@hotmeshio/long-tail 0.24.0 → 0.24.1

package/build/lib/events/nats-ws-ticket.js

@@ -6,15 +6,28 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.NATS_WS_TICKET_PARAM = exports.NATS_WS_TICKET_TYPE = void 0;
 exports.signNatsWsTicket = signNatsWsTicket;
 exports.verifyNatsWsTicket = verifyNatsWsTicket;
+exports.spendNatsWsTicket = spendNatsWsTicket;
+const crypto_1 = require("crypto");
 const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const db_1 = require("../db");
 const config_1 = require("../../modules/config");
 /**
  * A browser's pass to the NATS WebSocket proxy, in place of the NATS server
  * credential. It names the person in `sub` and carries no `userId`, so it
- * authenticates nothing but the proxy upgrade.
+ * authenticates nothing but the proxy upgrade. Each ticket admits one
+ * upgrade: the dashboard fetches a fresh one for every connection attempt.
  */
 exports.NATS_WS_TICKET_TYPE = 'nats-ws+jwt';
 exports.NATS_WS_TICKET_PARAM = 'ticket';
+/** Record the ticket as spent, and drop expired records. True only for its first use. */
+const SPEND_TICKET = `
+  WITH expired AS (
+    DELETE FROM lt_nats_ws_tickets WHERE expires_at < NOW()
+  )
+  INSERT INTO lt_nats_ws_tickets (jti, expires_at)
+  VALUES ($1, to_timestamp($2))
+  ON CONFLICT (jti) DO NOTHING
+  RETURNING jti`;
 function signNatsWsTicket(userId) {
     if (!config_1.config.JWT_SECRET)
         return null;
@@ -22,10 +35,11 @@ function signNatsWsTicket(userId) {
         algorithm: 'HS256',
         header: { alg: 'HS256', typ: exports.NATS_WS_TICKET_TYPE },
         subject: userId,
+        jwtid: (0, crypto_1.randomUUID)(),
         expiresIn: config_1.config.NATS_WS_TICKET_TTL_SECONDS,
     });
 }
-/** The person a valid ticket names; null for anything else. */
+/** The claims of a valid ticket; null for anything else. Does not spend it. */
 function verifyNatsWsTicket(ticket) {
     if (!ticket || !config_1.config.JWT_SECRET)
         return null;
@@ -33,10 +47,17 @@ function verifyNatsWsTicket(ticket) {
         const decoded = jsonwebtoken_1.default.verify(ticket, config_1.config.JWT_SECRET, { algorithms: ['HS256'], complete: true });
         if (decoded.header.typ !== exports.NATS_WS_TICKET_TYPE)
             return null;
-        const payload = decoded.payload;
-        return typeof payload.sub === 'string' && typeof payload.exp === 'number' ? payload.sub : null;
+        const { sub, jti, exp } = decoded.payload;
+        if (typeof sub !== 'string' || typeof jti !== 'string' || typeof exp !== 'number')
+            return null;
+        return { userId: sub, jti, exp };
     }
     catch {
         return null;
     }
 }
+/** Spend a verified ticket. False when it was already spent. */
+async function spendNatsWsTicket(ticket) {
+    const { rowCount } = await (0, db_1.getPool)().query(SPEND_TICKET, [ticket.jti, ticket.exp]);
+    return rowCount === 1;
+}

package/build/modules/config.d.ts

@@ -12,6 +12,10 @@ export declare const config: {
     NATS_DASHBOARD_TOKEN: string;
     /** How long a browser's WebSocket proxy ticket admits an upgrade. The dashboard fetches one per attempt. */
     NATS_WS_TICKET_TTL_SECONDS: number;
+    /** Largest WebSocket frame the proxy accepts from a browser, near NATS's own max_payload. */
+    NATS_WS_MAX_PAYLOAD_BYTES: number;
+    /** How often the proxy rechecks a connection holder's account; a change closes the connection. */
+    NATS_WS_RECHECK_SECONDS: number;
     /**
      * Dashboard reconnect: first backoff delay, delay cap, how long a drop lasts
      * before the banner shows, and the window the first retry and catch-up
@@ -24,6 +28,7 @@ export declare const config: {
     PORT: number;
     NODE_ENV: string;
     JWT_SECRET: string;
+    LT_SEED_SERVICE_KEYS: boolean;
     LT_OAUTH_ISSUER: string;
     HONEYCOMB_API_KEY: string;
     ROLE_ENFORCEMENT_CACHE_TTL_MS: number;

