@hotmeshio/long-tail 0.19.0 → 0.19.1

package/build/api/workflows/config.d.ts

@@ -35,7 +35,9 @@ export declare function getWorkflowConfig(input: {
  * @param input.invocation_roles — roles that can invoke this workflow
  * @param input.consumes — workflow types whose data this workflow consumes
  * @param input.tool_tags — MCP tool tags for discovery
- * @param input.envelope_schema — JSON Schema for envelope.data validation
+ * @param input.envelope_schema — JSON template that pre-fills the invoke form
+ * @param input.input_schema — x-lt-* JSON Schema for the rich invoke form; invoke validates data against it
+ * @param input.icon — curated icon name (WORKFLOW_ICONS); anything else is refused
  * @param input.resolver_schema — JSON Schema for resolver payload validation
  * @param input.cron_schedule — cron expression for scheduled execution
  * @returns `{ status: 200, data: <saved config> }`
@@ -53,6 +55,8 @@ export declare function upsertWorkflowConfig(input: {
     consumes?: string[];
     tool_tags?: string[];
     envelope_schema?: any;
+    input_schema?: any;
+    icon?: string | null;
     resolver_schema?: any;
     cron_schedule?: string | null;
     read_safe?: boolean;

package/build/api/workflows/config.js

@@ -38,6 +38,7 @@ exports.getWorkflowConfig = getWorkflowConfig;
 exports.upsertWorkflowConfig = upsertWorkflowConfig;
 exports.deleteWorkflowConfig = deleteWorkflowConfig;
 const configService = __importStar(require("../../services/config"));
+const workflow_icons_1 = require("../../types/workflow-icons");
 const cron_1 = require("../../services/cron");
 const ltconfig_1 = require("../../modules/ltconfig");
 /**
@@ -93,13 +94,18 @@ async function getWorkflowConfig(input) {
  * @param input.invocation_roles — roles that can invoke this workflow
  * @param input.consumes — workflow types whose data this workflow consumes
  * @param input.tool_tags — MCP tool tags for discovery
- * @param input.envelope_schema — JSON Schema for envelope.data validation
+ * @param input.envelope_schema — JSON template that pre-fills the invoke form
+ * @param input.input_schema — x-lt-* JSON Schema for the rich invoke form; invoke validates data against it
+ * @param input.icon — curated icon name (WORKFLOW_ICONS); anything else is refused
  * @param input.resolver_schema — JSON Schema for resolver payload validation
  * @param input.cron_schedule — cron expression for scheduled execution
  * @returns `{ status: 200, data: <saved config> }`
  */
 async function upsertWorkflowConfig(input) {
     try {
+        if (input.icon && !(0, workflow_icons_1.isWorkflowIcon)(input.icon)) {
+            return { status: 400, error: `Unknown workflow icon "${input.icon}"; choose one of WORKFLOW_ICONS` };
+        }
         // Validate cron expression before persisting
         if (input.cron_schedule) {
             const { validateCronSchedule } = await Promise.resolve().then(() => __importStar(require('../../services/cron')));
@@ -118,6 +124,8 @@ async function upsertWorkflowConfig(input) {
             consumes: input.consumes ?? [],
             tool_tags: input.tool_tags ?? [],
             envelope_schema: input.envelope_schema ?? null,
+            input_schema: input.input_schema ?? null,
+            icon: input.icon ?? null,
             resolver_schema: input.resolver_schema ?? null,
             cron_schedule: input.cron_schedule ?? null,
             read_safe: input.read_safe ?? false,

package/build/api/workflows/index.d.ts

@@ -1,3 +1,6 @@
 export { invokeWorkflow, getWorkflowStatus, getWorkflowResult, terminateWorkflow, exportWorkflow, } from './invocation';
 export { listWorkers, listDiscoveredWorkflows, getCronStatus, } from './discovery';
+export { listInvocableWorkflows, WORKFLOW_TIERS } from './invocable';
+export type { InvocableWorkflowEntry, WorkflowTier } from './invocable';
+export { checkInvokeInput, inputValidationFailure } from './input-validation';
 export { listWorkflowConfigs, getWorkflowConfig, upsertWorkflowConfig, deleteWorkflowConfig, } from './config';

