@hotmeshio/long-tail 0.18.1 → 0.19.0

package/build/services/escalation/queries.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.searchEscalationsFaceted = searchEscalationsFaceted;
 exports.getEscalationWithFormSchema = getEscalationWithFormSchema;
 exports.listFacetKeys = listFacetKeys;
+exports.listFacetValues = listFacetValues;
 exports.getEscalationStats = getEscalationStats;
 exports.listDistinctTypes = listDistinctTypes;
 exports.listEscalations = listEscalations;
@@ -42,13 +43,13 @@ function buildSearchOrderBy(sortBy, order) {
     }
     return 'priority ASC, created_at ASC';
 }
-const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const uuid_1 = require("../../lib/uuid");
 /**
  * The id arm of the correlation search binds a uuid param only when the term
  * parses as one — comparing `id::text = $term` casts the uuid column and has
  * no index path, which drags the whole OR into a full history scan.
  */
-const asUuidOrNull = (term) => term && UUID_RE.test(term) ? term : null;
+const asUuidOrNull = (term) => term && uuid_1.UUID_RE.test(term) ? term : null;
 /**
  * Server-side free-text search over the `lt_escalations` view. Runs when a
  * caller supplies a non-empty `search` term — the SDK `client.list()` cannot do
@@ -155,6 +156,9 @@ async function searchEscalationsFaceted(opts) {
  * cast is guarded, so a non-numeric pin simply falls through to the latest form.
  */
 async function getEscalationWithFormSchema(id) {
+    // A non-UUID is definitionally not-found — it must never reach the uuid cast.
+    if (!(0, uuid_1.isUuid)(id))
+        return null;
     await (0, client_1.ensureEscalationCompatView)();
     const pool = (0, db_1.getPool)();
     const { rows } = await pool.query(`SELECT e.*, COALESCE(ps.form_schema, r.form_schema) AS resolved_form_schema
@@ -216,6 +220,39 @@ async function listFacetKeys(opts) {
     }
     return [...actualKeys].sort();
 }
+// Mirrors the server-side facet key rule — metadata keys become a JSON path,
+// so a lookup key is strictly validated before it reaches SQL.
+const FACET_KEY_RE = /^[a-zA-Z0-9_]+$/;
+/**
+ * Distinct VALUES for one metadata facet key, visible to the caller — feeds
+ * the value picker (e.g. facility → [north, south]) so a bound scope offers
+ * real choices. Role-scoped with the same predicate as {@link listFacetKeys};
+ * the key is parameterized (never interpolated) and charset-validated, so a
+ * malformed key returns [] rather than reaching an unguarded path.
+ */
+async function listFacetValues(key, opts) {
+    if (!FACET_KEY_RE.test(key))
+        return [];
+    await (0, client_1.ensureEscalationCompatView)();
+    const pool = (0, db_1.getPool)();
+    const params = [key];
+    const clauses = ["jsonb_typeof(metadata) = 'object'", 'metadata ? $1'];
+    if (!opts.global) {
+        const ai = params.push(opts.visibleRoles?.length ? opts.visibleRoles : null);
+        const si = params.push(opts.selfRoles?.length ? opts.selfRoles : null);
+        const mi = params.push(opts.meUserId || null);
+        clauses.push(`(($${ai}::text[] IS NULL AND $${si}::text[] IS NULL)
+        OR ($${ai}::text[] IS NOT NULL AND role = ANY($${ai}))
+        OR ($${si}::text[] IS NOT NULL AND role = ANY($${si}) AND assigned_to = $${mi}))`);
+    }
+    const { rows } = await pool.query(`SELECT DISTINCT metadata->>$1 AS value
+       FROM public.lt_escalations
+      WHERE ${clauses.join('\n        AND ')}
+        AND metadata->>$1 IS NOT NULL
+      ORDER BY value
+      LIMIT 200`, params);
+    return rows.map((r) => r.value);
+}
 // Escalation stats back the home + overview surfaces and refresh on every
 // escalation event. As of hotmesh 0.25.0 the SDK stats query reads three
 // bounded, index-only sources (pending backlog, created window, resolved
@@ -388,7 +425,7 @@ function resetStationMetricsCache() {
     invalidateEscalationAggregates();
 }
 const toNum = (v) => (v != null ? Number(v) : null);
-async function getStationMetrics(visibleRoles, period) {
+async function getStationMetrics(visibleRoles, period, facets) {
     await (0, client_1.ensureEscalationCompatView)();
     // hasOwnProperty: a caller-supplied period like 'constructor' must fall back
     // to 24h, not resolve to an inherited Object.prototype member.
@@ -396,13 +433,18 @@ async function getStationMetrics(visibleRoles, period) {
         ? types_1.VALID_PERIODS[period]
         : '24 hours';
     const roles = visibleRoles ?? null;
+    // Facet scope rides both queries as a GIN-served `metadata @>` arm; null = no
+    // filter. It never widens role scope — it only narrows within it.
+    const facetJson = facets && Object.keys(facets).length ? JSON.stringify(facets) : null;
     const pool = (0, db_1.getPool)();
     // Live counts: always fresh (cheap — bounded pending working set).
-    // Period metrics: cached ~30s, single-flight (expensive percentile sort).
-    const cacheKey = `${period ?? '24h'}::${roles ? [...roles].sort().join(',') : 'ALL'}`;
+    // Period metrics: cached ~30s, single-flight (expensive percentile sort). The
+    // facet scope is part of the cache key — a scoped board never reads unscoped
+    // rows, and vice versa.
+    const cacheKey = `${period ?? '24h'}::${roles ? [...roles].sort().join(',') : 'ALL'}::${facetJson ?? ''}`;
     const [countsResult, periodRows] = await Promise.all([
-        pool.query(sql_1.STATION_LIVE_COUNTS_SQL, [roles]),
-        stationPeriodCache.resolve(cacheKey, async () => (await pool.query(sql_1.STATION_PERIOD_METRICS_SQL, [roles, intervalStr])).rows),
+        pool.query(sql_1.STATION_LIVE_COUNTS_SQL, [roles, facetJson]),
+        stationPeriodCache.resolve(cacheKey, async () => (await pool.query(sql_1.STATION_PERIOD_METRICS_SQL, [roles, intervalStr, facetJson])).rows),
     ]);
     const periodByRole = new Map(periodRows.map((r) => [r.role, r]));
     return countsResult.rows.map((c) => {

