@hotmeshio/long-tail 0.1.7 → 0.1.9

package/build/services/interceptor/index.js

@@ -98,14 +98,20 @@ function createLTInterceptor(options) {
                 taskQueue: activityTaskQueue,
                 retry: { maximumAttempts: 3 },
             });
-            // 2. Load config — unregistered workflows still get ToolContext
+            const envelope = (0, state_1.extractEnvelope)(ctx);
+            // 2. Fast path: envelope.metadata.certified === false skips the DB
+            //    lookup entirely. Use this for configured (non-certified) workflows
+            //    that manage their own escalation lifecycle via conditionLT.
+            if (envelope?.metadata?.certified === false) {
+                const toolCtx = (0, envelope_1.buildToolContextFromEnvelope)(envelope, wf.workflowId, wf.workflowTrace, wf.workflowSpan);
+                return toolCtx ? (0, context_2.runWithToolContext)(toolCtx, next) : next();
+            }
+            // 3. Load config — unregistered/uncertified workflows get ToolContext only
             const wfConfig = await activities.ltGetWorkflowConfig(wf.workflowName);
             if (!wfConfig) {
-                const envelope = (0, state_1.extractEnvelope)(ctx);
                 const toolCtx = (0, envelope_1.buildToolContextFromEnvelope)(envelope, wf.workflowId, wf.workflowTrace, wf.workflowSpan);
                 return toolCtx ? (0, context_2.runWithToolContext)(toolCtx, next) : next();
             }
-            const envelope = (0, state_1.extractEnvelope)(ctx);
             const taskQueue = (0, lifecycle_1.deriveTaskQueue)(wf);
             // 3. Find existing task and handle re-run escalation resolution
             const existingTask = await activities.ltGetTaskByWorkflowId(wf.workflowId);

package/build/services/orchestrator/condition.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Wait for a signal and resolve the associated escalation automatically.
+ *
+ * Wraps `Durable.workflow.condition()` with escalation lifecycle:
+ * when the signal arrives (from the dashboard resolve endpoint),
+ * the payload includes an injected `$escalation_id` field. This
+ * helper strips it, calls `ltResolveEscalation` as a durable
+ * activity, and returns the clean resolver payload.
+ *
+ * Usage (from within a workflow):
+ * ```typescript
+ * import { conditionLT } from '@hotmeshio/long-tail';
+ *
+ * export async function myWorkflow(envelope: LTEnvelope) {
+ *   // Create an escalation with signal_id in metadata
+ *   const signalId = `approval-${Durable.workflow.workflowId}`;
+ *   await activities.ltCreateEscalation({
+ *     type: 'approval',
+ *     role: 'reviewer',
+ *     metadata: { signal_id: signalId },
+ *     // ...
+ *   });
+ *
+ *   // Wait — the dashboard signals on resolve
+ *   const decision = await conditionLT<{ approved: boolean }>(signalId);
+ *   // decision.approved is clean — no $escalation_id
+ * }
+ * ```
+ *
+ * If the signal payload does not contain `$escalation_id` (e.g., signaled
+ * manually), the function returns the payload as-is without calling
+ * the resolve activity.
+ */
+export declare function conditionLT<T = Record<string, any>>(signalId: string): Promise<T>;

package/build/services/orchestrator/condition.js

@@ -0,0 +1,92 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.conditionLT = conditionLT;
+const hotmesh_1 = require("@hotmeshio/hotmesh");
+const interceptorActivities = __importStar(require("../interceptor/activities"));
+const LT_ACTIVITY_QUEUE = 'lt-interceptor';
+/**
+ * Wait for a signal and resolve the associated escalation automatically.
+ *
+ * Wraps `Durable.workflow.condition()` with escalation lifecycle:
+ * when the signal arrives (from the dashboard resolve endpoint),
+ * the payload includes an injected `$escalation_id` field. This
+ * helper strips it, calls `ltResolveEscalation` as a durable
+ * activity, and returns the clean resolver payload.
+ *
+ * Usage (from within a workflow):
+ * ```typescript
+ * import { conditionLT } from '@hotmeshio/long-tail';
+ *
+ * export async function myWorkflow(envelope: LTEnvelope) {
+ *   // Create an escalation with signal_id in metadata
+ *   const signalId = `approval-${Durable.workflow.workflowId}`;
+ *   await activities.ltCreateEscalation({
+ *     type: 'approval',
+ *     role: 'reviewer',
+ *     metadata: { signal_id: signalId },
+ *     // ...
+ *   });
+ *
+ *   // Wait — the dashboard signals on resolve
+ *   const decision = await conditionLT<{ approved: boolean }>(signalId);
+ *   // decision.approved is clean — no $escalation_id
+ * }
+ * ```
+ *
+ * If the signal payload does not contain `$escalation_id` (e.g., signaled
+ * manually), the function returns the payload as-is without calling
+ * the resolve activity.
+ */
+async function conditionLT(signalId) {
+    const raw = await hotmesh_1.Durable.workflow.condition(signalId);
+    const escalationId = raw.$escalation_id;
+    if (escalationId) {
+        // Resolve the escalation as a durable activity (crash-safe)
+        const { ltResolveEscalation } = hotmesh_1.Durable.workflow.proxyActivities({
+            activities: interceptorActivities,
+            taskQueue: LT_ACTIVITY_QUEUE,
+            retry: { maximumAttempts: 3 },
+        });
+        // Strip $escalation_id before passing as resolver payload
+        const { $escalation_id: _, ...resolverPayload } = raw;
+        await ltResolveEscalation({
+            escalationId,
+            resolverPayload: resolverPayload,
+        });
+        return resolverPayload;
+    }
+    return raw;
+}

package/build/services/workflow-invocation.d.ts

@@ -21,6 +21,16 @@ export interface InvokeWorkflowInput {
     metadata?: Record<string, any>;
     /** Per-request execute_as override (admin-only). */
     executeAs?: string;
+    /**
+     * Passthrough options forwarded to `Durable.Client.workflow.start()`.
+     * Any WorkflowOptions field (workflowId, expire, entity, namespace,
+     * search, signalIn, pending, etc.) can be set here. The service
+     * applies defaults for workflowId, expire, entity, taskQueue, and
+     * workflowName when not provided.
+     *
+     * @see https://docs.hotmesh.io/types/types_durable.WorkflowOptions.html
+     */
+    options?: Record<string, any>;
     auth: InvocationAuthContext;
 }
 export interface InvokeWorkflowResult {
@@ -33,8 +43,11 @@ export declare class InvocationError extends Error {
 /**
  * Start a workflow by its registered type.
  *
- * Validates config, roles, scopes, resolves principals, builds the
- * LTEnvelope, and starts the workflow via the Durable client.
+ * Thin proxy over `Durable.Client.workflow.start()` — callers have
+ * access to the full option set (workflowId, expire, entity) with
+ * sensible defaults when omitted. The service resolves the task queue,
+ * enforces auth/scope constraints, builds the LTEnvelope with IAM
+ * context, and delegates to the Durable client.
  *
  * Throws `InvocationError` with an appropriate status code on failure.
  */
@@ -43,4 +56,4 @@ export declare function invokeWorkflow(input: InvokeWorkflowInput): Promise<Invo
  * Check invocation_roles when present on a workflow config.
  * Throws InvocationError if the user lacks the required role.
  */
-export declare function checkInvocationRoles(workflowType: string, userId: string): Promise<void>;
+export declare function checkInvocationRoles(workflowType: string, userId: string, authRole?: string): Promise<void>;

