@hotmeshio/long-tail 0.12.0 → 0.13.0

package/build/start/workers.js

@@ -50,6 +50,7 @@ const cron_1 = require("../services/cron");
 const mcp_1 = require("../services/mcp");
 const yamlWorkflowWorkers = __importStar(require("../services/yaml-workflow/workers"));
 const migrate_1 = require("../lib/db/migrate");
+const apply_report_1 = require("./apply-report");
 /**
  * Create a named no-op workflow function for readonly/observer workers.
  * The function name is used by `registerWorker` for discovery.
@@ -116,6 +117,54 @@ async function startWorkers(startConfig, workers, builtinMcpServerFactories) {
     // Seed MCP service account (idempotent)
     const { seedMcpServiceAccount } = await Promise.resolve().then(() => __importStar(require('../services/mcp/seed-service-account')));
     await seedMcpServiceAccount();
+    // Who owns declared configuration after first boot ('db' = insert-if-absent).
+    const configSource = startConfig.configSource ?? 'db';
+    const codeOwnedBoot = configSource === 'code';
+    // Register declared roles (every container — roles are independent of workers).
+    if (startConfig.roles?.length) {
+        const { applyRoleConfig, listConfiguredRoles } = await Promise.resolve().then(() => __importStar(require('../services/role/seed')));
+        const roleReport = (0, apply_report_1.newSurfaceReport)();
+        await (0, apply_report_1.withConfigLock)(async () => {
+            for (const roleCfg of startConfig.roles) {
+                try {
+                    const outcome = await applyRoleConfig(roleCfg, (0, apply_report_1.ownedByCode)(roleCfg.reset, configSource));
+                    (0, apply_report_1.recordOutcome)(roleReport, roleCfg.role, outcome);
+                    if (outcome === 'applied')
+                        logger_1.loggerRegistry.info(`[long-tail] role applied: ${roleCfg.role}`);
+                }
+                catch (err) {
+                    logger_1.loggerRegistry.warn(`[long-tail] role apply failed for ${roleCfg.role}: ${err.message}`);
+                }
+            }
+        });
+        if (codeOwnedBoot && !startConfig.examples) {
+            // Orphans = configured roles (title or form schema set) neither declared
+            // here nor referenced by a declared workflow profile. Bare FK rows and
+            // membership-only roles never count. Skipped under examples — the demo
+            // seeders own their roles.
+            const declared = new Set(['reviewer', 'superadmin', 'system']);
+            for (const r of startConfig.roles) {
+                declared.add(r.role);
+                if (r.parent_role)
+                    declared.add(r.parent_role);
+                for (const t of r.escalation_targets ?? [])
+                    declared.add(t);
+                for (const u of r.upstream_roles ?? [])
+                    declared.add(u);
+            }
+            for (const w of workers) {
+                if (!w.config)
+                    continue;
+                declared.add(w.config.defaultRole ?? 'reviewer');
+                for (const role of [...(w.config.roles ?? []), ...(w.config.invocationRoles ?? [])]) {
+                    declared.add(role);
+                }
+            }
+            roleReport.orphans = (await listConfiguredRoles()).filter((r) => !declared.has(r));
+        }
+        if (codeOwnedBoot)
+            (0, apply_report_1.logSurfaceReport)('roles', roleReport);
+    }
     const connection = buildConnection();
     // Readonly mode: all user-provided workers are observers — skip crons, triggers, and agent seeding.
     // System workers (mcpQuery, etc.) are always added by collectWorkers, so check the original config.
@@ -160,16 +209,19 @@ async function startWorkers(startConfig, workers, builtinMcpServerFactories) {
             (0, registry_1.registerWorker)(w.workflow.name, w.taskQueue);
         }
         logger_1.loggerRegistry.info(`[long-tail] workers started on queues: ${workers.map((w) => w.taskQueue).join(', ')}`);
-        // Seed workflow configs (insert-if-absent — DB is source of truth)
+        // Register workflow configs — ownership per configSource / per-entry reset.
+        // Code-owned profiles are diffed and applied; db-owned profiles keep the
+        // insert-if-absent contract (DB is source of truth after first boot).
         const workersWithConfig = workers.filter((w) => w.config);
         if (workersWithConfig.length) {
-            const { seedWorkflowConfig } = await Promise.resolve().then(() => __importStar(require('../services/config/write')));
+            const { seedWorkflowConfig, applyWorkflowConfig } = await Promise.resolve().then(() => __importStar(require('../services/config/write')));
             const { ltConfig } = await Promise.resolve().then(() => __importStar(require('../modules/ltconfig')));
-            for (const w of workersWithConfig) {
-                const workflowType = w.workflow.name;
-                const c = w.config;
-                try {
-                    const inserted = await seedWorkflowConfig({
+            const wfReport = (0, apply_report_1.newSurfaceReport)();
+            await (0, apply_report_1.withConfigLock)(async () => {
+                for (const w of workersWithConfig) {
+                    const workflowType = w.workflow.name;
+                    const c = w.config;
+                    const declaration = {
                         workflow_type: workflowType,
                         task_queue: w.taskQueue,
                         invocable: c.invocable ?? false,
@@ -184,13 +236,33 @@ async function startWorkers(startConfig, workers, builtinMcpServerFactories) {
                         resolver_schema: c.resolverSchema ?? null,
                         cron_schedule: c.cronSchedule ?? null,
                         execute_as: c.executeAs ?? null,
-                    });
-                    if (inserted)
-                        logger_1.loggerRegistry.info(`[long-tail] config seeded: ${workflowType}`);
-                }
-                catch (err) {
-                    logger_1.loggerRegistry.warn(`[long-tail] config seed failed for ${workflowType}: ${err.message}`);
+                    };
+                    try {
+                        if ((0, apply_report_1.ownedByCode)(c.reset, configSource)) {
+                            const outcome = await applyWorkflowConfig(declaration);
+                            (0, apply_report_1.recordOutcome)(wfReport, workflowType, outcome);
+                            if (outcome === 'applied')
+                                logger_1.loggerRegistry.info(`[long-tail] config applied: ${workflowType}`);
+                        }
+                        else {
+                            const inserted = await seedWorkflowConfig(declaration);
+                            (0, apply_report_1.recordOutcome)(wfReport, workflowType, 'db-owned');
+                            if (inserted)
+                                logger_1.loggerRegistry.info(`[long-tail] config seeded: ${workflowType}`);
+                        }
+                    }
+                    catch (err) {
+                        logger_1.loggerRegistry.warn(`[long-tail] config seed failed for ${workflowType}: ${err.message}`);
+                    }
                 }
+            });
+            if (codeOwnedBoot) {
+                const { listWorkflowConfigs } = await Promise.resolve().then(() => __importStar(require('../services/config/read')));
+                const registered = new Set(workers.map((w) => w.workflow.name));
+                wfReport.orphans = (await listWorkflowConfigs())
+                    .map((cfg) => cfg.workflow_type)
+                    .filter((t) => !registered.has(t));
+                (0, apply_report_1.logSurfaceReport)('workflows', wfReport);
             }
             ltConfig.invalidate();
         }
@@ -211,7 +283,7 @@ async function startWorkers(startConfig, workers, builtinMcpServerFactories) {
         // Register MCP server factories: built-in (from system/) + user-provided
         // Both system and user factories can carry inline config for DB seeding.
         const { registerBuiltinServer } = await Promise.resolve().then(() => __importStar(require('../services/mcp/client')));
-        const { seedMcpServer, cleanStaleBuiltinServers } = await Promise.resolve().then(() => __importStar(require('../services/mcp/db')));
+        const { seedMcpServer, applyMcpServer, cleanStaleBuiltinServers } = await Promise.resolve().then(() => __importStar(require('../services/mcp/db')));
         const userFactories = startConfig.mcp?.serverFactories ?? {};
         // Resolve user factories — plain function or { factory, config }
         const resolvedUserFactories = {};
@@ -236,19 +308,33 @@ async function startWorkers(startConfig, workers, builtinMcpServerFactories) {
         // Set exposure config for the /mcp endpoint
         const { setExposureConfig } = await Promise.resolve().then(() => __importStar(require('../services/mcp/exposure')));
         setExposureConfig(startConfig.mcp?.exposure);
-        // 2. Seed MCP server configs (insert-if-absent + drift log)
+        // 2. Register MCP server configs — ownership per configSource / per-entry
+        // reset. Code-owned entries apply the config fields (runtime state stays
+        // untouched); db-owned entries keep insert-if-absent + drift log.
