@hotmeshio/long-tail 0.19.1 → 0.20.0

package/build/api/workflows/config.d.ts

@@ -1,3 +1,4 @@
+import { type EscalationLookupRef } from '../../types/escalation';
 import type { LTApiResult } from '../../types/sdk';
 /**
  * List all registered workflow configurations.
@@ -38,6 +39,7 @@ export declare function getWorkflowConfig(input: {
  * @param input.envelope_schema — JSON template that pre-fills the invoke form
  * @param input.input_schema — x-lt-* JSON Schema for the rich invoke form; invoke validates data against it
  * @param input.icon — curated icon name (WORKFLOW_ICONS); anything else is refused
+ * @param input.input_lookups: versioned knowledge refs the invoke form reads as `lookup.<as ?? key>`; malformed refs are refused
  * @param input.resolver_schema — JSON Schema for resolver payload validation
  * @param input.cron_schedule — cron expression for scheduled execution
  * @returns `{ status: 200, data: <saved config> }`
@@ -57,6 +59,7 @@ export declare function upsertWorkflowConfig(input: {
     envelope_schema?: any;
     input_schema?: any;
     icon?: string | null;
+    input_lookups?: EscalationLookupRef[] | null;
     resolver_schema?: any;
     cron_schedule?: string | null;
     read_safe?: boolean;

package/build/api/workflows/config.js

@@ -39,6 +39,8 @@ exports.upsertWorkflowConfig = upsertWorkflowConfig;
 exports.deleteWorkflowConfig = deleteWorkflowConfig;
 const configService = __importStar(require("../../services/config"));
 const workflow_icons_1 = require("../../types/workflow-icons");
+const escalation_1 = require("../../types/escalation");
+const lookup_refs_1 = require("../../services/knowledge/lookup-refs");
 const cron_1 = require("../../services/cron");
 const ltconfig_1 = require("../../modules/ltconfig");
 /**
@@ -97,6 +99,7 @@ async function getWorkflowConfig(input) {
  * @param input.envelope_schema — JSON template that pre-fills the invoke form
  * @param input.input_schema — x-lt-* JSON Schema for the rich invoke form; invoke validates data against it
  * @param input.icon — curated icon name (WORKFLOW_ICONS); anything else is refused
+ * @param input.input_lookups: versioned knowledge refs the invoke form reads as `lookup.<as ?? key>`; malformed refs are refused
  * @param input.resolver_schema — JSON Schema for resolver payload validation
  * @param input.cron_schedule — cron expression for scheduled execution
  * @returns `{ status: 200, data: <saved config> }`
@@ -106,6 +109,17 @@ async function upsertWorkflowConfig(input) {
         if (input.icon && !(0, workflow_icons_1.isWorkflowIcon)(input.icon)) {
             return { status: 400, error: `Unknown workflow icon "${input.icon}"; choose one of WORKFLOW_ICONS` };
         }
+        if (input.input_lookups != null) {
+            try {
+                (0, escalation_1.assertLookupRefs)(input.input_lookups);
+            }
+            catch (err) {
+                return { status: 400, error: err.message };
+            }
+            const missing = await (0, lookup_refs_1.describeMissingLookupRefs)(input.input_lookups);
+            if (missing.length)
+                return { status: 400, error: missing.join('; ') };
+        }
         // Validate cron expression before persisting
         if (input.cron_schedule) {
             const { validateCronSchedule } = await Promise.resolve().then(() => __importStar(require('../../services/cron')));
@@ -126,6 +140,7 @@ async function upsertWorkflowConfig(input) {
             envelope_schema: input.envelope_schema ?? null,
             input_schema: input.input_schema ?? null,
             icon: input.icon ?? null,
+            input_lookups: input.input_lookups ?? null,
             resolver_schema: input.resolver_schema ?? null,
             cron_schedule: input.cron_schedule ?? null,
             read_safe: input.read_safe ?? false,

package/build/api/workflows/index.d.ts

@@ -3,4 +3,5 @@ export { listWorkers, listDiscoveredWorkflows, getCronStatus, } from './discover
 export { listInvocableWorkflows, WORKFLOW_TIERS } from './invocable';
 export type { InvocableWorkflowEntry, WorkflowTier } from './invocable';
 export { checkInvokeInput, inputValidationFailure } from './input-validation';
+export { getWorkflowInputLookups } from './input-lookups';
 export { listWorkflowConfigs, getWorkflowConfig, upsertWorkflowConfig, deleteWorkflowConfig, } from './config';

