@hotmeshio/long-tail 0.10.2 → 0.10.4

package/README.md

@@ -231,6 +231,7 @@ All modes share PostgreSQL and scale independently. See [Cloud Deployment](https
 | [Compiler](https://github.com/hotmeshio/long-tail/blob/main/docs/compiler.md) | `ltc compile` — durable TypeScript to YAML DAGs |
 | [CLI](https://github.com/hotmeshio/long-tail/blob/main/docs/cli.md) | `ltc` — terminal access to workflows, escalations, knowledge, MCP |
 | [Escalation Strategies](https://github.com/hotmeshio/long-tail/blob/main/docs/escalation-strategies.md) | Default, MCP triage, custom handlers |
+| [Schema Enforcement](https://github.com/hotmeshio/long-tail/blob/main/docs/schema-enforcement.md) | form_schema as an enforced API contract on every resolve surface |
 | [Faceted Routing](https://github.com/hotmeshio/long-tail/blob/main/docs/faceted-routing.md) | Query and atomically claim the queue by facets; dispatcher pattern |
 | [SDK](https://github.com/hotmeshio/long-tail/blob/main/docs/sdk.md) | Embedded usage, `createClient`, event subscriptions |
 | [Architecture](https://github.com/hotmeshio/long-tail/blob/main/docs/architecture.md) | Project structure, conventions, discovery |

package/build/api/bot-accounts.d.ts

@@ -4,11 +4,15 @@ import type { LTApiResult, LTApiAuth } from '../types/sdk';
  *
  * @param input.limit — maximum number of bots to return (default 50)
  * @param input.offset — number of bots to skip for pagination (default 0)
+ * @param input.status — filter by account status
+ * @param input.search — free-text match on display name, external id, or description
  * @returns `{ status: 200, data: Bot[] }` paginated list of bots
  */
 export declare function listBots(input: {
     limit?: number;
     offset?: number;
+    status?: string;
+    search?: string;
 }): Promise<LTApiResult>;
 /**
  * Retrieve a single bot account by ID.

package/build/api/bot-accounts.js

@@ -51,13 +51,15 @@ const user_1 = require("../services/user");
  *
  * @param input.limit — maximum number of bots to return (default 50)
  * @param input.offset — number of bots to skip for pagination (default 0)
+ * @param input.status — filter by account status
+ * @param input.search — free-text match on display name, external id, or description
  * @returns `{ status: 200, data: Bot[] }` paginated list of bots
  */
 async function listBots(input) {
     try {
         const limit = input.limit ?? 50;
         const offset = input.offset ?? 0;
-        const result = await iam.listBots(limit, offset);
+        const result = await iam.listBots(limit, offset, { status: input.status, search: input.search });
         return { status: 200, data: result };
     }
     catch (err) {

