@hotmeshio/long-tail 0.19.0 → 0.20.0

package/build/api/workflows/config.d.ts

@@ -1,3 +1,4 @@
+import { type EscalationLookupRef } from '../../types/escalation';
 import type { LTApiResult } from '../../types/sdk';
 /**
  * List all registered workflow configurations.
@@ -35,7 +36,10 @@ export declare function getWorkflowConfig(input: {
  * @param input.invocation_roles — roles that can invoke this workflow
  * @param input.consumes — workflow types whose data this workflow consumes
  * @param input.tool_tags — MCP tool tags for discovery
- * @param input.envelope_schema — JSON Schema for envelope.data validation
+ * @param input.envelope_schema — JSON template that pre-fills the invoke form
+ * @param input.input_schema — x-lt-* JSON Schema for the rich invoke form; invoke validates data against it
+ * @param input.icon — curated icon name (WORKFLOW_ICONS); anything else is refused
+ * @param input.input_lookups: versioned knowledge refs the invoke form reads as `lookup.<as ?? key>`; malformed refs are refused
  * @param input.resolver_schema — JSON Schema for resolver payload validation
  * @param input.cron_schedule — cron expression for scheduled execution
  * @returns `{ status: 200, data: <saved config> }`
@@ -53,6 +57,9 @@ export declare function upsertWorkflowConfig(input: {
     consumes?: string[];
     tool_tags?: string[];
     envelope_schema?: any;
+    input_schema?: any;
+    icon?: string | null;
+    input_lookups?: EscalationLookupRef[] | null;
     resolver_schema?: any;
     cron_schedule?: string | null;
     read_safe?: boolean;

package/build/api/workflows/config.js

@@ -38,6 +38,9 @@ exports.getWorkflowConfig = getWorkflowConfig;
 exports.upsertWorkflowConfig = upsertWorkflowConfig;
 exports.deleteWorkflowConfig = deleteWorkflowConfig;
 const configService = __importStar(require("../../services/config"));
+const workflow_icons_1 = require("../../types/workflow-icons");
+const escalation_1 = require("../../types/escalation");
+const lookup_refs_1 = require("../../services/knowledge/lookup-refs");
 const cron_1 = require("../../services/cron");
 const ltconfig_1 = require("../../modules/ltconfig");
 /**
@@ -93,13 +96,30 @@ async function getWorkflowConfig(input) {
  * @param input.invocation_roles — roles that can invoke this workflow
  * @param input.consumes — workflow types whose data this workflow consumes
  * @param input.tool_tags — MCP tool tags for discovery
- * @param input.envelope_schema — JSON Schema for envelope.data validation
+ * @param input.envelope_schema — JSON template that pre-fills the invoke form
+ * @param input.input_schema — x-lt-* JSON Schema for the rich invoke form; invoke validates data against it
+ * @param input.icon — curated icon name (WORKFLOW_ICONS); anything else is refused
+ * @param input.input_lookups: versioned knowledge refs the invoke form reads as `lookup.<as ?? key>`; malformed refs are refused
  * @param input.resolver_schema — JSON Schema for resolver payload validation
  * @param input.cron_schedule — cron expression for scheduled execution
  * @returns `{ status: 200, data: <saved config> }`
  */
 async function upsertWorkflowConfig(input) {
     try {
+        if (input.icon && !(0, workflow_icons_1.isWorkflowIcon)(input.icon)) {
+            return { status: 400, error: `Unknown workflow icon "${input.icon}"; choose one of WORKFLOW_ICONS` };
+        }
+        if (input.input_lookups != null) {
+            try {
+                (0, escalation_1.assertLookupRefs)(input.input_lookups);
+            }
+            catch (err) {
+                return { status: 400, error: err.message };
+            }
+            const missing = await (0, lookup_refs_1.describeMissingLookupRefs)(input.input_lookups);
+            if (missing.length)
+                return { status: 400, error: missing.join('; ') };
+        }
         // Validate cron expression before persisting
         if (input.cron_schedule) {
             const { validateCronSchedule } = await Promise.resolve().then(() => __importStar(require('../../services/cron')));
@@ -118,6 +138,9 @@ async function upsertWorkflowConfig(input) {
             consumes: input.consumes ?? [],
             tool_tags: input.tool_tags ?? [],
             envelope_schema: input.envelope_schema ?? null,
+            input_schema: input.input_schema ?? null,
+            icon: input.icon ?? null,
+            input_lookups: input.input_lookups ?? null,
             resolver_schema: input.resolver_schema ?? null,
             cron_schedule: input.cron_schedule ?? null,
             read_safe: input.read_safe ?? false,

