@hotmeshio/long-tail 0.28.3 → 0.29.0

package/build/routes/oauth.d.ts

@@ -3,5 +3,6 @@ export declare function setOAuthConfig(cfg: {
     autoProvision?: boolean;
     defaultRoleType?: 'admin' | 'member';
     baseUrl?: string;
+    allowedDomains?: string[];
 }): void;
 export default router;

package/build/routes/oauth.js

@@ -5,6 +5,7 @@ const http_1 = require("../lib/http");
 const auth_1 = require("../modules/auth");
 const logger_1 = require("../lib/logger");
 const oauth_1 = require("../services/oauth");
+const provisioning_1 = require("../services/oauth/provisioning");
 const user_1 = require("../services/user");
 const router = (0, http_1.Router)();
 // ── OAuth startup config (set by initializeOAuth) ────────────────────────────
@@ -12,6 +13,7 @@ let _oauthConfig = {
     autoProvision: true,
     defaultRoleType: 'member',
     baseUrl: '',
+    allowedDomains: [],
 };
 function setOAuthConfig(cfg) {
     if (cfg.autoProvision !== undefined)
@@ -20,6 +22,8 @@ function setOAuthConfig(cfg) {
         _oauthConfig.defaultRoleType = cfg.defaultRoleType;
     if (cfg.baseUrl)
         _oauthConfig.baseUrl = cfg.baseUrl;
+    if (cfg.allowedDomains)
+        _oauthConfig.allowedDomains = (0, provisioning_1.normalizeDomains)(cfg.allowedDomains);
 }
 /**
  * GET /api/auth/oauth/providers
@@ -123,6 +127,13 @@ router.get('/:provider/callback', async (req, res) => {
                 res.status(403).json({ error: 'No account found. Contact an administrator.' });
                 return;
             }
+            if (!(0, provisioning_1.mayProvision)(userInfo.email, _oauthConfig.allowedDomains)) {
+                logger_1.loggerRegistry.warn(`[oauth] refused self-provisioning for ${provider} sign-in outside allowed domains`);
+                res.status(403).json({
+                    error: `Sign-in is limited to ${_oauthConfig.allowedDomains.join(', ')}. Contact an administrator.`,
+                });
+                return;
+            }
             // Auto-provision new user
             user = await (0, user_1.createUser)({
                 external_id: `${provider}:${userInfo.providerUserId}`,

package/build/services/machines/gateway/plan-machine.js

@@ -141,7 +141,7 @@ function planJob(state, m, b, at, ttl) {
         const released = releasedAction(row, m, b);
         if (b.result === protocol_1.JOB_RESULT.OK)
             return ack([released]);
-        return ack([released, ...(0, plan_shared_1.failHandoff)(state, row, m, {
+        return ack([(0, plan_shared_1.holdForResolver)(row, m), released, ...(0, plan_shared_1.failHandoff)(state, row, m, {
                 received: false, unitId, errorCode: contracts_1.HANDOFF_ERROR.SENDER_REJECTED, result: b.result, reason: b.reason ?? null,
                 detail: `${m} finished ${unitId}: ${b.result}${b.reason ? ` (${b.reason})` : ''}`,
             })]);

package/build/services/machines/gateway/plan-shared.d.ts

@@ -18,3 +18,11 @@ export declare function cancelDispatch(state: GatewayState, row: HandoffRow): Ac
  * claimant may resolve a claimed row); `reportedBy` names who saw the failure.
  */
 export declare function failHandoff(state: GatewayState, row: HandoffRow, reporter: Actor, resolution: HandoffResolution): Action[];
+/** Who resolves a failed handoff: the receiver while it holds the claim, otherwise whoever reports. */
+export declare function resolverOf(row: HandoffRow, reporter: Actor): Actor;
+/**
+ * The row claimed for its resolver before anything else is written to it. A
+ * claimed row refuses every other resolver, so what the machine writes next
+ * and the resolution that follows land on a row nobody else can end meanwhile.
+ */
+export declare function holdForResolver(row: HandoffRow, reporter: Actor): Action;

package/build/services/machines/gateway/plan-shared.js

@@ -3,6 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.cancelJobs = cancelJobs;
 exports.cancelDispatch = cancelDispatch;
 exports.failHandoff = failHandoff;
+exports.resolverOf = resolverOf;
+exports.holdForResolver = holdForResolver;
 const contracts_1 = require("../contracts");
 const protocol_1 = require("../../../lib/machines/protocol");
 const jobs_1 = require("./jobs");
@@ -32,7 +34,19 @@ function cancelDispatch(state, row) {
  * claimant may resolve a claimed row); `reportedBy` names who saw the failure.
  */
 function failHandoff(state, row, reporter, resolution) {
-    const claimant = row.dispatch === state_1.DISPATCH_STATE.ACCEPTED && row.toMachine ? row.toMachine : reporter;
+    const claimant = resolverOf(row, reporter);
     const payload = claimant === reporter ? { ...resolution } : { ...resolution, reportedBy: reporter };
     return [{ kind: 'resolve', as: claimant, rowId: row.id, payload }, ...cancelDispatch(state, row)];
 }
+/** Who resolves a failed handoff: the receiver while it holds the claim, otherwise whoever reports. */
+function resolverOf(row, reporter) {
+    return row.dispatch === state_1.DISPATCH_STATE.ACCEPTED && row.toMachine ? row.toMachine : reporter;
+}
+/**
+ * The row claimed for its resolver before anything else is written to it. A
+ * claimed row refuses every other resolver, so what the machine writes next
+ * and the resolution that follows land on a row nobody else can end meanwhile.
+ */
+function holdForResolver(row, reporter) {
+    return { kind: 'claim', as: resolverOf(row, reporter), rowId: row.id };
+}

package/build/services/oauth/index.d.ts

@@ -2,6 +2,7 @@ import type { LTOAuthStartConfig } from '../../types/oauth';
 export { encrypt, decrypt, getEncryptionKey, setEncryptionKey } from './crypto';
 export { createOAuthState, consumeOAuthState } from './state';
 export { registerProvider, getProvider, listProviders } from './providers';
+export { normalizeDomains, emailDomain, mayProvision } from './provisioning';
 export type { ProviderHandler, OAuthTokens } from './providers';
 export { upsertOAuthToken, getOAuthToken, getFreshAccessToken, listOAuthConnections, deleteOAuthConnection, getUserByOAuthProvider, } from './db';
 /**