+        const mcpReport = (0, apply_report_1.newSurfaceReport)();
         for (const [name, entry] of Object.entries(allFactories)) {
             if (entry.config) {
                 try {
-                    const inserted = await seedMcpServer({ name, ...entry.config });
-                    if (inserted)
-                        logger_1.loggerRegistry.info(`[long-tail] MCP server seeded: ${name}`);
+                    if ((0, apply_report_1.ownedByCode)(entry.config.reset, configSource)) {
+                        const outcome = await applyMcpServer({ name, ...entry.config });
+                        (0, apply_report_1.recordOutcome)(mcpReport, name, outcome);
+                        if (outcome === 'applied')
+                            logger_1.loggerRegistry.info(`[long-tail] MCP server applied: ${name}`);
+                    }
+                    else {
+                        const inserted = await seedMcpServer({ name, ...entry.config });
+                        (0, apply_report_1.recordOutcome)(mcpReport, name, 'db-owned');
+                        if (inserted)
+                            logger_1.loggerRegistry.info(`[long-tail] MCP server seeded: ${name}`);
+                    }
                 }
                 catch (err) {
                     logger_1.loggerRegistry.warn(`[long-tail] MCP server seed failed for ${name}: ${err.message}`);
                 }
             }
         }
+        if (codeOwnedBoot)
+            (0, apply_report_1.logSurfaceReport)('mcp-servers', mcpReport);
         // 3. Clean stale builtin servers no longer in factory list
         await cleanStaleBuiltinServers(Object.keys(allFactories));
         // Seed static graph (YAML/DAG) workflows — the graph-form peer of `workers`.
@@ -268,16 +354,34 @@ async function startWorkers(startConfig, workers, builtinMcpServerFactories) {
         // Register workers for active YAML (deterministic) workflows
         await yamlWorkflowWorkers.registerAllActiveWorkers();
     }
-    // Seed topic catalog (system topics + user-declared topics)
+    // Seed topic catalog (system topics + user-declared topics). Declared
+    // topics follow configSource; per-entry `reset` overrides in either direction.
     const { seedSystemTopics, seedConfigTopics } = await Promise.resolve().then(() => __importStar(require('../services/topics/system-topics')));
     await seedSystemTopics();
     if (startConfig.topics?.length)
-        await seedConfigTopics(startConfig.topics);
-    // Seed the domain dictionary (every container, workers or not) — insert-if-
-    // absent with warn-only reference validation; the DB row is runtime truth.
+        await seedConfigTopics(startConfig.topics, codeOwnedBoot);
+    if (codeOwnedBoot) {
+        const { listConfigTopicNames } = await Promise.resolve().then(() => __importStar(require('../services/topics')));
+        const declaredTopics = new Set((startConfig.topics ?? []).map((t) => t.topic));
+        if (startConfig.examples) {
+            try {
+                const { EXAMPLE_TOPICS } = await Promise.resolve().then(() => __importStar(require('../examples')));
+                for (const t of EXAMPLE_TOPICS ?? [])
+                    declaredTopics.add(t.topic);
+            }
+            catch { /* examples not available */ }
+        }
+        const orphanTopics = (await listConfigTopicNames()).filter((t) => !declaredTopics.has(t));
+        if (orphanTopics.length) {
+            logger_1.loggerRegistry.warn(`[long-tail] config apply (topics): orphans: [${orphanTopics.join(', ')}]`);
+        }
+    }
+    // Seed the domain dictionary (every container, workers or not). Db-owned:
+    // insert-if-absent, the DB row is runtime truth. Code-owned: the file is
+    // compared and applied, bumping the version once per changed document.
     if (startConfig.mcp?.domainDictionaryPath) {
         const { seedDomainDictionary } = await Promise.resolve().then(() => __importStar(require('../services/domain')));
-        await seedDomainDictionary(startConfig.mcp.domainDictionaryPath);
+        await seedDomainDictionary(startConfig.mcp.domainDictionaryPath, startConfig.mcp.domainDictionaryReset ?? codeOwnedBoot);
     }
     // Seed example topics when examples are enabled
     if (startConfig.examples) {
@@ -294,9 +398,11 @@ async function startWorkers(startConfig, workers, builtinMcpServerFactories) {
         : [];
     const allAgentConfigs = [...(startConfig.agents ?? []), ...systemAgents];
     if (allAgentConfigs.length > 0) {
-        const { seedAgent } = await Promise.resolve().then(() => __importStar(require('../services/agent')));
-        const { seedSubscription } = await Promise.resolve().then(() => __importStar(require('../services/agent/subscriptions')));
+        const { seedAgent, applyAgent, listAgentIds } = await Promise.resolve().then(() => __importStar(require('../services/agent')));
+        const { seedSubscription, applySubscription, listSubscriptions } = await Promise.resolve().then(() => __importStar(require('../services/agent/subscriptions')));
+        const agentReport = (0, apply_report_1.newSurfaceReport)();
         for (const agentConfig of allAgentConfigs) {
+            const codeOwned = (0, apply_report_1.ownedByCode)(agentConfig.reset, configSource);
             try {
                 // Map flat schedules into behaviors.schedules for DB storage
                 const behaviors = {};
@@ -304,7 +410,7 @@ async function startWorkers(startConfig, workers, builtinMcpServerFactories) {
                     behaviors.schedules = agentConfig.schedules;
                     behaviors.cron = agentConfig.schedules[0].cron;
                 }
-                const inserted = await seedAgent({
+                const declaration = {
                     id: agentConfig.name,
                     description: agentConfig.description,
                     goals: agentConfig.goals,
@@ -313,27 +419,58 @@ async function startWorkers(startConfig, workers, builtinMcpServerFactories) {
                     knowledge_domain: agentConfig.knowledge_domain,
                     behaviors,
                     workflow_type: agentConfig.schedules?.[0]?.workflow_type,
-                });
-                if (inserted)
-                    logger_1.loggerRegistry.info(`[long-tail] agent seeded: ${agentConfig.name}`);
-                // Seed subscriptions for this agent — id IS the name
+                };
+                if (codeOwned) {
+                    const outcome = await applyAgent(declaration);
+                    (0, apply_report_1.recordOutcome)(agentReport, agentConfig.name, outcome);
+                    if (outcome === 'applied')
+                        logger_1.loggerRegistry.info(`[long-tail] agent applied: ${agentConfig.name}`);
+                }
+                else {
+                    const inserted = await seedAgent(declaration);
+                    (0, apply_report_1.recordOutcome)(agentReport, agentConfig.name, 'db-owned');
+                    if (inserted)
+                        logger_1.loggerRegistry.info(`[long-tail] agent seeded: ${agentConfig.name}`);
+                }
+                // Subscriptions for this agent — id IS the name
                 if (agentConfig.subscriptions?.length) {
                     for (const sub of agentConfig.subscriptions) {
                         try {
-                            const subInserted = await seedSubscription(agentConfig.name, sub);
-                            if (subInserted)
-                                logger_1.loggerRegistry.info(`[long-tail] subscription seeded: ${agentConfig.name}/${sub.topic}`);
+                            if (codeOwned) {
+                                const outcome = await applySubscription(agentConfig.name, sub);
+                                if (outcome === 'applied')
+                                    logger_1.loggerRegistry.info(`[long-tail] subscription applied: ${agentConfig.name}/${sub.topic}`);
+                            }
+                            else {
+                                const subInserted = await seedSubscription(agentConfig.name, sub);
+                                if (subInserted)
+                                    logger_1.loggerRegistry.info(`[long-tail] subscription seeded: ${agentConfig.name}/${sub.topic}`);
+                            }
                         }
                         catch (subErr) {
                             logger_1.loggerRegistry.warn(`[long-tail] subscription seed failed: ${agentConfig.name}/${sub.topic}: ${subErr.message}`);
                         }
                     }
                 }
+                // Undeclared subscriptions on a code-owned agent are reported, never
+                // deleted — disabling or removing one stays a deliberate act.