package/build/api/workflows/index.d.ts

@@ -1,3 +1,7 @@
 export { invokeWorkflow, getWorkflowStatus, getWorkflowResult, terminateWorkflow, exportWorkflow, } from './invocation';
 export { listWorkers, listDiscoveredWorkflows, getCronStatus, } from './discovery';
+export { listInvocableWorkflows, WORKFLOW_TIERS } from './invocable';
+export type { InvocableWorkflowEntry, WorkflowTier } from './invocable';
+export { checkInvokeInput, inputValidationFailure } from './input-validation';
+export { getWorkflowInputLookups } from './input-lookups';
 export { listWorkflowConfigs, getWorkflowConfig, upsertWorkflowConfig, deleteWorkflowConfig, } from './config';

package/build/api/workflows/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.deleteWorkflowConfig = exports.upsertWorkflowConfig = exports.getWorkflowConfig = exports.listWorkflowConfigs = exports.getCronStatus = exports.listDiscoveredWorkflows = exports.listWorkers = exports.exportWorkflow = exports.terminateWorkflow = exports.getWorkflowResult = exports.getWorkflowStatus = exports.invokeWorkflow = void 0;
+exports.deleteWorkflowConfig = exports.upsertWorkflowConfig = exports.getWorkflowConfig = exports.listWorkflowConfigs = exports.getWorkflowInputLookups = exports.inputValidationFailure = exports.checkInvokeInput = exports.WORKFLOW_TIERS = exports.listInvocableWorkflows = exports.getCronStatus = exports.listDiscoveredWorkflows = exports.listWorkers = exports.exportWorkflow = exports.terminateWorkflow = exports.getWorkflowResult = exports.getWorkflowStatus = exports.invokeWorkflow = void 0;
 var invocation_1 = require("./invocation");
 Object.defineProperty(exports, "invokeWorkflow", { enumerable: true, get: function () { return invocation_1.invokeWorkflow; } });
 Object.defineProperty(exports, "getWorkflowStatus", { enumerable: true, get: function () { return invocation_1.getWorkflowStatus; } });
@@ -11,6 +11,14 @@ var discovery_1 = require("./discovery");
 Object.defineProperty(exports, "listWorkers", { enumerable: true, get: function () { return discovery_1.listWorkers; } });
 Object.defineProperty(exports, "listDiscoveredWorkflows", { enumerable: true, get: function () { return discovery_1.listDiscoveredWorkflows; } });
 Object.defineProperty(exports, "getCronStatus", { enumerable: true, get: function () { return discovery_1.getCronStatus; } });
+var invocable_1 = require("./invocable");
+Object.defineProperty(exports, "listInvocableWorkflows", { enumerable: true, get: function () { return invocable_1.listInvocableWorkflows; } });
+Object.defineProperty(exports, "WORKFLOW_TIERS", { enumerable: true, get: function () { return invocable_1.WORKFLOW_TIERS; } });
+var input_validation_1 = require("./input-validation");
+Object.defineProperty(exports, "checkInvokeInput", { enumerable: true, get: function () { return input_validation_1.checkInvokeInput; } });
+Object.defineProperty(exports, "inputValidationFailure", { enumerable: true, get: function () { return input_validation_1.inputValidationFailure; } });
+var input_lookups_1 = require("./input-lookups");
+Object.defineProperty(exports, "getWorkflowInputLookups", { enumerable: true, get: function () { return input_lookups_1.getWorkflowInputLookups; } });
 var config_1 = require("./config");
 Object.defineProperty(exports, "listWorkflowConfigs", { enumerable: true, get: function () { return config_1.listWorkflowConfigs; } });
 Object.defineProperty(exports, "getWorkflowConfig", { enumerable: true, get: function () { return config_1.getWorkflowConfig; } });

