@hotmeshio/long-tail 0.13.0 → 0.14.0

package/build/api/announcements.d.ts

@@ -0,0 +1,22 @@
+import type { LTApiResult, LTApiAuth } from '../types/sdk';
+/**
+ * Dashboard announcements — broadcast notices on the dashboard surface.
+ * Publishing is a role-manager act (superadmin/admin/engineer via the route
+ * guard); reading is any authenticated user, server-filtered to their roles.
+ * Role targeting is display scoping only: the live event reaches every
+ * authenticated subscriber, so bodies must never carry secrets.
+ */
+/** Create an announcement. Only `body` is required — everything else defaults. */
+export declare function createAnnouncement(input: {
+    body?: string;
+    title?: string;
+    layout?: string;
+    roles?: string[];
+    expiresAt?: string;
+}, auth: LTApiAuth): Promise<LTApiResult>;
+/** Active announcements for the caller — admins see all, others their roles' slice. */
+export declare function listAnnouncements(auth: LTApiAuth): Promise<LTApiResult>;
+/** Remove an announcement; subscribers see it drop live. */
+export declare function deleteAnnouncement(input: {
+    id: string;
+}, _auth: LTApiAuth): Promise<LTApiResult>;

package/build/api/announcements.js

@@ -0,0 +1,96 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAnnouncement = createAnnouncement;
+exports.listAnnouncements = listAnnouncements;
+exports.deleteAnnouncement = deleteAnnouncement;
+const announcementService = __importStar(require("../services/announcement"));
+const publish_1 = require("../lib/events/publish");
+const user_1 = require("../services/user");
+/**
+ * Dashboard announcements — broadcast notices on the dashboard surface.
+ * Publishing is a role-manager act (superadmin/admin/engineer via the route
+ * guard); reading is any authenticated user, server-filtered to their roles.
+ * Role targeting is display scoping only: the live event reaches every
+ * authenticated subscriber, so bodies must never carry secrets.
+ */
+/** Create an announcement. Only `body` is required — everything else defaults. */
+async function createAnnouncement(input, auth) {
+    try {
+        if (!input.body?.trim()) {
+            return { status: 400, error: 'body is required' };
+        }
+        const announcement = await announcementService.createAnnouncement({
+            body: input.body,
+            title: input.title,
+            layout: input.layout,
+            roles: input.roles,
+            expiresAt: input.expiresAt,
+            createdBy: auth.userId,
+        });
+        await (0, publish_1.publishAnnouncementEvent)({ type: 'announcement.created', announcement });
+        return { status: 200, data: announcement };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}
+/** Active announcements for the caller — admins see all, others their roles' slice. */
+async function listAnnouncements(auth) {
+    try {
+        const unscoped = auth.role === 'superadmin' || auth.role === 'admin';
+        const roles = unscoped
+            ? null
+            : (await (0, user_1.getUserRoles)(auth.userId)).map((r) => r.role);
+        const announcements = await announcementService.listActiveAnnouncements(roles);
+        return { status: 200, data: { announcements } };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}
+/** Remove an announcement; subscribers see it drop live. */
+async function deleteAnnouncement(input, _auth) {
+    try {
+        const deleted = await announcementService.deleteAnnouncement(input.id);
+        if (!deleted)
+            return { status: 404, error: 'announcement not found' };
+        await (0, publish_1.publishAnnouncementEvent)({ type: 'announcement.deleted', announcement: deleted });
+        return { status: 200, data: { deleted: true, id: input.id } };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}

