@hotmeshio/long-tail 0.23.1 → 0.24.0

package/build/api/escalations/related.js

@@ -0,0 +1,205 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getRelatedAggregates = getRelatedAggregates;
+exports.getRelatedRows = getRelatedRows;
+const escalationService = __importStar(require("../../services/escalation"));
+const roleService = __importStar(require("../../services/role"));
+const uuid_1 = require("../../lib/uuid");
+const list_schema_1 = require("../../shared/list-schema");
+const segment_1 = require("../../shared/roles/segment");
+const helpers_1 = require("./helpers");
+const DEFAULT_STATUS = 'pending';
+const NOT_FOUND = 'Role list schema not found';
+/** Gate the host role, then read its declaration from the stored list schema. */
+async function loadDeclaration(role, version, auth) {
+    if (typeof role !== 'string' || !role)
+        return { error: { status: 400, error: 'role is required' } };
+    if (version !== undefined && (!Number.isInteger(version) || version < 1)) {
+        return { error: { status: 400, error: 'version must be a positive integer' } };
+    }
+    const readScope = await (0, helpers_1.getEscalationReadScope)(auth.userId);
+    const readable = readScope.global || readScope.allRoles.includes(role) || readScope.selfRoles.includes(role);
+    if (!readable)
+        return { error: { status: 404, error: NOT_FOUND } };
+    const stored = await roleService.getRoleListSchema(role, version);
+    if (!stored)
+        return { error: { status: 404, error: NOT_FOUND } };
+    let relations;
+    try {
+        relations = (0, list_schema_1.readListSchemaRelations)(stored.list_schema);
+    }
+    catch (err) {
+        return { error: { status: 422, error: `list schema for ${role}: ${err.message}` } };
+    }
+    const scope = {
+        global: readScope.global,
+        visibleRoles: readScope.global ? undefined : readScope.allRoles,
+        selfRoles: readScope.global ? undefined : readScope.selfRoles,
+        meUserId: auth.userId,
+    };
+    return { scope, readScope, relations, version: stored.version };
+}
+async function resolveQueryRoles(query, readScope) {
+    const details = await roleService.listRolesWithDetails();
+    const roles = query.roles ?? (0, segment_1.segmentRoles)(details, query.segment);
+    if (!roles)
+        return `segment "${query.segment}" names no Pace Board sequence`;
+    const titles = new Map(details.map((d) => [d.role, d.title]));
+    const roleLabels = {};
+    for (const r of roles)
+        roleLabels[r] = titles.get(r) || r;
+    const restricted = readScope.global ? [] : roles.filter((r) => !readScope.allRoles.includes(r));
+    return { roles, roleLabels, restricted };
+}
+/** The split paths the declared columns ask of one set ('' when unsplit). */
+function splitsFor(relations, set) {
+    const splits = new Set(relations.columns.filter((c) => c.related === set).map((c) => c.splitBy ?? ''));
+    if (!splits.size)
+        splits.add('');
+    return [...splits];
+}
+/**
+ * Aggregate every related set the role's list schema declares, for one page
+ * of host rows. One statement per (set, split) pair, whatever the page size.
+ */
+async function getRelatedAggregates(input, auth) {
+    try {
+        if (!Array.isArray(input.ids))
+            return { status: 400, error: 'ids must be an array of escalation ids' };
+        if (input.ids.length > list_schema_1.RELATED_LIMITS.MAX_HOSTS) {
+            return { status: 400, error: `ids holds at most ${list_schema_1.RELATED_LIMITS.MAX_HOSTS} rows` };
+        }
+        const loaded = await loadDeclaration(input.role, input.version, auth);
+        if ('error' in loaded)
+            return loaded.error;
+        const { scope, readScope, relations, version } = loaded;
+        const data = { version, sets: {} };
+        const names = Object.keys(relations.sets);
+        const ids = [...new Set(input.ids.filter(uuid_1.isUuid))];
+        if (!names.length || !ids.length)
+            return { status: 200, data };
+        const hosts = await escalationService.readRelatedHosts({ ids, role: input.role, scope });
+        const hostIds = hosts.map((h) => h.id);
+        for (const name of names) {
+            const decl = relations.sets[name];
+            const result = { source: decl.source, aggregates: {} };
+            if (decl.source === list_schema_1.RELATED_SOURCES.ITEMS) {
