@hotmeshio/long-tail 0.1.15 → 0.1.17

package/build/services/config/write.js

@@ -2,8 +2,10 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.upsertWorkflowConfig = upsertWorkflowConfig;
 exports.deleteWorkflowConfig = deleteWorkflowConfig;
+exports.seedWorkflowConfig = seedWorkflowConfig;
 const db_1 = require("../../lib/db");
 const read_1 = require("./read");
+const logger_1 = require("../../lib/logger");
 const sql_1 = require("./sql");
 async function upsertWorkflowConfig(config) {
     const pool = (0, db_1.getPool)();
@@ -59,3 +61,65 @@ async function deleteWorkflowConfig(workflowType) {
     const { rowCount } = await pool.query(sql_1.DELETE_WORKFLOW, [workflowType]);
     return (rowCount ?? 0) > 0;
 }
+/**
+ * Seed a workflow config at startup (insert-if-absent).
+ * DB is the source of truth — if the row already exists, log drift warnings
+ * but do not overwrite. Returns true if inserted, false if already existed.
+ */
+async function seedWorkflowConfig(config) {
+    const pool = (0, db_1.getPool)();
+    // Ensure referenced roles exist
+    const allRoles = new Set([
+        config.default_role,
+        ...config.roles,
+        ...config.invocation_roles,
+    ]);
+    for (const role of allRoles) {
+        await pool.query(sql_1.ENSURE_ROLE_EXISTS, [role]);
+    }
+    // Insert-if-absent
+    const { rowCount } = await pool.query(sql_1.SEED_WORKFLOW_CONFIG, [
+        config.workflow_type,
+        config.invocable,
+        config.task_queue,
+        config.default_role,
+        config.description,
+        config.consumes,
+        config.envelope_schema ?? null,
+        config.resolver_schema ?? null,
+        config.cron_schedule ?? null,
+        config.tool_tags || [],
+        config.execute_as ?? null,
+    ]);
+    const inserted = (rowCount ?? 0) > 0;
+    if (inserted) {
+        // Seed roles (also insert-if-absent)
+        for (const role of config.roles) {
+            await pool.query(sql_1.SEED_CONFIG_ROLE, [config.workflow_type, role]);
+        }
+        for (const role of config.invocation_roles) {
+            await pool.query(sql_1.SEED_INVOCATION_ROLE, [config.workflow_type, role]);
+        }
+    }
+    else {
+        // Drift detection — compare key fields
+        const existing = await (0, read_1.getWorkflowConfig)(config.workflow_type);
+        if (existing) {
+            const drifts = [];
+            if (config.description && existing.description !== config.description)
+                drifts.push('description');
+            if (config.invocable !== existing.invocable)
+                drifts.push('invocable');
+            if (config.default_role !== existing.default_role)
+                drifts.push('default_role');
+            if (JSON.stringify(config.envelope_schema) !== JSON.stringify(existing.envelope_schema))
+                drifts.push('envelope_schema');
+            if (JSON.stringify(config.resolver_schema) !== JSON.stringify(existing.resolver_schema))
+                drifts.push('resolver_schema');
+            if (drifts.length) {
+                logger_1.loggerRegistry.warn(`[long-tail] config drift: ${config.workflow_type} — ${drifts.join(', ')} differ between code and DB`);
+            }
+        }
+    }
+    return inserted;
+}

package/build/services/cron/index.d.ts

@@ -1,5 +1,10 @@
 import type { LTWorkflowConfig } from '../../types';
 import type { LTYamlWorkflowRecord } from '../../types/yaml-workflow';
+/**
+ * Validate a cron expression and enforce a minimum interval.
+ * Throws if the expression is invalid or fires more often than once per minute.
+ */
+export declare function validateCronSchedule(expr: string): void;
 /**
  * Singleton registry for workflow cron schedules.
  *

