@hotmeshio/long-tail 0.13.0 → 0.14.0

package/build/services/config/read.js

@@ -29,6 +29,7 @@ async function getWorkflowConfig(workflowType) {
         resolver_schema: wf.resolver_schema ?? null,
         cron_schedule: wf.cron_schedule ?? null,
         execute_as: wf.execute_as ?? null,
+        read_safe: wf.read_safe ?? false,
     };
 }
 async function listWorkflowConfigs() {
@@ -66,5 +67,6 @@ async function listWorkflowConfigs() {
         resolver_schema: wf.resolver_schema ?? null,
         cron_schedule: wf.cron_schedule ?? null,
         execute_as: wf.execute_as ?? null,
+        read_safe: wf.read_safe ?? false,
     }));
 }

package/build/services/config/sql.d.ts

@@ -5,13 +5,13 @@ export declare const LIST_ALL_WORKFLOWS = "SELECT * FROM lt_config_workflows ORD
 export declare const LIST_ALL_ROLES = "SELECT * FROM lt_config_roles ORDER BY workflow_type, role";
 export declare const LIST_ALL_INVOCATION_ROLES = "SELECT * FROM lt_config_invocation_roles ORDER BY workflow_type, role";
 export declare const ENSURE_ROLE_EXISTS = "INSERT INTO lt_roles (role) VALUES ($1) ON CONFLICT DO NOTHING";
-export declare const UPSERT_WORKFLOW = "INSERT INTO lt_config_workflows\n  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified)\nVALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)\nON CONFLICT (workflow_type) DO UPDATE SET\n  invocable = EXCLUDED.invocable,\n  task_queue = EXCLUDED.task_queue,\n  default_role = EXCLUDED.default_role,\n  description = EXCLUDED.description,\n  consumes = EXCLUDED.consumes,\n  envelope_schema = EXCLUDED.envelope_schema,\n  resolver_schema = EXCLUDED.resolver_schema,\n  cron_schedule = EXCLUDED.cron_schedule,\n  tool_tags = EXCLUDED.tool_tags,\n  execute_as = EXCLUDED.execute_as,\n  certified = EXCLUDED.certified";
+export declare const UPSERT_WORKFLOW = "INSERT INTO lt_config_workflows\n  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified, read_safe)\nVALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)\nON CONFLICT (workflow_type) DO UPDATE SET\n  invocable = EXCLUDED.invocable,\n  task_queue = EXCLUDED.task_queue,\n  default_role = EXCLUDED.default_role,\n  description = EXCLUDED.description,\n  consumes = EXCLUDED.consumes,\n  envelope_schema = EXCLUDED.envelope_schema,\n  resolver_schema = EXCLUDED.resolver_schema,\n  cron_schedule = EXCLUDED.cron_schedule,\n  tool_tags = EXCLUDED.tool_tags,\n  execute_as = EXCLUDED.execute_as,\n  certified = EXCLUDED.certified,\n  read_safe = EXCLUDED.read_safe";
 export declare const DELETE_CONFIG_ROLES = "DELETE FROM lt_config_roles WHERE workflow_type = $1";
 export declare const INSERT_CONFIG_ROLE = "INSERT INTO lt_config_roles (workflow_type, role) VALUES ($1, $2)";
 export declare const DELETE_INVOCATION_ROLES = "DELETE FROM lt_config_invocation_roles WHERE workflow_type = $1";
 export declare const INSERT_INVOCATION_ROLE = "INSERT INTO lt_config_invocation_roles (workflow_type, role) VALUES ($1, $2)";
 export declare const DELETE_WORKFLOW = "DELETE FROM lt_config_workflows WHERE workflow_type = $1";
-export declare const SEED_WORKFLOW_CONFIG = "INSERT INTO lt_config_workflows\n  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified)\nVALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)\nON CONFLICT (workflow_type) DO NOTHING";
+export declare const SEED_WORKFLOW_CONFIG = "INSERT INTO lt_config_workflows\n  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified, read_safe)\nVALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)\nON CONFLICT (workflow_type) DO NOTHING";
 export declare const SEED_CONFIG_ROLE = "INSERT INTO lt_config_roles (workflow_type, role) VALUES ($1, $2)\nON CONFLICT (workflow_type, role) DO NOTHING";
 export declare const SEED_INVOCATION_ROLE = "INSERT INTO lt_config_invocation_roles (workflow_type, role) VALUES ($1, $2)\nON CONFLICT (workflow_type, role) DO NOTHING";
 export declare const GET_PROVIDER_DATA = "SELECT workflow_type, data, completed_at\n  FROM lt_tasks\n WHERE origin_id = $1\n   AND workflow_type = ANY($2)\n   AND status = 'completed'\n ORDER BY completed_at DESC";