+                const roles = new Set();
+                for (const splitBy of splitsFor(relations, name)) {
+                    const read = await escalationService.aggregateRelatedItems({
+                        hostIds, scope, splitBy: splitBy || undefined,
+                    });
+                    result.aggregates[splitBy] = read.aggregates;
+                    read.roles.forEach((r) => roles.add(r));
+                }
+                if (roles.size)
+                    result.roles = [...roles].sort();
+            }
+            else {
+                const resolved = await resolveQueryRoles(decl.query, readScope);
+                if (typeof resolved === 'string')
+                    return { status: 400, error: `x-lt-related.${name}: ${resolved}` };
+                Object.assign(result, resolved);
+                const matched = [];
+                const unresolved = [];
+                for (const host of hosts) {
+                    const match = (0, list_schema_1.resolveRelatedFacets)(decl.query.facets ?? {}, (0, list_schema_1.rowTemplateContext)(host), decl.query.narrow);
+                    if (match)
+                        matched.push({ hostId: host.id, match });
+                    else
+                        unresolved.push(host.id);
+                }
+                for (const splitBy of splitsFor(relations, name)) {
+                    const agg = await escalationService.aggregateRelatedQuery({
+                        hosts: matched, roles: resolved.roles, status: decl.query.status ?? DEFAULT_STATUS, scope,
+                        splitBy: splitBy || undefined,
+                    });
+                    for (const id of unresolved)
+                        agg[id] = { count: 0, unresolved: true };
+                    result.aggregates[splitBy] = agg;
+                }
+            }
+            data.sets[name] = result;
+        }
+        return { status: 200, data };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}
+/** One host's rows in one related set, for a row detail section. */
+async function getRelatedRows(input, auth) {
+    try {
+        if (!(0, uuid_1.isUuid)(input.id))
+            return { status: 400, error: 'id must be an escalation id' };
+        if (input.limit !== undefined && (!Number.isInteger(input.limit) || input.limit < 1 || input.limit > list_schema_1.RELATED_LIMITS.ROWS_MAX)) {
+            return { status: 400, error: `limit must be 1..${list_schema_1.RELATED_LIMITS.ROWS_MAX}` };
+        }
+        const loaded = await loadDeclaration(input.role, input.version, auth);
+        if ('error' in loaded)
+            return loaded.error;
+        const { scope, readScope, relations } = loaded;
+        const decl = relations.sets[input.set];
+        if (!decl)
+            return { status: 404, error: `x-lt-related declares no set "${input.set}"` };
+        const [host] = await escalationService.readRelatedHosts({ ids: [input.id], role: input.role, scope });
+        if (!host)
+            return { status: 404, error: 'Escalation not found' };
+        const limit = input.limit ?? list_schema_1.RELATED_LIMITS.ROWS_DEFAULT;
+        if (decl.source === list_schema_1.RELATED_SOURCES.ITEMS) {
+            const { rows, total } = await escalationService.listRelatedItems({ hostId: input.id, scope, limit });
+            const data = { source: decl.source, rows, total };
+            return { status: 200, data };
+        }
+        const resolved = await resolveQueryRoles(decl.query, readScope);
+        if (typeof resolved === 'string')
+            return { status: 400, error: `x-lt-related.${input.set}: ${resolved}` };
+        const match = (0, list_schema_1.resolveRelatedFacets)(decl.query.facets ?? {}, (0, list_schema_1.rowTemplateContext)(host), decl.query.narrow);
+        const { rows, total } = match
+            ? await escalationService.listRelatedQueryRows({
+                hosts: [{ hostId: input.id, match }], roles: resolved.roles,
+                status: decl.query.status ?? DEFAULT_STATUS, scope, limit,
+            })
+            : { rows: [], total: 0 };
+        const data = {
+            source: decl.source, rows, total, restricted: resolved.restricted, roleLabels: resolved.roleLabels,
+        };
+        return { status: 200, data };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}

