@hotmeshio/long-tail 0.1.16 → 0.1.18

package/build/api/escalations/resolve.js

@@ -159,6 +159,7 @@ async function resolveViaTriage(escalation, resolverPayload, triageEnvelope) {
         workflowId: triageWorkflowId,
         expire: defaults_1.JOB_EXPIRE_SECS,
         entity: 'mcpTriageRouter',
+        signalIn: false,
     });
     await escalationService.resolveEscalation(escalation.id, {
         ...resolverPayload,

package/build/api/files.d.ts

@@ -10,6 +10,10 @@ export declare function getFileMetadata(input: {
 export declare function deleteFile(input: {
     filePath: string;
 }): Promise<LTApiResult>;
+export declare function uploadFile(input: {
+    path: string;
+    buffer: Buffer;
+}): Promise<LTApiResult>;
 export declare function generateSignedUrl(input: {
     filePath: string;
     expiresIn: number;

package/build/api/files.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.browseFiles = browseFiles;
 exports.getFileMetadata = getFileMetadata;
 exports.deleteFile = deleteFile;
+exports.uploadFile = uploadFile;
 exports.generateSignedUrl = generateSignedUrl;
 const storage_1 = require("../lib/storage");
 const mime_1 = require("../lib/storage/mime");
@@ -43,6 +44,19 @@ async function deleteFile(input) {
         return { status: 500, error: err.message };
     }
 }
+async function uploadFile(input) {
+    try {
+        const result = await (0, storage_1.getStorageBackend)().write(input.path, input.buffer);
+        const contentType = (0, mime_1.mimeFromPath)(input.path);
+        return {
+            status: 200,
+            data: { path: input.path, size: result.size, content_type: contentType },
+        };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}
 async function generateSignedUrl(input) {
     if (!ALLOWED_EXPIRY.includes(input.expiresIn)) {
         return {

package/build/api/workflows/config.js

@@ -95,6 +95,11 @@ async function getWorkflowConfig(input) {
  */
 async function upsertWorkflowConfig(input) {
     try {
+        // Validate cron expression before persisting
+        if (input.cron_schedule) {
+            const { validateCronSchedule } = await Promise.resolve().then(() => __importStar(require('../../services/cron')));
+            validateCronSchedule(input.cron_schedule);
+        }
         const config = await configService.upsertWorkflowConfig({
             workflow_type: input.type,
             invocable: input.invocable ?? false,

package/build/index.d.ts

@@ -37,8 +37,8 @@ export { getActivityIdentity } from './services/iam/activity';
 export { getToolContext } from './services/iam/context';
 export { registerMcpTool } from './services/mcp/register-tool';
 export { getSystemWorkers, builtinMcpServerFactories } from './system';
-export { seedSystemMcpServers } from './system/seed';
 export { CallbackEventAdapter } from './lib/events/callback';
 export { createClient } from './sdk';
+export { getFreshAccessToken } from './services/oauth';
 export type { LTClient, LTClientOptions } from './sdk';
 export * as api from './api';

