@hotmeshio/long-tail 0.13.1 → 0.14.0

package/build/api/announcements.d.ts

@@ -0,0 +1,22 @@
+import type { LTApiResult, LTApiAuth } from '../types/sdk';
+/**
+ * Dashboard announcements — broadcast notices on the dashboard surface.
+ * Publishing is a role-manager act (superadmin/admin/engineer via the route
+ * guard); reading is any authenticated user, server-filtered to their roles.
+ * Role targeting is display scoping only: the live event reaches every
+ * authenticated subscriber, so bodies must never carry secrets.
+ */
+/** Create an announcement. Only `body` is required — everything else defaults. */
+export declare function createAnnouncement(input: {
+    body?: string;
+    title?: string;
+    layout?: string;
+    roles?: string[];
+    expiresAt?: string;
+}, auth: LTApiAuth): Promise<LTApiResult>;
+/** Active announcements for the caller — admins see all, others their roles' slice. */
+export declare function listAnnouncements(auth: LTApiAuth): Promise<LTApiResult>;
+/** Remove an announcement; subscribers see it drop live. */
+export declare function deleteAnnouncement(input: {
+    id: string;
+}, _auth: LTApiAuth): Promise<LTApiResult>;

package/build/api/announcements.js

@@ -0,0 +1,96 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAnnouncement = createAnnouncement;
+exports.listAnnouncements = listAnnouncements;
+exports.deleteAnnouncement = deleteAnnouncement;
+const announcementService = __importStar(require("../services/announcement"));
+const publish_1 = require("../lib/events/publish");
+const user_1 = require("../services/user");
+/**
+ * Dashboard announcements — broadcast notices on the dashboard surface.
+ * Publishing is a role-manager act (superadmin/admin/engineer via the route
+ * guard); reading is any authenticated user, server-filtered to their roles.
+ * Role targeting is display scoping only: the live event reaches every
+ * authenticated subscriber, so bodies must never carry secrets.
+ */
+/** Create an announcement. Only `body` is required — everything else defaults. */
+async function createAnnouncement(input, auth) {
+    try {
+        if (!input.body?.trim()) {
+            return { status: 400, error: 'body is required' };
+        }
+        const announcement = await announcementService.createAnnouncement({
+            body: input.body,
+            title: input.title,
+            layout: input.layout,
+            roles: input.roles,
+            expiresAt: input.expiresAt,
+            createdBy: auth.userId,
+        });
+        await (0, publish_1.publishAnnouncementEvent)({ type: 'announcement.created', announcement });
+        return { status: 200, data: announcement };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}
+/** Active announcements for the caller — admins see all, others their roles' slice. */
+async function listAnnouncements(auth) {
+    try {
+        const unscoped = auth.role === 'superadmin' || auth.role === 'admin';
+        const roles = unscoped
+            ? null
+            : (await (0, user_1.getUserRoles)(auth.userId)).map((r) => r.role);
+        const announcements = await announcementService.listActiveAnnouncements(roles);
+        return { status: 200, data: { announcements } };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}
+/** Remove an announcement; subscribers see it drop live. */
+async function deleteAnnouncement(input, _auth) {
+    try {
+        const deleted = await announcementService.deleteAnnouncement(input.id);
+        if (!deleted)
+            return { status: 404, error: 'announcement not found' };
+        await (0, publish_1.publishAnnouncementEvent)({ type: 'announcement.deleted', announcement: deleted });
+        return { status: 200, data: { deleted: true, id: input.id } };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}

package/build/api/escalations/list.d.ts

@@ -11,6 +11,14 @@ export interface FacetInput {
     /** Only rows past their role's priority threshold — see FacetQuery.jeopardy. */
     jeopardy?: boolean;
     orderBy?: FacetOrder[];
+    /**
+     * List rows omit the two heavyweight JSON columns (`envelope`,
+     * `escalation_payload`) by default — at scale they dominate the payload.
+     * Pass `'envelope'` to restore both (list schemas interpolating
+     * `{{envelope.*}}`/`{{payload.*}}` need them). The single-item GET always
+     * carries the full record.
+     */
+    include?: string;
 }
 /**
  * List escalations with optional filters.