package/build/api/auth-sso.d.ts

@@ -1,12 +1,15 @@
-import type { Request } from 'express';
+import type { Request, Response } from 'express';
 import type { LTApiResult } from '../types/sdk';
 /**
  * Exchange host authentication for a Long Tail JWT.
  *
- * Calls `sso.resolve(req)` to extract the host identity, JIT provisions
+ * Calls `sso.resolve(req, res)` to extract the host identity, JIT provisions
  * the user in `lt_users`, and returns a signed JWT the dashboard can
  * store for subsequent API calls.
  *
  * No request body required — the host's cookies/headers carry the auth.
+ * `res` gives cookie-owning hosts the response handle at the exchange
+ * boundary (login and every keepalive beat) to set/refresh their session
+ * cookie — headers only; the route writes the response body.
  */
-export declare function exchangeSSO(req: Request): Promise<LTApiResult>;
+export declare function exchangeSSO(req: Request, res?: Response): Promise<LTApiResult>;

package/build/api/auth-sso.js

@@ -7,19 +7,22 @@ const auth_1 = require("../modules/auth");
 /**
  * Exchange host authentication for a Long Tail JWT.
  *
- * Calls `sso.resolve(req)` to extract the host identity, JIT provisions
+ * Calls `sso.resolve(req, res)` to extract the host identity, JIT provisions
  * the user in `lt_users`, and returns a signed JWT the dashboard can
  * store for subsequent API calls.
  *
  * No request body required — the host's cookies/headers carry the auth.
+ * `res` gives cookie-owning hosts the response handle at the exchange
+ * boundary (login and every keepalive beat) to set/refresh their session
+ * cookie — headers only; the route writes the response body.
  */
-async function exchangeSSO(req) {
+async function exchangeSSO(req, res) {
     try {
         const ssoConfig = (0, sso_1.getSSOConfig)();
         if (!ssoConfig) {
             return { status: 404, error: 'SSO not configured' };
         }
-        const identity = await ssoConfig.resolve(req);
+        const identity = await ssoConfig.resolve(req, res);
         if (!identity) {
             return { status: 401, error: 'Host authentication required' };
         }

package/build/api/escalations/list.d.ts

@@ -11,6 +11,14 @@ export interface FacetInput {
     /** Only rows past their role's priority threshold — see FacetQuery.jeopardy. */
     jeopardy?: boolean;
     orderBy?: FacetOrder[];
+    /**
+     * List rows omit the two heavyweight JSON columns (`envelope`,
+     * `escalation_payload`) by default — at scale they dominate the payload.
+     * Pass `'envelope'` to restore both (list schemas interpolating
+     * `{{envelope.*}}`/`{{payload.*}}` need them). The single-item GET always
+     * carries the full record.
+     */
+    include?: string;
 }
 /**
  * List escalations with optional filters.

package/build/api/escalations/list.js

@@ -42,6 +42,16 @@ exports.getStationMetrics = getStationMetrics;
 const escalationService = __importStar(require("../../services/escalation"));
 const features_1 = require("../../modules/features");
 const helpers_1 = require("./helpers");
+/** Strip the heavyweight JSON columns from list rows unless asked back. */
+function projectListRows(rows, include) {
+    if (include === 'envelope')
+        return rows;
+    return rows.map(({ envelope: _e, escalation_payload: _p, ...rest }) => rest);
+}
+/** Apply the list projection to a { escalations, ... } service result. */
+function projectListResult(result, include) {
+    return { ...result, escalations: projectListRows(result.escalations, include) };
+}
 /** True when the caller asked for anything the plain list path can't express. */
 function hasFacetQuery(i) {
     return !!(i.facets ||
@@ -107,7 +117,7 @@ async function listEscalations(input, auth) {
                 limit: input.limit ?? 50,
                 offset: input.offset ?? 0,
             });
-            return { status: 200, data: result };
+            return { status: 200, data: projectListResult(result, input.include) };
         }
         const result = await escalationService.listEscalations({
             status: input.status,
@@ -127,7 +137,7 @@ async function listEscalations(input, auth) {
             selfRoles: scope.global ? undefined : scope.selfRoles,
             meUserId: auth.userId,
         });
-        return { status: 200, data: result };
+        return { status: 200, data: projectListResult(result, input.include) };
     }
     catch (err) {
         return { status: 500, error: err.message };
@@ -182,7 +192,7 @@ async function listAvailableEscalations(input, auth) {
                 limit: input.limit ?? 50,
                 offset: input.offset ?? 0,
             });
-            return { status: 200, data: result };
+            return { status: 200, data: projectListResult(result, input.include) };
         }
         const result = await escalationService.listAvailableEscalations({
             role: input.role,
@@ -198,7 +208,7 @@ async function listAvailableEscalations(input, auth) {
             selfRoles: scope.global ? undefined : scope.selfRoles,
             meUserId: auth.userId,
         });
-        return { status: 200, data: result };
+        return { status: 200, data: projectListResult(result, input.include) };
     }
     catch (err) {
         return { status: 500, error: err.message };

