@hotmeshio/long-tail 0.23.1 → 0.24.0

package/build/system/mcp-servers/admin/escalations.js

@@ -38,20 +38,9 @@ const escalationService = __importStar(require("../../../services/escalation"));
 const escalationApi = __importStar(require("../../../api/escalations"));
 const escalationMetaApi = __importStar(require("../../../api/escalations/metadata"));
 const escalationBulkApi = __importStar(require("../../../api/escalations/bulk"));
-const iam_1 = require("../../../services/iam");
+const caller_auth_1 = require("../caller-auth");
+const helpers_1 = require("../../../api/escalations/helpers");
 const schemas_1 = require("./schemas");
-let systemPrincipalId = null;
-/**
- * Resolve (and cache) the lt-system bot's real UUID. The escalation RBAC helpers
- * query the uuid `user_id` column, so the external_id string 'lt-system' would
- * raise `invalid input syntax for type uuid`. The bot is a superadmin, so it has
- * global escalation access.
- */
-async function systemAuth() {
-    if (!systemPrincipalId)
-        systemPrincipalId = await (0, iam_1.ensureSystemBot)();
-    return { userId: systemPrincipalId, role: 'superadmin' };
-}
 /** Project the full escalation record to the MCP-facing shape, including metadata. */
 function projectEscalation(e) {
     return {
@@ -87,7 +76,7 @@ function registerEscalationTools(server) {
             '(no status filter required). Returns full records including metadata, workflow linkage, ' +
             'assignment, and signal_key.',
         inputSchema: schemas_1.findEscalationsSchema,
-    }, async (args) => {
+    }, async (args, extra) => {
         const result = await escalationApi.listEscalations({
             status: args.status,
             role: args.role,
@@ -108,7 +97,7 @@ function registerEscalationTools(server) {
             exists: args.exists,
             available: args.available,
             orderBy: args.orderBy,
-        }, await systemAuth());
+        }, await (0, caller_auth_1.callerAuth)(extra));
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
         }
@@ -130,8 +119,8 @@ function registerEscalationTools(server) {
         description: 'Get a single escalation by ID — the full record including metadata, envelope ' +
             'linkage, resolver/escalation payloads, signal_key, and assignment state.',
         inputSchema: schemas_1.getEscalationSchema,
-    }, async (args) => {
-        const result = await escalationApi.getEscalation({ id: args.id }, await systemAuth());
+    }, async (args, extra) => {
+        const result = await escalationApi.getEscalation({ id: args.id }, await (0, caller_auth_1.callerAuth)(extra));
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
         }
@@ -143,8 +132,8 @@ function registerEscalationTools(server) {
         description: 'List all escalations linked to a specific workflow ID, newest first. Returns ' +
             'full records including metadata.',
         inputSchema: schemas_1.getEscalationsByWorkflowSchema,
-    }, async (args) => {
-        const result = await escalationApi.getEscalationsByWorkflowId({ workflowId: args.workflow_id });
+    }, async (args, extra) => {
+        const result = await escalationApi.getEscalationsByWorkflowId({ workflowId: args.workflow_id }, (0, caller_auth_1.externalCaller)(extra));
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
         }
@@ -156,7 +145,15 @@ function registerEscalationTools(server) {
         description: 'Aggregated escalation statistics: pending, claimed, created, ' +
             'resolved counts with breakdown by role and type.',
         inputSchema: schemas_1.getEscalationStatsSchema,
-    }, async (args) => {
+    }, async (args, extra) => {
+        const caller = (0, caller_auth_1.externalCaller)(extra);
+        if (caller) {
+            const result = await escalationApi.getEscalationStats({ period: args.period }, caller);
+            if (result.error) {
+                return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
+            }
+            return { content: [{ type: 'text', text: JSON.stringify(result.data) }] };
+        }
         const stats = await escalationService.getEscalationStats(undefined, args.period);
         return {
             content: [{ type: 'text', text: JSON.stringify(stats) }],