package/build/api/escalations/list.js

@@ -42,6 +42,16 @@ exports.getStationMetrics = getStationMetrics;
 const escalationService = __importStar(require("../../services/escalation"));
 const features_1 = require("../../modules/features");
 const helpers_1 = require("./helpers");
+/** Strip the heavyweight JSON columns from list rows unless asked back. */
+function projectListRows(rows, include) {
+    if (include === 'envelope')
+        return rows;
+    return rows.map(({ envelope: _e, escalation_payload: _p, ...rest }) => rest);
+}
+/** Apply the list projection to a { escalations, ... } service result. */
+function projectListResult(result, include) {
+    return { ...result, escalations: projectListRows(result.escalations, include) };
+}
 /** True when the caller asked for anything the plain list path can't express. */
 function hasFacetQuery(i) {
     return !!(i.facets ||
@@ -107,7 +117,7 @@ async function listEscalations(input, auth) {
                 limit: input.limit ?? 50,
                 offset: input.offset ?? 0,
             });
-            return { status: 200, data: result };
+            return { status: 200, data: projectListResult(result, input.include) };
         }
         const result = await escalationService.listEscalations({
             status: input.status,
@@ -127,7 +137,7 @@ async function listEscalations(input, auth) {
             selfRoles: scope.global ? undefined : scope.selfRoles,
             meUserId: auth.userId,
         });
-        return { status: 200, data: result };
+        return { status: 200, data: projectListResult(result, input.include) };
     }
     catch (err) {
         return { status: 500, error: err.message };
@@ -182,7 +192,7 @@ async function listAvailableEscalations(input, auth) {
                 limit: input.limit ?? 50,
                 offset: input.offset ?? 0,
             });
-            return { status: 200, data: result };
+            return { status: 200, data: projectListResult(result, input.include) };
         }
         const result = await escalationService.listAvailableEscalations({
             role: input.role,
@@ -198,7 +208,7 @@ async function listAvailableEscalations(input, auth) {
             selfRoles: scope.global ? undefined : scope.selfRoles,
             meUserId: auth.userId,
         });
-        return { status: 200, data: result };
+        return { status: 200, data: projectListResult(result, input.include) };
     }
     catch (err) {
         return { status: 500, error: err.message };

package/build/api/index.d.ts

@@ -18,3 +18,4 @@ export * as workflowSets from './workflow-sets';
 export * as dba from './dba';
 export * as namespaces from './namespaces';
 export * as maintenance from './maintenance';
+export * as announcements from './announcements';

package/build/api/index.js

@@ -33,7 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.maintenance = exports.namespaces = exports.dba = exports.workflowSets = exports.botAccounts = exports.controlplane = exports.exports = exports.settings = exports.insight = exports.mcpRuns = exports.pipelines = exports.mcp = exports.auth = exports.personas = exports.roles = exports.users = exports.yamlWorkflows = exports.workflows = exports.escalations = exports.tasks = void 0;
+exports.announcements = exports.maintenance = exports.namespaces = exports.dba = exports.workflowSets = exports.botAccounts = exports.controlplane = exports.exports = exports.settings = exports.insight = exports.mcpRuns = exports.pipelines = exports.mcp = exports.auth = exports.personas = exports.roles = exports.users = exports.yamlWorkflows = exports.workflows = exports.escalations = exports.tasks = void 0;
 exports.tasks = __importStar(require("./tasks"));
 exports.escalations = __importStar(require("./escalations"));
 exports.workflows = __importStar(require("./workflows"));
@@ -54,3 +54,4 @@ exports.workflowSets = __importStar(require("./workflow-sets"));
 exports.dba = __importStar(require("./dba"));
 exports.namespaces = __importStar(require("./namespaces"));
 exports.maintenance = __importStar(require("./maintenance"));
+exports.announcements = __importStar(require("./announcements"));

