@hotmeshio/long-tail 0.7.5 → 0.8.1

package/build/api/workflows/config.d.ts

@@ -22,11 +22,16 @@ export declare function getWorkflowConfig(input: {
  *
  * @param input.type — workflow type name
  * @param input.invocable — whether the workflow can be started via the API
+ * @param input.certified — explicit HITL certification (interceptor treatment).
+ *   Omitted → derived from roles/consumes presence, preserving the behavior of
+ *   callers that predate the explicit flag.
  * @param input.task_queue — HotMesh task queue
  * @param input.default_role — default escalation role
  * @param input.description — human-readable description
  * @param input.execute_as — service account for proxy invocation
- * @param input.roles — roles that can resolve escalations
+ * @param input.roles — interceptor default for who resolves interceptor-raised
+ *   escalations (deprecated as formalization — the escalation's role carries
+ *   the versioned schema and takes precedence)
  * @param input.invocation_roles — roles that can invoke this workflow
  * @param input.consumes — workflow types whose data this workflow consumes
  * @param input.tool_tags — MCP tool tags for discovery
@@ -38,6 +43,7 @@ export declare function getWorkflowConfig(input: {
 export declare function upsertWorkflowConfig(input: {
     type: string;
     invocable?: boolean;
+    certified?: boolean;
     task_queue?: string | null;
     default_role?: string;
     description?: string | null;

package/build/api/workflows/config.js

@@ -80,11 +80,16 @@ async function getWorkflowConfig(input) {
  *
  * @param input.type — workflow type name
  * @param input.invocable — whether the workflow can be started via the API
+ * @param input.certified — explicit HITL certification (interceptor treatment).
+ *   Omitted → derived from roles/consumes presence, preserving the behavior of
+ *   callers that predate the explicit flag.
  * @param input.task_queue — HotMesh task queue
  * @param input.default_role — default escalation role
  * @param input.description — human-readable description
  * @param input.execute_as — service account for proxy invocation
- * @param input.roles — roles that can resolve escalations
+ * @param input.roles — interceptor default for who resolves interceptor-raised
+ *   escalations (deprecated as formalization — the escalation's role carries
+ *   the versioned schema and takes precedence)
  * @param input.invocation_roles — roles that can invoke this workflow
  * @param input.consumes — workflow types whose data this workflow consumes
  * @param input.tool_tags — MCP tool tags for discovery
@@ -103,6 +108,7 @@ async function upsertWorkflowConfig(input) {
         const config = await configService.upsertWorkflowConfig({
             workflow_type: input.type,
             invocable: input.invocable ?? false,
+            certified: input.certified,
             task_queue: input.task_queue ?? null,
             default_role: input.default_role ?? 'reviewer',
             description: input.description ?? null,

package/build/api/workflows/discovery.js

@@ -105,10 +105,7 @@ async function listDiscoveredWorkflows(input) {
             .map((workflowType) => {
             const config = configMap.get(workflowType);
             const worker = activeWorkers.get(workflowType);
-            const hasCertification = !!(config &&
-                ((config.roles?.length ?? 0) > 0 ||
-                    (config.consumes?.length ?? 0) > 0));
-            const tier = !config ? 'durable' : hasCertification ? 'certified' : 'configured';
+            const tier = !config ? 'durable' : config.certified ? 'certified' : 'registered';
             return {
                 workflow_type: workflowType,
                 task_queue: config?.task_queue ?? worker?.taskQueue ?? null,