package/build/api/workflows/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.deleteWorkflowConfig = exports.upsertWorkflowConfig = exports.getWorkflowConfig = exports.listWorkflowConfigs = exports.inputValidationFailure = exports.checkInvokeInput = exports.WORKFLOW_TIERS = exports.listInvocableWorkflows = exports.getCronStatus = exports.listDiscoveredWorkflows = exports.listWorkers = exports.exportWorkflow = exports.terminateWorkflow = exports.getWorkflowResult = exports.getWorkflowStatus = exports.invokeWorkflow = void 0;
+exports.deleteWorkflowConfig = exports.upsertWorkflowConfig = exports.getWorkflowConfig = exports.listWorkflowConfigs = exports.getWorkflowInputLookups = exports.inputValidationFailure = exports.checkInvokeInput = exports.WORKFLOW_TIERS = exports.listInvocableWorkflows = exports.getCronStatus = exports.listDiscoveredWorkflows = exports.listWorkers = exports.exportWorkflow = exports.terminateWorkflow = exports.getWorkflowResult = exports.getWorkflowStatus = exports.invokeWorkflow = void 0;
 var invocation_1 = require("./invocation");
 Object.defineProperty(exports, "invokeWorkflow", { enumerable: true, get: function () { return invocation_1.invokeWorkflow; } });
 Object.defineProperty(exports, "getWorkflowStatus", { enumerable: true, get: function () { return invocation_1.getWorkflowStatus; } });
@@ -17,6 +17,8 @@ Object.defineProperty(exports, "WORKFLOW_TIERS", { enumerable: true, get: functi
 var input_validation_1 = require("./input-validation");
 Object.defineProperty(exports, "checkInvokeInput", { enumerable: true, get: function () { return input_validation_1.checkInvokeInput; } });
 Object.defineProperty(exports, "inputValidationFailure", { enumerable: true, get: function () { return input_validation_1.inputValidationFailure; } });
+var input_lookups_1 = require("./input-lookups");
+Object.defineProperty(exports, "getWorkflowInputLookups", { enumerable: true, get: function () { return input_lookups_1.getWorkflowInputLookups; } });
 var config_1 = require("./config");
 Object.defineProperty(exports, "listWorkflowConfigs", { enumerable: true, get: function () { return config_1.listWorkflowConfigs; } });
 Object.defineProperty(exports, "getWorkflowConfig", { enumerable: true, get: function () { return config_1.getWorkflowConfig; } });

package/build/api/workflows/input-lookups.d.ts

@@ -0,0 +1,16 @@
+import type { LTApiResult, LTApiAuth } from '../../types/sdk';
+/**
+ * Resolve the versioned knowledge lookups pinned on a workflow config.
+ *
+ * The refs on `input_lookups` ARE the grant: any caller who may invoke the
+ * workflow may read exactly the pinned editions it names. A ref whose
+ * snapshot does not exist answers with `missing: true`; the batch never
+ * fails.
+ *
+ * @param input.type: workflow type name
+ * @param auth: authenticated caller; must pass the invoke predicate
+ * @returns `{ status: 200, data: { lookups: [{ domain, key, version, as?, data, missing? }] } }`
+ */
+export declare function getWorkflowInputLookups(input: {
+    type: string;
+}, auth: LTApiAuth): Promise<LTApiResult>;

package/build/api/workflows/input-lookups.js

@@ -0,0 +1,69 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getWorkflowInputLookups = getWorkflowInputLookups;
+const configService = __importStar(require("../../services/config"));
+const userService = __importStar(require("../../services/user"));
+const invocation_access_1 = require("../../services/invocation-access");
+const knowledge_1 = require("../../services/knowledge");
+/**
+ * Resolve the versioned knowledge lookups pinned on a workflow config.
+ *
+ * The refs on `input_lookups` ARE the grant: any caller who may invoke the
+ * workflow may read exactly the pinned editions it names. A ref whose
+ * snapshot does not exist answers with `missing: true`; the batch never
+ * fails.
+ *
+ * @param input.type: workflow type name
+ * @param auth: authenticated caller; must pass the invoke predicate
+ * @returns `{ status: 200, data: { lookups: [{ domain, key, version, as?, data, missing? }] } }`
+ */
+async function getWorkflowInputLookups(input, auth) {
+    try {
+        const config = await configService.getWorkflowConfig(input.type);
+        if (!config) {
+            return { status: 404, error: 'Workflow config not found' };
+        }
+        const user = auth.userId ? await userService.getUser(auth.userId) : null;
+        if (!(0, invocation_access_1.canInvokeWorkflow)(config, user?.roles ?? [], auth.role)) {
+            return { status: 403, error: 'Not authorized to invoke this workflow' };
+        }
+        const lookups = await (0, knowledge_1.resolveLookupRefs)(config.input_lookups ?? []);
+        return { status: 200, data: { lookups } };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}