package/build/services/workflow-invocation.js

@@ -65,8 +65,11 @@ exports.InvocationError = InvocationError;
 /**
  * Start a workflow by its registered type.
  *
- * Validates config, roles, scopes, resolves principals, builds the
- * LTEnvelope, and starts the workflow via the Durable client.
+ * Thin proxy over `Durable.Client.workflow.start()` — callers have
+ * access to the full option set (workflowId, expire, entity) with
+ * sensible defaults when omitted. The service resolves the task queue,
+ * enforces auth/scope constraints, builds the LTEnvelope with IAM
+ * context, and delegates to the Durable client.
  *
  * Throws `InvocationError` with an appropriate status code on failure.
  */
@@ -89,16 +92,18 @@ async function invokeWorkflow(input) {
     // 4. Resolve principals and build envelope
     const wfConfig = await configService.getWorkflowConfig(workflowType);
     const envelope = await buildEnvelope(data, metadata ?? {}, auth.userId, executeAsOverride, wfConfig?.execute_as ?? undefined);
-    // 5. Start workflow
+    // 5. Start workflow — caller options pass through to Durable client
     const client = (0, workers_1.createClient)();
-    const workflowId = `${workflowType}-${hotmesh_1.Durable.guid()}`;
+    const callerOpts = input.options ?? {};
+    const workflowId = callerOpts.workflowId || `${workflowType}-${hotmesh_1.Durable.guid()}`;
     await client.workflow.start({
+        ...callerOpts,
         args: [envelope],
         taskQueue,
         workflowName: workflowType,
         workflowId,
-        expire: defaults_1.JOB_EXPIRE_SECS,
-        entity: workflowType,
+        expire: callerOpts.expire ?? defaults_1.JOB_EXPIRE_SECS,
+        entity: callerOpts.entity ?? workflowType,
     });
     return { workflowId };
 }
@@ -129,10 +134,13 @@ async function resolveTaskQueue(workflowType) {
  * Check invocation_roles when present on a workflow config.
  * Throws InvocationError if the user lacks the required role.
  */
-async function checkInvocationRoles(workflowType, userId) {
+async function checkInvocationRoles(workflowType, userId, authRole) {
     const wfConfig = await configService.getWorkflowConfig(workflowType);
     if (!wfConfig || wfConfig.invocation_roles.length === 0)
         return;
+    // Superadmin from JWT bypasses all invocation role checks
+    if (authRole === 'superadmin')
+        return;
     const user = await userService.getUserByExternalId(userId);
     if (!user) {
         throw new InvocationError('User not registered', 403);

package/build/start/index.d.ts

@@ -6,6 +6,7 @@ import type { LTStartConfig, LTInstance } from '../types/startup';
  * worker startup, and the embedded API server. Returns a client
  * for starting workflows and a shutdown function.
  *
+ * @example Standard worker
  * ```typescript
  * import { start } from '@hotmeshio/long-tail';
  * import * as myWorkflow from './workflows/my-workflow';
@@ -17,5 +18,28 @@ import type { LTStartConfig, LTInstance } from '../types/startup';
  *   ],
  * });
  * ```
+ *
+ * @example Dashboard for a remote system
+ *
+ * Point at another system's Postgres database and register its workflows
+ * by name with `readonly` connections. The dashboard discovers and displays
+ * them, and invocations are picked up by the real workers in the other system.
+ *
+ * ```typescript
+ * import { start } from '@hotmeshio/long-tail';
+ *
+ * const lt = await start({
+ *   database: { connectionString: 'postgres://shared-db:5432/other-system' },
+ *   workers: [
+ *     { taskQueue: 'ingest', workflow: 'orderPipeline', connection: { readonly: true } },
+ *     { taskQueue: 'ingest', workflow: 'invoiceReconciler', connection: { readonly: true } },
+ *     { taskQueue: 'billing', workflow: 'paymentProcessor', connection: { readonly: true } },
+ *   ],
+ *   server: { port: 4000 },
+ * });
+ *
+ * // Workflows appear in the dashboard UI — invoke, audit, and view executions
+ * // without competing for work. The real workers handle execution.
+ * ```
  */
 export declare function start(startConfig: LTStartConfig): Promise<LTInstance>;

package/build/start/index.js

@@ -21,6 +21,7 @@ const socketio_1 = require("../lib/events/socketio");
  * worker startup, and the embedded API server. Returns a client
  * for starting workflows and a shutdown function.
  *
+ * @example Standard worker
  * ```typescript
  * import { start } from '@hotmeshio/long-tail';
  * import * as myWorkflow from './workflows/my-workflow';
@@ -32,6 +33,29 @@ const socketio_1 = require("../lib/events/socketio");
  *   ],
  * });
  * ```
+ *
+ * @example Dashboard for a remote system
+ *
+ * Point at another system's Postgres database and register its workflows
+ * by name with `readonly` connections. The dashboard discovers and displays
+ * them, and invocations are picked up by the real workers in the other system.
+ *
+ * ```typescript
+ * import { start } from '@hotmeshio/long-tail';
+ *
+ * const lt = await start({
+ *   database: { connectionString: 'postgres://shared-db:5432/other-system' },
+ *   workers: [
+ *     { taskQueue: 'ingest', workflow: 'orderPipeline', connection: { readonly: true } },
+ *     { taskQueue: 'ingest', workflow: 'invoiceReconciler', connection: { readonly: true } },
+ *     { taskQueue: 'billing', workflow: 'paymentProcessor', connection: { readonly: true } },
+ *   ],
+ *   server: { port: 4000 },
+ * });
+ *
+ * // Workflows appear in the dashboard UI — invoke, audit, and view executions
+ * // without competing for work. The real workers handle execution.
+ * ```
  */
 async function start(startConfig) {
     // 1. Apply database config

package/build/start/workers.d.ts

@@ -2,19 +2,17 @@ import type { LTStartConfig } from '../types/startup';
 type WorkerEntry = {
     taskQueue: string;
     workflow: (...args: any[]) => any;
+    connection?: {
+        readonly?: boolean;
+        retry?: Record<string, unknown>;
+    };
 };
 /**
  * Build the connection descriptor used by HotMesh / Durable.
  */
 export declare function buildConnection(): {
-    class: typeof import("pg").Client;
-    options: {
-        host: string;
-        port: number;
-        user: string;
-        password: string;
-        database: string;
-    };
+    class: unknown;
+    options: Record<string, unknown>;
 };
 /**
  * Collect all workers: system, optional examples, and user-provided.

package/build/start/workers.js

@@ -48,6 +48,18 @@ const cron_1 = require("../services/cron");
 const mcp_1 = require("../services/mcp");
 const yamlWorkflowWorkers = __importStar(require("../services/yaml-workflow/workers"));
 const migrate_1 = require("../lib/db/migrate");
+/**
+ * Create a named no-op workflow function for readonly/observer workers.
+ * The function name is used by `registerWorker` for discovery.
+ */
+function createNoOpWorkflow(name) {
+    const container = {
+        [name](..._args) {
+            /* readonly no-op */
+        },
+    };
+    return container[name];
+}
 /**
  * Build the connection descriptor used by HotMesh / Durable.
  */
@@ -59,9 +71,20 @@ function buildConnection() {
  */
 async function collectWorkers(startConfig) {
     const { getSystemWorkers, builtinMcpServerFactories } = await Promise.resolve().then(() => __importStar(require('../system')));
+    // Normalize user workers: string workflows become named no-ops (readonly only)
+    const userWorkers = (startConfig.workers ?? []).map((w) => {
+        if (typeof w.workflow === 'string') {
+            if (!w.connection?.readonly) {
+                throw new Error(`Worker "${w.workflow}" on queue "${w.taskQueue}": ` +
+                    'string workflow names require connection.readonly = true');
+            }
+            return { ...w, workflow: createNoOpWorkflow(w.workflow) };
+        }
+        return w;
+    });
     const workers = [
         ...getSystemWorkers(),
-        ...(startConfig.workers ?? []),
+        ...userWorkers,
     ];
     logger_1.loggerRegistry.info('[long-tail] system workflows loaded');
     if (startConfig.examples) {
@@ -93,7 +116,7 @@ async function startWorkers(startConfig, workers, builtinMcpServerFactories) {
         for (const w of workers) {
             const label = `${w.taskQueue}::${w.workflow.name}`;
             const worker = await hotmesh_1.Durable.Worker.create({
-                connection,
+                connection: w.connection ? { ...connection, ...w.connection } : connection,
                 taskQueue: w.taskQueue,
                 workflow: w.workflow,
                 guid: `${label}-${hotmesh_1.Durable.guid()}`,