package/build/services/oauth/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getUserByOAuthProvider = exports.deleteOAuthConnection = exports.listOAuthConnections = exports.getFreshAccessToken = exports.getOAuthToken = exports.upsertOAuthToken = exports.listProviders = exports.getProvider = exports.registerProvider = exports.consumeOAuthState = exports.createOAuthState = exports.setEncryptionKey = exports.getEncryptionKey = exports.decrypt = exports.encrypt = void 0;
+exports.getUserByOAuthProvider = exports.deleteOAuthConnection = exports.listOAuthConnections = exports.getFreshAccessToken = exports.getOAuthToken = exports.upsertOAuthToken = exports.mayProvision = exports.emailDomain = exports.normalizeDomains = exports.listProviders = exports.getProvider = exports.registerProvider = exports.consumeOAuthState = exports.createOAuthState = exports.setEncryptionKey = exports.getEncryptionKey = exports.decrypt = exports.encrypt = void 0;
 exports.initializeOAuth = initializeOAuth;
 const crypto_1 = require("./crypto");
 const providers_1 = require("./providers");
@@ -17,6 +17,10 @@ var providers_2 = require("./providers");
 Object.defineProperty(exports, "registerProvider", { enumerable: true, get: function () { return providers_2.registerProvider; } });
 Object.defineProperty(exports, "getProvider", { enumerable: true, get: function () { return providers_2.getProvider; } });
 Object.defineProperty(exports, "listProviders", { enumerable: true, get: function () { return providers_2.listProviders; } });
+var provisioning_1 = require("./provisioning");
+Object.defineProperty(exports, "normalizeDomains", { enumerable: true, get: function () { return provisioning_1.normalizeDomains; } });
+Object.defineProperty(exports, "emailDomain", { enumerable: true, get: function () { return provisioning_1.emailDomain; } });
+Object.defineProperty(exports, "mayProvision", { enumerable: true, get: function () { return provisioning_1.mayProvision; } });
 var db_1 = require("./db");
 Object.defineProperty(exports, "upsertOAuthToken", { enumerable: true, get: function () { return db_1.upsertOAuthToken; } });
 Object.defineProperty(exports, "getOAuthToken", { enumerable: true, get: function () { return db_1.getOAuthToken; } });

package/build/services/oauth/provisioning.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Decides whether an OAuth sign-in may create its own account.
+ * Enforced server side in the callback; provider hints are not trusted.
+ */
+export declare function normalizeDomains(domains: string[] | undefined): string[];
+export declare function emailDomain(email: string | null | undefined): string | undefined;
+/** Whether a sign-in with this email may create its own account. Empty list: any. */
+export declare function mayProvision(email: string | null | undefined, allowedDomains: string[]): boolean;

package/build/services/oauth/provisioning.js

@@ -0,0 +1,23 @@
+"use strict";
+/**
+ * Decides whether an OAuth sign-in may create its own account.
+ * Enforced server side in the callback; provider hints are not trusted.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeDomains = normalizeDomains;
+exports.emailDomain = emailDomain;
+exports.mayProvision = mayProvision;
+function normalizeDomains(domains) {
+    return (domains ?? []).map((d) => d.trim().toLowerCase().replace(/^@/, '')).filter(Boolean);
+}
+function emailDomain(email) {
+    const at = email?.lastIndexOf('@') ?? -1;
+    return at > 0 ? email.slice(at + 1).toLowerCase() : undefined;
+}
+/** Whether a sign-in with this email may create its own account. Empty list: any. */
+function mayProvision(email, allowedDomains) {
+    if (allowedDomains.length === 0)
+        return true;
+    const domain = emailDomain(email);
+    return domain !== undefined && allowedDomains.includes(domain);
+}

package/build/start/config.js

@@ -98,6 +98,7 @@ async function applyServerAuthConfig(startConfig) {
             autoProvision: startConfig.auth.oauth.autoProvision,
             defaultRoleType: startConfig.auth.oauth.defaultRoleType,
             baseUrl: startConfig.auth.oauth.baseUrl,
+            allowedDomains: startConfig.auth.oauth.allowedDomains,
         });
     }
     const oauthServer = startConfig.auth?.oauthServer