package/build/services/escalation/sql.d.ts

@@ -80,6 +80,7 @@ export declare const RESOLVE_BY_METADATA_ATOMIC = "WITH target AS MATERIALIZED (
  * Live counts — pending, active claims, and priority (past-threshold) per role.
  *
  * $1 TEXT[] — role filter (NULL = all roles / superadmin).
+ * $2 JSONB  — metadata facet scope (NULL = no filter; `metadata @>`, GIN-served).
  *
  * Hits idx_hmsh_esc_pending_role_created (role, created_at DESC) WHERE
  * status='pending'. The pending working set is bounded by real backlog depth,
@@ -102,13 +103,14 @@ export declare const RESOLVE_BY_METADATA_ATOMIC = "WITH target AS MATERIALIZED (
  * with a facet configured, items missing the key or holding an unparseable
  * value do not count (NULL age never passes the comparison).
  */
-export declare const STATION_LIVE_COUNTS_SQL = "\nWITH role_targets AS (\n  SELECT role, sla_minutes, priority_threshold_minutes, priority_facet\n  FROM lt_roles\n  WHERE ($1::text[] IS NULL OR role = ANY($1::text[]))\n),\nlive_counts AS (\n  SELECT\n    e.role,\n    COUNT(*)                                                                         AS pending,\n    COUNT(*) FILTER (WHERE e.assigned_to IS NOT NULL AND e.assigned_until > NOW())  AS claimed,\n    COUNT(*) FILTER (\n      WHERE COALESCE(rt.priority_threshold_minutes, rt.sla_minutes) IS NOT NULL\n        AND (e.assigned_to IS NULL OR e.assigned_until IS NULL OR e.assigned_until <= NOW())\n        AND CASE\n          WHEN rt.priority_facet IS NULL THEN e.created_at\n          WHEN pg_input_is_valid(e.metadata->>rt.priority_facet, 'timestamptz')\n            THEN (e.metadata->>rt.priority_facet)::timestamptz\n          ELSE NULL\n        END < NOW() - (COALESCE(rt.priority_threshold_minutes, rt.sla_minutes) * INTERVAL '1 minute')\n    )                                                                                AS priority_count\n  FROM hmsh_escalations e\n  JOIN role_targets rt ON rt.role = e.role\n  WHERE e.status = 'pending'\n  GROUP BY e.role\n)\nSELECT\n  rt.role,\n  COALESCE(lc.pending,        0) AS pending,\n  COALESCE(lc.claimed,        0) AS claimed,\n  COALESCE(lc.priority_count, 0) AS priority_count\nFROM role_targets rt\nLEFT JOIN live_counts lc ON lc.role = rt.role\nORDER BY rt.role\n";
+export declare const STATION_LIVE_COUNTS_SQL = "\nWITH role_targets AS (\n  SELECT role, sla_minutes, priority_threshold_minutes, priority_facet\n  FROM lt_roles\n  WHERE ($1::text[] IS NULL OR role = ANY($1::text[]))\n),\nlive_counts AS (\n  SELECT\n    e.role,\n    COUNT(*)                                                                         AS pending,\n    COUNT(*) FILTER (WHERE e.assigned_to IS NOT NULL AND e.assigned_until > NOW())  AS claimed,\n    COUNT(*) FILTER (\n      WHERE COALESCE(rt.priority_threshold_minutes, rt.sla_minutes) IS NOT NULL\n        AND (e.assigned_to IS NULL OR e.assigned_until IS NULL OR e.assigned_until <= NOW())\n        AND CASE\n          WHEN rt.priority_facet IS NULL THEN e.created_at\n          WHEN pg_input_is_valid(e.metadata->>rt.priority_facet, 'timestamptz')\n            THEN (e.metadata->>rt.priority_facet)::timestamptz\n          ELSE NULL\n        END < NOW() - (COALESCE(rt.priority_threshold_minutes, rt.sla_minutes) * INTERVAL '1 minute')\n    )                                                                                AS priority_count\n  FROM hmsh_escalations e\n  JOIN role_targets rt ON rt.role = e.role\n  WHERE e.status = 'pending'\n    AND ($2::jsonb IS NULL OR e.metadata @> $2::jsonb)\n  GROUP BY e.role\n)\nSELECT\n  rt.role,\n  COALESCE(lc.pending,        0) AS pending,\n  COALESCE(lc.claimed,        0) AS claimed,\n  COALESCE(lc.priority_count, 0) AS priority_count\nFROM role_targets rt\nLEFT JOIN live_counts lc ON lc.role = rt.role\nORDER BY rt.role\n";
 /**
  * Period metrics — resolved count, throughput efficiency, and P99/P50/avg/max
  * latency for wait (queue time) and work (processing) per role.
  *
  * $1 TEXT[]   — role filter (NULL = all roles / superadmin).
  * $2 INTERVAL — time window (e.g. '24 hours', '15 minutes').
+ * $3 JSONB    — metadata facet scope (NULL = no filter; `metadata @>`, GIN-served).
  *
  * Hits idx_hmsh_esc_resolved_cover (role, resolved_at DESC, claimed_at,
  * created_at) WHERE status='resolved' — a covering index, so the percentile
@@ -119,4 +121,4 @@ export declare const STATION_LIVE_COUNTS_SQL = "\nWITH role_targets AS (\n  SELE
  * mix of resolved + in-flight — a clean "how did completed work perform?" read.
  * throughput_pct is NULL when the role has no target_per_hour (NULLIF guard).
  */
-export declare const STATION_PERIOD_METRICS_SQL = "\nWITH role_targets AS (\n  SELECT role, target_per_hour\n  FROM lt_roles\n  WHERE ($1::text[] IS NULL OR role = ANY($1::text[]))\n),\nperiod_metrics AS (\n  SELECT\n    e.role,\n    COUNT(*)                                                                         AS resolved,\n    ROUND((PERCENTILE_CONT(0.99) WITHIN GROUP (\n      ORDER BY EXTRACT(EPOCH FROM (e.claimed_at - e.created_at)) / 60)\n      FILTER (WHERE e.claimed_at IS NOT NULL))::numeric, 3)                        AS p99_wait_min,\n    ROUND((PERCENTILE_CONT(0.50) WITHIN GROUP (\n      ORDER BY EXTRACT(EPOCH FROM (e.claimed_at - e.created_at)) / 60)\n      FILTER (WHERE e.claimed_at IS NOT NULL))::numeric, 3)                        AS p50_wait_min,\n    ROUND((AVG(EXTRACT(EPOCH FROM (e.claimed_at - e.created_at)) / 60)\n      FILTER (WHERE e.claimed_at IS NOT NULL))::numeric, 3)                        AS avg_wait_min,\n    ROUND((MAX(EXTRACT(EPOCH FROM (e.claimed_at - e.created_at)) / 60)\n      FILTER (WHERE e.claimed_at IS NOT NULL))::numeric, 3)                        AS max_wait_min,\n    ROUND((PERCENTILE_CONT(0.99) WITHIN GROUP (\n      ORDER BY EXTRACT(EPOCH FROM (e.resolved_at - e.claimed_at)) / 60)\n      FILTER (WHERE e.claimed_at IS NOT NULL))::numeric, 3)                        AS p99_work_min,\n    ROUND((PERCENTILE_CONT(0.50) WITHIN GROUP (\n      ORDER BY EXTRACT(EPOCH FROM (e.resolved_at - e.claimed_at)) / 60)\n      FILTER (WHERE e.claimed_at IS NOT NULL))::numeric, 3)                        AS p50_work_min,\n    ROUND((AVG(EXTRACT(EPOCH FROM (e.resolved_at - e.claimed_at)) / 60)\n      FILTER (WHERE e.claimed_at IS NOT NULL))::numeric, 3)                        AS avg_work_min,\n    ROUND((MAX(EXTRACT(EPOCH FROM (e.resolved_at - e.claimed_at)) / 60)\n      FILTER (WHERE e.claimed_at IS NOT NULL))::numeric, 3)                        AS max_work_min\n  FROM hmsh_escalations e\n  WHERE e.status = 'resolved'\n    AND e.resolved_at >= NOW() - $2::interval\n    AND ($1::text[] IS NULL OR e.role = ANY($1::text[]))\n  GROUP BY e.role\n)\nSELECT\n  rt.role,\n  COALESCE(pm.resolved, 0) AS resolved,\n  ROUND(\n    (COALESCE(pm.resolved, 0)::numeric\n      / NULLIF(rt.target_per_hour::numeric * EXTRACT(EPOCH FROM $2::interval) / 3600.0, 0)\n      * 100\n    )::numeric, 1\n  )                        AS throughput_pct,\n  pm.p99_wait_min,\n  pm.p50_wait_min,\n  pm.avg_wait_min,\n  pm.max_wait_min,\n  pm.p99_work_min,\n  pm.p50_work_min,\n  pm.avg_work_min,\n  pm.max_work_min\nFROM role_targets rt\nLEFT JOIN period_metrics pm ON pm.role = rt.role\nORDER BY rt.role\n";
+export declare const STATION_PERIOD_METRICS_SQL = "\nWITH role_targets AS (\n  SELECT role, target_per_hour\n  FROM lt_roles\n  WHERE ($1::text[] IS NULL OR role = ANY($1::text[]))\n),\nperiod_metrics AS (\n  SELECT\n    e.role,\n    COUNT(*)                                                                         AS resolved,\n    ROUND((PERCENTILE_CONT(0.99) WITHIN GROUP (\n      ORDER BY EXTRACT(EPOCH FROM (e.claimed_at - e.created_at)) / 60)\n      FILTER (WHERE e.claimed_at IS NOT NULL))::numeric, 3)                        AS p99_wait_min,\n    ROUND((PERCENTILE_CONT(0.50) WITHIN GROUP (\n      ORDER BY EXTRACT(EPOCH FROM (e.claimed_at - e.created_at)) / 60)\n      FILTER (WHERE e.claimed_at IS NOT NULL))::numeric, 3)                        AS p50_wait_min,\n    ROUND((AVG(EXTRACT(EPOCH FROM (e.claimed_at - e.created_at)) / 60)\n      FILTER (WHERE e.claimed_at IS NOT NULL))::numeric, 3)                        AS avg_wait_min,\n    ROUND((MAX(EXTRACT(EPOCH FROM (e.claimed_at - e.created_at)) / 60)\n      FILTER (WHERE e.claimed_at IS NOT NULL))::numeric, 3)                        AS max_wait_min,\n    ROUND((PERCENTILE_CONT(0.99) WITHIN GROUP (\n      ORDER BY EXTRACT(EPOCH FROM (e.resolved_at - e.claimed_at)) / 60)\n      FILTER (WHERE e.claimed_at IS NOT NULL))::numeric, 3)                        AS p99_work_min,\n    ROUND((PERCENTILE_CONT(0.50) WITHIN GROUP (\n      ORDER BY EXTRACT(EPOCH FROM (e.resolved_at - e.claimed_at)) / 60)\n      FILTER (WHERE e.claimed_at IS NOT NULL))::numeric, 3)                        AS p50_work_min,\n    ROUND((AVG(EXTRACT(EPOCH FROM (e.resolved_at - e.claimed_at)) / 60)\n      FILTER (WHERE e.claimed_at IS NOT NULL))::numeric, 3)                        AS avg_work_min,\n    ROUND((MAX(EXTRACT(EPOCH FROM (e.resolved_at - e.claimed_at)) / 60)\n      FILTER (WHERE e.claimed_at IS NOT NULL))::numeric, 3)                        AS max_work_min\n  FROM hmsh_escalations e\n  WHERE e.status = 'resolved'\n    AND e.resolved_at >= NOW() - $2::interval\n    AND ($1::text[] IS NULL OR e.role = ANY($1::text[]))\n    AND ($3::jsonb IS NULL OR e.metadata @> $3::jsonb)\n  GROUP BY e.role\n)\nSELECT\n  rt.role,\n  COALESCE(pm.resolved, 0) AS resolved,\n  ROUND(\n    (COALESCE(pm.resolved, 0)::numeric\n      / NULLIF(rt.target_per_hour::numeric * EXTRACT(EPOCH FROM $2::interval) / 3600.0, 0)\n      * 100\n    )::numeric, 1\n  )                        AS throughput_pct,\n  pm.p99_wait_min,\n  pm.p50_wait_min,\n  pm.avg_wait_min,\n  pm.max_wait_min,\n  pm.p99_work_min,\n  pm.p50_work_min,\n  pm.avg_work_min,\n  pm.max_work_min\nFROM role_targets rt\nLEFT JOIN period_metrics pm ON pm.role = rt.role\nORDER BY rt.role\n";

package/build/services/escalation/sql.js

@@ -270,6 +270,7 @@ LEFT JOIN written ON written.id = target.id`;
  * Live counts — pending, active claims, and priority (past-threshold) per role.
  *
  * $1 TEXT[] — role filter (NULL = all roles / superadmin).
+ * $2 JSONB  — metadata facet scope (NULL = no filter; `metadata @>`, GIN-served).
  *
  * Hits idx_hmsh_esc_pending_role_created (role, created_at DESC) WHERE
  * status='pending'. The pending working set is bounded by real backlog depth,
@@ -316,6 +317,7 @@ live_counts AS (
   FROM hmsh_escalations e
   JOIN role_targets rt ON rt.role = e.role
   WHERE e.status = 'pending'
+    AND ($2::jsonb IS NULL OR e.metadata @> $2::jsonb)
   GROUP BY e.role
 )
 SELECT
@@ -333,6 +335,7 @@ ORDER BY rt.role
  *
  * $1 TEXT[]   — role filter (NULL = all roles / superadmin).
  * $2 INTERVAL — time window (e.g. '24 hours', '15 minutes').
+ * $3 JSONB    — metadata facet scope (NULL = no filter; `metadata @>`, GIN-served).
  *
  * Hits idx_hmsh_esc_resolved_cover (role, resolved_at DESC, claimed_at,
  * created_at) WHERE status='resolved' — a covering index, so the percentile
@@ -377,6 +380,7 @@ period_metrics AS (
   WHERE e.status = 'resolved'
     AND e.resolved_at >= NOW() - $2::interval
     AND ($1::text[] IS NULL OR e.role = ANY($1::text[]))
+    AND ($3::jsonb IS NULL OR e.metadata @> $3::jsonb)
   GROUP BY e.role
 )
 SELECT

package/build/services/role/types.d.ts

@@ -17,7 +17,7 @@ export interface EscalationChain {
  *    the detail page, and the scan screens. Multi-role users get full chrome.
  *  - LINK_VARIABLES: RoleLinkVariable[] — metadata facet names members bind
  *    per device. Pins may reference `{lt:name}` as a whole facet value
- *    (e.g. `facets={"facility":"{lt:facility}"}`); the dashboard substitutes
+ *    (e.g. `facets={"region":"{lt:region}"}`); the dashboard substitutes
  *    the device's bound value at render time, falls back to the declared
  *    default, and drops the facet entirely when both are unset.
  */

package/build/services/role/types.js

@@ -16,7 +16,7 @@ exports.ROLE_PROPERTY_KEYS = void 0;
  *    the detail page, and the scan screens. Multi-role users get full chrome.
  *  - LINK_VARIABLES: RoleLinkVariable[] — metadata facet names members bind
  *    per device. Pins may reference `{lt:name}` as a whole facet value
- *    (e.g. `facets={"facility":"{lt:facility}"}`); the dashboard substitutes
+ *    (e.g. `facets={"region":"{lt:region}"}`); the dashboard substitutes
  *    the device's bound value at render time, falls back to the declared
  *    default, and drops the facet entirely when both are unset.
  */