package/build/services/cron/index.js

@@ -34,12 +34,34 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.cronRegistry = void 0;
+exports.validateCronSchedule = validateCronSchedule;
 const hotmesh_1 = require("@hotmeshio/hotmesh");
+const cron_parser_1 = require("cron-parser");
 const db_1 = require("../../lib/db");
 const defaults_1 = require("../../modules/defaults");
 const logger_1 = require("../../lib/logger");
 const configService = __importStar(require("../config"));
 const principal_1 = require("../iam/principal");
+const MIN_CRON_INTERVAL_MS = 60_000; // 1 minute minimum
+/**
+ * Validate a cron expression and enforce a minimum interval.
+ * Throws if the expression is invalid or fires more often than once per minute.
+ */
+function validateCronSchedule(expr) {
+    let interval;
+    try {
+        interval = (0, cron_parser_1.parseExpression)(expr, { utc: true });
+    }
+    catch {
+        throw new Error(`Invalid cron expression: "${expr}"`);
+    }
+    const first = interval.next().toDate().getTime();
+    const second = interval.next().toDate().getTime();
+    const gap = second - first;
+    if (gap < MIN_CRON_INTERVAL_MS) {
+        throw new Error(`Cron interval too frequent: "${expr}" fires every ${Math.round(gap / 1000)}s (minimum is 60s)`);
+    }
+}
 const CRON_TOPIC_PREFIX = 'lt.cron';
 const CRON_ID_PREFIX = 'lt-cron';
 const YAML_CRON_TOPIC_PREFIX = 'lt.cron.yaml';
@@ -86,6 +108,7 @@ class LTCronRegistry {
     async startCron(config) {
         if (!config.cron_schedule || !config.task_queue)
             return;
+        validateCronSchedule(config.cron_schedule);
         const connection = (0, db_1.getConnection)();
         const topic = `${CRON_TOPIC_PREFIX}.${config.workflow_type}`;
         const cronId = `${CRON_ID_PREFIX}-${config.workflow_type}`;
@@ -96,6 +119,11 @@ class LTCronRegistry {
         if (!defaultEnvelope.metadata)
             defaultEnvelope.metadata = {};
         defaultEnvelope.metadata.source = 'cron';
+        // Auto-certify if the workflow config has roles or consumes
+        const isCertified = (config.roles?.length ?? 0) > 0 || (config.consumes?.length ?? 0) > 0;
+        if (isCertified) {
+            defaultEnvelope.metadata.certified = true;
+        }
         // Resolve executing principal: per-config execute_as, or system bot fallback
         if (!defaultEnvelope.lt)
             defaultEnvelope.lt = {};
@@ -129,6 +157,7 @@ class LTCronRegistry {
                         workflowId,
                         expire: defaults_1.JOB_EXPIRE_SECS,
                         entity: workflowType,
+                        signalIn: false,
                     });
                 }
                 catch (err) {
@@ -195,6 +224,7 @@ class LTCronRegistry {
     async startYamlCron(wf) {
         if (!wf.cron_schedule)
             return;
+        validateCronSchedule(wf.cron_schedule);
         const connection = (0, db_1.getConnection)();
         const topic = `${YAML_CRON_TOPIC_PREFIX}.${wf.id}`;
         const cronId = `${YAML_CRON_ID_PREFIX}-${wf.id}`;

package/build/services/insight/index.js

@@ -34,6 +34,7 @@ async function startMcpQuery(input) {
         workflowId,
         expire: defaults_1.JOB_EXPIRE_SECS,
         entity,
+        signalIn: false,
     });
     if (wait === false) {
         return { workflow_id: workflowId, status: 'started', prompt };
@@ -63,6 +64,7 @@ async function startWorkflowBuilder(input) {
         workflowId,
         expire: defaults_1.JOB_EXPIRE_SECS,
         entity: 'mcpWorkflowBuilder',
+        signalIn: false,
     });
     if (wait === false) {
         return { workflow_id: workflowId, status: 'started', prompt };
@@ -92,6 +94,7 @@ async function startWorkflowPlanner(input) {
         workflowId,
         expire: defaults_1.JOB_EXPIRE_SECS,
         entity: 'mcpWorkflowPlanner',
+        signalIn: false,
     });
     if (wait === false) {
         return { workflow_id: workflowId, status: 'started', prompt: specification.slice(0, 200) };

package/build/services/interceptor/activities/task.d.ts

@@ -18,6 +18,7 @@ export declare function ltCreateTask(input: {
     initiatedBy?: string;
     principalType?: string;
     executingAs?: string;
+    status?: string;
 }): Promise<string>;
 /**
  * Mark a task as in_progress.