package/build/lib/db/schemas/020_workflow_certified.sql

@@ -0,0 +1,34 @@
+-- Migration 020: Explicit workflow certification
+--
+-- Certification becomes a declared property of the workflow registration,
+-- stored on the row. Before this, the tier was derived: a registered workflow
+-- counted as certified whenever it had escalation roles or consumes — so
+-- demoting a certified workflow to plain registered meant deleting its
+-- escalation roles and provider references. With the explicit flag, the three
+-- tiers are direct states:
+--
+--   default    — no row in lt_config_workflows (ad-hoc durable workflow)
+--   registered — row exists, certified = false (invocation + entry schema)
+--   certified  — row exists, certified = true  (interceptor: task tracking,
+--                escalation handling, re-run detection)
+--
+-- Escalation formalization (who resolves, with what schema) belongs to the
+-- escalation and its role — roles carry the versioned escalation schema and
+-- take precedence. The workflow-level roles/resolver_schema remain as
+-- interceptor defaults only.
+--
+-- The backfill runs once (schema_migrations tracked): rows that were
+-- implicitly certified under the derived rule keep their tier.
+
+ALTER TABLE lt_config_workflows
+  ADD COLUMN IF NOT EXISTS certified BOOLEAN NOT NULL DEFAULT false;
+
+UPDATE lt_config_workflows w
+SET certified = true
+WHERE certified = false
+  AND (
+    cardinality(w.consumes) > 0
+    OR EXISTS (
+      SELECT 1 FROM lt_config_roles r WHERE r.workflow_type = w.workflow_type
+    )
+  );

package/build/modules/ltconfig.d.ts

@@ -19,8 +19,9 @@ declare class LTConfigCache {
      *
      * The interceptor uses this to decide whether to wrap the workflow
      * with task tracking, escalation handling, and re-run detection.
-     * Configured-but-not-certified workflows (no roles, no consumes)
-     * return null so the interceptor skips them.
+     * Certification is the explicit `certified` flag on the registration —
+     * registered-but-not-certified workflows return null so the interceptor
+     * skips them.
      */
     getResolvedConfig(name: string): Promise<LTResolvedConfig | null>;
     /**

package/build/modules/ltconfig.js

@@ -106,15 +106,15 @@ class LTConfigCache {
      *
      * The interceptor uses this to decide whether to wrap the workflow
      * with task tracking, escalation handling, and re-run detection.
-     * Configured-but-not-certified workflows (no roles, no consumes)
-     * return null so the interceptor skips them.
+     * Certification is the explicit `certified` flag on the registration —
+     * registered-but-not-certified workflows return null so the interceptor
+     * skips them.
      */
     async getResolvedConfig(name) {
         const config = await this.get(name);
         if (!config)
             return null;
-        const isCertified = (config.roles?.length ?? 0) > 0 || (config.consumes?.length ?? 0) > 0;
-        return isCertified ? config : null;
+        return config.certified ? config : null;
     }
     /**
      * Get the config for any workflow REGISTERED in lt_config_workflows (a row

package/build/routes/workflows/config.js

@@ -63,6 +63,7 @@ router.put('/:type/config', auth_1.requireAdmin, async (req, res) => {
     const result = await api.upsertWorkflowConfig({
         type: req.params.type,
         invocable: req.body.invocable,
+        certified: req.body.certified,
         task_queue: req.body.task_queue,
         default_role: req.body.default_role,
         description: req.body.description,

package/build/services/config/cache.js

@@ -8,6 +8,7 @@ async function loadAllConfigs() {
     for (const c of configs) {
         map.set(c.workflow_type, {
             invocable: c.invocable,
+            certified: c.certified ?? false,
             taskQueue: c.task_queue,
             role: c.default_role,
             roles: c.roles,

package/build/services/config/read.js

@@ -17,6 +17,7 @@ async function getWorkflowConfig(workflowType) {
     return {
         workflow_type: wf.workflow_type,
         invocable: wf.invocable,
+        certified: wf.certified ?? false,
         task_queue: wf.task_queue,
         default_role: wf.default_role,
         description: wf.description,
@@ -53,6 +54,7 @@ async function listWorkflowConfigs() {
     return wfResult.rows.map((wf) => ({
         workflow_type: wf.workflow_type,
         invocable: wf.invocable,
+        certified: wf.certified ?? false,
         task_queue: wf.task_queue,
         default_role: wf.default_role,
         description: wf.description,