package/build/services/user/auth.js

@@ -16,11 +16,11 @@ const sql_1 = require("./sql");
  */
 async function verifyPassword(externalId, password) {
     const pool = (0, db_1.getPool)();
-    const { rows } = await pool.query(sql_1.GET_USER_BY_EXTERNAL_ID, [externalId]);
+    const { rows } = await pool.query(sql_1.GET_USER_FOR_AUTH, [externalId]);
     if (!rows[0] || !rows[0].password_hash)
         return null;
     const valid = await bcryptjs_1.default.compare(password, rows[0].password_hash);
     if (!valid)
         return null;
-    return (0, crud_1.attachRoles)(rows[0]);
+    return (0, crud_1.getUser)(rows[0].id);
 }

package/build/services/user/crud.d.ts

@@ -3,6 +3,19 @@ import type { CreateUserInput, UpdateUserInput, UserPropertyOps } from './types'
 export declare function attachRoles(user: any): Promise<LTUserRecord>;
 export declare function createUser(input: CreateUserInput): Promise<LTUserRecord>;
 export declare function getUser(id: string): Promise<LTUserRecord | null>;
+export interface UserNameRecord {
+    id: string;
+    display_name: string | null;
+    external_id: string;
+    email: string | null;
+}
+/**
+ * Resolve many user ids to display fields in one query. Non-UUID input is
+ * dropped before the SQL (a bad id is not-found, never a 500), ids are deduped,
+ * and the batch is capped. Returns display fields only — never secrets, scopes,
+ * or metadata.
+ */
+export declare function getUserNames(ids: string[]): Promise<UserNameRecord[]>;
 export declare function getUserByExternalId(externalId: string): Promise<LTUserRecord | null>;
 export declare function getUserByEmail(email: string): Promise<LTUserRecord | null>;
 /**

package/build/services/user/crud.js

@@ -7,6 +7,7 @@ exports.UserPropertyValidationError = exports.UserPropertyConflictError = void 0
 exports.attachRoles = attachRoles;
 exports.createUser = createUser;
 exports.getUser = getUser;
+exports.getUserNames = getUserNames;
 exports.getUserByExternalId = getUserByExternalId;
 exports.getUserByEmail = getUserByEmail;
 exports.getUserByMetadataValue = getUserByMetadataValue;
@@ -18,14 +19,21 @@ exports.listUsers = listUsers;
 const bcryptjs_1 = __importDefault(require("bcryptjs"));
 const db_1 = require("../../lib/db");
 const sql_1 = require("./sql");
+const uuid_1 = require("../../lib/uuid");
 const scan_code_1 = require("../scan-code");
 const scan_code_2 = require("../../types/scan-code");
 const scope_1 = require("./scope");
 // ─── Private helpers (exported for internal use by auth.ts) ──────────────────
+/** Last-line guard: strip credentials before any user record leaves the service, so a stray SELECT * can never leak them. */
+function stripUserSecrets(user) {
+    delete user.password_hash;
+    delete user.oauth_provider_id;
+    return user;
+}
 async function attachRoles(user) {
     const pool = (0, db_1.getPool)();
     const { rows } = await pool.query(sql_1.GET_ROLES_BY_USER_ID, [user.id]);
-    return { ...user, roles: rows };
+    return stripUserSecrets({ ...user, roles: rows });
 }
 async function attachRolesToMany(users) {
     if (users.length === 0)
@@ -45,7 +53,7 @@ async function attachRolesToMany(users) {
         });
         roleMap.set(row.user_id, list);
     }
-    return users.map((u) => ({ ...u, roles: roleMap.get(u.id) || [] }));
+    return users.map((u) => stripUserSecrets({ ...u, roles: roleMap.get(u.id) || [] }));
 }
 // ─── CRUD ─────────────────────────────────────────────────────────────────────
 async function createUser(input) {
@@ -85,6 +93,21 @@ async function getUser(id) {
         return null;
     return attachRoles(rows[0]);
 }
+const MAX_NAME_LOOKUP = 200;
+/**
+ * Resolve many user ids to display fields in one query. Non-UUID input is
+ * dropped before the SQL (a bad id is not-found, never a 500), ids are deduped,
+ * and the batch is capped. Returns display fields only — never secrets, scopes,
+ * or metadata.
+ */
+async function getUserNames(ids) {
+    const clean = [...new Set((0, uuid_1.onlyUuids)(ids))].slice(0, MAX_NAME_LOOKUP);
+    if (clean.length === 0)
+        return [];
+    const pool = (0, db_1.getPool)();
+    const { rows } = await pool.query(sql_1.GET_NAMES_BY_IDS, [clean]);
+    return rows;
+}
 async function getUserByExternalId(externalId) {
     const pool = (0, db_1.getPool)();
     const { rows } = await pool.query(sql_1.GET_USER_BY_EXTERNAL_ID, [externalId]);
@@ -288,7 +311,7 @@ async function listUsers(filters) {
     const offset = filters.offset || 0;
     const [countResult, dataResult] = await Promise.all([
         pool.query(`SELECT COUNT(DISTINCT u.id) FROM lt_users u ${join} ${where}`, values),
-        pool.query(`SELECT DISTINCT u.* FROM lt_users u ${join} ${where} ORDER BY u.created_at DESC LIMIT $${idx++} OFFSET $${idx++}`, [...values, limit, offset]),
+        pool.query(`SELECT DISTINCT ${sql_1.USER_SAFE_COLUMNS_U} FROM lt_users u ${join} ${where} ORDER BY u.created_at DESC LIMIT $${idx++} OFFSET $${idx++}`, [...values, limit, offset]),
     ]);
     return {
         users: await attachRolesToMany(dataResult.rows),

package/build/services/user/index.d.ts

@@ -1,5 +1,5 @@
 export { CreateUserInput, UpdateUserInput, UserPropertyOps, VALID_ROLE_TYPES } from './types';
-export { createUser, getUser, getUserByExternalId, getUserByEmail, getUserByMetadataValue, updateUser, patchUserProperties, getIdentityPropertyKeys, UserPropertyConflictError, UserPropertyValidationError, deleteUser, listUsers, } from './crud';
+export { createUser, getUser, getUserNames, UserNameRecord, getUserByExternalId, getUserByEmail, getUserByMetadataValue, updateUser, patchUserProperties, getIdentityPropertyKeys, UserPropertyConflictError, UserPropertyValidationError, deleteUser, listUsers, } from './crud';
 export { isValidRoleType, addUserRole, grantRoleIfAbsent, removeUserRole, getUserRoles, hasRole, hasRoleType, } from './roles';
 export { isSuperAdmin, isGroupAdmin, canManageRole, hasGlobalEscalationAccess, hasRolesAsAdmin, getRoleScope, getRoleWriteScope } from './rbac';
 export { READ_SCOPES, WRITE_SCOPES, DEFAULT_READ_SCOPE, DEFAULT_WRITE_SCOPE, isValidReadScope, isValidWriteScope, isValidScopePair, effectiveScope, } from './scope';

package/build/services/user/index.js

@@ -1,11 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PREFERENCES_MAX_BYTES = exports.patchPreferences = exports.getPreferences = exports.seedAdmin = exports.verifyPassword = exports.effectiveScope = exports.isValidScopePair = exports.isValidWriteScope = exports.isValidReadScope = exports.DEFAULT_WRITE_SCOPE = exports.DEFAULT_READ_SCOPE = exports.WRITE_SCOPES = exports.READ_SCOPES = exports.getRoleWriteScope = exports.getRoleScope = exports.hasRolesAsAdmin = exports.hasGlobalEscalationAccess = exports.canManageRole = exports.isGroupAdmin = exports.isSuperAdmin = exports.hasRoleType = exports.hasRole = exports.getUserRoles = exports.removeUserRole = exports.grantRoleIfAbsent = exports.addUserRole = exports.isValidRoleType = exports.listUsers = exports.deleteUser = exports.UserPropertyValidationError = exports.UserPropertyConflictError = exports.getIdentityPropertyKeys = exports.patchUserProperties = exports.updateUser = exports.getUserByMetadataValue = exports.getUserByEmail = exports.getUserByExternalId = exports.getUser = exports.createUser = exports.VALID_ROLE_TYPES = void 0;
+exports.PREFERENCES_MAX_BYTES = exports.patchPreferences = exports.getPreferences = exports.seedAdmin = exports.verifyPassword = exports.effectiveScope = exports.isValidScopePair = exports.isValidWriteScope = exports.isValidReadScope = exports.DEFAULT_WRITE_SCOPE = exports.DEFAULT_READ_SCOPE = exports.WRITE_SCOPES = exports.READ_SCOPES = exports.getRoleWriteScope = exports.getRoleScope = exports.hasRolesAsAdmin = exports.hasGlobalEscalationAccess = exports.canManageRole = exports.isGroupAdmin = exports.isSuperAdmin = exports.hasRoleType = exports.hasRole = exports.getUserRoles = exports.removeUserRole = exports.grantRoleIfAbsent = exports.addUserRole = exports.isValidRoleType = exports.listUsers = exports.deleteUser = exports.UserPropertyValidationError = exports.UserPropertyConflictError = exports.getIdentityPropertyKeys = exports.patchUserProperties = exports.updateUser = exports.getUserByMetadataValue = exports.getUserByEmail = exports.getUserByExternalId = exports.getUserNames = exports.getUser = exports.createUser = exports.VALID_ROLE_TYPES = void 0;
 var types_1 = require("./types");
 Object.defineProperty(exports, "VALID_ROLE_TYPES", { enumerable: true, get: function () { return types_1.VALID_ROLE_TYPES; } });
 var crud_1 = require("./crud");
 Object.defineProperty(exports, "createUser", { enumerable: true, get: function () { return crud_1.createUser; } });
 Object.defineProperty(exports, "getUser", { enumerable: true, get: function () { return crud_1.getUser; } });
+Object.defineProperty(exports, "getUserNames", { enumerable: true, get: function () { return crud_1.getUserNames; } });
 Object.defineProperty(exports, "getUserByExternalId", { enumerable: true, get: function () { return crud_1.getUserByExternalId; } });
 Object.defineProperty(exports, "getUserByEmail", { enumerable: true, get: function () { return crud_1.getUserByEmail; } });
 Object.defineProperty(exports, "getUserByMetadataValue", { enumerable: true, get: function () { return crud_1.getUserByMetadataValue; } });