@@ -168,8 +165,8 @@ function registerEscalationTools(server) {
         description: 'Find escalations by a metadata key-value pair (e.g. a correlation key written ' +
             'into metadata when the escalation was raised).',
         inputSchema: schemas_1.findByMetadataSchema,
-    }, async (args) => {
-        const result = await escalationMetaApi.findByMetadata(args, await systemAuth());
+    }, async (args, extra) => {
+        const result = await escalationMetaApi.findByMetadata(args, await (0, caller_auth_1.callerAuth)(extra));
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
         }
@@ -183,8 +180,8 @@ function registerEscalationTools(server) {
             'reserved so no one else picks it up. If the claim expires, ' +
             'the escalation returns to the queue.',
         inputSchema: schemas_1.claimEscalationSchema,
-    }, async (args) => {
-        const result = await escalationApi.claimEscalation({ id: args.id, durationMinutes: args.duration_minutes }, await systemAuth());
+    }, async (args, extra) => {
+        const result = await escalationApi.claimEscalation({ id: args.id, durationMinutes: args.duration_minutes }, await (0, caller_auth_1.callerAuth)(extra));
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
         }
@@ -196,8 +193,8 @@ function registerEscalationTools(server) {
         description: 'Release a claimed escalation back to the available pool. Reverses a ' +
             'claim_escalation so another holder can pick it up.',
         inputSchema: schemas_1.releaseEscalationSchema,
-    }, async (args) => {
-        const result = await escalationApi.releaseEscalation({ id: args.id }, await systemAuth());
+    }, async (args, extra) => {
+        const result = await escalationApi.releaseEscalation({ id: args.id }, await (0, caller_auth_1.callerAuth)(extra));
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
         }
@@ -211,8 +208,8 @@ function registerEscalationTools(server) {
             'legacy paths signal via routing metadata or re-run the original workflow. ' +
             'Password fields in the payload are replaced with ephemeral tokens.',
         inputSchema: schemas_1.resolveEscalationSchema,
-    }, async (args) => {
-        const result = await escalationApi.resolveEscalation({ id: args.id, resolverPayload: args.resolverPayload }, await systemAuth());
+    }, async (args, extra) => {
+        const result = await escalationApi.resolveEscalation({ id: args.id, resolverPayload: args.resolverPayload }, await (0, caller_auth_1.callerAuth)(extra));
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
         }
@@ -226,11 +223,11 @@ function registerEscalationTools(server) {
             'workflow with the ordered collection. A reciprocal row is written in the same statement, both or neither. ' +
             'initiatedBy credits the person the add is for.',
         inputSchema: schemas_1.accumulateItemSchema,
-    }, async (args) => {
+    }, async (args, extra) => {
         const result = await escalationApi.accumulateItem({
             id: args.id, itemKey: args.itemKey, payload: args.payload, metadata: args.metadata,
             reciprocal: args.reciprocal, initiatedBy: args.initiatedBy,
-        }, await systemAuth());
+        }, await (0, caller_auth_1.callerAuth)(extra));
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error, ...(result.data ?? {}) }) }], isError: true };
         }
@@ -242,8 +239,8 @@ function registerEscalationTools(server) {
         description: 'Remove ONE held item from a pending open accumulator escalation. The row stays pending and the ' +
             'waiting workflow is never woken. initiatedBy credits the person the removal is for.',
         inputSchema: schemas_1.removeItemSchema,
-    }, async (args) => {
-        const result = await escalationApi.removeItem({ id: args.id, itemKey: args.itemKey, reciprocal: args.reciprocal, initiatedBy: args.initiatedBy }, await systemAuth());
+    }, async (args, extra) => {
+        const result = await escalationApi.removeItem({ id: args.id, itemKey: args.itemKey, reciprocal: args.reciprocal, initiatedBy: args.initiatedBy }, await (0, caller_auth_1.callerAuth)(extra));
