@hotmeshio/long-tail 0.24.0 → 0.24.2

package/build/services/mcp/seed-service-account.js

@@ -7,7 +7,10 @@
  *   - `mcp:full`  — all tools (automation, orchestration)
  *
  * Idempotent — skips creation if the account already exists.
- * Keys are generated once and logged; they cannot be retrieved again.
+ * With LT_SEED_SERVICE_KEYS=true (local docker compose) the keys are
+ * generated once and printed to stdout, never to the logger; they cannot be
+ * retrieved again. Otherwise the account is created without keys and a
+ * superadmin mints them from the dashboard or the bot-accounts API.
  */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
@@ -45,6 +48,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.seedMcpServiceAccount = seedMcpServiceAccount;
 const logger_1 = require("../../lib/logger");
+const config_1 = require("../../modules/config");
 const crud_1 = require("../user/crud");
 const iam = __importStar(require("../iam"));
 const SERVICE_ACCOUNT_NAME = 'mcp-service';
@@ -63,13 +67,14 @@ async function seedMcpServiceAccount() {
             display_name: 'MCP Service',
             roles: [{ role: 'system', type: 'member' }],
         });
-        // Generate read key (scoped to mcp:read)
+        if (!config_1.config.LT_SEED_SERVICE_KEYS) {
+            logger_1.loggerRegistry.info(`[seed-mcp] ${SERVICE_ACCOUNT_NAME} created; mint its API keys from the dashboard`);
+            return;
+        }
         const readKey = await iam.createBotKey(bot.id, 'read', ['mcp:read']);
-        logger_1.loggerRegistry.info(`[seed-mcp] read key: ${readKey.rawKey}`);
-        // Generate full key (scoped to mcp:full)
         const fullKey = await iam.createBotKey(bot.id, 'full', ['mcp:read', 'mcp:full']);
-        logger_1.loggerRegistry.info(`[seed-mcp] full key: ${fullKey.rawKey}`);
-        logger_1.loggerRegistry.info(`[seed-mcp] ${SERVICE_ACCOUNT_NAME} created with read + full API keys`);
+        process.stdout.write(`[seed-mcp] read key: ${readKey.rawKey}\n[seed-mcp] full key: ${fullKey.rawKey}\n`);
+        logger_1.loggerRegistry.info(`[seed-mcp] ${SERVICE_ACCOUNT_NAME} created with read + full API keys (printed to stdout)`);
     }
     catch (err) {
         logger_1.loggerRegistry.warn(`[seed-mcp] failed to seed: ${err.message}`);

package/build/services/yaml-workflow/invoke.js

@@ -36,11 +36,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.invokeYamlWorkflow = invokeYamlWorkflow;
 const yamlDeployer = __importStar(require("./deployer"));
 const principal_1 = require("../iam/principal");
+const workflow_invocation_1 = require("../workflow-invocation");
 const publish_1 = require("../../lib/events/publish");
 /**
  * The identity context compiled workflow activities run under, from the
  * server-side identity: execute_as with the invoker as initiator, else the
- * invoker. Never read from the caller's data.
+ * invoker. Never read from the caller's data. An identity that does not
+ * resolve is refused rather than run with none.
  */
 async function resolveScope(executeAs, userId) {
     if (executeAs) {
@@ -49,7 +51,7 @@ async function resolveScope(executeAs, userId) {
             userId ? (0, principal_1.resolvePrincipal)(userId) : Promise.resolve(null),
         ]);
         if (!botPrincipal)
-            return undefined;
+            throw new workflow_invocation_1.InvocationError(`execute_as principal "${executeAs}" not found`, 404);
         return {
             principal: botPrincipal,
             scopes: ['mcp:tool:call'],
@@ -59,7 +61,9 @@ async function resolveScope(executeAs, userId) {
     if (!userId)
         return undefined;
     const principal = await (0, principal_1.resolvePrincipal)(userId);
-    return principal ? { principal, scopes: ['mcp:tool:call'] } : undefined;
+    if (!principal)
+        throw new workflow_invocation_1.InvocationError('User not registered', 403);
+    return { principal, scopes: ['mcp:tool:call'] };
 }
 /**
  * Invoke a YAML workflow with scope injection.

package/build/services/yaml-workflow/workers/register.js

@@ -40,10 +40,9 @@ const db_1 = require("../../../lib/db");
 const logger_1 = require("../../../lib/logger");
 const system_events_1 = require("../../../lib/events/system-events");
 const ephemeral_1 = require("../../iam/ephemeral");
-const mcpClient = __importStar(require("../../mcp/client"));
-const connection_1 = require("../../mcp/client/connection");
 const yamlDb = __importStar(require("../db"));
 const scope_1 = require("./scope");
+const step_tool_1 = require("./step-tool");
 const callbacks_1 = require("./callbacks");
 const events_1 = require("./events");
 /**
@@ -156,7 +155,7 @@ async function registerWorkersForWorkflow(workflow) {
                     delete mergedArgs._scope;
                     delete mergedArgs.workflowName;
                     mergedArgs = await (0, ephemeral_1.exchangeTokensInArgs)(mergedArgs);
-                    const result = await mcpClient.callServerTool(dbServerId, toolName, mergedArgs);
+                    const result = await (0, step_tool_1.callStepTool)(dbServerId, toolName, mergedArgs);
                     logger_1.loggerRegistry.debug(`[yaml-workflow:worker] leaving db/${toolName} wf=${wfName} resultKeys=[${Object.keys(result || {}).join(',')}]`);
                     return { metadata: { ...data.metadata }, data: result };
                 }),
@@ -230,16 +229,7 @@ async function registerWorkersForWorkflow(workflow) {
                     }
                     const exchangedArgs = await (0, ephemeral_1.exchangeTokensInArgs)(mergedArgs);
                     const coercedArgs = coerceNumericObjects(exchangedArgs);
-                    // Try direct dispatch for built-in servers (bypasses MCP transport).
-                    // Falls through to mcpClient.callServerTool() for external servers.
-                    let result;
-                    const builtin = await (0, connection_1.dispatchBuiltinTool)(serverId, toolName, coercedArgs);
-                    if (builtin) {
-                        result = builtin.result;
-                    }
-                    else {
-                        result = await mcpClient.callServerTool(serverId, toolName, coercedArgs);
-                    }
+                    const result = await (0, step_tool_1.callStepTool)(serverId, toolName, coercedArgs);
                     if (result && typeof result === 'object' && 'error' in result) {
                         logger_1.loggerRegistry.error(`[yaml-workflow:worker] ${toolName} error: ${JSON.stringify(result).slice(0, 200)}`);
                     }

package/build/services/yaml-workflow/workers/step-tool.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Call a step's tool. A built-in tool runs as the principal the workflow was
+ * started for (its `_scope`), under the tool's manifest gate, so a step never
+ * does more than its invoker may. A run started in-process with no principal
+ * calls it as lt-system. Other servers are called as before.
+ */
+export declare function callStepTool(serverId: string, toolName: string, args: Record<string, unknown>): Promise<any>;

package/build/services/yaml-workflow/workers/step-tool.js

@@ -0,0 +1,69 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.callStepTool = callStepTool;
+const context_1 = require("../../iam/context");
+const mcpClient = __importStar(require("../../mcp/client"));
+const connection_1 = require("../../mcp/client/connection");
+/**
+ * Call a step's tool. A built-in tool runs as the principal the workflow was
+ * started for (its `_scope`), under the tool's manifest gate, so a step never
+ * does more than its invoker may. A run started in-process with no principal
+ * calls it as lt-system. Other servers are called as before.
+ */
+async function callStepTool(serverId, toolName, args) {
+    const [{ builtinServerFor, builtinToolGate }, { currentToolPrincipal }] = await Promise.all([
+        Promise.resolve().then(() => __importStar(require('../../../api/mcp/tools'))),
+        Promise.resolve().then(() => __importStar(require('../../../system/workflows/shared/principal-tools'))),
+    ]);
+    const builtin = await builtinServerFor(serverId);
+    if (!builtin)
+        return mcpClient.callServerTool(serverId, toolName, args);
+    const principal = await currentToolPrincipal();
+    if (!principal) {
+        const dispatched = await (0, connection_1.dispatchBuiltinTool)(builtin, toolName, args);
+        if (!dispatched)
+            throw new Error(`Tool ${toolName} not found on ${builtin}`);
+        return dispatched.result;
+    }
+    if (!(await principal.access(builtinToolGate(builtin, toolName)))) {
+        return { error: `${toolName} is not available to this caller` };
+    }
+    const ctx = (0, context_1.getToolContext)();
+    const credentials = ctx?.principal.id
+        ? { userId: ctx.principal.id, delegationToken: ctx.credentials.delegationToken }
+        : undefined;
+    return mcpClient.callBuiltinToolAs(builtin, toolName, args, { userId: principal.userId }, credentials);
+}