package/build/services/config/sql.js

@@ -23,8 +23,8 @@ exports.ENSURE_ROLE_EXISTS = `\
 INSERT INTO lt_roles (role) VALUES ($1) ON CONFLICT DO NOTHING`;
 exports.UPSERT_WORKFLOW = `\
 INSERT INTO lt_config_workflows
-  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified)
-VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)
+  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified, read_safe)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)
 ON CONFLICT (workflow_type) DO UPDATE SET
   invocable = EXCLUDED.invocable,
   task_queue = EXCLUDED.task_queue,
@@ -36,7 +36,8 @@ ON CONFLICT (workflow_type) DO UPDATE SET
   cron_schedule = EXCLUDED.cron_schedule,
   tool_tags = EXCLUDED.tool_tags,
   execute_as = EXCLUDED.execute_as,
-  certified = EXCLUDED.certified`;
+  certified = EXCLUDED.certified,
+  read_safe = EXCLUDED.read_safe`;
 exports.DELETE_CONFIG_ROLES = `\
 DELETE FROM lt_config_roles WHERE workflow_type = $1`;
 exports.INSERT_CONFIG_ROLE = `\
@@ -52,8 +53,8 @@ DELETE FROM lt_config_workflows WHERE workflow_type = $1`;
 // ------------------------------------------------------------------ //
 exports.SEED_WORKFLOW_CONFIG = `\
 INSERT INTO lt_config_workflows
-  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified)
-VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)
+  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified, read_safe)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)
 ON CONFLICT (workflow_type) DO NOTHING`;
 exports.SEED_CONFIG_ROLE = `\
 INSERT INTO lt_config_roles (workflow_type, role) VALUES ($1, $2)

package/build/services/config/write.js

@@ -52,6 +52,7 @@ async function replaceWorkflowConfig(config, certified) {
             config.tool_tags || [],
             config.execute_as ?? null,
             certified,
+            config.read_safe ?? false,
         ]);
         // Replace roles
         await client.query(sql_1.DELETE_CONFIG_ROLES, [config.workflow_type]);
@@ -112,6 +113,7 @@ async function seedWorkflowConfig(config) {
         config.tool_tags || [],
         config.execute_as ?? null,
         resolveCertified(config),
+        config.read_safe ?? false,
     ]);
     const inserted = (rowCount ?? 0) > 0;
     if (inserted) {
@@ -134,6 +136,8 @@ async function seedWorkflowConfig(config) {
                 drifts.push('invocable');
             if (resolveCertified(config) !== existing.certified)
                 drifts.push('certified');
+            if ((config.read_safe ?? false) !== (existing.read_safe ?? false))
+                drifts.push('read_safe');
             if (config.default_role !== existing.default_role)
                 drifts.push('default_role');
             if (JSON.stringify(config.envelope_schema) !== JSON.stringify(existing.envelope_schema))
@@ -169,6 +173,7 @@ async function applyWorkflowConfig(config) {
             existing.default_role === config.default_role &&
             (existing.description ?? null) === (config.description ?? null) &&
             existing.certified === certified &&
+            (existing.read_safe ?? false) === (config.read_safe ?? false) &&
             (existing.cron_schedule ?? null) === (config.cron_schedule ?? null) &&
             (existing.execute_as ?? null) === (config.execute_as ?? null) &&
             sortedEqual(existing.consumes ?? [], config.consumes ?? []) &&

package/build/services/scan-code/index.d.ts

@@ -1,4 +1,4 @@
 export { listScanSchemes, getScanScheme, listScanRules, getScanRule, } from './read';
-export { upsertScanScheme, deleteScanScheme, upsertScanRule, deleteScanRule, seedScanScheme, seedScanRule, type ScanSchemeInput, type ScanRuleInput, } from './write';
+export { upsertScanScheme, deleteScanScheme, upsertScanRule, deleteScanRule, seedScanScheme, seedScanRule, applyScanScheme, applyScanRule, type ScanSchemeInput, type ScanRuleInput, } from './write';
 export { parseScanCode, interpolateScanTemplate, type ScanParseResult, type ScanParseFailure, type ScanTemplateContext, } from './parse';
 export { assertValidScheme, assertValidSteps } from './validate';