package/build/api/escalations/single.d.ts

@@ -12,14 +12,15 @@ export declare function getEscalation(input: {
     id: string;
 }, auth: LTApiAuth): Promise<LTApiResult>;
 /**
- * List all escalations for a given workflow ID.
+ * List the escalations for a given workflow ID. With `auth`, only the rows
+ * that caller may read; without it (in-process callers), every row.
  *
  * @param input.workflowId — HotMesh workflow ID
  * @returns `{ status: 200, data: { escalations } }`
  */
 export declare function getEscalationsByWorkflowId(input: {
     workflowId: string;
-}): Promise<LTApiResult>;
+}, auth?: LTApiAuth): Promise<LTApiResult>;
 /**
  * Route a pending escalation to a different role.
  *

package/build/api/escalations/single.js

@@ -69,14 +69,19 @@ async function getEscalation(input, auth) {
     }
 }
 /**
- * List all escalations for a given workflow ID.
+ * List the escalations for a given workflow ID. With `auth`, only the rows
+ * that caller may read; without it (in-process callers), every row.
  *
  * @param input.workflowId — HotMesh workflow ID
  * @returns `{ status: 200, data: { escalations } }`
  */
-async function getEscalationsByWorkflowId(input) {
+async function getEscalationsByWorkflowId(input, auth) {
     try {
-        const escalations = await escalationService.getEscalationsByWorkflowId(input.workflowId);
+        const all = await escalationService.getEscalationsByWorkflowId(input.workflowId);
+        if (!auth?.userId)
+            return { status: 200, data: { escalations: all } };
+        const scope = await (0, helpers_1.getEscalationReadScope)(auth.userId);
+        const escalations = all.filter((e) => (0, helpers_1.scopeAdmits)(scope, auth.userId, e));
         return { status: 200, data: { escalations } };
     }
     catch (err) {

package/build/api/mcp/tools.d.ts

@@ -1,4 +1,16 @@
+import type { CapabilityGate } from '../../types';
 import type { LTApiResult, LTApiAuth } from '../../types/sdk';
+/**
+ * The built-in server a server id or name refers to: the one a tool call would
+ * dispatch to, else a shipped factory whose name matches. Null for an external
+ * server. Matching both keeps the gate in force wherever the code runs.
+ */
+export declare function builtinServerFor(serverIdOrName: string): Promise<string | null>;
+/**
+ * The capability a built-in tool's manifest gates it at, from the manifest the
+ * server was registered with (Long Tail's or the host's). A tool without a gate needs builder.
+ */
+export declare function builtinToolGate(serverName: string, toolName: string): CapabilityGate;
 /**
  * List all tools exposed by a connected MCP server.
  *