package/build/api/workflows/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.deleteWorkflowConfig = exports.upsertWorkflowConfig = exports.getWorkflowConfig = exports.listWorkflowConfigs = exports.getCronStatus = exports.listDiscoveredWorkflows = exports.listWorkers = exports.exportWorkflow = exports.terminateWorkflow = exports.getWorkflowResult = exports.getWorkflowStatus = exports.invokeWorkflow = void 0;
+exports.deleteWorkflowConfig = exports.upsertWorkflowConfig = exports.getWorkflowConfig = exports.listWorkflowConfigs = exports.inputValidationFailure = exports.checkInvokeInput = exports.WORKFLOW_TIERS = exports.listInvocableWorkflows = exports.getCronStatus = exports.listDiscoveredWorkflows = exports.listWorkers = exports.exportWorkflow = exports.terminateWorkflow = exports.getWorkflowResult = exports.getWorkflowStatus = exports.invokeWorkflow = void 0;
 var invocation_1 = require("./invocation");
 Object.defineProperty(exports, "invokeWorkflow", { enumerable: true, get: function () { return invocation_1.invokeWorkflow; } });
 Object.defineProperty(exports, "getWorkflowStatus", { enumerable: true, get: function () { return invocation_1.getWorkflowStatus; } });
@@ -11,6 +11,12 @@ var discovery_1 = require("./discovery");
 Object.defineProperty(exports, "listWorkers", { enumerable: true, get: function () { return discovery_1.listWorkers; } });
 Object.defineProperty(exports, "listDiscoveredWorkflows", { enumerable: true, get: function () { return discovery_1.listDiscoveredWorkflows; } });
 Object.defineProperty(exports, "getCronStatus", { enumerable: true, get: function () { return discovery_1.getCronStatus; } });
+var invocable_1 = require("./invocable");
+Object.defineProperty(exports, "listInvocableWorkflows", { enumerable: true, get: function () { return invocable_1.listInvocableWorkflows; } });
+Object.defineProperty(exports, "WORKFLOW_TIERS", { enumerable: true, get: function () { return invocable_1.WORKFLOW_TIERS; } });
+var input_validation_1 = require("./input-validation");
+Object.defineProperty(exports, "checkInvokeInput", { enumerable: true, get: function () { return input_validation_1.checkInvokeInput; } });
+Object.defineProperty(exports, "inputValidationFailure", { enumerable: true, get: function () { return input_validation_1.inputValidationFailure; } });
 var config_1 = require("./config");
 Object.defineProperty(exports, "listWorkflowConfigs", { enumerable: true, get: function () { return config_1.listWorkflowConfigs; } });
 Object.defineProperty(exports, "getWorkflowConfig", { enumerable: true, get: function () { return config_1.getWorkflowConfig; } });

package/build/api/workflows/input-validation.d.ts

@@ -0,0 +1,13 @@
+import { type LTValidationErrorBody } from '../../types/validation';
+import type { LTWorkflowConfig } from '../../types/config';
+import type { LTApiResult } from '../../types/sdk';
+/**
+ * The invoke input gate. A workflow that declares input_schema has its
+ * submitted data validated by the same shared pass the dashboard form runs,
+ * so a payload the form accepts is accepted here and a rejection lists the
+ * exact violations the form would show. No schema, no gate; a data value
+ * that is not an object is left to the service's own 400.
+ */
+export declare function checkInvokeInput(config: Pick<LTWorkflowConfig, 'workflow_type' | 'input_schema'> | null | undefined, data: unknown, metadata: Record<string, unknown> | null | undefined): LTValidationErrorBody | null;
+/** The canonical 422 result; the route serializes `data` as the body. */
+export declare function inputValidationFailure(body: LTValidationErrorBody): LTApiResult;

package/build/api/workflows/input-validation.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkInvokeInput = checkInvokeInput;
+exports.inputValidationFailure = inputValidationFailure;
+const validate_resolver_payload_1 = require("../../shared/form-validation/validate-resolver-payload");
+const invoke_context_1 = require("../../shared/form-validation/invoke-context");
+const validation_1 = require("../../types/validation");
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * The invoke input gate. A workflow that declares input_schema has its
+ * submitted data validated by the same shared pass the dashboard form runs,
+ * so a payload the form accepts is accepted here and a rejection lists the
+ * exact violations the form would show. No schema, no gate; a data value
+ * that is not an object is left to the service's own 400.
+ */
+function checkInvokeInput(config, data, metadata) {
+    const schema = config?.input_schema;
+    if (!schema || !isPlainObject(data))
+        return null;
+    const violations = (0, validate_resolver_payload_1.validateResolverPayload)(schema, data, (0, invoke_context_1.buildInvokeFormContext)(metadata));
+    if (violations.length === 0)
+        return null;
+    const n = violations.length;
+    return {
+        error: `data failed input schema validation (${n} violation${n === 1 ? '' : 's'})`,
+        code: validation_1.LT_ERROR_CODES.SCHEMA_VALIDATION,
+        violations,
+        role: null,
+        schemaVersion: null,
+        workflowType: config.workflow_type,
+    };
+}
+/** The canonical 422 result; the route serializes `data` as the body. */
+function inputValidationFailure(body) {
+    return { status: 422, error: body.error, code: body.code, data: body };
+}