package/build/api/index.d.ts

@@ -18,3 +18,4 @@ export * as workflowSets from './workflow-sets';
 export * as dba from './dba';
 export * as namespaces from './namespaces';
 export * as maintenance from './maintenance';
+export * as announcements from './announcements';

package/build/api/index.js

@@ -33,7 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.maintenance = exports.namespaces = exports.dba = exports.workflowSets = exports.botAccounts = exports.controlplane = exports.exports = exports.settings = exports.insight = exports.mcpRuns = exports.pipelines = exports.mcp = exports.auth = exports.personas = exports.roles = exports.users = exports.yamlWorkflows = exports.workflows = exports.escalations = exports.tasks = void 0;
+exports.announcements = exports.maintenance = exports.namespaces = exports.dba = exports.workflowSets = exports.botAccounts = exports.controlplane = exports.exports = exports.settings = exports.insight = exports.mcpRuns = exports.pipelines = exports.mcp = exports.auth = exports.personas = exports.roles = exports.users = exports.yamlWorkflows = exports.workflows = exports.escalations = exports.tasks = void 0;
 exports.tasks = __importStar(require("./tasks"));
 exports.escalations = __importStar(require("./escalations"));
 exports.workflows = __importStar(require("./workflows"));
@@ -54,3 +54,4 @@ exports.workflowSets = __importStar(require("./workflow-sets"));
 exports.dba = __importStar(require("./dba"));
 exports.namespaces = __importStar(require("./namespaces"));
 exports.maintenance = __importStar(require("./maintenance"));
+exports.announcements = __importStar(require("./announcements"));

package/build/api/workflows/config.d.ts

@@ -55,6 +55,7 @@ export declare function upsertWorkflowConfig(input: {
     envelope_schema?: any;
     resolver_schema?: any;
     cron_schedule?: string | null;
+    read_safe?: boolean;
 }): Promise<LTApiResult>;
 /**
  * Delete a workflow configuration.

package/build/api/workflows/config.js

@@ -120,6 +120,7 @@ async function upsertWorkflowConfig(input) {
             envelope_schema: input.envelope_schema ?? null,
             resolver_schema: input.resolver_schema ?? null,
             cron_schedule: input.cron_schedule ?? null,
+            read_safe: input.read_safe ?? false,
         });
         ltconfig_1.ltConfig.invalidate();
         await cron_1.cronRegistry.restartCron(config);

package/build/api/workflows/discovery.js

@@ -113,6 +113,7 @@ async function listDiscoveredWorkflows(input) {
                 registered: !!config,
                 active: !!worker,
                 invocable: config?.invocable ?? !!worker,
+                read_safe: config?.read_safe ?? false,
                 system: registry_1.SYSTEM_WORKFLOWS.has(workflowType),
                 description: config?.description ?? null,
                 roles: config?.roles ?? [],