package/build/services/interceptor/activities/task.js

@@ -79,6 +79,7 @@ async function ltCreateTask(input) {
         initiated_by: initiatedByUuid,
         principal_type: input.principalType,
         executing_as: input.executingAs,
+        status: input.status,
     });
     (0, publish_1.publishTaskEvent)({
         type: 'task.created',
@@ -88,7 +89,7 @@ async function ltCreateTask(input) {
         taskQueue: input.taskQueue || 'unknown',
         taskId: task.id,
         originId: input.originId,
-        status: 'pending',
+        status: input.status || 'pending',
     });
     return task.id;
 }

package/build/services/interceptor/activities/workflow.js

@@ -35,6 +35,7 @@ async function ltStartWorkflow(input) {
         taskQueue: input.taskQueue,
         workflowId: input.workflowId,
         expire: input.expire ?? defaults_1.JOB_EXPIRE_SECS,
+        signalIn: false,
     });
     logger_1.loggerRegistry.info(`[ltStartWorkflow] started ${input.workflowName} (${input.workflowId})`);
 }

package/build/services/interceptor/index.js

@@ -99,10 +99,10 @@ function createLTInterceptor(options) {
                 retry: { maximumAttempts: 3 },
             });
             const envelope = (0, state_1.extractEnvelope)(ctx);
-            // 2. Fast path: envelope.metadata.certified === false skips the DB
-            //    lookup entirely. Use this for configured (non-certified) workflows
-            //    that manage their own escalation lifecycle via conditionLT.
-            if (envelope?.metadata?.certified === false) {
+            // 2. Fast path: certification is opt-in. Only workflows with
+            //    metadata.certified === true pay for the config lookup,
+            //    task creation, and escalation wiring.
+            if (envelope?.metadata?.certified !== true) {
                 const toolCtx = (0, envelope_1.buildToolContextFromEnvelope)(envelope, wf.workflowId, wf.workflowTrace, wf.workflowSpan);
                 return toolCtx ? (0, context_2.runWithToolContext)(toolCtx, next) : next();
             }

package/build/services/interceptor/lifecycle.js

@@ -120,8 +120,8 @@ async function ensureTaskWithRouting(activities, wf, envelope, existingTask, tas
             spanId: wf.workflowSpan,
             initiatedBy: envelope?.lt?.initiatedBy ?? envelope?.lt?.userId,
             executingAs: envelope?.lt?.initiatedBy ? envelope?.lt?.userId : undefined,
+            status: 'in_progress',
         });
-        await activities.ltStartTask(taskId);
     }
     else if (existingTask?.status === 'pending') {
         await activities.ltStartTask(taskId);

package/build/services/mcp/db.d.ts

@@ -24,3 +24,20 @@ export declare function getAutoConnectServers(): Promise<LTMcpServerRecord[]>;
  * @param match - 'any' (OR — server has at least one tag) or 'all' (AND — server has all tags)
  */
 export declare function findServersByTags(tags: string[], match?: 'any' | 'all'): Promise<LTMcpServerRecord[]>;
+/**
+ * Seed an MCP server at startup (insert-if-absent).
+ * DB is the source of truth — if the row already exists, log drift warnings
+ * but do not overwrite. Returns true if inserted, false if already existed.
+ */
+export declare function seedMcpServer(input: {
+    name: string;
+    description?: string;
+    tags?: string[];
+    compileHints?: string;
+    credentialProviders?: string[];
+    toolManifest?: any[];
+}): Promise<boolean>;
+/**
+ * Remove builtin MCP servers that are no longer declared in factory config.
+ */
+export declare function cleanStaleBuiltinServers(activeNames: string[]): Promise<void>;