package/build/api/workflows/config.d.ts

@@ -55,6 +55,7 @@ export declare function upsertWorkflowConfig(input: {
     envelope_schema?: any;
     resolver_schema?: any;
     cron_schedule?: string | null;
+    read_safe?: boolean;
 }): Promise<LTApiResult>;
 /**
  * Delete a workflow configuration.

package/build/api/workflows/config.js

@@ -120,6 +120,7 @@ async function upsertWorkflowConfig(input) {
             envelope_schema: input.envelope_schema ?? null,
             resolver_schema: input.resolver_schema ?? null,
             cron_schedule: input.cron_schedule ?? null,
+            read_safe: input.read_safe ?? false,
         });
         ltconfig_1.ltConfig.invalidate();
         await cron_1.cronRegistry.restartCron(config);

package/build/api/workflows/discovery.js

@@ -113,6 +113,7 @@ async function listDiscoveredWorkflows(input) {
                 registered: !!config,
                 active: !!worker,
                 invocable: config?.invocable ?? !!worker,
+                read_safe: config?.read_safe ?? false,
                 system: registry_1.SYSTEM_WORKFLOWS.has(workflowType),
                 description: config?.description ?? null,
                 roles: config?.roles ?? [],

package/build/lib/db/schemas/031_announcements.sql

@@ -0,0 +1,30 @@
+-- Migration 031: Dashboard announcements
+--
+-- Broadcast notices for the dashboard surface (system.surfaces.dashboard).
+-- Role targeting is display scoping only — live events reach every
+-- authenticated socket, so a body must never carry secrets. Rows expire by
+-- timestamp; dismissal is per-browser on the client.
+
+CREATE TABLE IF NOT EXISTS lt_announcements (
+  id         UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  title      TEXT,
+  body       TEXT NOT NULL,
+  layout     TEXT NOT NULL DEFAULT 'banner',
+  roles      TEXT[] NOT NULL DEFAULT '{}',
+  created_by TEXT,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  expires_at TIMESTAMPTZ NOT NULL DEFAULT NOW() + INTERVAL '24 hours'
+);
+
+CREATE INDEX IF NOT EXISTS idx_lt_announcements_expires ON lt_announcements (expires_at);
+
+-- The announcement topic (system.surfaces.dashboard) introduces the
+-- 'surfaces' category to the topic catalog.
+ALTER TABLE lt_topic_catalog
+  DROP CONSTRAINT IF EXISTS lt_topic_catalog_category_check;
+
+ALTER TABLE lt_topic_catalog
+  ADD CONSTRAINT lt_topic_catalog_category_check
+  CHECK (category IN (
+    'task','workflow','escalation','activity','knowledge','file','agent','app','milestone','surfaces'
+  ));

package/build/lib/db/schemas/032_workflow_read_safe.sql

@@ -0,0 +1,9 @@
+-- Migration 032: read-safe workflow flag
+--
+-- Marks a workflow as side-effect-free for external MCP callers: the
+-- invoke_workflow_read_safe tool (manifest read_safe: true) starts only
+-- workflows carrying this flag, extending the tool-manifest read-scope
+-- contract to workflow invocation. Fail-closed: unset means not read-safe.
+
+ALTER TABLE lt_config_workflows
+  ADD COLUMN IF NOT EXISTS read_safe BOOLEAN NOT NULL DEFAULT false;