package/build/api/workflows/input-validation.d.ts

@@ -5,9 +5,10 @@ import type { LTApiResult } from '../../types/sdk';
  * The invoke input gate. A workflow that declares input_schema has its
  * submitted data validated by the same shared pass the dashboard form runs,
  * so a payload the form accepts is accepted here and a rejection lists the
- * exact violations the form would show. No schema, no gate; a data value
- * that is not an object is left to the service's own 400.
+ * exact violations the form would show. Pinned input_lookups resolve into
+ * the `lookup` domain first. No schema, no gate; a data value that is not
+ * an object is left to the service's own 400.
  */
-export declare function checkInvokeInput(config: Pick<LTWorkflowConfig, 'workflow_type' | 'input_schema'> | null | undefined, data: unknown, metadata: Record<string, unknown> | null | undefined): LTValidationErrorBody | null;
+export declare function checkInvokeInput(config: Pick<LTWorkflowConfig, 'workflow_type' | 'input_schema' | 'input_lookups'> | null | undefined, data: unknown, metadata: Record<string, unknown> | null | undefined): Promise<LTValidationErrorBody | null>;
 /** The canonical 422 result; the route serializes `data` as the body. */
 export declare function inputValidationFailure(body: LTValidationErrorBody): LTApiResult;

package/build/api/workflows/input-validation.js

@@ -4,6 +4,7 @@ exports.checkInvokeInput = checkInvokeInput;
 exports.inputValidationFailure = inputValidationFailure;
 const validate_resolver_payload_1 = require("../../shared/form-validation/validate-resolver-payload");
 const invoke_context_1 = require("../../shared/form-validation/invoke-context");
+const lookup_cache_1 = require("../../services/knowledge/lookup-cache");
 const validation_1 = require("../../types/validation");
 function isPlainObject(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
@@ -12,14 +13,16 @@ function isPlainObject(value) {
  * The invoke input gate. A workflow that declares input_schema has its
  * submitted data validated by the same shared pass the dashboard form runs,
  * so a payload the form accepts is accepted here and a rejection lists the
- * exact violations the form would show. No schema, no gate; a data value
- * that is not an object is left to the service's own 400.
+ * exact violations the form would show. Pinned input_lookups resolve into
+ * the `lookup` domain first. No schema, no gate; a data value that is not
+ * an object is left to the service's own 400.
  */
-function checkInvokeInput(config, data, metadata) {
+async function checkInvokeInput(config, data, metadata) {
     const schema = config?.input_schema;
     if (!schema || !isPlainObject(data))
         return null;
-    const violations = (0, validate_resolver_payload_1.validateResolverPayload)(schema, data, (0, invoke_context_1.buildInvokeFormContext)(metadata));
+    const lookup = await (0, lookup_cache_1.resolveLookupContext)(config?.input_lookups);
+    const violations = (0, validate_resolver_payload_1.validateResolverPayload)(schema, data, (0, invoke_context_1.buildInvokeFormContext)(metadata, lookup));
     if (violations.length === 0)
         return null;
     const n = violations.length;

package/build/api/workflows/invocable.js

@@ -65,6 +65,7 @@ function durableEntry(workflowType, taskQueue) {
         envelope_schema: null,
         input_schema: null,
         icon: null,
+        input_lookups: null,
         resolver_schema: null,
         cron_schedule: null,
         execute_as: null,

package/build/api/workflows/invocation.js

@@ -63,7 +63,7 @@ async function invokeWorkflow(input, auth) {
     try {
         await (0, workflow_invocation_1.checkInvocationRoles)(input.type, auth.userId, auth.role);
         const config = await configService.getWorkflowConfig(input.type);
-        const violation = (0, input_validation_1.checkInvokeInput)(config, input.data, input.metadata);
+        const violation = await (0, input_validation_1.checkInvokeInput)(config, input.data, input.metadata);
         if (violation)
             return (0, input_validation_1.inputValidationFailure)(violation);
         const result = await (0, workflow_invocation_1.invokeWorkflow)({

package/build/lib/db/schemas/035_workflow_input_lookups.sql

@@ -0,0 +1,9 @@
+-- Migration 035: workflow input lookups
+--
+-- One opt-in column on the workflow registration:
+--   input_lookups: versioned knowledge refs ({ domain, key, version, as? }[])
+--                   the invoke form reads under the `lookup.<as ?? key>`
+--                   context domain. NULL renders the form with no lookups.
+
+ALTER TABLE lt_config_workflows
+  ADD COLUMN IF NOT EXISTS input_lookups JSONB;