package/build/system/mcp-servers/admin/workflows.js

@@ -62,9 +62,14 @@ function registerWorkflowTools(server) {
             .map((wt) => {
             const config = configMap.get(wt);
             const worker = activeWorkers.get(wt);
+            const hasCertification = !!(config &&
+                ((config.roles?.length ?? 0) > 0 ||
+                    (config.consumes?.length ?? 0) > 0));
+            const tier = !config ? 'durable' : hasCertification ? 'certified' : 'configured';
             return {
                 workflow_type: wt,
                 task_queue: config?.task_queue ?? worker?.taskQueue ?? null,
+                tier,
                 registered: !!config,
                 active: !!worker,
                 invocable: config?.invocable ?? false,

package/build/tsconfig.tsbuildinfo

@@ -1 +1 @@
-{"root":["../index.ts","../vitest.config.ts","../vitest.integration.config.ts","../api/auth.ts","../api/bot-accounts.ts","../api/controlplane.ts","../api/dba.ts","../api/escalations.ts","../api/exports.ts","../api/index.ts","../api/insight.ts","../api/maintenance.ts","../api/mcp-runs.ts","../api/mcp.ts","../api/namespaces.ts","../api/roles.ts","../api/settings.ts","../api/tasks.ts","../api/users.ts","../api/workflow-sets.ts","../api/workflows.ts","../api/yaml-workflows.ts","../examples/index.ts","../examples/seed.ts","../examples/workers.ts","../examples/external-mcp-server/server.ts","../examples/types/envelopes.ts","../examples/types/index.ts","../examples/types/resolvers.ts","../examples/workflows/basic-echo/activities.ts","../examples/workflows/basic-echo/index.ts","../examples/workflows/kitchen-sink/activities.ts","../examples/workflows/kitchen-sink/index.ts","../examples/workflows/review-content/activities.ts","../examples/workflows/review-content/index.ts","../examples/workflows/review-content/types.ts","../lib/db/index.ts","../lib/db/migrate.ts","../lib/events/callback.ts","../lib/events/index.ts","../lib/events/memory.ts","../lib/events/nats.ts","../lib/events/publish.ts","../lib/events/socketio.ts","../lib/logger/index.ts","../lib/logger/pino.ts","../lib/storage/index.ts","../lib/storage/local.ts","../lib/storage/s3.ts","../lib/storage/types.ts","../lib/telemetry/honeycomb.ts","../lib/telemetry/index.ts","../modules/auth.ts","../modules/config.ts","../modules/defaults.ts","../modules/ltconfig.ts","../modules/maintenance.ts","../routes/auth.ts","../routes/bot-accounts.ts","../routes/controlplane.ts","../routes/dba.ts","../routes/delegation.ts","../routes/docs.ts","../routes/exports.ts","../routes/files.ts","../routes/index.ts","../routes/insight.ts","../routes/maintenance.ts","../routes/mcp-runs.ts","../routes/mcp.ts","../routes/namespaces.ts","../routes/oauth.ts","../routes/roles.ts","../routes/settings.ts","../routes/tasks.ts","../routes/users.ts","../routes/workflow-sets.ts","../routes/escalations/bulk.ts","../routes/escalations/index.ts","../routes/escalations/list.ts","../routes/escalations/resolve.ts","../routes/escalations/single.ts","../routes/workflows/config.ts","../routes/workflows/discovery.ts","../routes/workflows/index.ts","../routes/workflows/invocation.ts","../routes/yaml-workflows/cron.ts","../routes/yaml-workflows/crud.ts","../routes/yaml-workflows/deployment.ts","../routes/yaml-workflows/index.ts","../routes/yaml-workflows/versions.ts","../scripts/process-helpers.ts","../scripts/process.ts","../scripts/token.ts","../sdk/index.ts","../services/dba.ts","../services/hotmesh-utils.ts","../services/workflow-invocation.ts","../services/auth/bot-api-key.ts","../services/auth/delegation.ts","../services/auth/index.ts","../services/auth/service-token.ts","../services/config/cache.ts","../services/config/index.ts","../services/config/provider.ts","../services/config/read.ts","../services/config/sql.ts","../services/config/write.ts","../services/controlplane/index.ts","../services/controlplane/quorum-bridge.ts","../services/controlplane/sql.ts","../services/controlplane/types.ts","../services/cron/index.ts","../services/escalation/bulk.ts","../services/escalation/crud.ts","../services/escalation/index.ts","../services/escalation/queries.ts","../services/escalation/sql.ts","../services/escalation/types.ts","../services/escalation-strategy/default.ts","../services/escalation-strategy/index.ts","../services/escalation-strategy/mcp.ts","../services/export/client.ts","../services/export/index.ts","../services/export/post-process.ts","../services/export/types.ts","../services/iam/activity.ts","../services/iam/bots.ts","../services/iam/context.ts","../services/iam/credentials.ts","../services/iam/envelope.ts","../services/iam/ephemeral.ts","../services/iam/index.ts","../services/iam/principal.ts","../services/iam/resolve.ts","../services/iam/sql.ts","../services/insight/index.ts","../services/insight/prompts.ts","../services/interceptor/activity-interceptor.ts","../services/interceptor/completion.ts","../services/interceptor/context.ts","../services/interceptor/escalation.ts","../services/interceptor/index.ts","../services/interceptor/lifecycle.ts","../services/interceptor/state.ts","../services/interceptor/types.ts","../services/interceptor/activities/config.ts","../services/interceptor/activities/escalation.ts","../services/interceptor/activities/index.ts","../services/interceptor/activities/task.ts","../services/interceptor/activities/workflow.ts","../services/llm/detect.ts","../services/llm/index.ts","../services/llm/translate.ts","../services/llm/types.ts","../services/llm/providers/anthropic.ts","../services/llm/providers/openai.ts","../services/maintenance/index.ts","../services/mcp/adapter.ts","../services/mcp/db.ts","../services/mcp/index.ts","../services/mcp/register-tool.ts","../services/mcp/server.ts","../services/mcp/sql.ts","../services/mcp/types.ts","../services/mcp/workflow-compiler-server.ts","../services/mcp/workflow-server.ts","../services/mcp/client/connection.ts","../services/mcp/client/index.ts","../services/mcp/client/tools.ts","../services/mcp/db-server/index.ts","../services/mcp/db-server/schemas.ts","../services/mcp/db-server/tools.ts","../services/mcp/playwright-server/index.ts","../services/mcp/playwright-server/lifecycle.ts","../services/mcp/playwright-server/schemas.ts","../services/mcp/playwright-server/tools.ts","../services/mcp-runs/enrichment.ts","../services/mcp-runs/events.ts","../services/mcp-runs/execution-builder.ts","../services/mcp-runs/index.ts","../services/mcp-runs/queries.ts","../services/mcp-runs/sql.ts","../services/mcp-runs/types.ts","../services/namespace/index.ts","../services/namespace/sql.ts","../services/namespace/types.ts","../services/oauth/crypto.ts","../services/oauth/db.ts","../services/oauth/index.ts","../services/oauth/sql.ts","../services/oauth/state.ts","../services/oauth/providers/anthropic.ts","../services/oauth/providers/github.ts","../services/oauth/providers/google.ts","../services/oauth/providers/index.ts","../services/oauth/providers/microsoft.ts","../services/oauth/providers/mock.ts","../services/oauth/providers/registry.ts","../services/oauth/providers/types.ts","../services/orchestrator/index.ts","../services/orchestrator/types.ts","../services/role/index.ts","../services/role/sql.ts","../services/role/types.ts","../services/task/crud.ts","../services/task/index.ts","../services/task/process.ts","../services/task/resolve.ts","../services/task/sql.ts","../services/task/types.ts","../services/user/auth.ts","../services/user/crud.ts","../services