package/build/modules/config.js

@@ -24,6 +24,10 @@ exports.config = {
     NATS_DASHBOARD_TOKEN: process.env.NATS_DASHBOARD_TOKEN || '',
     /** How long a browser's WebSocket proxy ticket admits an upgrade. The dashboard fetches one per attempt. */
     NATS_WS_TICKET_TTL_SECONDS: positiveInt('NATS_WS_TICKET_TTL_SECONDS', 300),
+    /** Largest WebSocket frame the proxy accepts from a browser, near NATS's own max_payload. */
+    NATS_WS_MAX_PAYLOAD_BYTES: positiveInt('NATS_WS_MAX_PAYLOAD_BYTES', 1024 * 1024),
+    /** How often the proxy rechecks a connection holder's account; a change closes the connection. */
+    NATS_WS_RECHECK_SECONDS: positiveInt('NATS_WS_RECHECK_SECONDS', 60),
     /**
      * Dashboard reconnect: first backoff delay, delay cap, how long a drop lasts
      * before the banner shows, and the window the first retry and catch-up
@@ -36,6 +40,9 @@ exports.config = {
     PORT: parseInt(process.env.PORT || '3000', 10),
     NODE_ENV: process.env.NODE_ENV || 'development',
     JWT_SECRET: process.env.JWT_SECRET || '',
+    // Mint the seeded mcp-service account's API keys and print them to stdout once, at first seed.
+    // Local docker compose sets it; elsewhere a superadmin mints keys from the dashboard.
+    LT_SEED_SERVICE_KEYS: process.env.LT_SEED_SERVICE_KEYS === 'true',
     // Enables the OAuth authorization server for /mcp when start() passes no auth.oauthServer.
     LT_OAUTH_ISSUER: process.env.LT_OAUTH_ISSUER || '',
     HONEYCOMB_API_KEY: process.env.HONEYCOMB_API_KEY || '',

package/build/modules/maintenance.d.ts

@@ -10,6 +10,8 @@ import type { LTMaintenanceConfig } from '../types/maintenance';
  * 3. Strip execution artifacts from entity jobs older than 30 days
  *    (preserves jdata, udata, jmark, hmark — exports always work)
  * 4. Hard-delete pruned jobs older than 180 days
+ * 5. Delete OAuth server rows (expired codes and tokens, unused or revoked
+ *    grants, clients with no live grant) older than 7 days
  *
  * Conservative defaults — execution artifacts (activity inputs, stream
  * history) are needed for rich export data. Pruning too early strips

package/build/modules/maintenance.js

@@ -12,6 +12,8 @@ exports.defaultMaintenanceConfig = void 0;
  * 3. Strip execution artifacts from entity jobs older than 30 days
  *    (preserves jdata, udata, jmark, hmark — exports always work)
  * 4. Hard-delete pruned jobs older than 180 days
+ * 5. Delete OAuth server rows (expired codes and tokens, unused or revoked
+ *    grants, clients with no live grant) older than 7 days
  *
  * Conservative defaults — execution artifacts (activity inputs, stream
  * history) are needed for rich export data. Pruning too early strips
@@ -44,5 +46,10 @@ exports.defaultMaintenanceConfig = {
             olderThan: '180 days',
             pruned: true,
         },
+        {
+            target: 'oauth',
+            action: 'delete',
+            olderThan: '7 days',
+        },
     ],
 };

package/build/routes/agents.js

@@ -124,13 +124,13 @@ router.get('/:agentId/subscriptions', async (req, res) => {
  * Create an event subscription for an agent.
  */
 router.post('/:agentId/subscriptions', auth_1.requireBuilder, async (req, res) => {
-    const { topic, reaction_type, execute_as } = req.body;
+    const { topic, reaction_type, workflow_type, execute_as } = req.body;
     if (!topic || !reaction_type) {
         res.status(400).json({ error: 'topic and reaction_type are required' });
         return;
     }
     const agentId = String(req.params.agentId);
-    const check = () => (0, authority_1.assertMayConfigureSubscription)(req.auth.userId, { agentId, reaction_type, execute_as });
+    const check = () => (0, authority_1.assertMayConfigureSubscription)(req.auth.userId, { agentId, reaction_type, workflow_type, execute_as });
     if (!(await authorized(check, res)))
         return;
     const result = await subApi.createSubscription({ ...req.body, agentId });
@@ -144,7 +144,8 @@ router.put('/:agentId/subscriptions/:subId', auth_1.requireBuilder, async (req,
     const agentId = String(req.params.agentId);
     const id = String(req.params.subId);
     const check = () => (0, authority_1.assertMayConfigureSubscription)(req.auth.userId, {
-        agentId, subscriptionId: id, reaction_type: req.body?.reaction_type, execute_as: req.body?.execute_as,
+        agentId, subscriptionId: id, reaction_type: req.body?.reaction_type,
+        workflow_type: req.body?.workflow_type, execute_as: req.body?.execute_as,
     });
     if (!(await authorized(check, res)))
         return;

package/build/routes/oauth-server/authorize.js

@@ -51,9 +51,11 @@ function refuseBots(req, res) {
  * POST /api/oauth/authorize
  * The person approves. Body: the authorization request plus
  * { preset: 'read_only' | 'just_me' }. Returns { redirect } for the consent
- * page to navigate to, carrying the code.
+ * page to navigate to, carrying the code. Only the dashboard's own bearer
+ * credential approves: a host session cookie, which any same-site script
+ * could send, does not.
  */
-router.post('/authorize', auth_1.requireAuth, async (req, res) => {
+router.post('/authorize', auth_1.requireCredentialAuth, async (req, res) => {
     if (refuseBots(req, res))
         return;
     const settings = (0, oauth_server_1.getOAuthServerSettings)();
@@ -79,9 +81,9 @@ router.post('/authorize', auth_1.requireAuth, async (req, res) => {
 /**
  * POST /api/oauth/deny
  * The person declines. Body: { client_id, redirect_uri, state? }. Returns
- * { redirect } carrying error=access_denied.
+ * { redirect } carrying error=access_denied. Bearer credential only, as authorize.
  */
-router.post('/deny', auth_1.requireAuth, async (req, res) => {
+router.post('/deny', auth_1.requireCredentialAuth, async (req, res) => {
     const settings = (0, oauth_server_1.getOAuthServerSettings)();
     const clientId = typeof req.body?.client_id === 'string' ? req.body.client_id : '';
     const client = clientId ? await (0, oauth_server_2.getClient)(clientId) : null;