package/build/index.js

@@ -36,7 +36,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createClient = exports.CallbackEventAdapter = exports.seedSystemMcpServers = exports.builtinMcpServerFactories = exports.getSystemWorkers = exports.registerMcpTool = exports.getToolContext = exports.getActivityIdentity = exports.seedExamples = exports.exampleWorkers = exports.McpEscalationStrategy = exports.DefaultEscalationStrategy = exports.escalationStrategyRegistry = exports.McpVisionServer = exports.McpTranslationServer = exports.McpServer = exports.McpClient = exports.McpService = exports.BuiltInMcpAdapter = exports.mcpRegistry = exports.defaultMaintenanceConfig = exports.maintenanceRegistry = exports.PinoLoggerAdapter = exports.loggerRegistry = exports.HoneycombTelemetryAdapter = exports.telemetryRegistry = exports.publishWorkflowEvent = exports.publishEscalationEvent = exports.publishTaskEvent = exports.publishMilestoneEvent = exports.SocketIOEventAdapter = exports.InMemoryEventAdapter = exports.NatsEventAdapter = exports.eventRegistry = exports.ltConfig = exports.UserService = exports.ConfigService = exports.EscalationService = exports.TaskService = exports.signToken = exports.requireAdmin = exports.requireAuth = exports.createAuthMiddleware = exports.JwtAuthAdapter = exports.conditionLT = exports.executeLT = exports.createLTActivityInterceptor = exports.createLTInterceptor = exports.registerLT = exports.start = void 0;
+exports.getFreshAccessToken = exports.createClient = exports.CallbackEventAdapter = exports.builtinMcpServerFactories = exports.getSystemWorkers = exports.registerMcpTool = exports.getToolContext = exports.getActivityIdentity = exports.seedExamples = exports.exampleWorkers = exports.McpEscalationStrategy = exports.DefaultEscalationStrategy = exports.escalationStrategyRegistry = exports.McpVisionServer = exports.McpTranslationServer = exports.McpServer = exports.McpClient = exports.McpService = exports.BuiltInMcpAdapter = exports.mcpRegistry = exports.defaultMaintenanceConfig = exports.maintenanceRegistry = exports.PinoLoggerAdapter = exports.loggerRegistry = exports.HoneycombTelemetryAdapter = exports.telemetryRegistry = exports.publishWorkflowEvent = exports.publishEscalationEvent = exports.publishTaskEvent = exports.publishMilestoneEvent = exports.SocketIOEventAdapter = exports.InMemoryEventAdapter = exports.NatsEventAdapter = exports.eventRegistry = exports.ltConfig = exports.UserService = exports.ConfigService = exports.EscalationService = exports.TaskService = exports.signToken = exports.requireAdmin = exports.requireAuth = exports.createAuthMiddleware = exports.JwtAuthAdapter = exports.conditionLT = exports.executeLT = exports.createLTActivityInterceptor = exports.createLTInterceptor = exports.registerLT = exports.start = void 0;
 exports.api = void 0;
 const config_1 = require("./modules/config");
 const logger_1 = require("./lib/logger");
@@ -118,12 +118,12 @@ Object.defineProperty(exports, "registerMcpTool", { enumerable: true, get: funct
 var system_1 = require("./system");
 Object.defineProperty(exports, "getSystemWorkers", { enumerable: true, get: function () { return system_1.getSystemWorkers; } });
 Object.defineProperty(exports, "builtinMcpServerFactories", { enumerable: true, get: function () { return system_1.builtinMcpServerFactories; } });
-var seed_1 = require("./system/seed");
-Object.defineProperty(exports, "seedSystemMcpServers", { enumerable: true, get: function () { return seed_1.seedSystemMcpServers; } });
 var callback_1 = require("./lib/events/callback");
 Object.defineProperty(exports, "CallbackEventAdapter", { enumerable: true, get: function () { return callback_1.CallbackEventAdapter; } });
 var sdk_1 = require("./sdk");
 Object.defineProperty(exports, "createClient", { enumerable: true, get: function () { return sdk_1.createClient; } });
+var oauth_1 = require("./services/oauth");
+Object.defineProperty(exports, "getFreshAccessToken", { enumerable: true, get: function () { return oauth_1.getFreshAccessToken; } });
 exports.api = __importStar(require("./api"));
 // ─── Server ──────────────────────────────────────────────────────────────────
 async function main() {

package/build/lib/db/schemas/002_seed.sql

@@ -1,18 +1,6 @@
--- System seed data: built-in MCP server, system workflow configs, escalation chains.
--- Example workflow configs are seeded at runtime when examples: true.
-
--- ─── Built-in MCP server ───────────────────────────────────────────────────
-
-INSERT INTO lt_mcp_servers (name, description, transport_type, transport_config, auto_connect, status)
-VALUES (
-  'long-tail-db-query',
-  'Built-in read-only query server for tasks, escalations, processes, and system health',
-  'stdio',
-  '{"builtin": true}'::jsonb,
-  false,
-  'connected'
-)
-ON CONFLICT (name) DO NOTHING;
+-- System seed data: escalation chains.
+-- Workflow configs and MCP server definitions are seeded at startup
+-- via inline config on worker and factory declarations.
 