/user/index.ts","../services/user/rbac.ts","../services/user/roles.ts","../services/user/sql.ts","../services/user/types.ts","../services/workers/registry.ts","../services/workflow-sets/db.ts","../services/workflow-sets/index.ts","../services/workflow-sets/sql.ts","../services/yaml-workflow/db-utils.ts","../services/yaml-workflow/db.ts","../services/yaml-workflow/deployer-helpers.ts","../services/yaml-workflow/deployer.ts","../services/yaml-workflow/generator.ts","../services/yaml-workflow/index.ts","../services/yaml-workflow/input-analyzer-helpers.ts","../services/yaml-workflow/input-analyzer.ts","../services/yaml-workflow/invoke.ts","../services/yaml-workflow/sql.ts","../services/yaml-workflow/types.ts","../services/yaml-workflow/pattern-detector/array-source.ts","../services/yaml-workflow/pattern-detector/collapse.ts","../services/yaml-workflow/pattern-detector/index.ts","../services/yaml-workflow/pattern-detector/run-detection.ts","../services/yaml-workflow/pattern-detector/types.ts","../services/yaml-workflow/pipeline/analyze.ts","../services/yaml-workflow/pipeline/extract-helpers.ts","../services/yaml-workflow/pipeline/extract.ts","../services/yaml-workflow/pipeline/index.ts","../services/yaml-workflow/pipeline/prompts.ts","../services/yaml-workflow/pipeline/validate.ts","../services/yaml-workflow/pipeline/build/dag.ts","../services/yaml-workflow/pipeline/build/index.ts","../services/yaml-workflow/pipeline/build/iteration.ts","../services/yaml-workflow/pipeline/build/metadata.ts","../services/yaml-workflow/pipeline/build/transform.ts","../services/yaml-workflow/pipeline/build/utils.ts","../services/yaml-workflow/pipeline/build/wiring.ts","../services/yaml-workflow/pipeline/compile/index.ts","../services/yaml-workflow/pipeline/compile/llm-call.ts","../services/yaml-workflow/pipeline/compile/parse-plan.ts","../services/yaml-workflow/pipeline/compile/summarize.ts","../services/yaml-workflow/workers/callbacks.ts","../services/yaml-workflow/workers/events.ts","../services/yaml-workflow/workers/index.ts","../services/yaml-workflow/workers/register.ts","../services/yaml-workflow/workers/scope.ts","../start/adapters.ts","../start/config.ts","../start/index.ts","../start/server.ts","../start/workers.ts","../system/index.ts","../system/activities/claude-code.ts","../system/activities/file-storage.ts","../system/activities/http.ts","../system/activities/knowledge.ts","../system/activities/oauth.ts","../system/activities/sql.ts","../system/activities/triage/cache.ts","../system/activities/triage/context.ts","../system/activities/triage/discovery.ts","../system/activities/triage/index.ts","../system/activities/triage/llm.ts","../system/activities/triage/tools.ts","../system/mcp-servers/claude-code.ts","../system/mcp-servers/docs.ts","../system/mcp-servers/file-storage.ts","../system/mcp-servers/http-fetch.ts","../system/mcp-servers/human-queue.ts","../system/mcp-servers/knowledge.ts","../system/mcp-servers/oauth.ts","../system/mcp-servers/translation.ts","../system/mcp-servers/vision-prompts.ts","../system/mcp-servers/vision.ts","../system/mcp-servers/workflow-compiler.ts","../system/mcp-servers/workflow.ts","../system/mcp-servers/admin/escalations.ts","../system/mcp-servers/admin/index.ts","../system/mcp-servers/admin/maintenance.ts","../system/mcp-servers/admin/mcp-servers.ts","../system/mcp-servers/admin/schemas.ts","../system/mcp-servers/admin/tasks.ts","../system/mcp-servers/admin/users.ts","../system/mcp-servers/admin/workflow-config.ts","../system/mcp-servers/admin/workflows.ts","../system/mcp-servers/admin/yaml-workflows.ts","../system/mcp-servers/db-query/index.ts","../system/mcp-servers/db-query/schemas.ts","../system/mcp-servers/db-query/tools.ts","../system/mcp-servers/playwright/browser-lifecycle.ts","../system/mcp-servers/playwright/index.ts","../system/mcp-servers/playwright/schemas.ts","../system/mcp-servers/playwright/tools-atomic.ts","../system/mcp-servers/playwright/tools-navigation.ts","../system/mcp-servers/playwright/tools-page-interaction.ts","../system/mcp-servers/playwright/tools-run-script.ts","../system/mcp-servers/playwright/types.ts","../system/mcp-servers/playwright/vision-helper.ts","../system/mcp-servers/playwright-cli/helpers.ts","../system/mcp-servers/playwright-cli/index.ts","../system/mcp-servers/playwright-cli/schemas.ts","../system/mcp-servers/playwright-cli/tools-auth.ts","../system/mcp-servers/playwright-cli/tools-capture.ts","../system/seed/index.ts","../system/seed/server-definitions.ts","../system/seed/tool-manifests-admin.ts","../system/seed/tool-manifests-browser.ts","../system/seed/tool-manifests-data.ts","../system/seed/tool-manifests-escalation.ts","../system/seed/tool-manifests-knowledge.ts","../system/seed/tool-manifests-workflows.ts","../system/workflows/tool-result-guard.ts","../system/workflows/mcp-deterministic/activities.ts","../system/workflows/mcp-deterministic/index.ts","../system/workflows/mcp-query/index.ts","../system/workflows/mcp-query/prompts.ts","../system/workflows/mcp-query/strategy-advisors.ts","../system/workflows/mcp-query/types.ts","../system/workflows/mcp-query/activities/caches.ts","../system/workflows/mcp-query/activities/discovery.ts","../system/workflows/mcp-query/activities/index.ts","../system/workflows/mcp-query/activities/llm.ts","../system/workflows/mcp-query/activities/tool-executor.ts","../system/workflows/mcp-query/activities/tool-loader.ts","../system/workflows/mcp-query-router/activities.ts","../system/workflows/mcp-query-router/index.ts","../system/workflows/mcp-query-router/prompts.ts","../system/workflows/mcp-triage/index.ts","../system/workflows/mcp-triage/prompts.ts","../system/workflows/mcp-triage/response-builders.ts","../system/workflows/mcp-triage/response.ts","../system/workflows/mcp-triage/types.ts","../system/workflows/mcp-triage-deterministic/activities.ts","../system/workflows/mcp-triage-deterministic/index.ts","../system/workflows/mcp-triage-router/activities.ts","../system/workflows/mcp-triage-router/index.ts","../system/workflows/mcp-workflow-builder/index.ts","../system/workflows/mcp-workflow-builder/prompts.ts","../system/workflows/mcp-workflow-builder/activities/caches.ts","../system/workflows/mcp-workflow-builder/activities/index.ts","../system/workflows/mcp-workflow-builder/activities/llm.ts","../system/workflows/mcp-workflow-builder/activities/tool-loader.ts","../system/workflows/mcp-workflow-planner/index.ts","../system/workflows/mcp-workflow-planner/prompts.ts","../system/workflows/mcp-workflow-planner/activities/analyze.ts","../system/workflows/mcp-workflow-planner/activities/index.ts","../system/workflows/mcp-workflow-planner/activities/persist.ts","../system/workflows/mcp-workflow-planner/activities/plan.ts","../system/workflows/shared/discovery.ts","../system/workflows/shared/index.ts","../system/workflows/shared/llm-caller.ts","../system/workflows/shared/prompts.ts","../system/workflows/shared/strategy-advisors.ts","../system/workflows/shared/tool-executor.ts","../system/workflows/shared/tool-loader.ts","../system/workflows/shared/types.ts","../types/auth.ts","../types/config.ts","../types/delegation.ts","../types/discovery.ts","../types/envelope.ts","../types/escalation-strategy.ts","../types/escalation.ts","../types/events.ts","../types/export.ts","../types/express.d.ts","../types/index.ts","../types/logger.ts","../types/maintenance.ts","../types/mcp.ts","../types/oauth.ts","../types/sdk.ts","../types/startup.ts","../types/task.ts","../types/telemetry.ts","../types/tool-context.ts","../types/user.ts","../types/workflow-set.ts","../types/workflow.ts","../types/yaml-workflow.ts","../workers/index.ts"],"version":"5.9.3"}