package/build/routes/yaml-workflows/cron.js

@@ -59,7 +59,7 @@ router.put('/:id/cron', auth_1.requireBuilder, async (req, res) => {
         cron_schedule: req.body.cron_schedule,
         cron_envelope: req.body.cron_envelope,
         execute_as: req.body.execute_as,
-    });
+    }, req.auth);
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**

package/build/services/agent/authority.d.ts

@@ -10,5 +10,6 @@ export declare function assertMayConfigureSubscription(callerId: string, input:
     agentId: string;
     subscriptionId?: string;
     reaction_type?: string;
+    workflow_type?: string | null;
     execute_as?: string | null;
 }): Promise<void>;

package/build/services/agent/authority.js

@@ -8,13 +8,16 @@ exports.assertMayConfigureSubscription = assertMayConfigureSubscription;
  * Whoever configures one must be able to run as that identity: the same rule
  * as an execute_as override. Automation that would run as lt-system, or a
  * capability subscription (a tool called with lt-system authority), is a
- * superadmin's to configure.
+ * superadmin's to configure. A durable subscription starts its workflow
+ * under that workflow's invocation rules, for the configurer here and for
+ * the run identity each time it fires.
  */
 const workflow_invocation_1 = require("../workflow-invocation");
 const user_1 = require("../user");
 const index_1 = require("./index");
 const subscriptions_1 = require("./subscriptions");
 const SYSTEM_AUTHORITY = 'runs as lt-system; only superadmin can configure it';
+const DURABLE_REACTION = 'durable';
 async function assertIdentity(callerId, identity, what) {
     if (!identity)
         throw new workflow_invocation_1.InvocationError(`${what} has no identity, so it ${SYSTEM_AUTHORITY}`, 403);
@@ -47,6 +50,9 @@ async function assertMayConfigureSubscription(callerId, input) {
     if (reaction === 'capability') {
         throw new workflow_invocation_1.InvocationError(`a capability subscription calls a tool directly, so it ${SYSTEM_AUTHORITY}`, 403);
     }
+    const workflowType = input.workflow_type !== undefined ? input.workflow_type : existing?.workflow_type;
+    if (reaction === DURABLE_REACTION && workflowType)
+        await (0, workflow_invocation_1.checkInvocationRoles)(workflowType, callerId);
     const agent = await (0, index_1.getAgent)(input.agentId);
     const executeAs = input.execute_as !== undefined ? input.execute_as : existing?.execute_as;
     await assertIdentity(callerId, executeAs || agent?.user_id, 'the subscription');

package/build/services/agent/trigger-registry.js

@@ -245,12 +245,17 @@ class AgentTriggerRegistry {
     async executeReaction(sub, mapped, deterministicId) {
         switch (sub.reaction_type) {
             case 'durable': {
-                const { invokeWorkflow } = await Promise.resolve().then(() => __importStar(require('../workflow-invocation')));
+                const { invokeWorkflow, checkInvocationRoles } = await Promise.resolve().then(() => __importStar(require('../workflow-invocation')));
+                // The run identity must be able to start this workflow now. Only a
+                // superadmin configures a subscription with no identity.
+                const runAs = sub.execute_as ?? sub.agent_user_id ?? undefined;
+                if (runAs)
+                    await checkInvocationRoles(sub.workflow_type, runAs);
                 await invokeWorkflow({
                     workflowType: sub.workflow_type,
                     data: mapped.data ?? mapped,
                     metadata: mapped.metadata ?? { source: 'agent', certified: true },
-                    executeAs: sub.execute_as ?? sub.agent_user_id ?? undefined,
+                    executeAs: runAs,
                     options: { workflowId: deterministicId },
                     auth: { userId: sub.agent_user_id || 'lt-system', role: 'admin' },
                 });

package/build/services/auth/oauth-server/index.d.ts

@@ -1,3 +1,3 @@
-export { REFRESH_REUSE_GRACE_SECONDS, createSecret, hashSecret, pkceChallenge, registerClient, getClient, issueAuthorizationCode, exchangeAuthorizationCode, rotateRefreshToken, getLiveGrant, revokeByRefreshToken, revokeGrant, listGrants, type RevokedGrant, } from './store';
+export { REFRESH_REUSE_GRACE_SECONDS, createSecret, hashSecret, pkceChallenge, registerClient, getClient, issueAuthorizationCode, exchangeAuthorizationCode, rotateRefreshToken, getLiveGrant, revokeByRefreshToken, revokeGrant, listGrants, pruneOAuthServer, type RevokedGrant, type OAuthPruneCounts, } from './store';
 export { signAccessToken, verifyAccessToken, accessTokenPrincipal, type AccessTokenTarget, type LTAccessTokenClaims, } from './access-token';
 export { MCP_SCOPES, PRESET_SCOPE, ACCESS_TOKEN_TYPE, OAUTH_PRINCIPAL_TYPE } from './constants';