package/build/lib/events/publish.d.ts

@@ -64,6 +64,21 @@ export declare function publishActivityEvent(params: {
     activityName: string;
     data?: Record<string, any>;
 }): Promise<void>;
+/**
+ * The dashboard-surface broadcast subject. Announcements publish here and the
+ * dashboard subscribes; the payload is the announcement row (small by
+ * nature). Delivery reaches every authenticated socket — role targeting is
+ * display scoping, never confidentiality.
+ */
+export declare const ANNOUNCEMENT_TOPIC = "system.surfaces.dashboard";
+/**
+ * Publish a dashboard announcement event.
+ * Subject: system.surfaces.dashboard (fixed — one surface, one channel)
+ */
+export declare function publishAnnouncementEvent(params: {
+    type: 'announcement.created' | 'announcement.deleted';
+    announcement: Record<string, any>;
+}): Promise<void>;
 /**
  * Publish a knowledge lifecycle event.
  * Subject: system.knowledge.{domain}.{action}

package/build/lib/events/publish.js

@@ -1,9 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.ANNOUNCEMENT_TOPIC = void 0;
 exports.publishMilestoneEvent = publishMilestoneEvent;
 exports.publishTaskEvent = publishTaskEvent;
 exports.publishEscalationEvent = publishEscalationEvent;
 exports.publishActivityEvent = publishActivityEvent;
+exports.publishAnnouncementEvent = publishAnnouncementEvent;
 exports.publishKnowledgeEvent = publishKnowledgeEvent;
 exports.publishFileEvent = publishFileEvent;
 exports.publishAgentEvent = publishAgentEvent;
@@ -104,6 +106,26 @@ function publishActivityEvent(params) {
         timestamp: new Date().toISOString(),
     });
 }
+/**
+ * The dashboard-surface broadcast subject. Announcements publish here and the
+ * dashboard subscribes; the payload is the announcement row (small by
+ * nature). Delivery reaches every authenticated socket — role targeting is
+ * display scoping, never confidentiality.
+ */
+exports.ANNOUNCEMENT_TOPIC = 'system.surfaces.dashboard';
+/**
+ * Publish a dashboard announcement event.
+ * Subject: system.surfaces.dashboard (fixed — one surface, one channel)
+ */
+function publishAnnouncementEvent(params) {
+    const action = params.type.split('.')[1];
+    return fireAndForget({
+        type: exports.ANNOUNCEMENT_TOPIC,
+        source: 'announcement',
+        data: { action, announcement: params.announcement },
+        timestamp: new Date().toISOString(),
+    });
+}
 /**
  * Publish a knowledge lifecycle event.
  * Subject: system.knowledge.{domain}.{action}

package/build/routes/announcements.d.ts

@@ -0,0 +1,2 @@
+declare const router: import("express-serve-static-core").Router;
+export default router;

package/build/routes/announcements.js

@@ -0,0 +1,64 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const express_1 = require("express");
+const api = __importStar(require("../api/announcements"));
+const auth_1 = require("../modules/auth");
+const router = (0, express_1.Router)();
+/**
+ * Dashboard announcements. Publishing and removal are role-manager acts
+ * (superadmin, admin type, or engineer); any authenticated user reads their
+ * role-filtered slice. Targeting is display scoping — the live event
+ * broadcasts to every authenticated subscriber.
+ */
+router.get('/', async (req, res) => {
+    const result = await api.listAnnouncements(req.auth);
+    res.status(result.status).json(result.data ?? { error: result.error });
+});
+router.post('/', auth_1.requireRoleManager, async (req, res) => {
+    const result = await api.createAnnouncement({
+        body: req.body?.body,
+        title: req.body?.title,
+        layout: req.body?.layout,
+        roles: req.body?.roles,
+        expiresAt: req.body?.expiresAt,
+    }, req.auth);
+    res.status(result.status).json(result.data ?? { error: result.error });
+});
+router.delete('/:id', auth_1.requireRoleManager, async (req, res) => {
+    const result = await api.deleteAnnouncement({ id: String(req.params.id) }, req.auth);
+    res.status(result.status).json(result.data ?? { error: result.error });
+});
+exports.default = router;