package/build/system/mcp-servers/admin/agent-subscriptions.js

@@ -75,7 +75,8 @@ function registerAgentSubscriptionTools(server) {
         const caller = (0, caller_auth_1.externalCaller)(extra);
         const refused = caller
             ? await refusal(() => (0, authority_1.assertMayConfigureSubscription)(caller.userId, {
-                agentId: agent_id, reaction_type: body.reaction_type, execute_as: body.execute_as,
+                agentId: agent_id, reaction_type: body.reaction_type,
+                workflow_type: body.workflow_type, execute_as: body.execute_as,
             }))
             : null;
         if (refused)

package/build/system/mcp-servers/admin/schemas.d.ts

@@ -377,12 +377,12 @@ export declare const upsertWorkflowConfigSchema: z.ZodObject<{
     icon: z.ZodDefault<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
     read_safe: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
 }, "strip", z.ZodTypeAny, {
+    roles: string[];
     workflow_type: string;
     invocable: boolean;
     task_queue: string | null;
     default_role: string;
     description: string | null;
-    roles: string[];
     invocation_roles: string[];
     consumes: string[];
     tool_tags: string[];
@@ -403,11 +403,11 @@ export declare const upsertWorkflowConfigSchema: z.ZodObject<{
 }, {
     workflow_type: string;
     certified?: boolean | undefined;
+    roles?: string[] | undefined;
     invocable?: boolean | undefined;
     task_queue?: string | null | undefined;
     default_role?: string | undefined;
     description?: string | null | undefined;
-    roles?: string[] | undefined;
     invocation_roles?: string[] | undefined;
     consumes?: string[] | undefined;
     tool_tags?: string[] | undefined;
@@ -1196,19 +1196,19 @@ export declare const createBotSchema: z.ZodObject<{
     }>, "many">>;
 }, "strip", z.ZodTypeAny, {
     name: string;
-    description?: string | undefined;
     roles?: {
         role: string;
         type: string;
     }[] | undefined;
+    description?: string | undefined;
     display_name?: string | undefined;
 }, {
     name: string;
-    description?: string | undefined;
     roles?: {
         role: string;
         type: string;
     }[] | undefined;
+    description?: string | undefined;
     display_name?: string | undefined;
 }>;
 export declare const updateBotSchema: z.ZodObject<{
@@ -1277,15 +1277,15 @@ export declare const applyThrottleSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     appId: string;
     throttle: number;
+    scope?: string | undefined;
     topic?: string | undefined;
     guid?: string | undefined;
-    scope?: string | undefined;
 }, {
     throttle: number;
     appId?: string | undefined;
+    scope?: string | undefined;
     topic?: string | undefined;
     guid?: string | undefined;
-    scope?: string | undefined;
 }>;
 export declare const getStreamStatsSchema: z.ZodObject<{
     app_id: z.ZodDefault<z.ZodOptional<z.ZodString>>;

package/build/system/mcp-servers/admin/yaml-workflows.js

@@ -215,29 +215,15 @@ function registerYamlWorkflowTools(server) {
         description: 'Run a compiled YAML workflow. Deterministic — no LLM reasoning, ' +
             'just direct tool-to-tool data piping. Set sync=true to wait for result.',
         inputSchema: schemas_1.invokeYamlWorkflowSchema,
-    }, async (args) => {
-        const wf = await yamlDb.getYamlWorkflow(args.id);
-        if (!wf) {
-            return {
-                content: [{ type: 'text', text: JSON.stringify({ error: 'YAML workflow not found' }) }],
-                isError: true,
-            };
-        }
-        if (wf.status !== 'active') {
+    }, async (args, extra) => {
+        // Runs as the /mcp caller, under each step tool's gate.
+        const result = await (0, deploy_1.invokeYamlWorkflow)({ id: args.id, data: args.data, sync: args.sync, timeout: args.timeout }, (0, caller_auth_1.externalCaller)(extra));
+        if (result.error) {
             return {
-                content: [{ type: 'text', text: JSON.stringify({ error: 'Workflow must be active to invoke' }) }],
+                content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }],
                 isError: true,
             };
         }
-        if (args.sync) {
-            const { job_id, result } = await yamlDeployer.invokeYamlWorkflowSync(wf.app_id, wf.graph_topic, args.data, args.timeout, wf.graph_topic);
-            return {
-                content: [{ type: 'text', text: JSON.stringify({ job_id, result }) }],
-            };
-        }
-        const jobId = await yamlDeployer.invokeYamlWorkflow(wf.app_id, wf.graph_topic, args.data, wf.graph_topic);
-        return {
-            content: [{ type: 'text', text: JSON.stringify({ job_id: jobId }) }],
-        };
+        return { content: [{ type: 'text', text: JSON.stringify(result.data) }] };
     });
 }

package/build/system/mcp-servers/workflow.js

@@ -41,7 +41,8 @@ const zod_1 = require("zod");
 const defaults_1 = require("../../modules/defaults");
 const logger_1 = require("../../lib/logger");
 const yamlDb = __importStar(require("../../services/yaml-workflow/db"));
-const yamlDeployer = __importStar(require("../../services/yaml-workflow/deployer"));
+const deploy_1 = require("../../api/yaml-workflows/deploy");
+const caller_auth_1 = require("./caller-auth");
 let server = null;
 // ── Schemas ─────────────────────────────────────────────────────────────────
 const listWorkflowsSchema = zod_1.z.object({
@@ -161,7 +162,7 @@ async function createWorkflowServer(options) {
             'to discover available workflows and their input schemas. ' +
             'Set async=true for fire-and-forget (returns job ID), or leave false to wait for the result.',
         inputSchema: invokeWorkflowSchema,
-    }, async (args) => {
+    }, async (args, extra) => {
         const wf = await yamlDb.getYamlWorkflowByName(args.workflow_name);
         if (!wf) {
             return {
@@ -183,32 +184,19 @@ async function createWorkflowServer(options) {
                 isError: true,
             };
         }
-        if (args.async) {
-            const jobId = await yamlDeployer.invokeYamlWorkflow(wf.app_id, wf.graph_topic, args.input || {}, wf.graph_topic);
+        // Runs as the /mcp caller, under each step tool's gate.
+        const invoked = await (0, deploy_1.invokeYamlWorkflow)({ id: wf.id, data: args.input || {}, sync: !args.async, timeout: args.timeout }, (0, caller_auth_1.externalCaller)(extra));
+        if (invoked.error) {
             return {
-                content: [{
-                        type: 'text',
-                        text: JSON.stringify({
-                            job_id: jobId,
-                            workflow: wf.name,
-                            status: 'started',
-                        }),
-                    }],
+                content: [{ type: 'text', text: JSON.stringify({ error: invoked.error }) }],
+                isError: true,
             };
         }
-        const { job_id, result } = await yamlDeployer.invokeYamlWorkflowSync(wf.app_id, wf.graph_topic, args.input || {}, args.timeout, wf.graph_topic);
-        return {
-            content: [{
-                    type: 'text',
-                    text: JSON.stringify({
-                        job_id,
-                        namespace: wf.app_id,
-                        workflow: wf.name,
-                        status: 'completed',
-                        result,
-                    }),
-                }],
-        };
+        const { job_id, result } = invoked.data;
+        const outcome = args.async
+            ? { job_id, workflow: wf.name, status: 'started' }
+            : { job_id, namespace: wf.app_id, workflow: wf.name, status: 'completed', result };
+        return { content: [{ type: 'text', text: JSON.stringify(outcome) }] };
     });
     const toolCount = 3;
     logger_1.loggerRegistry.info(`[lt-mcp:server] ${name} ready (${toolCount} tools registered)`);