package/build/services/auth/oauth-server/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OAUTH_PRINCIPAL_TYPE = exports.ACCESS_TOKEN_TYPE = exports.PRESET_SCOPE = exports.MCP_SCOPES = exports.accessTokenPrincipal = exports.verifyAccessToken = exports.signAccessToken = exports.listGrants = exports.revokeGrant = exports.revokeByRefreshToken = exports.getLiveGrant = exports.rotateRefreshToken = exports.exchangeAuthorizationCode = exports.issueAuthorizationCode = exports.getClient = exports.registerClient = exports.pkceChallenge = exports.hashSecret = exports.createSecret = exports.REFRESH_REUSE_GRACE_SECONDS = void 0;
+exports.OAUTH_PRINCIPAL_TYPE = exports.ACCESS_TOKEN_TYPE = exports.PRESET_SCOPE = exports.MCP_SCOPES = exports.accessTokenPrincipal = exports.verifyAccessToken = exports.signAccessToken = exports.pruneOAuthServer = exports.listGrants = exports.revokeGrant = exports.revokeByRefreshToken = exports.getLiveGrant = exports.rotateRefreshToken = exports.exchangeAuthorizationCode = exports.issueAuthorizationCode = exports.getClient = exports.registerClient = exports.pkceChallenge = exports.hashSecret = exports.createSecret = exports.REFRESH_REUSE_GRACE_SECONDS = void 0;
 var store_1 = require("./store");
 Object.defineProperty(exports, "REFRESH_REUSE_GRACE_SECONDS", { enumerable: true, get: function () { return store_1.REFRESH_REUSE_GRACE_SECONDS; } });
 Object.defineProperty(exports, "createSecret", { enumerable: true, get: function () { return store_1.createSecret; } });
@@ -15,6 +15,7 @@ Object.defineProperty(exports, "getLiveGrant", { enumerable: true, get: function
 Object.defineProperty(exports, "revokeByRefreshToken", { enumerable: true, get: function () { return store_1.revokeByRefreshToken; } });
 Object.defineProperty(exports, "revokeGrant", { enumerable: true, get: function () { return store_1.revokeGrant; } });
 Object.defineProperty(exports, "listGrants", { enumerable: true, get: function () { return store_1.listGrants; } });
+Object.defineProperty(exports, "pruneOAuthServer", { enumerable: true, get: function () { return store_1.pruneOAuthServer; } });
 var access_token_1 = require("./access-token");
 Object.defineProperty(exports, "signAccessToken", { enumerable: true, get: function () { return access_token_1.signAccessToken; } });
 Object.defineProperty(exports, "verifyAccessToken", { enumerable: true, get: function () { return access_token_1.verifyAccessToken; } });

package/build/services/auth/oauth-server/sql.d.ts

@@ -26,9 +26,25 @@ export declare const ROTATE_REFRESH_TOKEN = "\n  WITH old AS (\n    UPDATE lt_oa
  * outside the retry grace window: the token has leaked.
  */
 export declare const REVOKE_ON_REFRESH_REUSE = "\n  UPDATE lt_oauth_grants g SET revoked_at = NOW()\n  FROM lt_oauth_refresh_tokens t\n  WHERE t.token_hash = $1 AND t.used_at IS NOT NULL\n    AND t.used_at < NOW() - make_interval(secs => $2)\n    AND g.id = t.grant_id AND g.revoked_at IS NULL\n  RETURNING g.id AS grant_id, g.user_id";
+/**
+ * Revoke the grant of an authorization code presented again after it was
+ * exchanged: the code has leaked (RFC 6749 §4.1.2).
+ */
+export declare const REVOKE_ON_CODE_REUSE = "\n  UPDATE lt_oauth_grants g SET revoked_at = NOW()\n  FROM lt_oauth_codes c\n  WHERE c.code_hash = $1 AND c.used_at IS NOT NULL\n    AND g.id = c.grant_id AND g.revoked_at IS NULL\n  RETURNING g.id AS grant_id, g.user_id";
 /** Revoke the grant a refresh token belongs to, for the client presenting it. */
 export declare const REVOKE_BY_REFRESH_TOKEN = "\n  UPDATE lt_oauth_grants g SET revoked_at = NOW()\n  FROM lt_oauth_refresh_tokens t\n  WHERE t.token_hash = $1 AND g.id = t.grant_id AND g.client_id = $2 AND g.revoked_at IS NULL\n  RETURNING g.id AS grant_id, g.user_id";
 /** Revoke a grant by id, optionally only when it belongs to the given user. */
 export declare const REVOKE_GRANT = "\n  UPDATE lt_oauth_grants SET revoked_at = NOW()\n  WHERE id = $1 AND ($2::uuid IS NULL OR user_id = $2) AND revoked_at IS NULL\n  RETURNING id AS grant_id, user_id";
 /** A person's live grants that a client has put to use, newest first. */
 export declare const LIST_GRANTS = "\n  SELECT g.id AS grant_id, g.client_id, c.client_name, g.policy, g.scope, g.created_at,\n         (SELECT MAX(t.created_at) FROM lt_oauth_refresh_tokens t WHERE t.grant_id = g.id) AS last_used_at\n  FROM lt_oauth_grants g\n  JOIN lt_oauth_clients c ON c.client_id = g.client_id\n  WHERE g.user_id = $1 AND g.revoked_at IS NULL\n    AND EXISTS (SELECT 1 FROM lt_oauth_refresh_tokens t WHERE t.grant_id = g.id)\n  ORDER BY g.created_at DESC";
+/** Refresh tokens past expiry, or rotated out, longer ago than the window. */
+export declare const PRUNE_REFRESH_TOKENS = "\n  DELETE FROM lt_oauth_refresh_tokens\n  WHERE expires_at < NOW() - $1::interval OR used_at < NOW() - $1::interval";
+/** Authorization codes past expiry longer ago than the window, exchanged or not. */
+export declare const PRUNE_CODES = "\n  DELETE FROM lt_oauth_codes WHERE expires_at < NOW() - $1::interval";
+/**
+ * Grants revoked longer ago than the window, and grants older than the window
+ * left with no refresh token and no code: never exchanged, or long unused.
+ */
+export declare const PRUNE_GRANTS = "\n  DELETE FROM lt_oauth_grants g\n  WHERE g.revoked_at < NOW() - $1::interval\n     OR (g.created_at < NOW() - $1::interval\n         AND NOT EXISTS (SELECT 1 FROM lt_oauth_refresh_tokens t WHERE t.grant_id = g.id)\n         AND NOT EXISTS (SELECT 1 FROM lt_oauth_codes c WHERE c.grant_id = g.id))";
+/** Clients registered longer ago than the window with no live grant. */
+export declare const PRUNE_CLIENTS = "\n  DELETE FROM lt_oauth_clients c\n  WHERE c.created_at < NOW() - $1::interval\n    AND NOT EXISTS (SELECT 1 FROM lt_oauth_grants g WHERE g.client_id = c.client_id AND g.revoked_at IS NULL)";