package/build/services/config/sql.d.ts

@@ -5,13 +5,13 @@ export declare const LIST_ALL_WORKFLOWS = "SELECT * FROM lt_config_workflows ORD
 export declare const LIST_ALL_ROLES = "SELECT * FROM lt_config_roles ORDER BY workflow_type, role";
 export declare const LIST_ALL_INVOCATION_ROLES = "SELECT * FROM lt_config_invocation_roles ORDER BY workflow_type, role";
 export declare const ENSURE_ROLE_EXISTS = "INSERT INTO lt_roles (role) VALUES ($1) ON CONFLICT DO NOTHING";
-export declare const UPSERT_WORKFLOW = "INSERT INTO lt_config_workflows\n  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as)\nVALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)\nON CONFLICT (workflow_type) DO UPDATE SET\n  invocable = EXCLUDED.invocable,\n  task_queue = EXCLUDED.task_queue,\n  default_role = EXCLUDED.default_role,\n  description = EXCLUDED.description,\n  consumes = EXCLUDED.consumes,\n  envelope_schema = EXCLUDED.envelope_schema,\n  resolver_schema = EXCLUDED.resolver_schema,\n  cron_schedule = EXCLUDED.cron_schedule,\n  tool_tags = EXCLUDED.tool_tags,\n  execute_as = EXCLUDED.execute_as";
+export declare const UPSERT_WORKFLOW = "INSERT INTO lt_config_workflows\n  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified)\nVALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)\nON CONFLICT (workflow_type) DO UPDATE SET\n  invocable = EXCLUDED.invocable,\n  task_queue = EXCLUDED.task_queue,\n  default_role = EXCLUDED.default_role,\n  description = EXCLUDED.description,\n  consumes = EXCLUDED.consumes,\n  envelope_schema = EXCLUDED.envelope_schema,\n  resolver_schema = EXCLUDED.resolver_schema,\n  cron_schedule = EXCLUDED.cron_schedule,\n  tool_tags = EXCLUDED.tool_tags,\n  execute_as = EXCLUDED.execute_as,\n  certified = EXCLUDED.certified";
 export declare const DELETE_CONFIG_ROLES = "DELETE FROM lt_config_roles WHERE workflow_type = $1";
 export declare const INSERT_CONFIG_ROLE = "INSERT INTO lt_config_roles (workflow_type, role) VALUES ($1, $2)";
 export declare const DELETE_INVOCATION_ROLES = "DELETE FROM lt_config_invocation_roles WHERE workflow_type = $1";
 export declare const INSERT_INVOCATION_ROLE = "INSERT INTO lt_config_invocation_roles (workflow_type, role) VALUES ($1, $2)";
 export declare const DELETE_WORKFLOW = "DELETE FROM lt_config_workflows WHERE workflow_type = $1";
-export declare const SEED_WORKFLOW_CONFIG = "INSERT INTO lt_config_workflows\n  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as)\nVALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)\nON CONFLICT (workflow_type) DO NOTHING";
+export declare const SEED_WORKFLOW_CONFIG = "INSERT INTO lt_config_workflows\n  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified)\nVALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)\nON CONFLICT (workflow_type) DO NOTHING";
 export declare const SEED_CONFIG_ROLE = "INSERT INTO lt_config_roles (workflow_type, role) VALUES ($1, $2)\nON CONFLICT (workflow_type, role) DO NOTHING";
 export declare const SEED_INVOCATION_ROLE = "INSERT INTO lt_config_invocation_roles (workflow_type, role) VALUES ($1, $2)\nON CONFLICT (workflow_type, role) DO NOTHING";
 export declare const GET_PROVIDER_DATA = "SELECT workflow_type, data, completed_at\n  FROM lt_tasks\n WHERE origin_id = $1\n   AND workflow_type = ANY($2)\n   AND status = 'completed'\n ORDER BY completed_at DESC";