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error, ...(result.data ?? {}) }) }], isError: true };
         }
@@ -254,13 +251,13 @@ function registerEscalationTools(server) {
         title: 'Get Escalation Items',
         description: 'The held items of an accumulator or batch escalation in arrival order, with the count and max.',
         inputSchema: schemas_1.getEscalationItemsSchema,
-    }, async (args) => {
+    }, async (args, extra) => {
         if (!args.id && !args.signalKey) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: 'id or signalKey is required' }) }], isError: true };
         }
         const result = args.id
-            ? await escalationApi.getEscalationItems({ id: args.id }, await systemAuth())
-            : await escalationApi.getEscalationItemsBySignalKey({ signalKey: args.signalKey }, await systemAuth());
+            ? await escalationApi.getEscalationItems({ id: args.id }, await (0, caller_auth_1.callerAuth)(extra))
+            : await escalationApi.getEscalationItemsBySignalKey({ signalKey: args.signalKey }, await (0, caller_auth_1.callerAuth)(extra));
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
         }
@@ -273,8 +270,8 @@ function registerEscalationTools(server) {
             'waiting workflow in place. For callers that know the deterministic signal id and want ' +
             'to skip the id lookup.',
         inputSchema: schemas_1.resolveBySignalKeySchema,
-    }, async (args) => {
-        const result = await escalationApi.resolveBySignalKey({ signalKey: args.signalKey, resolverPayload: args.resolverPayload }, await systemAuth());
+    }, async (args, extra) => {
+        const result = await escalationApi.resolveBySignalKey({ signalKey: args.signalKey, resolverPayload: args.resolverPayload }, await (0, caller_auth_1.callerAuth)(extra));
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
         }
@@ -287,8 +284,8 @@ function registerEscalationTools(server) {
             'callers may only resolve rows whose role they hold. For bookkeeping rows woken ' +
             'collectively (no per-row signal delivery).',
         inputSchema: schemas_1.resolveByIdsSchema,
-    }, async (args) => {
-        const result = await escalationApi.resolveByIds({ ids: args.ids, resolverPayload: args.resolverPayload, metadata: args.metadata }, await systemAuth());
+    }, async (args, extra) => {
+        const result = await escalationApi.resolveByIds({ ids: args.ids, resolverPayload: args.resolverPayload, metadata: args.metadata }, await (0, caller_auth_1.callerAuth)(extra));
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
         }
@@ -300,8 +297,8 @@ function registerEscalationTools(server) {
         description: 'Faceted search over a pond, scoped to the caller\'s role. Filter by status, ' +
             'availability, and metadata facets; sort by columns; page with limit/offset.',
         inputSchema: schemas_1.searchByFacetsSchema,
-    }, async (args) => {
-        const result = await escalationApi.searchByFacets(args, await systemAuth());
+    }, async (args, extra) => {
+        const result = await escalationApi.searchByFacets(args, await (0, caller_auth_1.callerAuth)(extra));
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
         }
@@ -318,8 +315,8 @@ function registerEscalationTools(server) {
             'each group. One call replaces N per-filter count round-trips. The filter takes the WHAT ' +
             'fields only — status/available/jeopardy are rejected (liveness derives from the measure).',
         inputSchema: schemas_1.aggregateByFacetsSchema,
-    }, async (args) => {
-        const result = await escalationApi.aggregateByFacets(args, await systemAuth());
+    }, async (args, extra) => {
+        const result = await escalationApi.aggregateByFacets(args, await (0, caller_auth_1.callerAuth)(extra));
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
         }
@@ -334,8 +331,8 @@ function registerEscalationTools(server) {
             'intervals are untracked time and are preserved, not filled. The entity facet value ' +
             'must be stored as a JSON string (GIN containment match).',
         inputSchema: schemas_1.timelineByFacetSchema,
-    }, async (args) => {
-        const result = await escalationApi.timelineByFacet(args, await systemAuth());