 -- ─── Escalation chains ─────────────────────────────────────────────────────
 
@@ -24,69 +12,3 @@ INSERT INTO lt_config_role_escalations (source_role, target_role) VALUES
   ('admin',     'engineer'),
   ('admin',     'superadmin')
 ON CONFLICT DO NOTHING;
-
--- ─── System workflow configs ────────────────────────────────────────────────
-
-INSERT INTO lt_config_workflows
-  (workflow_type, task_queue, default_role, invocable, description, tool_tags)
-VALUES
-  ('mcpQuery', 'long-tail-system', 'engineer', false,
-   'Dynamic MCP tool orchestration — LLM agentic loop with raw MCP tools',
-   '{}'),
-  ('mcpTriage', 'long-tail-system', 'engineer', false,
-   'Dynamic MCP triage — LLM agentic loop for escalation remediation',
-   '{}'),
-  ('mcpWorkflowBuilder', 'long-tail-system', 'engineer', false,
-   'Direct pipeline builder — LLM constructs DAG from tool schemas',
-   '{}'),
-  ('mcpWorkflowPlanner', 'long-tail-system', 'engineer', false,
-   'Plan mode — decomposes specifications into multi-workflow sets',
-   '{}')
-ON CONFLICT (workflow_type) DO NOTHING;
-
--- Query router (orchestrator entry point)
-INSERT INTO lt_config_workflows
-  (workflow_type, task_queue, default_role, invocable, description, tool_tags, envelope_schema)
-VALUES
-  ('mcpQueryRouter', 'long-tail-system', 'engineer', true,
-   'Do anything with tools — browser automation, file operations, HTTP requests, database queries, document processing, and more',
-   '{}',
-   '{"data": {"prompt": "Describe what you want to accomplish using available tools..."}, "metadata": {"source": "dashboard"}}'::jsonb)
-ON CONFLICT (workflow_type) DO NOTHING;
-
--- Deterministic execution (compiled YAML workflows)
-INSERT INTO lt_config_workflows
-  (workflow_type, task_queue, default_role, invocable, description, tool_tags)
-VALUES
-  ('mcpDeterministic', 'long-tail-system', 'engineer', false,
-   'Deterministic execution — invokes matched compiled YAML workflows with extracted inputs',
-   '{}')
-ON CONFLICT (workflow_type) DO NOTHING;
-
--- Triage router
-INSERT INTO lt_config_workflows
-  (workflow_type, task_queue, default_role, invocable, description, tool_tags)
-VALUES
-  ('mcpTriageRouter', 'long-tail-system', 'engineer', false,
-   'Triage router — discovers compiled workflows for remediation, routes to deterministic or dynamic triage',
-   '{}')
-ON CONFLICT (workflow_type) DO NOTHING;
-
--- Triage deterministic
-INSERT INTO lt_config_workflows
-  (workflow_type, task_queue, default_role, invocable, description, tool_tags)
-VALUES
-  ('mcpTriageDeterministic', 'long-tail-system', 'engineer', false,
-   'Deterministic triage — invokes matched compiled workflows for escalation remediation',
-   '{}')
-ON CONFLICT (workflow_type) DO NOTHING;
-
--- ─── Assign roles to all system workflows ──────────────────────────────────
-
-INSERT INTO lt_config_roles (workflow_type, role)
-SELECT wt, unnest(ARRAY['reviewer', 'engineer', 'admin'])
-FROM unnest(ARRAY[
-  'mcpQuery', 'mcpTriage', 'mcpWorkflowBuilder', 'mcpWorkflowPlanner',
-  'mcpQueryRouter', 'mcpDeterministic', 'mcpTriageRouter', 'mcpTriageDeterministic'
-]) AS wt
-ON CONFLICT (workflow_type, role) DO NOTHING;

package/build/lib/storage/mime.js

@@ -21,6 +21,26 @@ exports.MIME_TYPES = {
     '.yaml': 'text/yaml',
     '.yml': 'text/yaml',
     '.md': 'text/markdown',
+    '.ts': 'text/typescript',
+    '.tsx': 'text/typescript',
+    '.jsx': 'application/javascript',
+    '.sh': 'text/x-shellscript',
+    '.py': 'text/x-python',
+    '.rb': 'text/x-ruby',
+    '.go': 'text/x-go',
+    '.rs': 'text/x-rust',
+    '.java': 'text/x-java',
+    '.c': 'text/x-c',
+    '.cpp': 'text/x-c++',
+    '.h': 'text/x-c',
+    '.sql': 'text/x-sql',
+    '.toml': 'text/toml',
+    '.env': 'text/plain',
+    '.log': 'text/plain',
+    '.ini': 'text/plain',
+    '.cfg': 'text/plain',
+    '.conf': 'text/plain',
+    '.scss': 'text/css',
     '.zip': 'application/zip',
     '.gz': 'application/gzip',
 };