package/build/routes/workflows/config.js

@@ -54,6 +54,15 @@ router.get('/:type/config', async (req, res) => {
     const result = await api.getWorkflowConfig({ type: req.params.type });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
+/**
+ * GET /api/workflows/:type/input-lookups
+ * Resolve the versioned knowledge lookups pinned on a workflow config.
+ * Open to any caller the invoke gate admits for that workflow.
+ */
+router.get('/:type/input-lookups', async (req, res) => {
+    const result = await api.getWorkflowInputLookups({ type: req.params.type }, { userId: req.auth?.userId ?? '', role: req.auth?.role, scopes: req.auth?.scopes });
+    res.status(result.status).json(result.data ?? { error: result.error });
+});
 /**
  * PUT /api/workflows/:type/config
  * Create or replace a workflow configuration.
@@ -75,6 +84,7 @@ router.put('/:type/config', auth_1.requireAdmin, async (req, res) => {
         envelope_schema: req.body.envelope_schema,
         input_schema: req.body.input_schema,
         icon: req.body.icon,
+        input_lookups: req.body.input_lookups,
         resolver_schema: req.body.resolver_schema,
         cron_schedule: req.body.cron_schedule,
     });

package/build/services/config/cache.js

@@ -18,6 +18,7 @@ async function loadAllConfigs() {
             envelopeSchema: c.envelope_schema ?? null,
             inputSchema: c.input_schema ?? null,
             icon: c.icon ?? null,
+            inputLookups: c.input_lookups ?? null,
             resolverSchema: c.resolver_schema ?? null,
             cronSchedule: c.cron_schedule ?? null,
             executeAs: c.execute_as ?? null,

package/build/services/config/read.js

@@ -28,6 +28,7 @@ async function getWorkflowConfig(workflowType) {
         envelope_schema: wf.envelope_schema ?? null,
         input_schema: wf.input_schema ?? null,
         icon: wf.icon ?? null,
+        input_lookups: wf.input_lookups ?? null,
         resolver_schema: wf.resolver_schema ?? null,
         cron_schedule: wf.cron_schedule ?? null,
         execute_as: wf.execute_as ?? null,
@@ -68,6 +69,7 @@ async function listWorkflowConfigs() {
         envelope_schema: wf.envelope_schema ?? null,
         input_schema: wf.input_schema ?? null,
         icon: wf.icon ?? null,
+        input_lookups: wf.input_lookups ?? null,
         resolver_schema: wf.resolver_schema ?? null,
         cron_schedule: wf.cron_schedule ?? null,
         execute_as: wf.execute_as ?? null,