package/build/services/config/sql.js

@@ -23,8 +23,8 @@ exports.ENSURE_ROLE_EXISTS = `\
 INSERT INTO lt_roles (role) VALUES ($1) ON CONFLICT DO NOTHING`;
 exports.UPSERT_WORKFLOW = `\
 INSERT INTO lt_config_workflows
-  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as)
-VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)
+  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)
 ON CONFLICT (workflow_type) DO UPDATE SET
   invocable = EXCLUDED.invocable,
   task_queue = EXCLUDED.task_queue,
@@ -35,7 +35,8 @@ ON CONFLICT (workflow_type) DO UPDATE SET
   resolver_schema = EXCLUDED.resolver_schema,
   cron_schedule = EXCLUDED.cron_schedule,
   tool_tags = EXCLUDED.tool_tags,
-  execute_as = EXCLUDED.execute_as`;
+  execute_as = EXCLUDED.execute_as,
+  certified = EXCLUDED.certified`;
 exports.DELETE_CONFIG_ROLES = `\
 DELETE FROM lt_config_roles WHERE workflow_type = $1`;
 exports.INSERT_CONFIG_ROLE = `\
@@ -51,8 +52,8 @@ DELETE FROM lt_config_workflows WHERE workflow_type = $1`;
 // ------------------------------------------------------------------ //
 exports.SEED_WORKFLOW_CONFIG = `\
 INSERT INTO lt_config_workflows
-  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as)
-VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)
+  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)
 ON CONFLICT (workflow_type) DO NOTHING`;
 exports.SEED_CONFIG_ROLE = `\
 INSERT INTO lt_config_roles (workflow_type, role) VALUES ($1, $2)

package/build/services/config/write.js

@@ -7,6 +7,15 @@ const db_1 = require("../../lib/db");
 const read_1 = require("./read");
 const logger_1 = require("../../lib/logger");
 const sql_1 = require("./sql");
+/**
+ * Certification fallback for writers that omit the explicit flag (older SDKs,
+ * seed blocks without `certified`): derived from roles/consumes presence —
+ * the rule that governed the tier before the flag existed.
+ */
+function resolveCertified(config) {
+    return (config.certified ??
+        ((config.roles?.length ?? 0) > 0 || (config.consumes?.length ?? 0) > 0));
+}
 async function upsertWorkflowConfig(config) {
     const pool = (0, db_1.getPool)();
     const client = await pool.connect();
@@ -34,6 +43,7 @@ async function upsertWorkflowConfig(config) {
             config.cron_schedule ?? null,
             config.tool_tags || [],
             config.execute_as ?? null,
+            resolveCertified(config),
         ]);
         // Replace roles
         await client.query(sql_1.DELETE_CONFIG_ROLES, [config.workflow_type]);
@@ -90,6 +100,7 @@ async function seedWorkflowConfig(config) {
         config.cron_schedule ?? null,
         config.tool_tags || [],
         config.execute_as ?? null,
+        resolveCertified(config),
     ]);
     const inserted = (rowCount ?? 0) > 0;
     if (inserted) {
@@ -110,6 +121,8 @@ async function seedWorkflowConfig(config) {
                 drifts.push('description');
             if (config.invocable !== existing.invocable)
                 drifts.push('invocable');
+            if (resolveCertified(config) !== existing.certified)
+                drifts.push('certified');
             if (config.default_role !== existing.default_role)
                 drifts.push('default_role');
             if (JSON.stringify(config.envelope_schema) !== JSON.stringify(existing.envelope_schema))

package/build/services/escalation/bulk.d.ts

@@ -32,6 +32,8 @@ export declare function bulkCancelEscalations(ids: string[]): Promise<{
 /**
  * Bulk resolve escalations for AI triage.
  * Returns full records so the caller can start triage workflows. No signal is
- * delivered — the triage workflow takes over handling.
+ * delivered — the triage workflow takes over handling. Rows backing a live
+ * `condition()` waiter (`signal_key` set) are skipped by the store and stay
+ * `pending`; only the returned rows enter triage.
  */
 export declare function bulkResolveForTriage(ids: string[], hint?: string): Promise<LTEscalationRecord[]>;

package/build/services/escalation/bulk.js

@@ -65,7 +65,9 @@ async function bulkCancelEscalations(ids) {
 /**
  * Bulk resolve escalations for AI triage.
  * Returns full records so the caller can start triage workflows. No signal is
- * delivered — the triage workflow takes over handling.
+ * delivered — the triage workflow takes over handling. Rows backing a live
+ * `condition()` waiter (`signal_key` set) are skipped by the store and stay
+ * `pending`; only the returned rows enter triage.
  */
 async function bulkResolveForTriage(ids, hint) {
     if (ids.length === 0)