+    }, async (args, extra) => {
+        const result = await escalationApi.timelineByFacet(args, await (0, caller_auth_1.callerAuth)(extra));
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
         }
@@ -347,8 +344,8 @@ function registerEscalationTools(server) {
         description: 'Batch-claim complete origin groups (orders) in priority order over a pond, ' +
             'assigned to the calling principal. RBAC-scoped to the pond role.',
         inputSchema: schemas_1.claimGroupsSchema,
-    }, async (args) => {
-        const result = await escalationApi.claimGroups({ query: args.query, limit: args.limit, durationMinutes: args.durationMinutes, sizeFacet: args.sizeFacet }, await systemAuth());
+    }, async (args, extra) => {
+        const result = await escalationApi.claimGroups({ query: args.query, limit: args.limit, durationMinutes: args.durationMinutes, sizeFacet: args.sizeFacet }, await (0, caller_auth_1.callerAuth)(extra));
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
         }
@@ -361,8 +358,8 @@ function registerEscalationTools(server) {
             'assigned to the calling principal. With allOrNone, commits only the full set. ' +
             'RBAC-scoped to the pond role.',
         inputSchema: schemas_1.claimByFacetsSchema,
-    }, async (args) => {
-        const result = await escalationApi.claimByFacets({ query: args.query, limit: args.limit, durationMinutes: args.durationMinutes, allOrNone: args.allOrNone }, await systemAuth());
+    }, async (args, extra) => {
+        const result = await escalationApi.claimByFacets({ query: args.query, limit: args.limit, durationMinutes: args.durationMinutes, allOrNone: args.allOrNone }, await (0, caller_auth_1.callerAuth)(extra));
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
         }
@@ -374,8 +371,8 @@ function registerEscalationTools(server) {
         description: 'Route a pending escalation to a different role (per the escalation chain). The new ' +
             'role becomes responsible for resolving it.',
         inputSchema: schemas_1.escalateEscalationSchema,
-    }, async (args) => {
-        const result = await escalationApi.escalateToRole({ id: args.id, targetRole: args.targetRole }, await systemAuth());
+    }, async (args, extra) => {
+        const result = await escalationApi.escalateToRole({ id: args.id, targetRole: args.targetRole }, await (0, caller_auth_1.callerAuth)(extra));
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
         }
@@ -387,8 +384,8 @@ function registerEscalationTools(server) {
         description: 'Permanently cancel a pending escalation — used when the tied workflow has ' +
             'terminated and can never receive the resolution signal. Preserved for audit.',
         inputSchema: schemas_1.cancelEscalationSchema,
-    }, async (args) => {
-        const result = await escalationApi.cancelSingleEscalation({ id: args.id }, await systemAuth());
+    }, async (args, extra) => {
+        const result = await escalationApi.cancelSingleEscalation({ id: args.id }, await (0, caller_auth_1.callerAuth)(extra));
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
         }
@@ -413,7 +410,14 @@ function registerEscalationTools(server) {
             'Each escalation is marked resolved with needsTriage=true, then ' +
             'a triage workflow is started to remediate the issue.',
         inputSchema: schemas_1.bulkTriageSchema,
-    }, async (args) => {
+    }, async (args, extra) => {
+        const caller = (0, caller_auth_1.externalCaller)(extra);
+        if (caller) {
+            const perm = await (0, helpers_1.checkBulkPermission)(caller.userId, args.ids);
+            if (!perm.allowed) {
+                return { content: [{ type: 'text', text: JSON.stringify({ error: perm.error }) }], isError: true };
+            }
+        }
         const resolved = await escalationService.bulkResolveForTriage(args.ids, args.hint);
         return {
             content: [{
@@ -430,8 +434,8 @@ function registerEscalationTools(server) {
         title: 'Claim by Metadata',
         description: 'Find and claim an escalation by metadata key-value pair.',
         inputSchema: schemas_1.claimByMetadataSchema,
-    }, async (args) => {