package/build/routes/file-browser.js

@@ -123,4 +123,34 @@ router.get('/download/{*filePath}', async (req, res) => {
         res.status(404).json({ error: 'File not found' });
     }
 });
+/**
+ * POST /api/file-browser/upload
+ * Upload a file to storage.
+ * Query: ?path=images/photo.png (target path including filename)
+ * Body: raw file bytes (Content-Type should match the file type)
+ */
+router.post('/upload', async (req, res) => {
+    const targetPath = req.query.path;
+    if (!targetPath) {
+        res.status(400).json({ error: 'path query parameter required (e.g., ?path=images/photo.png)' });
+        return;
+    }
+    // Collect raw body chunks
+    const chunks = [];
+    req.on('data', (chunk) => chunks.push(chunk));
+    req.on('end', async () => {
+        try {
+            const buffer = Buffer.concat(chunks);
+            if (buffer.length === 0) {
+                res.status(400).json({ error: 'Empty file body' });
+                return;
+            }
+            const result = await api.uploadFile({ path: targetPath, buffer });
+            res.status(result.status).json(result.data ?? { error: result.error });
+        }
+        catch (err) {
+            res.status(500).json({ error: err.message });
+        }
+    });
+});
 exports.default = router;

package/build/routes/files.js

@@ -11,8 +11,8 @@ const router = (0, express_1.Router)();
 /**
  * GET /api/files/*
  * Serve files from managed file storage.
- * Supports optional signed token (?token=<jwt>) for authenticated access
- * to locally-generated signed URLs.
+ * Requires a signed token (?token=<jwt>) for authenticated access.
+ * Use POST /api/file-browser/signed-url to generate a token.
  */
 router.get('/{*filePath}', async (req, res) => {
     const raw = req.params.filePath;
@@ -21,26 +21,28 @@ router.get('/{*filePath}', async (req, res) => {
         res.status(400).json({ error: 'File path required' });
         return;
     }
-    // Validate signed token if provided
+    // Require signed token — no unauthenticated file access
     const token = req.query.token;
-    if (token) {
-        const secret = process.env.JWT_SECRET;
-        if (!secret) {
-            res.status(500).json({ error: 'Server not configured for signed URLs' });
-            return;
-        }
-        try {
-            const decoded = jsonwebtoken_1.default.verify(token, secret);
-            if (decoded.purpose !== 'file-download' || decoded.filePath !== filePath.replace(/^\/+/, '')) {
-                res.status(403).json({ error: 'Token does not match requested file' });
-                return;
-            }
-        }
-        catch {
-            res.status(403).json({ error: 'Invalid or expired token' });
+    if (!token) {
+        res.status(401).json({ error: 'Signed token required. Use /api/file-browser/signed-url to generate one.' });
+        return;
+    }
+    const secret = process.env.JWT_SECRET;
+    if (!secret) {
+        res.status(500).json({ error: 'Server not configured for signed URLs' });
+        return;
+    }
+    try {
+        const decoded = jsonwebtoken_1.default.verify(token, secret);
+        if (decoded.purpose !== 'file-download' || decoded.filePath !== filePath.replace(/^\/+/, '')) {
+            res.status(403).json({ error: 'Token does not match requested file' });
             return;
         }
     }
+    catch {
+        res.status(403).json({ error: 'Invalid or expired token' });
+        return;
+    }
     try {
         const stream = await (0, storage_1.getStorageBackend)().createReadStream(filePath);
         const contentType = (0, mime_1.mimeFromPath)(filePath);