package/build/services/escalation/crud.d.ts

@@ -30,9 +30,10 @@ export declare function resolveEscalation(id: string, resolverPayload: Record<st
  * Use this over a per-row `resolveEscalation` loop when every row takes the SAME
  * resolverPayload and the rows are woken collectively (or are bookkeeping rows with
  * no signal_key). NOTE: unlike the single `resolve`, this does NOT deliver per-row
- * signals — `resolveMany` is UPDATE-only. Do not use it for signal_key adverts whose
- * resolution must wake a parked workflow; those require the per-row `resolveEscalation`
- * (which delivers the signal).
+ * signals — `resolveMany` is UPDATE-only, and the store enforces it: rows with
+ * `signal_key` set (live `condition()` waiters) are skipped, stay `pending`, and
+ * drop out of the return set. Waking a parked workflow requires the per-row
+ * `resolveEscalation` (which delivers the signal).
  */
 export declare function resolveEscalationsByIds(ids: string[], resolverPayload: Record<string, any>, metadata?: Record<string, any>): Promise<LTEscalationRecord[]>;
 /**

package/build/services/escalation/crud.js

@@ -140,9 +140,10 @@ async function resolveEscalation(id, resolverPayload, metadata) {
  * Use this over a per-row `resolveEscalation` loop when every row takes the SAME
  * resolverPayload and the rows are woken collectively (or are bookkeeping rows with
  * no signal_key). NOTE: unlike the single `resolve`, this does NOT deliver per-row
- * signals — `resolveMany` is UPDATE-only. Do not use it for signal_key adverts whose
- * resolution must wake a parked workflow; those require the per-row `resolveEscalation`
- * (which delivers the signal).
+ * signals — `resolveMany` is UPDATE-only, and the store enforces it: rows with
+ * `signal_key` set (live `condition()` waiters) are skipped, stay `pending`, and
+ * drop out of the return set. Waking a parked workflow requires the per-row
+ * `resolveEscalation` (which delivers the signal).
  */
 async function resolveEscalationsByIds(ids, resolverPayload, metadata) {
     if (ids.length === 0)

package/build/start/workers.js

@@ -173,6 +173,7 @@ async function startWorkers(startConfig, workers, builtinMcpServerFactories) {
                         workflow_type: workflowType,
                         task_queue: w.taskQueue,
                         invocable: c.invocable ?? false,
+                        certified: c.certified,
                         default_role: c.defaultRole ?? 'reviewer',
                         description: c.description ?? null,
                         roles: c.roles ?? [],

package/build/system/mcp-servers/admin/schemas.d.ts

@@ -234,6 +234,7 @@ export declare const listWorkflowConfigsSchema: z.ZodObject<{}, "strip", z.ZodTy
 export declare const upsertWorkflowConfigSchema: z.ZodObject<{
     workflow_type: z.ZodString;
     invocable: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    certified: z.ZodOptional<z.ZodBoolean>;
     task_queue: z.ZodDefault<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
     default_role: z.ZodDefault<z.ZodOptional<z.ZodString>>;
     description: z.ZodDefault<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
@@ -259,8 +260,10 @@ export declare const upsertWorkflowConfigSchema: z.ZodObject<{
     resolver_schema: Record<string, any> | null;
     cron_schedule: string | null;
     execute_as: string | null;
+    certified?: boolean | undefined;
 }, {
     workflow_type: string;
+    certified?: boolean | undefined;
     invocable?: boolean | undefined;
     task_queue?: string | null | undefined;
     default_role?: string | undefined;