-        const result = await escalationMetaApi.claimByMetadata(args, await systemAuth());
+    }, async (args, extra) => {
+        const result = await escalationMetaApi.claimByMetadata(args, await (0, caller_auth_1.callerAuth)(extra));
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
         }
@@ -442,8 +446,8 @@ function registerEscalationTools(server) {
         title: 'Resolve by Metadata',
         description: 'Find and resolve an escalation by metadata key-value pair.',
         inputSchema: schemas_1.resolveByMetadataSchema,
-    }, async (args) => {
-        const result = await escalationMetaApi.resolveByMetadata(args, await systemAuth());
+    }, async (args, extra) => {
+        const result = await escalationMetaApi.resolveByMetadata(args, await (0, caller_auth_1.callerAuth)(extra));
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
         }
@@ -455,8 +459,8 @@ function registerEscalationTools(server) {
         title: 'Bulk Claim',
         description: 'Claim multiple escalations in a single operation.',
         inputSchema: schemas_1.bulkClaimSchema,
-    }, async (args) => {
-        const result = await escalationBulkApi.bulkClaim(args, await systemAuth());
+    }, async (args, extra) => {
+        const result = await escalationBulkApi.bulkClaim(args, await (0, caller_auth_1.callerAuth)(extra));
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
         }
@@ -467,8 +471,8 @@ function registerEscalationTools(server) {
         title: 'Bulk Assign',
         description: 'Assign multiple escalations to a specific user. Rows under a live claim are skipped unless reassign=true (the admin takeover).',
         inputSchema: schemas_1.bulkAssignSchema,
-    }, async (args) => {
-        const result = await escalationBulkApi.bulkAssign(args, await systemAuth());
+    }, async (args, extra) => {
+        const result = await escalationBulkApi.bulkAssign(args, await (0, caller_auth_1.callerAuth)(extra));
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
         }
@@ -479,8 +483,8 @@ function registerEscalationTools(server) {
         title: 'Bulk Unassign',
         description: 'Return claimed escalations to the available pool — the admin override of a live claim. Unclaimed and terminal rows are skipped.',
         inputSchema: schemas_1.bulkUnassignSchema,
-    }, async (args) => {
-        const result = await escalationBulkApi.bulkUnassign(args, await systemAuth());
+    }, async (args, extra) => {
+        const result = await escalationBulkApi.bulkUnassign(args, await (0, caller_auth_1.callerAuth)(extra));
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
         }
@@ -491,8 +495,8 @@ function registerEscalationTools(server) {
         title: 'Bulk Escalate',
         description: 'Escalate multiple escalations to a different role.',
         inputSchema: schemas_1.bulkEscalateSchema,
-    }, async (args) => {
-        const result = await escalationBulkApi.bulkEscalate(args, await systemAuth());
+    }, async (args, extra) => {
+        const result = await escalationBulkApi.bulkEscalate(args, await (0, caller_auth_1.callerAuth)(extra));
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
         }
@@ -503,8 +507,8 @@ function registerEscalationTools(server) {
         title: 'Bulk Cancel',
         description: 'Cancel multiple pending escalations in a single operation.',
         inputSchema: schemas_1.bulkCancelSchema,
-    }, async (args) => {
-        const result = await escalationApi.bulkCancel(args, await systemAuth());
+    }, async (args, extra) => {
+        const result = await escalationApi.bulkCancel(args, await (0, caller_auth_1.callerAuth)(extra));
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
         }
@@ -515,8 +519,8 @@ function registerEscalationTools(server) {
         title: 'Update Priority',
         description: 'Update the priority of multiple escalations.',
         inputSchema: schemas_1.updatePrioritySchema,
-    }, async (args) => {
-        const result = await escalationBulkApi.updatePriority(args, await systemAuth());
+    }, async (args, extra) => {
+        const result = await escalationBulkApi.updatePriority(args, await (0, caller_auth_1.callerAuth)(extra));
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
         }