package/build/tsconfig.tsbuildinfo

@@ -1 +1 @@
-{"root":["../index.ts","../vitest.config.ts","../vitest.fast.config.ts","../vitest.integration.config.ts","../vitest.llm.config.ts","../adapters/express.ts","../api/agent-subscriptions.ts","../api/agents.ts","../api/announcements.ts","../api/auth-sso.ts","../api/auth.ts","../api/bot-accounts.ts","../api/capabilities.ts","../api/controlplane.ts","../api/dba.ts","../api/diagnostics.ts","../api/domain.ts","../api/exports.ts","../api/files.ts","../api/index.ts","../api/insight.ts","../api/knowledge.ts","../api/maintenance.ts","../api/me.ts","../api/namespaces.ts","../api/overview.ts","../api/personas.ts","../api/pipelines.ts","../api/roles.ts","../api/settings.ts","../api/tasks.ts","../api/topics.ts","../api/users.ts","../api/workflow-sets.ts","../api/escalations/accumulate.ts","../api/escalations/analytics.ts","../api/escalations/batch-flag.ts","../api/escalations/bulk.ts","../api/escalations/cancel.ts","../api/escalations/claim.ts","../api/escalations/create.ts","../api/escalations/facets.ts","../api/escalations/helpers.ts","../api/escalations/index.ts","../api/escalations/list.ts","../api/escalations/lookups.ts","../api/escalations/metadata.ts","../api/escalations/related.ts","../api/escalations/resolve-batch.ts","../api/escalations/resolve.ts","../api/escalations/roster-action.ts","../api/escalations/single.ts","../api/mcp/index.ts","../api/mcp/servers.ts","../api/mcp/tools.ts","../api/scan-codes/badge-policy.ts","../api/scan-codes/choice-roles.ts","../api/scan-codes/choice.ts","../api/scan-codes/config.ts","../api/scan-codes/context.ts","../api/scan-codes/execute.ts","../api/scan-codes/fill-labels.ts","../api/scan-codes/grant.ts","../api/scan-codes/hold.ts","../api/scan-codes/identity.ts","../api/scan-codes/index.ts","../api/scan-codes/locate.ts","../api/scan-codes/present.ts","../api/scan-codes/subject.ts","../api/scan-codes/verb-accumulate.ts","../api/scan-codes/verb-fill.ts","../api/scan-codes/verb-into-subject.ts","../api/scan-codes/verbs-subject.ts","../api/scan-codes/verbs.ts","../api/workflows/config.ts","../api/workflows/discovery.ts","../api/workflows/index.ts","../api/workflows/input-lookups.ts","../api/workflows/input-validation.ts","../api/workflows/invocable.ts","../api/workflows/invocation.ts","../api/yaml-workflows/cron.ts","../api/yaml-workflows/crud.ts","../api/yaml-workflows/deploy.ts","../api/yaml-workflows/helpers.ts","../api/yaml-workflows/index.ts","../api/yaml-workflows/versions.ts","../bin/ltc.ts","../lib/typed-resolution.ts","../lib/uuid.ts","../lib/cli/auth.ts","../lib/cli/client.ts","../lib/cli/compile.ts","../lib/cli/format.ts","../lib/cli/init.ts","../lib/cli/output.ts","../lib/cli/scanner.ts","../lib/cli/types.ts","../lib/cli/commands/escalations.ts","../lib/cli/commands/knowledge.ts","../lib/cli/commands/mcp.ts","../lib/cli/commands/personas.ts","../lib/cli/commands/pipelines.ts","../lib/cli/commands/roles.ts","../lib/cli/commands/status.ts","../lib/cli/commands/streams.ts","../lib/cli/commands/users.ts","../lib/cli/commands/workflows.ts","../lib/db/config-lock.ts","../lib/db/index.ts","../lib/db/migrate.ts","../lib/events/browser-view.ts","../lib/events/callback.ts","../lib/events/escalation-wire.ts","../lib/events/index.ts","../lib/events/matching.ts","../lib/events/memory.ts","../lib/events/nats-ws-filter.ts","../lib/events/nats-ws-proxy.ts","../lib/events/nats-ws-server-filter.ts","../lib/events/nats-ws-ticket.ts","../lib/events/nats.ts","../lib/events/publish.ts","../lib/events/socketio.ts","../lib/events/system-events.ts","../lib/http/index.ts","../lib/json-path/pick.ts","../lib/logger/index.ts","../lib/logger/pino.ts","../lib/machines/index.ts","../lib/machines/line.ts","../lib/machines/protocol/codec.ts","../lib/machines/protocol/constants.ts","../lib/machines/protocol/contract.ts","../lib/machines/protocol/envelope.ts","../lib/machines/protocol/index.ts","../lib/machines/protocol/topics.ts","../lib/machines/site/edge-account.ts","../lib/machines/site/mosquitto-conf.ts","../lib/machines/site/site-conf.ts","../lib/machines/transport/callback-feed.ts","../lib/machines/transport/delivery.ts","../lib/machines/transport/index.ts","../lib/machines/transport/memory-broker.ts","../lib/machines/transport/memory.ts","../lib/machines/transport/mqtt-bus.ts","../lib/machines/transport/mqtt-link.ts","../lib/machines/transport/mqtt-session.ts","../lib/machines/transport/nats-bus.ts","../lib/machines/transport/nats-feed.ts","../lib/machines/transport/pubsub-feed.ts","../lib/machines/transport/serial.ts","../lib/machines/transport/stream-bus.ts","../lib/machines/transport/streams.ts","../lib/messaging/config.ts","../lib/messaging/constants.ts","../lib/messaging/index.ts","../lib/messaging/memory.ts","../lib/messaging/subjects.ts","../lib/messaging/nats/permissions.ts","../lib/messaging/nats/provider.ts","../lib/messaging/nats/render-conf.ts","../lib/messaging/nats/streams.ts","../lib/storage/index.ts","../lib/storage/local.ts","../lib/storage/mime.ts","../lib/storage/s3.ts","../lib/storage/types.ts","../lib/telemetry/honeycomb.ts","../lib/telemetry/index.ts","../modules/auth.ts","../modules/branding.ts","../modules/capabilities.ts","../modules/config.ts","../modules/defaults.ts","../modules/display.ts","../modules/features.ts","../modules/ltconfig.ts","../modules/machines.ts","../modules/maintenance.ts","../modules/mcp-auth.ts","../modules/oauth-server.ts","../modules/search.ts","../modules/sso.ts","../modules/utils.ts","../modules/version.ts","../routes/agents.ts","../routes/announcements.ts","../routes/auth-sso.ts","../routes/auth.ts","../routes/bot-accounts.ts","../routes/capabilities.ts","../routes/controlplane.ts","../routes/dba.ts","../routes/delegation.ts","../routes/diagnostics.ts","../routes/docs.ts","../routes/domain.ts","../routes/exports.ts","../routes/file-browser.ts","../routes/files.ts","../routes/index.ts","../routes/insight.ts","../routes/knowledge.ts","../routes/machines.ts","../routes/maintenance.ts","../routes/mcp-endpoint.ts","../routes/mcp.ts","../routes/me.ts","../routes/namespaces.ts","../routes/nats-credentials.ts","../routes/oauth-well-known.ts","../routes/oauth.ts","../routes/overview.ts","../routes/personas.ts","../routes/pipelines.ts","../routes/roles.ts","../routes/scan-codes.ts","../routes/settings.ts","../routes/tasks.ts","../routes/topics.ts","../routes/users.ts","../routes/workflow-sets.ts","../routes/escalations/accumulate.ts","../routes/escalations/acting.ts","../routes/escalations/analytics.ts","../routes/escalations/bulk.ts","../routes/escalations/facets.ts","../routes/escalations/index.ts","../routes/escalations/list.ts","../routes/escalations/metadata.ts","../routes/escalations/related.ts","../routes/escalations/resolve.ts","../routes/escalations/single.ts","../routes/oauth-server/authorize.ts","../routes/oauth-server/grants.ts","../routes/oauth-server/index.ts","../routes/oauth-server/registration.ts","../routes/oauth-server/token.ts","../routes/workflows/config.ts","../routes/workflows/discovery.ts","../routes/workflows/index.ts","../routes/workflows/invocation.ts","../routes/yaml-workflows