+                if (codeOwned) {
+                    const declaredSubs = new Set((agentConfig.subscriptions ?? []).map((s) => s.topic));
+                    const existingSubs = await listSubscriptions(agentConfig.name);
+                    agentReport.orphans.push(...existingSubs
+                        .filter((s) => !declaredSubs.has(s.topic))
+                        .map((s) => `${agentConfig.name}/${s.topic}`));
+                }
             }
             catch (err) {
                 logger_1.loggerRegistry.warn(`[long-tail] agent seed failed for ${agentConfig.name}: ${err.message}`);
             }
         }
+        if (codeOwnedBoot) {
+            const declaredAgents = new Set(allAgentConfigs.map((a) => a.name));
+            agentReport.orphans.push(...(await listAgentIds()).filter((id) => !declaredAgents.has(id)));
+            (0, apply_report_1.logSurfaceReport)('agents', agentReport);
+        }
     }
     // Register the in-process callback adapter for agent event triggers.
     // Reuse existing instance if already registered (e.g., from SDK createClient).

package/build/tsconfig.tsbuildinfo

@@ -1 +1 @@
-{"root":["../index.ts","../vitest.config.ts","../vitest.integration.config.ts","../adapters/express.ts","../api/agent-subscriptions.ts","../api/agents.ts","../api/auth-sso.ts","../api/auth.ts","../api/bot-accounts.ts","../api/capabilities.ts","../api/controlplane.ts","../api/dba.ts","../api/diagnostics.ts","../api/domain.ts","../api/exports.ts","../api/files.ts","../api/index.ts","../api/insight.ts","../api/knowledge.ts","../api/maintenance.ts","../api/me.ts","../api/namespaces.ts","../api/overview.ts","../api/personas.ts","../api/pipelines.ts","../api/roles.ts","../api/settings.ts","../api/tasks.ts","../api/topics.ts","../api/users.ts","../api/workflow-sets.ts","../api/escalations/analytics.ts","../api/escalations/bulk.ts","../api/escalations/cancel.ts","../api/escalations/claim.ts","../api/escalations/create.ts","../api/escalations/facets.ts","../api/escalations/helpers.ts","../api/escalations/index.ts","../api/escalations/list.ts","../api/escalations/metadata.ts","../api/escalations/resolve.ts","../api/escalations/single.ts","../api/mcp/index.ts","../api/mcp/servers.ts","../api/mcp/tools.ts","../api/scan-codes/choice.ts","../api/scan-codes/config.ts","../api/scan-codes/context.ts","../api/scan-codes/execute.ts","../api/scan-codes/identity.ts","../api/scan-codes/index.ts","../api/scan-codes/locate.ts","../api/scan-codes/present.ts","../api/scan-codes/verbs.ts","../api/workflows/config.ts","../api/workflows/discovery.ts","../api/workflows/index.ts","../api/workflows/invocation.ts","../api/yaml-workflows/cron.ts","../api/yaml-workflows/crud.ts","../api/yaml-workflows/deploy.ts","../api/yaml-workflows/helpers.ts","../api/yaml-workflows/index.ts","../api/yaml-workflows/versions.ts","../bin/ltc.ts","../lib/typed-resolution.ts","../lib/cli/auth.ts","../lib/cli/client.ts","../lib/cli/compile.ts","../lib/cli/format.ts","../lib/cli/init.ts","../lib/cli/output.ts","../lib/cli/scanner.ts","../lib/cli/types.ts","../lib/cli/commands/escalations.ts","../lib/cli/commands/knowledge.ts","../lib/cli/commands/mcp.ts","../lib/cli/commands/personas.ts","../lib/cli/commands/pipelines.ts","../lib/cli/commands/roles.ts","../lib/cli/commands/status.ts","../lib/cli/commands/streams.ts","../lib/cli/commands/users.ts","../lib/cli/commands/workflows.ts","../lib/db/index.ts","../lib/db/migrate.ts","../lib/events/callback.ts","../lib/events/escalation-wire.ts","../lib/events/index.ts","../lib/events/matching.ts","../lib/events/memory.ts","../lib/events/nats-ws-proxy.ts","../lib/events/nats.ts","../lib/events/publish.ts","../lib/events/socketio.ts","../lib/events/system-events.ts","../lib/json-path/pick.ts","../lib/logger/index.ts","../lib/logger/pino.ts","../lib/storage/index.ts","../lib/storage/local.ts","../lib/storage/mime.ts","../lib/storage/s3.ts","../lib/storage/types.ts","../lib/telemetry/honeycomb.ts","../lib/telemetry/index.ts","../modules/auth.ts","../modules/branding.ts","../modules/config.ts","../modules/defaults.ts","../modules/features.ts","../modules/ltconfig.ts","../modules/maintenance.ts","../modules/sso.ts","../modules/utils.ts","../modules/version.ts","../routes/agents.ts","../routes/auth-sso.ts","../routes/auth.ts","../routes/bot-accounts.ts","../routes/capabilities.ts","../routes/controlplane.ts","../routes/dba.ts","../routes/delegation.ts","../routes/diagnostics.ts","../routes/docs.ts","../routes/domain.ts","../routes/exports.ts","../routes/file-browser.ts","../routes/files.ts","../routes/index.ts","../routes/insight.ts","../routes/knowledge.ts","../routes/maintenance.ts","../routes/mcp-endpoint.ts","../routes/mcp.ts","../routes/me.ts","../routes/namespaces.ts","../routes/nats-credentials.ts","../routes/oauth.ts","../routes/overview.ts","../routes/personas.ts","../routes/pipelines.ts","../routes/roles.ts","../routes/scan-codes.ts","../routes/settings.ts","../routes/tasks.ts","../routes/topics.ts","../routes/users.ts","../routes/workflow-sets.ts","../routes/escalations/acting.ts","../routes/escalations/analytics.ts","../routes/escalations/bulk.ts","../routes/escalations/facets.ts","../routes/escalations/index.ts","../routes/escalations/list.ts","../routes/escalations/metadata.ts","../routes/escalations/resolve.ts","../routes/escalations/single.ts","../routes/workflows/config.ts","../routes/workflows/discovery.ts","../routes/workflows/index.ts","../routes/workflows/invocation.ts","../routes/yaml-workflows/cron.ts","../routes/yaml-workflows/crud.ts","../routes/yaml-workflows/deployment.ts","../routes/yaml-workflows/index.ts","../routes/yaml-workflows/versions.ts","../scripts/ortho-populate.ts","../scripts/printer-cycle.ts","../scripts/process-helpers.ts","../scripts/process.ts","../scripts/token.ts","../scripts/twin-farm.ts","../sdk/index.ts","../services/dba.ts","../services/hotmesh-utils.ts","../services/workflow-invocation.ts","../services/agent/index.ts","../services/agent/input-mapper.ts","../services/agent/sql.ts","../services/agent/subscription-sql.ts","../services/agent/subscriptions.ts","../services/agent/trigger-registry.ts","../services/auth/bot-api-key.ts","../services/auth/delegation.ts","../services/auth/index.ts","../services/auth/service-token.ts","../services/auth/sql.ts","../services/config/cache.ts","../services/config/index.ts","../services/config/provider.ts","../services/config/read.ts","../services/config/sql.ts","../services/config/write.ts","../services/controlplane/index.ts","../services/controlplane/quorum-bridge.ts","../services/controlplane/sql.ts","../services/controlplane/stream-messages-sql.ts","../services/controlplane/types.ts","../services/cron/index.ts","../services/diagnostics/index.ts","../services/diagnostics/patterns.ts","../services/domain/index.ts","../services/domain/read.ts","../services/domain/seed.ts","../services/domain/sql.ts","../services/domain/validate.ts","../services/domain/write.ts","../services/escalation/aggregate-sql.ts","../services/escalation/aggregate-validate.ts","../services/escalation/aggregates.ts","../services/escalation/bulk.ts","../services/escalation/client.ts","../services/escalation/crud.ts","../services/escalation/facet-sql.ts","../services/escalation/facets.ts","../services/escalation/index.ts","../services/escalation/map.ts","../services/escalation/metrics-cache