package/build/api/workflows/invocable.d.ts

@@ -0,0 +1,19 @@
+import type { LTWorkflowConfig } from '../../types/config';
+import type { LTApiResult, LTApiAuth } from '../../types/sdk';
+export declare const WORKFLOW_TIERS: {
+    readonly DURABLE: "durable";
+    readonly REGISTERED: "registered";
+    readonly CERTIFIED: "certified";
+};
+export type WorkflowTier = (typeof WORKFLOW_TIERS)[keyof typeof WORKFLOW_TIERS];
+export type InvocableWorkflowEntry = LTWorkflowConfig & {
+    tier: WorkflowTier;
+};
+/**
+ * The workflows the caller may invoke, decided by the same predicate the
+ * invoke gate runs. Callers with global access also see active durable
+ * workers that carry no registration row, as the invoke gate admits them.
+ *
+ * @returns `{ status: 200, data: { workflows: InvocableWorkflowEntry[] } }`
+ */
+export declare function listInvocableWorkflows(auth: LTApiAuth): Promise<LTApiResult>;

package/build/api/workflows/invocable.js

@@ -0,0 +1,106 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WORKFLOW_TIERS = void 0;
+exports.listInvocableWorkflows = listInvocableWorkflows;
+const configService = __importStar(require("../../services/config"));
+const userService = __importStar(require("../../services/user"));
+const invocation_access_1 = require("../../services/invocation-access");
+const registry_1 = require("../../services/workers/registry");
+exports.WORKFLOW_TIERS = {
+    DURABLE: 'durable',
+    REGISTERED: 'registered',
+    CERTIFIED: 'certified',
+};
+function tierOf(config) {
+    if (!config)
+        return exports.WORKFLOW_TIERS.DURABLE;
+    return config.certified ? exports.WORKFLOW_TIERS.CERTIFIED : exports.WORKFLOW_TIERS.REGISTERED;
+}
+/** An active worker with no registration row, shaped like a config so one list type serves the page. */
+function durableEntry(workflowType, taskQueue) {
+    return {
+        workflow_type: workflowType,
+        invocable: true,
+        certified: false,
+        task_queue: taskQueue,
+        default_role: 'reviewer',
+        description: null,
+        roles: [],
+        invocation_roles: [],
+        consumes: [],
+        tool_tags: [],
+        envelope_schema: null,
+        input_schema: null,
+        icon: null,
+        resolver_schema: null,
+        cron_schedule: null,
+        execute_as: null,
+        read_safe: false,
+        tier: exports.WORKFLOW_TIERS.DURABLE,
+    };
+}
+/**
+ * The workflows the caller may invoke, decided by the same predicate the
+ * invoke gate runs. Callers with global access also see active durable
+ * workers that carry no registration row, as the invoke gate admits them.
+ *
+ * @returns `{ status: 200, data: { workflows: InvocableWorkflowEntry[] } }`
+ */
+async function listInvocableWorkflows(auth) {
+    try {
+        const [configs, user] = await Promise.all([
+            configService.listWorkflowConfigs(),
+            auth.userId ? userService.getUser(auth.userId) : Promise.resolve(null),
+        ]);
+        const roles = user?.roles ?? [];
+        const workflows = configs
+            .filter((c) => (0, invocation_access_1.canInvokeWorkflow)(c, roles, auth.role))
+            .map((c) => ({ ...c, tier: tierOf(c) }));
+        if ((0, invocation_access_1.hasGlobalInvocationAccess)(roles, auth.role)) {
+            const registered = new Set(configs.map((c) => c.workflow_type));
+            for (const [name, { taskQueue }] of (0, registry_1.getRegisteredWorkers)()) {
+                if (registered.has(name) || registry_1.SYSTEM_WORKFLOWS.has(name))
+                    continue;
+                workflows.push(durableEntry(name, taskQueue));
+            }
+        }
+        workflows.sort((a, b) => a.workflow_type.localeCompare(b.workflow_type));
+        return { status: 200, data: { workflows } };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}