package/build/services/auth/oauth-server/sql.js

@@ -1,7 +1,7 @@
 "use strict";
 // ── OAuth authorization server queries ─────────────────────────────────────
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LIST_GRANTS = exports.REVOKE_GRANT = exports.REVOKE_BY_REFRESH_TOKEN = exports.REVOKE_ON_REFRESH_REUSE = exports.ROTATE_REFRESH_TOKEN = exports.GET_LIVE_GRANT = exports.EXCHANGE_CODE = exports.ISSUE_CODE = exports.GET_CLIENT = exports.INSERT_CLIENT = void 0;
+exports.PRUNE_CLIENTS = exports.PRUNE_GRANTS = exports.PRUNE_CODES = exports.PRUNE_REFRESH_TOKENS = exports.LIST_GRANTS = exports.REVOKE_GRANT = exports.REVOKE_BY_REFRESH_TOKEN = exports.REVOKE_ON_CODE_REUSE = exports.REVOKE_ON_REFRESH_REUSE = exports.ROTATE_REFRESH_TOKEN = exports.GET_LIVE_GRANT = exports.EXCHANGE_CODE = exports.ISSUE_CODE = exports.GET_CLIENT = exports.INSERT_CLIENT = void 0;
 /** The grant owner's current memberships, as a JSON array. Expects alias `g`. */
 const GRANT_ROLES = `
   COALESCE((
@@ -101,6 +101,16 @@ exports.REVOKE_ON_REFRESH_REUSE = `
     AND t.used_at < NOW() - make_interval(secs => $2)
     AND g.id = t.grant_id AND g.revoked_at IS NULL
   RETURNING g.id AS grant_id, g.user_id`;
+/**
+ * Revoke the grant of an authorization code presented again after it was
+ * exchanged: the code has leaked (RFC 6749 §4.1.2).
+ */
+exports.REVOKE_ON_CODE_REUSE = `
+  UPDATE lt_oauth_grants g SET revoked_at = NOW()
+  FROM lt_oauth_codes c
+  WHERE c.code_hash = $1 AND c.used_at IS NOT NULL
+    AND g.id = c.grant_id AND g.revoked_at IS NULL
+  RETURNING g.id AS grant_id, g.user_id`;
 /** Revoke the grant a refresh token belongs to, for the client presenting it. */
 exports.REVOKE_BY_REFRESH_TOKEN = `
   UPDATE lt_oauth_grants g SET revoked_at = NOW()
@@ -121,3 +131,26 @@ exports.LIST_GRANTS = `
   WHERE g.user_id = $1 AND g.revoked_at IS NULL
     AND EXISTS (SELECT 1 FROM lt_oauth_refresh_tokens t WHERE t.grant_id = g.id)
   ORDER BY g.created_at DESC`;
+// ── Maintenance: each statement takes the retention window as $1 (an interval) ──
+/** Refresh tokens past expiry, or rotated out, longer ago than the window. */
+exports.PRUNE_REFRESH_TOKENS = `
+  DELETE FROM lt_oauth_refresh_tokens
+  WHERE expires_at < NOW() - $1::interval OR used_at < NOW() - $1::interval`;
+/** Authorization codes past expiry longer ago than the window, exchanged or not. */
+exports.PRUNE_CODES = `
+  DELETE FROM lt_oauth_codes WHERE expires_at < NOW() - $1::interval`;
+/**
+ * Grants revoked longer ago than the window, and grants older than the window
+ * left with no refresh token and no code: never exchanged, or long unused.
+ */
+exports.PRUNE_GRANTS = `
+  DELETE FROM lt_oauth_grants g
+  WHERE g.revoked_at < NOW() - $1::interval
+     OR (g.created_at < NOW() - $1::interval
+         AND NOT EXISTS (SELECT 1 FROM lt_oauth_refresh_tokens t WHERE t.grant_id = g.id)
+         AND NOT EXISTS (SELECT 1 FROM lt_oauth_codes c WHERE c.grant_id = g.id))`;
+/** Clients registered longer ago than the window with no live grant. */
+exports.PRUNE_CLIENTS = `
+  DELETE FROM lt_oauth_clients c
+  WHERE c.created_at < NOW() - $1::interval
+    AND NOT EXISTS (SELECT 1 FROM lt_oauth_grants g WHERE g.client_id = c.client_id AND g.revoked_at IS NULL)`;