package/build/services/config/sql.d.ts

@@ -11,4 +11,7 @@ export declare const INSERT_CONFIG_ROLE = "INSERT INTO lt_config_roles (workflow
 export declare const DELETE_INVOCATION_ROLES = "DELETE FROM lt_config_invocation_roles WHERE workflow_type = $1";
 export declare const INSERT_INVOCATION_ROLE = "INSERT INTO lt_config_invocation_roles (workflow_type, role) VALUES ($1, $2)";
 export declare const DELETE_WORKFLOW = "DELETE FROM lt_config_workflows WHERE workflow_type = $1";
+export declare const SEED_WORKFLOW_CONFIG = "INSERT INTO lt_config_workflows\n  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as)\nVALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)\nON CONFLICT (workflow_type) DO NOTHING";
+export declare const SEED_CONFIG_ROLE = "INSERT INTO lt_config_roles (workflow_type, role) VALUES ($1, $2)\nON CONFLICT (workflow_type, role) DO NOTHING";
+export declare const SEED_INVOCATION_ROLE = "INSERT INTO lt_config_invocation_roles (workflow_type, role) VALUES ($1, $2)\nON CONFLICT (workflow_type, role) DO NOTHING";
 export declare const GET_PROVIDER_DATA = "SELECT workflow_type, data, completed_at\n  FROM lt_tasks\n WHERE origin_id = $1\n   AND workflow_type = ANY($2)\n   AND status = 'completed'\n ORDER BY completed_at DESC";

package/build/services/config/sql.js

@@ -3,7 +3,7 @@
 // Read queries                                                       //
 // ------------------------------------------------------------------ //
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GET_PROVIDER_DATA = exports.DELETE_WORKFLOW = exports.INSERT_INVOCATION_ROLE = exports.DELETE_INVOCATION_ROLES = exports.INSERT_CONFIG_ROLE = exports.DELETE_CONFIG_ROLES = exports.UPSERT_WORKFLOW = exports.ENSURE_ROLE_EXISTS = exports.LIST_ALL_INVOCATION_ROLES = exports.LIST_ALL_ROLES = exports.LIST_ALL_WORKFLOWS = exports.GET_WORKFLOW_INVOCATION_ROLES = exports.GET_WORKFLOW_ROLES = exports.GET_WORKFLOW = void 0;
+exports.GET_PROVIDER_DATA = exports.SEED_INVOCATION_ROLE = exports.SEED_CONFIG_ROLE = exports.SEED_WORKFLOW_CONFIG = exports.DELETE_WORKFLOW = exports.INSERT_INVOCATION_ROLE = exports.DELETE_INVOCATION_ROLES = exports.INSERT_CONFIG_ROLE = exports.DELETE_CONFIG_ROLES = exports.UPSERT_WORKFLOW = exports.ENSURE_ROLE_EXISTS = exports.LIST_ALL_INVOCATION_ROLES = exports.LIST_ALL_ROLES = exports.LIST_ALL_WORKFLOWS = exports.GET_WORKFLOW_INVOCATION_ROLES = exports.GET_WORKFLOW_ROLES = exports.GET_WORKFLOW = void 0;
 exports.GET_WORKFLOW = `\
 SELECT * FROM lt_config_workflows WHERE workflow_type = $1`;
 exports.GET_WORKFLOW_ROLES = `\
@@ -47,6 +47,20 @@ INSERT INTO lt_config_invocation_roles (workflow_type, role) VALUES ($1, $2)`;
 exports.DELETE_WORKFLOW = `\
 DELETE FROM lt_config_workflows WHERE workflow_type = $1`;
 // ------------------------------------------------------------------ //
+// Seed (insert-if-absent — used at startup, DB is source of truth)   //
+// ------------------------------------------------------------------ //
+exports.SEED_WORKFLOW_CONFIG = `\
+INSERT INTO lt_config_workflows
+  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)
+ON CONFLICT (workflow_type) DO NOTHING`;
+exports.SEED_CONFIG_ROLE = `\
+INSERT INTO lt_config_roles (workflow_type, role) VALUES ($1, $2)
+ON CONFLICT (workflow_type, role) DO NOTHING`;
+exports.SEED_INVOCATION_ROLE = `\
+INSERT INTO lt_config_invocation_roles (workflow_type, role) VALUES ($1, $2)
+ON CONFLICT (workflow_type, role) DO NOTHING`;
+// ------------------------------------------------------------------ //
 // Provider queries                                                   //
 // ------------------------------------------------------------------ //
 exports.GET_PROVIDER_DATA = `\