package/build/api/workflows/invocation.js

@@ -43,6 +43,8 @@ const exportService = __importStar(require("../../services/export"));
 const task_1 = require("../../services/task");
 const workflow_invocation_1 = require("../../services/workflow-invocation");
 const crud_1 = require("../../services/escalation/crud");
+const configService = __importStar(require("../../services/config"));
+const input_validation_1 = require("./input-validation");
 function isResolveError(err) {
     return err?.message?.includes('Cannot resolve workflow');
 }
@@ -60,6 +62,10 @@ function isResolveError(err) {
 async function invokeWorkflow(input, auth) {
     try {
         await (0, workflow_invocation_1.checkInvocationRoles)(input.type, auth.userId, auth.role);
+        const config = await configService.getWorkflowConfig(input.type);
+        const violation = (0, input_validation_1.checkInvokeInput)(config, input.data, input.metadata);
+        if (violation)
+            return (0, input_validation_1.inputValidationFailure)(violation);
         const result = await (0, workflow_invocation_1.invokeWorkflow)({
             workflowType: input.type,
             data: input.data || {},

package/build/lib/db/schemas/034_workflow_input_schema.sql

@@ -0,0 +1,13 @@
+-- Migration 034: workflow input form and icon
+--
+-- Two opt-in columns on the workflow registration:
+--   input_schema — an x-lt-* JSON Schema the dashboard renders as the invoke
+--                  form and the invoke API validates submitted data against.
+--                  NULL keeps the legacy envelope_schema template form.
+--   icon         — a curated icon name (WORKFLOW_ICONS) shown in place of the
+--                  tier glyph on the Invoke page and registry. NULL keeps the
+--                  tier glyph.
+
+ALTER TABLE lt_config_workflows
+  ADD COLUMN IF NOT EXISTS input_schema JSONB,
+  ADD COLUMN IF NOT EXISTS icon TEXT;

package/build/routes/workflows/config.js

@@ -73,6 +73,8 @@ router.put('/:type/config', auth_1.requireAdmin, async (req, res) => {
         consumes: req.body.consumes,
         tool_tags: req.body.tool_tags,
         envelope_schema: req.body.envelope_schema,
+        input_schema: req.body.input_schema,
+        icon: req.body.icon,
         resolver_schema: req.body.resolver_schema,
         cron_schedule: req.body.cron_schedule,
     });

package/build/routes/workflows/discovery.js

@@ -60,6 +60,20 @@ router.get('/discovered', async (req, res) => {
     });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
+// ── Invocable for the caller ────────────────────────────────────────────────
+/**
+ * GET /api/workflows/invocable
+ * The workflows the calling user may invoke, decided by the invoke gate's
+ * own predicate. Drives the dashboard Invoke page and its nav entry.
+ */
+router.get('/invocable', async (req, res) => {
+    const result = await api.listInvocableWorkflows({
+        userId: req.auth?.userId ?? '',
+        role: req.auth?.role,
+        scopes: req.auth?.scopes,
+    });
+    res.status(result.status).json(result.data ?? { error: result.error });
+});
 // ── Cron status ─────────────────────────────────────────────────────────────
 /**
  * GET /api/workflows/cron/status

package/build/services/config/cache.js

@@ -16,6 +16,8 @@ async function loadAllConfigs() {
             consumes: c.consumes,
             toolTags: c.tool_tags || [],
             envelopeSchema: c.envelope_schema ?? null,
+            inputSchema: c.input_schema ?? null,
+            icon: c.icon ?? null,
             resolverSchema: c.resolver_schema ?? null,
             cronSchedule: c.cron_schedule ?? null,
             executeAs: c.execute_as ?? null,

