@hotmeshio/long-tail 0.23.1 → 0.24.0

package/build/services/mcp/client/tools.d.ts

@@ -1,3 +1,16 @@
+/**
+ * Call a built-in server's tool as a named caller: the handler sees the
+ * caller as an external principal, so caller-aware tools act with the
+ * caller's own rights rather than lt-system's. `serverName` is the canonical
+ * built-in name (resolveBuiltinServerName).
+ */
+export declare function callBuiltinToolAs(serverName: string, toolName: string, args: Record<string, any>, caller: {
+    userId: string;
+    role?: string;
+}, credentials?: {
+    userId?: string;
+    delegationToken?: string;
+}): Promise<any>;
 /**
  * Call a tool on a connected server.
  * Resolves the server by ID or name, auto-connecting built-in servers.

package/build/services/mcp/client/tools.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.callBuiltinToolAs = callBuiltinToolAs;
 exports.callServerTool = callServerTool;
 exports.toolActivities = toolActivities;
 const logger_1 = require("../../../lib/logger");
@@ -53,6 +54,23 @@ function deriveAuthFromToolContext() {
         delegationToken: ctx.credentials.delegationToken,
     };
 }
+/**
+ * Call a built-in server's tool as a named caller: the handler sees the
+ * caller as an external principal, so caller-aware tools act with the
+ * caller's own rights rather than lt-system's. `serverName` is the canonical
+ * built-in name (resolveBuiltinServerName).
+ */
+async function callBuiltinToolAs(serverName, toolName, args, caller, credentials) {
+    // `_auth` carries the identity tools resolve credentials with, as callServerTool sets it.
+    const toolArgs = {
+        ...args,
+        _auth: credentials ? { userId: credentials.userId, token: credentials.delegationToken } : { userId: caller.userId },
+    };
+    const builtin = await (0, connection_1.dispatchBuiltinTool)(serverName, toolName, toolArgs, { authInfo: caller });
+    if (!builtin)
+        throw Object.assign(new Error(`Tool ${toolName} not found on ${serverName}`), { name: 'ToolNotFoundError' });
+    return builtin.result;
+}
 /**
  * Call a tool on a connected server.
  * Resolves the server by ID or name, auto-connecting built-in servers.

package/build/services/mcp/db-server/index.js

@@ -5,6 +5,7 @@ exports.getDbServer = getDbServer;
 exports.stopDbServer = stopDbServer;
 const mcp_js_1 = require("@modelcontextprotocol/sdk/server/mcp.js");
 const logger_1 = require("../../../lib/logger");
+const registered_tools_1 = require("../registered-tools");
 const tools_1 = require("./tools");
 let server = null;
 /**
@@ -28,7 +29,7 @@ async function createDbServer(options) {
         server = instance;
     }
     (0, tools_1.registerDbTools)(instance);
-    logger_1.loggerRegistry.info(`[lt-mcp:db-server] ${name} ready (6 tools registered)`);
+    logger_1.loggerRegistry.info(`[lt-mcp:db-server] ${name} ready (${(0, registered_tools_1.registeredToolCount)(instance)} tools registered)`);
     return instance;
 }
 /**

package/build/services/mcp/external-server.d.ts

@@ -6,10 +6,15 @@
  * Created per-request in stateless mode (pure in-memory, no IO).
  */
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { CapabilityAccess } from '../../types';
 import type { ExposureConfig } from './exposure';
+export declare const SHIPPED_SERVERS: Set<string>;
 /**
- * Create a unified McpServer with tools from all qualifying shipped servers.
- * Called per-request in stateless mode. Server instances are cached; only
- * the McpServer wrapper and tool registrations are fresh (pure in-memory).
+ * Create a unified McpServer with the tools this caller may use from all
+ * qualifying shipped servers. Called per-request in stateless mode, so a tool
+ * the caller lacks the capability for is neither listed nor callable. When
+ * the request calls one tool, only that tool is registered and only its gate
+ * is checked. Server instances are cached; only the McpServer wrapper and
+ * tool registrations are fresh (pure in-memory).
  */
-export declare function createUnifiedMcpServer(exposure?: ExposureConfig, callerScopes?: string[]): Promise<McpServer>;
+export declare function createUnifiedMcpServer(access: CapabilityAccess, exposure?: ExposureConfig, callerScopes?: string[], requestedTool?: string): Promise<McpServer>;