package/build/services/config/write.d.ts

@@ -3,3 +3,9 @@ export declare function upsertWorkflowConfig(config: LTWorkflowConfig & {
     lifecycle?: any;
 }): Promise<LTWorkflowConfig>;
 export declare function deleteWorkflowConfig(workflowType: string): Promise<boolean>;
+/**
+ * Seed a workflow config at startup (insert-if-absent).
+ * DB is the source of truth — if the row already exists, log drift warnings
+ * but do not overwrite. Returns true if inserted, false if already existed.
+ */
+export declare function seedWorkflowConfig(config: LTWorkflowConfig): Promise<boolean>;

package/build/services/config/write.js

@@ -2,8 +2,10 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.upsertWorkflowConfig = upsertWorkflowConfig;
 exports.deleteWorkflowConfig = deleteWorkflowConfig;
+exports.seedWorkflowConfig = seedWorkflowConfig;
 const db_1 = require("../../lib/db");
 const read_1 = require("./read");
+const logger_1 = require("../../lib/logger");
 const sql_1 = require("./sql");
 async function upsertWorkflowConfig(config) {
     const pool = (0, db_1.getPool)();
@@ -59,3 +61,65 @@ async function deleteWorkflowConfig(workflowType) {
     const { rowCount } = await pool.query(sql_1.DELETE_WORKFLOW, [workflowType]);
     return (rowCount ?? 0) > 0;
 }
+/**
+ * Seed a workflow config at startup (insert-if-absent).
+ * DB is the source of truth — if the row already exists, log drift warnings
+ * but do not overwrite. Returns true if inserted, false if already existed.
+ */
+async function seedWorkflowConfig(config) {
+    const pool = (0, db_1.getPool)();
+    // Ensure referenced roles exist
+    const allRoles = new Set([
+        config.default_role,
+        ...config.roles,
+        ...config.invocation_roles,
+    ]);
+    for (const role of allRoles) {
+        await pool.query(sql_1.ENSURE_ROLE_EXISTS, [role]);
+    }
+    // Insert-if-absent
+    const { rowCount } = await pool.query(sql_1.SEED_WORKFLOW_CONFIG, [
+        config.workflow_type,
+        config.invocable,
+        config.task_queue,
+        config.default_role,
+        config.description,
+        config.consumes,
+        config.envelope_schema ?? null,
+        config.resolver_schema ?? null,
+        config.cron_schedule ?? null,
+        config.tool_tags || [],
+        config.execute_as ?? null,
+    ]);
+    const inserted = (rowCount ?? 0) > 0;
+    if (inserted) {
+        // Seed roles (also insert-if-absent)
+        for (const role of config.roles) {
+            await pool.query(sql_1.SEED_CONFIG_ROLE, [config.workflow_type, role]);
+        }
+        for (const role of config.invocation_roles) {
+            await pool.query(sql_1.SEED_INVOCATION_ROLE, [config.workflow_type, role]);
+        }
+    }
+    else {
+        // Drift detection — compare key fields
+        const existing = await (0, read_1.getWorkflowConfig)(config.workflow_type);
+        if (existing) {
+            const drifts = [];
+            if (config.description && existing.description !== config.description)
+                drifts.push('description');
+            if (config.invocable !== existing.invocable)
+                drifts.push('invocable');
+            if (config.default_role !== existing.default_role)
+                drifts.push('default_role');
+            if (JSON.stringify(config.envelope_schema) !== JSON.stringify(existing.envelope_schema))
+                drifts.push('envelope_schema');
+            if (JSON.stringify(config.resolver_schema) !== JSON.stringify(existing.resolver_schema))
+                drifts.push('resolver_schema');
+            if (drifts.length) {
+                logger_1.loggerRegistry.warn(`[long-tail] config drift: ${config.workflow_type} — ${drifts.join(', ')} differ between code and DB`);
+            }
+        }
+    }
+    return inserted;
+}

package/build/services/cron/index.d.ts

@@ -1,5 +1,10 @@
 import type { LTWorkflowConfig } from '../../types';
 import type { LTYamlWorkflowRecord } from '../../types/yaml-workflow';
+/**
+ * Validate a cron expression and enforce a minimum interval.
+ * Throws if the expression is invalid or fires more often than once per minute.
+ */
+export declare function validateCronSchedule(expr: string): void;
 /**
  * Singleton registry for workflow cron schedules.
  *