.ts","../services/escalation/queries.ts","../services/escalation/resolver-validation.ts","../services/escalation/sql.ts","../services/escalation/submit-guard.ts","../services/escalation/types.ts","../services/escalation-strategy/default.ts","../services/escalation-strategy/index.ts","../services/escalation-strategy/mcp.ts","../services/export/client.ts","../services/export/index.ts","../services/export/post-process.ts","../services/export/types.ts","../services/iam/acting-identity.ts","../services/iam/activity.ts","../services/iam/bots.ts","../services/iam/context.ts","../services/iam/credentials.ts","../services/iam/envelope.ts","../services/iam/ephemeral.ts","../services/iam/index.ts","../services/iam/principal.ts","../services/iam/resolve.ts","../services/iam/sql.ts","../services/insight/index.ts","../services/insight/prompts.ts","../services/interceptor/activity-interceptor.ts","../services/interceptor/completion.ts","../services/interceptor/context.ts","../services/interceptor/escalation.ts","../services/interceptor/index.ts","../services/interceptor/lifecycle.ts","../services/interceptor/state.ts","../services/interceptor/types.ts","../services/interceptor/activities/config.ts","../services/interceptor/activities/escalation.ts","../services/interceptor/activities/index.ts","../services/interceptor/activities/task.ts","../services/interceptor/activities/workflow.ts","../services/llm/detect.ts","../services/llm/index.ts","../services/llm/translate.ts","../services/llm/types.ts","../services/llm/providers/anthropic.ts","../services/llm/providers/openai.ts","../services/maintenance/index.ts","../services/mcp/adapter.ts","../services/mcp/db.ts","../services/mcp/exposure.ts","../services/mcp/external-server.ts","../services/mcp/index.ts","../services/mcp/register-tool.ts","../services/mcp/seed-service-account.ts","../services/mcp/server-lifecycle.ts","../services/mcp/server-tools.ts","../services/mcp/server.ts","../services/mcp/sql.ts","../services/mcp/types.ts","../services/mcp/workflow-compiler-server.ts","../services/mcp/workflow-server.ts","../services/mcp/client/connection-dispatch.ts","../services/mcp/client/connection-lifecycle.ts","../services/mcp/client/connection-test.ts","../services/mcp/client/connection.ts","../services/mcp/client/index.ts","../services/mcp/client/tools.ts","../services/mcp/db-server/index.ts","../services/mcp/db-server/schemas.ts","../services/mcp/db-server/tools.ts","../services/mcp/playwright-server/index.ts","../services/mcp/playwright-server/lifecycle.ts","../services/mcp/playwright-server/schemas.ts","../services/mcp/playwright-server/tools.ts","../services/namespace/index.ts","../services/namespace/sql.ts","../services/namespace/types.ts","../services/oauth/crypto.ts","../services/oauth/db.ts","../services/oauth/index.ts","../services/oauth/sql.ts","../services/oauth/state.ts","../services/oauth/providers/anthropic.ts","../services/oauth/providers/github.ts","../services/oauth/providers/google.ts","../services/oauth/providers/index.ts","../services/oauth/providers/microsoft.ts","../services/oauth/providers/mock.ts","../services/oauth/providers/registry.ts","../services/oauth/providers/types.ts","../services/orchestrator/condition.ts","../services/orchestrator/index.ts","../services/orchestrator/types.ts","../services/overview/index.ts","../services/overview/sql.ts","../services/persona/index.ts","../services/persona/sql.ts","../services/persona/types.ts","../services/pipelines/enrichment.ts","../services/pipelines/events.ts","../services/pipelines/execution-builder.ts","../services/pipelines/index.ts","../services/pipelines/queries.ts","../services/pipelines/sql.ts","../services/pipelines/types.ts","../services/role/enforcement-cache.ts","../services/role/index.ts","../services/role/schema-validator.ts","../services/role/sql.ts","../services/role/types.ts","../services/scan-code/index.ts","../services/scan-code/parse.ts","../services/scan-code/read.ts","../services/scan-code/sql.ts","../services/scan-code/validate.ts","../services/scan-code/write.ts","../services/task/crud.ts","../services/task/index.ts","../services/task/process.ts","../services/task/resolve.ts","../services/task/sql.ts","../services/task/types.ts","../services/topics/index.ts","../services/topics/sql.ts","../services/topics/system-topics.ts","../services/user/auth.ts","../services/user/crud.ts","../services/user/index.ts","../services/user/preferences.ts","../services/user/rbac.ts","../services/user/roles.ts","../services/user/scope.ts","../services/user/seed-admin.ts","../services/user/sql.ts","../services/user/sso-provision.ts","../services/user/types.ts","../services/workers/registry.ts","../services/workflow-sets/db.ts","../services/workflow-sets/index.ts","../services/workflow-sets/sql.ts","../services/yaml-workflow/builder-regenerate.ts","../services/yaml-workflow/db-utils.ts","../services/yaml-workflow/db-versions.ts","../services/yaml-workflow/db.ts","../services/yaml-workflow/deployer-helpers.ts","../services/yaml-workflow/deployer.ts","../services/yaml-workflow/generator.ts","../services/yaml-workflow/index.ts","../services/yaml-workflow/input-analyzer-helpers.ts","../services/yaml-workflow/input-analyzer.ts","../services/yaml-workflow/invoke.ts","../services/yaml-workflow/pipe-validator.ts","../services/yaml-workflow/sql.ts","../services/yaml-workflow/types.ts","../services/yaml-workflow/durable-compiler/index.ts","../services/yaml-workflow/durable-compiler/parser.ts","../services/yaml-workflow/durable-compiler/prompts.ts","../services/yaml-workflow/durable-compiler/types.ts","../services/yaml-workflow/pattern-detector/array-source.ts","../services/yaml-workflow/pattern-detector/collapse.ts","../services/yaml-workflow/pattern-detector/index.ts","../services/yaml-workflow/pattern-detector/run-detection.ts","../services/yaml-workflow/pattern-detector/types.ts","../services/yaml-workflow/pipeline/analyze.ts","../services/yaml-workflow/pipeline/extract-helpers.ts","../services/yaml-workflow/pipeline/extract.ts","../services/yaml-workflow/pipeline/index.ts","../services/yaml-workflow/pipeline/prompt-templates.ts","../services/yaml-workflow/pipeline/prompts.ts","../services/yaml-workflow/pipeline/validate.ts","../services/yaml-workflow/pipeline/build/dag-assembly.ts","../services/yaml-workflow/pipeline/build/dag.ts","../services/yaml-workflow/pipeline/build/index.ts","../services/yaml-workflow/pipeline/build/iteration.ts","../services/yaml-workflow/pipeline/build/metadata.ts","../services/yaml-workflow/pipeline/build/transform.ts","../services/yaml-workflow/pipeline/build/utils.ts","../services/yaml-workflow/pipeline/build/wiring.ts","../services/yaml-workflow/pipeline/compile/index.ts","../services/yaml-workflow/pipeline/compile/llm-call.ts","../services/yaml-workflow/pipeline/compile/parse-plan.ts","../services/yaml-workflow/pipeline/compile/summarize.ts","../services/yaml-workflow/workers/callbacks.ts","../services/yaml-workflow/workers/events.ts","../services/yaml-workflow/workers/index.ts","../services/yaml-workflow/workers/register.ts","../services/yaml-workflow/workers/scope.ts","../shared/form-validation/derive-field-label.ts","../shared/form-validation/field-validator.ts","../shared/form-validation/index.ts","../shared/form-validation/validate-resolver-payload.ts","../shared/form-validation/x-lt-bind.ts","../shared/form-validation/x-lt-help