package/build/services/auth/oauth-server/store.d.ts

@@ -34,7 +34,8 @@ export declare function issueAuthorizationCode(input: {
 /**
  * Exchange a code for the grant and its first refresh token. Null when the
  * code is unknown, used, expired, for another client or redirect URI, fails
- * PKCE, or its grant or owner is no longer active.
+ * PKCE, or its grant or owner is no longer active. A code presented again
+ * after its exchange revokes its grant.
  */
 export declare function exchangeAuthorizationCode(input: {
     code: string;
@@ -72,3 +73,16 @@ export declare function revokeByRefreshToken(refreshToken: string, clientId: str
 export declare function revokeGrant(grantId: string, userId?: string): Promise<RevokedGrant | null>;
 /** The person's live grants that a client has put to use. */
 export declare function listGrants(userId: string): Promise<LTGrantSummary[]>;
+export interface OAuthPruneCounts {
+    refreshTokens: number;
+    codes: number;
+    grants: number;
+    clients: number;
+}
+/**
+ * Delete what the authorization server no longer needs, older than the
+ * window (a Postgres interval): spent and expired refresh tokens and codes,
+ * then grants with neither left or revoked, then clients with no live grant.
+ * Each step reads what the one before it left.
+ */
+export declare function pruneOAuthServer(olderThan: string): Promise<OAuthPruneCounts>;

package/build/services/auth/oauth-server/store.js

@@ -46,6 +46,7 @@ exports.getLiveGrant = getLiveGrant;
 exports.revokeByRefreshToken = revokeByRefreshToken;
 exports.revokeGrant = revokeGrant;
 exports.listGrants = listGrants;
+exports.pruneOAuthServer = pruneOAuthServer;
 const crypto = __importStar(require("crypto"));
 const db_1 = require("../../../lib/db");
 const uuid_1 = require("../../../lib/uuid");
@@ -94,16 +95,21 @@ async function issueAuthorizationCode(input) {
 /**
  * Exchange a code for the grant and its first refresh token. Null when the
  * code is unknown, used, expired, for another client or redirect URI, fails
- * PKCE, or its grant or owner is no longer active.
+ * PKCE, or its grant or owner is no longer active. A code presented again
+ * after its exchange revokes its grant.
  */
 async function exchangeAuthorizationCode(input) {
+    const pool = (0, db_1.getPool)();
     const refreshToken = createSecret();
-    const { rows } = await (0, db_1.getPool)().query(sql_1.EXCHANGE_CODE, [
-        hashSecret(input.code), input.clientId, input.redirectUri, pkceChallenge(input.codeVerifier),
+    const codeHash = hashSecret(input.code);
+    const { rows } = await pool.query(sql_1.EXCHANGE_CODE, [
+        codeHash, input.clientId, input.redirectUri, pkceChallenge(input.codeVerifier),
         hashSecret(refreshToken), input.refreshTtlSeconds,
     ]);
-    if (!rows[0])
+    if (!rows[0]) {
+        await pool.query(sql_1.REVOKE_ON_CODE_REUSE, [codeHash]);
         return null;
+    }
     const { resource, ...snapshot } = rows[0];
     return { snapshot, resource, refreshToken };
 }
@@ -149,3 +155,17 @@ async function listGrants(userId) {
     const { rows } = await (0, db_1.getPool)().query(sql_1.LIST_GRANTS, [userId]);
     return rows;
 }
+/**
+ * Delete what the authorization server no longer needs, older than the
+ * window (a Postgres interval): spent and expired refresh tokens and codes,
+ * then grants with neither left or revoked, then clients with no live grant.
+ * Each step reads what the one before it left.
+ */
+async function pruneOAuthServer(olderThan) {
+    const pool = (0, db_1.getPool)();
+    const refreshTokens = (await pool.query(sql_1.PRUNE_REFRESH_TOKENS, [olderThan])).rowCount ?? 0;
+    const codes = (await pool.query(sql_1.PRUNE_CODES, [olderThan])).rowCount ?? 0;
+    const grants = (await pool.query(sql_1.PRUNE_GRANTS, [olderThan])).rowCount ?? 0;
+    const clients = (await pool.query(sql_1.PRUNE_CLIENTS, [olderThan])).rowCount ?? 0;
+    return { refreshTokens, codes, grants, clients };
+}