package/build/api/escalations/metadata.js

@@ -38,6 +38,9 @@ exports.claimByMetadata = claimByMetadata;
 exports.resolveByMetadata = resolveByMetadata;
 const escalationService = __importStar(require("../../services/escalation"));
 const helpers_1 = require("./helpers");
+const resolver_validation_1 = require("../../services/escalation/resolver-validation");
+const enforcement_cache_1 = require("../../services/role/enforcement-cache");
+const resolve_1 = require("./resolve");
 /**
  * Find escalations by a metadata key-value pair.
  *
@@ -130,7 +133,24 @@ async function resolveByMetadata(input, auth) {
         const writeScope = await (0, helpers_1.getEscalationWriteScope)(auth.userId);
         const writeAllRoles = writeScope.global ? null : writeScope.allRoles;
         const writeSelfRoles = writeScope.global ? null : writeScope.selfRoles;
-        const result = await escalationService.resolveByMetadataAtomic(input.key, input.value, resolveUserId, input.resolverPayload, input.metadata, writeAllRoles, writeSelfRoles);
+        // Schema enforcement rides the atomic statement: with the cached enforcing
+        // set empty (the common case) the single-call behavior is unchanged. When
+        // the picked row's role enforces, the statement returns the row WITHOUT
+        // writing; the payload validates here, then a second asserted pass claims
+        // + resolves the same row with pending re-checked inside the statement.
+        const enforcing = await (0, enforcement_cache_1.getEnforcingRoles)();
+        let result = await escalationService.resolveByMetadataAtomic(input.key, input.value, resolveUserId, input.resolverPayload, input.metadata, writeAllRoles, writeSelfRoles, enforcing.size > 0 ? [...enforcing] : null);
+        if (result.outcome === 'validation_required' && result.row) {
+            const report = await (0, resolver_validation_1.checkResolverPayload)(result.row, input.resolverPayload);
+            if (report)
+                return (0, resolve_1.validationFailure)(report);
+            result = await escalationService.resolveByMetadataAtomic(input.key, input.value, resolveUserId, input.resolverPayload, input.metadata, writeAllRoles, writeSelfRoles, null, result.row.id);
+            // The asserted row left pending between the two passes — a concurrent
+            // resolution won the row; surface it as the conflict it is.
+            if (result.outcome === 'not_found') {
+                return { status: 409, error: 'A concurrent resolution is already in progress for this escalation' };
+            }
+        }
         if (result.outcome === 'not_found') {
             return { status: 404, error: 'No pending escalation found for this metadata, or insufficient role permissions' };
         }

package/build/api/escalations/resolve.d.ts

@@ -1,3 +1,4 @@
+import type { ResolverSchemaViolationReport } from '../../services/escalation/resolver-validation';
 import type { LTApiResult, LTApiAuth } from '../../types/sdk';
 /**
  * Resolve a pending escalation with a human-provided payload.
@@ -72,3 +73,10 @@ export declare function resolveAllOrNone(input: {
     metadata?: Record<string, any>;
     requireClaimed?: boolean;
 }, auth: LTApiAuth): Promise<LTApiResult>;
+/**
+ * The canonical 422 for a schema-validation rejection. The full body rides in
+ * `data` (routes serialize `data ?? { error }`), so every transport — HTTP,
+ * SDK, CLI, dashboard — receives the same shape: error, code, violations,
+ * role, schemaVersion. `code` also sits on the envelope for SDK branching.
+ */
+export declare function validationFailure(report: ResolverSchemaViolationReport): LTApiResult;