package/build/services/config/read.js

@@ -26,6 +26,8 @@ async function getWorkflowConfig(workflowType) {
         consumes: wf.consumes || [],
         tool_tags: wf.tool_tags || [],
         envelope_schema: wf.envelope_schema ?? null,
+        input_schema: wf.input_schema ?? null,
+        icon: wf.icon ?? null,
         resolver_schema: wf.resolver_schema ?? null,
         cron_schedule: wf.cron_schedule ?? null,
         execute_as: wf.execute_as ?? null,
@@ -64,6 +66,8 @@ async function listWorkflowConfigs() {
         consumes: wf.consumes || [],
         tool_tags: wf.tool_tags || [],
         envelope_schema: wf.envelope_schema ?? null,
+        input_schema: wf.input_schema ?? null,
+        icon: wf.icon ?? null,
         resolver_schema: wf.resolver_schema ?? null,
         cron_schedule: wf.cron_schedule ?? null,
         execute_as: wf.execute_as ?? null,

package/build/services/config/sql.d.ts

@@ -5,13 +5,13 @@ export declare const LIST_ALL_WORKFLOWS = "SELECT * FROM lt_config_workflows ORD
 export declare const LIST_ALL_ROLES = "SELECT * FROM lt_config_roles ORDER BY workflow_type, role";
 export declare const LIST_ALL_INVOCATION_ROLES = "SELECT * FROM lt_config_invocation_roles ORDER BY workflow_type, role";
 export declare const ENSURE_ROLE_EXISTS = "INSERT INTO lt_roles (role) VALUES ($1) ON CONFLICT DO NOTHING";
-export declare const UPSERT_WORKFLOW = "INSERT INTO lt_config_workflows\n  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified, read_safe)\nVALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)\nON CONFLICT (workflow_type) DO UPDATE SET\n  invocable = EXCLUDED.invocable,\n  task_queue = EXCLUDED.task_queue,\n  default_role = EXCLUDED.default_role,\n  description = EXCLUDED.description,\n  consumes = EXCLUDED.consumes,\n  envelope_schema = EXCLUDED.envelope_schema,\n  resolver_schema = EXCLUDED.resolver_schema,\n  cron_schedule = EXCLUDED.cron_schedule,\n  tool_tags = EXCLUDED.tool_tags,\n  execute_as = EXCLUDED.execute_as,\n  certified = EXCLUDED.certified,\n  read_safe = EXCLUDED.read_safe";
+export declare const UPSERT_WORKFLOW = "INSERT INTO lt_config_workflows\n  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified, read_safe, input_schema, icon)\nVALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15)\nON CONFLICT (workflow_type) DO UPDATE SET\n  invocable = EXCLUDED.invocable,\n  task_queue = EXCLUDED.task_queue,\n  default_role = EXCLUDED.default_role,\n  description = EXCLUDED.description,\n  consumes = EXCLUDED.consumes,\n  envelope_schema = EXCLUDED.envelope_schema,\n  resolver_schema = EXCLUDED.resolver_schema,\n  cron_schedule = EXCLUDED.cron_schedule,\n  tool_tags = EXCLUDED.tool_tags,\n  execute_as = EXCLUDED.execute_as,\n  certified = EXCLUDED.certified,\n  read_safe = EXCLUDED.read_safe,\n  input_schema = EXCLUDED.input_schema,\n  icon = EXCLUDED.icon";
 export declare const DELETE_CONFIG_ROLES = "DELETE FROM lt_config_roles WHERE workflow_type = $1";
 export declare const INSERT_CONFIG_ROLE = "INSERT INTO lt_config_roles (workflow_type, role) VALUES ($1, $2)";
 export declare const DELETE_INVOCATION_ROLES = "DELETE FROM lt_config_invocation_roles WHERE workflow_type = $1";
 export declare const INSERT_INVOCATION_ROLE = "INSERT INTO lt_config_invocation_roles (workflow_type, role) VALUES ($1, $2)";
 export declare const DELETE_WORKFLOW = "DELETE FROM lt_config_workflows WHERE workflow_type = $1";
-export declare const SEED_WORKFLOW_CONFIG = "INSERT INTO lt_config_workflows\n  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified, read_safe)\nVALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)\nON CONFLICT (workflow_type) DO NOTHING";
+export declare const SEED_WORKFLOW_CONFIG = "INSERT INTO lt_config_workflows\n  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified, read_safe, input_schema, icon)\nVALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15)\nON CONFLICT (workflow_type) DO NOTHING";
 export declare const SEED_CONFIG_ROLE = "INSERT INTO lt_config_roles (workflow_type, role) VALUES ($1, $2)\nON CONFLICT (workflow_type, role) DO NOTHING";
 export declare const SEED_INVOCATION_ROLE = "INSERT INTO lt_config_invocation_roles (workflow_type, role) VALUES ($1, $2)\nON CONFLICT (workflow_type, role) DO NOTHING";
 export declare const GET_PROVIDER_DATA = "SELECT workflow_type, data, completed_at\n  FROM lt_tasks\n WHERE origin_id = $1\n   AND workflow_type = ANY($2)\n   AND status = 'completed'\n ORDER BY completed_at DESC";