package/build/services/mcp/external-server.js

@@ -7,6 +7,7 @@
  * Created per-request in stateless mode (pure in-memory, no IO).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.SHIPPED_SERVERS = void 0;
 exports.createUnifiedMcpServer = createUnifiedMcpServer;
 const mcp_js_1 = require("@modelcontextprotocol/sdk/server/mcp.js");
 const logger_1 = require("../../lib/logger");
@@ -44,7 +45,7 @@ async function buildInstructions() {
 // ── Shipped server allowlist ─────────────────────────────────────────────────
 // Only these servers are exposed via the /mcp endpoint.
 // Example servers (playwright, gmail, image-tools) are excluded.
-const SHIPPED_SERVERS = new Set([
+exports.SHIPPED_SERVERS = new Set([
     'long-tail-admin',
     'long-tail-human-queue',
     'long-tail-file-storage',
@@ -74,7 +75,7 @@ async function getOrCreateServer(name) {
 }
 // ── Exposure filtering ───────────────────────────────────────────────────────
 function isServerAllowed(name, exposure) {
-    if (!SHIPPED_SERVERS.has(name))
+    if (!exports.SHIPPED_SERVERS.has(name))
         return false;
     if (exposure?.allowServers?.length) {
         if (!exposure.allowServers.includes(name))
@@ -94,6 +95,15 @@ function isServerAllowed(name, exposure) {
     }
     return true;
 }
+/**
+ * Whether the caller holds the capability the tool's manifest entry declares.
+ * Fails closed: a tool without a manifest entry or a gate is never exposed.
+ */
+async function isToolPermitted(toolName, serverName, access) {
+    const manifest = system_1.builtinMcpServerFactories[serverName]?.config?.toolManifest;
+    const gate = manifest?.find((t) => t.name === toolName)?.gate;
+    return gate !== undefined && (await access(gate));
+}
 function isToolAllowed(toolName, serverName, exposure, callerScopes) {
     // Per-caller scope filtering: mcp:read callers only see read_safe tools
     const isReadOnly = exposure?.readOnly
@@ -114,12 +124,16 @@ function isToolAllowed(toolName, serverName, exposure, callerScopes) {
 }
 // ── Unified server creation ──────────────────────────────────────────────────
 /**
- * Create a unified McpServer with tools from all qualifying shipped servers.
- * Called per-request in stateless mode. Server instances are cached; only
- * the McpServer wrapper and tool registrations are fresh (pure in-memory).
+ * Create a unified McpServer with the tools this caller may use from all
+ * qualifying shipped servers. Called per-request in stateless mode, so a tool
+ * the caller lacks the capability for is neither listed nor callable. When
+ * the request calls one tool, only that tool is registered and only its gate
+ * is checked. Server instances are cached; only the McpServer wrapper and
+ * tool registrations are fresh (pure in-memory).
  */
-async function createUnifiedMcpServer(exposure, callerScopes) {
+async function createUnifiedMcpServer(access, exposure, callerScopes, requestedTool) {
     const unified = new mcp_js_1.McpServer({ name: 'long-tail', version: '1.0.0' }, { instructions: await buildInstructions() });
+    const named = new Set();
     const registered = new Set();
     for (const [name] of Object.entries(system_1.builtinMcpServerFactories)) {
         if (!isServerAllowed(name, exposure))
@@ -137,16 +151,22 @@ async function createUnifiedMcpServer(exposure, callerScopes) {
             for (const [toolName, tool] of Object.entries(tools)) {
                 if (!tool?.handler || !tool.enabled)
                     continue;
-                if (!isToolAllowed(toolName, name, exposure, callerScopes))
-                    continue;
-                // Deduplicate: prefix with server short name on collision
+                // Deduplicate: prefix with server short name on collision. Names are
+                // claimed before filtering so a tool keeps its name for every caller.
                 let finalName = toolName;
-                if (registered.has(toolName)) {
+                if (named.has(toolName)) {
                     const prefix = name.replace('long-tail-', '').replace(/-/g, '_');
                     finalName = `${prefix}_${toolName}`;
-                    if (registered.has(finalName))
+                    if (named.has(finalName))
                         continue; // still a collision — skip
                 }
+                named.add(finalName);
+                if (requestedTool !== undefined && finalName !== requestedTool)
+                    continue;
+                if (!(await isToolPermitted(toolName, name, access)))
+                    continue;
+                if (!isToolAllowed(toolName, name, exposure, callerScopes))
+                    continue;
                 registered.add(finalName);
                 // Re-register the tool handler on the unified server.
                 // Use the low-level `tool()` API since we already have the parsed handler.
@@ -162,6 +182,9 @@ async function createUnifiedMcpServer(exposure, callerScopes) {
             logger_1.loggerRegistry.error(`[lt-mcp:endpoint] server "${name}" failed to load, skipping its tools: ${err?.stack || err?.message || err}`);
         }
     }
+    // A call to one denied or unknown tool registers none; the tool handlers
+    // still answer it the way the SDK answers any unknown tool.
+    unified.setToolRequestHandlers();
     logger_1.loggerRegistry.info(`[lt-mcp:endpoint] unified server ready (${registered.size} tools)`);
     return unified;
 }