package/build/api/workflows/input-lookups.d.ts

@@ -0,0 +1,16 @@
+import type { LTApiResult, LTApiAuth } from '../../types/sdk';
+/**
+ * Resolve the versioned knowledge lookups pinned on a workflow config.
+ *
+ * The refs on `input_lookups` ARE the grant: any caller who may invoke the
+ * workflow may read exactly the pinned editions it names. A ref whose
+ * snapshot does not exist answers with `missing: true`; the batch never
+ * fails.
+ *
+ * @param input.type: workflow type name
+ * @param auth: authenticated caller; must pass the invoke predicate
+ * @returns `{ status: 200, data: { lookups: [{ domain, key, version, as?, data, missing? }] } }`
+ */
+export declare function getWorkflowInputLookups(input: {
+    type: string;
+}, auth: LTApiAuth): Promise<LTApiResult>;

package/build/api/workflows/input-lookups.js

@@ -0,0 +1,69 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getWorkflowInputLookups = getWorkflowInputLookups;
+const configService = __importStar(require("../../services/config"));
+const userService = __importStar(require("../../services/user"));
+const invocation_access_1 = require("../../services/invocation-access");
+const knowledge_1 = require("../../services/knowledge");
+/**
+ * Resolve the versioned knowledge lookups pinned on a workflow config.
+ *
+ * The refs on `input_lookups` ARE the grant: any caller who may invoke the
+ * workflow may read exactly the pinned editions it names. A ref whose
+ * snapshot does not exist answers with `missing: true`; the batch never
+ * fails.
+ *
+ * @param input.type: workflow type name
+ * @param auth: authenticated caller; must pass the invoke predicate
+ * @returns `{ status: 200, data: { lookups: [{ domain, key, version, as?, data, missing? }] } }`
+ */
+async function getWorkflowInputLookups(input, auth) {
+    try {
+        const config = await configService.getWorkflowConfig(input.type);
+        if (!config) {
+            return { status: 404, error: 'Workflow config not found' };
+        }
+        const user = auth.userId ? await userService.getUser(auth.userId) : null;
+        if (!(0, invocation_access_1.canInvokeWorkflow)(config, user?.roles ?? [], auth.role)) {
+            return { status: 403, error: 'Not authorized to invoke this workflow' };
+        }
+        const lookups = await (0, knowledge_1.resolveLookupRefs)(config.input_lookups ?? []);
+        return { status: 200, data: { lookups } };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}

package/build/api/workflows/input-validation.d.ts

@@ -0,0 +1,14 @@
+import { type LTValidationErrorBody } from '../../types/validation';
+import type { LTWorkflowConfig } from '../../types/config';
+import type { LTApiResult } from '../../types/sdk';
+/**
+ * The invoke input gate. A workflow that declares input_schema has its
+ * submitted data validated by the same shared pass the dashboard form runs,
+ * so a payload the form accepts is accepted here and a rejection lists the
+ * exact violations the form would show. Pinned input_lookups resolve into
+ * the `lookup` domain first. No schema, no gate; a data value that is not
+ * an object is left to the service's own 400.
+ */
+export declare function checkInvokeInput(config: Pick<LTWorkflowConfig, 'workflow_type' | 'input_schema' | 'input_lookups'> | null | undefined, data: unknown, metadata: Record<string, unknown> | null | undefined): Promise<LTValidationErrorBody | null>;
+/** The canonical 422 result; the route serializes `data` as the body. */
+export declare function inputValidationFailure(body: LTValidationErrorBody): LTApiResult;