package/build/lib/db/schemas/031_announcements.sql

@@ -0,0 +1,30 @@
+-- Migration 031: Dashboard announcements
+--
+-- Broadcast notices for the dashboard surface (system.surfaces.dashboard).
+-- Role targeting is display scoping only — live events reach every
+-- authenticated socket, so a body must never carry secrets. Rows expire by
+-- timestamp; dismissal is per-browser on the client.
+
+CREATE TABLE IF NOT EXISTS lt_announcements (
+  id         UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  title      TEXT,
+  body       TEXT NOT NULL,
+  layout     TEXT NOT NULL DEFAULT 'banner',
+  roles      TEXT[] NOT NULL DEFAULT '{}',
+  created_by TEXT,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  expires_at TIMESTAMPTZ NOT NULL DEFAULT NOW() + INTERVAL '24 hours'
+);
+
+CREATE INDEX IF NOT EXISTS idx_lt_announcements_expires ON lt_announcements (expires_at);
+
+-- The announcement topic (system.surfaces.dashboard) introduces the
+-- 'surfaces' category to the topic catalog.
+ALTER TABLE lt_topic_catalog
+  DROP CONSTRAINT IF EXISTS lt_topic_catalog_category_check;
+
+ALTER TABLE lt_topic_catalog
+  ADD CONSTRAINT lt_topic_catalog_category_check
+  CHECK (category IN (
+    'task','workflow','escalation','activity','knowledge','file','agent','app','milestone','surfaces'
+  ));

package/build/lib/db/schemas/032_workflow_read_safe.sql

@@ -0,0 +1,9 @@
+-- Migration 032: read-safe workflow flag
+--
+-- Marks a workflow as side-effect-free for external MCP callers: the
+-- invoke_workflow_read_safe tool (manifest read_safe: true) starts only
+-- workflows carrying this flag, extending the tool-manifest read-scope
+-- contract to workflow invocation. Fail-closed: unset means not read-safe.
+
+ALTER TABLE lt_config_workflows
+  ADD COLUMN IF NOT EXISTS read_safe BOOLEAN NOT NULL DEFAULT false;

package/build/lib/events/publish.d.ts

@@ -64,6 +64,21 @@ export declare function publishActivityEvent(params: {
     activityName: string;
     data?: Record<string, any>;
 }): Promise<void>;
+/**
+ * The dashboard-surface broadcast subject. Announcements publish here and the
+ * dashboard subscribes; the payload is the announcement row (small by
+ * nature). Delivery reaches every authenticated socket — role targeting is
+ * display scoping, never confidentiality.
+ */
+export declare const ANNOUNCEMENT_TOPIC = "system.surfaces.dashboard";
+/**
+ * Publish a dashboard announcement event.
+ * Subject: system.surfaces.dashboard (fixed — one surface, one channel)
+ */
+export declare function publishAnnouncementEvent(params: {
+    type: 'announcement.created' | 'announcement.deleted';
+    announcement: Record<string, any>;
+}): Promise<void>;
 /**
  * Publish a knowledge lifecycle event.
  * Subject: system.knowledge.{domain}.{action}

package/build/lib/events/publish.js

@@ -1,9 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.ANNOUNCEMENT_TOPIC = void 0;
 exports.publishMilestoneEvent = publishMilestoneEvent;
 exports.publishTaskEvent = publishTaskEvent;
 exports.publishEscalationEvent = publishEscalationEvent;
 exports.publishActivityEvent = publishActivityEvent;
+exports.publishAnnouncementEvent = publishAnnouncementEvent;
 exports.publishKnowledgeEvent = publishKnowledgeEvent;
 exports.publishFileEvent = publishFileEvent;
 exports.publishAgentEvent = publishAgentEvent;
@@ -104,6 +106,26 @@ function publishActivityEvent(params) {
         timestamp: new Date().toISOString(),
     });
 }
+/**
+ * The dashboard-surface broadcast subject. Announcements publish here and the
+ * dashboard subscribes; the payload is the announcement row (small by
+ * nature). Delivery reaches every authenticated socket — role targeting is
+ * display scoping, never confidentiality.
+ */
+exports.ANNOUNCEMENT_TOPIC = 'system.surfaces.dashboard';
+/**
+ * Publish a dashboard announcement event.
+ * Subject: system.surfaces.dashboard (fixed — one surface, one channel)
+ */
+function publishAnnouncementEvent(params) {
+    const action = params.type.split('.')[1];
+    return fireAndForget({
+        type: exports.ANNOUNCEMENT_TOPIC,
+        source: 'announcement',
+        data: { action, announcement: params.announcement },
+        timestamp: new Date().toISOString(),
+    });
+}
 /**
  * Publish a knowledge lifecycle event.
  * Subject: system.knowledge.{domain}.{action}