package/build/system/mcp-servers/admin/schemas.js

@@ -103,6 +103,8 @@ exports.listWorkflowConfigsSchema = zod_1.z.object({});
 exports.upsertWorkflowConfigSchema = zod_1.z.object({
     workflow_type: zod_1.z.string().describe('Workflow function name'),
     invocable: zod_1.z.boolean().optional().default(false),
+    certified: zod_1.z.boolean().optional()
+        .describe('Explicit HITL certification (interceptor treatment). Omitted → derived from roles/consumes presence.'),
     task_queue: zod_1.z.string().nullable().optional().default(null),
     default_role: zod_1.z.string().optional().default('reviewer'),
     description: zod_1.z.string().nullable().optional().default(null),
@@ -117,7 +119,7 @@ exports.upsertWorkflowConfigSchema = zod_1.z.object({
     cron_schedule: zod_1.z.string().nullable().optional().default(null),
 });
 exports.deleteWorkflowConfigSchema = zod_1.z.object({
-    workflow_type: zod_1.z.string().describe('Workflow type to de-certify'),
+    workflow_type: zod_1.z.string().describe('Workflow type to unregister (deletes the registration row)'),
 });
 // ── workflows (routes/workflows/invocation.ts + discovery.ts) ───────────────
 exports.listDiscoveredWorkflowsSchema = zod_1.z.object({

package/build/system/mcp-servers/admin/workflow-config.js

@@ -75,6 +75,7 @@ function registerWorkflowConfigTools(server) {
         const config = await configService.upsertWorkflowConfig({
             workflow_type: args.workflow_type,
             invocable: args.invocable,
+            certified: args.certified,
             task_queue: args.task_queue,
             default_role: args.default_role,
             description: args.description,

package/build/types/config.d.ts

@@ -5,9 +5,23 @@
 export interface LTWorkflowConfig {
     workflow_type: string;
     invocable: boolean;
+    /**
+     * Explicit certification. Certified workflows get the interceptor: task
+     * tracking, escalation handling, re-run detection. Stored on the row —
+     * demoting to plain registered flips this flag and keeps every other
+     * field intact. Always present on reads; optional on writes, where an
+     * omitted value derives from roles/consumes presence (the pre-flag rule).
+     */
+    certified?: boolean;
     task_queue: string | null;
     default_role: string;
     description: string | null;
+    /**
+     * @deprecated Escalation formalization belongs to the escalation and its
+     * role — roles carry the versioned escalation schema and take precedence.
+     * This list remains only as the interceptor default for who can claim and
+     * resolve interceptor-raised escalations.
+     */
     roles: string[];
     invocation_roles: string[];
     consumes: string[];
@@ -24,6 +38,8 @@ export interface LTWorkflowConfig {
  */
 export interface LTResolvedConfig {
     invocable: boolean;
+    /** Explicit certification — gates the interceptor treatment. */
+    certified: boolean;
     taskQueue: string | null;
     role: string;
     roles: string[];

package/build/types/startup.d.ts

@@ -19,11 +19,21 @@ export interface LTWorkerConfig {
     description?: string;
     /** Allow invocation from the dashboard / API. Default: false. */
     invocable?: boolean;
+    /**
+     * Certify for HITL escalation — the interceptor wraps the workflow with
+     * task tracking, escalation handling, and re-run detection. Omitted →
+     * derived from roles/consumes presence (the pre-flag behavior).
+     */
+    certified?: boolean;
     /** Roles allowed to invoke this workflow. */
     invocationRoles?: string[];
     /** Default role for escalations. Default: 'reviewer'. */
     defaultRole?: string;
-    /** Roles that can claim and resolve escalations (certifies the workflow for HITL). */
+    /**
+     * Interceptor default for who can claim and resolve interceptor-raised
+     * escalations. Escalation formalization lives with the escalation's role
+     * (versioned schema) and takes precedence over this list.
+     */
     roles?: string[];
     /** JSON template that pre-fills the dashboard invocation form. */
     envelopeSchema?: Record<string, any>;