/cron.ts","../routes/yaml-workflows/crud.ts","../routes/yaml-workflows/deployment.ts","../routes/yaml-workflows/index.ts","../routes/yaml-workflows/versions.ts","../scripts/bambu-boat.ts","../scripts/bambu-print.ts","../scripts/consolidation-sim.ts","../scripts/machine-line.ts","../scripts/ortho-populate.ts","../scripts/printer-cycle.ts","../scripts/process-helpers.ts","../scripts/process.ts","../scripts/token.ts","../scripts/twin-farm.ts","../sdk/index.ts","../services/dba.ts","../services/hotmesh-utils.ts","../services/invocation-access.ts","../services/workflow-invocation.ts","../services/workflow-state.ts","../services/agent/authority.ts","../services/agent/index.ts","../services/agent/input-mapper.ts","../services/agent/sql.ts","../services/agent/subscription-sql.ts","../services/agent/subscriptions.ts","../services/agent/trigger-registry.ts","../services/announcement/index.ts","../services/announcement/sql.ts","../services/auth/bot-api-key.ts","../services/auth/delegation.ts","../services/auth/index.ts","../services/auth/service-token.ts","../services/auth/sql.ts","../services/auth/oauth-server/access-token.ts","../services/auth/oauth-server/authorization.ts","../services/auth/oauth-server/constants.ts","../services/auth/oauth-server/index.ts","../services/auth/oauth-server/metadata.ts","../services/auth/oauth-server/registration.ts","../services/auth/oauth-server/sql.ts","../services/auth/oauth-server/store.ts","../services/config/cache.ts","../services/config/index.ts","../services/config/provider.ts","../services/config/read.ts","../services/config/sql.ts","../services/config/write.ts","../services/controlplane/index.ts","../services/controlplane/quorum-bridge.ts","../services/controlplane/sql.ts","../services/controlplane/stream-messages-sql.ts","../services/controlplane/types.ts","../services/cron/index.ts","../services/diagnostics/index.ts","../services/diagnostics/patterns.ts","../services/domain/index.ts","../services/domain/read.ts","../services/domain/seed.ts","../services/domain/sql.ts","../services/domain/validate.ts","../services/domain/write.ts","../services/escalation/accumulate.ts","../services/escalation/aggregate-sql.ts","../services/escalation/aggregate-validate.ts","../services/escalation/aggregates.ts","../services/escalation/batch-flag.ts","../services/escalation/batch.ts","../services/escalation/bulk.ts","../services/escalation/claim-asserted.ts","../services/escalation/client.ts","../services/escalation/crud.ts","../services/escalation/facet-sql.ts","../services/escalation/facets.ts","../services/escalation/grouped-list.ts","../services/escalation/index.ts","../services/escalation/map.ts","../services/escalation/metrics-cache.ts","../services/escalation/queries.ts","../services/escalation/read-scope-sql.ts","../services/escalation/related-extremes.ts","../services/escalation/related.ts","../services/escalation/resolver-validation.ts","../services/escalation/roster.ts","../services/escalation/sql.ts","../services/escalation/submit-guard.ts","../services/escalation/types.ts","../services/escalation-strategy/default.ts","../services/escalation-strategy/index.ts","../services/escalation-strategy/mcp.ts","../services/export/client.ts","../services/export/index.ts","../services/export/post-process.ts","../services/export/types.ts","../services/iam/acting-identity.ts","../services/iam/activity.ts","../services/iam/bots.ts","../services/iam/context.ts","../services/iam/credentials.ts","../services/iam/envelope.ts","../services/iam/ephemeral.ts","../services/iam/index.ts","../services/iam/principal.ts","../services/iam/resolve.ts","../services/iam/sql.ts","../services/insight/index.ts","../services/insight/prompts.ts","../services/interceptor/activity-interceptor.ts","../services/interceptor/completion.ts","../services/interceptor/context.ts","../services/interceptor/escalation.ts","../services/interceptor/index.ts","../services/interceptor/lifecycle.ts","../services/interceptor/state.ts","../services/interceptor/types.ts","../services/interceptor/activities/config.ts","../services/interceptor/activities/escalation.ts","../services/interceptor/activities/index.ts","../services/interceptor/activities/task.ts","../services/interceptor/activities/workflow.ts","../services/knowledge/index.ts","../services/knowledge/lookup-cache.ts","../services/knowledge/lookup-refs.ts","../services/knowledge/sql.ts","../services/llm/detect.ts","../services/llm/index.ts","../services/llm/translate.ts","../services/llm/types.ts","../services/llm/providers/anthropic.ts","../services/llm/providers/openai.ts","../services/machines/commands.ts","../services/machines/config.ts","../services/machines/contracts.ts","../services/machines/forms.ts","../services/machines/identities.ts","../services/machines/index.ts","../services/machines/leadership.ts","../services/machines/line-index.ts","../services/machines/registry-sql.ts","../services/machines/registry-sync.ts","../services/machines/registry.ts","../services/machines/roles.ts","../services/machines/rows.ts","../services/machines/select.ts","../services/machines/surface.ts","../services/machines/gateway/actions.ts","../services/machines/gateway/address-book.ts","../services/machines/gateway/admission.ts","../services/machines/gateway/api-escalations.ts","../services/machines/gateway/dispatcher.ts","../services/machines/gateway/escalations.ts","../services/machines/gateway/executor.ts","../services/machines/gateway/gateway.ts","../services/machines/gateway/index.ts","../services/machines/gateway/inspect.ts","../services/machines/gateway/jobs.ts","../services/machines/gateway/lifecycle.ts","../services/machines/gateway/log.ts","../services/machines/gateway/lt-http.ts","../services/machines/gateway/pacing.ts","../services/machines/gateway/plan-escalation.ts","../services/machines/gateway/plan-machine.ts","../services/machines/gateway/plan-shared.ts","../services/machines/gateway/project.ts","../services/machines/gateway/provision.ts","../services/machines/gateway/receipts.ts","../services/machines/gateway/reconcile.ts","../services/machines/gateway/registration.ts","../services/machines/gateway/reply-waiter.ts","../services/machines/gateway/state.ts","../services/machines/gateway/trace.ts","../services/machines/gateway/wire-window.ts","../services/machines/gateway/wire.ts","../services/machines/testing/fake-long-tail.ts","../services/machines/testing/index.ts","../services/machines/testing/recording-log.ts","../services/machines/testing/wait.ts","../services/maintenance/index.ts","../services/mcp/adapter.ts","../services/mcp/db.ts","../services/mcp/exposure.ts","../services/mcp/external-server.ts","../services/mcp/index.ts","../services/mcp/register-tool.ts","../services/mcp/registered-tools.ts","../services/mcp/seed-service-account.ts","../services/mcp/server-lifecycle.ts","../services/mcp/server-tools.ts","../services/mcp/server.ts","../services/mcp/sql.ts","../services/mcp/types.ts","../services/mcp/workflow-compiler-server.ts","../services/mcp/workflow-server.ts","../services/mcp/client/connection-dispatch.ts","../services/mcp/client/connection-lifecycle.