package/build/services/config/sql.d.ts

@@ -5,13 +5,13 @@ export declare const LIST_ALL_WORKFLOWS = "SELECT * FROM lt_config_workflows ORD
 export declare const LIST_ALL_ROLES = "SELECT * FROM lt_config_roles ORDER BY workflow_type, role";
 export declare const LIST_ALL_INVOCATION_ROLES = "SELECT * FROM lt_config_invocation_roles ORDER BY workflow_type, role";
 export declare const ENSURE_ROLE_EXISTS = "INSERT INTO lt_roles (role) VALUES ($1) ON CONFLICT DO NOTHING";
-export declare const UPSERT_WORKFLOW = "INSERT INTO lt_config_workflows\n  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified, read_safe, input_schema, icon)\nVALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15)\nON CONFLICT (workflow_type) DO UPDATE SET\n  invocable = EXCLUDED.invocable,\n  task_queue = EXCLUDED.task_queue,\n  default_role = EXCLUDED.default_role,\n  description = EXCLUDED.description,\n  consumes = EXCLUDED.consumes,\n  envelope_schema = EXCLUDED.envelope_schema,\n  resolver_schema = EXCLUDED.resolver_schema,\n  cron_schedule = EXCLUDED.cron_schedule,\n  tool_tags = EXCLUDED.tool_tags,\n  execute_as = EXCLUDED.execute_as,\n  certified = EXCLUDED.certified,\n  read_safe = EXCLUDED.read_safe,\n  input_schema = EXCLUDED.input_schema,\n  icon = EXCLUDED.icon";
+export declare const UPSERT_WORKFLOW = "INSERT INTO lt_config_workflows\n  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified, read_safe, input_schema, icon, input_lookups)\nVALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16)\nON CONFLICT (workflow_type) DO UPDATE SET\n  invocable = EXCLUDED.invocable,\n  task_queue = EXCLUDED.task_queue,\n  default_role = EXCLUDED.default_role,\n  description = EXCLUDED.description,\n  consumes = EXCLUDED.consumes,\n  envelope_schema = EXCLUDED.envelope_schema,\n  resolver_schema = EXCLUDED.resolver_schema,\n  cron_schedule = EXCLUDED.cron_schedule,\n  tool_tags = EXCLUDED.tool_tags,\n  execute_as = EXCLUDED.execute_as,\n  certified = EXCLUDED.certified,\n  read_safe = EXCLUDED.read_safe,\n  input_schema = EXCLUDED.input_schema,\n  icon = EXCLUDED.icon,\n  input_lookups = EXCLUDED.input_lookups";
 export declare const DELETE_CONFIG_ROLES = "DELETE FROM lt_config_roles WHERE workflow_type = $1";
 export declare const INSERT_CONFIG_ROLE = "INSERT INTO lt_config_roles (workflow_type, role) VALUES ($1, $2)";
 export declare const DELETE_INVOCATION_ROLES = "DELETE FROM lt_config_invocation_roles WHERE workflow_type = $1";
 export declare const INSERT_INVOCATION_ROLE = "INSERT INTO lt_config_invocation_roles (workflow_type, role) VALUES ($1, $2)";
 export declare const DELETE_WORKFLOW = "DELETE FROM lt_config_workflows WHERE workflow_type = $1";
-export declare const SEED_WORKFLOW_CONFIG = "INSERT INTO lt_config_workflows\n  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified, read_safe, input_schema, icon)\nVALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15)\nON CONFLICT (workflow_type) DO NOTHING";
+export declare const SEED_WORKFLOW_CONFIG = "INSERT INTO lt_config_workflows\n  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified, read_safe, input_schema, icon, input_lookups)\nVALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16)\nON CONFLICT (workflow_type) DO NOTHING";
 export declare const SEED_CONFIG_ROLE = "INSERT INTO lt_config_roles (workflow_type, role) VALUES ($1, $2)\nON CONFLICT (workflow_type, role) DO NOTHING";
 export declare const SEED_INVOCATION_ROLE = "INSERT INTO lt_config_invocation_roles (workflow_type, role) VALUES ($1, $2)\nON CONFLICT (workflow_type, role) DO NOTHING";
 export declare const GET_PROVIDER_DATA = "SELECT workflow_type, data, completed_at\n  FROM lt_tasks\n WHERE origin_id = $1\n   AND workflow_type = ANY($2)\n   AND status = 'completed'\n ORDER BY completed_at DESC";

package/build/services/config/sql.js

@@ -23,8 +23,8 @@ exports.ENSURE_ROLE_EXISTS = `\
 INSERT INTO lt_roles (role) VALUES ($1) ON CONFLICT DO NOTHING`;
 exports.UPSERT_WORKFLOW = `\
 INSERT INTO lt_config_workflows
-  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified, read_safe, input_schema, icon)
-VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15)
+  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified, read_safe, input_schema, icon, input_lookups)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16)
 ON CONFLICT (workflow_type) DO UPDATE SET
   invocable = EXCLUDED.invocable,
   task_queue = EXCLUDED.task_queue,
@@ -39,7 +39,8 @@ ON CONFLICT (workflow_type) DO UPDATE SET
   certified = EXCLUDED.certified,
   read_safe = EXCLUDED.read_safe,
   input_schema = EXCLUDED.input_schema,
-  icon = EXCLUDED.icon`;
+  icon = EXCLUDED.icon,
+  input_lookups = EXCLUDED.input_lookups`;
 exports.DELETE_CONFIG_ROLES = `\
 DELETE FROM lt_config_roles WHERE workflow_type = $1`;
 exports.INSERT_CONFIG_ROLE = `\
@@ -55,8 +56,8 @@ DELETE FROM lt_config_workflows WHERE workflow_type = $1`;
 // ------------------------------------------------------------------ //
 exports.SEED_WORKFLOW_CONFIG = `\
 INSERT INTO lt_config_workflows
-  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified, read_safe, input_schema, icon)
-VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15)
+  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified, read_safe, input_schema, icon, input_lookups)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16)
 ON CONFLICT (workflow_type) DO NOTHING`;
 exports.SEED_CONFIG_ROLE = `\
 INSERT INTO lt_config_roles (workflow_type, role) VALUES ($1, $2)