package/build/api/workflows/input-validation.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkInvokeInput = checkInvokeInput;
+exports.inputValidationFailure = inputValidationFailure;
+const validate_resolver_payload_1 = require("../../shared/form-validation/validate-resolver-payload");
+const invoke_context_1 = require("../../shared/form-validation/invoke-context");
+const lookup_cache_1 = require("../../services/knowledge/lookup-cache");
+const validation_1 = require("../../types/validation");
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * The invoke input gate. A workflow that declares input_schema has its
+ * submitted data validated by the same shared pass the dashboard form runs,
+ * so a payload the form accepts is accepted here and a rejection lists the
+ * exact violations the form would show. Pinned input_lookups resolve into
+ * the `lookup` domain first. No schema, no gate; a data value that is not
+ * an object is left to the service's own 400.
+ */
+async function checkInvokeInput(config, data, metadata) {
+    const schema = config?.input_schema;
+    if (!schema || !isPlainObject(data))
+        return null;
+    const lookup = await (0, lookup_cache_1.resolveLookupContext)(config?.input_lookups);
+    const violations = (0, validate_resolver_payload_1.validateResolverPayload)(schema, data, (0, invoke_context_1.buildInvokeFormContext)(metadata, lookup));
+    if (violations.length === 0)
+        return null;
+    const n = violations.length;
+    return {
+        error: `data failed input schema validation (${n} violation${n === 1 ? '' : 's'})`,
+        code: validation_1.LT_ERROR_CODES.SCHEMA_VALIDATION,
+        violations,
+        role: null,
+        schemaVersion: null,
+        workflowType: config.workflow_type,
+    };
+}
+/** The canonical 422 result; the route serializes `data` as the body. */
+function inputValidationFailure(body) {
+    return { status: 422, error: body.error, code: body.code, data: body };
+}

package/build/api/workflows/invocable.d.ts

@@ -0,0 +1,19 @@
+import type { LTWorkflowConfig } from '../../types/config';
+import type { LTApiResult, LTApiAuth } from '../../types/sdk';
+export declare const WORKFLOW_TIERS: {
+    readonly DURABLE: "durable";
+    readonly REGISTERED: "registered";
+    readonly CERTIFIED: "certified";
+};
+export type WorkflowTier = (typeof WORKFLOW_TIERS)[keyof typeof WORKFLOW_TIERS];
+export type InvocableWorkflowEntry = LTWorkflowConfig & {
+    tier: WorkflowTier;
+};
+/**
+ * The workflows the caller may invoke, decided by the same predicate the
+ * invoke gate runs. Callers with global access also see active durable
+ * workers that carry no registration row, as the invoke gate admits them.
+ *
+ * @returns `{ status: 200, data: { workflows: InvocableWorkflowEntry[] } }`
+ */
+export declare function listInvocableWorkflows(auth: LTApiAuth): Promise<LTApiResult>;

package/build/api/workflows/invocable.js

@@ -0,0 +1,107 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WORKFLOW_TIERS = void 0;
+exports.listInvocableWorkflows = listInvocableWorkflows;
+const configService = __importStar(require("../../services/config"));
+const userService = __importStar(require("../../services/user"));
+const invocation_access_1 = require("../../services/invocation-access");
+const registry_1 = require("../../services/workers/registry");
+exports.WORKFLOW_TIERS = {
+    DURABLE: 'durable',
+    REGISTERED: 'registered',
+    CERTIFIED: 'certified',
+};
+function tierOf(config) {
+    if (!config)
+        return exports.WORKFLOW_TIERS.DURABLE;
+    return config.certified ? exports.WORKFLOW_TIERS.CERTIFIED : exports.WORKFLOW_TIERS.REGISTERED;
+}
+/** An active worker with no registration row, shaped like a config so one list type serves the page. */
+function durableEntry(workflowType, taskQueue) {
+    return {
+        workflow_type: workflowType,
+        invocable: true,
+        certified: false,
+        task_queue: taskQueue,
+        default_role: 'reviewer',
+        description: null,
+        roles: [],
+        invocation_roles: [],
+        consumes: [],
+        tool_tags: [],
+        envelope_schema: null,
+        input_schema: null,
+        icon: null,
+        input_lookups: null,
+        resolver_schema: null,
+        cron_schedule: null,
+        execute_as: null,
+        read_safe: false,
+        tier: exports.WORKFLOW_TIERS.DURABLE,
+    };
+}
+/**
+ * The workflows the caller may invoke, decided by the same predicate the
+ * invoke gate runs. Callers with global access also see active durable
+ * workers that carry no registration row, as the invoke gate admits them.
+ *
+ * @returns `{ status: 200, data: { workflows: InvocableWorkflowEntry[] } }`
+ */
+async function listInvocableWorkflows(auth) {
+    try {
+        const [configs, user] = await Promise.all([
+            configService.listWorkflowConfigs(),
+            auth.userId ? userService.getUser(auth.userId) : Promise.resolve(null),
+        ]);
+        const roles = user?.roles ?? [];
+        const workflows = configs
+            .filter((c) => (0, invocation_access_1.canInvokeWorkflow)(c, roles, auth.role))
+            .map((c) => ({ ...c, tier: tierOf(c) }));
+        if ((0, invocation_access_1.hasGlobalInvocationAccess)(roles, auth.role)) {
+            const registered = new Set(configs.map((c) => c.workflow_type));
+            for (const [name, { taskQueue }] of (0, registry_1.getRegisteredWorkers)()) {
+                if (registered.has(name) || registry_1.SYSTEM_WORKFLOWS.has(name))
+                    continue;
+                workflows.push(durableEntry(name, taskQueue));
+            }
+        }
+        workflows.sort((a, b) => a.workflow_type.localeCompare(b.workflow_type));
+        return { status: 200, data: { workflows } };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}