package/dashboard/dist/assets/AdminDashboard-Ck5-jV9T.js

@@ -0,0 +1,2 @@
+import{v as n,j as o}from"./index-DgCS2Frb.js";import{c as m}from"./tasks-DNdvW5H6.js";import{f as d}from"./useEventHooks-CUUeBSH1.js";import{u}from"./mcp-BtG54ZAx.js";import{P as c}from"./PageHeaderWithStats-Cf8TYFRh.js";import"./vendor-query-DLp59M9_.js";import"./vendor-react-zA2lQFDs.js";import"./vendor-icons-CNyYGNsk.js";function N(){var e;d();const{data:a}=m({limit:1}),{data:t}=n({status:"pending",limit:1}),{data:s}=u(),i=((e=s==null?void 0:s.servers)==null?void 0:e.filter(l=>l.status==="connected").length)??0,r=s?`${i}/${s.total}`:"—";return o.jsxDEV("div",{children:o.jsxDEV(c,{title:"Admin",stats:[{label:"Tasks",value:(a==null?void 0:a.total)??"—"},{label:"Pending Escalations",value:(t==null?void 0:t.total)??"—",dotClass:"bg-status-pending"},{label:"MCP Servers",value:r},{label:"System",value:"Healthy",dotClass:"bg-status-success"}]},void 0,!1,{fileName:"/app/dashboard/src/pages/admin/AdminDashboard.tsx",lineNumber:19,columnNumber:7},this)},void 0,!1,{fileName:"/app/dashboard/src/pages/admin/AdminDashboard.tsx",lineNumber:18,columnNumber:5},this)}export{N as AdminDashboard};
+//# sourceMappingURL=AdminDashboard-Ck5-jV9T.js.map

package/dashboard/dist/assets/{AdminDashboard-Bgomc_jH.js.map → AdminDashboard-Ck5-jV9T.js.map}