package/build/services/scan-code/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.assertValidSteps = exports.assertValidScheme = exports.interpolateScanTemplate = exports.parseScanCode = exports.seedScanRule = exports.seedScanScheme = exports.deleteScanRule = exports.upsertScanRule = exports.deleteScanScheme = exports.upsertScanScheme = exports.getScanRule = exports.listScanRules = exports.getScanScheme = exports.listScanSchemes = void 0;
+exports.assertValidSteps = exports.assertValidScheme = exports.interpolateScanTemplate = exports.parseScanCode = exports.applyScanRule = exports.applyScanScheme = exports.seedScanRule = exports.seedScanScheme = exports.deleteScanRule = exports.upsertScanRule = exports.deleteScanScheme = exports.upsertScanScheme = exports.getScanRule = exports.listScanRules = exports.getScanScheme = exports.listScanSchemes = void 0;
 var read_1 = require("./read");
 Object.defineProperty(exports, "listScanSchemes", { enumerable: true, get: function () { return read_1.listScanSchemes; } });
 Object.defineProperty(exports, "getScanScheme", { enumerable: true, get: function () { return read_1.getScanScheme; } });
@@ -13,6 +13,8 @@ Object.defineProperty(exports, "upsertScanRule", { enumerable: true, get: functi
 Object.defineProperty(exports, "deleteScanRule", { enumerable: true, get: function () { return write_1.deleteScanRule; } });
 Object.defineProperty(exports, "seedScanScheme", { enumerable: true, get: function () { return write_1.seedScanScheme; } });
 Object.defineProperty(exports, "seedScanRule", { enumerable: true, get: function () { return write_1.seedScanRule; } });
+Object.defineProperty(exports, "applyScanScheme", { enumerable: true, get: function () { return write_1.applyScanScheme; } });
+Object.defineProperty(exports, "applyScanRule", { enumerable: true, get: function () { return write_1.applyScanRule; } });
 var parse_1 = require("./parse");
 Object.defineProperty(exports, "parseScanCode", { enumerable: true, get: function () { return parse_1.parseScanCode; } });
 Object.defineProperty(exports, "interpolateScanTemplate", { enumerable: true, get: function () { return parse_1.interpolateScanTemplate; } });

package/build/services/scan-code/sql.d.ts

@@ -8,3 +8,10 @@ export declare const UPSERT_ACTION = "INSERT INTO lt_config_scan_actions\n  (sch
 export declare const DELETE_ACTION = "DELETE FROM lt_config_scan_actions WHERE scheme_version = $1 AND category = $2";
 export declare const SEED_SCHEME = "INSERT INTO lt_config_scan_schemes\n  (version, name, description, target_facet, encoding, delimiter, target_length,\n   kind, grant_ttl_seconds, grant_max_uses, enabled)\nVALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)\nON CONFLICT (version) DO NOTHING";
 export declare const SEED_ACTION = "INSERT INTO lt_config_scan_actions\n  (scheme_version, category, name, steps, fallback, not_primed, enabled)\nVALUES ($1, $2, $3, $4, $5, $6, $7)\nON CONFLICT (scheme_version, category) DO NOTHING";
+/**
+ * Apply — same column set as the upsert, guarded by IS DISTINCT FROM so an
+ * unchanged declaration is a zero-row no-op. `(xmax = 0)` distinguishes
+ * insert from update. jsonb columns compare content-wise in SQL.
+ */
+export declare const APPLY_SCHEME = "INSERT INTO lt_config_scan_schemes\n  (version, name, description, target_facet, encoding, delimiter, target_length,\n   kind, grant_ttl_seconds, grant_max_uses, enabled)\nVALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)\nON CONFLICT (version) DO UPDATE SET\n  name = EXCLUDED.name,\n  description = EXCLUDED.description,\n  target_facet = EXCLUDED.target_facet,\n  encoding = EXCLUDED.encoding,\n  delimiter = EXCLUDED.delimiter,\n  target_length = EXCLUDED.target_length,\n  kind = EXCLUDED.kind,\n  grant_ttl_seconds = EXCLUDED.grant_ttl_seconds,\n  grant_max_uses = EXCLUDED.grant_max_uses,\n  enabled = EXCLUDED.enabled,\n  updated_at = NOW()\nWHERE (lt_config_scan_schemes.name, lt_config_scan_schemes.description,\n       lt_config_scan_schemes.target_facet, lt_config_scan_schemes.encoding,\n       lt_config_scan_schemes.delimiter, lt_config_scan_schemes.target_length,\n       lt_config_scan_schemes.kind, lt_config_scan_schemes.grant_ttl_seconds,\n       lt_config_scan_schemes.grant_max_uses, lt_config_scan_schemes.enabled)\n  IS DISTINCT FROM\n      (EXCLUDED.name, EXCLUDED.description, EXCLUDED.target_facet,\n       EXCLUDED.encoding, EXCLUDED.delimiter, EXCLUDED.target_length,\n       EXCLUDED.kind, EXCLUDED.grant_ttl_seconds, EXCLUDED.grant_max_uses,\n       EXCLUDED.enabled)\nRETURNING (xmax = 0) AS inserted";
+export declare const APPLY_ACTION = "INSERT INTO lt_config_scan_actions\n  (scheme_version, category, name, steps, fallback, not_primed, enabled)\nVALUES ($1, $2, $3, $4, $5, $6, $7)\nON CONFLICT (scheme_version, category) DO UPDATE SET\n  name = EXCLUDED.name,\n  steps = EXCLUDED.steps,\n  fallback = EXCLUDED.fallback,\n  not_primed = EXCLUDED.not_primed,\n  enabled = EXCLUDED.enabled,\n  updated_at = NOW()\nWHERE (lt_config_scan_actions.name, lt_config_scan_actions.steps,\n       lt_config_scan_actions.fallback, lt_config_scan_actions.not_primed,\n       lt_config_scan_actions.enabled)\n  IS DISTINCT FROM\n      (EXCLUDED.name, EXCLUDED.steps, EXCLUDED.fallback,\n       EXCLUDED.not_primed, EXCLUDED.enabled)\nRETURNING (xmax = 0) AS inserted";