package/build/api/workflows/invocation.js

@@ -43,6 +43,8 @@ const exportService = __importStar(require("../../services/export"));
 const task_1 = require("../../services/task");
 const workflow_invocation_1 = require("../../services/workflow-invocation");
 const crud_1 = require("../../services/escalation/crud");
+const configService = __importStar(require("../../services/config"));
+const input_validation_1 = require("./input-validation");
 function isResolveError(err) {
     return err?.message?.includes('Cannot resolve workflow');
 }
@@ -60,6 +62,10 @@ function isResolveError(err) {
 async function invokeWorkflow(input, auth) {
     try {
         await (0, workflow_invocation_1.checkInvocationRoles)(input.type, auth.userId, auth.role);
+        const config = await configService.getWorkflowConfig(input.type);
+        const violation = await (0, input_validation_1.checkInvokeInput)(config, input.data, input.metadata);
+        if (violation)
+            return (0, input_validation_1.inputValidationFailure)(violation);
         const result = await (0, workflow_invocation_1.invokeWorkflow)({
             workflowType: input.type,
             data: input.data || {},

package/build/lib/db/schemas/034_workflow_input_schema.sql

@@ -0,0 +1,13 @@
+-- Migration 034: workflow input form and icon
+--
+-- Two opt-in columns on the workflow registration:
+--   input_schema — an x-lt-* JSON Schema the dashboard renders as the invoke
+--                  form and the invoke API validates submitted data against.
+--                  NULL keeps the legacy envelope_schema template form.
+--   icon         — a curated icon name (WORKFLOW_ICONS) shown in place of the
+--                  tier glyph on the Invoke page and registry. NULL keeps the
+--                  tier glyph.
+
+ALTER TABLE lt_config_workflows
+  ADD COLUMN IF NOT EXISTS input_schema JSONB,
+  ADD COLUMN IF NOT EXISTS icon TEXT;

package/build/lib/db/schemas/035_workflow_input_lookups.sql

@@ -0,0 +1,9 @@
+-- Migration 035: workflow input lookups
+--
+-- One opt-in column on the workflow registration:
+--   input_lookups: versioned knowledge refs ({ domain, key, version, as? }[])
+--                   the invoke form reads under the `lookup.<as ?? key>`
+--                   context domain. NULL renders the form with no lookups.
+
+ALTER TABLE lt_config_workflows
+  ADD COLUMN IF NOT EXISTS input_lookups JSONB;

package/build/routes/workflows/config.js

@@ -54,6 +54,15 @@ router.get('/:type/config', async (req, res) => {
     const result = await api.getWorkflowConfig({ type: req.params.type });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
+/**
+ * GET /api/workflows/:type/input-lookups
+ * Resolve the versioned knowledge lookups pinned on a workflow config.
+ * Open to any caller the invoke gate admits for that workflow.
+ */
+router.get('/:type/input-lookups', async (req, res) => {
+    const result = await api.getWorkflowInputLookups({ type: req.params.type }, { userId: req.auth?.userId ?? '', role: req.auth?.role, scopes: req.auth?.scopes });
+    res.status(result.status).json(result.data ?? { error: result.error });
+});
 /**
  * PUT /api/workflows/:type/config
  * Create or replace a workflow configuration.
@@ -73,6 +82,9 @@ router.put('/:type/config', auth_1.requireAdmin, async (req, res) => {
         consumes: req.body.consumes,
         tool_tags: req.body.tool_tags,
         envelope_schema: req.body.envelope_schema,
+        input_schema: req.body.input_schema,
+        icon: req.body.icon,
+        input_lookups: req.body.input_lookups,
         resolver_schema: req.body.resolver_schema,
         cron_schedule: req.body.cron_schedule,
     });