package/build/services/config/write.js

@@ -14,6 +14,10 @@ const sql_1 = require("./sql");
  * seed blocks without `certified`): derived from roles/consumes presence —
  * the rule that governed the tier before the flag existed.
  */
+/** pg binds JS arrays as Postgres arrays; jsonb columns take the JSON text. */
+function toJsonb(value) {
+    return value == null ? null : JSON.stringify(value);
+}
 function resolveCertified(config) {
     return (config.certified ??
         ((config.roles?.length ?? 0) > 0 || (config.consumes?.length ?? 0) > 0));
@@ -55,6 +59,7 @@ async function replaceWorkflowConfig(config, certified) {
             config.read_safe ?? false,
             config.input_schema ?? null,
             config.icon ?? null,
+            toJsonb(config.input_lookups),
         ]);
         // Replace roles
         await client.query(sql_1.DELETE_CONFIG_ROLES, [config.workflow_type]);
@@ -118,6 +123,7 @@ async function seedWorkflowConfig(config) {
         config.read_safe ?? false,
         config.input_schema ?? null,
         config.icon ?? null,
+        toJsonb(config.input_lookups),
     ]);
     const inserted = (rowCount ?? 0) > 0;
     if (inserted) {
@@ -152,6 +158,8 @@ async function seedWorkflowConfig(config) {
                 drifts.push('input_schema');
             if ((config.icon ?? null) !== (existing.icon ?? null))
                 drifts.push('icon');
+            if (JSON.stringify(config.input_lookups ?? null) !== JSON.stringify(existing.input_lookups ?? null))
+                drifts.push('input_lookups');
             if (drifts.length) {
                 logger_1.loggerRegistry.warn(`[long-tail] config drift: ${config.workflow_type} — ${drifts.join(', ')} differ between code and DB`);
             }
@@ -191,7 +199,8 @@ async function applyWorkflowConfig(config) {
             (0, node_util_1.isDeepStrictEqual)(existing.envelope_schema ?? null, config.envelope_schema ?? null) &&
             (0, node_util_1.isDeepStrictEqual)(existing.resolver_schema ?? null, config.resolver_schema ?? null) &&
             (0, node_util_1.isDeepStrictEqual)(existing.input_schema ?? null, config.input_schema ?? null) &&
-            (existing.icon ?? null) === (config.icon ?? null);
+            (existing.icon ?? null) === (config.icon ?? null) &&
+            (0, node_util_1.isDeepStrictEqual)(existing.input_lookups ?? null, config.input_lookups ?? null);
         if (unchanged)
             return 'unchanged';
     }

package/build/services/knowledge/index.d.ts

@@ -1,4 +1,5 @@
 export * from './lookup-cache';
+export * from './lookup-refs';
 export interface KnowledgeVersionMeta {
     version: number;
     change_summary: string | null;

package/build/services/knowledge/index.js

@@ -24,6 +24,7 @@ exports.listKnowledgeVersions = listKnowledgeVersions;
 const db_1 = require("../../lib/db");
 const sql_1 = require("./sql");
 __exportStar(require("./lookup-cache"), exports);
+__exportStar(require("./lookup-refs"), exports);
 /** The immutable snapshot at (domain, key, version), uncached full shape. */
 async function getKnowledgeVersion(domain, key, version) {
     const pool = (0, db_1.getPool)();

package/build/services/knowledge/lookup-refs.d.ts

@@ -0,0 +1,7 @@
+import type { EscalationLookupRef } from '../../types/escalation';
+/**
+ * One message per ref whose pinned edition does not exist, naming what does.
+ * Shape is the caller's job (assertLookupRefs); this answers the second
+ * question a saver has: is there an edition behind the pin.
+ */
+export declare function describeMissingLookupRefs(refs: EscalationLookupRef[]): Promise<string[]>;

package/build/services/knowledge/lookup-refs.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.describeMissingLookupRefs = describeMissingLookupRefs;
+const db_1 = require("../../lib/db");
+const lookup_cache_1 = require("./lookup-cache");
+const sql_1 = require("./sql");
+/**
+ * One message per ref whose pinned edition does not exist, naming what does.
+ * Shape is the caller's job (assertLookupRefs); this answers the second
+ * question a saver has: is there an edition behind the pin.
+ */
+async function describeMissingLookupRefs(refs) {
+    const problems = [];
+    for (const ref of refs) {
+        const snapshot = await (0, lookup_cache_1.getKnowledgeSnapshot)(ref.domain, ref.key, ref.version);
+        if (snapshot)
+            continue;
+        const { rows } = await (0, db_1.getPool)().query(sql_1.LIST_KNOWLEDGE_VERSIONS, [ref.domain, ref.key]);
+        const versions = rows.map((r) => Number(r.version)).sort((a, b) => a - b);
+        const where = versions.length
+            ? `editions: ${versions.map((v) => `v${v}`).join(', ')}`
+            : `no knowledge entry ${ref.domain}/${ref.key}`;
+        problems.push(`Lookup ref ${ref.domain}/${ref.key} v${ref.version} names no edition (${where})`);
+    }
+    return problems;
+}