package/build/services/cron/index.js

@@ -34,12 +34,34 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.cronRegistry = void 0;
+exports.validateCronSchedule = validateCronSchedule;
 const hotmesh_1 = require("@hotmeshio/hotmesh");
+const cron_parser_1 = require("cron-parser");
 const db_1 = require("../../lib/db");
 const defaults_1 = require("../../modules/defaults");
 const logger_1 = require("../../lib/logger");
 const configService = __importStar(require("../config"));
 const principal_1 = require("../iam/principal");
+const MIN_CRON_INTERVAL_MS = 60_000; // 1 minute minimum
+/**
+ * Validate a cron expression and enforce a minimum interval.
+ * Throws if the expression is invalid or fires more often than once per minute.
+ */
+function validateCronSchedule(expr) {
+    let interval;
+    try {
+        interval = (0, cron_parser_1.parseExpression)(expr, { utc: true });
+    }
+    catch {
+        throw new Error(`Invalid cron expression: "${expr}"`);
+    }
+    const first = interval.next().toDate().getTime();
+    const second = interval.next().toDate().getTime();
+    const gap = second - first;
+    if (gap < MIN_CRON_INTERVAL_MS) {
+        throw new Error(`Cron interval too frequent: "${expr}" fires every ${Math.round(gap / 1000)}s (minimum is 60s)`);
+    }
+}
 const CRON_TOPIC_PREFIX = 'lt.cron';
 const CRON_ID_PREFIX = 'lt-cron';
 const YAML_CRON_TOPIC_PREFIX = 'lt.cron.yaml';
@@ -86,6 +108,7 @@ class LTCronRegistry {
     async startCron(config) {
         if (!config.cron_schedule || !config.task_queue)
             return;
+        validateCronSchedule(config.cron_schedule);
         const connection = (0, db_1.getConnection)();
         const topic = `${CRON_TOPIC_PREFIX}.${config.workflow_type}`;
         const cronId = `${CRON_ID_PREFIX}-${config.workflow_type}`;
@@ -96,6 +119,11 @@ class LTCronRegistry {
         if (!defaultEnvelope.metadata)
             defaultEnvelope.metadata = {};
         defaultEnvelope.metadata.source = 'cron';
+        // Auto-certify if the workflow config has roles or consumes
+        const isCertified = (config.roles?.length ?? 0) > 0 || (config.consumes?.length ?? 0) > 0;
+        if (isCertified) {
+            defaultEnvelope.metadata.certified = true;
+        }
         // Resolve executing principal: per-config execute_as, or system bot fallback
         if (!defaultEnvelope.lt)
             defaultEnvelope.lt = {};
@@ -129,6 +157,7 @@ class LTCronRegistry {
                         workflowId,
                         expire: defaults_1.JOB_EXPIRE_SECS,
                         entity: workflowType,
+                        signalIn: false,
                     });
                 }
                 catch (err) {
@@ -195,6 +224,7 @@ class LTCronRegistry {
     async startYamlCron(wf) {
         if (!wf.cron_schedule)
             return;
+        validateCronSchedule(wf.cron_schedule);
         const connection = (0, db_1.getConnection)();
         const topic = `${YAML_CRON_TOPIC_PREFIX}.${wf.id}`;
         const cronId = `${YAML_CRON_ID_PREFIX}-${wf.id}`;

package/build/services/insight/index.js

@@ -34,6 +34,7 @@ async function startMcpQuery(input) {
         workflowId,
         expire: defaults_1.JOB_EXPIRE_SECS,
         entity,
+        signalIn: false,
     });
     if (wait === false) {
         return { workflow_id: workflowId, status: 'started', prompt };
@@ -63,6 +64,7 @@ async function startWorkflowBuilder(input) {
         workflowId,
         expire: defaults_1.JOB_EXPIRE_SECS,
         entity: 'mcpWorkflowBuilder',
+        signalIn: false,
     });
     if (wait === false) {
         return { workflow_id: workflowId, status: 'started', prompt };
@@ -92,6 +94,7 @@ async function startWorkflowPlanner(input) {
         workflowId,
         expire: defaults_1.JOB_EXPIRE_SECS,
         entity: 'mcpWorkflowPlanner',
+        signalIn: false,
     });
     if (wait === false) {
         return { workflow_id: workflowId, status: 'started', prompt: specification.slice(0, 200) };

package/build/services/interceptor/activities/task.d.ts

@@ -18,6 +18,7 @@ export declare function ltCreateTask(input: {
     initiatedBy?: string;
     principalType?: string;
     executingAs?: string;
+    status?: string;
 }): Promise<string>;
 /**
  * Mark a task as in_progress.