package/build/tsconfig.tsbuildinfo

@@ -1 +1 @@
-{"root":["../index.ts","../vitest.config.ts","../vitest.fast.config.ts","../vitest.integration.config.ts","../vitest.llm.config.ts","../adapters/express.ts","../api/agent-subscriptions.ts","../api/agents.ts","../api/announcements.ts","../api/auth-sso.ts","../api/auth.ts","../api/bot-accounts.ts","../api/capabilities.ts","../api/controlplane.ts","../api/dba.ts","../api/diagnostics.ts","../api/domain.ts","../api/exports.ts","../api/files.ts","../api/index.ts","../api/insight.ts","../api/knowledge.ts","../api/maintenance.ts","../api/me.ts","../api/namespaces.ts","../api/overview.ts","../api/personas.ts","../api/pipelines.ts","../api/roles.ts","../api/settings.ts","../api/tasks.ts","../api/topics.ts","../api/users.ts","../api/workflow-sets.ts","../api/escalations/accumulate.ts","../api/escalations/analytics.ts","../api/escalations/bulk.ts","../api/escalations/cancel.ts","../api/escalations/claim.ts","../api/escalations/create.ts","../api/escalations/facets.ts","../api/escalations/helpers.ts","../api/escalations/index.ts","../api/escalations/list.ts","../api/escalations/lookups.ts","../api/escalations/metadata.ts","../api/escalations/related.ts","../api/escalations/resolve-batch.ts","../api/escalations/resolve.ts","../api/escalations/single.ts","../api/mcp/index.ts","../api/mcp/servers.ts","../api/mcp/tools.ts","../api/scan-codes/badge-policy.ts","../api/scan-codes/choice.ts","../api/scan-codes/config.ts","../api/scan-codes/context.ts","../api/scan-codes/execute.ts","../api/scan-codes/grant.ts","../api/scan-codes/hold.ts","../api/scan-codes/identity.ts","../api/scan-codes/index.ts","../api/scan-codes/locate.ts","../api/scan-codes/present.ts","../api/scan-codes/subject.ts","../api/scan-codes/verb-accumulate.ts","../api/scan-codes/verb-fill.ts","../api/scan-codes/verb-into-subject.ts","../api/scan-codes/verbs-subject.ts","../api/scan-codes/verbs.ts","../api/workflows/config.ts","../api/workflows/discovery.ts","../api/workflows/index.ts","../api/workflows/input-lookups.ts","../api/workflows/input-validation.ts","../api/workflows/invocable.ts","../api/workflows/invocation.ts","../api/yaml-workflows/cron.ts","../api/yaml-workflows/crud.ts","../api/yaml-workflows/deploy.ts","../api/yaml-workflows/helpers.ts","../api/yaml-workflows/index.ts","../api/yaml-workflows/versions.ts","../bin/ltc.ts","../lib/typed-resolution.ts","../lib/uuid.ts","../lib/cli/auth.ts","../lib/cli/client.ts","../lib/cli/compile.ts","../lib/cli/format.ts","../lib/cli/init.ts","../lib/cli/output.ts","../lib/cli/scanner.ts","../lib/cli/types.ts","../lib/cli/commands/escalations.ts","../lib/cli/commands/knowledge.ts","../lib/cli/commands/mcp.ts","../lib/cli/commands/personas.ts","../lib/cli/commands/pipelines.ts","../lib/cli/commands/roles.ts","../lib/cli/commands/status.ts","../lib/cli/commands/streams.ts","../lib/cli/commands/users.ts","../lib/cli/commands/workflows.ts","../lib/db/index.ts","../lib/db/migrate.ts","../lib/events/browser-view.ts","../lib/events/callback.ts","../lib/events/escalation-wire.ts","../lib/events/index.ts","../lib/events/matching.ts","../lib/events/memory.ts","../lib/events/nats-ws-filter.ts","../lib/events/nats-ws-proxy.ts","../lib/events/nats-ws-server-filter.ts","../lib/events/nats-ws-ticket.ts","../lib/events/nats.ts","../lib/events/publish.ts","../lib/events/socketio.ts","../lib/events/system-events.ts","../lib/http/index.ts","../lib/json-path/pick.ts","../lib/logger/index.ts","../lib/logger/pino.ts","../lib/storage/index.ts","../lib/storage/local.ts","../lib/storage/mime.ts","../lib/storage/s3.ts","../lib/storage/types.ts","../lib/telemetry/honeycomb.ts","../lib/telemetry/index.ts","../modules/auth.ts","../modules/branding.ts","../modules/capabilities.ts","../modules/config.ts","../modules/defaults.ts","../modules/display.ts","../modules/features.ts","../modules/ltconfig.ts","../modules/maintenance.ts","../modules/mcp-auth.ts","../modules/oauth-server.ts","../modules/search.ts","../modules/sso.ts","../modules/utils.ts","../modules/version.ts","../routes/agents.ts","../routes/announcements.ts","../routes/auth-sso.ts","../routes/auth.ts","../routes/bot-accounts.ts","../routes/capabilities.ts","../routes/controlplane.ts","../routes/dba.ts","../routes/delegation.ts","../routes/diagnostics.ts","../routes/docs.ts","../routes/domain.ts","../routes/exports.ts","../routes/file-browser.ts","../routes/files.ts","../routes/index.ts","../routes/insight.ts","../routes/knowledge.ts","../routes/maintenance.ts","../routes/mcp-endpoint.ts","../routes/mcp.ts","../routes/me.ts","../routes/namespaces.ts","../routes/nats-credentials.ts","../routes/oauth-well-known.ts","../routes/oauth.ts","../routes/overview.ts","../routes/personas.ts","../routes/pipelines.ts","../routes/roles.ts","../routes/scan-codes.ts","../routes/settings.ts","../routes/tasks.ts","../routes/topics.ts","../routes/users.ts","../routes/workflow-sets.ts","../routes/escalations/accumulate.ts","../routes/escalations/acting.ts","../routes/escalations/analytics.ts","../routes/escalations/bulk.ts","../routes/escalations/facets.ts","../routes/escalations/index.ts","../routes/escalations/list.ts","../routes/escalations/metadata.ts","../routes/escalations/related.ts","../routes/escalations/resolve.ts","../routes/escalations/single.ts","../routes/oauth-server/authorize.ts","../routes/oauth-server/grants.ts","../routes/oauth-server/index.ts","../routes/oauth-server/registration.ts","../routes/oauth-server/token.ts","../routes/workflows/config.ts","../routes/workflows/discovery.ts","../routes/workflows/index.ts","../routes/workflows/invocation.ts","../routes/yaml-workflows/cron.ts","../routes/yaml-workflows/crud.ts","../routes/yaml-workflows/deployment.ts","../routes/yaml-workflows/index.ts","../routes/yaml-workflows/versions.ts","../scripts/consolidation-sim.ts","../scripts/ortho-populate.ts","../scripts/printer-cycle.ts","../scripts/process-helpers.ts","../scripts/process.ts","../scripts/token.ts","../scripts/twin-farm.ts","../sdk/index.ts","../services/dba.ts","../services/hotmesh-utils.ts","../services/invocation-access.ts","../services/workflow-invocation.ts","../services/workflow-state.ts","../services/agent/authority.ts","../services/agent/index.ts","../services/agent/input-mapper.ts","../services/agent/sql.ts","../services/agent/subscription-sql.ts","../services/agent/subscriptions.ts","../services/agent/trigger-registry.ts","../services/announcement/index.ts","../services/announcement/sql.ts","../services/auth/bot-api-key.ts","../services/auth/delegation.ts","../services/auth/index.ts","../services/auth/service-token.ts","../services/auth/sql.ts","../services/auth/oauth-server/access-token.ts","../services/auth/oauth-server/authorization.ts","../services/auth/oauth-server/constants.ts","../services/auth/oauth-server/index.ts","../services/auth/oauth-server/metadata.ts","../services/auth/oauth-server/registration.ts","../services/auth/oauth-server/sql.ts","../services/auth/oauth-server/store.ts","../services/config/cache.ts","../services/config/index.ts","../services/config/provider.ts","../services/config/read.ts","../services/config/sql.ts","../services/config/write.ts","../services/controlplane/index.ts","../services/controlplane/quorum-bridge.ts","../services/controlplane/sql.ts","../services/controlplane/stream-messages-sql.ts","../services/controlplane/types.ts","../services/cron/index.ts","../services/diagnostics/index.ts","../services/diagnostics/patterns.ts","../services/domain/index.ts","../services/domain/read.ts","../services/domain/seed.ts","../services/domain/sql.ts","../services/domain/validate.ts","../services/domain/write.ts","../services/escalation/accumulate.ts","../services/escalation/aggregate-sql.ts","../services/escalation/aggregate-validate.ts","../services/escalation/aggregates.ts","../services/escalation/batch.ts","../services/escalation/bulk.ts","../services/escalation/claim-asserted.ts","../services/escalation/client.ts","../services/escalation/crud.ts","../services/escalation/facet-sql.ts","../services/escalation/facets.ts","../services/escalation/grouped-list.ts","../services/escalation/index.ts","../services/escalation/map.ts","../services/escalation/metrics-cache.ts","../services/escalation/queries.ts","../services/escalation/read-scope-sql.ts","../services/escalation/related.ts","../services/escalation/resolver-validation.ts","../services/escalation/sql.ts","../services/escalation/submit-guard.ts","../services/escalation/types.ts","../services/escalation-strategy/default.ts","../services/escalation-strategy/index.ts","../services/escalation-strategy/mcp.ts","../services/export/client.ts","../services/export/index.ts","../services/export/post-process.ts","../services/export/types.ts","../services/iam/acting-identity.ts","../services/iam/activity.ts","../services/iam/bots.ts","../services/iam/context.ts","../services/iam/credentials.ts","../services/iam/envelope.ts","../services/iam/ephemeral.ts","../services/iam/index.ts","../services/iam/principal.ts","../services/iam/resolve.ts","../services/iam/sql.ts","../services/insight/index.ts","../services/insight/prompts.ts","../services/interceptor/activity-interceptor.ts","../services/interceptor/completion.ts","../services/interceptor/context.ts","../services/interceptor/escalation.ts","../services/interceptor/index.ts","