package/build/routes/escalations/list.js

@@ -109,6 +109,7 @@ function registerListRoutes(router) {
             orderBy: jsonParam(req.query.orderBy),
             available: req.query.available != null ? req.query.available === 'true' : undefined,
             jeopardy: req.query.jeopardy === '1' || req.query.jeopardy === 'true' || undefined,
+            include: req.query.include,
         }, req.auth);
         res.status(result.status).json(result.data ?? { error: result.error });
     });
@@ -136,6 +137,7 @@ function registerListRoutes(router) {
             exists: jsonParam(req.query.exists),
             orderBy: jsonParam(req.query.orderBy),
             jeopardy: req.query.jeopardy === '1' || req.query.jeopardy === 'true' || undefined,
+            include: req.query.include,
         }, req.auth);
         res.status(result.status).json(result.data ?? { error: result.error });
     });

package/build/routes/index.js

@@ -38,6 +38,7 @@ const topics_1 = __importDefault(require("./topics"));
 const nats_credentials_1 = __importDefault(require("./nats-credentials"));
 const scan_codes_1 = __importDefault(require("./scan-codes"));
 const domain_1 = __importDefault(require("./domain"));
+const announcements_1 = __importDefault(require("./announcements"));
 const router = (0, express_1.Router)();
 // Public routes (no auth required — they handle their own auth)
 router.use('/auth', auth_2.default);
@@ -76,6 +77,7 @@ router.use('/capabilities', capabilities_1.default);
 router.use('/topics', topics_1.default);
 router.use('/scan-codes', scan_codes_1.default);
 router.use('/domain', domain_1.default);
+router.use('/announcements', announcements_1.default);
 const overview_1 = __importDefault(require("./overview"));
 router.use('/overview', overview_1.default);
 const diagnostics_1 = __importDefault(require("./diagnostics"));

package/build/services/announcement/index.d.ts

@@ -0,0 +1,30 @@
+/**
+ * A dashboard announcement — a broadcast notice on the dashboard surface.
+ * Role targeting is display scoping only (live events reach every
+ * authenticated socket); bodies must never carry secrets.
+ */
+export interface LTAnnouncement {
+    id: string;
+    title: string | null;
+    /** Markdown. */
+    body: string;
+    layout: string;
+    /** Empty = everyone; otherwise shown to holders of any named role. */
+    roles: string[];
+    created_by: string | null;
+    created_at: string;
+    expires_at: string;
+}
+/** Only the body is required; everything else has a liberal default (24h expiry). */
+export declare function createAnnouncement(input: {
+    body: string;
+    title?: string;
+    layout?: string;
+    roles?: string[];
+    createdBy?: string;
+    expiresAt?: string;
+}): Promise<LTAnnouncement>;
+/** Active announcements visible to a viewer; null roles = the unscoped admin view. */
+export declare function listActiveAnnouncements(userRoles: string[] | null): Promise<LTAnnouncement[]>;
+/** Returns the deleted row so the caller can publish its removal, or null. */
+export declare function deleteAnnouncement(id: string): Promise<LTAnnouncement | null>;

package/build/services/announcement/index.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAnnouncement = createAnnouncement;
+exports.listActiveAnnouncements = listActiveAnnouncements;
+exports.deleteAnnouncement = deleteAnnouncement;
+const db_1 = require("../../lib/db");
+const sql_1 = require("./sql");
+/** Only the body is required; everything else has a liberal default (24h expiry). */
+async function createAnnouncement(input) {
+    const { rows } = await (0, db_1.getPool)().query(sql_1.INSERT_ANNOUNCEMENT, [
+        input.title ?? null,
+        input.body,
+        input.layout ?? null,
+        input.roles ?? null,
+        input.createdBy ?? null,
+        input.expiresAt ?? null,
+    ]);
+    return rows[0];
+}
+/** Active announcements visible to a viewer; null roles = the unscoped admin view. */
+async function listActiveAnnouncements(userRoles) {
+    const { rows } = await (0, db_1.getPool)().query(sql_1.LIST_ACTIVE_ANNOUNCEMENTS, [userRoles]);
+    return rows;
+}
+/** Returns the deleted row so the caller can publish its removal, or null. */
+async function deleteAnnouncement(id) {
+    const { rows } = await (0, db_1.getPool)().query(sql_1.DELETE_ANNOUNCEMENT, [id]);
+    return rows[0] ?? null;
+}

