLs.
+ * Requires a signed token (?token=<jwt>) for authenticated access.
+ * Use POST /api/file-browser/signed-url to generate a token.
  */
 router.get('/{*filePath}', async (req, res) => {
     const raw = req.params.filePath;
@@ -21,26 +21,28 @@ router.get('/{*filePath}', async (req, res) => {
         res.status(400).json({ error: 'File path required' });
         return;
     }
-    // Validate signed token if provided
+    // Require signed token — no unauthenticated file access
     const token = req.query.token;
-    if (token) {
-        const secret = process.env.JWT_SECRET;
-        if (!secret) {
-            res.status(500).json({ error: 'Server not configured for signed URLs' });
-            return;
-        }
-        try {
-            const decoded = jsonwebtoken_1.default.verify(token, secret);
-            if (decoded.purpose !== 'file-download' || decoded.filePath !== filePath.replace(/^\/+/, '')) {
-                res.status(403).json({ error: 'Token does not match requested file' });
-                return;
-            }
-        }
-        catch {
-            res.status(403).json({ error: 'Invalid or expired token' });
+    if (!token) {
+        res.status(401).json({ error: 'Signed token required. Use /api/file-browser/signed-url to generate one.' });
+        return;
+    }
+    const secret = process.env.JWT_SECRET;
+    if (!secret) {
+        res.status(500).json({ error: 'Server not configured for signed URLs' });
+        return;
+    }
+    try {
+        const decoded = jsonwebtoken_1.default.verify(token, secret);
+        if (decoded.purpose !== 'file-download' || decoded.filePath !== filePath.replace(/^\/+/, '')) {
+            res.status(403).json({ error: 'Token does not match requested file' });
             return;
         }
     }
+    catch {
+        res.status(403).json({ error: 'Invalid or expired token' });
+        return;
+    }
     try {
         const stream = await (0, storage_1.getStorageBackend)().createReadStream(filePath);
         const contentType = (0, mime_1.mimeFromPath)(filePath);

package/build/routes/index.js

@@ -29,6 +29,7 @@ const bot_accounts_1 = __importDefault(require("./bot-accounts"));
 const docs_1 = __importDefault(require("./docs"));
 const workflow_sets_1 = __importDefault(require("./workflow-sets"));
 const knowledge_1 = __importDefault(require("./knowledge"));
+const nats_credentials_1 = __importDefault(require("./nats-credentials"));
 const router = (0, express_1.Router)();
 // Public routes (no auth required — they handle their own auth)
 router.use('/auth', auth_2.default);
@@ -38,6 +39,7 @@ router.use('/files', files_1.default);
 router.use('/settings', settings_1.default);
 // Apply auth to all API routes
 router.use(auth_1.requireAuth);
+router.use('/nats-credentials', nats_credentials_1.default);
 router.use('/tasks', tasks_1.default);
 router.use('/escalations', escalations_1.default);
 router.use('/workflows', workflows_1.default);

package/build/routes/nats-credentials.d.ts

@@ -0,0 +1,2 @@
+declare const router: import("express-serve-static-core").Router;
+export default router;

package/build/routes/nats-credentials.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const express_1 = require("express");
+const events_1 = require("../lib/events");
+const nats_1 = require("../lib/events/nats");
+const router = (0, express_1.Router)();
+/**
+ * GET /api/nats-credentials
+ * Returns NATS WebSocket URL and auth token.
+ * Mounted behind requireAuth — only authenticated users receive the token.
+ */
+router.get('/', async (_req, res) => {
+    const hasNats = !!events_1.eventRegistry.getAdapter(nats_1.NatsEventAdapter);
+    if (!hasNats) {
+        return res.json({ natsWsUrl: null, natsToken: null });
+    }
+    res.json({
+        natsWsUrl: process.env.VITE_NATS_WS_URL || process.env.NATS_WS_URL || null,
+        natsToken: process.env.NATS_TOKEN || null,
+    });
+});
+exports.default = router;