package/build/modules/auth.js

@@ -43,6 +43,7 @@ exports.signToken = signToken;
 const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
 const config_1 = require("./config");
 const sso_1 = require("./sso");
+const logger_1 = require("../lib/logger");
 const user_1 = require("../services/user");
 const sso_provision_1 = require("../services/user/sso-provision");
 const bot_api_key_1 = require("../services/auth/bot-api-key");
@@ -156,7 +157,10 @@ const requireAuth = async (req, res, next) => {
         const mw = _authMiddleware || createAuthMiddleware(new JwtAuthAdapter());
         return mw(req, res, next);
     }
-    // SSO fallback: no Bearer, but host may have authenticated via cookies/headers
+    // SSO fallback: no Bearer, but host may have authenticated via cookies/headers.
+    // `res` is deliberately NOT passed to resolve here: this path runs on every
+    // cookie-bearing request, and ambient API traffic must never slide the host
+    // session — only the explicit exchange (login + gated keepalive beat) does.
     const ssoConfig = (0, sso_1.getSSOConfig)();
     if (ssoConfig) {
         try {
@@ -177,8 +181,10 @@ const requireAuth = async (req, res, next) => {
                 return next();
             }
         }
-        catch {
-            // SSO resolve failed — fall through to 401
+        catch (err) {
+            // SSO resolve failed — fall through to 401, but leave a trace so host
+            // resolve errors are diagnosable.
+            logger_1.loggerRegistry.debug(`[long-tail] sso resolve failed on auth fallback: ${err?.message}`);
         }
     }
     // No Bearer, no SSO — delegate to standard middleware (returns 401)

package/build/routes/announcements.d.ts

@@ -0,0 +1,2 @@
+declare const router: import("express-serve-static-core").Router;
+export default router;

package/build/routes/announcements.js

@@ -0,0 +1,64 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const express_1 = require("express");
+const api = __importStar(require("../api/announcements"));
+const auth_1 = require("../modules/auth");
+const router = (0, express_1.Router)();
+/**
+ * Dashboard announcements. Publishing and removal are role-manager acts
+ * (superadmin, admin type, or engineer); any authenticated user reads their
+ * role-filtered slice. Targeting is display scoping — the live event
+ * broadcasts to every authenticated subscriber.
+ */
+router.get('/', async (req, res) => {
+    const result = await api.listAnnouncements(req.auth);
+    res.status(result.status).json(result.data ?? { error: result.error });
+});
+router.post('/', auth_1.requireRoleManager, async (req, res) => {
+    const result = await api.createAnnouncement({
+        body: req.body?.body,
+        title: req.body?.title,
+        layout: req.body?.layout,
+        roles: req.body?.roles,
+        expiresAt: req.body?.expiresAt,
+    }, req.auth);
+    res.status(result.status).json(result.data ?? { error: result.error });
+});
+router.delete('/:id', auth_1.requireRoleManager, async (req, res) => {
+    const result = await api.deleteAnnouncement({ id: String(req.params.id) }, req.auth);
+    res.status(result.status).json(result.data ?? { error: result.error });
+});
+exports.default = router;