package/build/services/interceptor/activities/task.js

@@ -79,6 +79,7 @@ async function ltCreateTask(input) {
         initiated_by: initiatedByUuid,
         principal_type: input.principalType,
         executing_as: input.executingAs,
+        status: input.status,
     });
     (0, publish_1.publishTaskEvent)({
         type: 'task.created',
@@ -88,7 +89,7 @@ async function ltCreateTask(input) {
         taskQueue: input.taskQueue || 'unknown',
         taskId: task.id,
         originId: input.originId,
-        status: 'pending',
+        status: input.status || 'pending',
     });
     return task.id;
 }

package/build/services/interceptor/activities/workflow.js

@@ -35,6 +35,7 @@ async function ltStartWorkflow(input) {
         taskQueue: input.taskQueue,
         workflowId: input.workflowId,
         expire: input.expire ?? defaults_1.JOB_EXPIRE_SECS,
+        signalIn: false,
     });
     logger_1.loggerRegistry.info(`[ltStartWorkflow] started ${input.workflowName} (${input.workflowId})`);
 }

package/build/services/interceptor/index.js

@@ -99,10 +99,10 @@ function createLTInterceptor(options) {
                 retry: { maximumAttempts: 3 },
             });
             const envelope = (0, state_1.extractEnvelope)(ctx);
-            // 2. Fast path: envelope.metadata.certified === false skips the DB
-            //    lookup entirely. Use this for configured (non-certified) workflows
-            //    that manage their own escalation lifecycle via conditionLT.
-            if (envelope?.metadata?.certified === false) {
+            // 2. Fast path: certification is opt-in. Only workflows with
+            //    metadata.certified === true pay for the config lookup,
+            //    task creation, and escalation wiring.
+            if (envelope?.metadata?.certified !== true) {
                 const toolCtx = (0, envelope_1.buildToolContextFromEnvelope)(envelope, wf.workflowId, wf.workflowTrace, wf.workflowSpan);
                 return toolCtx ? (0, context_2.runWithToolContext)(toolCtx, next) : next();
             }

package/build/services/interceptor/lifecycle.js

@@ -120,8 +120,8 @@ async function ensureTaskWithRouting(activities, wf, envelope, existingTask, tas
             spanId: wf.workflowSpan,
             initiatedBy: envelope?.lt?.initiatedBy ?? envelope?.lt?.userId,
             executingAs: envelope?.lt?.initiatedBy ? envelope?.lt?.userId : undefined,
+            status: 'in_progress',
         });
-        await activities.ltStartTask(taskId);
     }
     else if (existingTask?.status === 'pending') {
         await activities.ltStartTask(taskId);

package/build/services/mcp/db.d.ts

@@ -24,3 +24,20 @@ export declare function getAutoConnectServers(): Promise<LTMcpServerRecord[]>;
  * @param match - 'any' (OR — server has at least one tag) or 'all' (AND — server has all tags)
  */
 export declare function findServersByTags(tags: string[], match?: 'any' | 'all'): Promise<LTMcpServerRecord[]>;
+/**
+ * Seed an MCP server at startup (insert-if-absent).
+ * DB is the source of truth — if the row already exists, log drift warnings
+ * but do not overwrite. Returns true if inserted, false if already existed.
+ */
+export declare function seedMcpServer(input: {
+    name: string;
+    description?: string;
+    tags?: string[];
+    compileHints?: string;
+    credentialProviders?: string[];
+    toolManifest?: any[];
+}): Promise<boolean>;
+/**
+ * Remove builtin MCP servers that are no longer declared in factory config.
+ */
+export declare function cleanStaleBuiltinServers(activeNames: string[]): Promise<void>;