package/build/services/mcp/playwright-server/index.js

@@ -4,6 +4,7 @@ exports.stopPlaywrightServer = void 0;
 exports.createPlaywrightServer = createPlaywrightServer;
 const mcp_js_1 = require("@modelcontextprotocol/sdk/server/mcp.js");
 const logger_1 = require("../../../lib/logger");
+const registered_tools_1 = require("../registered-tools");
 const tools_1 = require("./tools");
 var lifecycle_1 = require("./lifecycle");
 Object.defineProperty(exports, "stopPlaywrightServer", { enumerable: true, get: function () { return lifecycle_1.stopPlaywrightServer; } });
@@ -20,6 +21,6 @@ async function createPlaywrightServer(options) {
     const name = options?.name || 'long-tail-playwright';
     const instance = new mcp_js_1.McpServer({ name, version: '1.0.0' });
     (0, tools_1.registerTools)(instance);
-    logger_1.loggerRegistry.info(`[lt-mcp:playwright] ${name} ready (8 tools registered)`);
+    logger_1.loggerRegistry.info(`[lt-mcp:playwright] ${name} ready (${(0, registered_tools_1.registeredToolCount)(instance)} tools registered)`);
     return instance;
 }

package/build/services/mcp/registered-tools.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+/** How many tools a server registered, for its ready log line. */
+export declare function registeredToolCount(server: McpServer): number;

package/build/services/mcp/registered-tools.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registeredToolCount = registeredToolCount;
+/** How many tools a server registered, for its ready log line. */
+function registeredToolCount(server) {
+    return Object.keys(server._registeredTools ?? {}).length;
+}

package/build/services/mcp/server-lifecycle.js

@@ -5,6 +5,7 @@ exports.getServer = getServer;
 exports.stopServer = stopServer;
 const mcp_js_1 = require("@modelcontextprotocol/sdk/server/mcp.js");
 const logger_1 = require("../../lib/logger");
+const registered_tools_1 = require("./registered-tools");
 const server_tools_1 = require("./server-tools");
 let server = null;
 /**
@@ -28,7 +29,7 @@ async function createHumanQueueServer(options) {
     const name = options?.name || 'long-tail-human-queue';
     server = new mcp_js_1.McpServer({ name, version: '1.0.0' });
     (0, server_tools_1.registerHumanQueueTools)(server);
-    logger_1.loggerRegistry.info(`[lt-mcp:server] ${name} ready (5 tools registered)`);
+    logger_1.loggerRegistry.info(`[lt-mcp:server] ${name} ready (${(0, registered_tools_1.registeredToolCount)(server)} tools registered)`);
     return server;
 }
 /**