package/build/system/mcp-servers/admin/exports.js

@@ -36,6 +36,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerExportTools = registerExportTools;
 const api = __importStar(require("../../../api/exports"));
 const pick_1 = require("../../../lib/json-path/pick");
+const capabilities_1 = require("../../../modules/capabilities");
+const caller_auth_1 = require("../caller-auth");
+const run_read_1 = require("./run-read");
 const schemas_1 = require("./schemas");
 function registerExportTools(server) {
     // mirrors GET /api/workflow-states/jobs
@@ -76,7 +79,10 @@ function registerExportTools(server) {
             'Useful for debugging and workflow compilation. Histories run large — ' +
             'pass select (dot paths) to return only what you need.',
         inputSchema: schemas_1.exportWorkflowExecutionSchema,
-    }, async (args) => {
+    }, async (args, extra) => {
+        if (!(await (0, capabilities_1.mayReadWorkflowRun)(await (0, caller_auth_1.callerAuth)(extra), args.workflow_id))) {
+            return { content: [{ type: 'text', text: JSON.stringify({ error: run_read_1.RUN_READ_DENIED }) }], isError: true };
+        }
         const result = await api.exportWorkflowExecution({
             workflowId: args.workflow_id,
             excludeSystem: args.excludeSystem,

package/build/system/mcp-servers/admin/index.js

@@ -39,6 +39,7 @@ exports.stopAdminServer = stopAdminServer;
  */
 const mcp_js_1 = require("@modelcontextprotocol/sdk/server/mcp.js");
 const logger_1 = require("../../../lib/logger");
+const registered_tools_1 = require("../../../services/mcp/registered-tools");
 const tasks_1 = require("./tasks");
 const escalations_1 = require("./escalations");
 const workflow_config_1 = require("./workflow-config");
@@ -61,7 +62,6 @@ const diagnostics_1 = require("./diagnostics");
 const scan_codes_1 = require("./scan-codes");
 const domain_context_1 = require("./domain-context");
 const announcements_1 = require("./announcements");
-const TOOL_COUNT = 105;
 let server = null;
 async function createAdminServer(options) {
     if (server && !options?.fresh)
@@ -71,30 +71,29 @@ async function createAdminServer(options) {
     if (!options?.fresh) {
         server = instance;
     }
-    (0, tasks_1.registerTaskTools)(instance); //  2 tools
-    (0, escalations_1.registerEscalationTools)(instance); // 20 tools (RO + RW single + metadata + bulk)
-    (0, workflow_config_1.registerWorkflowConfigTools)(instance); //  3 tools
-    (0, workflows_1.registerWorkflowTools)(instance); //  5 tools (+ terminate_workflow, invoke_workflow_read_safe)
-    (0, mcp_servers_1.registerMcpServerTools)(instance); //  4 tools
-    (0, yaml_workflows_1.registerYamlWorkflowTools)(instance); //  5 tools
-    (0, users_1.registerUserTools)(instance); // 10 tools (users + roles + role schemas)
-    (0, personas_1.registerPersonaTools)(instance); // 10 tools (persona CRUD + links + assignment)
-    (0, maintenance_1.registerMaintenanceTools)(instance); //  1 tool
-    (0, agents_1.registerAgentTools)(instance); //  5 tools
-    (0, agent_subscriptions_1.registerAgentSubscriptionTools)(instance); //  3 tools
-    (0, bot_accounts_1.registerBotAccountTools)(instance); //  7 tools
-    (0, controlplane_1.registerControlPlaneTools)(instance); //  5 tools
-    (0, pipelines_1.registerPipelineTools)(instance); //  4 tools
-    (0, topics_1.registerTopicTools)(instance); //  5 tools
-    (0, settings_1.registerSettingsTools)(instance); //  1 tool
-    (0, exports_1.registerExportTools)(instance); //  4 tools
-    (0, overview_1.registerOverviewTools)(instance); //  1 tool
-    (0, diagnostics_1.registerDiagnosticsTools)(instance); //  3 tools
-    (0, scan_codes_1.registerScanCodeTools)(instance); //  5 tools (scan schemes + rules + execute)
-    (0, domain_context_1.registerDomainContextTools)(instance); //  1 tool  (get_domain_context)
-    (0, announcements_1.registerAnnouncementTools)(instance); //  1 tool  (publish_announcement)
-    // Total: 105
-    logger_1.loggerRegistry.info(`[lt-mcp:admin] ${name} ready (${TOOL_COUNT} tools registered)`);
+    (0, tasks_1.registerTaskTools)(instance);
+    (0, escalations_1.registerEscalationTools)(instance);
+    (0, workflow_config_1.registerWorkflowConfigTools)(instance);
+    (0, workflows_1.registerWorkflowTools)(instance);
+    (0, mcp_servers_1.registerMcpServerTools)(instance);
+    (0, yaml_workflows_1.registerYamlWorkflowTools)(instance);
+    (0, users_1.registerUserTools)(instance);
+    (0, personas_1.registerPersonaTools)(instance);
+    (0, maintenance_1.registerMaintenanceTools)(instance);
+    (0, agents_1.registerAgentTools)(instance);
+    (0, agent_subscriptions_1.registerAgentSubscriptionTools)(instance);
+    (0, bot_accounts_1.registerBotAccountTools)(instance);
+    (0, controlplane_1.registerControlPlaneTools)(instance);
+    (0, pipelines_1.registerPipelineTools)(instance);
+    (0, topics_1.registerTopicTools)(instance);
+    (0, settings_1.registerSettingsTools)(instance);
+    (0, exports_1.registerExportTools)(instance);
+    (0, overview_1.registerOverviewTools)(instance);
+    (0, diagnostics_1.registerDiagnosticsTools)(instance);
+    (0, scan_codes_1.registerScanCodeTools)(instance);
+    (0, domain_context_1.registerDomainContextTools)(instance);
+    (0, announcements_1.registerAnnouncementTools)(instance);
+    logger_1.loggerRegistry.info(`[lt-mcp:admin] ${name} ready (${(0, registered_tools_1.registeredToolCount)(instance)} tools registered)`);
     return instance;
 }
 function getAdminServer() {