package/build/routes/workflows/discovery.js

@@ -60,6 +60,20 @@ router.get('/discovered', async (req, res) => {
     });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
+// ── Invocable for the caller ────────────────────────────────────────────────
+/**
+ * GET /api/workflows/invocable
+ * The workflows the calling user may invoke, decided by the invoke gate's
+ * own predicate. Drives the dashboard Invoke page and its nav entry.
+ */
+router.get('/invocable', async (req, res) => {
+    const result = await api.listInvocableWorkflows({
+        userId: req.auth?.userId ?? '',
+        role: req.auth?.role,
+        scopes: req.auth?.scopes,
+    });
+    res.status(result.status).json(result.data ?? { error: result.error });
+});
 // ── Cron status ─────────────────────────────────────────────────────────────
 /**
  * GET /api/workflows/cron/status

package/build/services/config/cache.js

@@ -16,6 +16,9 @@ async function loadAllConfigs() {
             consumes: c.consumes,
             toolTags: c.tool_tags || [],
             envelopeSchema: c.envelope_schema ?? null,
+            inputSchema: c.input_schema ?? null,
+            icon: c.icon ?? null,
+            inputLookups: c.input_lookups ?? null,
             resolverSchema: c.resolver_schema ?? null,
             cronSchedule: c.cron_schedule ?? null,
             executeAs: c.execute_as ?? null,

package/build/services/config/read.js

@@ -26,6 +26,9 @@ async function getWorkflowConfig(workflowType) {
         consumes: wf.consumes || [],
         tool_tags: wf.tool_tags || [],
         envelope_schema: wf.envelope_schema ?? null,
+        input_schema: wf.input_schema ?? null,
+        icon: wf.icon ?? null,
+        input_lookups: wf.input_lookups ?? null,
         resolver_schema: wf.resolver_schema ?? null,
         cron_schedule: wf.cron_schedule ?? null,
         execute_as: wf.execute_as ?? null,
@@ -64,6 +67,9 @@ async function listWorkflowConfigs() {
         consumes: wf.consumes || [],
         tool_tags: wf.tool_tags || [],
         envelope_schema: wf.envelope_schema ?? null,
+        input_schema: wf.input_schema ?? null,
+        icon: wf.icon ?? null,
+        input_lookups: wf.input_lookups ?? null,
         resolver_schema: wf.resolver_schema ?? null,
         cron_schedule: wf.cron_schedule ?? null,
         execute_as: wf.execute_as ?? null,