ts","../services/mcp/client/connection-test.ts","../services/mcp/client/connection.ts","../services/mcp/client/index.ts","../services/mcp/client/network-transport.ts","../services/mcp/client/tools.ts","../services/mcp/db-server/index.ts","../services/mcp/db-server/schemas.ts","../services/mcp/db-server/tools.ts","../services/mcp/playwright-server/index.ts","../services/mcp/playwright-server/lifecycle.ts","../services/mcp/playwright-server/schemas.ts","../services/mcp/playwright-server/tools.ts","../services/namespace/index.ts","../services/namespace/sql.ts","../services/namespace/types.ts","../services/oauth/crypto.ts","../services/oauth/db.ts","../services/oauth/index.ts","../services/oauth/sql.ts","../services/oauth/state.ts","../services/oauth/providers/anthropic.ts","../services/oauth/providers/github.ts","../services/oauth/providers/google.ts","../services/oauth/providers/index.ts","../services/oauth/providers/microsoft.ts","../services/oauth/providers/mock.ts","../services/oauth/providers/registry.ts","../services/oauth/providers/types.ts","../services/orchestrator/condition.ts","../services/orchestrator/index.ts","../services/orchestrator/types.ts","../services/overview/index.ts","../services/overview/sql.ts","../services/persona/index.ts","../services/persona/sql.ts","../services/persona/types.ts","../services/pipelines/enrichment.ts","../services/pipelines/events.ts","../services/pipelines/execution-builder.ts","../services/pipelines/index.ts","../services/pipelines/queries.ts","../services/pipelines/sql.ts","../services/pipelines/types.ts","../services/role/badge-grant.ts","../services/role/enforcement-cache.ts","../services/role/index.ts","../services/role/schema-validator.ts","../services/role/seed.ts","../services/role/sql.ts","../services/role/types.ts","../services/scan-code/index.ts","../services/scan-code/parse.ts","../services/scan-code/read.ts","../services/scan-code/sql.ts","../services/scan-code/validate-facts.ts","../services/scan-code/validate-query.ts","../services/scan-code/validate-subject.ts","../services/scan-code/validate.ts","../services/scan-code/write.ts","../services/task/crud.ts","../services/task/index.ts","../services/task/process.ts","../services/task/resolve.ts","../services/task/sql.ts","../services/task/types.ts","../services/topics/index.ts","../services/topics/sql.ts","../services/topics/system-topics.ts","../services/user/auth.ts","../services/user/crud.ts","../services/user/index.ts","../services/user/preferences.ts","../services/user/rbac.ts","../services/user/roles.ts","../services/user/scope.ts","../services/user/seed-admin.ts","../services/user/sql.ts","../services/user/sso-provision.ts","../services/user/types.ts","../services/workers/registry.ts","../services/workflow-sets/db.ts","../services/workflow-sets/index.ts","../services/workflow-sets/sql.ts","../services/yaml-workflow/builder-regenerate.ts","../services/yaml-workflow/db-utils.ts","../services/yaml-workflow/db-versions.ts","../services/yaml-workflow/db.ts","../services/yaml-workflow/deployer-helpers.ts","../services/yaml-workflow/deployer.ts","../services/yaml-workflow/generator.ts","../services/yaml-workflow/index.ts","../services/yaml-workflow/input-analyzer-helpers.ts","../services/yaml-workflow/input-analyzer.ts","../services/yaml-workflow/invoke.ts","../services/yaml-workflow/pipe-validator.ts","../services/yaml-workflow/sql.ts","../services/yaml-workflow/types.ts","../services/yaml-workflow/durable-compiler/index.ts","../services/yaml-workflow/durable-compiler/parser.ts","../services/yaml-workflow/durable-compiler/prompts.ts","../services/yaml-workflow/durable-compiler/types.ts","../services/yaml-workflow/pattern-detector/array-source.ts","../services/yaml-workflow/pattern-detector/collapse.ts","../services/yaml-workflow/pattern-detector/index.ts","../services/yaml-workflow/pattern-detector/run-detection.ts","../services/yaml-workflow/pattern-detector/types.ts","../services/yaml-workflow/pipeline/analyze.ts","../services/yaml-workflow/pipeline/extract-helpers.ts","../services/yaml-workflow/pipeline/extract.ts","../services/yaml-workflow/pipeline/index.ts","../services/yaml-workflow/pipeline/prompt-templates.ts","../services/yaml-workflow/pipeline/prompts.ts","../services/yaml-workflow/pipeline/validate.ts","../services/yaml-workflow/pipeline/build/dag-assembly.ts","../services/yaml-workflow/pipeline/build/dag.ts","../services/yaml-workflow/pipeline/build/index.ts","../services/yaml-workflow/pipeline/build/iteration.ts","../services/yaml-workflow/pipeline/build/metadata.ts","../services/yaml-workflow/pipeline/build/transform.ts","../services/yaml-workflow/pipeline/build/utils.ts","../services/yaml-workflow/pipeline/build/wiring.ts","../services/yaml-workflow/pipeline/compile/index.ts","../services/yaml-workflow/pipeline/compile/llm-call.ts","../services/yaml-workflow/pipeline/compile/parse-plan.ts","../services/yaml-workflow/pipeline/compile/summarize.ts","../services/yaml-workflow/workers/callbacks.ts","../services/yaml-workflow/workers/events.ts","../services/yaml-workflow/workers/index.ts","../services/yaml-workflow/workers/register.ts","../services/yaml-workflow/workers/scope.ts","../services/yaml-workflow/workers/step-tool.ts","../shared/workflow-state.ts","../shared/form-validation/ctx-path.ts","../shared/form-validation/derive-field-label.ts","../shared/form-validation/display-only-widgets.ts","../shared/form-validation/field-validator.ts","../shared/form-validation/index.ts","../shared/form-validation/invoke-context.ts","../shared/form-validation/validate-resolver-payload.ts","../shared/form-validation/x-lt-actions.ts","../shared/form-validation/x-lt-bind.ts","../shared/form-validation/x-lt-help.ts","../shared/form-validation/x-lt-invoke.ts","../shared/form-validation/x-lt-labels.ts","../shared/form-validation/x-lt-options.ts","../shared/form-validation/x-lt-query.ts","../shared/form-validation/x-lt-require-any.ts","../shared/form-validation/x-lt-require-sum.ts","../shared/form-validation/x-lt-roster.ts","../shared/form-validation/x-lt-scan.ts","../shared/form-validation/x-lt-show-if.ts","../shared/form-validation/x-lt-submit-guard.ts","../shared/form-validation/x-lt-submit-on-claim.ts","../shared/form-validation/x-lt-transition.ts","../shared/list-schema/aggregate.ts","../shared/list-schema/index.ts","../shared/list-schema/template.ts","../shared/list-schema/types.ts","../shared/list-schema/validate.ts","../shared/roles/segment.ts","../shared/scan-code/gtin.ts","../shared/scan-code/index.ts","../shared/scan-code/parse.ts","../start/adapters.ts","../start/apply-report.ts","../start/config.ts","../start/graph-workflows.ts","../start/index.ts","../start/server.ts","../start/socket-auth.ts","../start/workers.ts","../system/index.ts","../system/activities/claude-code.ts","../system/activities/file-storage.ts","../system/activities/http.ts","../system/activities/knowledge.ts","../system/activities/oauth.ts","../system/activities/schema-exchange.ts","../system/activities/sql.ts","../system/activities/triage/cache.ts","../system/activities/triage/context.ts","../system/activities/triage/discovery.ts","../system/activities/triage/index.ts","../system/activities/triage/llm.ts","../system/activities/triage/tools.ts","../system/mcp-servers/caller-auth.ts","../system/mcp-servers/claude-code.ts","../system/mcp-servers/docs.ts","../system/mcp-servers/events.ts","../system/mcp-servers/file-storage.ts","../system/mcp-servers/http-fetch.ts","../system/mcp-servers/human-queue-schemas.ts","../system/mcp-servers/human-queue.ts","../system/mcp-servers/knowledge.ts","../system/mcp-servers/machines-schemas.ts","../system/mcp-servers/machines.ts","../system/mcp-servers/oauth.ts","../system/mcp-servers/schema-exchange.ts","../system/mcp-servers/translation.ts","../system/mcp-servers/vision-prompts.ts","../system/mcp-servers/vision.ts","../system/mcp-servers/workflow-compiler.ts","../system/mcp-servers/workflow.ts","../system/mcp-servers/admin/agent-subscriptions.ts","../system/mcp-servers/admin/agents.ts","../system/mcp-servers/admin/announcements.ts","../system/mcp-servers/admin/bot-accounts.ts","../system/mcp-servers/admin/controlplane.ts","../system/mcp-servers/admin/diagnostics.ts","../system/mcp-servers/admin/domain-context.ts","../system/mcp-servers/admin/escalations.ts","../system/mcp-servers/admin/exports.ts","../system/mcp-servers/admin/index.ts","../system/mcp-servers/admin/maintenance.ts","../system/mcp-servers/admin/mcp-servers.ts","../system/mcp-servers/admin/overview.ts","../system/mcp-servers/admin/personas.ts","../system/mcp-servers/admin/pipelines.ts","../system/mcp-servers/admin/run-read.ts","../system/mcp-servers/admin/scan-codes.ts","../system/mcp-servers/admin/schemas.ts","../system/mcp-servers/admin/settings.ts","../system/mcp-servers/admin/tasks.ts","../system/mcp-servers/admin/topics.ts","../system/mcp-servers/admin/users.ts","../system/mcp-servers/admin/workflow-config.ts","../system/mcp-servers/admin/workflows.ts","../system/mcp-servers/admin/yaml-workflows.ts","../system/mcp-servers/db-query/index.ts","../system/mcp-servers/db-query/schemas.ts","../system/mcp-servers/db-query/tools.ts","../system/seed/index.ts","../system/seed/tool-manifests-admin.ts","../system/seed/tool-manifests-data.ts","../system/seed/tool-manifests-escalation.ts","../system/seed/tool-manifests-events.ts","../system/seed/tool-manifests-knowledge.ts","../system/seed/tool-manifests-machines.ts","../system/seed/tool-manifests-workflows.ts","../system/workflows/tool-result-guard.ts","../system/workflows/capability-invoke/activities.ts","../system/workflows/capability-invoke/index.ts","../system/workflows/mcp-deterministic/activities.ts","../system/workflows/mcp-deterministic/index.ts","../system/workflows/mcp-query/index.ts","../system/workflows/mcp-query/prompts.ts","../system/workflows/mcp-query/strategy-advisors.ts","../system/workflows/mcp-query/types.ts","../system/workflows/mcp-query/activities/caches.ts","../system/workflows/mcp-query/activities/discovery.ts","../system/workflows/mcp-query/activities/index.ts","../system/workflows/mcp-query/activities/llm.ts","../system/workflows/mcp-query/activities/tool-executor.ts","../system/workflows/mcp-query/activities/tool-loader.ts","../system/workflows/mcp-query-router/activities.ts","../system/workflows/mcp-query-router/index.ts","../system/workflows/mcp-query-router/prompts.ts","../system/workflows/mcp-triage/activities-proxy.ts","../system/workflows/mcp-triage/index.ts","../system/workflows/mcp-triage/prompts.ts","../system/workflows/mcp-triage/response-builders.ts","../system/workflows/mcp-triage/response.ts","../system/workflows/mcp-triage/types.ts","../system/workflows/mcp-triage-deterministic/activities.ts","../system/workflows/mcp-triage-deterministic/index.ts","../system/workflows/mcp-triage-router/activities.ts","../system/workflows/mcp-triage-router/index.ts","../system/workflows/mcp-workflow-builder/index.ts","../system/workflows/mcp-workflow-builder/prompts.ts","../system/workflows/mcp-workflow-builder/activities/caches.ts","../system/workflows/mcp-workflow-builder/activities/index.ts","../system/workflows/mcp-workflow-builder/activities/llm.ts","../system/workflows/mcp-workflow-builder/activities/tool-loader.ts","../system/workflows/mcp-workflow-planner/index.ts","../system/workflows/mcp-workflow-planner/prompts.ts","../system/workflows/mcp-workflow-planner/activities/analyze.ts","../system/workflows/mcp-workflow-planner/activities/index.ts","../system/workflows/mcp-workflow-planner/activities/persist.ts","../system/workflows/mcp-workflow-planner/activities/plan.ts","../system/workflows/shared/discovery.ts","../system/workflows/shared/index.ts","../system/workflows/shared/llm-caller.ts","../system/workflows/shared/principal-tools.ts","../system/workflows/shared/prompts.ts","../system/workflows/shared/strategy-advisors.ts","../system/workflows/shared/tool-executor.ts","../system/workflows/shared/tool-loader.ts","../system/workflows/shared/types.ts","../themes/midnight.ts","../types/agent.ts","../types/analytics.ts","../types/auth.ts","../types/capability.ts","../types/config.ts","../types/delegation.ts","../types/discovery.ts","../types/domain-manifest.ts","../types/envelope.ts","../types/escalation-strategy.ts","../types/escalation.ts","../types/events.ts","../types/export.ts","../types/express.d.ts","../types/facets.ts","../types/index.ts","../types/logger.ts","../types/machines-view.ts","../types/machines.ts","../types/maintenance.ts","../types/mcp.ts","../types/messaging.ts","../types/oauth-server.ts","../types/oauth.ts","../types/persona.ts","../types/scan-choice.ts","../types/sdk.ts","../types/startup.ts","../types/task.ts","../types/telemetry.ts","../types/tool-context.ts","../types/user.ts","../types/validation.ts","../types/workflow-icons.ts","../types/workflow-set.ts","../types/workflow.ts","../types/yaml-workflow.ts","../types/scan-code/constants.ts","../types/scan-code/index.ts","../types/scan-code/response.ts","../types/scan-code/rule.ts","../workers/index.ts"],"version":"5.9.3"}
+{"root":["../index.ts","../vitest.config.ts","../vitest.fast.config.ts","../vitest.integration.config.ts","../vitest.llm.config.ts","../adapters/express.ts","../api/agent-subscriptions.ts","../api/agents.ts","../api/announcements.ts","../api/auth-sso.ts","../api/auth.ts","../api/bot-accounts.ts","../api/capabilities.ts","../api/controlplane.ts","../api/dba.ts","../api/diagnostics.ts","../api/domain.ts","../api/exports.ts","../api/files.ts","../api/index.ts","../api/insight.ts","../api/knowledge.ts","../api/maintenance.ts","../api/me.ts","../api/namespaces.ts","../api/overview.ts","../api/personas.ts","../api/pipelines.ts","../api/roles.ts","../api/settings.ts","../api/tasks.ts","../api/topics.ts","../api/users.ts","../api/workflow-sets.ts","../api/escalations/accumulate.ts","../api/escalations/analytics.ts","../api/escalations/batch-flag.ts","../api/escalations/bulk.ts","../api/escalations/cancel.ts","../api/escalations/claim.ts","../api/escalations/create.ts","../api/escalations/facets.ts","../api/escalations/helpers.ts","../api/escalations/index.ts","../api/escalations/list.ts","../api/escalations/lookups.ts","../api/escalations/metadata.ts","../api/escalations/related.ts","../api/escalations/resolve-batch.ts","../api/escalations/resolve.ts","../api/escalations/roster-action.ts","../api/escalations/single.ts","../api/mcp/index.ts","../api/mcp/servers.ts","../api/mcp/tools.ts","../api/scan-codes/badge-policy.ts","../api/scan-codes/choice-roles.ts","../api/scan-codes/choice.ts","../api/scan-codes/config.ts","../api/scan-codes/context.ts","../api/scan-codes/execute.ts","../api/scan-codes/fill-labels.ts","../api/scan-codes/grant.ts","../api/scan-codes/hold.ts","../api/scan-codes/identity.ts","../api/scan-codes/index.ts","../api/scan-codes/locate.ts","../api/scan-codes/present.ts","../api/scan-codes/subject.ts","../api/scan-codes/verb-accumulate.ts","../api/scan-codes/verb-fill.ts","../api/scan-codes/verb-into-subject.ts","../api/scan-codes/verbs-subject.ts","../api/scan-codes/verbs.ts","../api/workflows/config.ts","../api/workflows/discovery.ts","../api/workflows/index.ts","../api/workflows/input-lookups.ts","../api/workflows/input-validation.ts","../api/workflows/invocable.ts","../api/workflows/invocation.ts","../api/yaml-workflows/cron.ts","../api/yaml-workflows/crud.ts","../api/yaml-workflows/deploy.ts","../api/yaml-workflows/helpers.ts","../api/yaml-workflows/index.ts","../api/yaml-workflows/versions.ts","../bin/ltc.ts","../lib/typed-resolution.ts","../lib/uuid.ts","../lib/cli/auth.ts","../lib/cli/client.ts","../lib/cli/compile.ts","../lib/cli/format.ts","../lib/cli/init.ts","../lib/cli/output.ts","../lib/cli/scanner.ts","../lib/cli/types.ts","../lib/cli/commands/escalations.ts","../lib/cli/commands/knowledge.ts","../lib/cli/commands/mcp.ts","../lib/cli/commands/personas.ts","../lib/cli/commands/pipelines.ts","../lib/cli/commands/roles.ts","../lib/cli/commands/status.ts","../lib/cli/commands/streams.ts","../lib/cli/commands/users.ts","../lib/cli/commands/workflows.ts","../lib/db/config-lock.ts","../lib/db/index.ts","../lib/db/migrate.ts","../lib/events/browser-view.ts","../lib/events/callback.ts","../lib/events/escalation-wire.ts","../lib/events/index.ts","../lib/events/matching.ts","../lib/events/memory.ts","../lib/events/nats-ws-filter.ts","../lib/events/nats-ws-proxy.ts","../lib/events/nats-ws-server-filter.ts","../lib/events/nats-ws-ticket.ts","../lib/events/nats.ts","../lib/events/publish.ts","../lib/events/socketio.ts","../lib/events/system-events.ts","../lib/http/index.ts","../lib/json-path/pick.ts","../lib/logger/index.ts","../lib/logger/pino.ts","../lib/machines/index.ts","../lib/machines/line.ts","../lib/machines/protocol/codec.ts","../lib/machines/protocol/constants.ts","../lib/machines/protocol/contract.ts","../lib/machines/protocol/envelope.ts","../lib/machines/protocol/index.ts","../lib/machines/protocol/topics.ts","../lib/machines/site/edge-account.ts","../lib/machines/site/mosquitto-conf.ts","../lib/machines/site/site-conf.ts","../lib/machines/transport/callback-feed.ts","../lib/machines/transport/delivery.ts","../lib/machines/transport/index.ts","../lib/machines/transport/memory-broker.ts","../lib/machines/transport/memory.ts","../lib/machines/transport/mqtt-bus.ts","../lib/machines/transport/mqtt-link.ts","../lib/machines/transport/mqtt-session.ts","../lib/machines/transport/nats-bus.ts","../lib/machines/transport/nats-feed.ts","../lib/machines/transport/pubsub-feed.ts","../lib/machines/transport/serial.ts","../lib/machines/transport/stream-bus.ts","../lib/machines/transport/streams.ts","../lib/messaging/config.ts","../lib/messaging/constants.ts","../lib/messaging/index.ts","../lib/messaging/memory.ts","../lib/messaging/subjects.ts","../lib/messaging/nats/permissions.ts","../lib/messaging/nats/provider.ts","../lib/messaging/nats/render-conf.ts","../lib/messaging/nats/streams.ts","../lib/storage/index.ts","../lib/storage/local.ts","../lib/storage/mime.ts","../lib/storage/s3.ts","../lib/storage/types.ts","../lib/telemetry/honeycomb.ts","../lib/telemetry/index.ts","../modules/auth.ts","../modules/branding.ts","../modules/capabilities.ts","../modules/config.ts","../modules/defaults.ts","../modules/display.ts","../modules/features.ts","../modules/ltconfig.ts","../modules/machines.ts","../modules/maintenance.ts","../modules/mcp-auth.ts","../modules/oauth-server.ts","../modules/search.ts","../modules/sso.ts","../modules/utils.ts","../modules/version.ts","../routes/agents.ts","../routes/announcements.ts","../routes/auth-sso.ts","../routes/auth.ts","../routes/bot-accounts.ts","../routes/capabilities.ts","../routes/controlplane.ts","../routes/dba.ts","../routes/delegation.ts","../routes/diagnostics.ts","../routes/docs.ts","../routes/domain.ts","../routes/exports.ts","../routes/file-browser.ts","../routes/files.ts","../routes/index.ts","../routes/insight.ts","../routes/knowledge.ts","../routes/machines.ts","../routes/maintenance.ts","../routes/mcp-endpoint.ts","../routes/mcp.ts","../routes/me.ts","../routes/namespaces.ts","../routes/nats-credentials.ts","../routes/oauth-well-known.ts","../routes/oauth.ts","../routes/overview.ts","../routes/personas.ts","../routes/pipelines.ts","../routes/roles.ts","../routes/scan-codes.ts","../routes/settings.ts","../routes/tasks.ts","../routes/topics.ts","../routes/users.ts","../routes/workflow-sets.ts","../routes/escalations/accumulate.ts","../routes/escalations/acting.ts","../routes/escalations/analytics.ts","../routes/escalations/bulk.ts","../routes/escalations/facets.ts","../routes/escalations/index.ts","../routes/escalations/list.ts","../routes/escalations/metadata.ts","../routes/escalations/related.ts","../routes/escalations/resolve.ts","../routes/escalations/single.ts","../routes/oauth-server/authorize.ts","../routes/oauth-server/grants.ts","../routes/oauth-server/index.ts","../routes/oauth-server/registration.ts","../routes/oauth-server/token.ts","../routes/workflows/config.ts","../routes/workflows/discovery.ts","../routes/workflows/index.ts","../routes/workflows/invocation.ts","../routes/yaml-workflows/cron.ts","../routes/yaml-workflows/crud.ts","../routes/yaml-workflows/deployment.ts","../routes/yaml-workflows/index.ts","../routes/yaml-workflows/versions.ts","../scripts/bambu-boat.ts","../scripts/bambu-print.ts","../scripts/consolidation-sim.ts","../scripts/machine-line.ts","../scripts/ortho-populate.ts","../scripts/printer-cycle.ts","../scripts/process-helpers.ts","../scripts/process.ts","../scripts/token.ts","../scripts/twin-farm.ts","../sdk/index.ts","../services/dba.ts","../services/hotmesh-utils.ts","../services/invocation-access.ts","../services/workflow-invocation.ts","../services/workflow-state.ts","../services/agent/authority.ts","../services/agent/index.ts","../services/agent/input-mapper.ts","../services/agent/sql.ts","../services/agent/subscription-sql.ts","../services/agent/subscriptions.ts","../services/agent/trigger-registry.ts","../services/announcement/index.ts","../services/announcement/sql.ts","../services/auth/bot-api-key.ts","../services/auth/delegation.ts","../services/auth/index.ts","../services/auth/service-token.ts","../services/auth/sql.ts","../services/auth/oauth-server/access-token.ts","../services/auth/oauth-server/authorization.ts","../services/auth/oauth-server/constants