package/build/services/scan-code/sql.js

@@ -3,7 +3,7 @@
 // Read queries                                                       //
 // ------------------------------------------------------------------ //
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SEED_ACTION = exports.SEED_SCHEME = exports.DELETE_ACTION = exports.UPSERT_ACTION = exports.DELETE_SCHEME = exports.UPSERT_SCHEME = exports.GET_ACTION = exports.LIST_ACTIONS = exports.GET_SCHEME = exports.LIST_SCHEMES = void 0;
+exports.APPLY_ACTION = exports.APPLY_SCHEME = exports.SEED_ACTION = exports.SEED_SCHEME = exports.DELETE_ACTION = exports.UPSERT_ACTION = exports.DELETE_SCHEME = exports.UPSERT_SCHEME = exports.GET_ACTION = exports.LIST_ACTIONS = exports.GET_SCHEME = exports.LIST_SCHEMES = void 0;
 exports.LIST_SCHEMES = `\
 SELECT * FROM lt_config_scan_schemes ORDER BY version`;
 exports.GET_SCHEME = `\
@@ -61,3 +61,57 @@ INSERT INTO lt_config_scan_actions
   (scheme_version, category, name, steps, fallback, not_primed, enabled)
 VALUES ($1, $2, $3, $4, $5, $6, $7)
 ON CONFLICT (scheme_version, category) DO NOTHING`;
+// ------------------------------------------------------------------ //
+// Apply (code-owned startup pass — code is source of truth)          //
+// ------------------------------------------------------------------ //
+/**
+ * Apply — same column set as the upsert, guarded by IS DISTINCT FROM so an
+ * unchanged declaration is a zero-row no-op. `(xmax = 0)` distinguishes
+ * insert from update. jsonb columns compare content-wise in SQL.
+ */
+exports.APPLY_SCHEME = `\
+INSERT INTO lt_config_scan_schemes
+  (version, name, description, target_facet, encoding, delimiter, target_length,
+   kind, grant_ttl_seconds, grant_max_uses, enabled)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)
+ON CONFLICT (version) DO UPDATE SET
+  name = EXCLUDED.name,
+  description = EXCLUDED.description,
+  target_facet = EXCLUDED.target_facet,
+  encoding = EXCLUDED.encoding,
+  delimiter = EXCLUDED.delimiter,
+  target_length = EXCLUDED.target_length,
+  kind = EXCLUDED.kind,
+  grant_ttl_seconds = EXCLUDED.grant_ttl_seconds,
+  grant_max_uses = EXCLUDED.grant_max_uses,
+  enabled = EXCLUDED.enabled,
+  updated_at = NOW()
+WHERE (lt_config_scan_schemes.name, lt_config_scan_schemes.description,
+       lt_config_scan_schemes.target_facet, lt_config_scan_schemes.encoding,
+       lt_config_scan_schemes.delimiter, lt_config_scan_schemes.target_length,
+       lt_config_scan_schemes.kind, lt_config_scan_schemes.grant_ttl_seconds,
+       lt_config_scan_schemes.grant_max_uses, lt_config_scan_schemes.enabled)
+  IS DISTINCT FROM
+      (EXCLUDED.name, EXCLUDED.description, EXCLUDED.target_facet,
+       EXCLUDED.encoding, EXCLUDED.delimiter, EXCLUDED.target_length,
+       EXCLUDED.kind, EXCLUDED.grant_ttl_seconds, EXCLUDED.grant_max_uses,
+       EXCLUDED.enabled)
+RETURNING (xmax = 0) AS inserted`;
+exports.APPLY_ACTION = `\
+INSERT INTO lt_config_scan_actions
+  (scheme_version, category, name, steps, fallback, not_primed, enabled)
+VALUES ($1, $2, $3, $4, $5, $6, $7)
+ON CONFLICT (scheme_version, category) DO UPDATE SET
+  name = EXCLUDED.name,
+  steps = EXCLUDED.steps,
+  fallback = EXCLUDED.fallback,
+  not_primed = EXCLUDED.not_primed,
+  enabled = EXCLUDED.enabled,
+  updated_at = NOW()
+WHERE (lt_config_scan_actions.name, lt_config_scan_actions.steps,
+       lt_config_scan_actions.fallback, lt_config_scan_actions.not_primed,
+       lt_config_scan_actions.enabled)
+  IS DISTINCT FROM
+      (EXCLUDED.name, EXCLUDED.steps, EXCLUDED.fallback,
+       EXCLUDED.not_primed, EXCLUDED.enabled)
+RETURNING (xmax = 0) AS inserted`;