package/build/services/announcement/sql.d.ts

@@ -0,0 +1,8 @@
+export declare const INSERT_ANNOUNCEMENT = "\n  INSERT INTO lt_announcements (title, body, layout, roles, created_by, expires_at)\n  VALUES ($1, $2, COALESCE($3, 'banner'), COALESCE($4::text[], '{}'), $5,\n          COALESCE($6::timestamptz, NOW() + INTERVAL '24 hours'))\n  RETURNING *";
+/**
+ * Active announcements for a viewer. $1 = the viewer's role names, or NULL
+ * for the unscoped admin view. Untargeted rows (roles = '{}') reach everyone;
+ * targeted rows reach holders of any named role.
+ */
+export declare const LIST_ACTIVE_ANNOUNCEMENTS = "\n  SELECT * FROM lt_announcements\n  WHERE expires_at > NOW()\n    AND ($1::text[] IS NULL OR roles = '{}' OR roles && $1::text[])\n  ORDER BY created_at DESC";
+export declare const DELETE_ANNOUNCEMENT = "\n  DELETE FROM lt_announcements WHERE id = $1\n  RETURNING *";

package/build/services/announcement/sql.js

@@ -0,0 +1,24 @@
+"use strict";
+// ─── Announcement queries ────────────────────────────────────────────────────
+// Liberal defaults live in the SQL so the service contract is self-describing:
+// only the body is required; layout, targeting, and the 24-hour expiry fill in.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DELETE_ANNOUNCEMENT = exports.LIST_ACTIVE_ANNOUNCEMENTS = exports.INSERT_ANNOUNCEMENT = void 0;
+exports.INSERT_ANNOUNCEMENT = `
+  INSERT INTO lt_announcements (title, body, layout, roles, created_by, expires_at)
+  VALUES ($1, $2, COALESCE($3, 'banner'), COALESCE($4::text[], '{}'), $5,
+          COALESCE($6::timestamptz, NOW() + INTERVAL '24 hours'))
+  RETURNING *`;
+/**
+ * Active announcements for a viewer. $1 = the viewer's role names, or NULL
+ * for the unscoped admin view. Untargeted rows (roles = '{}') reach everyone;
+ * targeted rows reach holders of any named role.
+ */
+exports.LIST_ACTIVE_ANNOUNCEMENTS = `
+  SELECT * FROM lt_announcements
+  WHERE expires_at > NOW()
+    AND ($1::text[] IS NULL OR roles = '{}' OR roles && $1::text[])
+  ORDER BY created_at DESC`;
+exports.DELETE_ANNOUNCEMENT = `
+  DELETE FROM lt_announcements WHERE id = $1
+  RETURNING *`;

package/build/services/config/cache.js

@@ -19,6 +19,7 @@ async function loadAllConfigs() {
             resolverSchema: c.resolver_schema ?? null,
             cronSchedule: c.cron_schedule ?? null,
             executeAs: c.execute_as ?? null,
+            readSafe: c.read_safe ?? false,
         });
     }
     return map;