package/build/api/mcp/tools.js

@@ -1,8 +1,92 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.builtinServerFor = builtinServerFor;
+exports.builtinToolGate = builtinToolGate;
 exports.listMcpServerTools = listMcpServerTools;
 exports.callMcpTool = callMcpTool;
 const mcp_1 = require("../../services/mcp");
+const mcpClient = __importStar(require("../../services/mcp/client"));
+const userService = __importStar(require("../../services/user"));
+const capabilities_1 = require("../../modules/capabilities");
+const workflow_invocation_1 = require("../../services/workflow-invocation");
+const system_1 = require("../../system");
+const uuid_1 = require("../../lib/uuid");
+const ROLE_TYPE_ORDER = ['superadmin', 'admin', 'member'];
+const normalizeName = (name) => name.replace(/[^a-zA-Z0-9]/g, '').toLowerCase();
+/**
+ * The built-in server a server id or name refers to: the one a tool call would
+ * dispatch to, else a shipped factory whose name matches. Null for an external
+ * server. Matching both keeps the gate in force wherever the code runs.
+ */
+async function builtinServerFor(serverIdOrName) {
+    const registered = await mcpClient.resolveBuiltinServerName(serverIdOrName);
+    if (registered)
+        return registered;
+    if (system_1.builtinMcpServerFactories[serverIdOrName])
+        return serverIdOrName;
+    const wanted = normalizeName(serverIdOrName);
+    if (!wanted)
+        return null;
+    return Object.keys(system_1.builtinMcpServerFactories).find((name) => {
+        const have = normalizeName(name);
+        return have.includes(wanted) || wanted.includes(have);
+    }) ?? null;
+}
+/**
+ * The capability a built-in tool's manifest gates it at, from the manifest the
+ * server was registered with (Long Tail's or the host's). A tool without a gate needs builder.
+ */
+function builtinToolGate(serverName, toolName) {
+    const manifest = mcpClient.getBuiltinToolManifest(serverName)
+        ?? system_1.builtinMcpServerFactories[serverName]?.config?.toolManifest;
+    return manifest?.find((t) => t.name === toolName)?.gate ?? 'builder';
+}
+/** The principal a tool call acts as: the caller, or an execute_as target the caller outranks. */
+async function actingPrincipal(auth, executeAs) {
+    if (!executeAs)
+        return { userId: auth.userId, role: auth.role };
+    await (0, workflow_invocation_1.assertMayActAs)(auth.userId, executeAs);
+    const target = (0, uuid_1.isUuid)(executeAs)
+        ? await userService.getUser(executeAs)
+        : await userService.getUserByExternalId(executeAs);
+    if (!target)
+        throw new workflow_invocation_1.InvocationError(`execute_as principal "${executeAs}" not found`, 404);
+    const role = ROLE_TYPE_ORDER.find((type) => target.roles.some((r) => r.type === type));
+    return { userId: target.id, role };
+}
 /**
  * List all tools exposed by a connected MCP server.
  *
@@ -41,22 +125,42 @@ async function listMcpServerTools(input) {
  */
 async function callMcpTool(input, auth) {
     try {
-        const adapter = mcp_1.mcpRegistry.current;
-        if (!adapter) {
-            return { status: 400, error: 'MCP adapter not registered' };
-        }
-        const effectiveUserId = input.execute_as || auth?.userId;
-        const authContext = effectiveUserId ? { userId: effectiveUserId } : undefined;
+        if (!auth?.userId)
+            return { status: 401, error: 'Authentication required' };
+        const actor = await actingPrincipal(auth, input.execute_as);
         // Inject user_id into arguments so builtin tools can resolve
         // the calling user's credentials (OAuth tokens, etc.)
         const args = { ...(input.arguments || {}) };
-        if (effectiveUserId && !args.user_id) {
-            args.user_id = effectiveUserId;
+        if (!args.user_id)
+            args.user_id = actor.userId;
+        // A built-in tool runs in this process. It is gated as /mcp gates it, by
+        // the tool's manifest capability for the acting principal (live, never a
+        // role claim), and runs as that principal rather than as lt-system.
+        const builtin = await builtinServerFor(input.id);
+        if (builtin) {
+            const permitted = await (0, capabilities_1.capabilityAccess)({ userId: actor.userId })(builtinToolGate(builtin, input.toolName));
+            if (!permitted)
+                return { status: 403, error: `Forbidden: ${input.toolName} is not available to you` };
+            const result = await mcpClient.callBuiltinToolAs(builtin, input.toolName, args, actor);
+            return { status: 200, data: { result } };
+        }
+        // An external server's tools run on its stored credential (headers, env),
+        // which carries that server's authority: a builder's to use.
+        if (!(await (0, capabilities_1.capabilityAccess)({ userId: actor.userId })('builder'))) {
+            return { status: 403, error: `Forbidden: tools on an external MCP server need builder access` };
+        }
+        const adapter = mcp_1.mcpRegistry.current;
+        if (!adapter) {
+            return { status: 400, error: 'MCP adapter not registered' };
         }
-        const result = await adapter.callTool(input.id, input.toolName, args, authContext);
+        const result = await adapter.callTool(input.id, input.toolName, args, { userId: actor.userId });
         return { status: 200, data: { result } };
     }
     catch (err) {
+        if (err instanceof workflow_invocation_1.InvocationError)
+            return { status: err.statusCode, error: err.message };
+        if (err.name === 'ToolNotFoundError')
+            return { status: 404, error: err.message };
         if (err.name === 'MissingCredentialError') {
             return {
                 status: 422,

package/build/api/roles.js

@@ -51,6 +51,7 @@ const roleService = __importStar(require("../services/role"));
 const types_1 = require("../services/role/types");
 const badge_grant_1 = require("../services/role/badge-grant");
 const facet_sql_1 = require("../services/escalation/facet-sql");
+const list_schema_1 = require("../shared/list-schema");
 /**
  * List all distinct role names in the system.
  *
@@ -295,6 +296,9 @@ async function updateRole(input) {
         const grantError = (0, badge_grant_1.badgeGrantError)(input.properties?.[types_1.ROLE_PROPERTY_KEYS.BADGE_GRANT]);
         if (grantError)
             return { status: 400, error: grantError };
+        const listSchemaError = input.list_schema != null ? (0, list_schema_1.listSchemaRelationsError)(input.list_schema) : null;
+        if (listSchemaError)
+            return { status: 400, error: `list_schema: ${listSchemaError}` };
         if (input.portals != null && !isPortalList(input.portals)) {
             return {
                 status: 400,