package/build/api/escalations/resolve.js

@@ -37,6 +37,7 @@ exports.resolveEscalation = resolveEscalation;
 exports.resolveBySignalKey = resolveBySignalKey;
 exports.resolveByIds = resolveByIds;
 exports.resolveAllOrNone = resolveAllOrNone;
+exports.validationFailure = validationFailure;
 const escalationService = __importStar(require("../../services/escalation"));
 const taskService = __importStar(require("../../services/task"));
 const escalation_strategy_1 = require("../../services/escalation-strategy");
@@ -45,6 +46,8 @@ const deployer_1 = require("../../services/yaml-workflow/deployer");
 const workers_1 = require("../../workers");
 const defaults_1 = require("../../modules/defaults");
 const helpers_1 = require("./helpers");
+const resolver_validation_1 = require("../../services/escalation/resolver-validation");
+const enforcement_cache_1 = require("../../services/role/enforcement-cache");
 // ── Orchestrator ─────────────────────────────────────────────────────────
 /**
  * Resolve a pending escalation with a human-provided payload.
@@ -90,6 +93,13 @@ async function resolveEscalation(input, auth) {
         const stale = (0, helpers_1.assertLiveClaimant)(auth.userId, escalation);
         if (stale)
             return stale;
+        // Schema enforcement (enforce_schema roles): validate the payload against
+        // the escalation's resolved form schema BEFORE any resolution path runs.
+        // Costs nothing when the role does not enforce (cached role set); the
+        // task-fallback envelope read only happens for enforcing roles.
+        const violation = await (0, resolver_validation_1.checkResolverPayload)(escalation, resolverPayload, () => reconstructEnvelope(escalation));
+        if (violation)
+            return validationFailure(violation);
         // The resolver payload is stored exactly as submitted — its shape is the
         // workflow's contract, formed by the caller (the React app maps the form to
         // the payload via x-lt-bind before submitting). No server-side transform.
@@ -161,6 +171,11 @@ async function resolveBySignalKey(input, auth) {
         const denied = await (0, helpers_1.assertWriteAccess)(auth.userId, escalation);
         if (denied)
             return { status: 404, error: 'Escalation not found' };
+        // Schema enforcement — the row (envelope included) is already loaded, so
+        // this costs zero extra reads beyond the cached schema.
+        const violation = await (0, resolver_validation_1.checkResolverPayload)(escalation, resolverPayload);
+        if (violation)
+            return validationFailure(violation);
         // The payload is delivered as the signal the parked workflow's condition()
         // receives — stored exactly as submitted (the caller formed its shape).
         return resolveViaSignalKey(escalation, resolverPayload, metadata);
@@ -195,17 +210,39 @@ async function resolveByIds(input, auth) {
         // resolve any item in the role; write_self roles may resolve only items assigned
         // to the caller (same rule single-resolve applies via assertWriteAccess). Global
         // bypasses. A missing id or any out-of-scope item → 404 (non-disclosure), and
-        // nothing is resolved.
+        // nothing is resolved. The scope-row read is shared with the enforcement
+        // gate below — one indexed read serves both.
         const writeScope = await (0, helpers_1.getEscalationWriteScope)(auth.userId);
+        const enforcing = await (0, enforcement_cache_1.getEnforcingRoles)();
+        let scopeRows = null;
         if (!writeScope.global) {
             const allSet = new Set(writeScope.allRoles);
             const selfSet = new Set(writeScope.selfRoles);
-            const rows = await escalationService.getEscalationScopeRows(ids);
+            scopeRows = await escalationService.getEscalationScopeRows(ids);
             const writable = (r) => allSet.has(r.role) || (selfSet.has(r.role) && r.assigned_to === auth.userId);
-            if (rows.length !== ids.length || !rows.every(writable)) {
+            if (scopeRows.length !== ids.length || !scopeRows.every(writable)) {
                 return { status: 404, error: 'One or more escalations not found' };
             }
         }
+        // Schema enforcement (enforce_schema roles): with the cached enforcing set
+        // empty this path adds zero reads. Otherwise the scope rows identify which
+        // targets enforce, and only those rows load in full for validation — the
+        // one payload is validated against each enforcing row's own context.
+        if (enforcing.size > 0) {
+            const rows = scopeRows ?? await escalationService.getEscalationScopeRows(ids);
+            const involved = rows.filter((r) => enforcing.has(r.role)).map((r) => r.id);
+            if (involved.length > 0) {
+                const fullRows = await escalationService.getEscalationsByIds(involved);
+                const failed = [];
+                for (const row of fullRows) {
+                    const report = await (0, resolver_validation_1.checkResolverPayload)(row, resolverPayload);
+                    if (report)
+                        failed.push({ id: row.id, report });
+                }
+                if (failed.length > 0)
+                    return bulkValidationFailure(failed);
+            }
+        }
         const resolved = await escalationService.resolveEscalationsByIds(ids, resolverPayload, metadata);
         return { status: 200, data: { resolved: resolved.length, escalationIds: resolved.map((e) => e.id) } };
     }
@@ -286,6 +323,24 @@ async function resolveAllOrNone(input, auth) {
             const error = 'One or more escalations require the single-resolve path (legacy signal routing)';
             return { status: 409, error, data: { error, failedIds: failed.map((f) => f.id), failed } };
         }
+        // Schema enforcement (enforce_schema roles): every item validates against
+        // its own row's context before ANYTHING resolves — all-or-none extends to
+        // validation. Rows are already in hand, so the only added reads are the
+        // cached schemas of enforcing roles.
+        const enforcing = await (0, enforcement_cache_1.getEnforcingRoles)();
+        if (enforcing.size > 0) {
+            const failed = [];
+            for (const item of items) {
+                const row = rowById.get(item.id);
+                if (!row || !row.role || !enforcing.has(row.role))
+                    continue;
+                const report = await (0, resolver_validation_1.checkResolverPayload)(row, item.resolverPayload);
+                if (report)
+                    failed.push({ id: item.id, report });
+            }
+            if (failed.length > 0)
+                return bulkValidationFailure(failed);
+        }
         // Per-row password redaction against each row's own form schema — the
         // payload enters the signal store and the audit record; plaintext never.
         const serviceItems = await Promise.all(items.map(async (item) => ({
@@ -448,6 +503,30 @@ function signaledResult(escalation, workflowId) {
         data: { signaled: true, escalationId: escalation.id, workflowId },
     };
 }
+/**
+ * The canonical 422 for a schema-validation rejection. The full body rides in
+ * `data` (routes serialize `data ?? { error }`), so every transport — HTTP,
+ * SDK, CLI, dashboard — receives the same shape: error, code, violations,
+ * role, schemaVersion. `code` also sits on the envelope for SDK branching.
+ */
+function validationFailure(report) {
+    const body = (0, resolver_validation_1.toValidationErrorBody)(report);
+    return { status: 422, error: body.error, code: body.code, data: body };
+}
+/**
+ * The bulk-surface 422: violations from every failing row, each tagged with
+ * its escalationId so callers can attribute them. Role/schemaVersion echo the
+ * first failing report (bulk resolves target homogeneous role groups).
+ */
+function bulkValidationFailure(failed) {
+    const violations = failed.flatMap(({ id, report }) => report.violations.map((v) => ({ ...v, escalationId: id })));
+    const body = {
+        ...(0, resolver_validation_1.toValidationErrorBody)(failed[0].report),
+        error: `resolverPayload failed schema validation for ${failed.length} escalation${failed.length === 1 ? '' : 's'} (${violations.length} violation${violations.length === 1 ? '' : 's'})`,
+        violations,
+    };
+    return { status: 422, error: body.error, code: body.code, data: body };
+}
 /** Replace password fields with ephemeral tokens so plaintext never enters the signal store. */
 async function redactPasswords(payload, formSchema) {
     if (!formSchema?.properties)