package/build/system/mcp-servers/admin/overview.d.ts

@@ -6,8 +6,8 @@ import { z } from 'zod';
 export declare const systemOverviewSchema: z.ZodObject<{
     period: z.ZodDefault<z.ZodOptional<z.ZodEnum<["1h", "24h", "7d"]>>>;
 }, "strip", z.ZodTypeAny, {
-    period: "24h" | "1h" | "7d";
+    period: "1h" | "24h" | "7d";
 }, {
-    period?: "24h" | "1h" | "7d" | undefined;
+    period?: "1h" | "24h" | "7d" | undefined;
 }>;
 export declare function registerOverviewTools(server: McpServer): void;

package/build/system/mcp-servers/admin/run-read.d.ts

@@ -0,0 +1,2 @@
+/** The refusal a run read gives a caller who neither builds nor started or runs as the run. */
+export declare const RUN_READ_DENIED = "Forbidden: only a builder, or the person who started the run or it runs as, may read it";

package/build/system/mcp-servers/admin/run-read.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RUN_READ_DENIED = void 0;
+/** The refusal a run read gives a caller who neither builds nor started or runs as the run. */
+exports.RUN_READ_DENIED = 'Forbidden: only a builder, or the person who started the run or it runs as, may read it';

package/build/system/mcp-servers/admin/scan-codes.d.ts

@@ -3,8 +3,8 @@
  *
  * Schemes map a code's leading two digits (10-99) to a target metadata facet
  * and parse shape; rules map a single-digit category (0-9) to ordered
- * condition/action steps over the escalation surface. execute_scan_code runs a raw code as
- * the lt-system principal (see escalations.ts for the principal rationale).
+ * condition/action steps over the escalation surface. execute_scan_code and
+ * execute_scan_choice run as the `/mcp` caller, or as lt-system for internal calls.
  */
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 export declare function registerScanCodeTools(server: McpServer): void;

package/build/system/mcp-servers/admin/scan-codes.js

@@ -35,14 +35,8 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerScanCodeTools = registerScanCodeTools;
 const scanCodesApi = __importStar(require("../../../api/scan-codes"));
-const iam_1 = require("../../../services/iam");
+const caller_auth_1 = require("../caller-auth");
 const schemas_1 = require("./schemas");
-let systemPrincipalId = null;
-async function systemAuth() {
-    if (!systemPrincipalId)
-        systemPrincipalId = await (0, iam_1.ensureSystemBot)();
-    return { userId: systemPrincipalId, role: 'superadmin' };
-}
 function asText(payload) {
     return { content: [{ type: 'text', text: JSON.stringify(payload) }] };
 }
@@ -58,14 +52,14 @@ function registerScanCodeTools(server) {
             'subject_stale, no_open_container, no_match_fallback, not_primed, ' +
             'identity_primed, identity_unknown, unconfigured, invalid_code, forbidden, conflict.',
         inputSchema: schemas_1.executeScanCodeSchema,
-    }, async (args) => {
+    }, async (args, extra) => {
         const result = await scanCodesApi.executeScanCode({
             code: args.code,
             actingToken: args.actingToken,
             previousActingToken: args.previousActingToken,
             subject: args.subject,
             stationRole: args.stationRole,
-        }, await systemAuth());
+        }, await (0, caller_auth_1.callerAuth)(extra));
         return asText(result.data ?? { error: result.error });
     });
     // mirrors POST /api/scan-codes/execute-choice
@@ -76,8 +70,8 @@ function registerScanCodeTools(server) {
             'against live config, the row\'s current state, the acting-identity gate, ' +
             'and RBAC before the verb runs.',
         inputSchema: schemas_1.executeScanChoiceSchema,
-    }, async (args) => {
-        const result = await scanCodesApi.executeScanChoice(args, await systemAuth());
+    }, async (args, extra) => {
+        const result = await scanCodesApi.executeScanChoice(args, await (0, caller_auth_1.callerAuth)(extra));
         return asText(result.data ?? { error: result.error });
     });
     // mirrors GET /api/scan-codes/schemes