package/build/services/config/read.js

@@ -29,6 +29,7 @@ async function getWorkflowConfig(workflowType) {
         resolver_schema: wf.resolver_schema ?? null,
         cron_schedule: wf.cron_schedule ?? null,
         execute_as: wf.execute_as ?? null,
+        read_safe: wf.read_safe ?? false,
     };
 }
 async function listWorkflowConfigs() {
@@ -66,5 +67,6 @@ async function listWorkflowConfigs() {
         resolver_schema: wf.resolver_schema ?? null,
         cron_schedule: wf.cron_schedule ?? null,
         execute_as: wf.execute_as ?? null,
+        read_safe: wf.read_safe ?? false,
     }));
 }

package/build/services/config/sql.d.ts

@@ -5,13 +5,13 @@ export declare const LIST_ALL_WORKFLOWS = "SELECT * FROM lt_config_workflows ORD
 export declare const LIST_ALL_ROLES = "SELECT * FROM lt_config_roles ORDER BY workflow_type, role";
 export declare const LIST_ALL_INVOCATION_ROLES = "SELECT * FROM lt_config_invocation_roles ORDER BY workflow_type, role";
 export declare const ENSURE_ROLE_EXISTS = "INSERT INTO lt_roles (role) VALUES ($1) ON CONFLICT DO NOTHING";
-export declare const UPSERT_WORKFLOW = "INSERT INTO lt_config_workflows\n  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified)\nVALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)\nON CONFLICT (workflow_type) DO UPDATE SET\n  invocable = EXCLUDED.invocable,\n  task_queue = EXCLUDED.task_queue,\n  default_role = EXCLUDED.default_role,\n  description = EXCLUDED.description,\n  consumes = EXCLUDED.consumes,\n  envelope_schema = EXCLUDED.envelope_schema,\n  resolver_schema = EXCLUDED.resolver_schema,\n  cron_schedule = EXCLUDED.cron_schedule,\n  tool_tags = EXCLUDED.tool_tags,\n  execute_as = EXCLUDED.execute_as,\n  certified = EXCLUDED.certified";
+export declare const UPSERT_WORKFLOW = "INSERT INTO lt_config_workflows\n  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified, read_safe)\nVALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)\nON CONFLICT (workflow_type) DO UPDATE SET\n  invocable = EXCLUDED.invocable,\n  task_queue = EXCLUDED.task_queue,\n  default_role = EXCLUDED.default_role,\n  description = EXCLUDED.description,\n  consumes = EXCLUDED.consumes,\n  envelope_schema = EXCLUDED.envelope_schema,\n  resolver_schema = EXCLUDED.resolver_schema,\n  cron_schedule = EXCLUDED.cron_schedule,\n  tool_tags = EXCLUDED.tool_tags,\n  execute_as = EXCLUDED.execute_as,\n  certified = EXCLUDED.certified,\n  read_safe = EXCLUDED.read_safe";
 export declare const DELETE_CONFIG_ROLES = "DELETE FROM lt_config_roles WHERE workflow_type = $1";
 export declare const INSERT_CONFIG_ROLE = "INSERT INTO lt_config_roles (workflow_type, role) VALUES ($1, $2)";
 export declare const DELETE_INVOCATION_ROLES = "DELETE FROM lt_config_invocation_roles WHERE workflow_type = $1";
 export declare const INSERT_INVOCATION_ROLE = "INSERT INTO lt_config_invocation_roles (workflow_type, role) VALUES ($1, $2)";
 export declare const DELETE_WORKFLOW = "DELETE FROM lt_config_workflows WHERE workflow_type = $1";
-export declare const SEED_WORKFLOW_CONFIG = "INSERT INTO lt_config_workflows\n  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified)\nVALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)\nON CONFLICT (workflow_type) DO NOTHING";
+export declare const SEED_WORKFLOW_CONFIG = "INSERT INTO lt_config_workflows\n  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified, read_safe)\nVALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)\nON CONFLICT (workflow_type) DO NOTHING";
 export declare const SEED_CONFIG_ROLE = "INSERT INTO lt_config_roles (workflow_type, role) VALUES ($1, $2)\nON CONFLICT (workflow_type, role) DO NOTHING";
 export declare const SEED_INVOCATION_ROLE = "INSERT INTO lt_config_invocation_roles (workflow_type, role) VALUES ($1, $2)\nON CONFLICT (workflow_type, role) DO NOTHING";
 export declare const GET_PROVIDER_DATA = "SELECT workflow_type, data, completed_at\n  FROM lt_tasks\n WHERE origin_id = $1\n   AND workflow_type = ANY($2)\n   AND status = 'completed'\n ORDER BY completed_at DESC";