package/build/api/roles.d.ts

@@ -104,6 +104,8 @@ export declare function updateRole(input: {
     priority_threshold_minutes?: number | null;
     /** Escalation metadata key holding the age origin (ISO 8601 UTC timestamp). Falls back to created_at. */
     priority_facet?: string | null;
+    /** Turn server-side resolver schema validation on/off for this role. */
+    enforce_schema?: boolean;
     /** Replace the upstream-input set (omitted = preserve; null or [] = clear). */
     upstream_roles?: string[] | null;
     /** Recorded on the schema snapshot when this update changes a schema field. */

package/build/api/roles.js

@@ -225,6 +225,9 @@ async function updateRole(input) {
         if (input.ops_visible !== undefined && typeof input.ops_visible !== 'boolean') {
             return { status: 400, error: 'ops_visible must be a boolean' };
         }
+        if (input.enforce_schema !== undefined && typeof input.enforce_schema !== 'boolean') {
+            return { status: 400, error: 'enforce_schema must be a boolean' };
+        }
         if (input.parent_role != null && input.parent_role === input.role) {
             return { status: 400, error: 'parent_role must reference a different role' };
         }
@@ -265,6 +268,7 @@ async function updateRole(input) {
             worker_count: input.worker_count,
             priority_threshold_minutes: input.priority_threshold_minutes,
             priority_facet: input.priority_facet,
+            enforce_schema: input.enforce_schema,
             upstream_roles: input.upstream_roles,
             change_summary: input.change_summary,
         });

package/build/bin/ltc.js

@@ -62,7 +62,16 @@ const envLoaded = fs.existsSync(envPath);
 // ── Error handler ────────────────────────────────────────────────────────
 function handleError(err) {
     const msg = err.message || String(err);
-    console.error(`\n  ${picocolors_1.default.red('✗')} ${msg}\n`);
+    console.error(`\n  ${picocolors_1.default.red('✗')} ${msg}`);
+    // Schema-validation rejections carry field-level violations — print each
+    // one the way the dashboard's errors panel lists them.
+    if (Array.isArray(err.violations)) {
+        for (const v of err.violations) {
+            const where = v.escalationId ? `${v.escalationId} · ${v.field}` : v.field;
+            console.error(`    ${picocolors_1.default.dim('·')} ${picocolors_1.default.bold(where)} — ${v.message}`);
+        }
+    }
+    console.error('');
     process.exit(1);
 }
 function wrap(fn) {