package/build/services/role/index.js

@@ -19,6 +19,7 @@ exports.getRoleFormSchema = getRoleFormSchema;
 exports.getRoleMetadataSchema = getRoleMetadataSchema;
 exports.getRoleProperties = getRoleProperties;
 exports.deleteRole = deleteRole;
+const list_schema_1 = require("../../shared/list-schema");
 const db_1 = require("../../lib/db");
 const user_1 = require("../user");
 const sql_1 = require("./sql");
@@ -128,6 +129,11 @@ async function createRole(role) {
  * resets to {}). One atomic UPDATE — see UPDATE_ROLE_METADATA.
  */
 async function updateRoleMetadata(role, input) {
+    if (input.list_schema != null) {
+        const listSchemaError = (0, list_schema_1.listSchemaRelationsError)(input.list_schema);
+        if (listSchemaError)
+            throw new Error(`list_schema: ${listSchemaError}`);
+    }
     const pool = (0, db_1.getPool)();
     const provided = (key) => input[key] !== undefined;
     const upstreams = [...new Set(input.upstream_roles ?? [])].sort();

package/build/services/role/seed.js

@@ -9,6 +9,7 @@ const logger_1 = require("../../lib/logger");
 const index_1 = require("./index");
 const sql_1 = require("./sql");
 const badge_grant_1 = require("./badge-grant");
+const list_schema_1 = require("../../shared/list-schema");
 const types_1 = require("./types");
 /** Recorded on schema snapshots written by the startup apply. */
 exports.STARTUP_CHANGE_SUMMARY = 'startup apply (code)';
@@ -84,6 +85,9 @@ async function applyRoleConfig(cfg, codeOwned) {
     const grantError = (0, badge_grant_1.badgeGrantError)(cfg.properties?.[types_1.ROLE_PROPERTY_KEYS.BADGE_GRANT]);
     if (grantError)
         throw new Error(`role ${cfg.role}: ${grantError}`);
+    const listSchemaError = cfg.list_schema != null ? (0, list_schema_1.listSchemaRelationsError)(cfg.list_schema) : null;
+    if (listSchemaError)
+        throw new Error(`role ${cfg.role}: list_schema: ${listSchemaError}`);
     const created = await (0, index_1.createRole)(cfg.role);
     const pool = (0, db_1.getPool)();
     const { rows } = await pool.query(sql_1.GET_ROLE_ROW, [cfg.role]);

package/build/services/scan-code/validate-facts.d.ts

@@ -1,5 +1,5 @@
 import { type ScanStep } from '../../types';
 /** The most facts a station screen states before it reads as a data dump. */
 export declare const SCAN_FACTS_MAX = 12;
-/** `facts` on a present step: labeled template values the station states. */
+/** `facts` on a present step: labeled template values the station states, optionally formatted. */
 export declare function assertValidFacts(step: ScanStep, at: string): void;