package/build/services/mcp/db.js

@@ -9,7 +9,10 @@ exports.updateMcpServerStatus = updateMcpServerStatus;
 exports.listMcpServers = listMcpServers;
 exports.getAutoConnectServers = getAutoConnectServers;
 exports.findServersByTags = findServersByTags;
+exports.seedMcpServer = seedMcpServer;
+exports.cleanStaleBuiltinServers = cleanStaleBuiltinServers;
 const db_1 = require("../../lib/db");
+const logger_1 = require("../../lib/logger");
 const sql_1 = require("./sql");
 async function createMcpServer(input) {
     const pool = (0, db_1.getPool)();
@@ -149,3 +152,50 @@ async function findServersByTags(tags, match = 'any') {
     const { rows } = await pool.query(`SELECT * FROM lt_mcp_servers WHERE tags ${operator} $1::text[] ORDER BY name`, [tags]);
     return rows;
 }
+/**
+ * Seed an MCP server at startup (insert-if-absent).
+ * DB is the source of truth — if the row already exists, log drift warnings
+ * but do not overwrite. Returns true if inserted, false if already existed.
+ */
+async function seedMcpServer(input) {
+    const pool = (0, db_1.getPool)();
+    const { rowCount } = await pool.query(sql_1.SEED_MCP_SERVER, [
+        input.name,
+        input.description || null,
+        'stdio',
+        JSON.stringify({ builtin: true, process: 'in-memory' }),
+        JSON.stringify(input.toolManifest || []),
+        JSON.stringify({ builtin: true }),
+        input.tags || [],
+        input.compileHints || null,
+        input.credentialProviders || [],
+    ]);
+    const inserted = (rowCount ?? 0) > 0;
+    if (!inserted) {
+        // Drift detection
+        const existing = await getMcpServerByName(input.name);
+        if (existing) {
+            const drifts = [];
+            if (input.description && existing.description !== input.description)
+                drifts.push('description');
+            if (input.compileHints && existing.compile_hints !== input.compileHints)
+                drifts.push('compile_hints');
+            if (JSON.stringify(input.tags || []) !== JSON.stringify(existing.tags || []))
+                drifts.push('tags');
+            if (drifts.length) {
+                logger_1.loggerRegistry.warn(`[long-tail] MCP server drift: ${input.name} — ${drifts.join(', ')} differ between code and DB`);
+            }
+        }
+    }
+    return inserted;
+}
+/**
+ * Remove builtin MCP servers that are no longer declared in factory config.
+ */
+async function cleanStaleBuiltinServers(activeNames) {
+    const pool = (0, db_1.getPool)();
+    const { rows } = await pool.query(sql_1.DELETE_STALE_BUILTIN_SERVERS, [activeNames]);
+    for (const row of rows) {
+        logger_1.loggerRegistry.info(`[long-tail] removed stale builtin MCP server: ${row.name}`);
+    }
+}

package/build/services/mcp/sql.d.ts

@@ -15,4 +15,7 @@ export declare const HEALTH_COMPILED_WORKFLOWS = "\n  SELECT\n    COUNT(*)::int
 export declare const HEALTH_WORKFLOW_CONFIGS = "\n  SELECT workflow_type, task_queue, description\n  FROM lt_config_workflows ORDER BY workflow_type";
 export declare const HEALTH_DURABLE_WORKFLOWS = "\n  SELECT\n    COALESCE(entity, '_internal') AS entity,\n    COUNT(*)::int AS total,\n    COUNT(*) FILTER (WHERE status = 0)::int AS active,\n    COUNT(*) FILTER (WHERE status = 1)::int AS completed\n  FROM durable.jobs\n  WHERE entity IS NOT NULL AND entity != ''\n  GROUP BY entity\n  ORDER BY entity";
 export declare const DELETE_STALE_BUILTIN_SERVERS = "\n  DELETE FROM lt_mcp_servers\n  WHERE (metadata->>'builtin')::boolean = true\n    AND name != ALL($1)\n  RETURNING name";
-export declare const SEED_MCP_SERVER = "\n  INSERT INTO lt_mcp_servers\n    (name, description, transport_type, transport_config, auto_connect, status, tool_manifest, metadata, tags, compile_hints, credential_providers, last_connected_at)\n  VALUES ($1, $2, $3, $4, true, 'connected', $5, $6, $7, $8, $9, NOW())\n  ON CONFLICT (name) DO UPDATE SET\n    tool_manifest = EXCLUDED.tool_manifest,\n    metadata = EXCLUDED.metadata,\n    description = EXCLUDED.description,\n    tags = EXCLUDED.tags,\n    compile_hints = EXCLUDED.compile_hints,\n    credential_providers = EXCLUDED.credential_providers,\n    status = 'connected',\n    last_connected_at = NOW()";
+/** Upsert — used by dashboard/API writes (overwrites intentionally). */
+export declare const UPSERT_MCP_SERVER = "\n  INSERT INTO lt_mcp_servers\n    (name, description, transport_type, transport_config, auto_connect, status, tool_manifest, metadata, tags, compile_hints, credential_providers, last_connected_at)\n  VALUES ($1, $2, $3, $4, true, 'connected', $5, $6, $7, $8, $9, NOW())\n  ON CONFLICT (name) DO UPDATE SET\n    tool_manifest = EXCLUDED.tool_manifest,\n    metadata = EXCLUDED.metadata,\n    description = EXCLUDED.description,\n    tags = EXCLUDED.tags,\n    compile_hints = EXCLUDED.compile_hints,\n    credential_providers = EXCLUDED.credential_providers,\n    status = 'connected',\n    last_connected_at = NOW()";
+/** Seed — insert-if-absent. DB is source of truth after first boot. */
+export declare const SEED_MCP_SERVER = "\n  INSERT INTO lt_mcp_servers\n    (name, description, transport_type, transport_config, auto_connect, status, tool_manifest, metadata, tags, compile_hints, credential_providers, last_connected_at)\n  VALUES ($1, $2, $3, $4, true, 'connected', $5, $6, $7, $8, $9, NOW())\n  ON CONFLICT (name) DO NOTHING";