.ts","../shared/form-validation/x-lt-labels.ts","../shared/form-validation/x-lt-query.ts","../shared/form-validation/x-lt-show-if.ts","../shared/form-validation/x-lt-submit-guard.ts","../shared/form-validation/x-lt-submit-on-claim.ts","../shared/form-validation/x-lt-transition.ts","../start/adapters.ts","../start/config.ts","../start/graph-workflows.ts","../start/index.ts","../start/server.ts","../start/socket-auth.ts","../start/workers.ts","../system/index.ts","../system/activities/claude-code.ts","../system/activities/file-storage.ts","../system/activities/http.ts","../system/activities/knowledge.ts","../system/activities/oauth.ts","../system/activities/schema-exchange.ts","../system/activities/sql.ts","../system/activities/triage/cache.ts","../system/activities/triage/context.ts","../system/activities/triage/discovery.ts","../system/activities/triage/index.ts","../system/activities/triage/llm.ts","../system/activities/triage/tools.ts","../system/mcp-servers/claude-code.ts","../system/mcp-servers/docs.ts","../system/mcp-servers/events.ts","../system/mcp-servers/file-storage.ts","../system/mcp-servers/http-fetch.ts","../system/mcp-servers/human-queue-schemas.ts","../system/mcp-servers/human-queue.ts","../system/mcp-servers/knowledge.ts","../system/mcp-servers/oauth.ts","../system/mcp-servers/schema-exchange.ts","../system/mcp-servers/translation.ts","../system/mcp-servers/vision-prompts.ts","../system/mcp-servers/vision.ts","../system/mcp-servers/workflow-compiler.ts","../system/mcp-servers/workflow.ts","../system/mcp-servers/admin/agent-subscriptions.ts","../system/mcp-servers/admin/agents.ts","../system/mcp-servers/admin/bot-accounts.ts","../system/mcp-servers/admin/controlplane.ts","../system/mcp-servers/admin/diagnostics.ts","../system/mcp-servers/admin/domain-context.ts","../system/mcp-servers/admin/escalations.ts","../system/mcp-servers/admin/exports.ts","../system/mcp-servers/admin/index.ts","../system/mcp-servers/admin/maintenance.ts","../system/mcp-servers/admin/mcp-servers.ts","../system/mcp-servers/admin/overview.ts","../system/mcp-servers/admin/personas.ts","../system/mcp-servers/admin/pipelines.ts","../system/mcp-servers/admin/scan-codes.ts","../system/mcp-servers/admin/schemas.ts","../system/mcp-servers/admin/settings.ts","../system/mcp-servers/admin/tasks.ts","../system/mcp-servers/admin/topics.ts","../system/mcp-servers/admin/users.ts","../system/mcp-servers/admin/workflow-config.ts","../system/mcp-servers/admin/workflows.ts","../system/mcp-servers/admin/yaml-workflows.ts","../system/mcp-servers/db-query/index.ts","../system/mcp-servers/db-query/schemas.ts","../system/mcp-servers/db-query/tools.ts","../system/seed/index.ts","../system/seed/tool-manifests-admin.ts","../system/seed/tool-manifests-data.ts","../system/seed/tool-manifests-escalation.ts","../system/seed/tool-manifests-events.ts","../system/seed/tool-manifests-knowledge.ts","../system/seed/tool-manifests-workflows.ts","../system/workflows/tool-result-guard.ts","../system/workflows/capability-invoke/activities.ts","../system/workflows/capability-invoke/index.ts","../system/workflows/mcp-deterministic/activities.ts","../system/workflows/mcp-deterministic/index.ts","../system/workflows/mcp-query/index.ts","../system/workflows/mcp-query/prompts.ts","../system/workflows/mcp-query/strategy-advisors.ts","../system/workflows/mcp-query/types.ts","../system/workflows/mcp-query/activities/caches.ts","../system/workflows/mcp-query/activities/discovery.ts","../system/workflows/mcp-query/activities/index.ts","../system/workflows/mcp-query/activities/llm.ts","../system/workflows/mcp-query/activities/tool-executor.ts","../system/workflows/mcp-query/activities/tool-loader.ts","../system/workflows/mcp-query-router/activities.ts","../system/workflows/mcp-query-router/index.ts","../system/workflows/mcp-query-router/prompts.ts","../system/workflows/mcp-triage/activities-proxy.ts","../system/workflows/mcp-triage/index.ts","../system/workflows/mcp-triage/prompts.ts","../system/workflows/mcp-triage/response-builders.ts","../system/workflows/mcp-triage/response.ts","../system/workflows/mcp-triage/types.ts","../system/workflows/mcp-triage-deterministic/activities.ts","../system/workflows/mcp-triage-deterministic/index.ts","../system/workflows/mcp-triage-router/activities.ts","../system/workflows/mcp-triage-router/index.ts","../system/workflows/mcp-workflow-builder/index.ts","../system/workflows/mcp-workflow-builder/prompts.ts","../system/workflows/mcp-workflow-builder/activities/caches.ts","../system/workflows/mcp-workflow-builder/activities/index.ts","../system/workflows/mcp-workflow-builder/activities/llm.ts","../system/workflows/mcp-workflow-builder/activities/tool-loader.ts","../system/workflows/mcp-workflow-planner/index.ts","../system/workflows/mcp-workflow-planner/prompts.ts","../system/workflows/mcp-workflow-planner/activities/analyze.ts","../system/workflows/mcp-workflow-planner/activities/index.ts","../system/workflows/mcp-workflow-planner/activities/persist.ts","../system/workflows/mcp-workflow-planner/activities/plan.ts","../system/workflows/shared/discovery.ts","../system/workflows/shared/index.ts","../system/workflows/shared/llm-caller.ts","../system/workflows/shared/prompts.ts","../system/workflows/shared/strategy-advisors.ts","../system/workflows/shared/tool-executor.ts","../system/workflows/shared/tool-loader.ts","../system/workflows/shared/types.ts","../themes/midnight.ts","../types/agent.ts","../types/analytics.ts","../types/auth.ts","../types/config.ts","../types/delegation.ts","../types/discovery.ts","../types/domain-manifest.ts","../types/envelope.ts","../types/escalation-strategy.ts","../types/escalation.ts","../types/events.ts","../types/export.ts","../types/express.d.ts","../types/facets.ts","../types/index.ts","../types/logger.ts","../types/maintenance.ts","../types/mcp.ts","../types/oauth.ts","../types/persona.ts","../types/scan-choice.ts","../types/scan-code.ts","../types/sdk.ts","../types/startup.ts","../types/task.ts","../types/telemetry.ts","../types/tool-context.ts","../types/user.ts","../types/validation.ts","../types/workflow-set.ts","../types/workflow.ts","../types/yaml-workflow.ts","../workers/index.ts"],"version":"5.9.3"}
+{"root":["../index.ts","../vitest.config.ts","../vitest.integration.config.ts","../adapters/express.ts","../api/agent-subscriptions.ts","../api/agents.ts","../api/auth-sso.ts","../api/auth.ts","../api/bot-accounts.ts","../api/capabilities.ts","../api/controlplane.ts","../api/dba.ts","../api/diagnostics.ts","../api/domain.ts","../api/exports.ts","../api/files.ts","../api/index.ts","../api/insight.ts","../api/knowledge.ts","../api/maintenance.ts","../api/me.ts","../api/namespaces.ts","../api/overview.ts","../api/personas.ts","../api/pipelines.ts","../api/roles.ts","../api/settings.ts","../api/tasks.ts","../api/topics.ts","../api/users.ts","../api/workflow-sets.ts","../api/escalations/analytics.ts","../api/escalations/bulk.ts","../api/escalations/cancel.ts","../api/escalations/claim.ts","../api/escalations/create.ts","../api/escalations/facets.ts","../api/escalations/helpers.ts","../api/escalations/index.ts","../api/escalations/list.ts","../api/escalations/metadata.ts","../api/escalations/resolve.ts","../api/escalations/single.ts","../api/mcp/index.ts","../api/mcp/servers.ts","../api/mcp/tools.ts","../api/scan-codes/choice.ts","../api/scan-codes/config