package/build/services/config/sql.d.ts

@@ -5,13 +5,13 @@ export declare const LIST_ALL_WORKFLOWS = "SELECT * FROM lt_config_workflows ORD
 export declare const LIST_ALL_ROLES = "SELECT * FROM lt_config_roles ORDER BY workflow_type, role";
 export declare const LIST_ALL_INVOCATION_ROLES = "SELECT * FROM lt_config_invocation_roles ORDER BY workflow_type, role";
 export declare const ENSURE_ROLE_EXISTS = "INSERT INTO lt_roles (role) VALUES ($1) ON CONFLICT DO NOTHING";
-export declare const UPSERT_WORKFLOW = "INSERT INTO lt_config_workflows\n  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified, read_safe)\nVALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)\nON CONFLICT (workflow_type) DO UPDATE SET\n  invocable = EXCLUDED.invocable,\n  task_queue = EXCLUDED.task_queue,\n  default_role = EXCLUDED.default_role,\n  description = EXCLUDED.description,\n  consumes = EXCLUDED.consumes,\n  envelope_schema = EXCLUDED.envelope_schema,\n  resolver_schema = EXCLUDED.resolver_schema,\n  cron_schedule = EXCLUDED.cron_schedule,\n  tool_tags = EXCLUDED.tool_tags,\n  execute_as = EXCLUDED.execute_as,\n  certified = EXCLUDED.certified,\n  read_safe = EXCLUDED.read_safe";
+export declare const UPSERT_WORKFLOW = "INSERT INTO lt_config_workflows\n  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified, read_safe, input_schema, icon, input_lookups)\nVALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16)\nON CONFLICT (workflow_type) DO UPDATE SET\n  invocable = EXCLUDED.invocable,\n  task_queue = EXCLUDED.task_queue,\n  default_role = EXCLUDED.default_role,\n  description = EXCLUDED.description,\n  consumes = EXCLUDED.consumes,\n  envelope_schema = EXCLUDED.envelope_schema,\n  resolver_schema = EXCLUDED.resolver_schema,\n  cron_schedule = EXCLUDED.cron_schedule,\n  tool_tags = EXCLUDED.tool_tags,\n  execute_as = EXCLUDED.execute_as,\n  certified = EXCLUDED.certified,\n  read_safe = EXCLUDED.read_safe,\n  input_schema = EXCLUDED.input_schema,\n  icon = EXCLUDED.icon,\n  input_lookups = EXCLUDED.input_lookups";
 export declare const DELETE_CONFIG_ROLES = "DELETE FROM lt_config_roles WHERE workflow_type = $1";
 export declare const INSERT_CONFIG_ROLE = "INSERT INTO lt_config_roles (workflow_type, role) VALUES ($1, $2)";
 export declare const DELETE_INVOCATION_ROLES = "DELETE FROM lt_config_invocation_roles WHERE workflow_type = $1";
 export declare const INSERT_INVOCATION_ROLE = "INSERT INTO lt_config_invocation_roles (workflow_type, role) VALUES ($1, $2)";
 export declare const DELETE_WORKFLOW = "DELETE FROM lt_config_workflows WHERE workflow_type = $1";
-export declare const SEED_WORKFLOW_CONFIG = "INSERT INTO lt_config_workflows\n  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified, read_safe)\nVALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)\nON CONFLICT (workflow_type) DO NOTHING";
+export declare const SEED_WORKFLOW_CONFIG = "INSERT INTO lt_config_workflows\n  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified, read_safe, input_schema, icon, input_lookups)\nVALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16)\nON CONFLICT (workflow_type) DO NOTHING";
 export declare const SEED_CONFIG_ROLE = "INSERT INTO lt_config_roles (workflow_type, role) VALUES ($1, $2)\nON CONFLICT (workflow_type, role) DO NOTHING";
 export declare const SEED_INVOCATION_ROLE = "INSERT INTO lt_config_invocation_roles (workflow_type, role) VALUES ($1, $2)\nON CONFLICT (workflow_type, role) DO NOTHING";
 export declare const GET_PROVIDER_DATA = "SELECT workflow_type, data, completed_at\n  FROM lt_tasks\n WHERE origin_id = $1\n   AND workflow_type = ANY($2)\n   AND status = 'completed'\n ORDER BY completed_at DESC";