package/build/services/mcp/db-server/schemas.d.ts

@@ -7,12 +7,12 @@ export declare const findTasksSchema: z.ZodObject<{
     limit: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
 }, "strip", z.ZodTypeAny, {
     limit: number;
-    status?: "pending" | "in_progress" | "completed" | "needs_intervention" | "failed" | undefined;
+    status?: "completed" | "pending" | "in_progress" | "needs_intervention" | "failed" | undefined;
     workflow_type?: string | undefined;
     workflow_id?: string | undefined;
     origin_id?: string | undefined;
 }, {
-    status?: "pending" | "in_progress" | "completed" | "needs_intervention" | "failed" | undefined;
+    status?: "completed" | "pending" | "in_progress" | "needs_intervention" | "failed" | undefined;
     workflow_type?: string | undefined;
     workflow_id?: string | undefined;
     origin_id?: string | undefined;

package/build/shared/form-validation/field-validator.d.ts

@@ -38,6 +38,7 @@ export declare function resolveChecklistDefault(fieldSchema: Record<string, unkn
  * which remains the at-least-one check.
  */
 export declare function validateRequireAll(value: unknown, fieldSchema: Record<string, unknown> | undefined, ctx?: Record<string, unknown>): string | undefined;
+export declare const INVALID_JSON = "Invalid JSON";
 /**
  * Runtime type check against the field's declared JSON Schema `type`. Guards
  * the payload contract for API-first callers (a form widget already produces