package/build/index.js

@@ -40,6 +40,7 @@ exports.registerMcpTool = exports.getToolContext = exports.getActivityIdentity =
 exports.LTExpressAdapter = exports.api = exports.KnowledgeApi = exports.resolveCredential = exports.mimeFromPath = exports.getStorageBackend = exports.listOAuthConnections = exports.getFreshAccessToken = exports.createClient = exports.CallbackEventAdapter = exports.builtinMcpServerFactories = exports.getSystemAgents = exports.getSystemWorkers = void 0;
 const config_1 = require("./modules/config");
 const logger_1 = require("./lib/logger");
+const midnight_1 = require("./examples/themes/midnight");
 const start_1 = require("./start");
 // ─── Package Exports ─────────────────────────────────────────────────────────
 var start_2 = require("./start");
@@ -170,7 +171,12 @@ async function main() {
         escalation: {
             strategy: 'mcp',
         },
-        branding: process.env.WHITE_LABEL ? { appName: process.env.WHITE_LABEL } : undefined,
+        branding: {
+            ...(process.env.WHITE_LABEL ? { appName: process.env.WHITE_LABEL } : {}),
+            // Midnight ships as a registered theme — the working proof that a
+            // deployment-supplied stylesheet controls the entire design system.
+            themes: [midnight_1.midnightTheme],
+        },
         telemetry: honeycombKey ? { honeycomb: { apiKey: honeycombKey } } : undefined,
         events: config_1.config.EVENT_TRANSPORT === 'nats'
             ? { nats: { url: config_1.config.NATS_URL, wsUrl: config_1.config.NATS_WS_URL || undefined, token: config_1.config.NATS_TOKEN || undefined } }

package/build/lib/cli/client.d.ts

@@ -1,6 +1,9 @@
+import { type LTFieldViolation } from '../../types/validation';
 export declare class CLIError extends Error {
     status?: number | undefined;
-    constructor(message: string, status?: number | undefined);
+    /** Field-level violations from a schema_validation 422, when present. */
+    violations?: LTFieldViolation[];
+    constructor(message: string, status?: number | undefined, violations?: LTFieldViolation[]);
 }
 /** Authenticated fetch against the Long Tail API */
 export declare function apiFetch<T = any>(path: string, options?: RequestInit): Promise<T>;

package/build/lib/cli/client.js

@@ -3,11 +3,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CLIError = void 0;
 exports.apiFetch = apiFetch;
 const auth_1 = require("./auth");
+const validation_1 = require("../../types/validation");
 class CLIError extends Error {
-    constructor(message, status) {
+    constructor(message, status, violations) {
         super(message);
         this.status = status;
         this.name = 'CLIError';
+        this.violations = violations;
     }
 }
 exports.CLIError = CLIError;
@@ -25,7 +27,7 @@ async function apiFetch(path, options) {
     });
     const body = await res.json().catch(() => ({ error: `HTTP ${res.status}` }));
     if (!res.ok) {
-        throw new CLIError(body.error || `HTTP ${res.status}`, res.status);
+        throw new CLIError(body.error || `HTTP ${res.status}`, res.status, (0, validation_1.isValidationErrorBody)(body) ? body.violations : undefined);
     }
     return body;
 }