package/build/services/user/sql.d.ts

@@ -1,10 +1,14 @@
+export declare const USER_SAFE_COLUMNS: string;
+export declare const USER_SAFE_COLUMNS_U: string;
 /** Ensure a role name exists in the lt_roles lookup table (FK target). */
 export declare const ENSURE_ROLE_EXISTS = "INSERT INTO lt_roles (role) VALUES ($1) ON CONFLICT DO NOTHING";
 /** Fetch roles for a single user, ordered by creation time. granted_by_persona
  *  is the sustaining persona's key (null = direct grant). */
 export declare const GET_ROLES_BY_USER_ID = "SELECT r.role, r.type, r.read_scope, r.write_scope, r.created_at, p.key AS granted_by_persona\n   FROM lt_user_roles r\n   LEFT JOIN lt_personas p ON p.id = r.granted_by_persona\n   WHERE r.user_id = $1 ORDER BY r.created_at";
 /** Fetch a user row by external_id. */
-export declare const GET_USER_BY_EXTERNAL_ID = "SELECT * FROM lt_users WHERE external_id = $1";
+export declare const GET_USER_BY_EXTERNAL_ID: string;
+/** Password-check only: the one query that reads the hash, never returned to a client. */
+export declare const GET_USER_FOR_AUTH = "SELECT id, password_hash FROM lt_users WHERE external_id = $1";
 /**
  * Create a user and its role assignments in ONE atomic statement. The user row,
  * the lt_roles FK targets ($9 = role names), and the lt_user_roles links
@@ -15,9 +19,11 @@ export declare const GET_USER_BY_EXTERNAL_ID = "SELECT * FROM lt_users WHERE ext
  * end, after the sibling role-ensure CTE has run, so brand-new roles are valid
  * FK targets.
  */
-export declare const CREATE_USER_WITH_ROLES = "WITH new_user AS (\n     INSERT INTO lt_users (external_id, email, display_name, status, metadata, password_hash, oauth_provider, oauth_provider_id)\n     VALUES ($1, $2, $3, $4, $5, $6, $7, $8)\n     RETURNING *\n   ), ensured_roles AS (\n     INSERT INTO lt_roles (role)\n     SELECT DISTINCT unnest($9::text[])\n     ON CONFLICT DO NOTHING\n   ), assigned_roles AS (\n     INSERT INTO lt_user_roles (user_id, role, type, read_scope, write_scope)\n     SELECT (SELECT id FROM new_user), x.role, x.type, x.read_scope, x.write_scope\n     FROM unnest($9::text[], $10::text[], $11::text[], $12::text[]) AS x(role, type, read_scope, write_scope)\n     ON CONFLICT DO NOTHING\n   )\n   SELECT * FROM new_user";
-export declare const GET_USER_BY_EMAIL = "SELECT * FROM lt_users WHERE email = $1 LIMIT 1";
-export declare const GET_USER_BY_ID = "SELECT * FROM lt_users WHERE id = $1";
+export declare const CREATE_USER_WITH_ROLES: string;
+export declare const GET_USER_BY_EMAIL: string;
+export declare const GET_USER_BY_ID: string;
+/** Thin identity projection for batch name resolution — display fields only, never secrets, scopes, or metadata. */
+export declare const GET_NAMES_BY_IDS = "SELECT id, display_name, external_id, email FROM lt_users WHERE id = ANY($1)";
 /**
  * Lookup by a caller-named metadata key (e.g. a badge binding). LIMIT 2 so an
  * ambiguous binding — two users carrying the same value — is detectable and
@@ -25,7 +31,7 @@ export declare const GET_USER_BY_ID = "SELECT * FROM lt_users WHERE id = $1";
  * is the people table (small); revisit with a GIN index on metadata if a
  * deployment ever holds tens of thousands of users.
  */
-export declare const GET_USERS_BY_METADATA_VALUE = "SELECT * FROM lt_users WHERE metadata->>$1 = $2 AND status = 'active' LIMIT 2";
+export declare const GET_USERS_BY_METADATA_VALUE: string;
 /** Check if a user exists by id. Lightweight — returns only the id column. */
 export declare const VERIFY_USER_BY_ID = "SELECT id FROM lt_users WHERE id = $1 LIMIT 1";
 /**

package/build/services/user/sql.js

@@ -1,7 +1,15 @@
 "use strict";
 // ─── Shared queries (used by multiple modules) ──────────────────────────────
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.IS_GROUP_ADMIN = exports.GET_ROLE_SCOPE = exports.HAS_ROLE_TYPE = exports.HAS_ROLE = exports.DELETE_USER_ROLE = exports.INSERT_USER_ROLE_IF_ABSENT = exports.UPSERT_USER_ROLE = exports.GET_ROLES_BY_USER_IDS = exports.DELETE_USER_BY_ID = exports.GET_USER_WITH_ROLES = exports.PATCH_USER_PROPERTIES = exports.VERIFY_USER_BY_ID = exports.GET_USERS_BY_METADATA_VALUE = exports.GET_USER_BY_ID = exports.GET_USER_BY_EMAIL = exports.CREATE_USER_WITH_ROLES = exports.GET_USER_BY_EXTERNAL_ID = exports.GET_ROLES_BY_USER_ID = exports.ENSURE_ROLE_EXISTS = void 0;
+exports.IS_GROUP_ADMIN = exports.GET_ROLE_SCOPE = exports.HAS_ROLE_TYPE = exports.HAS_ROLE = exports.DELETE_USER_ROLE = exports.INSERT_USER_ROLE_IF_ABSENT = exports.UPSERT_USER_ROLE = exports.GET_ROLES_BY_USER_IDS = exports.DELETE_USER_BY_ID = exports.GET_USER_WITH_ROLES = exports.PATCH_USER_PROPERTIES = exports.VERIFY_USER_BY_ID = exports.GET_USERS_BY_METADATA_VALUE = exports.GET_NAMES_BY_IDS = exports.GET_USER_BY_ID = exports.GET_USER_BY_EMAIL = exports.CREATE_USER_WITH_ROLES = exports.GET_USER_FOR_AUTH = exports.GET_USER_BY_EXTERNAL_ID = exports.GET_ROLES_BY_USER_ID = exports.ENSURE_ROLE_EXISTS = exports.USER_SAFE_COLUMNS_U = exports.USER_SAFE_COLUMNS = void 0;
+/**
+ * Every lt_users column a client may see. password_hash and oauth_provider_id
+ * are credentials and never appear here — no user read path selects them (the
+ * password check has its own GET_USER_FOR_AUTH). `U` prefixes for a joined list.
+ */
+const USER_COLS = ['id', 'external_id', 'email', 'display_name', 'status', 'account_type', 'oauth_provider', 'metadata', 'created_at', 'updated_at', 'preferences'];
+exports.USER_SAFE_COLUMNS = USER_COLS.join(', ');
+exports.USER_SAFE_COLUMNS_U = USER_COLS.map((c) => `u.${c}`).join(', ');
 /** Ensure a role name exists in the lt_roles lookup table (FK target). */
 exports.ENSURE_ROLE_EXISTS = 'INSERT INTO lt_roles (role) VALUES ($1) ON CONFLICT DO NOTHING';
 /** Fetch roles for a single user, ordered by creation time. granted_by_persona
@@ -11,7 +19,9 @@ exports.GET_ROLES_BY_USER_ID = `SELECT r.role, r.type, r.read_scope, r.write_sco
    LEFT JOIN lt_personas p ON p.id = r.granted_by_persona
    WHERE r.user_id = $1 ORDER BY r.created_at`;
 /** Fetch a user row by external_id. */
-exports.GET_USER_BY_EXTERNAL_ID = 'SELECT * FROM lt_users WHERE external_id = $1';
+exports.GET_USER_BY_EXTERNAL_ID = `SELECT ${exports.USER_SAFE_COLUMNS} FROM lt_users WHERE external_id = $1`;
+/** Password-check only: the one query that reads the hash, never returned to a client. */
+exports.GET_USER_FOR_AUTH = 'SELECT id, password_hash FROM lt_users WHERE external_id = $1';
 // ─── User CRUD ───────────────────────────────────────────────────────────────
 /**
  * Create a user and its role assignments in ONE atomic statement. The user row,
@@ -37,9 +47,11 @@ exports.CREATE_USER_WITH_ROLES = `WITH new_user AS (
      FROM unnest($9::text[], $10::text[], $11::text[], $12::text[]) AS x(role, type, read_scope, write_scope)
      ON CONFLICT DO NOTHING
    )
-   SELECT * FROM new_user`;
-exports.GET_USER_BY_EMAIL = `SELECT * FROM lt_users WHERE email = $1 LIMIT 1`;
-exports.GET_USER_BY_ID = 'SELECT * FROM lt_users WHERE id = $1';
+   SELECT ${exports.USER_SAFE_COLUMNS} FROM new_user`;
+exports.GET_USER_BY_EMAIL = `SELECT ${exports.USER_SAFE_COLUMNS} FROM lt_users WHERE email = $1 LIMIT 1`;
+exports.GET_USER_BY_ID = `SELECT ${exports.USER_SAFE_COLUMNS} FROM lt_users WHERE id = $1`;
+/** Thin identity projection for batch name resolution — display fields only, never secrets, scopes, or metadata. */
+exports.GET_NAMES_BY_IDS = 'SELECT id, display_name, external_id, email FROM lt_users WHERE id = ANY($1)';
 /**
  * Lookup by a caller-named metadata key (e.g. a badge binding). LIMIT 2 so an
  * ambiguous binding — two users carrying the same value — is detectable and
@@ -47,7 +59,7 @@ exports.GET_USER_BY_ID = 'SELECT * FROM lt_users WHERE id = $1';
  * is the people table (small); revisit with a GIN index on metadata if a
  * deployment ever holds tens of thousands of users.
  */
-exports.GET_USERS_BY_METADATA_VALUE = `SELECT * FROM lt_users WHERE metadata->>$1 = $2 AND status = 'active' LIMIT 2`;
+exports.GET_USERS_BY_METADATA_VALUE = `SELECT ${exports.USER_SAFE_COLUMNS} FROM lt_users WHERE metadata->>$1 = $2 AND status = 'active' LIMIT 2`;
 /** Check if a user exists by id. Lightweight — returns only the id column. */
 exports.VERIFY_USER_BY_ID = 'SELECT id FROM lt_users WHERE id = $1 LIMIT 1';
 /**