package/build/services/scan-code/write.d.ts

@@ -28,3 +28,11 @@ export declare function deleteScanRule(schemeVersion: number, category: string):
 /** Insert-if-absent seeding — DB is the source of truth, never overwrite. */
 export declare function seedScanScheme(input: ScanSchemeInput): Promise<boolean>;
 export declare function seedScanRule(input: ScanRuleInput): Promise<boolean>;
+/**
+ * Apply a scheme declaration at startup (code is source of truth). Same
+ * validation as the upsert; the IS DISTINCT FROM guard makes an unchanged
+ * declaration a zero-row no-op.
+ */
+export declare function applyScanScheme(input: ScanSchemeInput): Promise<'applied' | 'unchanged'>;
+/** Apply a rule declaration at startup (code is source of truth). */
+export declare function applyScanRule(input: ScanRuleInput): Promise<'applied' | 'unchanged'>;

package/build/services/scan-code/write.js

@@ -6,6 +6,8 @@ exports.upsertScanRule = upsertScanRule;
 exports.deleteScanRule = deleteScanRule;
 exports.seedScanScheme = seedScanScheme;
 exports.seedScanRule = seedScanRule;
+exports.applyScanScheme = applyScanScheme;
+exports.applyScanRule = applyScanRule;
 const db_1 = require("../../lib/db");
 const types_1 = require("../../types");
 const sql_1 = require("./sql");
@@ -55,7 +57,8 @@ async function deleteScanScheme(version) {
     const { rowCount } = await (0, db_1.getPool)().query(sql_1.DELETE_SCHEME, [version]);
     return (rowCount ?? 0) > 0;
 }
-async function upsertScanRule(input) {
+/** Shared rule-input validation — the upsert and startup-apply paths enforce the same contract. */
+async function assertValidRuleInput(input) {
     if (!/^[0-9]$/.test(input.category)) {
         throw new Error('category must be a single digit (0-9)');
     }
@@ -65,6 +68,9 @@ async function upsertScanRule(input) {
     if (input.steps.length === 0 && !input.fallback?.markdown && !input.fallback?.route) {
         throw new Error('a rule needs at least one step or a fallback');
     }
+}
+async function upsertScanRule(input) {
+    await assertValidRuleInput(input);
     const { rows } = await (0, db_1.getPool)().query(sql_1.UPSERT_ACTION, ruleParams(input));
     return rows[0];
 }
@@ -83,3 +89,19 @@ async function seedScanRule(input) {
     const { rowCount } = await (0, db_1.getPool)().query(sql_1.SEED_ACTION, ruleParams(input));
     return (rowCount ?? 0) > 0;
 }
+/**
+ * Apply a scheme declaration at startup (code is source of truth). Same
+ * validation as the upsert; the IS DISTINCT FROM guard makes an unchanged
+ * declaration a zero-row no-op.
+ */
+async function applyScanScheme(input) {
+    (0, validate_1.assertValidScheme)(input);
+    const { rowCount } = await (0, db_1.getPool)().query(sql_1.APPLY_SCHEME, schemeParams(input));
+    return (rowCount ?? 0) > 0 ? 'applied' : 'unchanged';
+}
+/** Apply a rule declaration at startup (code is source of truth). */
+async function applyScanRule(input) {
+    await assertValidRuleInput(input);
+    const { rowCount } = await (0, db_1.getPool)().query(sql_1.APPLY_ACTION, ruleParams(input));
+    return (rowCount ?? 0) > 0 ? 'applied' : 'unchanged';
+}

package/build/services/topics/system-topics.js

@@ -261,6 +261,26 @@ const SYSTEM_TOPICS = [
         example_payload: { workflowId: 'wf-abc', workflowName: 'processOrder', milestones: [{ name: 'items_processed', value: 42 }] },
         tags: ['progress', 'core'],
     },
+    // Surfaces
+    {
+        topic: 'system.surfaces.dashboard',
+        description: 'A dashboard announcement was published or removed. Delivery reaches ' +
+            'every authenticated subscriber — role targeting is display scoping, ' +
+            'so bodies must never carry secrets.',
+        category: 'surfaces',
+        payload_schema: objectSchema({
+            action: { type: 'string', description: 'created | deleted' },
+            announcement: {
+                type: 'object',
+                description: 'The announcement row (id, title, body, layout, roles, expires_at)',
+            },
+        }),
+        example_payload: {
+            action: 'created',
+            announcement: { id: 'ann-001', title: 'Maintenance tonight', layout: 'banner', roles: [] },
+        },
+        tags: ['surface', 'dashboard'],
+    },
 ];
 // ── Seeding ─────────────────────────────────────────────────────────────────────
 /**