+{"root":["../index.ts","../vitest.config.ts","../vitest.integration.config.ts","../api/auth.ts","../api/bot-accounts.ts","../api/controlplane.ts","../api/dba.ts","../api/escalations.ts","../api/exports.ts","../api/index.ts","../api/insight.ts","../api/maintenance.ts","../api/mcp-runs.ts","../api/mcp.ts","../api/namespaces.ts","../api/roles.ts","../api/settings.ts","../api/tasks.ts","../api/users.ts","../api/workflow-sets.ts","../api/workflows.ts","../api/yaml-workflows.ts","../examples/index.ts","../examples/seed.ts","../examples/workers.ts","../examples/external-mcp-server/server.ts","../examples/types/envelopes.ts","../examples/types/index.ts","../examples/types/resolvers.ts","../examples/workflows/assembly-line/activities.ts","../examples/workflows/assembly-line/index.ts","../examples/workflows/assembly-line/iterator.ts","../examples/workflows/assembly-line/reverter.ts","../examples/workflows/assembly-line/types.ts","../examples/workflows/assembly-line/worker.ts","../examples/workflows/basic-echo/activities.ts","../examples/workflows/basic-echo/index.ts","../examples/workflows/basic-signal/activities.ts","../examples/workflows/basic-signal/index.ts","../examples/workflows/kitchen-sink/activities.ts","../examples/workflows/kitchen-sink/index.ts","../examples/workflows/review-content/activities.ts","../examples/workflows/review-content/index.ts","../examples/workflows/review-content/types.ts","../lib/db/index.ts","../lib/db/migrate.ts","../lib/events/callback.ts","../lib/events/index.ts","../lib/events/memory.ts","../lib/events/nats.ts","../lib/events/publish.ts","../lib/events/socketio.ts","../lib/logger/index.ts","../lib/logger/pino.ts","../lib/storage/index.ts","../lib/storage/local.ts","../lib/storage/s3.ts","../lib/storage/types.ts","../lib/telemetry/honeycomb.ts","../lib/telemetry/index.ts","../modules/auth.ts","../modules/config.ts","../modules/defaults.ts","../modules/ltconfig.ts","../modules/maintenance.ts","../routes/auth.ts","../routes/bot-accounts.ts","../routes/controlplane.ts","../routes/dba.ts","../routes/delegation.ts","../routes/docs.ts","../routes/exports.ts","../routes/files.ts","../routes/index.ts","../routes/insight.ts","../routes/maintenance.ts","../routes/mcp-runs.ts","../routes/mcp.ts","../routes/namespaces.ts","../routes/oauth.ts","../routes/roles.ts","../routes/settings.ts","../routes/tasks.ts","../routes/users.ts","../routes/workflow-sets.ts","../routes/escalations/bulk.ts","../routes/escalations/index.ts","../routes/escalations/list.ts","../routes/escalations/resolve.ts","../routes/escalations/single.ts","../routes/workflows/config.ts","../routes/workflows/discovery.ts","../routes/workflows/index.ts","../routes/workflows/invocation.ts","../routes/yaml-workflows/cron.ts","../routes/yaml-workflows/crud.ts","../routes/yaml-workflows/deployment.ts","../routes/yaml-workflows/index.ts","../routes/yaml-workflows/versions.ts","../scripts/process-helpers.ts","../scripts/process.ts","../scripts/token.ts","../sdk/index.ts","../services/dba.ts","../services/hotmesh-utils.ts","../services/workflow-invocation.ts","../services/auth/bot-api-key.ts","../services/auth/delegation.ts","../services/auth/index.ts","../services/auth/service-token.ts","../services/config/cache.ts","../services/config/index.ts","../services/config/provider.ts","../services/config/read.ts","../services/config/sql.ts","../services/config/write.ts","../services/controlplane/index.ts","../services/controlplane/quorum-bridge.ts","../services/controlplane/sql.ts","../services/controlplane/types.ts","../services/cron/index.ts","../services/escalation/bulk.ts","../services/escalation/crud.ts","../services/escalation/index.ts","../services/escalation/queries.ts","../services/escalation/sql.ts","../services/escalation/types.ts","../services/escalation-strategy/default.ts","../services/escalation-strategy/index.ts","../services/escalation-strategy/mcp.ts","../services/export/client.ts","../services/export/index.ts","../services/export/post-process.ts","../services/export/types.ts","../services/iam/activity.ts","../services/iam/bots.ts","../services/iam/context.ts","../services/iam/credentials.ts","../services/iam/envelope.ts","../services/iam/ephemeral.ts","../services/iam/index.ts","../services/iam/principal.ts","../services/iam/resolve.ts","../services/iam/sql.ts","../services/insight/index.ts","../services/insight/prompts.ts","../services/interceptor/activity-interceptor.ts","../services/interceptor/completion.ts","../services/interceptor/context.ts","../services/interceptor/escalation.ts","../services/interceptor/index.ts","../services/interceptor/lifecycle.ts","../services/interceptor/state.ts","../services/interceptor/types.ts","../services/interceptor/activities/config.ts","../services/interceptor/activities/escalation.ts","../services/interceptor/activities/index.ts","../services/interceptor/activities/task.ts","../services/interceptor/activities/workflow.ts","../services/llm/detect.ts","../services/llm/index.ts","../services/llm/translate.ts","../services/llm/types.ts","../services/llm/providers/anthropic.ts","../services/llm/providers/openai.ts","../services/maintenance/index.ts","../services/mcp/adapter.ts","../services/mcp/db.ts","../services/mcp/index.ts","../services/mcp/register-tool.ts","../services/mcp/server.ts","../services/mcp/sql.ts","../services/mcp/types.ts","../services/mcp/workflow-compiler-server.ts","../services/mcp/workflow-server.ts","../services/mcp/client/connection.ts","../services/mcp/client/index.ts","../services/mcp/client/tools.ts","../services/mcp/db-server/index.ts","../services/mcp/db-server/schemas.ts","../services/mcp/db-server/tools.ts","../services/mcp/playwright-server/index.ts","../services/mcp/playwright-server/lifecycle.ts","../services/mcp/playwright-server/schemas.ts","../services/mcp/playwright-server/tools.ts","../services/mcp-runs/enrichment.ts","../services/mcp-runs/events.ts","../services/mcp-runs/execution-builder.ts","../services/mcp-runs/index.ts","../services/mcp-runs/queries.ts","../services/mcp-runs/sql.ts","../services/mcp-runs/types.ts","../services/namespace/index.ts","../services/namespace/sql.ts","../services/namespace/types.ts","../services/oauth/crypto.ts","../services/oauth/db.ts","../services/oauth/index.ts","../services/oauth/sql.ts","../services/oauth/state.ts","../services/oauth/providers/anthropic.ts","../services/oauth/providers/github.ts","../services/oauth/providers/google.ts","../services/oauth/providers/index.ts","../services/oauth/providers/microsoft.ts","../services/oauth/providers/mock.ts","../services/oauth/providers/registry.ts","../services/oauth/providers/types.ts","../services/orchestrator/condition.ts","../services/orchestrator/index.ts","../services/orchestrator/types.ts","../services/role/index.ts","../services/role/sql.ts","../services/role/types.ts","../services/task/crud.ts","../services/task/index.ts","../services/task/process.ts","../services/task/resolve.ts","../services/task/sql.ts","../services/task/types.ts","../services/user/auth.ts","../services/user/crud.ts","../services/user/index.ts","../services/user/rbac.ts","../services/user/roles.ts","../services/user/sql.ts","../services/user/types.ts","../services/workers/registry.ts","../services/workflow-sets/db.ts","../