../services/interceptor/lifecycle.ts","../services/interceptor/state.ts","../services/interceptor/types.ts","../services/interceptor/activities/config.ts","../services/interceptor/activities/escalation.ts","../services/interceptor/activities/index.ts","../services/interceptor/activities/task.ts","../services/interceptor/activities/workflow.ts","../services/knowledge/index.ts","../services/knowledge/lookup-cache.ts","../services/knowledge/lookup-refs.ts","../services/knowledge/sql.ts","../services/llm/detect.ts","../services/llm/index.ts","../services/llm/translate.ts","../services/llm/types.ts","../services/llm/providers/anthropic.ts","../services/llm/providers/openai.ts","../services/maintenance/index.ts","../services/mcp/adapter.ts","../services/mcp/db.ts","../services/mcp/exposure.ts","../services/mcp/external-server.ts","../services/mcp/index.ts","../services/mcp/register-tool.ts","../services/mcp/registered-tools.ts","../services/mcp/seed-service-account.ts","../services/mcp/server-lifecycle.ts","../services/mcp/server-tools.ts","../services/mcp/server.ts","../services/mcp/sql.ts","../services/mcp/types.ts","../services/mcp/workflow-compiler-server.ts","../services/mcp/workflow-server.ts","../services/mcp/client/connection-dispatch.ts","../services/mcp/client/connection-lifecycle.ts","../services/mcp/client/connection-test.ts","../services/mcp/client/connection.ts","../services/mcp/client/index.ts","../services/mcp/client/network-transport.ts","../services/mcp/client/tools.ts","../services/mcp/db-server/index.ts","../services/mcp/db-server/schemas.ts","../services/mcp/db-server/tools.ts","../services/mcp/playwright-server/index.ts","../services/mcp/playwright-server/lifecycle.ts","../services/mcp/playwright-server/schemas.ts","../services/mcp/playwright-server/tools.ts","../services/namespace/index.ts","../services/namespace/sql.ts","../services/namespace/types.ts","../services/oauth/crypto.ts","../services/oauth/db.ts","../services/oauth/index.ts","../services/oauth/sql.ts","../services/oauth/state.ts","../services/oauth/providers/anthropic.ts","../services/oauth/providers/github.ts","../services/oauth/providers/google.ts","../services/oauth/providers/index.ts","../services/oauth/providers/microsoft.ts","../services/oauth/providers/mock.ts","../services/oauth/providers/registry.ts","../services/oauth/providers/types.ts","../services/orchestrator/condition.ts","../services/orchestrator/index.ts","../services/orchestrator/types.ts","../services/overview/index.ts","../services/overview/sql.ts","../services/persona/index.ts","../services/persona/sql.ts","../services/persona/types.ts","../services/pipelines/enrichment.ts","../services/pipelines/events.ts","../services/pipelines/execution-builder.ts","../services/pipelines/index.ts","../services/pipelines/queries.ts","../services/pipelines/sql.ts","../services/pipelines/types.ts","../services/role/badge-grant.ts","../services/role/enforcement-cache.ts","../services/role/index.ts","../services/role/schema-validator.ts","../services/role/seed.ts","../services/role/sql.ts","../services/role/types.ts","../services/scan-code/index.ts","../services/scan-code/parse.ts","../services/scan-code/read.ts","../services/scan-code/sql.ts","../services/scan-code/validate-facts.ts","../services/scan-code/validate-query.ts","../services/scan-code/validate-subject.ts","../services/scan-code/validate.ts","../services/scan-code/write.ts","../services/task/crud.ts","../services/task/index.ts","../services/task/process.ts","../services/task/resolve.ts","../services/task/sql.ts","../services/task/types.ts","../services/topics/index.ts","../services/topics/sql.ts","../services/topics/system-topics.ts","../services/user/auth.ts","../services/user/crud.ts","../services/user/index.ts","../services/user/preferences.ts","../services/user/rbac.ts","../services/user/roles.ts","../services/user/scope.ts","../services/user/seed-admin.ts","../services/user/sql.ts","../services/user/sso-provision.ts","../services/user/types.ts","../services/workers/registry.ts","../services/workflow-sets/db.ts","../services/workflow-sets/index.ts","../services/workflow-sets/sql.ts","../services/yaml-workflow/builder-regenerate.ts","../services/yaml-workflow/db-utils.ts","../services/yaml-workflow/db-versions.ts","../services/yaml-workflow/db.ts","../services/yaml-workflow/deployer-helpers.ts","../services/yaml-workflow/deployer.ts","../services/yaml-workflow/generator.ts","../services/yaml-workflow/index.ts","../services/yaml-workflow/input-analyzer-helpers.ts","../services/yaml-workflow/input-analyzer.ts","../services/yaml-workflow/invoke.ts","../services/yaml-workflow/pipe-validator.ts","../services/yaml-workflow/sql.ts","../services/yaml-workflow/types.ts","../services/yaml-workflow/durable-compiler/index.ts","../services/yaml-workflow/durable-compiler/parser.ts","../services/yaml-workflow/durable-compiler/prompts.ts","../services/yaml-workflow/durable-compiler/types.ts","../services/yaml-workflow/pattern-detector/array-source.ts","../services/yaml-workflow/pattern-detector/collapse.ts","../services/yaml-workflow/pattern-detector/index.ts","../services/yaml-workflow/pattern-detector/run-detection.ts","../services/yaml-workflow/pattern-detector/types.ts","../services/yaml-workflow/pipeline/analyze.ts","../services/yaml-workflow/pipeline/extract-helpers.ts","../services/yaml-workflow/pipeline/extract.ts","../services/yaml-workflow/pipeline/index.ts","../services/yaml-workflow/pipeline/prompt-templates.ts","../services/yaml-workflow/pipeline/prompts.ts","../services/yaml-workflow/pipeline/validate.ts","../services/yaml-workflow/pipeline/build/dag-assembly.ts","../services/yaml-workflow/pipeline/build/dag.ts","../services/yaml-workflow/pipeline/build/index.ts","../services/yaml-workflow/pipeline/build/iteration.ts","../services/yaml-workflow/pipeline/build/metadata.ts","../services/yaml-workflow/pipeline/build/transform.ts","../services/yaml-workflow/pipeline/build/utils.ts","../services/yaml-workflow/pipeline/build/wiring.ts","../services/yaml-workflow/pipeline/compile/index.ts","../services/yaml-workflow/pipeline/compile/llm-call.ts","../services/yaml-workflow/pipeline/compile/parse-plan.ts","../services/yaml-workflow/pipeline/compile/summarize.ts","../services/yaml-workflow/workers/callbacks.ts","../services/yaml-workflow/workers/events.ts","../services/yaml-workflow/workers/index.ts","../services/yaml-workflow/workers/register.ts","../services/yaml-workflow/workers/scope.ts","../shared/workflow-state.ts","../shared/form-validation/ctx-path.ts","../shared/form-validation/derive-field-label.ts","../shared/form-validation/display-only-widgets.ts","../shared/form-validation/field-validator.ts","../shared/form-validation/index.ts","../shared/form-validation/invoke-context.ts","../shared/form-validation/validate-resolver-payload.ts","../shared/form-validation/x-lt-bind.ts","../shared/form-validation/x-lt-help.ts","../shared/form-validation/x-lt-invoke.ts","../shared/form-validation/x-lt-labels.ts","../shared/form-validation/x-lt-options.ts","../shared/form-validation/x-lt-query.ts","../shared/form-validation/x-lt-require-any.ts","../shared/form-validation/x-lt-require-sum.ts","../shared/form-validation/x-lt-scan.ts","../shared/form-validation/x-lt-show-if.ts","../shared/form-validation/x-lt-submit-guard.ts","../shared/form-validation/x-lt-submit-on-claim.ts","../shared/form-validation/x-lt-transition.ts","../shared/list-schema/index.ts","../shared/list-schema/template.ts","../shared/list-schema/types.ts","../shared/list-schema/validate.ts","../shared/roles/segment.ts","../shared/scan-code/gtin.ts","../shared/scan-code/index.ts","../shared/scan-code/parse.ts","../start/adapters.ts","../start/apply-report.ts","../start/config.ts","../start/graph-workflows.ts","../start/index.ts","../start/server.ts","../start/socket-auth.ts","../start/workers.ts","../system/index.ts","../system/activities/claude-code.ts","../system/activities/file-storage.ts","../system/activities/http.ts","../system/activities/knowledge.ts","../system/activities/oauth.ts","../system/activities/schema-exchange.ts","../system/activities/sql.ts","../system/activities/triage/cache.ts","../system/activities/triage/context.ts","../system/activities/triage/discovery.ts","../system/activities/triage/index.ts","../system/activities/triage/llm.ts","../system/activities/triage/tools.ts","../system/mcp-servers/caller-auth.ts","../system/mcp-servers/claude-code.ts","../system/mcp-servers/docs.ts","../system/mcp-servers/events.ts","../system/mcp-servers/file-storage.ts","../system/mcp-servers/http-fetch.ts","../system/mcp-servers/human-queue-schemas.ts","../system/mcp-servers/human-queue.ts","../system/mcp-servers/knowledge.ts","../system/mcp-servers/oauth.ts","../system/mcp-servers/schema-exchange.ts","../system/mcp-servers/translation.ts","../system/mcp-servers/vision-prompts.ts","../system/mcp-servers/vision.ts","../system/mcp-servers/workflow-compiler.ts","../system/mcp-servers/workflow.ts","../system/mcp-servers/admin/agent-subscriptions.ts","../system/mcp-servers/admin/agents.ts","../system/mcp-servers/admin/announcements.ts","../system/mcp-servers/admin/bot-accounts.ts","../system/mcp-servers/admin/controlplane.ts","../system/mcp-servers/admin/diagnostics.ts","../system/mcp-servers/admin/domain-context.ts","../system/mcp-