package/build/api/scan-codes/choice.js

@@ -39,6 +39,7 @@ const escalationService = __importStar(require("../../services/escalation"));
 const types_1 = require("../../types");
 const identity_1 = require("./identity");
 const grant_1 = require("./grant");
+const helpers_1 = require("../escalations/helpers");
 const context_1 = require("./context");
 const locate_1 = require("./locate");
 const verbs_1 = require("./verbs");
@@ -84,9 +85,21 @@ async function executeScanChoice(input, auth) {
             effectiveAuth = peeked.auth;
             grant = peeked.grant;
         }
-        // 3. The row anchors the target: the scheme's facet on the escalation the
-        // screen presented. A missing binding is loud misconfiguration.
-        const row = await escalationService.getEscalation(input.escalationId);
+        // 3. With no live grant, a choice that needs a badge parks for the next
+        // badge scan before any row is read, whatever the station may read.
+        if (!grant && choice.requireActingIdentity
+            && !(await (0, identity_1.actingIdentitySatisfied)(step, { stationAuth: auth, acting: false }))) {
+            return stampPointer((0, context_1.notPrimed)({ rule }), rule, input);
+        }
+        // 4. The row anchors the target: the scheme's facet on the escalation the
+        // screen presented. A missing binding is loud misconfiguration. A row the
+        // actor may not read answers as one that left the presented state, and
+        // discloses nothing of the row.
+        const loaded = await escalationService.getEscalation(input.escalationId);
+        if (loaded && (await (0, helpers_1.assertReadAccess)(effectiveAuth.userId, loaded))) {
+            return stampPointer((0, context_1.conflict)('the item is no longer in the presented state'), rule, input);
+        }
+        const row = loaded;
         const target = row?.metadata?.[scheme.target_facet];
         if (!row || typeof target !== 'string' || !target) {
             return {
@@ -104,11 +117,11 @@ async function executeScanChoice(input, auth) {
             acting: !!grant,
             grant,
         };
-        // 4. The identity gate, per the choice.
+        // 5. The identity gate, per the choice.
         if (choice.requireActingIdentity && !(await (0, identity_1.actingIdentitySatisfied)(step, ctx))) {
             return decorate((0, context_1.notPrimed)(ctx), ctx, input);
         }
-        // 5. The row must still match the step's query — the reality the screen
+        // 6. The row must still match the step's query — the reality the screen
         // showed. A row that moved on (resolved, claimed away, re-routed) is the
         // same double-actor race a second scan loses.
         const located = await (0, locate_1.locateForStep)(step, ctx, 2);
@@ -116,10 +129,10 @@ async function executeScanChoice(input, auth) {
         if (!presented) {
             return decorate((0, context_1.conflict)('the item is no longer in the presented state'), ctx, input);
         }
-        // 6. Dispatch through the same atomic executors a direct scan uses.
+        // 7. Dispatch through the same atomic executors a direct scan uses.
         const synthesized = { query: step.query, verb: choice.verb, params: choice.params };
         const result = decorate(await (0, verbs_1.dispatchChoiceVerb)(synthesized, ctx, presented), ctx, input);
-        // 7. Settle the badge: refund a spend whose act did not land
+        // 8. Settle the badge: refund a spend whose act did not land
         const acting = await (0, grant_1.settleGrant)(ctx, result);
         if (acting && result.data)
             result.data = { ...result.data, acting };
@@ -129,6 +142,17 @@ async function executeScanChoice(input, auth) {
         return { status: 500, error: err.message };
     }
 }
+/** Stamp the rule and pointer onto an outcome decided before the row was read. */
+function stampPointer(result, rule, input) {
+    if (result.data && typeof result.data === 'object' && 'outcome' in result.data) {
+        result.data = {
+            ...result.data,
+            rule: { schemeVersion: rule.scheme_version, category: rule.category, name: rule.name },
+            stepIndex: input.stepIndex,
+        };
+    }
+    return result;
+}
 /** Stamp the rule + pointer identity onto the outcome, mirroring execute. */
 function decorate(result, ctx, input) {
     if (result.data && typeof result.data === 'object' && 'outcome' in result.data) {

package/build/api/scan-codes/present.js

@@ -45,7 +45,11 @@ function renderFacts(step, ctx, row) {
     if (!step.facts)
         return undefined;
     const tpl = { ...(0, context_1.templateContext)(ctx), item: row.metadata ?? {} };
-    return step.facts.map((fact) => ({ label: fact.label, value: scanCodeService.renderScanCopy(fact.value, tpl) }));
+    return step.facts.map((fact) => ({
+        label: fact.label,
+        value: scanCodeService.renderScanCopy(fact.value.trim(), tpl),
+        ...(fact.format ? { format: fact.format } : {}),
+    }));
 }
 // ── The info-choice outcome — locate → present reality + labeled choices ───
 //