services/workflow-sets/index.ts","../services/workflow-sets/sql.ts","../services/yaml-workflow/db-utils.ts","../services/yaml-workflow/db.ts","../services/yaml-workflow/deployer-helpers.ts","../services/yaml-workflow/deployer.ts","../services/yaml-workflow/generator.ts","../services/yaml-workflow/index.ts","../services/yaml-workflow/input-analyzer-helpers.ts","../services/yaml-workflow/input-analyzer.ts","../services/yaml-workflow/invoke.ts","../services/yaml-workflow/sql.ts","../services/yaml-workflow/types.ts","../services/yaml-workflow/pattern-detector/array-source.ts","../services/yaml-workflow/pattern-detector/collapse.ts","../services/yaml-workflow/pattern-detector/index.ts","../services/yaml-workflow/pattern-detector/run-detection.ts","../services/yaml-workflow/pattern-detector/types.ts","../services/yaml-workflow/pipeline/analyze.ts","../services/yaml-workflow/pipeline/extract-helpers.ts","../services/yaml-workflow/pipeline/extract.ts","../services/yaml-workflow/pipeline/index.ts","../services/yaml-workflow/pipeline/prompts.ts","../services/yaml-workflow/pipeline/validate.ts","../services/yaml-workflow/pipeline/build/dag.ts","../services/yaml-workflow/pipeline/build/index.ts","../services/yaml-workflow/pipeline/build/iteration.ts","../services/yaml-workflow/pipeline/build/metadata.ts","../services/yaml-workflow/pipeline/build/transform.ts","../services/yaml-workflow/pipeline/build/utils.ts","../services/yaml-workflow/pipeline/build/wiring.ts","../services/yaml-workflow/pipeline/compile/index.ts","../services/yaml-workflow/pipeline/compile/llm-call.ts","../services/yaml-workflow/pipeline/compile/parse-plan.ts","../services/yaml-workflow/pipeline/compile/summarize.ts","../services/yaml-workflow/workers/callbacks.ts","../services/yaml-workflow/workers/events.ts","../services/yaml-workflow/workers/index.ts","../services/yaml-workflow/workers/register.ts","../services/yaml-workflow/workers/scope.ts","../start/adapters.ts","../start/config.ts","../start/index.ts","../start/server.ts","../start/workers.ts","../system/index.ts","../system/activities/claude-code.ts","../system/activities/file-storage.ts","../system/activities/http.ts","../system/activities/knowledge.ts","../system/activities/oauth.ts","../system/activities/sql.ts","../system/activities/triage/cache.ts","../system/activities/triage/context.ts","../system/activities/triage/discovery.ts","../system/activities/triage/index.ts","../system/activities/triage/llm.ts","../system/activities/triage/tools.ts","../system/mcp-servers/claude-code.ts","../system/mcp-servers/docs.ts","../system/mcp-servers/file-storage.ts","../system/mcp-servers/http-fetch.ts","../system/mcp-servers/human-queue.ts","../system/mcp-servers/knowledge.ts","../system/mcp-servers/oauth.ts","../system/mcp-servers/translation.ts","../system/mcp-servers/vision-prompts.ts","../system/mcp-servers/vision.ts","../system/mcp-servers/workflow-compiler.ts","../system/mcp-servers/workflow.ts","../system/mcp-servers/admin/escalations.ts","../system/mcp-servers/admin/index.ts","../system/mcp-servers/admin/maintenance.ts","../system/mcp-servers/admin/mcp-servers.ts","../system/mcp-servers/admin/schemas.ts","../system/mcp-servers/admin/tasks.ts","../system/mcp-servers/admin/users.ts","../system/mcp-servers/admin/workflow-config.ts","../system/mcp-servers/admin/workflows.ts","../system/mcp-servers/admin/yaml-workflows.ts","../system/mcp-servers/db-query/index.ts","../system/mcp-servers/db-query/schemas.ts","../system/mcp-servers/db-query/tools.ts","../system/mcp-servers/playwright/browser-lifecycle.ts","../system/mcp-servers/playwright/index.ts","../system/mcp-servers/playwright/schemas.ts","../system/mcp-servers/playwright/tools-atomic.ts","../system/mcp-servers/playwright/tools-navigation.ts","../system/mcp-servers/playwright/tools-page-interaction.ts","../system/mcp-servers/playwright/tools-run-script.ts","../system/mcp-servers/playwright/types.ts","../system/mcp-servers/playwright/vision-helper.ts","../system/mcp-servers/playwright-cli/helpers.ts","../system/mcp-servers/playwright-cli/index.ts","../system/mcp-servers/playwright-cli/schemas.ts","../system/mcp-servers/playwright-cli/tools-auth.ts","../system/mcp-servers/playwright-cli/tools-capture.ts","../system/seed/index.ts","../system/seed/server-definitions.ts","../system/seed/tool-manifests-admin.ts","../system/seed/tool-manifests-browser.ts","../system/seed/tool-manifests-data.ts","../system/seed/tool-manifests-escalation.ts","../system/seed/tool-manifests-knowledge.ts","../system/seed/tool-manifests-workflows.ts","../system/workflows/tool-result-guard.ts","../system/workflows/mcp-deterministic/activities.ts","../system/workflows/mcp-deterministic/index.ts","../system/workflows/mcp-query/index.ts","../system/workflows/mcp-query/prompts.ts","../system/workflows/mcp-query/strategy-advisors.ts","../system/workflows/mcp-query/types.ts","../system/workflows/mcp-query/activities/caches.ts","../system/workflows/mcp-query/activities/discovery.ts","../system/workflows/mcp-query/activities/index.ts","../system/workflows/mcp-query/activities/llm.ts","../system/workflows/mcp-query/activities/tool-executor.ts","../system/workflows/mcp-query/activities/tool-loader.ts","../system/workflows/mcp-query-router/activities.ts","../system/workflows/mcp-query-router/index.ts","../system/workflows/mcp-query-router/prompts.ts","../system/workflows/mcp-triage/index.ts","../system/workflows/mcp-triage/prompts.ts","../system/workflows/mcp-triage/response-builders.ts","../system/workflows/mcp-triage/response.ts","../system/workflows/mcp-triage/types.ts","../system/workflows/mcp-triage-deterministic/activities.ts","../system/workflows/mcp-triage-deterministic/index.ts","../system/workflows/mcp-triage-router/activities.ts","../system/workflows/mcp-triage-router/index.ts","../system/workflows/mcp-workflow-builder/index.ts","../system/workflows/mcp-workflow-builder/prompts.ts","../system/workflows/mcp-workflow-builder/activities/caches.ts","../system/workflows/mcp-workflow-builder/activities/index.ts","../system/workflows/mcp-workflow-builder/activities/llm.ts","../system/workflows/mcp-workflow-builder/activities/tool-loader.ts","../system/workflows/mcp-workflow-planner/index.ts","../system/workflows/mcp-workflow-planner/prompts.ts","../system/workflows/mcp-workflow-planner/activities/analyze.ts","../system/workflows/mcp-workflow-planner/activities/index.ts","../system/workflows/mcp-workflow-planner/activities/persist.ts","../system/workflows/mcp-workflow-planner/activities/plan.ts","../system/workflows/shared/discovery.ts","../system/workflows/shared/index.ts","../system/workflows/shared/llm-caller.ts","../system/workflows/shared/prompts.ts","../system/workflows/shared/strategy-advisors.ts","../system/workflows/shared/tool-executor.ts","../system/workflows/shared/tool-loader.ts","../system/workflows/shared/types.ts","../types/auth.ts","../types/config.ts","../types/delegation.ts","../types/discovery.ts","../types/envelope.ts","../types/escalation-strategy.ts","../types/escalation.ts","../types/events.ts","../types/export.ts","../types/express.d.ts","../types/index.ts","../types/logger.ts","../types/maintenance.ts","../types/mcp.ts","../types/oauth.ts","../types/sdk.ts","../types/startup.ts","../types/task.ts","../types/telemetry.ts","../types/tool-context.ts","../types/user.ts","../types/workflow-set.ts","../types/workflow.ts","../types/yaml-workflow.ts","../workers/index.ts"],"version":"5.9.3"}