package/build/tsconfig.tsbuildinfo

@@ -1 +1 @@
-{"root":["../index.ts","../vitest.config.ts","../vitest.integration.config.ts","../adapters/express.ts","../api/agent-subscriptions.ts","../api/agents.ts","../api/announcements.ts","../api/auth-sso.ts","../api/auth.ts","../api/bot-accounts.ts","../api/capabilities.ts","../api/controlplane.ts","../api/dba.ts","../api/diagnostics.ts","../api/domain.ts","../api/exports.ts","../api/files.ts","../api/index.ts","../api/insight.ts","../api/knowledge.ts","../api/maintenance.ts","../api/me.ts","../api/namespaces.ts","../api/overview.ts","../api/personas.ts","../api/pipelines.ts","../api/roles.ts","../api/settings.ts","../api/tasks.ts","../api/topics.ts","../api/users.ts","../api/workflow-sets.ts","../api/escalations/analytics.ts","../api/escalations/bulk.ts","../api/escalations/cancel.ts","../api/escalations/claim.ts","../api/escalations/create.ts","../api/escalations/facets.ts","../api/escalations/helpers.ts","../api/escalations/index.ts","../api/escalations/list.ts","../api/escalations/lookups.ts","../api/escalations/metadata.ts","../api/escalations/resolve-batch.ts","../api/escalations/resolve.ts","../api/escalations/single.ts","../api/mcp/index.ts","../api/mcp/servers.ts","../api/mcp/tools.ts","../api/scan-codes/choice.ts","../api/scan-codes/config.ts","../api/scan-codes/context.ts","../api/scan-codes/execute.ts","../api/scan-codes/identity.ts","../api/scan-codes/index.ts","../api/scan-codes/locate.ts","../api/scan-codes/present.ts","../api/scan-codes/verbs.ts","../api/workflows/config.ts","../api/workflows/discovery.ts","../api/workflows/index.ts","../api/workflows/invocation.ts","../api/yaml-workflows/cron.ts","../api/yaml-workflows/crud.ts","../api/yaml-workflows/deploy.ts","../api/yaml-workflows/helpers.ts","../api/yaml-workflows/index.ts","../api/yaml-workflows/versions.ts","../bin/ltc.ts","../lib/typed-resolution.ts","../lib/cli/auth.ts","../lib/cli/client.ts","../lib/cli/compile.ts","../lib/cli/format.ts","../lib/cli/init.ts","../lib/cli/output.ts","../lib/cli/scanner.ts","../lib/cli/types.ts","../lib/cli/commands/escalations.ts","../lib/cli/commands/knowledge.ts","../lib/cli/commands/mcp.ts","../lib/cli/commands/personas.ts","../lib/cli/commands/pipelines.ts","../lib/cli/commands/roles.ts","../lib/cli/commands/status.ts","../lib/cli/commands/streams.ts","../lib/cli/commands/users.ts","../lib/cli/commands/workflows.ts","../lib/db/index.ts","../lib/db/migrate.ts","../lib/events/callback.ts","../lib/events/escalation-wire.ts","../lib/events/index.ts","../lib/events/matching.ts","../lib/events/memory.ts","../lib/events/nats-ws-proxy.ts","../lib/events/nats.ts","../lib/events/publish.ts","../lib/events/socketio.ts","../lib/events/system-events.ts","../lib/json-path/pick.ts","../lib/logger/index.ts","../lib/logger/pino.ts","../lib/storage/index.ts","../lib/storage/local.ts","../lib/storage/mime.ts","../lib/storage/s3.ts","../lib/storage/types.ts","../lib/telemetry/honeycomb.ts","../lib/telemetry/index.ts","../modules/auth.ts","../modules/branding.ts","../modules/config.ts","../modules/defaults.ts","../modules/features.ts","../modules/ltconfig.ts","../modules/maintenance.ts","../modules/search.ts","../modules/sso.ts","../modules/utils.ts","../modules/version.ts","../routes/agents.ts","../routes/announcements.ts","../routes/auth-sso.ts","../routes/auth.ts","../routes/bot-accounts.ts","../routes/capabilities.ts","../routes/controlplane.ts","../routes/dba.ts","../routes/delegation.ts","../routes/diagnostics.ts","../routes/docs.ts","../routes/domain.ts","../routes/exports.ts","../routes/file-browser.ts","../routes/files.ts","../routes/index.ts","../routes/insight.ts","../routes/knowledge.ts","../routes/maintenance.ts","../routes/mcp-endpoint.ts","../routes/mcp.ts","../routes/me.ts","../routes/namespaces.ts","../routes/nats-credentials.ts","../routes/oauth.ts","../routes/overview.ts","../routes/personas.ts","../routes/pipelines.ts","../routes/roles.ts","../routes/scan-codes.ts","../routes/settings.ts","../routes/tasks.ts","../routes/topics.ts","../routes/users.ts","../routes/workflow-sets.ts","../routes/escalations/acting.ts","../routes/escalations/analytics.ts","../routes/escalations/bulk.ts","../routes/escalations/facets.ts","../routes/escalations/index.ts","../routes/escalations/list.ts","../routes/escalations/metadata.ts","../routes/escalations/resolve.ts","../routes/escalations/single.ts","../routes/workflows/config.ts","../routes/workflows/discovery.ts","../routes/workflows/index.ts","../routes/workflows/invocation.ts","../routes/yaml-workflows/cron.ts","../routes/yaml-workflows/crud.ts","../routes/yaml-workflows/deployment.ts","../routes/yaml-workflows/index.ts","../routes/yaml-workflows/versions.ts","../scripts/ortho-populate.ts","../scripts/printer-cycle.ts","../scripts/process-helpers.ts","../scripts/process.ts","../scripts/token.ts","../scripts/twin-farm.ts","../sdk/index.ts","../services/dba.ts","../services/hotmesh-utils.ts","../services/workflow-invocation.ts","../services/agent/index.ts","../services/agent/input-mapper.ts","../services/agent/sql.ts","../services/agent/subscription-sql.ts","../services/agent/subscriptions.ts","../services/agent/trigger-registry.ts","../services/announcement/index.ts","../services/announcement/sql.ts","../services/auth/bot-api-key.ts","../services/auth/delegation.ts","../services/auth/index.ts","../services/auth/service-token.ts","../services/auth/sql.ts","../services/config/cache.ts","../services/config/index.ts","../services/config/provider.ts","../services/config/read.ts","../services/config/sql.ts","../services/config/write.ts","../services/controlplane/index.ts","../services/controlplane/quorum-bridge.ts","../services/controlplane/sql.ts","../services/controlplane/stream-messages-sql.ts","../services/controlplane/types.ts","../services/cron/index.ts","../services/diagnostics/index.ts","../services/diagnostics/patterns.ts","../services/domain/index.ts","../services/domain/read.ts","../services/domain/seed.ts","../services/domain/sql.ts","../services/domain/validate.ts","../services/domain/write.ts","../services/escalation/aggregate-sql.ts","../services/escalation/aggregate-validate.ts","../services/escalation/aggregates.ts","../services/escalation/batch.ts","../services/escalation/bulk.ts","../services/escalation/client.ts","../services/escalation/crud.ts","../services/escalation/facet-sql.ts","../services/escalation/facets.ts","../services/escalation/index.ts","../services/escalation/map.ts","../services/escalation/metrics-cache.ts","../services/escalation/queries.ts","../services/escalation/resolver-validation.ts","../services/escalation/sql.ts","../services/escalation/submit-guard.ts","../services/escalation/types.ts","../services/escalation-strategy/default.ts","../services/escalation-strategy/index.ts","../services/escalation-strategy/mcp.ts","../services/export/client.ts","../services/export/index.ts","../services/export/post-process.ts","../services/export/types.ts","../services/iam/acting-identity.ts","../services/iam/activity.ts","../services/iam/bots.ts","../services/iam/context.ts","../services/iam/credentials.ts","../services/iam/envelope.ts","../services/iam/ephemeral.ts","../services/iam/index.ts","../services/iam/principal.ts","../services/iam/resolve.ts","../services/iam/sql.ts","../services/insight/index.ts","../services/insight/prompts.ts","../services/interceptor/activity-interceptor.ts","../services/interceptor/completion.ts","../services/interceptor/context.ts","../services/interceptor/escalation.ts","../services/interceptor/index.ts","../services/interceptor/lifecycle.ts","../services/interceptor/state.ts","../services/interceptor/types.ts","../services/interceptor/activities/config.ts","../services/interceptor/activities/escalation.ts","../services/interceptor/activities/index.ts","../services/interceptor/activities/task.ts","../services/interceptor/activities/workflow.ts","../services/knowledge/index.ts","../services/knowledge/lookup-cache.ts","../services/knowledge/sql.ts","../services/llm/detect.ts","../services/llm/index.ts","../services/llm/translate.ts","../services/llm/types.ts","../services/llm/providers/anthropic.ts","../services/llm/providers/openai.ts","../services/maintenance/index.ts","../services/mcp/adapter.ts","../services/mcp/db.ts","../services/mcp/exposure.ts","../services/mcp/external-server.ts","../services/mcp/index.ts","../services/mcp/register-tool.ts","../services/mcp/seed-service-account.ts","../services/mcp/server-lifecycle.ts","../services/mcp/server-tools.ts","../services/mcp/server.ts","../services/mcp/sql.ts","../services/mcp/types.ts","../services/mcp/workflow-compiler-server.ts","../services/mcp/workflow-server.ts","../services/mcp/client/connection-dispatch.ts","../services/mcp/client/connection-lifecycle.ts","../services/mcp/client/connection-test.ts","../services/mcp/client/connection.ts","../services/mcp/client/index.ts","../services/mcp/client/tools.ts","../services/mcp/db-server/index.ts","../services/mcp/db-server/schemas.ts","../services/mcp/db-server/tools.ts","../services/mcp/playwright-server/index.ts","../services/mcp/playwright-server/lifecycle.ts","../services/mcp/playwright-server/schemas.ts","../services/mcp/playwright-server/tools.ts","../services/namespace/index.ts","../services/namespace/sql.ts","../services/namespace/types.ts","../services/oauth/crypto.ts","../services/oauth/db.ts","../services/oauth/index.ts","../services/oauth/sql.ts","../services/oauth/state.ts","../services/oauth/providers/anthropic.ts","../services/oauth/providers/github.ts","../services/oauth/providers/google.ts","../services/oauth/providers/index.ts","../services/oauth/providers/microsoft.ts","../services/oauth/providers/mock.ts","../services/oauth/providers/registry.ts","../services/oauth/providers/types.ts","../services/orchestrator/condition.ts","../services/orchestrator/index.ts","../services/orchestrator/types.ts","../services/overview/index.ts","../services/overview/sql.ts","../services/persona/index.ts","../services/persona/sql.ts","../services/persona/types.ts","../services/pipelines/enrichment.ts","../services/pipelines/events.ts","../services/pipelines/execution-builder.ts","../services/pipelines/index.ts","../services/pipelines/queries.ts","../services/pipelines/sql.ts","../services/pipelines/types.ts","../services/role/enforcement-cache.ts","../services/role/index.ts","../services/role/schema-validator.ts","../services/role/seed.ts","../services/role/sql.ts","../services/role/types.ts","../services/scan-code/index.ts","../services/scan-code/parse.ts","../services/scan-code/read.ts","../services/scan-code/sql.ts","../services/scan-code/validate.ts","../services/scan-code/write.ts","../services/task/crud.ts","../services/task/index.ts","../services/task/process.ts","../services/task/resolve.ts","../services/task/sql.ts","../services/task/types.ts","../services/topics/index.ts","../services/topics/sql.ts","../services/topics/system-topics.ts","../services/user/auth.ts","../services/user/crud.ts","../services/user/index.ts","../services/user/preferences.ts","../services/user/rbac.ts","../services/user/roles.ts","../services/user/scope.ts","../services/user/seed-admin.ts","../services/user/sql.ts","../services/user/sso-provision.ts","../services/user/types.ts","../services/workers/registry.ts","../services/workflow-sets/db.ts","../services/workflow-sets/index.ts","../services/workflow-sets/sql.ts","../services/yaml-workflow/builder-regenerate.ts","../services/yaml-workflow/db-utils.ts","../services/yaml-workflow/db-versions.ts","../services/yaml-workflow/db.ts","../services/yaml-workflow/deployer-helpers.ts","../services/yaml-workflow/deployer.ts","../services/yaml-workflow/generator.ts","../services/yaml-workflow/index.ts","../services/yaml-workflow/input-analyzer-helpers.ts","../services/yaml-workflow/input-analyzer.ts","../services/yaml-workflow/invoke.ts","../services/yaml-workflow/pipe-validator.ts","../services/yaml-workflow/sql.ts","../services/yaml-workflow/types.ts","../services/yaml-workflow/durable-compiler/index.ts","../services/yaml-workflow/durable-compiler/parser.ts","../services/yaml-workflow/durable-compiler/prompts.ts","../services/yaml-workflow/durable-compiler/types.ts","../services/yaml-workflow/pattern-detector/array-source.ts","../services/yaml-workflow/pattern-detector/collapse.ts","../services/yaml-workflow/pattern-detector/index.ts","../services/yaml-workflow/pattern-detector/run-detection.ts","../services/yaml-workflow/pattern-detector/types.ts","../services/yaml-workflow/pipeline/analyze.ts","../services/yaml-workflow/pipeline/extract-helpers.ts","../services/yaml-workflow/pipeline/extract.ts","../services/yaml-workflow/pipeline/index.ts","../services/yaml-workflow/pipeline/prompt-templates.ts","../services/yaml-workflow/pipeline/prompts.ts","../services/yaml-workflow/pipeline/validate.ts","../services/yaml-workflow/pipeline/build/dag-assembly.ts","../services/yaml-workflow/pipeline/build/dag.ts","../services/yaml-workflow/pipeline/build/index.ts","../services/yaml-workflow/pipeline/build/iteration.ts","../services/yaml-workflow/pipeline/build/metadata.ts","../services/yaml-workflow/pipeline/build/transform.ts","../services/yaml-workflow/pipeline/build/utils.ts","../services/yaml-workflow/pipeline/build/wiring.ts","../services/yaml-workflow/pipeline/compile/index.ts","../services/yaml-workflow/pipeline/compile/llm-call.ts","../services/yaml-workflow/pipeline/compile/parse-plan.ts","../services/yaml-workflow/pipeline/compile/summarize.ts","../services/yaml-workflow/workers/callbacks.ts","../services/yaml-workflow/workers/events.ts","../services/yaml-workflow