.ts","../api/scan-codes/context.ts","../api/scan-codes/execute.ts","../api/scan-codes/identity.ts","../api/scan-codes/index.ts","../api/scan-codes/locate.ts","../api/scan-codes/present.ts","../api/scan-codes/verbs.ts","../api/workflows/config.ts","../api/workflows/discovery.ts","../api/workflows/index.ts","../api/workflows/invocation.ts","../api/yaml-workflows/cron.ts","../api/yaml-workflows/crud.ts","../api/yaml-workflows/deploy.ts","../api/yaml-workflows/helpers.ts","../api/yaml-workflows/index.ts","../api/yaml-workflows/versions.ts","../bin/ltc.ts","../lib/typed-resolution.ts","../lib/cli/auth.ts","../lib/cli/client.ts","../lib/cli/compile.ts","../lib/cli/format.ts","../lib/cli/init.ts","../lib/cli/output.ts","../lib/cli/scanner.ts","../lib/cli/types.ts","../lib/cli/commands/escalations.ts","../lib/cli/commands/knowledge.ts","../lib/cli/commands/mcp.ts","../lib/cli/commands/personas.ts","../lib/cli/commands/pipelines.ts","../lib/cli/commands/roles.ts","../lib/cli/commands/status.ts","../lib/cli/commands/streams.ts","../lib/cli/commands/users.ts","../lib/cli/commands/workflows.ts","../lib/db/index.ts","../lib/db/migrate.ts","../lib/events/callback.ts","../lib/events/escalation-wire.ts","../lib/events/index.ts","../lib/events/matching.ts","../lib/events/memory.ts","../lib/events/nats-ws-proxy.ts","../lib/events/nats.ts","../lib/events/publish.ts","../lib/events/socketio.ts","../lib/events/system-events.ts","../lib/json-path/pick.ts","../lib/logger/index.ts","../lib/logger/pino.ts","../lib/storage/index.ts","../lib/storage/local.ts","../lib/storage/mime.ts","../lib/storage/s3.ts","../lib/storage/types.ts","../lib/telemetry/honeycomb.ts","../lib/telemetry/index.ts","../modules/auth.ts","../modules/branding.ts","../modules/config.ts","../modules/defaults.ts","../modules/features.ts","../modules/ltconfig.ts","../modules/maintenance.ts","../modules/sso.ts","../modules/utils.ts","../modules/version.ts","../routes/agents.ts","../routes/auth-sso.ts","../routes/auth.ts","../routes/bot-accounts.ts","../routes/capabilities.ts","../routes/controlplane.ts","../routes/dba.ts","../routes/delegation.ts","../routes/diagnostics.ts","../routes/docs.ts","../routes/domain.ts","../routes/exports.ts","../routes/file-browser.ts","../routes/files.ts","../routes/index.ts","../routes/insight.ts","../routes/knowledge.ts","../routes/maintenance.ts","../routes/mcp-endpoint.ts","../routes/mcp.ts","../routes/me.ts","../routes/namespaces.ts","../routes/nats-credentials.ts","../routes/oauth.ts","../routes/overview.ts","../routes/personas.ts","../routes/pipelines.ts","../routes/roles.ts","../routes/scan-codes.ts","../routes/settings.ts","../routes/tasks.ts","../routes/topics.ts","../routes/users.ts","../routes/workflow-sets.ts","../routes/escalations/acting.ts","../routes/escalations/analytics.ts","../routes/escalations/bulk.ts","../routes/escalations/facets.ts","../routes/escalations/index.ts","../routes/escalations/list.ts","../routes/escalations/metadata.ts","../routes/escalations/resolve.ts","../routes/escalations/single.ts","../routes/workflows/config.ts","../routes/workflows/discovery.ts","../routes/workflows/index.ts","../routes/workflows/invocation.ts","../routes/yaml-workflows/cron.ts","../routes/yaml-workflows/crud.ts","../routes/yaml-workflows/deployment.ts","../routes/yaml-workflows/index.ts","../routes/yaml-workflows/versions.ts","../scripts/ortho-populate.ts","../scripts/printer-cycle.ts","../scripts/process-helpers.ts","../scripts/process.ts","../scripts/token.ts","../scripts/twin-farm.ts","../sdk/index.ts","../services/dba.ts","../services/hotmesh-utils.ts","../services/workflow-invocation.ts","../services/agent/index.ts","../services/agent/input-mapper.ts","../services/agent/sql.ts","../services/agent/subscription-sql.ts","../services/agent/subscriptions.ts","../services/agent/trigger-registry.ts","../services/auth/bot-api-key.ts","../services/auth/delegation.ts","../services/auth/index.ts","../services/auth/service-token.ts","../services/auth/sql.ts","../services/config/cache.ts","../services/config/index.ts","../services/config/provider.ts","../services/config/read.ts","../services/config/sql.ts","../services/config/write.ts","../services/controlplane/index.ts","../services/controlplane/quorum-bridge.ts","../services/controlplane/sql.ts","../services/controlplane/stream-messages-sql.ts","../services/controlplane/types.ts","../services/cron/index.ts","../services/diagnostics/index.ts","../services/diagnostics/patterns.ts","../services/domain/index.ts","../services/domain/read.ts","../services/domain/seed.ts","../services/domain/sql.ts","../services/domain/validate.ts","../services/domain/write.ts","../services/escalation/aggregate-sql.ts","../services/escalation/aggregate-validate.ts","../services/escalation/aggregates.ts","../services/escalation/bulk.ts","../services/escalation/client.ts","../services/escalation/crud.ts","../services/escalation/facet-sql.ts","../services/escalation/facets.ts","../services/escalation/index.ts","../services/escalation/map.ts","../services/escalation/metrics-cache.ts","../services/escalation/queries.ts","../services/escalation/resolver-validation.ts","../services/escalation/sql.ts","../services/escalation/submit-guard.ts","../services/escalation/types.ts","../services/escalation-strategy/default.ts","../services/escalation-strategy/index.ts","../services/escalation-strategy/mcp.ts","../services/export/client.ts","../services/export/index.ts","../services/export/post-process.ts","../services/export/types.ts","../services/iam/acting-identity.ts","../services/iam/activity.ts","../services/iam/bots.ts","../services/iam/context.ts","../services/iam/credentials.ts","../services/iam/envelope.ts","../services/iam/ephemeral.ts","../services/iam/index.ts","../services/iam/principal.ts","../services/iam/resolve.ts","../services/iam/sql.ts","../services/insight/index.ts","../services/insight/prompts.ts","../services/interceptor/activity-interceptor.ts","../services/interceptor/completion.ts","../services/interceptor/context.ts","../services/interceptor/escalation.ts","../services/interceptor/index.ts","../services/interceptor/lifecycle.ts","../services/interceptor/state.ts","../services/interceptor/types.ts","../services/interceptor/activities/config.ts","../services/interceptor/activities/escalation.ts","../services/interceptor/activities/index.ts","../services/interceptor/activities/task.ts","../services/interceptor/activities/workflow.ts","../services/llm/detect.ts","../services/llm/index.ts","../services/llm/translate.ts","../services/llm/types.ts","../services/llm/providers/anthropic.ts","../services/llm/providers/openai.ts","../services/maintenance/index.ts","../services/mcp/adapter.ts","../services/mcp/db.ts","../services/mcp/exposure.ts","../services/mcp/external-server.ts","../services/mcp/index.ts","../services/mcp/register-tool.ts","../services/mcp/seed-service-account.ts","../services/mcp/server-lifecycle.ts","../services/mcp/server-tools.ts","../services/mcp/server.ts","../services/mcp/sql.ts","../services/mcp/types.ts","../services/mcp/workflow-compiler-server.ts","../services/mcp/workflow-server.ts","../services/mcp/client/connection-dispatch.ts","../services/mcp/client/connection-lifecycle.ts","../services/mcp/client/connection-test.ts","../services/mcp/client/connection.ts","../services/mcp/client/index.ts","../services/mcp/client/