package/build/services/mcp/sql.js

@@ -1,7 +1,7 @@
 "use strict";
 // ─── MCP server CRUD ────────────────────────────────────────────────────────
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SEED_MCP_SERVER = exports.DELETE_STALE_BUILTIN_SERVERS = exports.HEALTH_DURABLE_WORKFLOWS = exports.HEALTH_WORKFLOW_CONFIGS = exports.HEALTH_COMPILED_WORKFLOWS = exports.HEALTH_MCP_SERVER_LIST = exports.HEALTH_MCP_SERVERS = exports.HEALTH_RECENT_ACTIVITY = exports.HEALTH_ACTIVE_WORKFLOW_TYPES = exports.HEALTH_ESCALATION_COUNTS = exports.HEALTH_TASK_COUNTS = exports.GET_AUTO_CONNECT_SERVERS = exports.UPDATE_STATUS = exports.UPDATE_STATUS_CONNECTED = exports.DELETE_MCP_SERVER = exports.GET_MCP_SERVER_BY_NAME = exports.GET_MCP_SERVER = exports.CREATE_MCP_SERVER = void 0;
+exports.SEED_MCP_SERVER = exports.UPSERT_MCP_SERVER = exports.DELETE_STALE_BUILTIN_SERVERS = exports.HEALTH_DURABLE_WORKFLOWS = exports.HEALTH_WORKFLOW_CONFIGS = exports.HEALTH_COMPILED_WORKFLOWS = exports.HEALTH_MCP_SERVER_LIST = exports.HEALTH_MCP_SERVERS = exports.HEALTH_RECENT_ACTIVITY = exports.HEALTH_ACTIVE_WORKFLOW_TYPES = exports.HEALTH_ESCALATION_COUNTS = exports.HEALTH_TASK_COUNTS = exports.GET_AUTO_CONNECT_SERVERS = exports.UPDATE_STATUS = exports.UPDATE_STATUS_CONNECTED = exports.DELETE_MCP_SERVER = exports.GET_MCP_SERVER_BY_NAME = exports.GET_MCP_SERVER = exports.CREATE_MCP_SERVER = void 0;
 exports.CREATE_MCP_SERVER = `
   INSERT INTO lt_mcp_servers
     (name, description, transport_type, transport_config, auto_connect, metadata, tags, compile_hints, credential_providers)
@@ -77,7 +77,8 @@ exports.DELETE_STALE_BUILTIN_SERVERS = `
   WHERE (metadata->>'builtin')::boolean = true
     AND name != ALL($1)
   RETURNING name`;
-exports.SEED_MCP_SERVER = `
+/** Upsert — used by dashboard/API writes (overwrites intentionally). */
+exports.UPSERT_MCP_SERVER = `
   INSERT INTO lt_mcp_servers
     (name, description, transport_type, transport_config, auto_connect, status, tool_manifest, metadata, tags, compile_hints, credential_providers, last_connected_at)
   VALUES ($1, $2, $3, $4, true, 'connected', $5, $6, $7, $8, $9, NOW())
@@ -90,3 +91,9 @@ exports.SEED_MCP_SERVER = `
     credential_providers = EXCLUDED.credential_providers,
     status = 'connected',
     last_connected_at = NOW()`;
+/** Seed — insert-if-absent. DB is source of truth after first boot. */
+exports.SEED_MCP_SERVER = `
+  INSERT INTO lt_mcp_servers
+    (name, description, transport_type, transport_config, auto_connect, status, tool_manifest, metadata, tags, compile_hints, credential_providers, last_connected_at)
+  VALUES ($1, $2, $3, $4, true, 'connected', $5, $6, $7, $8, $9, NOW())
+  ON CONFLICT (name) DO NOTHING`;