package/build/shared/form-validation/field-validator.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.X_LT_DEFAULT_CHECKED = void 0;
+exports.INVALID_JSON = exports.X_LT_DEFAULT_CHECKED = void 0;
 exports.resolveChecklistItems = resolveChecklistItems;
 exports.resolveChecklistDefault = resolveChecklistDefault;
 exports.validateRequireAll = validateRequireAll;
@@ -87,6 +87,18 @@ function validateRequireAll(value, fieldSchema, ctx) {
         return undefined;
     return `${incomplete} of ${mandatory.length} checks incomplete`;
 }
+exports.INVALID_JSON = 'Invalid JSON';
+/** The json editor holds unparseable text as a string at the field's key. */
+function isJsonWidget(fieldSchema) {
+    return fieldSchema?.['x-lt-widget'] === 'json';
+}
+/** A list is edited through the json editor or a multi-select; any other list value is display only. */
+function isEditableList(fieldSchema) {
+    return isJsonWidget(fieldSchema) || fieldSchema?.[x_lt_options_1.X_LT_OPTIONS] !== undefined;
+}
+function plural(n, noun) {
+    return `${n} ${noun}${n === 1 ? '' : 's'}`;
+}
 /**
  * Runtime type check against the field's declared JSON Schema `type`. Guards
  * the payload contract for API-first callers (a form widget already produces
@@ -109,9 +121,13 @@ function validateFieldType(value, fieldSchema) {
         case 'boolean':
             return typeof value === 'boolean' ? undefined : 'Expected true or false';
         case 'array':
-            return Array.isArray(value) ? undefined : 'Expected a list';
+            if (Array.isArray(value))
+                return undefined;
+            return isJsonWidget(fieldSchema) && typeof value === 'string' ? exports.INVALID_JSON : 'Expected a list';
         case 'object':
-            return typeof value === 'object' && !Array.isArray(value) ? undefined : 'Expected an object';
+            if (typeof value === 'object' && !Array.isArray(value))
+                return undefined;
+            return isJsonWidget(fieldSchema) && typeof value === 'string' ? exports.INVALID_JSON : 'Expected an object';
         default:
             return undefined;
     }
@@ -136,7 +152,7 @@ function validateFieldConstraints(value, fieldSchema, ctx) {
     // interpolated list that currently offers nothing fails closed — a stale
     // cascade child value never submits.
     const allowed = (0, x_lt_options_1.resolveFieldOptions)(fieldSchema, ctx);
-    if (allowed !== undefined && value !== undefined && value !== null && value !== '') {
+    if (allowed !== undefined && value !== undefined && value !== null && value !== '' && !Array.isArray(value)) {
         if (allowed.length === 0) {
             return 'No valid options for this selection';
         }
@@ -144,6 +160,12 @@ function validateFieldConstraints(value, fieldSchema, ctx) {
             return `Must be one of: ${allowed.map((o) => String(o.value)).join(', ')}`;
         }
     }
+    if (Array.isArray(value)) {
+        return isEditableList(fieldSchema) ? validateListConstraints(value, fieldSchema, allowed, ctx) : undefined;
+    }
+    if (value !== null && typeof value === 'object') {
+        return validateMapConstraints(value, fieldSchema, ctx);
+    }
     if (typeof value === 'string') {
         const s = value.trim();
         if (s === '')
@@ -196,6 +218,65 @@ function validateFieldConstraints(value, fieldSchema, ctx) {
     }
     return undefined;
 }
+/**
+ * An edited list: every item must belong to the field's `x-lt-options` when
+ * declared, the length must sit within `minItems`/`maxItems`, and each item
+ * must satisfy `items`. An empty list passes; presence is the required
+ * check's job.
+ */
+function validateListConstraints(value, fieldSchema, allowed, ctx) {
+    if (value.length === 0)
+        return undefined;
+    if (allowed !== undefined) {
+        if (allowed.length === 0)
+            return 'No valid options for this selection';
+        if (value.some((v) => !allowed.some((o) => o.value === v))) {
+            return `Must be one of: ${allowed.map((o) => String(o.value)).join(', ')}`;
+        }
+    }
+    const minItems = resolveNumericConstraint(fieldSchema.minItems, undefined, ctx);
+    if (minItems !== undefined && value.length < minItems)
+        return `At least ${plural(minItems, 'item')}`;
+    const maxItems = resolveNumericConstraint(fieldSchema.maxItems, undefined, ctx);
+    if (maxItems !== undefined && value.length > maxItems)
+        return `At most ${plural(maxItems, 'item')}`;
+    const items = fieldSchema.items;
+    if (items && typeof items === 'object' && !Array.isArray(items)) {
+        const itemSchema = items;
+        for (let i = 0; i < value.length; i++) {
+            const err = validateFieldType(value[i], itemSchema) ?? validateFieldConstraints(value[i], itemSchema, ctx);
+            if (err)
+                return `Item ${i + 1}: ${err}`;
+        }
+    }
+    return undefined;
+}
+/**
+ * A map value: keys must belong to `propertyNames.enum` when declared, and
+ * every value must satisfy an object-shaped `additionalProperties`.
+ */
+function validateMapConstraints(value, fieldSchema, ctx) {
+    const entries = Object.entries(value);
+    if (entries.length === 0)
+        return undefined;
+    const propertyNames = fieldSchema.propertyNames;
+    const allowedKeys = Array.isArray(propertyNames?.enum) ? propertyNames.enum.map(String) : undefined;
+    if (allowedKeys) {
+        const unknown = entries.find(([k]) => !allowedKeys.includes(k));
+        if (unknown)
+            return `Unknown key "${unknown[0]}". Allowed: ${allowedKeys.join(', ')}`;
+    }
+    const ap = fieldSchema.additionalProperties;
+    if (ap && typeof ap === 'object' && !Array.isArray(ap)) {
+        const valueSchema = ap;
+        for (const [k, v] of entries) {
+            const err = validateFieldType(v, valueSchema) ?? validateFieldConstraints(v, valueSchema, ctx);
+            if (err)
+                return `"${k}": ${err}`;
+        }
+    }
+    return undefined;
+}
 function resolveNumericConstraint(staticVal, dynamicPath, ctx) {
     if (typeof staticVal === 'number')
         return staticVal;
@@ -232,13 +313,20 @@ function validateField(value, fieldSchema, isRequired, isTouched, ctx) {
     if (isRequired) {
         if (value === undefined || value === null)
             return 'Required';
-        if (typeof value === 'boolean' && !value)
+        // A checkbox must be checked; a boolean with an option list is answered by either value.
+        if (typeof value === 'boolean' && !value && (0, x_lt_options_1.resolveFieldOptions)(fieldSchema, ctx) === undefined)
             return 'Required';
         if (typeof value === 'string' && value.trim() === '')
             return 'Required';
+        // A picked or edited list needs one item; a plain list value is not checked.
+        if (Array.isArray(value) && value.length === 0 && isEditableList(fieldSchema))
+            return 'Required';
         if (typeof value === 'object' && !Array.isArray(value) && value !== null) {
             const vals = Object.values(value);
-            if (vals.length === 0 || vals.every((v) => !v))
+            if (vals.length === 0)
+                return 'Required';
+            // A json map is answered by any key; every other object needs one truthy value.
+            if (!isJsonWidget(fieldSchema) && vals.every((v) => !v))
                 return 'Required';
         }
     }