servers/admin/escalations.ts","../system/mcp-servers/admin/exports.ts","../system/mcp-servers/admin/index.ts","../system/mcp-servers/admin/maintenance.ts","../system/mcp-servers/admin/mcp-servers.ts","../system/mcp-servers/admin/overview.ts","../system/mcp-servers/admin/personas.ts","../system/mcp-servers/admin/pipelines.ts","../system/mcp-servers/admin/run-read.ts","../system/mcp-servers/admin/scan-codes.ts","../system/mcp-servers/admin/schemas.ts","../system/mcp-servers/admin/settings.ts","../system/mcp-servers/admin/tasks.ts","../system/mcp-servers/admin/topics.ts","../system/mcp-servers/admin/users.ts","../system/mcp-servers/admin/workflow-config.ts","../system/mcp-servers/admin/workflows.ts","../system/mcp-servers/admin/yaml-workflows.ts","../system/mcp-servers/db-query/index.ts","../system/mcp-servers/db-query/schemas.ts","../system/mcp-servers/db-query/tools.ts","../system/seed/index.ts","../system/seed/tool-manifests-admin.ts","../system/seed/tool-manifests-data.ts","../system/seed/tool-manifests-escalation.ts","../system/seed/tool-manifests-events.ts","../system/seed/tool-manifests-knowledge.ts","../system/seed/tool-manifests-workflows.ts","../system/workflows/tool-result-guard.ts","../system/workflows/capability-invoke/activities.ts","../system/workflows/capability-invoke/index.ts","../system/workflows/mcp-deterministic/activities.ts","../system/workflows/mcp-deterministic/index.ts","../system/workflows/mcp-query/index.ts","../system/workflows/mcp-query/prompts.ts","../system/workflows/mcp-query/strategy-advisors.ts","../system/workflows/mcp-query/types.ts","../system/workflows/mcp-query/activities/caches.ts","../system/workflows/mcp-query/activities/discovery.ts","../system/workflows/mcp-query/activities/index.ts","../system/workflows/mcp-query/activities/llm.ts","../system/workflows/mcp-query/activities/tool-executor.ts","../system/workflows/mcp-query/activities/tool-loader.ts","../system/workflows/mcp-query-router/activities.ts","../system/workflows/mcp-query-router/index.ts","../system/workflows/mcp-query-router/prompts.ts","../system/workflows/mcp-triage/activities-proxy.ts","../system/workflows/mcp-triage/index.ts","../system/workflows/mcp-triage/prompts.ts","../system/workflows/mcp-triage/response-builders.ts","../system/workflows/mcp-triage/response.ts","../system/workflows/mcp-triage/types.ts","../system/workflows/mcp-triage-deterministic/activities.ts","../system/workflows/mcp-triage-deterministic/index.ts","../system/workflows/mcp-triage-router/activities.ts","../system/workflows/mcp-triage-router/index.ts","../system/workflows/mcp-workflow-builder/index.ts","../system/workflows/mcp-workflow-builder/prompts.ts","../system/workflows/mcp-workflow-builder/activities/caches.ts","../system/workflows/mcp-workflow-builder/activities/index.ts","../system/workflows/mcp-workflow-builder/activities/llm.ts","../system/workflows/mcp-workflow-builder/activities/tool-loader.ts","../system/workflows/mcp-workflow-planner/index.ts","../system/workflows/mcp-workflow-planner/prompts.ts","../system/workflows/mcp-workflow-planner/activities/analyze.ts","../system/workflows/mcp-workflow-planner/activities/index.ts","../system/workflows/mcp-workflow-planner/activities/persist.ts","../system/workflows/mcp-workflow-planner/activities/plan.ts","../system/workflows/shared/discovery.ts","../system/workflows/shared/index.ts","../system/workflows/shared/llm-caller.ts","../system/workflows/shared/principal-tools.ts","../system/workflows/shared/prompts.ts","../system/workflows/shared/strategy-advisors.ts","../system/workflows/shared/tool-executor.ts","../system/workflows/shared/tool-loader.ts","../system/workflows/shared/types.ts","../themes/midnight.ts","../types/agent.ts","../types/analytics.ts","../types/auth.ts","../types/capability.ts","../types/config.ts","../types/delegation.ts","../types/discovery.ts","../types/domain-manifest.ts","../types/envelope.ts","../types/escalation-strategy.ts","../types/escalation.ts","../types/events.ts","../types/export.ts","../types/express.d.ts","../types/facets.ts","../types/index.ts","../types/logger.ts","../types/maintenance.ts","../types/mcp.ts","../types/oauth-server.ts","../types/oauth.ts","../types/persona.ts","../types/scan-choice.ts","../types/sdk.ts","../types/startup.ts","../types/task.ts","../types/telemetry.ts","../types/tool-context.ts","../types/user.ts","../types/validation.ts","../types/workflow-icons.ts","../types/workflow-set.ts","../types/workflow.ts","../types/yaml-workflow.ts","../types/scan-code/constants.ts","../types/scan-code/index.ts","../types/scan-code/response.ts","../types/scan-code/rule.ts","../workers/index.ts"],"version":"5.9.3"}
+{"root":["../index.ts","../vitest.config.ts","../vitest.fast.config.ts","../vitest.integration.config.ts","../vitest.llm.config.ts","../adapters/express.ts","../api/agent-subscriptions.ts","../api/agents.ts","../api/announcements.ts","../api/auth-sso.ts","../api/auth.ts","../api/bot-accounts.ts","../api/capabilities.ts","../api/controlplane.ts","../api/dba.ts","../api/diagnostics.ts","../api/domain.ts","../api/exports.ts","../api/files.ts","../api/index.ts","../api/insight.ts","../api/knowledge.ts","../api/maintenance.ts","../api/me.ts","../api/namespaces.ts","../api/overview.ts","../api/personas.ts","../api/pipelines.ts","../api/roles.ts","../api/settings.ts","../api/tasks.ts","../api/topics.ts","../api/users.ts","../api/workflow-sets.ts","../api/escalations/accumulate.ts","../api/escalations/analytics.ts","../api/escalations/bulk.ts","../api/escalations/cancel.ts","../api/escalations/claim.ts","../api/escalations/create.ts","../api/escalations/facets.ts","../api/escalations/helpers.ts","../api/escalations/index.ts","../api/escalations/list.ts","../api/escalations/lookups.ts","../api/escalations/metadata.ts","../api/escalations/related.ts","../api/escalations/resolve-batch.ts","../api/escalations/resolve.ts","../api/escalations/single.ts","../api/mcp/index.ts","../api/mcp/servers.ts","../api/mcp/tools.ts","../api/scan-codes/badge-policy.ts","../api/scan-codes/choice.ts","../api/scan-codes/config.ts","../api/scan-codes/context.ts","../api/scan-codes/execute.ts","../api/scan-codes/grant.ts","../api/scan-codes/hold.ts","../api/scan-codes/identity.ts","../api/scan-codes/index.ts","../api/scan-codes/locate.ts","../api/scan-codes/present.ts","../api/scan-codes/subject.ts","../api/scan-codes/verb-accumulate.ts","../api/scan-codes/verb-fill.ts","../api/scan-codes/verb-into-subject.ts","../api/scan-codes/verbs-subject.ts","../api/scan-codes/verbs.ts","../api/workflows/config.ts","../api/workflows/discovery.ts","../api/workflows/index.ts","../api/workflows/input-lookups.ts","../api/workflows/input-validation.ts","../api/workflows/invocable.ts","../api/workflows/invocation.ts","../api/yaml-workflows/cron.ts","../api/yaml-workflows/crud.ts","../api/yaml-workflows/deploy.ts","../api/yaml-workflows/helpers.ts","../api/yaml-workflows/index.ts","../api/yaml-workflows/versions.ts","../bin/ltc.ts","../lib/typed-resolution.ts","../lib/uuid.ts","../lib/cli/auth.ts","../lib/cli/client.ts","../lib/cli/compile.ts","../lib/cli/format.ts","../lib/cli/init.ts","../lib/cli/output.ts","../lib/cli/scanner.ts","../lib/cli/types.ts","../lib/cli/commands/escalations.ts","../lib/cli/commands/knowledge.ts","../lib/cli/commands/mcp.ts","../lib/cli/commands/personas.ts","../lib/cli/commands/pipelines.ts","../lib/cli/commands/roles.ts","../lib/cli/commands/status.ts","../lib/cli/commands/streams.ts","../lib/cli/commands/users.ts","../lib/cli/commands/workflows.ts","../lib/db/index.ts","../lib/db/migrate.ts","../lib/events/browser-view.ts","../lib/events/callback.ts","../lib/events/escalation-wire.ts","../lib/events/index.ts","../lib/events/matching.ts","../lib/events/memory.ts","../lib/events/nats-ws-filter.ts","../lib/events/nats-ws-proxy.ts","../lib/events/nats-ws-server-filter.ts","../lib/events/nats-ws-ticket.ts","../lib/events/nats.ts","../lib/events/publish.ts","../lib/events/socketio.ts","../lib/events/system-events.ts","../lib/http/index.ts","../lib/json-path/pick.ts","../lib/logger/index.ts","../lib/logger/pino.ts","../lib/storage/index.ts","../lib/storage/local.ts","../lib/storage/mime.ts","../lib/storage/s3.ts","../lib/storage/types.ts","../lib/telemetry/honeycomb.ts","../lib/telemetry/index.ts","../modules/auth.ts","../modules/branding.ts","../modules/capabilities.ts","../modules/config.ts","../modules/defaults.ts","../modules/display.ts","../modules/features.ts","../modules/ltconfig.ts","../modules/maintenance.ts","../modules/mcp-auth.ts","../modules/oauth-server.ts","../modules/search.ts","../modules/sso.ts","../modules/utils.ts","../modules/version.ts","../routes/agents.ts","../routes/announcements.ts","../routes/auth-sso.ts","../routes/auth.ts","../routes/bot-accounts.ts","../routes/capabilities.ts","../routes/controlplane.ts","../routes/dba.ts","../routes/delegation.ts","../routes/diagnostics.ts","../routes/docs.ts","../routes/domain.ts","../routes/exports.ts","../routes/file-browser.ts","../routes/files.ts","../routes/index.ts","../routes/insight.ts","../routes/knowledge.ts","../routes/maintenance.ts","../routes/mcp-endpoint.ts","../routes/mcp.ts","../routes/me.ts","../routes/namespaces.ts","../routes/nats-credentials.ts","../routes/oauth-well-known.ts","../routes/oauth.ts","../routes/overview.ts","../routes/