package/build/lib/db/schemas/023_role_enforce_schema.sql

@@ -0,0 +1,18 @@
+-- Migration 023: Role-level resolver schema enforcement
+--
+-- enforce_schema makes the role's form_schema an enforced API contract: every
+-- resolve surface (by id, by signal key, by ids, all-or-none, by metadata, and
+-- the MCP resolve tools) validates the submitted resolverPayload against the
+-- escalation's resolved form schema (metadata.form_schema override, else the
+-- pinned lt_role_schemas snapshot, else the role's latest) and rejects
+-- violations with 422 before any state changes. The validation pass is the
+-- same isomorphic code the dashboard runs pre-submission, so a payload that
+-- passes the client panel passes the gate and a 422 carries the identical
+-- field-error list.
+--
+-- Opt-in per role (default false) so surfaces migrate deliberately: flip it on
+-- a role once its submitters (dashboard, sim workforce, webhooks) are known to
+-- send complete payloads. Roles with it off resolve exactly as before.
+
+ALTER TABLE lt_roles
+  ADD COLUMN IF NOT EXISTS enforce_schema BOOLEAN NOT NULL DEFAULT false;

package/build/lib/typed-resolution.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Typed resolution parsing — the workflow-side half of the resolver contract.
+ *
+ * Server-side enforcement (enforce_schema roles) guarantees a resolution
+ * matched the role's form schema when it was submitted. This module gives
+ * workflow and activity code the consuming half: declare the payload shape
+ * once as a zod schema, and parse the resolution through it to get a TYPED
+ * value with runtime assurance — a drifted or legacy payload fails loud here
+ * instead of propagating `any` into business logic.
+ *
+ *   const IntakeV1 = z.object({ customer: z.object({ name: z.string() }) });
+ *   const intake = parseResolverPayload(IntakeV1, response);
+ *   intake.customer.name; // typed AND runtime-checked
+ */
+import type { ZodType } from 'zod';
+import type { LTFieldViolation } from '../types/validation';
+/**
+ * A resolution that failed its declared zod schema. Carries the same
+ * `{ field, message }` violation list the validation surfaces use, and the
+ * original ZodError as `cause`.
+ */
+export declare class ResolverPayloadTypeError extends Error {
+    violations: LTFieldViolation[];
+    cause?: unknown;
+    constructor(violations: LTFieldViolation[], options?: {
+        cause?: unknown;
+    });
+}
+/**
+ * Parse a resolution payload through its declared zod schema. Returns the
+ * typed value; throws {@link ResolverPayloadTypeError} when the payload does
+ * not conform. The generic flows from the schema to the return value — no
+ * casting at the call site.
+ */
+export declare function parseResolverPayload<T>(schema: ZodType<T>, payload: unknown): T;

package/build/lib/typed-resolution.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ResolverPayloadTypeError = void 0;
+exports.parseResolverPayload = parseResolverPayload;
+/**
+ * A resolution that failed its declared zod schema. Carries the same
+ * `{ field, message }` violation list the validation surfaces use, and the
+ * original ZodError as `cause`.
+ */
+class ResolverPayloadTypeError extends Error {
+    constructor(violations, options) {
+        const n = violations.length;
+        super(`resolver payload failed its declared schema (${n} violation${n === 1 ? '' : 's'}): `
+            + violations.map((v) => `${v.field}: ${v.message}`).join('; '));
+        this.name = 'ResolverPayloadTypeError';
+        this.violations = violations;
+        this.cause = options?.cause;
+    }
+}
+exports.ResolverPayloadTypeError = ResolverPayloadTypeError;
+/**
+ * Parse a resolution payload through its declared zod schema. Returns the
+ * typed value; throws {@link ResolverPayloadTypeError} when the payload does
+ * not conform. The generic flows from the schema to the return value — no
+ * casting at the call site.
+ */
+function parseResolverPayload(schema, payload) {
+    const result = schema.safeParse(payload);
+    if (!result.success) {
+        const violations = result.error.issues.map((issue) => ({
+            field: issue.path.length > 0 ? issue.path.join('.') : '(root)',
+            message: issue.message,
+        }));
+        throw new ResolverPayloadTypeError(violations, { cause: result.error });
+    }
+    return result.data;
+}