package/build/services/scan-code/validate-facts.js

@@ -3,9 +3,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.SCAN_FACTS_MAX = void 0;
 exports.assertValidFacts = assertValidFacts;
 const types_1 = require("../../types");
+const FACT_FORMATS = new Set(Object.values(types_1.SCAN_FACT_FORMATS));
+/** A formatted fact reads one value: a single `{bag.key}` token. */
+const SINGLE_TOKEN = /^\{[a-z]+\.[^{}]+\}$/;
 /** The most facts a station screen states before it reads as a data dump. */
 exports.SCAN_FACTS_MAX = 12;
-/** `facts` on a present step: labeled template values the station states. */
+/** `facts` on a present step: labeled template values the station states, optionally formatted. */
 function assertValidFacts(step, at) {
     if (step.facts === undefined)
         return;
@@ -20,5 +23,13 @@ function assertValidFacts(step, at) {
         }
         if (typeof fact.value !== 'string')
             throw new Error(`${at}: facts[${i}].value must be a template string`);
+        if (fact.format === undefined)
+            return;
+        if (!FACT_FORMATS.has(fact.format)) {
+            throw new Error(`${at}: facts[${i}].format must be one of ${[...FACT_FORMATS].join(', ')}`);
+        }
+        if (!SINGLE_TOKEN.test(fact.value.trim())) {
+            throw new Error(`${at}: facts[${i}] with a format must read a single token, e.g. {item.releaseAt}`);
+        }
     });
 }

package/build/services/workflow-invocation.d.ts

@@ -53,7 +53,20 @@ export declare class InvocationError extends Error {
  */
 export declare function invokeWorkflow(input: InvokeWorkflowInput): Promise<InvokeWorkflowResult>;
 /**
- * Check invocation_roles when present on a workflow config.
- * Throws InvocationError if the user lacks the required role.
+ * Check a caller against the workflow's invocation rules, from the caller's
+ * live grants rather than any role claim a token carries. A workflow with no
+ * invocation roles is open, except a system-authority workflow, which needs a
+ * superadmin.
  */
-export declare function checkInvocationRoles(workflowType: string, userId: string, authRole?: string): Promise<void>;
+export declare function checkInvocationRoles(workflowType: string, userId: string): Promise<void>;
+/** Refuse an execute_as override that would exceed the caller's own authority. */
+export declare function assertMayActAs(userId: string, executeAs: string): Promise<void>;
+/**
+ * Authorize an invocation that arrives from outside the process (REST, /mcp):
+ * the workflow's invocation rules, then any execute_as override.
+ */
+export declare function authorizeInvocation(input: {
+    workflowType: string;
+    userId: string;
+    executeAs?: string;
+}): Promise<void>;

package/build/services/workflow-invocation.js

@@ -45,8 +45,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.InvocationError = void 0;
 exports.invokeWorkflow = invokeWorkflow;
 exports.checkInvocationRoles = checkInvocationRoles;
+exports.assertMayActAs = assertMayActAs;
+exports.authorizeInvocation = authorizeInvocation;
 const hotmesh_1 = require("@hotmeshio/hotmesh");
 const invocation_access_1 = require("./invocation-access");
+const uuid_1 = require("../lib/uuid");
 const workers_1 = require("../workers");
 const configService = __importStar(require("./config"));
 const userService = __importStar(require("./user"));
@@ -138,26 +141,55 @@ async function resolveTaskQueue(workflowType) {
     }
     return worker.taskQueue;
 }
+/** A principal's grants by uuid or external_id, or null when no such user exists. */
+async function grantsOf(identifier) {
+    const user = (0, uuid_1.isUuid)(identifier)
+        ? await userService.getUser(identifier)
+        : await userService.getUserByExternalId(identifier);
+    return user ? user.roles.map((r) => ({ role: r.role, type: r.type })) : null;
+}
 /**
- * Check invocation_roles when present on a workflow config.
- * Throws InvocationError if the user lacks the required role.
+ * Check a caller against the workflow's invocation rules, from the caller's
+ * live grants rather than any role claim a token carries. A workflow with no
+ * invocation roles is open, except a system-authority workflow, which needs a
+ * superadmin.
  */
-async function checkInvocationRoles(workflowType, userId, authRole) {
+async function checkInvocationRoles(workflowType, userId) {
     const wfConfig = await configService.getWorkflowConfig(workflowType);
-    if (!wfConfig || wfConfig.invocation_roles.length === 0)
-        return;
-    // Superadmin from JWT bypasses all invocation role checks
-    if (authRole === 'superadmin')
+    const systemAuthority = invocation_access_1.SYSTEM_AUTHORITY_WORKFLOWS.has(workflowType);
+    if (!systemAuthority && (!wfConfig || wfConfig.invocation_roles.length === 0))
         return;
-    const user = await userService.getUser(userId);
-    if (!user) {
+    const roles = await grantsOf(userId);
+    if (!roles) {
         throw new InvocationError('User not registered', 403);
     }
     // invocable is resolveTaskQueue's concern; this gate decides roles only.
-    if (!(0, invocation_access_1.canInvokeWorkflow)({ ...wfConfig, invocable: true }, user.roles, authRole)) {
+    const rules = { workflow_type: workflowType, invocation_roles: wfConfig?.invocation_roles ?? [], invocable: true };
+    if (!(0, invocation_access_1.canInvokeWorkflow)(rules, roles)) {
         throw new InvocationError('Insufficient role for invocation', 403);
     }
 }
+/** Refuse an execute_as override that would exceed the caller's own authority. */
+async function assertMayActAs(userId, executeAs) {
+    const caller = await grantsOf(userId);
+    if (!caller)
+        throw new InvocationError('User not registered', 403);
+    const target = await grantsOf(executeAs);
+    if (!target)
+        throw new InvocationError(`execute_as principal "${executeAs}" not found`, 404);
+    if (!(0, invocation_access_1.mayActAs)(caller, target)) {
+        throw new InvocationError('execute_as may not exceed your own authority', 403);
+    }
+}
+/**
+ * Authorize an invocation that arrives from outside the process (REST, /mcp):
+ * the workflow's invocation rules, then any execute_as override.
+ */
+async function authorizeInvocation(input) {
+    await checkInvocationRoles(input.workflowType, input.userId);
+    if (input.executeAs)
+        await assertMayActAs(input.userId, input.executeAs);
+}
 /**
  * Build the LTEnvelope with IAM context.
  */