tools.ts","../services/mcp/db-server/index.ts","../services/mcp/db-server/schemas.ts","../services/mcp/db-server/tools.ts","../services/mcp/playwright-server/index.ts","../services/mcp/playwright-server/lifecycle.ts","../services/mcp/playwright-server/schemas.ts","../services/mcp/playwright-server/tools.ts","../services/namespace/index.ts","../services/namespace/sql.ts","../services/namespace/types.ts","../services/oauth/crypto.ts","../services/oauth/db.ts","../services/oauth/index.ts","../services/oauth/sql.ts","../services/oauth/state.ts","../services/oauth/providers/anthropic.ts","../services/oauth/providers/github.ts","../services/oauth/providers/google.ts","../services/oauth/providers/index.ts","../services/oauth/providers/microsoft.ts","../services/oauth/providers/mock.ts","../services/oauth/providers/registry.ts","../services/oauth/providers/types.ts","../services/orchestrator/condition.ts","../services/orchestrator/index.ts","../services/orchestrator/types.ts","../services/overview/index.ts","../services/overview/sql.ts","../services/persona/index.ts","../services/persona/sql.ts","../services/persona/types.ts","../services/pipelines/enrichment.ts","../services/pipelines/events.ts","../services/pipelines/execution-builder.ts","../services/pipelines/index.ts","../services/pipelines/queries.ts","../services/pipelines/sql.ts","../services/pipelines/types.ts","../services/role/enforcement-cache.ts","../services/role/index.ts","../services/role/schema-validator.ts","../services/role/seed.ts","../services/role/sql.ts","../services/role/types.ts","../services/scan-code/index.ts","../services/scan-code/parse.ts","../services/scan-code/read.ts","../services/scan-code/sql.ts","../services/scan-code/validate.ts","../services/scan-code/write.ts","../services/task/crud.ts","../services/task/index.ts","../services/task/process.ts","../services/task/resolve.ts","../services/task/sql.ts","../services/task/types.ts","../services/topics/index.ts","../services/topics/sql.ts","../services/topics/system-topics.ts","../services/user/auth.ts","../services/user/crud.ts","../services/user/index.ts","../services/user/preferences.ts","../services/user/rbac.ts","../services/user/roles.ts","../services/user/scope.ts","../services/user/seed-admin.ts","../services/user/sql.ts","../services/user/sso-provision.ts","../services/user/types.ts","../services/workers/registry.ts","../services/workflow-sets/db.ts","../services/workflow-sets/index.ts","../services/workflow-sets/sql.ts","../services/yaml-workflow/builder-regenerate.ts","../services/yaml-workflow/db-utils.ts","../services/yaml-workflow/db-versions.ts","../services/yaml-workflow/db.ts","../services/yaml-workflow/deployer-helpers.ts","../services/yaml-workflow/deployer.ts","../services/yaml-workflow/generator.ts","../services/yaml-workflow/index.ts","../services/yaml-workflow/input-analyzer-helpers.ts","../services/yaml-workflow/input-analyzer.ts","../services/yaml-workflow/invoke.ts","../services/yaml-workflow/pipe-validator.ts","../services/yaml-workflow/sql.ts","../services/yaml-workflow/types.ts","../services/yaml-workflow/durable-compiler/index.ts","../services/yaml-workflow/durable-compiler/parser.ts","../services/yaml-workflow/durable-compiler/prompts.ts","../services/yaml-workflow/durable-compiler/types.ts","../services/yaml-workflow/pattern-detector/array-source.ts","../services/yaml-workflow/pattern-detector/collapse.ts","../services/yaml-workflow/pattern-detector/index.ts","../services/yaml-workflow/pattern-detector/run-detection.ts","../services/yaml-workflow/pattern-detector/types.ts","../services/yaml-workflow/pipeline/analyze.ts","../services/yaml-workflow/pipeline/extract-helpers.ts","../services/yaml-workflow/pipeline/extract.ts","../services/yaml-workflow/pipeline/index.ts","../services/yaml-workflow/pipeline/prompt-templates.ts","../services/yaml-workflow/pipeline/prompts.ts","../services/yaml-workflow/pipeline/validate.ts","../services/yaml-workflow/pipeline/build/dag-assembly.ts","../services/yaml-workflow/pipeline/build/dag.ts","../services/yaml-workflow/pipeline/build/index.ts","../services/yaml-workflow/pipeline/build/iteration.ts","../services/yaml-workflow/pipeline/build/metadata.ts","../services/yaml-workflow/pipeline/build/transform.ts","../services/yaml-workflow/pipeline/build/utils.ts","../services/yaml-workflow/pipeline/build/wiring.ts","../services/yaml-workflow/pipeline/compile/index.ts","../services/yaml-workflow/pipeline/compile/llm-call.ts","../services/yaml-workflow/pipeline/compile/parse-plan.ts","../services/yaml-workflow/pipeline/compile/summarize.ts","../services/yaml-workflow/workers/callbacks.ts","../services/yaml-workflow/workers/events.ts","../services/yaml-workflow/workers/index.ts","../services/yaml-workflow/workers/register.ts","../services/yaml-workflow/workers/scope.ts","../shared/form-validation/derive-field-label.ts","../shared/form-validation/field-validator.ts","../shared/form-validation/index.ts","../shared/form-validation/validate-resolver-payload.ts","../shared/form-validation/x-lt-bind.ts","../shared/form-validation/x-lt-help.ts","../shared/form-validation/x-lt-labels.ts","../shared/form-validation/x-lt-query.ts","../shared/form-validation/x-lt-show-if.ts","../shared/form-validation/x-lt-submit-guard.ts","../shared/form-validation/x-lt-submit-on-claim.ts","../shared/form-validation/x-lt-transition.ts","../start/adapters.ts","../start/apply-report.ts","../start/config.ts","../start/graph-workflows.ts","../start/index.ts","../start/server.ts","../start/socket-auth.ts","../start/workers.ts","../system/index.ts","../system/activities/claude-code.ts","../system/activities/file-storage.ts","../system/activities/http.ts","../system/activities/knowledge.ts","../system/activities/oauth.ts","../system/activities/schema-exchange.ts","../system/activities/sql.ts","../system/activities/triage/cache.ts","../system/activities/triage/context.ts","../system/activities/triage/discovery.ts","../system/activities/triage/index.ts","../system/activities/triage/llm.ts","../system/activities/triage/tools.ts","../system/mcp-servers/claude-code.ts","../system/mcp-servers/docs.ts","../system/mcp-servers/events.ts","../system/mcp-servers/file-storage.ts","../system/mcp-servers/http-fetch.ts","../system/mcp-servers/human-queue-schemas.ts","../system/mcp-servers/human-queue.ts","../system/mcp-servers/knowledge.ts","../system/mcp-servers/oauth.ts","../system/mcp-servers/schema-exchange.ts","../system/mcp-servers/translation.ts","../system/mcp-servers/vision-prompts.ts","../system/mcp-servers/vision.ts","../system/mcp-servers/workflow-compiler.ts","../system/mcp-servers/workflow.ts","../system/mcp-servers/admin/agent-subscriptions.ts","../system/mcp-servers/admin/agents.ts","../system/mcp-servers/admin/bot-accounts.ts","../system/mcp-servers/admin/controlplane.ts","../system/mcp-servers/admin/diagnostics.ts","../system/mcp-servers/admin/domain-context.ts","../system/mcp-servers/admin/escalations.ts","../system/mcp-servers/admin/exports.ts","../system/mcp-servers/admin/index.ts","../system/mcp-servers/admin/maintenance.ts","../system/mcp-servers/admin/mcp-servers.ts","../system/mcp-servers/admin/overview.ts","../system/mcp-servers/admin/personas.ts","../system/mcp-servers/admin/pipelines.ts","../system/mcp-servers/admin/scan-codes.ts","../system/mcp-servers/admin/schemas.ts","../system/mcp-servers/admin/settings.ts","../system/mcp-servers/admin/tasks.ts","../system/mcp-servers/admin/topics.ts","../system/mcp-servers/admin/users.ts","../system/mcp-servers/admin/workflow-config.ts","../system/mcp-servers/admin/workflows.ts","../system/mcp-servers/admin/yaml-workflows.ts","../system/mcp-servers/db-query/index.ts","../system/mcp-servers/db-query/schemas.ts","../system/mcp-servers/db-query/tools.ts","../system/seed/index.ts","../system/seed/tool-manifests-admin.ts","../system/seed/tool-manifests-data.ts","../system/seed/tool-manifests-escalation.ts","../system/seed/tool-manifests-events.ts","../system/seed/tool-manifests-knowledge.ts","../system/seed/tool-manifests-workflows.ts","../system/workflows/tool-result-guard.ts","../system/workflows/capability-invoke/activities.ts","../system/workflows/capability-invoke/index.ts","../system/workflows/mcp-deterministic/activities.ts","../system/workflows/mcp-deterministic/index.ts","../system/workflows/mcp-query/index.ts","../system/workflows/mcp-query/prompts.ts","../system/workflows/mcp-query/strategy-advisors.ts","../system/workflows/mcp-query/types.ts","../system/workflows/mcp-query/activities/caches.ts","../system/workflows/mcp-query/activities/discovery.ts","../system/workflows/mcp-query/activities/index.ts","../system/workflows/mcp-query/activities/llm.ts","../system/workflows/mcp-query/activities/tool-executor.ts","../system/workflows/mcp-query/activities/tool-loader.ts","../system/workflows/mcp-query-router/activities.ts","../system/workflows/mcp-query-router/index.ts","../system/workflows/mcp-query-router/prompts.ts","../system/workflows/mcp-triage/activities-proxy.ts","../system/workflows/mcp-triage/index.ts","../system/workflows/mcp-triage/prompts.ts","../system/workflows/mcp-triage/response-builders.ts","../system/workflows/mcp-triage/response.ts","../system/workflows/mcp-triage/types.ts","../system/workflows/mcp-triage-deterministic/activities.ts","../system/workflows/mcp-triage-deterministic/index.ts","../system/workflows/mcp-triage-router/activities.ts","../system/workflows/mcp-triage-router/index.ts","../system/workflows/mcp-workflow-builder/index.ts","../system/workflows/mcp-workflow-builder/prompts.ts","../system/workflows/mcp-workflow-builder/activities/caches.ts","../system/workflows/mcp-workflow-builder/activities/index.ts","../system/workflows/mcp-workflow-builder/activities/llm.ts","../system/workflows/mcp-workflow-builder/activities/tool-loader.ts","../system/workflows/mcp-workflow-planner/index.ts","../system/workflows/mcp-workflow-planner/prompts.ts","../system/workflows/mcp-workflow-planner/activities/analyze.ts","../system/workflows/mcp-workflow-planner/activities/index.ts","../system/workflows/mcp-workflow-planner/activities/persist.ts","../system/workflows/mcp-workflow-planner/activities/plan.ts","../system/workflows/shared/discovery.ts","../system/workflows/shared/index.ts","../system/workflows/shared/llm-caller.ts","../system/workflows/shared/prompts.ts","../system/workflows/shared/strategy-advisors.ts","../system/workflows/shared/tool-executor.ts","../system/workflows/shared/tool-loader.ts","../system/workflows/shared/types.ts","../themes/midnight.ts","../types/agent.ts","../types/analytics.ts","../types/auth.ts","../types/config.ts","../types/delegation.ts","../types/discovery.ts","../types/domain-manifest.ts","../types/envelope.ts","../types/escalation-strategy.ts","../types/escalation.ts","../types/events.ts","../types/export.ts","../types/express.d.ts","../types/facets.ts","../types/index.ts","../types/logger.ts","../types/maintenance.ts","../types/mcp.ts","../types/oauth.ts","../types/persona.ts","../types/scan-choice.ts","../types/scan-code.ts","../types/sdk.ts","../types/startup.ts","../types/task.ts","../types/telemetry.ts","../types/tool-context.ts","../types/user.ts","../types/validation.ts","../types/workflow-set.ts","../types/workflow.ts","../types/yaml-workflow.ts","../workers/index.ts"],"version":"5.9.3"}

package/build/types/auth.d.ts

@@ -95,11 +95,37 @@ export interface LTSSOConfig {
     resolve: (req: Request) => Promise<SSOIdentity | null> | (SSOIdentity | null);
     /** Map host role names to LT role names.
      *  Key = host role, value = LT role name.
-     *  Unmapped roles are ignored. If omitted, host roles pass through as-is. */
+     *  A configured map is the COMPLETE contract: an unmapped host role means
+     *  "no LT role" — a user whose host roles all miss the map provisions with
+     *  zero SSO-granted memberships (seeded/persona grants still apply). If
+     *  omitted, host roles pass through as-is and a user with no host roles
+     *  receives the default membership.
+     *
+     *  SSO synchronizes identity, never authorization: a role the user already
+     *  holds is left exactly as the admin set it (type, read/write scope,
+     *  persona provenance). Promotions and scope changes go through the admin
+     *  surfaces (`POST /api/users/:id/roles`, the admin MCP tools). */
     roleMap?: Record<string, string>;
     /** Default LT role type for provisioned users. Default: `'member'`. */
     defaultRoleType?: 'admin' | 'member';
     /** URL to redirect the browser on logout (host's logout endpoint).
      *  If omitted, the dashboard shows its own login page on logout. */
     logoutUrl?: string;
+    /**
+     * Session keepalive: while the dashboard is open and visible, the SPA
+     * re-runs the credentialed SSO exchange (`POST /api/auth/sso`, host cookies
+     * included) every `keepaliveSeconds`, keeping a short-lived sliding host
+     * session warm exactly the way host-app navigation does. Each beat re-runs
+     * `resolve`, so a host that revokes access cuts the dashboard off at the
+     * next beat. 0/omitted = no keepalive. Values under 15s are clamped to 15s.
+     */
+    keepaliveSeconds?: number;
+    /**
+     * Pause the keepalive after this much user inactivity (no pointer, key, or
+     * wheel input), so an abandoned-but-visible tab still expires on the host's
+     * schedule. Omitted = no activity gate: any visible tab keeps its session
+     * (the right default for station screens that go minutes between touches —
+     * badge-wedge scans count as key input).
+     */
+    keepaliveIdleTimeoutSeconds?: number;
 }

package/build/types/index.d.ts

@@ -17,7 +17,7 @@ export type { LTLoggerAdapter, } from './logger';
 export type { LTMaintenanceRule, LTMaintenanceConfig, } from './maintenance';
 export type { LTExportField, LTExportOptions, LTTimelineEntry, LTTransitionEntry, LTWorkflowExport, } from './export';
 export type { WorkflowExecution, WorkflowExecutionEvent, WorkflowExecutionStatus, WorkflowExecutionSummary, WorkflowEventType, WorkflowEventCategory, WorkflowEventAttributes, ExecutionExportOptions, ExportMode, ActivityDetail, JobExport, } from './export';
-export type { LTStartConfig, LTInstance, LTWorkerConfig, LTMcpServerConfig, LTAgentConfig, LTTopicConfig, } from './startup';
+export type { LTStartConfig, LTInstance, LTWorkerConfig, LTMcpServerConfig, LTAgentConfig, LTTopicConfig, LTRoleConfig, } from './startup';
 export type { LTMcpTransportType, LTMcpServerRecord, LTMcpServerStatus, LTMcpToolManifest, LTMcpAdapter, } from './mcp';
 export type { ResolutionContext, ResolutionDirective, LTEscalationStrategy, } from './escalation-strategy';
 export type { WorkflowCandidate, } from './discovery';