package/build/modules/branding.d.ts

@@ -4,10 +4,29 @@
  * The `appName` defaults to 'LongTail' and can be overridden via the
  * `branding` block of the `start()` config — no env-var required, since
  * this is a per-deployment product decision, not an ops toggle.
+ *
+ * `customCss` and `themes` carry the deployment's design-system overrides.
+ * Theme metadata (id, label, swatch, dark) rides the /api/settings JSON so
+ * the picker can render; the CSS itself is served separately at
+ * GET /api/settings/custom.css so the browser caches it as a stylesheet.
  */
-export declare function configureBranding(patch?: {
+export interface LTBrandingTheme {
+    id: string;
+    label: string;
+    swatch: string;
+    css: string;
+    dark?: boolean;
+}
+export interface LTBrandingConfig {
     appName?: string;
-}): void;
+    customCss?: string;
+    themes?: LTBrandingTheme[];
+}
+export declare function configureBranding(patch?: LTBrandingConfig): void;
+/** Metadata only — the CSS never rides the settings JSON. */
 export declare function getBranding(): {
     appName: string;
+    themes: Array<Omit<LTBrandingTheme, 'css'>>;
 };
+/** The full stylesheet served at /api/settings/custom.css. */
+export declare function getCustomCss(): string;

package/build/modules/branding.js

@@ -5,15 +5,36 @@
  * The `appName` defaults to 'LongTail' and can be overridden via the
  * `branding` block of the `start()` config — no env-var required, since
  * this is a per-deployment product decision, not an ops toggle.
+ *
+ * `customCss` and `themes` carry the deployment's design-system overrides.
+ * Theme metadata (id, label, swatch, dark) rides the /api/settings JSON so
+ * the picker can render; the CSS itself is served separately at
+ * GET /api/settings/custom.css so the browser caches it as a stylesheet.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.configureBranding = configureBranding;
 exports.getBranding = getBranding;
+exports.getCustomCss = getCustomCss;
 let _appName = 'LongTail';
+let _customCss = '';
+let _themes = [];
 function configureBranding(patch) {
     if (patch?.appName)
         _appName = patch.appName;
+    if (typeof patch?.customCss === 'string')
+        _customCss = patch.customCss;
+    if (Array.isArray(patch?.themes))
+        _themes = patch.themes;
 }
+/** Metadata only — the CSS never rides the settings JSON. */
 function getBranding() {
-    return { appName: _appName };
+    return {
+        appName: _appName,
+        themes: _themes.map(({ id, label, swatch, dark }) => ({ id, label, swatch, dark })),
+    };
+}
+/** The full stylesheet served at /api/settings/custom.css. */
+function getCustomCss() {
+    const parts = [_customCss, ..._themes.map((t) => t.css)].filter(Boolean);
+    return parts.join('\n\n');
 }

package/build/modules/config.d.ts

@@ -12,5 +12,6 @@ export declare const config: {
     NODE_ENV: string;
     JWT_SECRET: string;
     HONEYCOMB_API_KEY: string;
+    ROLE_ENFORCEMENT_CACHE_TTL_MS: number;
 };
 export declare const postgres_options: Record<string, unknown>;

package/build/modules/config.js

@@ -19,6 +19,11 @@ exports.config = {
     NODE_ENV: process.env.NODE_ENV || 'development',
     JWT_SECRET: process.env.JWT_SECRET || '',
     HONEYCOMB_API_KEY: process.env.HONEYCOMB_API_KEY || '',
+    // Resolver schema enforcement: TTL for the cached enforcing-role set and
+    // latest role form schemas. Bounds cross-container staleness after a role
+    // admin flips enforce_schema or edits a schema; pinned snapshots are
+    // immutable and cache indefinitely.
+    ROLE_ENFORCEMENT_CACHE_TTL_MS: parseInt(process.env.ROLE_ENFORCEMENT_CACHE_TTL_MS || '30000', 10),
 };
 exports.postgres_options = {
     host: exports.config.POSTGRES_HOST,