package/build/services/yaml-workflow/deployer.d.ts

@@ -27,10 +27,18 @@ export declare function deployYamlWorkflow(appId: string, yamlContent: string):
  * Activate a deployed version of a YAML workflow.
  */
 export declare function activateYamlWorkflow(appId: string, version: string): Promise<boolean>;
+/** The key compiled workflow activities read their identity context from. */
+export declare const SCOPE_KEY = "_scope";
+/**
+ * The trigger data a compiled workflow starts with. Identity context is never
+ * taken from the data a caller supplied: any `_scope` there is dropped, and
+ * only the scope the server resolved is set.
+ */
+export declare function withTrustedScope(data: Record<string, unknown>, scope?: Record<string, unknown>): Record<string, unknown>;
 /**
  * Invoke a YAML workflow (fire-and-forget). Returns the job ID.
  */
-export declare function invokeYamlWorkflow(appId: string, topic: string, data: Record<string, unknown>, entity?: string, context?: Record<string, any>): Promise<string>;
+export declare function invokeYamlWorkflow(appId: string, topic: string, data: Record<string, unknown>, entity?: string, context?: Record<string, any>, scope?: Record<string, unknown>): Promise<string>;
 /**
  * Invoke a YAML workflow and wait for the result.
  *
@@ -40,7 +48,7 @@ export declare function invokeYamlWorkflow(appId: string, topic: string, data: R
  *
  * Source: @hotmeshio/hotmesh engine/index.js pubsub()
  */
-export declare function invokeYamlWorkflowSync(appId: string, topic: string, data: Record<string, unknown>, timeout?: number, entity?: string): Promise<{
+export declare function invokeYamlWorkflowSync(appId: string, topic: string, data: Record<string, unknown>, timeout?: number, entity?: string, scope?: Record<string, unknown>): Promise<{
     job_id: string;
     result: Record<string, unknown>;
 }>;