package/build/services/oauth/index.js

@@ -57,11 +57,14 @@ function initializeOAuth(config) {
         }
     }
     // Auto-detect providers from environment variables
+    const port = process.env.PORT || '3000';
+    const baseUrl = process.env.BASE_URL || `http://localhost:${port}`;
     for (const { provider, idVar, secretVar } of ENV_PROVIDERS) {
         const clientId = process.env[idVar];
         const clientSecret = process.env[secretVar];
         if (clientId && clientSecret && !(0, providers_1.getProvider)(provider)) {
-            (0, providers_1.registerProvider)({ provider, clientId, clientSecret, scopes: [] });
+            const redirectUri = `${baseUrl}/api/auth/oauth/${provider}/callback`;
+            (0, providers_1.registerProvider)({ provider, clientId, clientSecret, scopes: [], redirectUri });
         }
     }
     // Register built-in credential providers (API key paste flow, no real OAuth)

package/build/services/oauth/providers/google.js

@@ -48,8 +48,13 @@ function createGoogleHandler(cfg) {
         config: cfg,
         async createAuthorizationURL(state, codeVerifier) {
             const google = await getClient();
-            const scopes = cfg.scopes.length > 0 ? cfg.scopes : ['openid', 'email', 'profile'];
-            return google.createAuthorizationURL(state, codeVerifier, scopes);
+            const scopes = cfg.scopes.length > 0
+                ? cfg.scopes
+                : ['openid', 'email', 'profile', 'https://www.googleapis.com/auth/gmail.readonly'];
+            const url = google.createAuthorizationURL(state, codeVerifier, scopes);
+            url.searchParams.set('access_type', 'offline');
+            url.searchParams.set('prompt', 'consent');
+            return url;
         },
         async validateAuthorizationCode(code, codeVerifier) {
             const google = await getClient();

package/build/services/orchestrator/index.js

@@ -131,6 +131,10 @@ async function executeLT(options) {
     if (envelope) {
         const userId = envelope.lt?.userId || orchCtx?.userId;
         envelope.lt = { ...envelope.lt, taskId, originId, parentId, userId };
+        // Propagate certified flag from parent to child
+        if (envelope0?.metadata?.certified === true && envelope.metadata) {
+            envelope.metadata.certified = true;
+        }
     }
     // 5. Start child workflow (fire-and-forget — only the start is awaited)
     await hotmesh_1.Durable.workflow.startChild({
@@ -140,6 +144,7 @@ async function executeLT(options) {
         workflowId: childWorkflowId,
         expire: expire || defaults_1.JOB_EXPIRE_SECS,
         entity: workflowName,
+        signalIn: false,
     });
     // 6. Wait for the child's interceptor to signal back with the result
     const result = await hotmesh_1.Durable.workflow.condition(signalId);

package/build/services/task/crud.js

@@ -28,6 +28,7 @@ async function createTask(input) {
         input.initiated_by || null,
         input.principal_type || null,
         input.executing_as || null,
+        input.status || null,
     ]);
     return rows[0];
 }