@@ -1 +1 @@
-{"version":3,"file":"AdminDashboard-Bgomc_jH.js","sources":["../../src/pages/admin/AdminDashboard.tsx"],"sourcesContent":["import { useTasks } from '../../api/tasks';\nimport { useEscalations } from '../../api/escalations';\nimport { useEscalationListEvents } from '../../hooks/useEventHooks';\nimport { useMcpServers } from '../../api/mcp';\nimport { PageHeaderWithStats } from '../../components/common/layout/PageHeaderWithStats';\n\nexport function AdminDashboard() {\n  useEscalationListEvents();\n  const { data: taskData } = useTasks({ limit: 1 });\n  const { data: pendingEsc } = useEscalations({ status: 'pending', limit: 1 });\n  const { data: mcpData } = useMcpServers();\n\n  const connectedServers =\n    mcpData?.servers?.filter((s) => s.status === 'connected').length ?? 0;\n  const mcpLabel = mcpData ? `${connectedServers}/${mcpData.total}` : '—';\n\n  return (\n    <div>\n      <PageHeaderWithStats\n        title=\"Admin\"\n        stats={[\n          { label: 'Tasks', value: taskData?.total ?? '—' },\n          { label: 'Pending Escalations', value: pendingEsc?.total ?? '—', dotClass: 'bg-status-pending' },\n          { label: 'MCP Servers', value: mcpLabel },\n          { label: 'System', value: 'Healthy', dotClass: 'bg-status-success' },\n        ]}\n      />\n    </div>\n  );\n}\n"],"names":["AdminDashboard","useEscalationListEvents","taskData","useTasks","pendingEsc","useEscalations","mcpData","useMcpServers","connectedServers","_a","s","mcpLabel","jsx","PageHeaderWithStats"],"mappings":"4UAMO,SAASA,GAAiB,OAC/BC,EAAA,EACA,KAAM,CAAE,KAAMC,CAAA,EAAaC,EAAS,CAAE,MAAO,EAAG,EAC1C,CAAE,KAAMC,CAAA,EAAeC,EAAe,CAAE,OAAQ,UAAW,MAAO,EAAG,EACrE,CAAE,KAAMC,CAAA,EAAYC,EAAA,EAEpBC,IACJC,EAAAH,GAAA,YAAAA,EAAS,UAAT,YAAAG,EAAkB,OAAQC,GAAMA,EAAE,SAAW,aAAa,SAAU,EAChEC,EAAWL,EAAU,GAAGE,CAAgB,IAAIF,EAAQ,KAAK,GAAK,IAEpE,aACG,MAAA,CACC,SAAAM,EAAAA,IAACC,EAAA,CACC,MAAM,QACN,MAAO,CACL,CAAE,MAAO,QAAS,OAAOX,GAAA,YAAAA,EAAU,QAAS,GAAA,EAC5C,CAAE,MAAO,sBAAuB,OAAOE,GAAA,YAAAA,EAAY,QAAS,IAAK,SAAU,mBAAA,EAC3E,CAAE,MAAO,cAAe,MAAOO,CAAA,EAC/B,CAAE,MAAO,SAAU,MAAO,UAAW,SAAU,mBAAA,CAAoB,CACrE,CAAA,EAEJ,CAEJ"}
+{"version":3,"file":"AdminDashboard-Ck5-jV9T.js","sources":["../../src/pages/admin/AdminDashboard.tsx"],"sourcesContent":["import { useTasks } from '../../api/tasks';\nimport { useEscalations } from '../../api/escalations';\nimport { useEscalationListEvents } from '../../hooks/useEventHooks';\nimport { useMcpServers } from '../../api/mcp';\nimport { PageHeaderWithStats } from '../../components/common/layout/PageHeaderWithStats';\n\nexport function AdminDashboard() {\n  useEscalationListEvents();\n  const { data: taskData } = useTasks({ limit: 1 });\n  const { data: pendingEsc } = useEscalations({ status: 'pending', limit: 1 });\n  const { data: mcpData } = useMcpServers();\n\n  const connectedServers =\n    mcpData?.servers?.filter((s) => s.status === 'connected').length ?? 0;\n  const mcpLabel = mcpData ? `${connectedServers}/${mcpData.total}` : '—';\n\n  return (\n    <div>\n      <PageHeaderWithStats\n        title=\"Admin\"\n        stats={[\n          { label: 'Tasks', value: taskData?.total ?? '—' },\n          { label: 'Pending Escalations', value: pendingEsc?.total ?? '—', dotClass: 'bg-status-pending' },\n          { label: 'MCP Servers', value: mcpLabel },\n          { label: 'System', value: 'Healthy', dotClass: 'bg-status-success' },\n        ]}\n      />\n    </div>\n  );\n}\n"],"names":["AdminDashboard","useEscalationListEvents","taskData","useTasks","pendingEsc","useEscalations","mcpData","useMcpServers","connectedServers","_a","s","mcpLabel","jsxDEV","PageHeaderWithStats"],"mappings":"uUAMO,SAASA,GAAiB,OAC/BC,EAAA,EACA,KAAM,CAAE,KAAMC,CAAA,EAAaC,EAAS,CAAE,MAAO,EAAG,EAC1C,CAAE,KAAMC,CAAA,EAAeC,EAAe,CAAE,OAAQ,UAAW,MAAO,EAAG,EACrE,CAAE,KAAMC,CAAA,EAAYC,EAAA,EAEpBC,IACJC,EAAAH,GAAA,YAAAA,EAAS,UAAT,YAAAG,EAAkB,OAAQC,GAAMA,EAAE,SAAW,aAAa,SAAU,EAChEC,EAAWL,EAAU,GAAGE,CAAgB,IAAIF,EAAQ,KAAK,GAAK,IAEpE,gBACG,MAAA,CACC,SAAAM,EAAAA,OAACC,EAAA,CACC,MAAM,QACN,MAAO,CACL,CAAE,MAAO,QAAS,OAAOX,GAAA,YAAAA,EAAU,QAAS,GAAA,EAC5C,CAAE,MAAO,sBAAuB,OAAOE,GAAA,YAAAA,EAAY,QAAS,IAAK,SAAU,mBAAA,EAC3E,CAAE,MAAO,cAAe,MAAOO,CAAA,EAC/B,CAAE,MAAO,SAAU,MAAO,UAAW,SAAU,mBAAA,CAAoB,CACrE,EAPF,OAAA,GAAA,CAAA,SAAA,oDAAA,WAAA,GAAA,aAAA,CAAA,EAAA,IAAA,CAQA,EATF,OAAA,GAAA,CAAA,SAAA,oDAAA,WAAA,GAAA,aAAA,CAAA,EAAA,IAUA,CAEJ"}