package/build/services/cron/index.js

@@ -65,6 +65,7 @@ function validateCronSchedule(expr) {
 const CRON_TOPIC_PREFIX = 'lt.cron';
 const CRON_ID_PREFIX = 'lt-cron';
 const YAML_CRON_TOPIC_PREFIX = 'lt.cron.yaml';
+const CRON_SOURCE = 'cron';
 const YAML_CRON_ID_PREFIX = 'lt-cron-yaml';
 /**
  * Singleton registry for workflow cron schedules.
@@ -241,9 +242,10 @@ class LTCronRegistry {
                 try {
                     cronCallCount++;
                     logger_1.loggerRegistry.info(`[lt-cron] tick #${cronCallCount} at ${new Date().toISOString()} — pub(${appId}/${graphTopic})`);
-                    const { getEngine } = await Promise.resolve().then(() => __importStar(require('../yaml-workflow/deployer')));
-                    const engine = await getEngine(appId);
-                    await engine.pub(graphTopic, cronEnvelope, undefined, { entity: graphTopic });
+                    // Through the invoke service, so the run carries only the scope the
+                    // server resolves for execute_as, never one written in the envelope.
+                    const { invokeYamlWorkflow } = await Promise.resolve().then(() => __importStar(require('../yaml-workflow/invoke')));
+                    await invokeYamlWorkflow(wf, { data: cronEnvelope, execute_as: wf.execute_as ?? undefined, source: CRON_SOURCE });
                     logger_1.loggerRegistry.info(`[lt-cron] tick #${cronCallCount} published successfully`);
                 }
                 catch (err) {

package/build/services/maintenance/index.js

@@ -106,6 +106,14 @@ async function executeRule(appId, rule) {
             }
             break;
         }
+        // Drop the authorization server's dead rows: spent or expired tokens and
+        // codes, grants with neither left or long revoked, clients with no live grant.
+        case rule.target === 'oauth' && rule.action === 'delete': {
+            const { pruneOAuthServer } = await Promise.resolve().then(() => __importStar(require('../auth/oauth-server')));
+            const counts = await pruneOAuthServer(rule.olderThan);
+            logger_1.loggerRegistry.info(`[lt-maintenance] oauth pruned: ${JSON.stringify(counts)} (olderThan: ${rule.olderThan})`);
+            break;
+        }
         default:
             logger_1.loggerRegistry.warn(`[lt-maintenance] unknown rule, skipping: ${JSON.stringify(rule)}`);
     }

package/build/services/mcp/seed-service-account.d.ts

@@ -6,6 +6,9 @@
  *   - `mcp:full`  — all tools (automation, orchestration)
  *
  * Idempotent — skips creation if the account already exists.
- * Keys are generated once and logged; they cannot be retrieved again.
+ * With LT_SEED_SERVICE_KEYS=true (local docker compose) the keys are
+ * generated once and printed to stdout, never to the logger; they cannot be
+ * retrieved again. Otherwise the account is created without keys and a
+ * superadmin mints them from the dashboard or the bot-accounts API.
  */
 export declare function seedMcpServiceAccount(): Promise<void>;

package/build/services/mcp/seed-service-account.js

@@ -7,7 +7,10 @@
  *   - `mcp:full`  — all tools (automation, orchestration)
  *
  * Idempotent — skips creation if the account already exists.
- * Keys are generated once and logged; they cannot be retrieved again.
+ * With LT_SEED_SERVICE_KEYS=true (local docker compose) the keys are
+ * generated once and printed to stdout, never to the logger; they cannot be
+ * retrieved again. Otherwise the account is created without keys and a
+ * superadmin mints them from the dashboard or the bot-accounts API.
  */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
@@ -45,6 +48,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.seedMcpServiceAccount = seedMcpServiceAccount;
 const logger_1 = require("../../lib/logger");
+const config_1 = require("../../modules/config");
 const crud_1 = require("../user/crud");
 const iam = __importStar(require("../iam"));
 const SERVICE_ACCOUNT_NAME = 'mcp-service';
@@ -63,13 +67,14 @@ async function seedMcpServiceAccount() {
             display_name: 'MCP Service',
             roles: [{ role: 'system', type: 'member' }],
         });
-        // Generate read key (scoped to mcp:read)
+        if (!config_1.config.LT_SEED_SERVICE_KEYS) {
+            logger_1.loggerRegistry.info(`[seed-mcp] ${SERVICE_ACCOUNT_NAME} created; mint its API keys from the dashboard`);
+            return;
+        }
         const readKey = await iam.createBotKey(bot.id, 'read', ['mcp:read']);
-        logger_1.loggerRegistry.info(`[seed-mcp] read key: ${readKey.rawKey}`);
-        // Generate full key (scoped to mcp:full)
         const fullKey = await iam.createBotKey(bot.id, 'full', ['mcp:read', 'mcp:full']);
-        logger_1.loggerRegistry.info(`[seed-mcp] full key: ${fullKey.rawKey}`);
-        logger_1.loggerRegistry.info(`[seed-mcp] ${SERVICE_ACCOUNT_NAME} created with read + full API keys`);
+        process.stdout.write(`[seed-mcp] read key: ${readKey.rawKey}\n[seed-mcp] full key: ${fullKey.rawKey}\n`);
+        logger_1.loggerRegistry.info(`[seed-mcp] ${SERVICE_ACCOUNT_NAME} created with read + full API keys (printed to stdout)`);
     }
     catch (err) {
         logger_1.loggerRegistry.warn(`[seed-mcp] failed to seed: ${err.message}`);