package/build/api/settings.d.ts

@@ -8,6 +8,6 @@ import type { LTApiResult } from '../types/sdk';
  * environment block (long-tail + HotMesh versions, Node env/version).
  *
  * @param req — the incoming HTTP request, used to derive NATS WS URL from headers when proxying
- * @returns `{ status: 200, data: { telemetry, escalation, events, auth, ai, features, environment } }`
+ * @returns `{ status: 200, data: { telemetry, escalation, events, auth, ai, features, search, branding, display, environment } }`
  */
 export declare function getSettings(req?: IncomingMessage): Promise<LTApiResult>;

package/build/api/settings.js

@@ -10,6 +10,8 @@ const config_1 = require("../modules/config");
 const features_1 = require("../modules/features");
 const search_1 = require("../modules/search");
 const branding_1 = require("../modules/branding");
+const oauth_server_1 = require("../modules/oauth-server");
+const display_1 = require("../modules/display");
 const version_1 = require("../modules/version");
 const sso_1 = require("../modules/sso");
 const defaults_1 = require("../modules/defaults");
@@ -41,7 +43,7 @@ function resolveNatsWsUrl(adapter, req) {
  * environment block (long-tail + HotMesh versions, Node env/version).
  *
  * @param req — the incoming HTTP request, used to derive NATS WS URL from headers when proxying
- * @returns `{ status: 200, data: { telemetry, escalation, events, auth, ai, features, environment } }`
+ * @returns `{ status: 200, data: { telemetry, escalation, events, auth, ai, features, search, branding, display, environment } }`
  */
 async function getSettings(req) {
     try {
@@ -65,6 +67,12 @@ async function getSettings(req) {
                 events: {
                     transport,
                     natsWsUrl: natsAdapter ? resolveNatsWsUrl(natsAdapter, req) : null,
+                    reconnect: {
+                        initialDelayMs: config_1.config.NATS_RECONNECT_INITIAL_MS,
+                        maxDelayMs: config_1.config.NATS_RECONNECT_MAX_MS,
+                        noticeAfterMs: config_1.config.NATS_LIVE_NOTICE_AFTER_MS,
+                        spreadMs: config_1.config.NATS_RECONNECT_SPREAD_MS,
+                    },
                 },
                 auth: {
                     sso: (0, sso_1.isSSOEnabled)(),
@@ -72,6 +80,8 @@ async function getSettings(req) {
                     // Session keepalive dials for the SPA (null = no keepalive / no idle gate).
                     ssoKeepaliveSeconds: (0, sso_1.getSSOConfig)()?.keepaliveSeconds ?? null,
                     ssoKeepaliveIdleTimeoutSeconds: (0, sso_1.getSSOConfig)()?.keepaliveIdleTimeoutSeconds ?? null,
+                    // The OAuth authorization server for MCP clients (Connected apps).
+                    oauthServer: (0, oauth_server_1.getOAuthServerSettings)() !== null,
                 },
                 ai: {
                     enabled: (0, llm_1.hasLLMApiKey)(),
@@ -79,6 +89,7 @@ async function getSettings(req) {
                 features: (0, features_1.getFeatureFlags)(),
                 search: (0, search_1.getSearchConfig)(),
                 branding: (0, branding_1.getBranding)(),
+                display: (0, display_1.getDisplay)(),
                 environment: {
                     longTailVersion: version_1.LONG_TAIL_VERSION,
                     hotmeshVersion: version_1.HOTMESH_VERSION,

package/build/api/tasks.d.ts

@@ -47,7 +47,7 @@ export declare function listTasks(input: {
     origin_id?: string;
     limit?: number;
     offset?: number;
-}): Promise<LTApiResult>;
+}, auth?: LTApiAuth): Promise<LTApiResult>;
 /**
  * Return aggregate process statistics.
  *
@@ -82,7 +82,7 @@ export declare function listProcesses(input: {
  */
 export declare function getProcess(input: {
     originId: string;
-}): Promise<LTApiResult>;
+}, auth?: LTApiAuth): Promise<LTApiResult>;
 /**
  * Get a single task by ID.
  *
@@ -91,4 +91,4 @@ export declare function getProcess(input: {
  */
 export declare function getTask(input: {
     id: string;
-}): Promise<LTApiResult>;
+}, auth?: LTApiAuth): Promise<LTApiResult>;