package/build/types/envelope.d.ts

@@ -20,6 +20,13 @@ export interface LTEnvelopePrincipal {
 export interface LTEnvelope {
     data: Record<string, any>;
     metadata: {
+        /**
+         * Set to `false` to bypass the interceptor's config lookup entirely.
+         * Skips the `ltGetWorkflowConfig` proxyActivity call — no DB hit,
+         * no task creation, no escalation wiring. The workflow still gets
+         * ToolContext (IAM identity) but manages its own lifecycle.
+         */
+        certified?: boolean;
         [key: string]: any;
     };
     lt?: {

package/build/types/sdk.d.ts

@@ -24,4 +24,6 @@ export interface LTApiResult<T = any> {
  */
 export interface LTApiAuth {
     userId: string;
+    role?: string;
+    scopes?: string[];
 }

package/build/types/startup.d.ts

@@ -22,10 +22,37 @@ export interface LTStartConfig {
         enabled?: boolean;
         port?: number;
     };
-    /** Workflow workers to start. Each entry registers a worker on the given queue. */
+    /**
+     * Workflow workers to start. Each entry registers a worker on the given queue.
+     *
+     * Pass a function for normal workers. Pass a **string name** with
+     * `connection: { readonly: true }` for dashboard/observer mode — a no-op
+     * worker is created automatically so the workflow appears in discovery
+     * and can be invoked without competing for work.
+     *
+     * @example
+     * ```typescript
+     * workers: [
+     *   // Normal worker — runs the workflow
+     *   { taskQueue: 'my-queue', workflow: myWorkflow },
+     *   // Readonly observer — discovers and invokes without competing for work
+     *   { taskQueue: 'ingest', workflow: 'orderPipeline', connection: { readonly: true } },
+     * ]
+     * ```
+     */
     workers?: Array<{
         taskQueue: string;
-        workflow: (...args: any[]) => any;
+        /** Workflow function, or a string name when registering a readonly observer. */
+        workflow: ((...args: any[]) => any) | string;
+        /**
+         * Optional overrides merged onto the HotMesh connection/provider config.
+         * Common fields: `readonly` (observe without consuming work),
+         * `retry` (stream-level retry policy with backoff).
+         */
+        connection?: {
+            readonly?: boolean;
+            retry?: Record<string, unknown>;
+        };
     }>;
     /** Interceptor defaults applied when a workflow escalates. */
     interceptor?: {

package/dashboard/dist/assets/{AdminDashboard-DRjkRSjJ.js → AdminDashboard-DUrSBQOl.js}

@@ -1,2 +1,2 @@
-import{q as n,j as o}from"./index-BwN3KP_L.js";import{c as m}from"./tasks-Bmte_hc4.js";import{e as d}from"./useEventHooks-CUCxpiI2.js";import{u}from"./mcp-BZoFryNc.js";import{P as c}from"./PageHeaderWithStats-D0KRASML.js";import"./vendor-query-DLp59M9_.js";import"./vendor-react-Co3Y8ikm.js";import"./vendor-icons-D1DdudfH.js";function N(){var e;d();const{data:a}=m({limit:1}),{data:t}=n({status:"pending",limit:1}),{data:s}=u(),i=((e=s==null?void 0:s.servers)==null?void 0:e.filter(l=>l.status==="connected").length)??0,r=s?`${i}/${s.total}`:"—";return o.jsxDEV("div",{children:o.jsxDEV(c,{title:"Admin",stats:[{label:"Tasks",value:(a==null?void 0:a.total)??"—"},{label:"Pending Escalations",value:(t==null?void 0:t.total)??"—",dotClass:"bg-status-pending"},{label:"MCP Servers",value:r},{label:"System",value:"Healthy",dotClass:"bg-status-success"}]},void 0,!1,{fileName:"/app/dashboard/src/pages/admin/AdminDashboard.tsx",lineNumber:19,columnNumber:7},this)},void 0,!1,{fileName:"/app/dashboard/src/pages/admin/AdminDashboard.tsx",lineNumber:18,columnNumber:5},this)}export{N as AdminDashboard};
-//# sourceMappingURL=AdminDashboard-DRjkRSjJ.js.map
+import{q as n,j as o}from"./index-BYZX9tOb.js";import{c as m}from"./tasks-BquNDHDI.js";import{e as d}from"./useEventHooks-anv_B2Yy.js";import{u}from"./mcp-B_xbczAt.js";import{P as c}from"./PageHeaderWithStats-BI7JG5x6.js";import"./vendor-query-DLp59M9_.js";import"./vendor-react-Co3Y8ikm.js";import"./vendor-icons-T4r2DSPD.js";function N(){var e;d();const{data:a}=m({limit:1}),{data:t}=n({status:"pending",limit:1}),{data:s}=u(),i=((e=s==null?void 0:s.servers)==null?void 0:e.filter(l=>l.status==="connected").length)??0,r=s?`${i}/${s.total}`:"—";return o.jsxDEV("div",{children:o.jsxDEV(c,{title:"Admin",stats:[{label:"Tasks",value:(a==null?void 0:a.total)??"—"},{label:"Pending Escalations",value:(t==null?void 0:t.total)??"—",dotClass:"bg-status-pending"},{label:"MCP Servers",value:r},{label:"System",value:"Healthy",dotClass:"bg-status-success"}]},void 0,!1,{fileName:"/app/dashboard/src/pages/admin/AdminDashboard.tsx",lineNumber:19,columnNumber:7},this)},void 0,!1,{fileName:"/app/dashboard/src/pages/admin/AdminDashboard.tsx",lineNumber:18,columnNumber:5},this)}export{N as AdminDashboard};
+//# sourceMappingURL=AdminDashboard-DUrSBQOl.js.map

package/dashboard/dist/assets/{AdminDashboard-DRjkRSjJ.js.map → AdminDashboard-DUrSBQOl.js.map}