package/build/routes/auth-sso.js

@@ -45,7 +45,12 @@ const router = (0, express_1.Router)();
  * login form with a transparent token exchange.
  */
 router.post('/sso', async (req, res) => {
-    const result = await api.exchangeSSO(req);
+    const result = await api.exchangeSSO(req, res);
+    // A host's resolve may only set headers on `res`; if one violates the
+    // contract and writes the response, degrade to a skipped beat instead of
+    // a headers-after-send crash.
+    if (res.headersSent)
+        return;
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 exports.default = router;

package/build/routes/escalations/list.js

@@ -109,6 +109,7 @@ function registerListRoutes(router) {
             orderBy: jsonParam(req.query.orderBy),
             available: req.query.available != null ? req.query.available === 'true' : undefined,
             jeopardy: req.query.jeopardy === '1' || req.query.jeopardy === 'true' || undefined,
+            include: req.query.include,
         }, req.auth);
         res.status(result.status).json(result.data ?? { error: result.error });
     });
@@ -136,6 +137,7 @@ function registerListRoutes(router) {
             exists: jsonParam(req.query.exists),
             orderBy: jsonParam(req.query.orderBy),
             jeopardy: req.query.jeopardy === '1' || req.query.jeopardy === 'true' || undefined,
+            include: req.query.include,
         }, req.auth);
         res.status(result.status).json(result.data ?? { error: result.error });
     });

package/build/routes/index.js

@@ -38,6 +38,7 @@ const topics_1 = __importDefault(require("./topics"));
 const nats_credentials_1 = __importDefault(require("./nats-credentials"));
 const scan_codes_1 = __importDefault(require("./scan-codes"));
 const domain_1 = __importDefault(require("./domain"));
+const announcements_1 = __importDefault(require("./announcements"));
 const router = (0, express_1.Router)();
 // Public routes (no auth required — they handle their own auth)
 router.use('/auth', auth_2.default);
@@ -76,6 +77,7 @@ router.use('/capabilities', capabilities_1.default);
 router.use('/topics', topics_1.default);
 router.use('/scan-codes', scan_codes_1.default);
 router.use('/domain', domain_1.default);
+router.use('/announcements', announcements_1.default);
 const overview_1 = __importDefault(require("./overview"));
 router.use('/overview', overview_1.default);
 const diagnostics_1 = __importDefault(require("./diagnostics"));

package/build/services/announcement/index.d.ts

@@ -0,0 +1,30 @@
+/**
+ * A dashboard announcement — a broadcast notice on the dashboard surface.
+ * Role targeting is display scoping only (live events reach every
+ * authenticated socket); bodies must never carry secrets.
+ */
+export interface LTAnnouncement {
+    id: string;
+    title: string | null;
+    /** Markdown. */
+    body: string;
+    layout: string;
+    /** Empty = everyone; otherwise shown to holders of any named role. */
+    roles: string[];
+    created_by: string | null;
+    created_at: string;
+    expires_at: string;
+}
+/** Only the body is required; everything else has a liberal default (24h expiry). */
+export declare function createAnnouncement(input: {
+    body: string;
+    title?: string;
+    layout?: string;
+    roles?: string[];
+    createdBy?: string;
+    expiresAt?: string;
+}): Promise<LTAnnouncement>;
+/** Active announcements visible to a viewer; null roles = the unscoped admin view. */
+export declare function listActiveAnnouncements(userRoles: string[] | null): Promise<LTAnnouncement[]>;
+/** Returns the deleted row so the caller can publish its removal, or null. */
+export declare function deleteAnnouncement(id: string): Promise<LTAnnouncement | null>;