package/build/services/config/sql.d.ts

@@ -11,4 +11,7 @@ export declare const INSERT_CONFIG_ROLE = "INSERT INTO lt_config_roles (workflow
 export declare const DELETE_INVOCATION_ROLES = "DELETE FROM lt_config_invocation_roles WHERE workflow_type = $1";
 export declare const INSERT_INVOCATION_ROLE = "INSERT INTO lt_config_invocation_roles (workflow_type, role) VALUES ($1, $2)";
 export declare const DELETE_WORKFLOW = "DELETE FROM lt_config_workflows WHERE workflow_type = $1";
+export declare const SEED_WORKFLOW_CONFIG = "INSERT INTO lt_config_workflows\n  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as)\nVALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)\nON CONFLICT (workflow_type) DO NOTHING";
+export declare const SEED_CONFIG_ROLE = "INSERT INTO lt_config_roles (workflow_type, role) VALUES ($1, $2)\nON CONFLICT (workflow_type, role) DO NOTHING";
+export declare const SEED_INVOCATION_ROLE = "INSERT INTO lt_config_invocation_roles (workflow_type, role) VALUES ($1, $2)\nON CONFLICT (workflow_type, role) DO NOTHING";
 export declare const GET_PROVIDER_DATA = "SELECT workflow_type, data, completed_at\n  FROM lt_tasks\n WHERE origin_id = $1\n   AND workflow_type = ANY($2)\n   AND status = 'completed'\n ORDER BY completed_at DESC";

package/build/services/config/sql.js

@@ -3,7 +3,7 @@
 // Read queries                                                       //
 // ------------------------------------------------------------------ //
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GET_PROVIDER_DATA = exports.DELETE_WORKFLOW = exports.INSERT_INVOCATION_ROLE = exports.DELETE_INVOCATION_ROLES = exports.INSERT_CONFIG_ROLE = exports.DELETE_CONFIG_ROLES = exports.UPSERT_WORKFLOW = exports.ENSURE_ROLE_EXISTS = exports.LIST_ALL_INVOCATION_ROLES = exports.LIST_ALL_ROLES = exports.LIST_ALL_WORKFLOWS = exports.GET_WORKFLOW_INVOCATION_ROLES = exports.GET_WORKFLOW_ROLES = exports.GET_WORKFLOW = void 0;
+exports.GET_PROVIDER_DATA = exports.SEED_INVOCATION_ROLE = exports.SEED_CONFIG_ROLE = exports.SEED_WORKFLOW_CONFIG = exports.DELETE_WORKFLOW = exports.INSERT_INVOCATION_ROLE = exports.DELETE_INVOCATION_ROLES = exports.INSERT_CONFIG_ROLE = exports.DELETE_CONFIG_ROLES = exports.UPSERT_WORKFLOW = exports.ENSURE_ROLE_EXISTS = exports.LIST_ALL_INVOCATION_ROLES = exports.LIST_ALL_ROLES = exports.LIST_ALL_WORKFLOWS = exports.GET_WORKFLOW_INVOCATION_ROLES = exports.GET_WORKFLOW_ROLES = exports.GET_WORKFLOW = void 0;
 exports.GET_WORKFLOW = `\
 SELECT * FROM lt_config_workflows WHERE workflow_type = $1`;
 exports.GET_WORKFLOW_ROLES = `\
@@ -47,6 +47,20 @@ INSERT INTO lt_config_invocation_roles (workflow_type, role) VALUES ($1, $2)`;
 exports.DELETE_WORKFLOW = `\
 DELETE FROM lt_config_workflows WHERE workflow_type = $1`;
 // ------------------------------------------------------------------ //
+// Seed (insert-if-absent — used at startup, DB is source of truth)   //
+// ------------------------------------------------------------------ //
+exports.SEED_WORKFLOW_CONFIG = `\
+INSERT INTO lt_config_workflows
+  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)
+ON CONFLICT (workflow_type) DO NOTHING`;
+exports.SEED_CONFIG_ROLE = `\
+INSERT INTO lt_config_roles (workflow_type, role) VALUES ($1, $2)
+ON CONFLICT (workflow_type, role) DO NOTHING`;
+exports.SEED_INVOCATION_ROLE = `\
+INSERT INTO lt_config_invocation_roles (workflow_type, role) VALUES ($1, $2)
+ON CONFLICT (workflow_type, role) DO NOTHING`;
+// ------------------------------------------------------------------ //
 // Provider queries                                                   //
 // ------------------------------------------------------------------ //
 exports.GET_PROVIDER_DATA = `\

package/build/services/config/write.d.ts

@@ -3,3 +3,9 @@ export declare function upsertWorkflowConfig(config: LTWorkflowConfig & {
     lifecycle?: any;
 }): Promise<LTWorkflowConfig>;
 export declare function deleteWorkflowConfig(workflowType: string): Promise<boolean>;
+/**
+ * Seed a workflow config at startup (insert-if-absent).
+ * DB is the source of truth — if the row already exists, log drift warnings
+ * but do not overwrite. Returns true if inserted, false if already existed.
+ */
+export declare function seedWorkflowConfig(config: LTWorkflowConfig): Promise<boolean>;