package/build/services/yaml-workflow/invoke.js

@@ -36,11 +36,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.invokeYamlWorkflow = invokeYamlWorkflow;
 const yamlDeployer = __importStar(require("./deployer"));
 const principal_1 = require("../iam/principal");
+const workflow_invocation_1 = require("../workflow-invocation");
 const publish_1 = require("../../lib/events/publish");
 /**
  * The identity context compiled workflow activities run under, from the
  * server-side identity: execute_as with the invoker as initiator, else the
- * invoker. Never read from the caller's data.
+ * invoker. Never read from the caller's data. An identity that does not
+ * resolve is refused rather than run with none.
  */
 async function resolveScope(executeAs, userId) {
     if (executeAs) {
@@ -49,7 +51,7 @@ async function resolveScope(executeAs, userId) {
             userId ? (0, principal_1.resolvePrincipal)(userId) : Promise.resolve(null),
         ]);
         if (!botPrincipal)
-            return undefined;
+            throw new workflow_invocation_1.InvocationError(`execute_as principal "${executeAs}" not found`, 404);
         return {
             principal: botPrincipal,
             scopes: ['mcp:tool:call'],
@@ -59,7 +61,9 @@ async function resolveScope(executeAs, userId) {
     if (!userId)
         return undefined;
     const principal = await (0, principal_1.resolvePrincipal)(userId);
-    return principal ? { principal, scopes: ['mcp:tool:call'] } : undefined;
+    if (!principal)
+        throw new workflow_invocation_1.InvocationError('User not registered', 403);
+    return { principal, scopes: ['mcp:tool:call'] };
 }
 /**
  * Invoke a YAML workflow with scope injection.

package/build/services/yaml-workflow/workers/register.js

@@ -40,10 +40,9 @@ const db_1 = require("../../../lib/db");
 const logger_1 = require("../../../lib/logger");
 const system_events_1 = require("../../../lib/events/system-events");
 const ephemeral_1 = require("../../iam/ephemeral");
-const mcpClient = __importStar(require("../../mcp/client"));
-const connection_1 = require("../../mcp/client/connection");
 const yamlDb = __importStar(require("../db"));
 const scope_1 = require("./scope");
+const step_tool_1 = require("./step-tool");
 const callbacks_1 = require("./callbacks");
 const events_1 = require("./events");
 /**
@@ -156,7 +155,7 @@ async function registerWorkersForWorkflow(workflow) {
                     delete mergedArgs._scope;
                     delete mergedArgs.workflowName;
                     mergedArgs = await (0, ephemeral_1.exchangeTokensInArgs)(mergedArgs);
-                    const result = await mcpClient.callServerTool(dbServerId, toolName, mergedArgs);
+                    const result = await (0, step_tool_1.callStepTool)(dbServerId, toolName, mergedArgs);
                     logger_1.loggerRegistry.debug(`[yaml-workflow:worker] leaving db/${toolName} wf=${wfName} resultKeys=[${Object.keys(result || {}).join(',')}]`);
                     return { metadata: { ...data.metadata }, data: result };
                 }),
@@ -230,16 +229,7 @@ async function registerWorkersForWorkflow(workflow) {
                     }
                     const exchangedArgs = await (0, ephemeral_1.exchangeTokensInArgs)(mergedArgs);
                     const coercedArgs = coerceNumericObjects(exchangedArgs);
-                    // Try direct dispatch for built-in servers (bypasses MCP transport).
-                    // Falls through to mcpClient.callServerTool() for external servers.
-                    let result;
-                    const builtin = await (0, connection_1.dispatchBuiltinTool)(serverId, toolName, coercedArgs);
-                    if (builtin) {
-                        result = builtin.result;
-                    }
-                    else {
-                        result = await mcpClient.callServerTool(serverId, toolName, coercedArgs);
-                    }
+                    const result = await (0, step_tool_1.callStepTool)(serverId, toolName, coercedArgs);
                     if (result && typeof result === 'object' && 'error' in result) {
                         logger_1.loggerRegistry.error(`[yaml-workflow:worker] ${toolName} error: ${JSON.stringify(result).slice(0, 200)}`);
                     }

package/build/services/yaml-workflow/workers/step-tool.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Call a step's tool. A built-in tool runs as the principal the workflow was
+ * started for (its `_scope`), under the tool's manifest gate, so a step never
+ * does more than its invoker may. A run started in-process with no principal
+ * calls it as lt-system. Other servers are called as before.
+ */
+export declare function callStepTool(serverId: string, toolName: string, args: Record<string, unknown>): Promise<any>;