personas.ts","../routes/pipelines.ts","../routes/roles.ts","../routes/scan-codes.ts","../routes/settings.ts","../routes/tasks.ts","../routes/topics.ts","../routes/users.ts","../routes/workflow-sets.ts","../routes/escalations/accumulate.ts","../routes/escalations/acting.ts","../routes/escalations/analytics.ts","../routes/escalations/bulk.ts","../routes/escalations/facets.ts","../routes/escalations/index.ts","../routes/escalations/list.ts","../routes/escalations/metadata.ts","../routes/escalations/related.ts","../routes/escalations/resolve.ts","../routes/escalations/single.ts","../routes/oauth-server/authorize.ts","../routes/oauth-server/grants.ts","../routes/oauth-server/index.ts","../routes/oauth-server/registration.ts","../routes/oauth-server/token.ts","../routes/workflows/config.ts","../routes/workflows/discovery.ts","../routes/workflows/index.ts","../routes/workflows/invocation.ts","../routes/yaml-workflows/cron.ts","../routes/yaml-workflows/crud.ts","../routes/yaml-workflows/deployment.ts","../routes/yaml-workflows/index.ts","../routes/yaml-workflows/versions.ts","../scripts/consolidation-sim.ts","../scripts/ortho-populate.ts","../scripts/printer-cycle.ts","../scripts/process-helpers.ts","../scripts/process.ts","../scripts/token.ts","../scripts/twin-farm.ts","../sdk/index.ts","../services/dba.ts","../services/hotmesh-utils.ts","../services/invocation-access.ts","../services/workflow-invocation.ts","../services/workflow-state.ts","../services/agent/authority.ts","../services/agent/index.ts","../services/agent/input-mapper.ts","../services/agent/sql.ts","../services/agent/subscription-sql.ts","../services/agent/subscriptions.ts","../services/agent/trigger-registry.ts","../services/announcement/index.ts","../services/announcement/sql.ts","../services/auth/bot-api-key.ts","../services/auth/delegation.ts","../services/auth/index.ts","../services/auth/service-token.ts","../services/auth/sql.ts","../services/auth/oauth-server/access-token.ts","../services/auth/oauth-server/authorization.ts","../services/auth/oauth-server/constants.ts","../services/auth/oauth-server/index.ts","../services/auth/oauth-server/metadata.ts","../services/auth/oauth-server/registration.ts","../services/auth/oauth-server/sql.ts","../services/auth/oauth-server/store.ts","../services/config/cache.ts","../services/config/index.ts","../services/config/provider.ts","../services/config/read.ts","../services/config/sql.ts","../services/config/write.ts","../services/controlplane/index.ts","../services/controlplane/quorum-bridge.ts","../services/controlplane/sql.ts","../services/controlplane/stream-messages-sql.ts","../services/controlplane/types.ts","../services/cron/index.ts","../services/diagnostics/index.ts","../services/diagnostics/patterns.ts","../services/domain/index.ts","../services/domain/read.ts","../services/domain/seed.ts","../services/domain/sql.ts","../services/domain/validate.ts","../services/domain/write.ts","../services/escalation/accumulate.ts","../services/escalation/aggregate-sql.ts","../services/escalation/aggregate-validate.ts","../services/escalation/aggregates.ts","../services/escalation/batch.ts","../services/escalation/bulk.ts","../services/escalation/claim-asserted.ts","../services/escalation/client.ts","../services/escalation/crud.ts","../services/escalation/facet-sql.ts","../services/escalation/facets.ts","../services/escalation/grouped-list.ts","../services/escalation/index.ts","../services/escalation/map.ts","../services/escalation/metrics-cache.ts","../services/escalation/queries.ts","../services/escalation/read-scope-sql.ts","../services/escalation/related.ts","../services/escalation/resolver-validation.ts","../services/escalation/sql.ts","../services/escalation/submit-guard.ts","../services/escalation/types.ts","../services/escalation-strategy/default.ts","../services/escalation-strategy/index.ts","../services/escalation-strategy/mcp.ts","../services/export/client.ts","../services/export/index.ts","../services/export/post-process.ts","../services/export/types.ts","../services/iam/acting-identity.ts","../services/iam/activity.ts","../services/iam/bots.ts","../services/iam/context.ts","../services/iam/credentials.ts","../services/iam/envelope.ts","../services/iam/ephemeral.ts","../services/iam/index.ts","../services/iam/principal.ts","../services/iam/resolve.ts","../services/iam/sql.ts","../services/insight/index.ts","../services/insight/prompts.ts","../services/interceptor/activity-interceptor.ts","../services/interceptor/completion.ts","../services/interceptor/context.ts","../services/interceptor/escalation.ts","../services/interceptor/index.ts","../services/interceptor/lifecycle.ts","../services/interceptor/state.ts","../services/interceptor/types.ts","../services/interceptor/activities/config.ts","../services/interceptor/activities/escalation.ts","../services/interceptor/activities/index.ts","../services/interceptor/activities/task.ts","../services/interceptor/activities/workflow.ts","../services/knowledge/index.ts","../services/knowledge/lookup-cache.ts","../services/knowledge/lookup-refs.ts","../services/knowledge/sql.ts","../services/llm/detect.ts","../services/llm/index.ts","../services/llm/translate.ts","../services/llm/types.ts","../services/llm/providers/anthropic.ts","../services/llm/providers/openai.ts","../services/maintenance/index.ts","../services/mcp/adapter.ts","../services/mcp/db.ts","../services/mcp/exposure.ts","../services/mcp/external-server.ts","../services/mcp/index.ts","../services/mcp/register-tool.ts","../services/mcp/registered-tools.ts","../services/mcp/seed-service-account.ts","../services/mcp/server-lifecycle.ts","../services/mcp/server-tools.ts","../services/mcp/server.ts","../services/mcp/sql.ts","../services/mcp/types.ts","../services/mcp/workflow-compiler-server.ts","../services/mcp/workflow-server.ts","../services/mcp/client/connection-dispatch.ts","../services/mcp/client/connection-lifecycle.ts","../services/mcp/client/connection-test.ts","../services/mcp/client/connection.ts","../services/mcp/client/index.ts","../services/mcp/client/network-transport.ts","../services/mcp/client/tools.ts","../services/mcp/db-server/index.ts","../services/mcp/db-server/schemas.ts","../services/mcp/db-server/tools.ts","../services/mcp/playwright-server/index.ts","../services/mcp/playwright-server/lifecycle.ts","../services/mcp/playwright-server/schemas.ts","../services/mcp/playwright-server/tools.ts","../services/namespace/index.ts","../services/namespace/sql.ts","../services/namespace/types.ts","../services/oauth/crypto.ts","../services/oauth/db.ts","../services/oauth/index.ts","../services/oauth/sql.ts","../services/oauth/state.ts","../services/oauth/providers/anthropic.ts","../services/oauth/providers/github.ts","../services/oauth/providers/google.ts","../services/oauth/providers/index.ts","../services/oauth/providers/microsoft.ts","../services/oauth/providers/mock.ts","../services/oauth/providers/registry.ts","../services/oauth/providers/types.ts","../services/orchestrator/condition.ts","../services/orchestrator/index.ts","../services/orchestrator/types.ts","../services/overview/index.ts","../services/overview/sql.ts","../services/persona/index.ts","../services/persona/sql.ts","../services/persona/types.ts","../services/pipelines/enrichment.ts","../services/pipelines/events.ts","../services/pipelines/execution-builder.ts","../services/pipelines/index.ts","../services/pipelines/queries.ts","../services/pipelines/sql.ts","../services/pipelines/types.ts","../services/role/badge-grant.ts","../services/role/enforcement-cache.ts","../services/role/index.ts","../services/role/schema-validator.ts","../services/role/seed.ts","../services/role/sql.ts","../services/role/types.ts","../services/scan-code/index.ts","../services/scan-code/parse.ts","../services/scan-code/read.ts","../services/scan-code/sql.ts","../services/scan-code/validate-facts.ts","../services/scan-code/validate-query.ts","../services/scan-code/validate-subject.ts","../services/scan-code/validate.ts","../services/scan-code/write.ts","../services/task/crud.ts","../services/task/index.ts","../services/task/process.ts","../services/task/resolve.ts","../services/task/sql.ts","../services/task/types.ts","../services/topics/index.ts","../services/topics/sql.ts","../services/topics/system-topics.ts","../services/user/auth.ts","../services/user/crud.ts","../services/user/index.ts","../services/user/preferences.ts","../services/user/rbac.ts","../services/user/roles.ts","../services/user/scope.ts","../services/user/seed-admin.ts","../services/user/sql.ts","../services/user/sso-provision.ts","../services/user/types.ts","../services/workers/registry.ts","../services/workflow-sets/db.ts","../services/workflow-sets/index.ts","../services/workflow-sets/sql.ts","../services/yaml-workflow/builder-regenerate.ts","../services/yaml-workflow/db-utils.ts","../services/yaml-workflow/db-versions.ts","../services/yaml-workflow/db.ts","../services/yaml-workflow/deployer-helpers.ts","../services/yaml-workflow/deployer.ts","../services/yaml-workflow/generator.ts","../services/yaml-workflow/index.ts","../services/yaml-workflow/input-analyzer-helpers.ts","../services/yaml-workflow/input-analyzer.ts","../services/yaml-workflow/invoke.ts","../services/yaml-workflow/pipe-validator.ts","../services/yaml-workflow/sql.ts","../services/yaml