package/build/services/announcement/index.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAnnouncement = createAnnouncement;
+exports.listActiveAnnouncements = listActiveAnnouncements;
+exports.deleteAnnouncement = deleteAnnouncement;
+const db_1 = require("../../lib/db");
+const sql_1 = require("./sql");
+/** Only the body is required; everything else has a liberal default (24h expiry). */
+async function createAnnouncement(input) {
+    const { rows } = await (0, db_1.getPool)().query(sql_1.INSERT_ANNOUNCEMENT, [
+        input.title ?? null,
+        input.body,
+        input.layout ?? null,
+        input.roles ?? null,
+        input.createdBy ?? null,
+        input.expiresAt ?? null,
+    ]);
+    return rows[0];
+}
+/** Active announcements visible to a viewer; null roles = the unscoped admin view. */
+async function listActiveAnnouncements(userRoles) {
+    const { rows } = await (0, db_1.getPool)().query(sql_1.LIST_ACTIVE_ANNOUNCEMENTS, [userRoles]);
+    return rows;
+}
+/** Returns the deleted row so the caller can publish its removal, or null. */
+async function deleteAnnouncement(id) {
+    const { rows } = await (0, db_1.getPool)().query(sql_1.DELETE_ANNOUNCEMENT, [id]);
+    return rows[0] ?? null;
+}

package/build/services/announcement/sql.d.ts

@@ -0,0 +1,8 @@
+export declare const INSERT_ANNOUNCEMENT = "\n  INSERT INTO lt_announcements (title, body, layout, roles, created_by, expires_at)\n  VALUES ($1, $2, COALESCE($3, 'banner'), COALESCE($4::text[], '{}'), $5,\n          COALESCE($6::timestamptz, NOW() + INTERVAL '24 hours'))\n  RETURNING *";
+/**
+ * Active announcements for a viewer. $1 = the viewer's role names, or NULL
+ * for the unscoped admin view. Untargeted rows (roles = '{}') reach everyone;
+ * targeted rows reach holders of any named role.
+ */
+export declare const LIST_ACTIVE_ANNOUNCEMENTS = "\n  SELECT * FROM lt_announcements\n  WHERE expires_at > NOW()\n    AND ($1::text[] IS NULL OR roles = '{}' OR roles && $1::text[])\n  ORDER BY created_at DESC";
+export declare const DELETE_ANNOUNCEMENT = "\n  DELETE FROM lt_announcements WHERE id = $1\n  RETURNING *";

package/build/services/announcement/sql.js

@@ -0,0 +1,24 @@
+"use strict";
+// ─── Announcement queries ────────────────────────────────────────────────────
+// Liberal defaults live in the SQL so the service contract is self-describing:
+// only the body is required; layout, targeting, and the 24-hour expiry fill in.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DELETE_ANNOUNCEMENT = exports.LIST_ACTIVE_ANNOUNCEMENTS = exports.INSERT_ANNOUNCEMENT = void 0;
+exports.INSERT_ANNOUNCEMENT = `
+  INSERT INTO lt_announcements (title, body, layout, roles, created_by, expires_at)
+  VALUES ($1, $2, COALESCE($3, 'banner'), COALESCE($4::text[], '{}'), $5,
+          COALESCE($6::timestamptz, NOW() + INTERVAL '24 hours'))
+  RETURNING *`;
+/**
+ * Active announcements for a viewer. $1 = the viewer's role names, or NULL
+ * for the unscoped admin view. Untargeted rows (roles = '{}') reach everyone;
+ * targeted rows reach holders of any named role.
+ */
+exports.LIST_ACTIVE_ANNOUNCEMENTS = `
+  SELECT * FROM lt_announcements
+  WHERE expires_at > NOW()
+    AND ($1::text[] IS NULL OR roles = '{}' OR roles && $1::text[])
+  ORDER BY created_at DESC`;
+exports.DELETE_ANNOUNCEMENT = `
+  DELETE FROM lt_announcements WHERE id = $1
+  RETURNING *`;

package/build/services/config/cache.js

@@ -19,6 +19,7 @@ async function loadAllConfigs() {
             resolverSchema: c.resolver_schema ?? null,
             cronSchedule: c.cron_schedule ?? null,
             executeAs: c.execute_as ?? null,
+            readSafe: c.read_safe ?? false,
         });
     }
     return map;