package/build/services/task/sql.d.ts

@@ -1,4 +1,4 @@
-export declare const CREATE_TASK = "\n  INSERT INTO lt_tasks\n    (workflow_id, workflow_type, lt_type, task_queue, signal_id,\n     parent_workflow_id, origin_id, parent_id, envelope, metadata, priority,\n     trace_id, span_id, initiated_by, principal_type, executing_as)\n  VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16)\n  RETURNING *";
+export declare const CREATE_TASK = "\n  INSERT INTO lt_tasks\n    (workflow_id, workflow_type, lt_type, task_queue, signal_id,\n     parent_workflow_id, origin_id, parent_id, envelope, metadata, priority,\n     trace_id, span_id, initiated_by, principal_type, executing_as, status)\n  VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, COALESCE($17, 'pending'))\n  RETURNING *";
 export declare const APPEND_MILESTONES = "\n  UPDATE lt_tasks\n  SET milestones = milestones || $1::jsonb\n  WHERE id = $2\n  RETURNING *";
 export declare const GET_TASK = "SELECT * FROM lt_tasks WHERE id = $1";
 export declare const GET_TASK_BY_SIGNAL_ID = "SELECT * FROM lt_tasks WHERE signal_id = $1";

package/build/services/task/sql.js

@@ -11,8 +11,8 @@ exports.CREATE_TASK = `
   INSERT INTO lt_tasks
     (workflow_id, workflow_type, lt_type, task_queue, signal_id,
      parent_workflow_id, origin_id, parent_id, envelope, metadata, priority,
-     trace_id, span_id, initiated_by, principal_type, executing_as)
-  VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16)
+     trace_id, span_id, initiated_by, principal_type, executing_as, status)
+  VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, COALESCE($17, 'pending'))
   RETURNING *`;
 exports.APPEND_MILESTONES = `
   UPDATE lt_tasks

package/build/services/task/types.d.ts

@@ -23,6 +23,8 @@ export interface CreateTaskInput {
     principal_type?: string;
     /** Executing principal (bot external_id) when proxy invocation is used. */
     executing_as?: string;
+    /** Initial status. Default: 'pending'. */
+    status?: string;
 }
 export interface UpdateTaskInput {
     status?: LTTaskStatus;

package/build/services/workers/registry.js

@@ -17,10 +17,12 @@ function getRegisteredWorkers() {
 /** System workflows excluded from the overview by default. */
 exports.SYSTEM_WORKFLOWS = new Set([
     'mcpQuery',
-    'mcpDeterministic',
     'mcpQueryRouter',
+    'mcpDeterministic',
     'mcpTriage',
     'mcpTriageRouter',
     'mcpTriageDeterministic',
+    'mcpWorkflowBuilder',
+    'mcpWorkflowPlanner',
     'insightQuery',
 ]);

package/build/services/workflow-invocation.js

@@ -91,7 +91,13 @@ async function invokeWorkflow(input) {
     }
     // 4. Resolve principals and build envelope
     const wfConfig = await configService.getWorkflowConfig(workflowType);
-    const envelope = await buildEnvelope(data, metadata ?? {}, auth.userId, executeAsOverride, wfConfig?.execute_as ?? undefined);
+    const isCertified = !!(wfConfig &&
+        ((wfConfig.roles?.length ?? 0) > 0 || (wfConfig.consumes?.length ?? 0) > 0));
+    const resolvedMetadata = { ...(metadata ?? {}) };
+    if (isCertified && resolvedMetadata.certified !== false) {
+        resolvedMetadata.certified = true;
+    }
+    const envelope = await buildEnvelope(data, resolvedMetadata, auth.userId, executeAsOverride, wfConfig?.execute_as ?? undefined);
     // 5. Start workflow — caller options pass through to Durable client
     const client = (0, workers_1.createClient)();
     const callerOpts = input.options ?? {};
@@ -104,6 +110,7 @@ async function invokeWorkflow(input) {
         workflowId,
         expire: callerOpts.expire ?? defaults_1.JOB_EXPIRE_SECS,
         entity: callerOpts.entity ?? workflowType,
+        signalIn: false,
     });
     return { workflowId };
 }