/workers/index.ts","../services/yaml-workflow/workers/register.ts","../services/yaml-workflow/workers/scope.ts","../shared/form-validation/ctx-path.ts","../shared/form-validation/derive-field-label.ts","../shared/form-validation/field-validator.ts","../shared/form-validation/index.ts","../shared/form-validation/validate-resolver-payload.ts","../shared/form-validation/x-lt-bind.ts","../shared/form-validation/x-lt-help.ts","../shared/form-validation/x-lt-labels.ts","../shared/form-validation/x-lt-options.ts","../shared/form-validation/x-lt-query.ts","../shared/form-validation/x-lt-require-any.ts","../shared/form-validation/x-lt-require-sum.ts","../shared/form-validation/x-lt-show-if.ts","../shared/form-validation/x-lt-submit-guard.ts","../shared/form-validation/x-lt-submit-on-claim.ts","../shared/form-validation/x-lt-transition.ts","../start/adapters.ts","../start/apply-report.ts","../start/config.ts","../start/graph-workflows.ts","../start/index.ts","../start/server.ts","../start/socket-auth.ts","../start/workers.ts","../system/index.ts","../system/activities/claude-code.ts","../system/activities/file-storage.ts","../system/activities/http.ts","../system/activities/knowledge.ts","../system/activities/oauth.ts","../system/activities/schema-exchange.ts","../system/activities/sql.ts","../system/activities/triage/cache.ts","../system/activities/triage/context.ts","../system/activities/triage/discovery.ts","../system/activities/triage/index.ts","../system/activities/triage/llm.ts","../system/activities/triage/tools.ts","../system/mcp-servers/claude-code.ts","../system/mcp-servers/docs.ts","../system/mcp-servers/events.ts","../system/mcp-servers/file-storage.ts","../system/mcp-servers/http-fetch.ts","../system/mcp-servers/human-queue-schemas.ts","../system/mcp-servers/human-queue.ts","../system/mcp-servers/knowledge.ts","../system/mcp-servers/oauth.ts","../system/mcp-servers/schema-exchange.ts","../system/mcp-servers/translation.ts","../system/mcp-servers/vision-prompts.ts","../system/mcp-servers/vision.ts","../system/mcp-servers/workflow-compiler.ts","../system/mcp-servers/workflow.ts","../system/mcp-servers/admin/agent-subscriptions.ts","../system/mcp-servers/admin/agents.ts","../system/mcp-servers/admin/announcements.ts","../system/mcp-servers/admin/bot-accounts.ts","../system/mcp-servers/admin/controlplane.ts","../system/mcp-servers/admin/diagnostics.ts","../system/mcp-servers/admin/domain-context.ts","../system/mcp-servers/admin/escalations.ts","../system/mcp-servers/admin/exports.ts","../system/mcp-servers/admin/index.ts","../system/mcp-servers/admin/maintenance.ts","../system/mcp-servers/admin/mcp-servers.ts","../system/mcp-servers/admin/overview.ts","../system/mcp-servers/admin/personas.ts","../system/mcp-servers/admin/pipelines.ts","../system/mcp-servers/admin/scan-codes.ts","../system/mcp-servers/admin/schemas.ts","../system/mcp-servers/admin/settings.ts","../system/mcp-servers/admin/tasks.ts","../system/mcp-servers/admin/topics.ts","../system/mcp-servers/admin/users.ts","../system/mcp-servers/admin/workflow-config.ts","../system/mcp-servers/admin/workflows.ts","../system/mcp-servers/admin/yaml-workflows.ts","../system/mcp-servers/db-query/index.ts","../system/mcp-servers/db-query/schemas.ts","../system/mcp-servers/db-query/tools.ts","../system/seed/index.ts","../system/seed/tool-manifests-admin.ts","../system/seed/tool-manifests-data.ts","../system/seed/tool-manifests-escalation.ts","../system/seed/tool-manifests-events.ts","../system/seed/tool-manifests-knowledge.ts","../system/seed/tool-manifests-workflows.ts","../system/workflows/tool-result-guard.ts","../system/workflows/capability-invoke/activities.ts","../system/workflows/capability-invoke/index.ts","../system/workflows/mcp-deterministic/activities.ts","../system/workflows/mcp-deterministic/index.ts","../system/workflows/mcp-query/index.ts","../system/workflows/mcp-query/prompts.ts","../system/workflows/mcp-query/strategy-advisors.ts","../system/workflows/mcp-query/types.ts","../system/workflows/mcp-query/activities/caches.ts","../system/workflows/mcp-query/activities/discovery.ts","../system/workflows/mcp-query/activities/index.ts","../system/workflows/mcp-query/activities/llm.ts","../system/workflows/mcp-query/activities/tool-executor.ts","../system/workflows/mcp-query/activities/tool-loader.ts","../system/workflows/mcp-query-router/activities.ts","../system/workflows/mcp-query-router/index.ts","../system/workflows/mcp-query-router/prompts.ts","../system/workflows/mcp-triage/activities-proxy.ts","../system/workflows/mcp-triage/index.ts","../system/workflows/mcp-triage/prompts.ts","../system/workflows/mcp-triage/response-builders.ts","../system/workflows/mcp-triage/response.ts","../system/workflows/mcp-triage/types.ts","../system/workflows/mcp-triage-deterministic/activities.ts","../system/workflows/mcp-triage-deterministic/index.ts","../system/workflows/mcp-triage-router/activities.ts","../system/workflows/mcp-triage-router/index.ts","../system/workflows/mcp-workflow-builder/index.ts","../system/workflows/mcp-workflow-builder/prompts.ts","../system/workflows/mcp-workflow-builder/activities/caches.ts","../system/workflows/mcp-workflow-builder/activities/index.ts","../system/workflows/mcp-workflow-builder/activities/llm.ts","../system/workflows/mcp-workflow-builder/activities/tool-loader.ts","../system/workflows/mcp-workflow-planner/index.ts","../system/workflows/mcp-workflow-planner/prompts.ts","../system/workflows/mcp-workflow-planner/activities/analyze.ts","../system/workflows/mcp-workflow-planner/activities/index.ts","../system/workflows/mcp-workflow-planner/activities/persist.ts","../system/workflows/mcp-workflow-planner/activities/plan.ts","../system/workflows/shared/discovery.ts","../system/workflows/shared/index.ts","../system/workflows/shared/llm-caller.ts","../system/workflows/shared/prompts.ts","../system/workflows/shared/strategy-advisors.ts","../system/workflows/shared/tool-executor.ts","../system/workflows/shared/tool-loader.ts","../system/workflows/shared/types.ts","../themes/midnight.ts","../types/agent.ts","../types/analytics.ts","../types/auth.ts","../types/config.ts","../types/delegation.ts","../types/discovery.ts","../types/domain-manifest.ts","../types/envelope.ts","../types/escalation-strategy.ts","../types/escalation.ts","../types/events.ts","../types/export.ts","../types/express.d.ts","../types/facets.ts","../types/index.ts","../types/logger.ts","../types/maintenance.ts","../types/mcp.ts","../types/oauth.ts","../types/persona.ts","../types/scan-choice.ts","../types/scan-code.ts","../types/sdk.ts","../types/startup.ts","../types/task.ts","../types/telemetry.ts","../types/tool-context.ts","../types/user.ts","../types/validation.ts","../types/workflow-set.ts","../types/workflow.ts","../types/yaml-workflow.ts","../workers/index.ts"],"version":"5.9.3"}
+{"root":["../index.ts","../vitest.config.ts","../vitest.integration.config.ts","../adapters/express.ts","../api/agent-subscriptions.ts","../api/agents.ts","../api/announcements.ts","../api/auth-sso.ts","../api/auth.ts","../api/bot-accounts.ts","../api/capabilities.ts","../api/controlplane.ts","../api/dba.ts","../api/diagnostics.ts","../api/domain.ts","../api/exports.ts","../api/files.ts","../api/index.ts","../api/insight.ts","../api/knowledge.ts","../api/maintenance.ts","../api/me.ts","../api/namespaces.ts","../api/overview.ts","../api/personas.ts","../api/pipelines.ts","../api/roles.ts","../api/settings.ts","../api/tasks.ts","../api/topics.ts","../api/users.ts","../api/workflow-sets.ts","../api/escalations/analytics.ts","../api/escalations/bulk.ts","../api/escalations/cancel.ts","../api/escalations/claim.ts","../api/escalations/create.ts","../api/escalations/facets.ts","../api/escalations/helpers.ts","../api/escalations/index.ts","../api/escalations/list.ts","../api/escalations/lookups.ts","../api/escalations/metadata.ts","../api/escalations/resolve-batch.ts","../api/escalations/resolve.ts","../api/escalations/single.ts","../api/mcp/index.ts","../api/mcp/servers.ts","../api/mcp/tools.ts","../api/scan-codes/choice.ts","../api/scan-codes/config.ts","../api/scan-codes/context.ts","../api/scan-codes/execute.ts","../api/scan-codes/identity.ts","../api/scan-codes/index.ts","../api/scan-codes/locate.ts","../api/scan-codes/present.ts","../api/scan-codes/verbs.ts","../api/workflows/config.ts","../api/workflows/discovery.ts","../api/workflows/index.ts","../api/workflows/invocation.ts","../api/yaml-workflows/cron.ts","../api/yaml-workflows/crud.ts","../api/yaml-workflows/deploy.ts","../api/yaml-workflows/helpers.ts","../api/yaml-workflows/index.ts","../api/yaml-workflows/versions.ts","../bin/ltc.ts","../lib/typed-resolution.ts","../lib/uuid.ts","../lib/cli/auth.ts","../lib/cli/client.ts","../lib/cli/compile.ts","../lib/cli/format.ts","../lib/cli/init.ts","../lib/cli/output.ts","../lib/cli/scanner.ts","../lib/cli/types.ts","../lib/cli/commands/escalations.ts","../lib/cli/commands/knowledge.ts","../lib/cli/commands/mcp.ts","../lib/cli/commands/personas.ts","../lib/cli/commands/pipelines.ts","../lib/cli/commands/roles.ts","../lib/cli/commands/status.ts","../lib/cli/commands/streams.ts","../lib/cli/commands/users.ts","../lib/cli/commands/workflows.ts","../lib/db/index.ts","../lib/db/migrate.ts","../lib/events/callback.ts","../lib/events/escalation-wire.ts","../lib/events/index.ts","../lib/events/matching.ts","../lib/events/memory.ts","../lib/events/nats-ws-proxy.ts","../lib/events/nats.ts","../lib/events/publish.ts","../lib/events/socketio.ts","../lib/events/system-events.ts","../lib/json-path/pick.ts","../lib/logger/index.ts","../lib/logger/pino.ts","../lib/storage/index.ts","../lib/storage/local.ts","../lib/storage/mime.ts","../lib/storage/s3.ts","../lib/storage/types.ts","../lib/telemetry/honeycomb.ts","../lib/telemetry/index.ts","../modules/auth.ts","../modules/branding.ts","../modules/config.ts","../modules/defaults.ts","../modules/features.ts","../modules/ltconfig.ts","../modules/maintenance.ts","../modules/search.ts","../modules/sso.ts","../modules/utils.ts","../modules/version.ts","../routes/agents.ts","../routes/announcements.ts","../routes/auth-sso.ts","../routes/auth.ts","../routes/bot-accounts.ts","../routes/capabilities.ts","../routes/controlplane.ts","../routes/dba.ts","../routes/delegation.ts","../routes/diagnostics.ts","../routes/docs.ts","../routes/domain.ts","../routes/exports.ts","../routes/file-browser.ts","../routes/files.ts","../routes/index.ts","../routes/insight.ts","../routes/knowledge.ts","../routes/maintenance.ts","../routes/mcp-endpoint.ts","../routes/mcp.ts","../routes/me.ts","../routes/namespaces.ts","../routes/nats-credentials.ts","../routes/oauth.ts","../routes/overview.ts","../routes/personas.ts","../routes/pipelines.ts","../routes/roles.ts","../routes/scan-codes.ts","../routes/settings.ts","../routes/tasks.ts","../routes/topics.ts","../routes/users.ts","../routes/workflow-sets.ts","../routes/escalations/acting.ts","../routes/escalations/analytics.ts","../routes/escalations/bulk.ts","../routes/escalations/facets.ts","../routes/escalations/index.ts","../routes/escalations/list.ts","../routes/escalations/metadata.ts","../routes/escalations/resolve.ts","../routes/escalations/single.ts","../routes/workflows/config.ts","../routes/workflows/discovery.ts","../routes/workflows/index.ts","../routes/workflows/invocation.ts","../routes/yaml-workflows/cron.ts","../routes/yaml-workflows/crud.ts","../routes/yaml-workflows/deployment.ts","../routes/yaml-workflows/index.ts","../routes/yaml-workflows/versions.ts","../scripts/ortho-populate.ts","../scripts/printer-cycle.ts","../scripts/process-helpers.ts","../scripts/process.ts","../scripts/token.ts","../scripts/twin-farm.ts","../sdk/index.ts","../services/dba.ts","../services/hotmesh-utils.ts","../services/workflow-invocation.ts","../services/agent/index.ts","../services/agent/input-mapper.ts","../services/agent/sql.ts","../services/agent/subscription-sql.ts","../services/agent/subscriptions.ts","../services/agent/trigger-registry.ts","../services/announcement/index.ts","../services/announcement/sql.ts","../services/auth/bot-api-key.ts","../services/auth/delegation.ts","../services/auth/index.ts","../services/auth/service-token.ts","../services/auth/sql.ts","../services/config/cache.ts","../services/config/index.ts","../services/config/provider.ts","../services/config/read.ts","../services/config/sql.ts","../services/config/write.ts","../services/controlplane/index.ts","../services/controlplane/quorum-bridge.ts","../services/controlplane/sql.ts","../services/controlplane/stream-messages-sql.ts","../services/controlplane/types.ts","../services/cron/index.ts","../services/diagnostics/index.ts","../services/diagnostics/patterns.ts","../services/domain/index.ts","../services/domain/read.ts","../services/domain/seed.ts","../services/domain/sql.ts","../services/domain/validate.ts","../services/domain/write.ts","../services/escalation/aggregate-sql.ts","../services/escalation/aggregate-validate.ts","../services/escalation/aggregates.ts","../services/escalation/batch.ts","../services/escalation/bulk.ts","../services/escalation/client.ts","../services/escalation/crud.ts","../services/escalation/facet-sql.ts","../services/escalation/facets.ts","../services/escalation/index.ts","../services/escalation/map.ts","../services/escalation/metrics-cache.ts","../services/escalation/queries.ts","../services/escalation/resolver-validation.ts","../services/escalation/sql.ts","../services/escalation/submit-guard.ts","../services/escalation/types.ts","../services/escalation-strategy/default.ts","../services/escalation-strategy/index.ts","../services/escalation-strategy/mcp