package/build/shared/form-validation/index.d.ts

@@ -13,5 +13,6 @@ export * from './x-lt-labels';
 export * from './x-lt-query';
 export * from './x-lt-submit-guard';
 export * from './x-lt-show-if';
+export * from './x-lt-require-any';
 export * from './field-validator';
 export * from './validate-resolver-payload';

package/build/shared/form-validation/index.js

@@ -29,5 +29,6 @@ __exportStar(require("./x-lt-labels"), exports);
 __exportStar(require("./x-lt-query"), exports);
 __exportStar(require("./x-lt-submit-guard"), exports);
 __exportStar(require("./x-lt-show-if"), exports);
+__exportStar(require("./x-lt-require-any"), exports);
 __exportStar(require("./field-validator"), exports);
 __exportStar(require("./validate-resolver-payload"), exports);

package/build/shared/form-validation/validate-resolver-payload.d.ts

@@ -15,6 +15,9 @@
  *   - x-lt-require-all against the checklist items resolved from context
  *   - static + dynamic bounds (minimum/x-lt-minimum, lengths, patterns)
  *
+ * Root-level x-lt-require-any groups run after the per-field pass: each group
+ * needs a value in at least one visible member (all-hidden groups are waived).
+ *
  * The showIf/`resolver.*` domain is always the FLAT form representation, so a
  * condition like `resolver.approved` reads the same on both sides.
  */

package/build/shared/form-validation/validate-resolver-payload.js

@@ -19,12 +19,16 @@ exports.validateResolverPayload = validateResolverPayload;
  *   - x-lt-require-all against the checklist items resolved from context
  *   - static + dynamic bounds (minimum/x-lt-minimum, lengths, patterns)
  *
+ * Root-level x-lt-require-any groups run after the per-field pass: each group
+ * needs a value in at least one visible member (all-hidden groups are waived).
+ *
  * The showIf/`resolver.*` domain is always the FLAT form representation, so a
  * condition like `resolver.approved` reads the same on both sides.
  */
 const field_validator_1 = require("./field-validator");
 const x_lt_show_if_1 = require("./x-lt-show-if");
 const x_lt_bind_1 = require("./x-lt-bind");
+const x_lt_require_any_1 = require("./x-lt-require-any");
 /**
  * Validate FLAT form values against the form schema. This is the dashboard's
  * entry point (the values the user edits, keyed by field name).
@@ -46,6 +50,21 @@ function validateResolverForm(schema, formValues, ctx) {
         if (err)
             errors.push({ field, message: err });
     }
+    // Require-any groups: at least one VISIBLE member per group carries a value.
+    // A member hidden by showIf (or naming no property) can neither satisfy nor
+    // be demanded; an all-hidden group is waived.
+    for (const group of (0, x_lt_require_any_1.readRequireAnyGroups)(schema)) {
+        const visible = group.filter((k) => properties[k] && (0, x_lt_show_if_1.evaluateShowIf)(properties[k]['x-lt-showIf'], liveCtx));
+        if (visible.length === 0)
+            continue;
+        if (visible.some((k) => (0, x_lt_require_any_1.hasRequireAnyValue)(formValues[k])))
+            continue;
+        const titles = visible.map((k) => properties[k].title ?? k);
+        errors.push({
+            field: visible[0],
+            message: `Enter a value for at least one of: ${titles.join(', ')}`,
+        });
+    }
     return errors;
 }
 /**