package/build/services/config/sql.js

@@ -23,8 +23,8 @@ exports.ENSURE_ROLE_EXISTS = `\
 INSERT INTO lt_roles (role) VALUES ($1) ON CONFLICT DO NOTHING`;
 exports.UPSERT_WORKFLOW = `\
 INSERT INTO lt_config_workflows
-  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified, read_safe)
-VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)
+  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified, read_safe, input_schema, icon)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15)
 ON CONFLICT (workflow_type) DO UPDATE SET
   invocable = EXCLUDED.invocable,
   task_queue = EXCLUDED.task_queue,
@@ -37,7 +37,9 @@ ON CONFLICT (workflow_type) DO UPDATE SET
   tool_tags = EXCLUDED.tool_tags,
   execute_as = EXCLUDED.execute_as,
   certified = EXCLUDED.certified,
-  read_safe = EXCLUDED.read_safe`;
+  read_safe = EXCLUDED.read_safe,
+  input_schema = EXCLUDED.input_schema,
+  icon = EXCLUDED.icon`;
 exports.DELETE_CONFIG_ROLES = `\
 DELETE FROM lt_config_roles WHERE workflow_type = $1`;
 exports.INSERT_CONFIG_ROLE = `\
@@ -53,8 +55,8 @@ DELETE FROM lt_config_workflows WHERE workflow_type = $1`;
 // ------------------------------------------------------------------ //
 exports.SEED_WORKFLOW_CONFIG = `\
 INSERT INTO lt_config_workflows
-  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified, read_safe)
-VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)
+  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified, read_safe, input_schema, icon)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15)
 ON CONFLICT (workflow_type) DO NOTHING`;
 exports.SEED_CONFIG_ROLE = `\
 INSERT INTO lt_config_roles (workflow_type, role) VALUES ($1, $2)

package/build/services/config/write.js

@@ -53,6 +53,8 @@ async function replaceWorkflowConfig(config, certified) {
             config.execute_as ?? null,
             certified,
             config.read_safe ?? false,
+            config.input_schema ?? null,
+            config.icon ?? null,
         ]);
         // Replace roles
         await client.query(sql_1.DELETE_CONFIG_ROLES, [config.workflow_type]);
@@ -114,6 +116,8 @@ async function seedWorkflowConfig(config) {
         config.execute_as ?? null,
         resolveCertified(config),
         config.read_safe ?? false,
+        config.input_schema ?? null,
+        config.icon ?? null,
     ]);
     const inserted = (rowCount ?? 0) > 0;
     if (inserted) {
@@ -144,6 +148,10 @@ async function seedWorkflowConfig(config) {
                 drifts.push('envelope_schema');
             if (JSON.stringify(config.resolver_schema) !== JSON.stringify(existing.resolver_schema))
                 drifts.push('resolver_schema');
+            if (JSON.stringify(config.input_schema ?? null) !== JSON.stringify(existing.input_schema ?? null))
+                drifts.push('input_schema');
+            if ((config.icon ?? null) !== (existing.icon ?? null))
+                drifts.push('icon');
             if (drifts.length) {
                 logger_1.loggerRegistry.warn(`[long-tail] config drift: ${config.workflow_type} — ${drifts.join(', ')} differ between code and DB`);
             }
@@ -181,7 +189,9 @@ async function applyWorkflowConfig(config) {
             sortedEqual(existing.roles ?? [], config.roles ?? []) &&
             sortedEqual(existing.invocation_roles ?? [], config.invocation_roles ?? []) &&
             (0, node_util_1.isDeepStrictEqual)(existing.envelope_schema ?? null, config.envelope_schema ?? null) &&
-            (0, node_util_1.isDeepStrictEqual)(existing.resolver_schema ?? null, config.resolver_schema ?? null);
+            (0, node_util_1.isDeepStrictEqual)(existing.resolver_schema ?? null, config.resolver_schema ?? null) &&
+            (0, node_util_1.isDeepStrictEqual)(existing.input_schema ?? null, config.input_schema ?? null) &&
+            (existing.icon ?? null) === (config.icon ?? null);
         if (unchanged)
             return 'unchanged';
     }