package/build/routes/bot-accounts.js

@@ -43,12 +43,14 @@ router.use(auth_1.requireBuilder);
 /**
  * GET /api/bot-accounts
  * List all bot accounts.
- * Query: ?limit=50&offset=0
+ * Query: ?limit=50&offset=0&status=active&search=mcp
  */
 router.get('/', async (req, res) => {
     const result = await api.listBots({
         limit: req.query.limit ? parseInt(req.query.limit, 10) : undefined,
         offset: req.query.offset ? parseInt(req.query.offset, 10) : undefined,
+        status: req.query.status || undefined,
+        search: req.query.search || undefined,
     });
     res.status(result.status).json(result.data ?? { error: result.error });
 });

package/build/routes/settings.js

@@ -33,8 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+const crypto_1 = require("crypto");
 const express_1 = require("express");
 const api = __importStar(require("../api/settings"));
+const branding_1 = require("../modules/branding");
 const router = (0, express_1.Router)();
 /**
  * GET /api/settings
@@ -44,4 +46,23 @@ router.get('/', async (req, res) => {
     const result = await api.getSettings(req);
     res.status(result.status).json(result.data ?? { error: result.error });
 });
+/**
+ * GET /api/settings/custom.css
+ * The deployment's registered design-system overrides (branding.customCss +
+ * registered theme blocks). Always 200 text/css — empty when nothing is
+ * registered — so the dashboard references it unconditionally with no flash
+ * and no conditional logic. ETag lets the browser cache it across loads.
+ */
+router.get('/custom.css', (req, res) => {
+    const css = (0, branding_1.getCustomCss)();
+    const etag = `"${(0, crypto_1.createHash)('sha1').update(css).digest('hex')}"`;
+    if (req.headers['if-none-match'] === etag) {
+        res.status(304).end();
+        return;
+    }
+    res.setHeader('Content-Type', 'text/css; charset=utf-8');
+    res.setHeader('ETag', etag);
+    res.setHeader('Cache-Control', 'no-cache');
+    res.status(200).send(css);
+});
 exports.default = router;

package/build/sdk/index.d.ts

@@ -466,3 +466,7 @@ export declare function createClient(options?: LTClientOptions): {
 };
 /** The return type of createClient(). */
 export type LTClient = ReturnType<typeof createClient>;
+export { LT_ERROR_CODES, isValidationErrorBody, } from '../types/validation';
+export type { LTErrorCode, LTFieldViolation, LTValidationErrorBody, } from '../types/validation';
+export type { LTApiAuth, LTApiResult } from '../types/sdk';
+export { parseResolverPayload, ResolverPayloadTypeError } from '../lib/typed-resolution';

package/build/sdk/index.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.ResolverPayloadTypeError = exports.parseResolverPayload = exports.isValidationErrorBody = exports.LT_ERROR_CODES = void 0;
 exports.createClient = createClient;
 const tasksApi = __importStar(require("../api/tasks"));
 const escalationsApi = __importStar(require("../api/escalations"));
@@ -365,3 +366,16 @@ function createClient(options = {}) {
         },
     };
 }
+// ── Canonical error shapes ──────────────────────────────────────────────
+// A 422 from any resolve surface carries the full LTValidationErrorBody in
+// `result.data` with `result.code === LT_ERROR_CODES.SCHEMA_VALIDATION`.
+// `isValidationErrorBody(result.data)` narrows it for typed handling.
+var validation_1 = require("../types/validation");
+Object.defineProperty(exports, "LT_ERROR_CODES", { enumerable: true, get: function () { return validation_1.LT_ERROR_CODES; } });
+Object.defineProperty(exports, "isValidationErrorBody", { enumerable: true, get: function () { return validation_1.isValidationErrorBody; } });
+// ── Typed resolution parsing ────────────────────────────────────────────
+// Workflow/activity code declares its payload shape as a zod schema and
+// parses resolutions through it — typed values with runtime assurance.
+var typed_resolution_1 = require("../lib/typed-resolution");
+Object.defineProperty(exports, "parseResolverPayload", { enumerable: true, get: function () { return typed_resolution_1.parseResolverPayload; } });
+Object.defineProperty(exports, "ResolverPayloadTypeError", { enumerable: true, get: function () { return typed_resolution_1.ResolverPayloadTypeError; } });