@@ -1 +1 @@
-{"version":3,"file":"AdminDashboard-DRjkRSjJ.js","sources":["../../src/pages/admin/AdminDashboard.tsx"],"sourcesContent":["import { useTasks } from '../../api/tasks';\nimport { useEscalations } from '../../api/escalations';\nimport { useEscalationListEvents } from '../../hooks/useEventHooks';\nimport { useMcpServers } from '../../api/mcp';\nimport { PageHeaderWithStats } from '../../components/common/layout/PageHeaderWithStats';\n\nexport function AdminDashboard() {\n  useEscalationListEvents();\n  const { data: taskData } = useTasks({ limit: 1 });\n  const { data: pendingEsc } = useEscalations({ status: 'pending', limit: 1 });\n  const { data: mcpData } = useMcpServers();\n\n  const connectedServers =\n    mcpData?.servers?.filter((s) => s.status === 'connected').length ?? 0;\n  const mcpLabel = mcpData ? `${connectedServers}/${mcpData.total}` : '—';\n\n  return (\n    <div>\n      <PageHeaderWithStats\n        title=\"Admin\"\n        stats={[\n          { label: 'Tasks', value: taskData?.total ?? '—' },\n          { label: 'Pending Escalations', value: pendingEsc?.total ?? '—', dotClass: 'bg-status-pending' },\n          { label: 'MCP Servers', value: mcpLabel },\n          { label: 'System', value: 'Healthy', dotClass: 'bg-status-success' },\n        ]}\n      />\n    </div>\n  );\n}\n"],"names":["AdminDashboard","useEscalationListEvents","taskData","useTasks","pendingEsc","useEscalations","mcpData","useMcpServers","connectedServers","_a","s","mcpLabel","jsxDEV","PageHeaderWithStats"],"mappings":"uUAMO,SAASA,GAAiB,OAC/BC,EAAA,EACA,KAAM,CAAE,KAAMC,CAAA,EAAaC,EAAS,CAAE,MAAO,EAAG,EAC1C,CAAE,KAAMC,CAAA,EAAeC,EAAe,CAAE,OAAQ,UAAW,MAAO,EAAG,EACrE,CAAE,KAAMC,CAAA,EAAYC,EAAA,EAEpBC,IACJC,EAAAH,GAAA,YAAAA,EAAS,UAAT,YAAAG,EAAkB,OAAQC,GAAMA,EAAE,SAAW,aAAa,SAAU,EAChEC,EAAWL,EAAU,GAAGE,CAAgB,IAAIF,EAAQ,KAAK,GAAK,IAEpE,gBACG,MAAA,CACC,SAAAM,EAAAA,OAACC,EAAA,CACC,MAAM,QACN,MAAO,CACL,CAAE,MAAO,QAAS,OAAOX,GAAA,YAAAA,EAAU,QAAS,GAAA,EAC5C,CAAE,MAAO,sBAAuB,OAAOE,GAAA,YAAAA,EAAY,QAAS,IAAK,SAAU,mBAAA,EAC3E,CAAE,MAAO,cAAe,MAAOO,CAAA,EAC/B,CAAE,MAAO,SAAU,MAAO,UAAW,SAAU,mBAAA,CAAoB,CACrE,EAPF,OAAA,GAAA,CAAA,SAAA,oDAAA,WAAA,GAAA,aAAA,CAAA,EAAA,IAAA,CAQA,EATF,OAAA,GAAA,CAAA,SAAA,oDAAA,WAAA,GAAA,aAAA,CAAA,EAAA,IAUA,CAEJ"}
+{"version":3,"file":"AdminDashboard-DUrSBQOl.js","sources":["../../src/pages/admin/AdminDashboard.tsx"],"sourcesContent":["import { useTasks } from '../../api/tasks';\nimport { useEscalations } from '../../api/escalations';\nimport { useEscalationListEvents } from '../../hooks/useEventHooks';\nimport { useMcpServers } from '../../api/mcp';\nimport { PageHeaderWithStats } from '../../components/common/layout/PageHeaderWithStats';\n\nexport function AdminDashboard() {\n  useEscalationListEvents();\n  const { data: taskData } = useTasks({ limit: 1 });\n  const { data: pendingEsc } = useEscalations({ status: 'pending', limit: 1 });\n  const { data: mcpData } = useMcpServers();\n\n  const connectedServers =\n    mcpData?.servers?.filter((s) => s.status === 'connected').length ?? 0;\n  const mcpLabel = mcpData ? `${connectedServers}/${mcpData.total}` : '—';\n\n  return (\n    <div>\n      <PageHeaderWithStats\n        title=\"Admin\"\n        stats={[\n          { label: 'Tasks', value: taskData?.total ?? '—' },\n          { label: 'Pending Escalations', value: pendingEsc?.total ?? '—', dotClass: 'bg-status-pending' },\n          { label: 'MCP Servers', value: mcpLabel },\n          { label: 'System', value: 'Healthy', dotClass: 'bg-status-success' },\n        ]}\n      />\n    </div>\n  );\n}\n"],"names":["AdminDashboard","useEscalationListEvents","taskData","useTasks","pendingEsc","useEscalations","mcpData","useMcpServers","connectedServers","_a","s","mcpLabel","jsxDEV","PageHeaderWithStats"],"mappings":"uUAMO,SAASA,GAAiB,OAC/BC,EAAA,EACA,KAAM,CAAE,KAAMC,CAAA,EAAaC,EAAS,CAAE,MAAO,EAAG,EAC1C,CAAE,KAAMC,CAAA,EAAeC,EAAe,CAAE,OAAQ,UAAW,MAAO,EAAG,EACrE,CAAE,KAAMC,CAAA,EAAYC,EAAA,EAEpBC,IACJC,EAAAH,GAAA,YAAAA,EAAS,UAAT,YAAAG,EAAkB,OAAQC,GAAMA,EAAE,SAAW,aAAa,SAAU,EAChEC,EAAWL,EAAU,GAAGE,CAAgB,IAAIF,EAAQ,KAAK,GAAK,IAEpE,gBACG,MAAA,CACC,SAAAM,EAAAA,OAACC,EAAA,CACC,MAAM,QACN,MAAO,CACL,CAAE,MAAO,QAAS,OAAOX,GAAA,YAAAA,EAAU,QAAS,GAAA,EAC5C,CAAE,MAAO,sBAAuB,OAAOE,GAAA,YAAAA,EAAY,QAAS,IAAK,SAAU,mBAAA,EAC3E,CAAE,MAAO,cAAe,MAAOO,CAAA,EAC/B,CAAE,MAAO,SAAU,MAAO,UAAW,SAAU,mBAAA,CAAoB,CACrE,EAPF,OAAA,GAAA,CAAA,SAAA,oDAAA,WAAA,GAAA,aAAA,CAAA,EAAA,IAAA,CAQA,EATF,OAAA,GAAA,CAAA,SAAA,oDAAA,WAAA,GAAA,aAAA,CAAA,EAAA,IAUA,CAEJ"}