.ts","../services/export/client.ts","../services/export/index.ts","../services/export/post-process.ts","../services/export/types.ts","../services/iam/acting-identity.ts","../services/iam/activity.ts","../services/iam/bots.ts","../services/iam/context.ts","../services/iam/credentials.ts","../services/iam/envelope.ts","../services/iam/ephemeral.ts","../services/iam/index.ts","../services/iam/principal.ts","../services/iam/resolve.ts","../services/iam/sql.ts","../services/insight/index.ts","../services/insight/prompts.ts","../services/interceptor/activity-interceptor.ts","../services/interceptor/completion.ts","../services/interceptor/context.ts","../services/interceptor/escalation.ts","../services/interceptor/index.ts","../services/interceptor/lifecycle.ts","../services/interceptor/state.ts","../services/interceptor/types.ts","../services/interceptor/activities/config.ts","../services/interceptor/activities/escalation.ts","../services/interceptor/activities/index.ts","../services/interceptor/activities/task.ts","../services/interceptor/activities/workflow.ts","../services/knowledge/index.ts","../services/knowledge/lookup-cache.ts","../services/knowledge/sql.ts","../services/llm/detect.ts","../services/llm/index.ts","../services/llm/translate.ts","../services/llm/types.ts","../services/llm/providers/anthropic.ts","../services/llm/providers/openai.ts","../services/maintenance/index.ts","../services/mcp/adapter.ts","../services/mcp/db.ts","../services/mcp/exposure.ts","../services/mcp/external-server.ts","../services/mcp/index.ts","../services/mcp/register-tool.ts","../services/mcp/seed-service-account.ts","../services/mcp/server-lifecycle.ts","../services/mcp/server-tools.ts","../services/mcp/server.ts","../services/mcp/sql.ts","../services/mcp/types.ts","../services/mcp/workflow-compiler-server.ts","../services/mcp/workflow-server.ts","../services/mcp/client/connection-dispatch.ts","../services/mcp/client/connection-lifecycle.ts","../services/mcp/client/connection-test.ts","../services/mcp/client/connection.ts","../services/mcp/client/index.ts","../services/mcp/client/tools.ts","../services/mcp/db-server/index.ts","../services/mcp/db-server/schemas.ts","../services/mcp/db-server/tools.ts","../services/mcp/playwright-server/index.ts","../services/mcp/playwright-server/lifecycle.ts","../services/mcp/playwright-server/schemas.ts","../services/mcp/playwright-server/tools.ts","../services/namespace/index.ts","../services/namespace/sql.ts","../services/namespace/types.ts","../services/oauth/crypto.ts","../services/oauth/db.ts","../services/oauth/index.ts","../services/oauth/sql.ts","../services/oauth/state.ts","../services/oauth/providers/anthropic.ts","../services/oauth/providers/github.ts","../services/oauth/providers/google.ts","../services/oauth/providers/index.ts","../services/oauth/providers/microsoft.ts","../services/oauth/providers/mock.ts","../services/oauth/providers/registry.ts","../services/oauth/providers/types.ts","../services/orchestrator/condition.ts","../services/orchestrator/index.ts","../services/orchestrator/types.ts","../services/overview/index.ts","../services/overview/sql.ts","../services/persona/index.ts","../services/persona/sql.ts","../services/persona/types.ts","../services/pipelines/enrichment.ts","../services/pipelines/events.ts","../services/pipelines/execution-builder.ts","../services/pipelines/index.ts","../services/pipelines/queries.ts","../services/pipelines/sql.ts","../services/pipelines/types.ts","../services/role/enforcement-cache.ts","../services/role/index.ts","../services/role/schema-validator.ts","../services/role/seed.ts","../services/role/sql.ts","../services/role/types.ts","../services/scan-code/index.ts","../services/scan-code/parse.ts","../services/scan-code/read.ts","../services/scan-code/sql.ts","../services/scan-code/validate.ts","../services/scan-code/write.ts","../services/task/crud.ts","../services/task/index.ts","../services/task/process.ts","../services/task/resolve.ts","../services/task/sql.ts","../services/task/types.ts","../services/topics/index.ts","../services/topics/sql.ts","../services/topics/system-topics.ts","../services/user/auth.ts","../services/user/crud.ts","../services/user/index.ts","../services/user/preferences.ts","../services/user/rbac.ts","../services/user/roles.ts","../services/user/scope.ts","../services/user/seed-admin.ts","../services/user/sql.ts","../services/user/sso-provision.ts","../services/user/types.ts","../services/workers/registry.ts","../services/workflow-sets/db.ts","../services/workflow-sets/index.ts","../services/workflow-sets/sql.ts","../services/yaml-workflow/builder-regenerate.ts","../services/yaml-workflow/db-utils.ts","../services/yaml-workflow/db-versions.ts","../services/yaml-workflow/db.ts","../services/yaml-workflow/deployer-helpers.ts","../services/yaml-workflow/deployer.ts","../services/yaml-workflow/generator.ts","../services/yaml-workflow/index.ts","../services/yaml-workflow/input-analyzer-helpers.ts","../services/yaml-workflow/input-analyzer.ts","../services/yaml-workflow/invoke.ts","../services/yaml-workflow/pipe-validator.ts","../services/yaml-workflow/sql.ts","../services/yaml-workflow/types.ts","../services/yaml-workflow/durable-compiler/index.ts","../services/yaml-workflow/durable-compiler/parser.ts","../services/yaml-workflow/durable-compiler/prompts.ts","../services/yaml-workflow/durable-compiler/types.ts","../services/yaml-workflow/pattern-detector/array-source.ts","../services/yaml-workflow/pattern-detector/collapse.ts","../services/yaml-workflow/pattern-detector/index.ts","../services/yaml-workflow/pattern-detector/run-detection.ts","../services/yaml-workflow/pattern-detector/types.ts","../services/yaml-workflow/pipeline/analyze.ts","../services/yaml-workflow/pipeline/extract-helpers.ts","../services/yaml-workflow/pipeline/extract.ts","../services/yaml-workflow/pipeline/index.ts","../services/yaml-workflow/pipeline/prompt-templates.ts","../services/yaml-workflow/pipeline/prompts.ts","../services/yaml-workflow/pipeline/validate.ts","../services/yaml-workflow/pipeline/build/dag-assembly.ts","../services/yaml-workflow/pipeline/build/dag.ts","../services/yaml-workflow/pipeline/build/index.ts","../services/yaml-workflow/pipeline/build/iteration.ts","../services/yaml-workflow/pipeline/build/metadata.ts","../services/yaml-workflow/pipeline/build/transform.ts","../services/yaml-workflow/pipeline/build/utils.ts","../services/yaml-workflow/pipeline/build/wiring.ts","../services/yaml-workflow/pipeline/compile/index.ts","../services/yaml-workflow/pipeline/compile/llm-call.ts","../services/yaml-workflow/pipeline/compile/parse-plan.ts","../services/yaml-workflow/pipeline/compile/summarize.ts","../services/yaml-workflow/workers/callbacks.ts","../services/yaml-workflow/workers/events.ts","../services/yaml-workflow/workers/index.ts","../services/yaml-workflow/workers/register.ts","../services/yaml-workflow/workers/scope.ts","../shared/form-validation/ctx-path.ts","../shared/form-validation/derive-field-label.ts","../shared/form-validation/field-validator.ts","../shared/form-validation/index.ts","../shared/form-validation/validate-resolver-payload.ts","../shared/form-validation/x-lt-bind.ts","../shared/form-validation/x-lt-help.ts","../shared/form-validation/x-lt-labels.ts","../shared/form-validation/x-lt-options.ts","../shared/form-validation/x-lt-query.ts","../shared/form-validation/x-lt-require-any.ts","../shared/form-validation/x-lt-require-sum.ts","../shared/form-validation/x-lt-show-if.ts","../shared/form-validation/x-lt-submit-guard.ts","../shared/form-validation/x-lt-submit-on-claim.ts","../shared/form-validation/x-lt-transition.ts","../start/adapters.ts","../start/apply-report.ts","../start/config.ts","../start/graph-workflows.ts","../start/index.ts","../start/server.ts","../start/socket-auth.ts","../start/workers.ts","../system/index.ts","../system/activities/claude-code.ts","../system/activities/file-storage.ts","../system/activities/http.ts","../system/activities/knowledge.ts","../system/activities/oauth.ts","../system/activities/schema-exchange.ts","../system/activities/sql.ts","../system/activities/triage/cache.ts","../system/activities/triage/context.ts","../system/activities/triage/discovery.ts","../system/activities/triage/index.ts","../system/activities/triage/llm.ts","../system/activities/triage/tools.ts","../system/mcp-servers/claude-code.ts","../system/mcp-servers/docs.ts","../system/mcp-servers/events.ts","../system/mcp-servers/file-storage.ts","../system/mcp-servers/http-fetch.ts","../system/mcp-servers/human-queue-schemas.ts","../system/mcp-servers/human-queue.ts","../system/mcp-servers/knowledge.ts","../system/mcp-servers/oauth.ts","../system/mcp-servers/schema-exchange.ts","../system/mcp-servers/translation.ts","../system/mcp-servers/vision-prompts.ts","../system/mcp-servers/vision.ts","../system/mcp-servers/workflow-compiler.ts","../system/mcp-servers/workflow.ts","../system/mcp-servers/admin/agent-subscriptions.ts","../system/mcp-servers/admin/agents.ts","../system/mcp-servers/admin/announcements.ts","../system/mcp-servers/admin/bot-accounts.ts","../system/mcp-servers/admin/controlplane.ts","../system/mcp-servers/admin/diagnostics.ts","../system/mcp-servers/admin/domain-context.ts","../system/mcp-servers/admin/escalations.ts","../system/mcp-servers/admin/exports.ts","../system/mcp-servers/admin/index.ts","../system/mcp-servers/admin/maintenance.ts","../system/mcp-servers/admin/mcp-servers.ts","../system/mcp-servers/admin/overview.ts","../system/mcp-servers/admin/personas.ts","../system/mcp-servers/admin/pipelines.ts","../system/mcp-servers/admin/scan-codes.ts","../system/mcp-servers/admin/schemas.ts","../system/mcp-servers/admin/settings.ts","../system/mcp-servers/admin/tasks.ts","../system/mcp-servers/admin/topics.ts","../system/mcp-servers/admin/users.ts","../system/mcp-servers/admin/workflow-config.ts","../system/mcp-servers/admin/workflows.ts","../system/mcp-servers/admin/yaml-workflows.ts","../system/mcp-servers/db-query/index.ts","../system/mcp-servers/db-query/schemas.ts","../system/mcp-servers/db-query/tools.ts","../system/seed/index.ts","../system/seed/tool-manifests-admin.ts","../system/seed/tool-manifests-data.ts","../system/seed/tool-manifests-escalation.ts","../system/seed/tool-manifests-events.ts","../system/seed/tool-manifests-knowledge.ts","../system/seed/tool-manifests-workflows.ts","../system/workflows/tool-result-guard.ts","../system/workflows/capability-invoke/activities.ts","../system/workflows/capability-invoke/index.ts","../system/workflows/mcp-deterministic/activities.ts","../system/workflows/mcp-deterministic/index.ts","../system/workflows/mcp-query/index.ts","../system/workflows/mcp-query/prompts.ts","../system/workflows/mcp-query/strategy-advisors.ts","../system/workflows/mcp-query/types.ts","../system/workflows/mcp-query/activities/caches.ts","../system/workflows/mcp-query/activities/discovery.ts","../system/workflows/mcp-query/activities/index.ts","../system/workflows/mcp-query/activities/llm.ts","../system/workflows/mcp-query/activities/tool-executor.ts","../system/workflows/mcp-query/activities/tool-loader.ts","../system/workflows/mcp-query-router/activities.ts","../system/workflows/mcp-query-router/index.ts","../system/workflows/mcp-query-router/prompts.ts","../system/workflows/mcp-triage/activities-proxy.ts","../system/workflows/mcp-triage/index.ts","../system/workflows/mcp-triage/prompts.ts","../system/workflows/mcp-triage/response-builders.ts","../system/workflows/mcp-triage/response.ts","../system/workflows/mcp-triage/types.ts","../system/workflows/mcp-triage-deterministic/activities.ts","../system/workflows/mcp-triage-deterministic/index.ts","../system/workflows/mcp-triage-router/activities.ts","../system/workflows/mcp-triage-router/index.ts","../system/workflows/mcp-workflow-builder/index.ts","../system/workflows/mcp-workflow-builder/prompts.ts","../system/workflows/mcp-workflow-builder/activities/caches.ts","../system/workflows/mcp-workflow-builder/activities/index.ts","../system/workflows/mcp-workflow-builder/activities/llm.ts","../system/workflows/mcp-workflow-builder/activities/tool-loader.ts","../system/workflows/mcp-workflow-planner/index.ts","../system/workflows/mcp-workflow-planner/prompts.ts","../system/workflows/mcp-workflow-planner/activities/analyze.ts","../system/workflows/mcp-workflow-planner/activities/index.ts","../system/workflows/mcp-workflow-planner/activities/persist.ts","../system/workflows/mcp-workflow-planner/activities/plan.ts","../system/workflows/shared/discovery.ts","../system/workflows/shared/index.ts","../system/workflows/shared/llm-caller.ts","../system/workflows/shared/prompts.ts","../system/workflows/shared/strategy-advisors.ts","../system/workflows/shared/tool-executor.ts","../system/workflows/shared/tool-loader.ts","../system/workflows/shared/types.ts","../themes/midnight.ts","../types/agent.ts","../types/analytics.ts","../types/auth.ts","../types/config.ts","../types/delegation.ts","../types/discovery.ts","../types/domain-manifest.ts","../types/envelope.ts","../types/escalation-strategy.ts","../types/escalation.ts","../types/events.ts","../types/export.ts","../types/express.d.ts","../types/facets.ts","../types/index.ts","../types/logger.ts","../types/maintenance.ts","../types/mcp.ts","../types/oauth.ts","../types/persona.ts","../types/scan-choice.ts","../types/scan-code.ts","../types/sdk.ts","../types/startup.ts","../types/task.ts","../types/telemetry.ts","../types/tool-context.ts","../types/user.ts","../types/validation.ts","../types/workflow-set.ts","../types/workflow.ts","../types/yaml-workflow.ts","../workers/index.ts"],"version":"5.9.3"}