package/build/services/config/sql.js

@@ -23,8 +23,8 @@ exports.ENSURE_ROLE_EXISTS = `\
 INSERT INTO lt_roles (role) VALUES ($1) ON CONFLICT DO NOTHING`;
 exports.UPSERT_WORKFLOW = `\
 INSERT INTO lt_config_workflows
-  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified)
-VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)
+  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified, read_safe)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)
 ON CONFLICT (workflow_type) DO UPDATE SET
   invocable = EXCLUDED.invocable,
   task_queue = EXCLUDED.task_queue,
@@ -36,7 +36,8 @@ ON CONFLICT (workflow_type) DO UPDATE SET
   cron_schedule = EXCLUDED.cron_schedule,
   tool_tags = EXCLUDED.tool_tags,
   execute_as = EXCLUDED.execute_as,
-  certified = EXCLUDED.certified`;
+  certified = EXCLUDED.certified,
+  read_safe = EXCLUDED.read_safe`;
 exports.DELETE_CONFIG_ROLES = `\
 DELETE FROM lt_config_roles WHERE workflow_type = $1`;
 exports.INSERT_CONFIG_ROLE = `\
@@ -52,8 +53,8 @@ DELETE FROM lt_config_workflows WHERE workflow_type = $1`;
 // ------------------------------------------------------------------ //
 exports.SEED_WORKFLOW_CONFIG = `\
 INSERT INTO lt_config_workflows
-  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified)
-VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)
+  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified, read_safe)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)
 ON CONFLICT (workflow_type) DO NOTHING`;
 exports.SEED_CONFIG_ROLE = `\
 INSERT INTO lt_config_roles (workflow_type, role) VALUES ($1, $2)

package/build/services/config/write.js

@@ -52,6 +52,7 @@ async function replaceWorkflowConfig(config, certified) {
             config.tool_tags || [],
             config.execute_as ?? null,
             certified,
+            config.read_safe ?? false,
         ]);
         // Replace roles
         await client.query(sql_1.DELETE_CONFIG_ROLES, [config.workflow_type]);
@@ -112,6 +113,7 @@ async function seedWorkflowConfig(config) {
         config.tool_tags || [],
         config.execute_as ?? null,
         resolveCertified(config),
+        config.read_safe ?? false,
     ]);
     const inserted = (rowCount ?? 0) > 0;
     if (inserted) {
@@ -134,6 +136,8 @@ async function seedWorkflowConfig(config) {
                 drifts.push('invocable');
             if (resolveCertified(config) !== existing.certified)
                 drifts.push('certified');
+            if ((config.read_safe ?? false) !== (existing.read_safe ?? false))
+                drifts.push('read_safe');
             if (config.default_role !== existing.default_role)
                 drifts.push('default_role');
             if (JSON.stringify(config.envelope_schema) !== JSON.stringify(existing.envelope_schema))
@@ -169,6 +173,7 @@ async function applyWorkflowConfig(config) {
             existing.default_role === config.default_role &&
             (existing.description ?? null) === (config.description ?? null) &&
             existing.certified === certified &&
+            (existing.read_safe ?? false) === (config.read_safe ?? false) &&
             (existing.cron_schedule ?? null) === (config.cron_schedule ?? null) &&
             (existing.execute_as ?? null) === (config.execute_as ?? null) &&
             sortedEqual(existing.consumes ?? [], config.consumes ?? []) &&