package/build/shared/form-validation/x-lt-labels.d.ts

@@ -10,19 +10,30 @@
  * { "x-lt-labels": { "claim": "Claim and Submit", "submit": "Approve" } }
  * ```
  *
- * Only the five known targets are read; unknown keys and non-string values are
- * ignored. Any target the schema omits keeps its default label, so a schema
- * overrides just the controls it cares about.
+ * `cancel` additionally accepts `false` to remove the control entirely —
+ * for roles where cancelling is not part of the process ("Send to Service"
+ * flows escalate instead). The other targets are rename-only: hiding
+ * claim/submit/release would strand the footer.
+ *
+ * Only the five known targets are read; unknown keys and non-string values
+ * (except `cancel: false`) are ignored. Any target the schema omits keeps its
+ * default label, so a schema overrides just the controls it cares about.
  */
 export declare const X_LT_LABELS = "x-lt-labels";
 /** The footer controls a schema may rename. */
 export declare const FOOTER_LABEL_TARGETS: readonly ["claim", "cancel", "submit", "escalate", "release"];
 export type FooterLabelTarget = (typeof FOOTER_LABEL_TARGETS)[number];
-/** A partial map of target → override label. Absent targets keep their default. */
-export type FooterLabels = Partial<Record<FooterLabelTarget, string>>;
+/**
+ * A partial map of target → override label. Absent targets keep their
+ * default. `cancel: false` removes the cancel control from the footer.
+ */
+export type FooterLabels = Partial<Record<Exclude<FooterLabelTarget, 'cancel'>, string>> & {
+    cancel?: string | false;
+};
 /**
  * The schema's footer label overrides, or an empty map when none are declared.
  * Reads only the known targets; a non-object `x-lt-labels`, unknown keys, and
- * blank or non-string values are dropped.
+ * blank or non-string values are dropped — except `cancel: false`, which is
+ * preserved as the hide instruction.
  */
 export declare function readFooterLabels(schema: Record<string, unknown> | null | undefined): FooterLabels;

package/build/shared/form-validation/x-lt-labels.js

@@ -11,9 +11,14 @@
  * { "x-lt-labels": { "claim": "Claim and Submit", "submit": "Approve" } }
  * ```
  *
- * Only the five known targets are read; unknown keys and non-string values are
- * ignored. Any target the schema omits keeps its default label, so a schema
- * overrides just the controls it cares about.
+ * `cancel` additionally accepts `false` to remove the control entirely —
+ * for roles where cancelling is not part of the process ("Send to Service"
+ * flows escalate instead). The other targets are rename-only: hiding
+ * claim/submit/release would strand the footer.
+ *
+ * Only the five known targets are read; unknown keys and non-string values
+ * (except `cancel: false`) are ignored. Any target the schema omits keeps its
+ * default label, so a schema overrides just the controls it cares about.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FOOTER_LABEL_TARGETS = exports.X_LT_LABELS = void 0;
@@ -24,7 +29,8 @@ exports.FOOTER_LABEL_TARGETS = ['claim', 'cancel', 'submit', 'escalate', 'releas
 /**
  * The schema's footer label overrides, or an empty map when none are declared.
  * Reads only the known targets; a non-object `x-lt-labels`, unknown keys, and
- * blank or non-string values are dropped.
+ * blank or non-string values are dropped — except `cancel: false`, which is
+ * preserved as the hide instruction.
  */
 function readFooterLabels(schema) {
     const raw = schema?.[exports.X_LT_LABELS];
@@ -32,6 +38,8 @@ function readFooterLabels(schema) {
         return {};
     const source = raw;
     const labels = {};
+    if (source.cancel === false)
+        labels.cancel = false;
     for (const target of exports.FOOTER_LABEL_TARGETS) {
         const value = source[target];
         if (typeof value === 'string' && value.trim().length > 0) {

package/build/shared/form-validation/x-lt-require-any.d.ts

@@ -0,0 +1,22 @@
+/**
+ * x-lt-require-any — "at least one of this set" as a root-schema token. A
+ * form_schema declares groups of field names; a submission passes when every
+ * group has a value in at least one member. The canonical case: a Left
+ * quantity and a Right quantity where either satisfies, but blank-both fails.
+ *
+ *   x-lt-require-any   string[][] — e.g. [["left_quantity", "right_quantity"]]
+ *
+ * Visibility rules compose: a member hidden by its `x-lt-showIf` (or naming
+ * no schema property) can neither satisfy the group nor be demanded of the
+ * submitter, and a group whose members are ALL hidden is waived. `false` and
+ * `0` are answers; `''`, null, and undefined are not.
+ */
+export declare const X_LT_REQUIRE_ANY = "x-lt-require-any";
+/**
+ * The schema's require-any groups. Malformed declarations (non-array token,
+ * non-array groups, non-string members) read as no groups — a bad token never
+ * bricks submission.
+ */
+export declare function readRequireAnyGroups(schema: Record<string, unknown> | null | undefined): string[][];
+/** Present = an actual answer: `false` and `0` count; `''`/null/undefined do not. */
+export declare function hasRequireAnyValue(value: unknown): boolean;

package/build/shared/form-validation/x-lt-require-any.js

@@ -0,0 +1,41 @@
+"use strict";
+/**
+ * x-lt-require-any — "at least one of this set" as a root-schema token. A
+ * form_schema declares groups of field names; a submission passes when every
+ * group has a value in at least one member. The canonical case: a Left
+ * quantity and a Right quantity where either satisfies, but blank-both fails.
+ *
+ *   x-lt-require-any   string[][] — e.g. [["left_quantity", "right_quantity"]]
+ *
+ * Visibility rules compose: a member hidden by its `x-lt-showIf` (or naming
+ * no schema property) can neither satisfy the group nor be demanded of the
+ * submitter, and a group whose members are ALL hidden is waived. `false` and
+ * `0` are answers; `''`, null, and undefined are not.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.X_LT_REQUIRE_ANY = void 0;
+exports.readRequireAnyGroups = readRequireAnyGroups;
+exports.hasRequireAnyValue = hasRequireAnyValue;
+exports.X_LT_REQUIRE_ANY = 'x-lt-require-any';
+/**
+ * The schema's require-any groups. Malformed declarations (non-array token,
+ * non-array groups, non-string members) read as no groups — a bad token never
+ * bricks submission.
+ */
+function readRequireAnyGroups(schema) {
+    const raw = schema?.[exports.X_LT_REQUIRE_ANY];
+    if (!Array.isArray(raw))
+        return [];
+    return raw
+        .filter((group) => Array.isArray(group))
+        .map((group) => group.filter((m) => typeof m === 'string' && m.length > 0))
+        .filter((group) => group.length > 0);
+}
+/** Present = an actual answer: `false` and `0` count; `''`/null/undefined do not. */
+function hasRequireAnyValue(value) {
+    if (value === undefined || value === null)
+        return false;
+    if (typeof value === 'string')
+        return value.trim().length > 0;
+    return true;
+}