package/build/services/interceptor/index.js

@@ -47,6 +47,11 @@ const context_2 = require("../iam/context");
 const publish_1 = require("../../lib/events/publish");
 const envelope_1 = require("../iam/envelope");
 const DEFAULT_ACTIVITY_QUEUE = 'lt-interceptor';
+/** The result payload a completed event carries: the workflow's `data` when it returned the envelope shape. */
+function resultData(result) {
+    const data = result?.data;
+    return data && typeof data === 'object' && !Array.isArray(data) ? data : undefined;
+}
 /**
  * Register the Long Tail interceptors in a single call.
  *
@@ -120,6 +125,7 @@ function createLTInterceptor(options) {
                     workflowName: wf.workflowName,
                     taskQueue: taskQueue0,
                     status: 'completed',
+                    data: resultData(result0),
                 });
                 return result0;
             }
@@ -138,6 +144,7 @@ function createLTInterceptor(options) {
                     workflowName: wf.workflowName,
                     taskQueue: taskQueue2,
                     status: 'completed',
+                    data: resultData(result2),
                 });
                 return result2;
             }

package/build/services/invocation-access.d.ts

@@ -0,0 +1,18 @@
+import type { LTWorkflowConfig } from '../types/config';
+export interface InvocationRoleGrant {
+    role: string;
+    type: string;
+}
+export declare const INVOCATION_ROLE_TYPES: {
+    readonly SUPERADMIN: "superadmin";
+    readonly ADMIN: "admin";
+};
+export declare const ADMIN_ROLE = "admin";
+/** Superadmin anywhere, or the named admin role held as admin type, invokes every workflow. */
+export declare function hasGlobalInvocationAccess(roles: readonly InvocationRoleGrant[], authRole?: string): boolean;
+/**
+ * The one invocation predicate, shared by the invoke gate and the per-caller
+ * list so the two can never disagree. An empty invocation_roles list opens
+ * the workflow to every authenticated caller.
+ */
+export declare function canInvokeWorkflow(config: Pick<LTWorkflowConfig, 'invocable' | 'invocation_roles'>, roles: readonly InvocationRoleGrant[], authRole?: string): boolean;

package/build/services/invocation-access.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ADMIN_ROLE = exports.INVOCATION_ROLE_TYPES = void 0;
+exports.hasGlobalInvocationAccess = hasGlobalInvocationAccess;
+exports.canInvokeWorkflow = canInvokeWorkflow;
+exports.INVOCATION_ROLE_TYPES = {
+    SUPERADMIN: 'superadmin',
+    ADMIN: 'admin',
+};
+exports.ADMIN_ROLE = 'admin';
+/** Superadmin anywhere, or the named admin role held as admin type, invokes every workflow. */
+function hasGlobalInvocationAccess(roles, authRole) {
+    if (authRole === exports.INVOCATION_ROLE_TYPES.SUPERADMIN)
+        return true;
+    return roles.some((r) => r.type === exports.INVOCATION_ROLE_TYPES.SUPERADMIN)
+        || roles.some((r) => r.role === exports.ADMIN_ROLE && r.type === exports.INVOCATION_ROLE_TYPES.ADMIN);
+}
+/**
+ * The one invocation predicate, shared by the invoke gate and the per-caller
+ * list so the two can never disagree. An empty invocation_roles list opens
+ * the workflow to every authenticated caller.
+ */
+function canInvokeWorkflow(config, roles, authRole) {
+    if (!config.invocable)
+        return false;
+    if (config.invocation_roles.length === 0)
+        return true;
+    if (hasGlobalInvocationAccess(roles, authRole))
+        return true;
+    const held = new Set(roles.map((r) => r.role));
+    return config.invocation_roles.some((r) => held.has(r));
+}