package/build/services/yaml-workflow/deployer.js

@@ -33,11 +33,12 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.buildMergedYaml = void 0;
+exports.SCOPE_KEY = exports.buildMergedYaml = void 0;
 exports.getEngine = getEngine;
 exports.deployAppId = deployAppId;
 exports.deployYamlWorkflow = deployYamlWorkflow;
 exports.activateYamlWorkflow = activateYamlWorkflow;
+exports.withTrustedScope = withTrustedScope;
 exports.invokeYamlWorkflow = invokeYamlWorkflow;
 exports.invokeYamlWorkflowSync = invokeYamlWorkflowSync;
 exports.stopEngine = stopEngine;
@@ -142,12 +143,23 @@ async function activateYamlWorkflow(appId, version) {
     logger_1.loggerRegistry.info(`[yaml-workflow] activated ${appId} v${version}`);
     return result;
 }
+/** The key compiled workflow activities read their identity context from. */
+exports.SCOPE_KEY = '_scope';
+/**
+ * The trigger data a compiled workflow starts with. Identity context is never
+ * taken from the data a caller supplied: any `_scope` there is dropped, and
+ * only the scope the server resolved is set.
+ */
+function withTrustedScope(data, scope) {
+    const { [exports.SCOPE_KEY]: _dropped, ...rest } = data ?? {};
+    return scope ? { ...rest, [exports.SCOPE_KEY]: scope } : rest;
+}
 /**
  * Invoke a YAML workflow (fire-and-forget). Returns the job ID.
  */
-async function invokeYamlWorkflow(appId, topic, data, entity, context) {
+async function invokeYamlWorkflow(appId, topic, data, entity, context, scope) {
     const engine = await getEngine(appId);
-    return engine.pub(topic, data, context, entity ? { entity } : undefined);
+    return engine.pub(topic, withTrustedScope(data, scope), context, entity ? { entity } : undefined);
 }
 /**
  * Invoke a YAML workflow and wait for the result.
@@ -158,7 +170,7 @@ async function invokeYamlWorkflow(appId, topic, data, entity, context) {
  *
  * Source: @hotmeshio/hotmesh engine/index.js pubsub()
  */
-async function invokeYamlWorkflowSync(appId, topic, data, timeout, entity) {
+async function invokeYamlWorkflowSync(appId, topic, data, timeout, entity, scope) {
     const hotmesh = await getEngine(appId);
     const engine = hotmesh.engine;
     const timeoutMs = timeout ?? defaults_1.WORKFLOW_SYNC_TIMEOUT_MS;
@@ -171,7 +183,7 @@ async function invokeYamlWorkflowSync(appId, topic, data, timeout, entity) {
     };
     // Publish with entity via extended param
     const extended = entity ? { entity } : undefined;
-    const jobId = await engine.pub(topic, data, context, extended);
+    const jobId = await engine.pub(topic, withTrustedScope(data, scope), context, extended);
     return new Promise((resolve, reject) => {
         engine.registerJobCallback(jobId, (_topic, output) => {
             if (output.metadata.err) {