package/build/services/config/sql.js

@@ -23,8 +23,8 @@ exports.ENSURE_ROLE_EXISTS = `\
 INSERT INTO lt_roles (role) VALUES ($1) ON CONFLICT DO NOTHING`;
 exports.UPSERT_WORKFLOW = `\
 INSERT INTO lt_config_workflows
-  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified, read_safe)
-VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)
+  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified, read_safe, input_schema, icon, input_lookups)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16)
 ON CONFLICT (workflow_type) DO UPDATE SET
   invocable = EXCLUDED.invocable,
   task_queue = EXCLUDED.task_queue,
@@ -37,7 +37,10 @@ ON CONFLICT (workflow_type) DO UPDATE SET
   tool_tags = EXCLUDED.tool_tags,
   execute_as = EXCLUDED.execute_as,
   certified = EXCLUDED.certified,
-  read_safe = EXCLUDED.read_safe`;
+  read_safe = EXCLUDED.read_safe,
+  input_schema = EXCLUDED.input_schema,
+  icon = EXCLUDED.icon,
+  input_lookups = EXCLUDED.input_lookups`;
 exports.DELETE_CONFIG_ROLES = `\
 DELETE FROM lt_config_roles WHERE workflow_type = $1`;
 exports.INSERT_CONFIG_ROLE = `\
@@ -53,8 +56,8 @@ DELETE FROM lt_config_workflows WHERE workflow_type = $1`;
 // ------------------------------------------------------------------ //
 exports.SEED_WORKFLOW_CONFIG = `\
 INSERT INTO lt_config_workflows
-  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified, read_safe)
-VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)
+  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified, read_safe, input_schema, icon, input_lookups)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16)
 ON CONFLICT (workflow_type) DO NOTHING`;
 exports.SEED_CONFIG_ROLE = `\
 INSERT INTO lt_config_roles (workflow_type, role) VALUES ($1, $2)

package/build/services/config/write.js

@@ -14,6 +14,10 @@ const sql_1 = require("./sql");
  * seed blocks without `certified`): derived from roles/consumes presence —
  * the rule that governed the tier before the flag existed.
  */
+/** pg binds JS arrays as Postgres arrays; jsonb columns take the JSON text. */
+function toJsonb(value) {
+    return value == null ? null : JSON.stringify(value);
+}
 function resolveCertified(config) {
     return (config.certified ??
         ((config.roles?.length ?? 0) > 0 || (config.consumes?.length ?? 0) > 0));
@@ -53,6 +57,9 @@ async function replaceWorkflowConfig(config, certified) {
             config.execute_as ?? null,
             certified,
             config.read_safe ?? false,
+            config.input_schema ?? null,
+            config.icon ?? null,
+            toJsonb(config.input_lookups),
         ]);
         // Replace roles
         await client.query(sql_1.DELETE_CONFIG_ROLES, [config.workflow_type]);
@@ -114,6 +121,9 @@ async function seedWorkflowConfig(config) {
         config.execute_as ?? null,
         resolveCertified(config),
         config.read_safe ?? false,
+        config.input_schema ?? null,
+        config.icon ?? null,
+        toJsonb(config.input_lookups),
     ]);
     const inserted = (rowCount ?? 0) > 0;
     if (inserted) {
@@ -144,6 +154,12 @@ async function seedWorkflowConfig(config) {
                 drifts.push('envelope_schema');
             if (JSON.stringify(config.resolver_schema) !== JSON.stringify(existing.resolver_schema))
                 drifts.push('resolver_schema');
+            if (JSON.stringify(config.input_schema ?? null) !== JSON.stringify(existing.input_schema ?? null))
+                drifts.push('input_schema');
+            if ((config.icon ?? null) !== (existing.icon ?? null))
+                drifts.push('icon');
+            if (JSON.stringify(config.input_lookups ?? null) !== JSON.stringify(existing.input_lookups ?? null))
+                drifts.push('input_lookups');
             if (drifts.length) {
                 logger_1.loggerRegistry.warn(`[long-tail] config drift: ${config.workflow_type} — ${drifts.join(', ')} differ between code and DB`);
             }
@@ -181,7 +197,10 @@ async function applyWorkflowConfig(config) {
             sortedEqual(existing.roles ?? [], config.roles ?? []) &&
             sortedEqual(existing.invocation_roles ?? [], config.invocation_roles ?? []) &&
             (0, node_util_1.isDeepStrictEqual)(existing.envelope_schema ?? null, config.envelope_schema ?? null) &&
-            (0, node_util_1.isDeepStrictEqual)(existing.resolver_schema ?? null, config.resolver_schema ?? null);
+            (0, node_util_1.isDeepStrictEqual)(existing.resolver_schema ?? null, config.resolver_schema ?? null) &&
+            (0, node_util_1.isDeepStrictEqual)(existing.input_schema ?? null, config.input_schema ?? null) &&
+            (existing.icon ?? null) === (config.icon ?? null) &&
+            (0, node_util_1.isDeepStrictEqual)(existing.input_lookups ?? null, config.input_lookups ?? null);
         if (unchanged)
             return 'unchanged';
     }