package/build/services/workflow-invocation.js

@@ -46,6 +46,7 @@ exports.InvocationError = void 0;
 exports.invokeWorkflow = invokeWorkflow;
 exports.checkInvocationRoles = checkInvocationRoles;
 const hotmesh_1 = require("@hotmeshio/hotmesh");
+const invocation_access_1 = require("./invocation-access");
 const workers_1 = require("../workers");
 const configService = __importStar(require("./config"));
 const userService = __importStar(require("./user"));
@@ -152,15 +153,9 @@ async function checkInvocationRoles(workflowType, userId, authRole) {
     if (!user) {
         throw new InvocationError('User not registered', 403);
     }
-    const userRoles = user.roles.map((r) => r.role);
-    const hasInvocationRole = wfConfig.invocation_roles.some((r) => userRoles.includes(r));
-    if (!hasInvocationRole) {
-        // superadmin and admin/admin bypass role checks
-        const hasGlobalAccess = user.roles.some((r) => r.type === 'superadmin')
-            || user.roles.some((r) => r.role === 'admin' && r.type === 'admin');
-        if (!hasGlobalAccess) {
-            throw new InvocationError('Insufficient role for invocation', 403);
-        }
+    // invocable is resolveTaskQueue's concern; this gate decides roles only.
+    if (!(0, invocation_access_1.canInvokeWorkflow)({ ...wfConfig, invocable: true }, user.roles, authRole)) {
+        throw new InvocationError('Insufficient role for invocation', 403);
     }
 }
 /**

package/build/shared/form-validation/index.d.ts

@@ -19,3 +19,4 @@ export * from './x-lt-options';
 export * from './ctx-path';
 export * from './field-validator';
 export * from './validate-resolver-payload';
+export * from './invoke-context';

package/build/shared/form-validation/index.js

@@ -35,3 +35,4 @@ __exportStar(require("./x-lt-options"), exports);
 __exportStar(require("./ctx-path"), exports);
 __exportStar(require("./field-validator"), exports);
 __exportStar(require("./validate-resolver-payload"), exports);
+__exportStar(require("./invoke-context"), exports);

package/build/shared/form-validation/invoke-context.d.ts

@@ -0,0 +1,7 @@
+import type { ResolverValidationContext } from './validate-resolver-payload';
+/**
+ * The context an invoke form validates and renders against. The pass itself
+ * supplies the live values under `input` and `resolver`; the envelope
+ * metadata is the only other domain an invoke form can reference.
+ */
+export declare function buildInvokeFormContext(metadata: Record<string, unknown> | null | undefined): ResolverValidationContext;

package/build/shared/form-validation/invoke-context.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildInvokeFormContext = buildInvokeFormContext;
+/**
+ * The context an invoke form validates and renders against. The pass itself
+ * supplies the live values under `input` and `resolver`; the envelope
+ * metadata is the only other domain an invoke form can reference.
+ */
+function buildInvokeFormContext(metadata) {
+    return { metadata: metadata ?? {} };
+}

package/build/shared/form-validation/validate-resolver-payload.d.ts

@@ -31,7 +31,7 @@ export type { FieldError } from './field-validator';
  * dynamic constraints against. `resolver` is supplied by the pass itself
  * (the flat form values under validation) — callers provide the rest.
  */
-export type ResolverValidationContext = Omit<ShowIfContext, 'resolver'>;
+export type ResolverValidationContext = Omit<ShowIfContext, 'resolver' | 'input'>;
 /**
  * Validate FLAT form values against the form schema. This is the dashboard's
  * entry point (the values the user edits, keyed by field name).

package/build/shared/form-validation/validate-resolver-payload.js

@@ -44,6 +44,7 @@ function validateResolverForm(schema, formValues, ctx) {
     const liveCtx = {
         ...(ctx ?? {}),
         resolver: formValues,
+        input: formValues,
     };
     const errors = [];
     for (const [field, fieldSchema] of Object.entries(properties)) {

package/build/shared/form-validation/x-lt-help.d.ts

@@ -1,5 +1,5 @@
-/** The token domains a help template may reference. */
-export declare const HELP_DOMAINS: readonly ["escalation", "metadata", "envelope", "payload", "resolver", "lookup"];
+/** The token domains a help template may reference. `input` is the invoke-form name for the live values `resolver` also carries. */
+export declare const HELP_DOMAINS: readonly ["escalation", "metadata", "envelope", "payload", "resolver", "lookup", "input"];
 export type HelpDomain = (typeof HELP_DOMAINS)[number];
 export type HelpTokenContext = Partial<Record<HelpDomain, Record<string, unknown> | null>>;
 /** Replace every `{{domain.path}}` token with its value from the context. */