package/build/start/workers.js

@@ -236,6 +236,7 @@ async function startWorkers(startConfig, workers, builtinMcpServerFactories) {
                         resolver_schema: c.resolverSchema ?? null,
                         cron_schedule: c.cronSchedule ?? null,
                         execute_as: c.executeAs ?? null,
+                        read_safe: c.readSafe ?? false,
                     };
                     try {
                         if ((0, apply_report_1.ownedByCode)(c.reset, configSource)) {
@@ -472,6 +473,55 @@ async function startWorkers(startConfig, workers, builtinMcpServerFactories) {
             (0, apply_report_1.logSurfaceReport)('agents', agentReport);
         }
     }
+    // Declared scan schemes + rules (one ownership unit, one reset). The scheme
+    // applies first — rule validation reads its kind.
+    if (startConfig.scanSchemes?.length) {
+        const { seedScanScheme, seedScanRule, applyScanScheme, applyScanRule, listScanSchemes, listScanRules, } = await Promise.resolve().then(() => __importStar(require('../services/scan-code')));
+        const scanReport = (0, apply_report_1.newSurfaceReport)();
+        for (const scheme of startConfig.scanSchemes) {
+            const codeOwned = (0, apply_report_1.ownedByCode)(scheme.reset, configSource);
+            const { rules, reset: _reset, ...schemeInput } = scheme;
+            try {
+                if (codeOwned) {
+                    let outcome = await applyScanScheme(schemeInput);
+                    for (const rule of rules ?? []) {
+                        const ruleOutcome = await applyScanRule({ scheme_version: scheme.version, ...rule });
+                        if (ruleOutcome === 'applied')
+                            outcome = 'applied';
+                    }
+                    (0, apply_report_1.recordOutcome)(scanReport, `scheme ${scheme.version}`, outcome);
+                    if (outcome === 'applied')
+                        logger_1.loggerRegistry.info(`[long-tail] scan scheme applied: ${scheme.version}`);
+                    const declaredCategories = new Set((rules ?? []).map((r) => r.category));
+                    const existingRules = await listScanRules(scheme.version);
+                    scanReport.orphans.push(...existingRules
+                        .filter((r) => !declaredCategories.has(r.category))
+                        .map((r) => `${scheme.version}/${r.category}`));
+                }
+                else {
+                    const inserted = await seedScanScheme(schemeInput);
+                    for (const rule of rules ?? []) {
+                        await seedScanRule({ scheme_version: scheme.version, ...rule });
+                    }
+                    (0, apply_report_1.recordOutcome)(scanReport, `scheme ${scheme.version}`, 'db-owned');
+                    if (inserted)
+                        logger_1.loggerRegistry.info(`[long-tail] scan scheme seeded: ${scheme.version}`);
+                }
+            }
+            catch (err) {
+                logger_1.loggerRegistry.warn(`[long-tail] scan scheme seed failed for ${scheme.version}: ${err.message}`);
+            }
+        }
+        if (codeOwnedBoot && !startConfig.examples) {
+            const declaredVersions = new Set(startConfig.scanSchemes.map((s) => s.version));
+            scanReport.orphans.push(...(await listScanSchemes())
+                .map((s) => s.version)
+                .filter((v) => !declaredVersions.has(v))
+                .map(String));
+        }
+        if (codeOwnedBoot)
+            (0, apply_report_1.logSurfaceReport)('scan-schemes', scanReport);
+    }
     // Register the in-process callback adapter for agent event triggers.
     // Reuse existing instance if already registered (e.g., from SDK createClient).
     const { CallbackEventAdapter } = await Promise.resolve().then(() => __importStar(require('../lib/events/callback')));

package/build/system/mcp-servers/admin/announcements.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Dashboard announcement tool — mirrors routes/announcements.ts. Publishing
+ * is a privileged surface (the HTTP route guards with requireRoleManager);
+ * targeting is display scoping only, so bodies must never carry secrets.
+ */
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function registerAnnouncementTools(server: McpServer): void;