-workflow/types.ts","../services/yaml-workflow/durable-compiler/index.ts","../services/yaml-workflow/durable-compiler/parser.ts","../services/yaml-workflow/durable-compiler/prompts.ts","../services/yaml-workflow/durable-compiler/types.ts","../services/yaml-workflow/pattern-detector/array-source.ts","../services/yaml-workflow/pattern-detector/collapse.ts","../services/yaml-workflow/pattern-detector/index.ts","../services/yaml-workflow/pattern-detector/run-detection.ts","../services/yaml-workflow/pattern-detector/types.ts","../services/yaml-workflow/pipeline/analyze.ts","../services/yaml-workflow/pipeline/extract-helpers.ts","../services/yaml-workflow/pipeline/extract.ts","../services/yaml-workflow/pipeline/index.ts","../services/yaml-workflow/pipeline/prompt-templates.ts","../services/yaml-workflow/pipeline/prompts.ts","../services/yaml-workflow/pipeline/validate.ts","../services/yaml-workflow/pipeline/build/dag-assembly.ts","../services/yaml-workflow/pipeline/build/dag.ts","../services/yaml-workflow/pipeline/build/index.ts","../services/yaml-workflow/pipeline/build/iteration.ts","../services/yaml-workflow/pipeline/build/metadata.ts","../services/yaml-workflow/pipeline/build/transform.ts","../services/yaml-workflow/pipeline/build/utils.ts","../services/yaml-workflow/pipeline/build/wiring.ts","../services/yaml-workflow/pipeline/compile/index.ts","../services/yaml-workflow/pipeline/compile/llm-call.ts","../services/yaml-workflow/pipeline/compile/parse-plan.ts","../services/yaml-workflow/pipeline/compile/summarize.ts","../services/yaml-workflow/workers/callbacks.ts","../services/yaml-workflow/workers/events.ts","../services/yaml-workflow/workers/index.ts","../services/yaml-workflow/workers/register.ts","../services/yaml-workflow/workers/scope.ts","../services/yaml-workflow/workers/step-tool.ts","../shared/workflow-state.ts","../shared/form-validation/ctx-path.ts","../shared/form-validation/derive-field-label.ts","../shared/form-validation/display-only-widgets.ts","../shared/form-validation/field-validator.ts","../shared/form-validation/index.ts","../shared/form-validation/invoke-context.ts","../shared/form-validation/validate-resolver-payload.ts","../shared/form-validation/x-lt-bind.ts","../shared/form-validation/x-lt-help.ts","../shared/form-validation/x-lt-invoke.ts","../shared/form-validation/x-lt-labels.ts","../shared/form-validation/x-lt-options.ts","../shared/form-validation/x-lt-query.ts","../shared/form-validation/x-lt-require-any.ts","../shared/form-validation/x-lt-require-sum.ts","../shared/form-validation/x-lt-scan.ts","../shared/form-validation/x-lt-show-if.ts","../shared/form-validation/x-lt-submit-guard.ts","../shared/form-validation/x-lt-submit-on-claim.ts","../shared/form-validation/x-lt-transition.ts","../shared/list-schema/index.ts","../shared/list-schema/template.ts","../shared/list-schema/types.ts","../shared/list-schema/validate.ts","../shared/roles/segment.ts","../shared/scan-code/gtin.ts","../shared/scan-code/index.ts","../shared/scan-code/parse.ts","../start/adapters.ts","../start/apply-report.ts","../start/config.ts","../start/graph-workflows.ts","../start/index.ts","../start/server.ts","../start/socket-auth.ts","../start/workers.ts","../system/index.ts","../system/activities/claude-code.ts","../system/activities/file-storage.ts","../system/activities/http.ts","../system/activities/knowledge.ts","../system/activities/oauth.ts","../system/activities/schema-exchange.ts","../system/activities/sql.ts","../system/activities/triage/cache.ts","../system/activities/triage/context.ts","../system/activities/triage/discovery.ts","../system/activities/triage/index.ts","../system/activities/triage/llm.ts","../system/activities/triage/tools.ts","../system/mcp-servers/caller-auth.ts","../system/mcp-servers/claude-code.ts","../system/mcp-servers/docs.ts","../system/mcp-servers/events.ts","../system/mcp-servers/file-storage.ts","../system/mcp-servers/http-fetch.ts","../system/mcp-servers/human-queue-schemas.ts","../system/mcp-servers/human-queue.ts","../system/mcp-servers/knowledge.ts","../system/mcp-servers/oauth.ts","../system/mcp-servers/schema-exchange.ts","../system/mcp-servers/translation.ts","../system/mcp-servers/vision-prompts.ts","../system/mcp-servers/vision.ts","../system/mcp-servers/workflow-compiler.ts","../system/mcp-servers/workflow.ts","../system/mcp-servers/admin/agent-subscriptions.ts","../system/mcp-servers/admin/agents.ts","../system/mcp-servers/admin/announcements.ts","../system/mcp-servers/admin/bot-accounts.ts","../system/mcp-servers/admin/controlplane.ts","../system/mcp-servers/admin/diagnostics.ts","../system/mcp-servers/admin/domain-context.ts","../system/mcp-servers/admin/escalations.ts","../system/mcp-servers/admin/exports.ts","../system/mcp-servers/admin/index.ts","../system/mcp-servers/admin/maintenance.ts","../system/mcp-servers/admin/mcp-servers.ts","../system/mcp-servers/admin/overview.ts","../system/mcp-servers/admin/personas.ts","../system/mcp-servers/admin/pipelines.ts","../system/mcp-servers/admin/run-read.ts","../system/mcp-servers/admin/scan-codes.ts","../system/mcp-servers/admin/schemas.ts","../system/mcp-servers/admin/settings.ts","../system/mcp-servers/admin/tasks.ts","../system/mcp-servers/admin/topics.ts","../system/mcp-servers/admin/users.ts","../system/mcp-servers/admin/workflow-config.ts","../system/mcp-servers/admin/workflows.ts","../system/mcp-servers/admin/yaml-workflows.ts","../system/mcp-servers/db-query/index.ts","../system/mcp-servers/db-query/schemas.ts","../system/mcp-servers/db-query/tools.ts","../system/seed/index.ts","../system/seed/tool-manifests-admin.ts","../system/seed/tool-manifests-data.ts","../system/seed/tool-manifests-escalation.ts","../system/seed/tool-manifests-events.ts","../system/seed/tool-manifests-knowledge.ts","../system/seed/tool-manifests-workflows.ts","../system/workflows/tool-result-guard.ts","../system/workflows/capability-invoke/activities.ts","../system/workflows/capability-invoke/index.ts","../system/workflows/mcp-deterministic/activities.ts","../system/workflows/mcp-deterministic/index.ts","../system/workflows/mcp-query/index.ts","../system/workflows/mcp-query/prompts.ts","../system/workflows/mcp-query/strategy-advisors.ts","../system/workflows/mcp-query/types.ts","../system/workflows/mcp-query/activities/caches.ts","../system/workflows/mcp-query/activities/discovery.ts","../system/workflows/mcp-query/activities/index.ts","../system/workflows/mcp-query/activities/llm.ts","../system/workflows/mcp-query/activities/tool-executor.ts","../system/workflows/mcp-query/activities/tool-loader.ts","../system/workflows/mcp-query-router/activities.ts","../system/workflows/mcp-query-router/index.ts","../system/workflows/mcp-query-router/prompts.ts","../system/workflows/mcp-triage/activities-proxy.ts","../system/workflows/mcp-triage/index.ts","../system/workflows/mcp-triage/prompts.ts","../system/workflows/mcp-triage/response-builders.ts","../system/workflows/mcp-triage/response.ts","../system/workflows/mcp-triage/types.ts","../system/workflows/mcp-triage-deterministic/activities.ts","../system/workflows/mcp-triage-deterministic/index.ts","../system/workflows/mcp-triage-router/activities.ts","../system/workflows/mcp-triage-router/index.ts","../system/workflows/mcp-workflow-builder/index.ts","../system/workflows/mcp-workflow-builder/prompts.ts","../system/workflows/mcp-workflow-builder/activities/caches.ts","../system/workflows/mcp-workflow-builder/activities/index.ts","../system/workflows/mcp-workflow-builder/activities/llm.ts","../system/workflows/mcp-workflow-builder/activities/tool-loader.ts","../system/workflows/mcp-workflow-planner/index.ts","../system/workflows/mcp-workflow-planner/prompts.ts","../system/workflows/mcp-workflow-planner/activities/analyze.ts","../system/workflows/mcp-workflow-planner/activities/index.ts","../system/workflows/mcp-workflow-planner/activities/persist.ts","../system/workflows/mcp-workflow-planner/activities/plan.ts","../system/workflows/shared/discovery.ts","../system/workflows/shared/index.ts","../system/workflows/shared/llm-caller.ts","../system/workflows/shared/principal-tools.ts","../system/workflows/shared/prompts.ts","../system/workflows/shared/strategy-advisors.ts","../system/workflows/shared/tool-executor.ts","../system/workflows/shared/tool-loader.ts","../system/workflows/shared/types.ts","../themes/midnight.ts","../types/agent.ts","../types/analytics.ts","../types/auth.ts","../types/capability.ts","../types/config.ts","../types/delegation.ts","../types/discovery.ts","../types/domain-manifest.ts","../types/envelope.ts","../types/escalation-strategy.ts","../types/escalation.ts","../types/events.ts","../types/export.ts","../types/express.d.ts","../types/facets.ts","../types/index.ts","../types/logger.ts","../types/maintenance.ts","../types/mcp.ts","../types/oauth-server.ts","../types/oauth.ts","../types/persona.ts","../types/scan-choice.ts","../types/sdk.ts","../types/startup.ts","../types/task.ts","../types/telemetry.ts","../types/tool-context.ts","../types/user.ts","../types/validation.ts","../types/workflow-icons.ts","../types/workflow-set.ts","../types/workflow.ts","../types/yaml-workflow.ts","../types/scan-code/constants.ts","../types/scan-code/index.ts","../types/scan-code/response.ts","../types/scan-code/rule.ts","../workers/index.ts"],"version":"5.9.3"}