package/build/services/yaml-workflow/workers/register.js

@@ -138,7 +138,8 @@ async function registerWorkersForWorkflow(workflow) {
         else if (toolSource === 'db') {
             if (!activity.mcp_tool_name)
                 continue;
-            const toolName = activity.mcp_tool_name;
+            const rawToolName = activity.mcp_tool_name;
+            const toolName = rawToolName.includes('__') ? rawToolName.slice(rawToolName.indexOf('__') + 2) : rawToolName;
             const dbServerId = activity.mcp_server_id || 'long-tail-db';
             const toolArgs = activity.tool_arguments;
             workerConfigs.push({
@@ -163,7 +164,8 @@ async function registerWorkersForWorkflow(workflow) {
         else {
             if (!activity.mcp_tool_name)
                 continue;
-            const toolName = activity.mcp_tool_name;
+            const rawToolName = activity.mcp_tool_name;
+            const toolName = rawToolName.includes('__') ? rawToolName.slice(rawToolName.indexOf('__') + 2) : rawToolName;
             const serverId = activity.mcp_server_id;
             if (!serverId)
                 continue;

package/build/start/adapters.js

@@ -16,6 +16,7 @@ const adapter_1 = require("../services/mcp/adapter");
 const escalation_strategy_1 = require("../services/escalation-strategy");
 const default_1 = require("../services/escalation-strategy/default");
 const mcp_2 = require("../services/escalation-strategy/mcp");
+const socket_auth_1 = require("./socket-auth");
 /**
  * Register all adapters (logging, telemetry, events, maintenance,
  * escalation strategy, MCP) based on the startup config.
@@ -46,7 +47,9 @@ function registerAdapters(startConfig) {
         if (startConfig.events?.nats) {
             events_1.eventRegistry.register(new nats_1.NatsEventAdapter(startConfig.events.nats));
         }
-        events_1.eventRegistry.register(new socketio_1.SocketIOEventAdapter());
+        events_1.eventRegistry.register(new socketio_1.SocketIOEventAdapter({
+            authenticate: (0, socket_auth_1.createSocketIOAuthenticator)(startConfig),
+        }));
     }
     // Always register the callback adapter for SDK event subscriptions.
     // Zero-cost when no listeners are registered.

package/build/start/socket-auth.d.ts

@@ -0,0 +1,13 @@
+import type { SocketIOAuthenticator } from '../lib/events/socketio';
+import type { LTStartConfig } from '../types/startup';
+/**
+ * Build a Socket.IO handshake authenticator from the startup config.
+ *
+ * Uses the same JWT secret as `requireAuth` — either the explicit
+ * secret from startConfig.auth.secret or the JWT_SECRET env var.
+ *
+ * Returns `undefined` when no secret is configured (e.g. tests or
+ * deployments that intentionally skip auth), which leaves Socket.IO
+ * open as before.
+ */
+export declare function createSocketIOAuthenticator(startConfig: LTStartConfig): SocketIOAuthenticator | undefined;

package/build/start/socket-auth.js

@@ -0,0 +1,32 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSocketIOAuthenticator = createSocketIOAuthenticator;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const config_1 = require("../modules/config");
+/**
+ * Build a Socket.IO handshake authenticator from the startup config.
+ *
+ * Uses the same JWT secret as `requireAuth` — either the explicit
+ * secret from startConfig.auth.secret or the JWT_SECRET env var.
+ *
+ * Returns `undefined` when no secret is configured (e.g. tests or
+ * deployments that intentionally skip auth), which leaves Socket.IO
+ * open as before.
+ */
+function createSocketIOAuthenticator(startConfig) {
+    const secret = startConfig.auth?.secret ?? config_1.config.JWT_SECRET;
+    if (!secret)
+        return undefined;
+    return (token) => {
+        try {
+            const payload = jsonwebtoken_1.default.verify(token, secret);
+            return !!(payload && typeof payload === 'object' && payload.userId);
+        }
+        catch {
+            return false;
+        }
+    };
+}

package/build/start/workers.d.ts

@@ -1,4 +1,4 @@
-import type { LTStartConfig } from '../types/startup';
+import type { LTStartConfig, LTWorkerConfig } from '../types/startup';
 type WorkerEntry = {
     taskQueue: string;
     workflow: (...args: any[]) => any;
@@ -6,6 +6,7 @@ type WorkerEntry = {
         readonly?: boolean;
         retry?: Record<string, unknown>;
     };
+    config?: LTWorkerConfig;
 };
 /**
  * Build the connection descriptor used by HotMesh / Durable.