package/dashboard/dist/assets/{AdminDashboard-DDY8bceq.js → AdminDashboard-DPkWtPc1.js}

@@ -1,2 +1,2 @@
-import{j as o}from"./vendor-query-RUZdMvN6.js";import{c as n}from"./tasks-CDs-Li2v.js";import{y as m,a3 as c}from"./index-D88VWEVp.js";import{u}from"./mcp-CQ_TD2P9.js";import{P as d}from"./PageHeaderWithStats-DuAm6YK2.js";import"./vendor-react-CdqEC2zv.js";import"./vendor-icons-R9b9gQ04.js";function S(){var e;m();const{data:t}=n({limit:1}),{data:a}=c({status:"pending",limit:1}),{data:s}=u(),l=((e=s==null?void 0:s.servers)==null?void 0:e.filter(i=>i.status==="connected").length)??0,r=s?`${l}/${s.total}`:"—";return o.jsx("div",{children:o.jsx(d,{title:"Admin",stats:[{label:"Tasks",value:(t==null?void 0:t.total)??"—"},{label:"Pending Escalations",value:(a==null?void 0:a.total)??"—",dotClass:"bg-status-pending"},{label:"MCP Servers",value:r},{label:"System",value:"Healthy",dotClass:"bg-status-success"}]})})}export{S as AdminDashboard};
-//# sourceMappingURL=AdminDashboard-DDY8bceq.js.map
+import{j as o}from"./vendor-query-RUZdMvN6.js";import{c as n}from"./tasks-DrWSrjmj.js";import{y as m,a3 as c}from"./index-BaC3sbJH.js";import{u}from"./mcp-C-DMktCT.js";import{P as d}from"./PageHeaderWithStats-DVo_qqn1.js";import"./vendor-react-CdqEC2zv.js";import"./vendor-icons-BCWsItQ7.js";function S(){var e;m();const{data:t}=n({limit:1}),{data:a}=c({status:"pending",limit:1}),{data:s}=u(),l=((e=s==null?void 0:s.servers)==null?void 0:e.filter(i=>i.status==="connected").length)??0,r=s?`${l}/${s.total}`:"—";return o.jsx("div",{children:o.jsx(d,{title:"Admin",stats:[{label:"Tasks",value:(t==null?void 0:t.total)??"—"},{label:"Pending Escalations",value:(a==null?void 0:a.total)??"—",dotClass:"bg-status-pending"},{label:"MCP Servers",value:r},{label:"System",value:"Healthy",dotClass:"bg-status-success"}]})})}export{S as AdminDashboard};
+//# sourceMappingURL=AdminDashboard-DPkWtPc1.js.map