package/build/types/maintenance.d.ts

@@ -2,8 +2,8 @@
  * A single maintenance rule describing what to prune and when.
  */
 export interface LTMaintenanceRule {
-    /** Which resource to target */
-    target: 'streams' | 'jobs' | 'escalations';
+    /** Which resource to target. 'oauth' is the /mcp authorization server's clients, grants, codes and refresh tokens. */
+    target: 'streams' | 'jobs' | 'escalations' | 'oauth';
     /** delete = hard-delete rows; prune = strip execution artifacts */
     action: 'delete' | 'prune';
     /** Postgres interval for the retention window, e.g. '7 days', '90 days' */

package/docs/api/http/mcp-endpoint.md

@@ -75,7 +75,7 @@ Connect Claude Code to your Long Tail instance as an MCP server. Once connected,
 
 ### Step 1: Get an API key
 
-Start Long Tail (`docker compose up -d --build`). The startup log shows two seeded API keys:
+Start Long Tail (`docker compose up -d --build`). On first start, docker compose sets `LT_SEED_SERVICE_KEYS=true`, so the container's stdout shows two seeded API keys:
 
 ```
 [seed-mcp] read key: lt_bot_<read-key>
@@ -168,11 +168,11 @@ A read key cannot invoke write operations (create, update, delete, invoke workfl
 
 ### Seeded Service Account
 
-Long Tail seeds an `mcp-service` account at startup with two pre-configured API keys:
+Long Tail seeds an `mcp-service` account at startup with two API keys:
 - **read** — scopes: `["mcp:read"]`
 - **full** — scopes: `["mcp:read", "mcp:full"]`
 
-Keys are logged once at startup and cannot be retrieved again. For production, create a new service account and generate keys via the dashboard or API.
+With `LT_SEED_SERVICE_KEYS=true` (local docker compose), the keys are minted at first start and printed once to stdout, never through the logger; they cannot be retrieved again. Without it, the account is created with no keys, and a superadmin mints them from the dashboard or the bot-accounts API.
 
 ## Exposure Control