package/build/services/yaml-workflow/invoke.js

@@ -37,36 +37,37 @@ exports.invokeYamlWorkflow = invokeYamlWorkflow;
 const yamlDeployer = __importStar(require("./deployer"));
 const principal_1 = require("../iam/principal");
 const publish_1 = require("../../lib/events/publish");
+/**
+ * The identity context compiled workflow activities run under, from the
+ * server-side identity: execute_as with the invoker as initiator, else the
+ * invoker. Never read from the caller's data.
+ */
+async function resolveScope(executeAs, userId) {
+    if (executeAs) {
+        const [botPrincipal, invokerPrincipal] = await Promise.all([
+            (0, principal_1.resolvePrincipal)(executeAs),
+            userId ? (0, principal_1.resolvePrincipal)(userId) : Promise.resolve(null),
+        ]);
+        if (!botPrincipal)
+            return undefined;
+        return {
+            principal: botPrincipal,
+            scopes: ['mcp:tool:call'],
+            ...(invokerPrincipal ? { initiatedBy: userId, initiatingPrincipal: invokerPrincipal } : {}),
+        };
+    }
+    if (!userId)
+        return undefined;
+    const principal = await (0, principal_1.resolvePrincipal)(userId);
+    return principal ? { principal, scopes: ['mcp:tool:call'] } : undefined;
+}
 /**
  * Invoke a YAML workflow with scope injection.
  * Shared by HTTP route and cron callback.
  */
 async function invokeYamlWorkflow(wf, options = {}) {
     const data = { ...(options.data || {}) };
-    // Inject _scope so compiled workflow activities have identity context
-    if (!data._scope) {
-        const executeAs = options.execute_as;
-        const userId = options.userId;
-        if (executeAs) {
-            const [botPrincipal, invokerPrincipal] = await Promise.all([
-                (0, principal_1.resolvePrincipal)(executeAs),
-                userId ? (0, principal_1.resolvePrincipal)(userId) : Promise.resolve(null),
-            ]);
-            if (botPrincipal) {
-                data._scope = {
-                    principal: botPrincipal,
-                    scopes: ['mcp:tool:call'],
-                    ...(invokerPrincipal ? { initiatedBy: userId, initiatingPrincipal: invokerPrincipal } : {}),
-                };
-            }
-        }
-        else if (userId) {
-            const principal = await (0, principal_1.resolvePrincipal)(userId);
-            if (principal) {
-                data._scope = { principal, scopes: ['mcp:tool:call'] };
-            }
-        }
-    }
+    const scope = await resolveScope(options.execute_as, options.userId);
     if (options.source) {
         if (!data._metadata)
             data._metadata = {};
@@ -85,7 +86,7 @@ async function invokeYamlWorkflow(wf, options = {}) {
             status: 'running',
         });
         try {
-            const { job_id, result } = await yamlDeployer.invokeYamlWorkflowSync(wf.app_id, wf.graph_topic, data, options.timeout, wf.graph_topic);
+            const { job_id, result } = await yamlDeployer.invokeYamlWorkflowSync(wf.app_id, wf.graph_topic, data, options.timeout, wf.graph_topic, scope);
             (0, publish_1.publishWorkflowEvent)({
                 type: 'workflow.completed',
                 source: 'graph',
@@ -121,7 +122,7 @@ async function invokeYamlWorkflow(wf, options = {}) {
             },
         }
         : undefined;
-    const jobId = await yamlDeployer.invokeYamlWorkflow(wf.app_id, wf.graph_topic, data, wf.graph_topic, context);
+    const jobId = await yamlDeployer.invokeYamlWorkflow(wf.app_id, wf.graph_topic, data, wf.graph_topic, context, scope);
     (0, publish_1.publishWorkflowEvent)({
         type: 'workflow.started',
         source: 'graph',

package/build/shared/form-validation/x-lt-scan.d.ts

@@ -10,6 +10,8 @@ export interface ScanSink {
     expectError: string;
     /** Array fields: 'count' takes a value as many times as it is expected. */
     multiplicity: 'count' | 'once';
+    /** Array fields: the instruction shown while the field is empty. */
+    prompt?: string;
 }
 /** The parts of a parsed scan a sink reads. */
 export interface SinkScan {
@@ -30,6 +32,12 @@ export declare function resolveScanExpected(sink: ScanSink, ctx: Record<string,
  * each expected value once (or as many times as expected, with 'count').
  */
 export declare function scanSinkError(value: unknown, fieldSchema: Schema | undefined, ctx: Record<string, unknown> | undefined): string | undefined;
+/**
+ * How many scans complete an array field: the scans its expected list admits
+ * (each listing under 'count', each distinct value otherwise), else
+ * `maxItems`, else null. The checklist and the admission gate share it.
+ */
+export declare function scanTargetCount(fieldSchema: Schema | undefined, ctx: Record<string, unknown> | undefined): number | null;
 /** What a scan does to a field: the next value, or the error to show (nothing written). */
 export declare function applyScanToField(current: unknown, scan: SinkScan, fieldSchema: Schema, ctx: Record<string, unknown> | undefined): {
     ok: true;