.ts","../services/auth/oauth-server/index.ts","../services/auth/oauth-server/metadata.ts","../services/auth/oauth-server/registration.ts","../services/auth/oauth-server/sql.ts","../services/auth/oauth-server/store.ts","../services/config/cache.ts","../services/config/index.ts","../services/config/provider.ts","../services/config/read.ts","../services/config/sql.ts","../services/config/write.ts","../services/controlplane/index.ts","../services/controlplane/quorum-bridge.ts","../services/controlplane/sql.ts","../services/controlplane/stream-messages-sql.ts","../services/controlplane/types.ts","../services/cron/index.ts","../services/diagnostics/index.ts","../services/diagnostics/patterns.ts","../services/domain/index.ts","../services/domain/read.ts","../services/domain/seed.ts","../services/domain/sql.ts","../services/domain/validate.ts","../services/domain/write.ts","../services/escalation/accumulate.ts","../services/escalation/aggregate-sql.ts","../services/escalation/aggregate-validate.ts","../services/escalation/aggregates.ts","../services/escalation/batch-flag.ts","../services/escalation/batch.ts","../services/escalation/bulk.ts","../services/escalation/claim-asserted.ts","../services/escalation/client.ts","../services/escalation/crud.ts","../services/escalation/facet-sql.ts","../services/escalation/facets.ts","../services/escalation/grouped-list.ts","../services/escalation/index.ts","../services/escalation/map.ts","../services/escalation/metrics-cache.ts","../services/escalation/queries.ts","../services/escalation/read-scope-sql.ts","../services/escalation/related-extremes.ts","../services/escalation/related.ts","../services/escalation/resolver-validation.ts","../services/escalation/roster.ts","../services/escalation/sql.ts","../services/escalation/submit-guard.ts","../services/escalation/types.ts","../services/escalation-strategy/default.ts","../services/escalation-strategy/index.ts","../services/escalation-strategy/mcp.ts","../services/export/client.ts","../services/export/index.ts","../services/export/post-process.ts","../services/export/types.ts","../services/iam/acting-identity.ts","../services/iam/activity.ts","../services/iam/bots.ts","../services/iam/context.ts","../services/iam/credentials.ts","../services/iam/envelope.ts","../services/iam/ephemeral.ts","../services/iam/index.ts","../services/iam/principal.ts","../services/iam/resolve.ts","../services/iam/sql.ts","../services/insight/index.ts","../services/insight/prompts.ts","../services/interceptor/activity-interceptor.ts","../services/interceptor/completion.ts","../services/interceptor/context.ts","../services/interceptor/escalation.ts","../services/interceptor/index.ts","../services/interceptor/lifecycle.ts","../services/interceptor/state.ts","../services/interceptor/types.ts","../services/interceptor/activities/config.ts","../services/interceptor/activities/escalation.ts","../services/interceptor/activities/index.ts","../services/interceptor/activities/task.ts","../services/interceptor/activities/workflow.ts","../services/knowledge/index.ts","../services/knowledge/lookup-cache.ts","../services/knowledge/lookup-refs.ts","../services/knowledge/sql.ts","../services/llm/detect.ts","../services/llm/index.ts","../services/llm/translate.ts","../services/llm/types.ts","../services/llm/providers/anthropic.ts","../services/llm/providers/openai.ts","../services/machines/commands.ts","../services/machines/config.ts","../services/machines/contracts.ts","../services/machines/forms.ts","../services/machines/identities.ts","../services/machines/index.ts","../services/machines/leadership.ts","../services/machines/line-index.ts","../services/machines/registry-sql.ts","../services/machines/registry-sync.ts","../services/machines/registry.ts","../services/machines/roles.ts","../services/machines/rows.ts","../services/machines/select.ts","../services/machines/surface.ts","../services/machines/gateway/actions.ts","../services/machines/gateway/address-book.ts","../services/machines/gateway/admission.ts","../services/machines/gateway/api-escalations.ts","../services/machines/gateway/dispatcher.ts","../services/machines/gateway/escalations.ts","../services/machines/gateway/executor.ts","../services/machines/gateway/gateway.ts","../services/machines/gateway/index.ts","../services/machines/gateway/inspect.ts","../services/machines/gateway/jobs.ts","../services/machines/gateway/lifecycle.ts","../services/machines/gateway/log.ts","../services/machines/gateway/lt-http.ts","../services/machines/gateway/pacing.ts","../services/machines/gateway/plan-escalation.ts","../services/machines/gateway/plan-machine.ts","../services/machines/gateway/plan-shared.ts","../services/machines/gateway/project.ts","../services/machines/gateway/provision.ts","../services/machines/gateway/receipts.ts","../services/machines/gateway/reconcile.ts","../services/machines/gateway/registration.ts","../services/machines/gateway/reply-waiter.ts","../services/machines/gateway/state.ts","../services/machines/gateway/trace.ts","../services/machines/gateway/wire-window.ts","../services/machines/gateway/wire.ts","../services/machines/testing/fake-long-tail.ts","../services/machines/testing/index.ts","../services/machines/testing/recording-log.ts","../services/machines/testing/wait.ts","../services/maintenance/index.ts","../services/mcp/adapter.ts","../services/mcp/db.ts","../services/mcp/exposure.ts","../services/mcp/external-server.ts","../services/mcp/index.ts","../services/mcp/register-tool.ts","../services/mcp/registered-tools.ts","../services/mcp/seed-service-account.ts","../services/mcp/server-lifecycle.ts","../services/mcp/server-tools.ts","../services/mcp/server.ts","../services/mcp/sql.ts","../services/mcp/types.ts","../services/mcp/workflow-compiler-server.ts","../services/mcp/workflow-server.ts","../services/mcp/client/connection-dispatch.ts","../services/mcp/client/connection-lifecycle.ts","../services/mcp/client/connection-test.ts","../services/mcp/client/connection.ts","../services/mcp/client/index.ts","../services/mcp/client/network-transport.ts","../services/mcp/client/tools.ts","../services/mcp/db-server/index.ts","../services/mcp/db-server/schemas.ts","../services/mcp/db-server/tools.ts","../services/mcp/playwright-server/index.ts","../services/mcp/playwright-server/lifecycle.ts","../services/mcp/playwright-server/schemas.ts","../services/mcp/playwright-server/tools.ts","../services/namespace/index.ts","../services/namespace/sql.ts","../services/namespace/types.ts","../services/oauth/crypto.ts","../services/oauth/db.ts","../services/oauth/index.ts","../services/oauth/provisioning.ts","../services/oauth/sql.ts","../services/oauth/state.ts","../services/oauth/providers/anthropic.ts","../services/oauth/providers/github.ts","../services/oauth/providers/google.ts","../services/oauth/providers/index.ts","../services/oauth/providers/microsoft.ts","../services/oauth/providers/mock.ts","../services/oauth/providers/registry.ts","../services/oauth/providers/types.ts","../services/orchestrator/condition.ts","../services/orchestrator/index.ts","../services/orchestrator/types.ts","../services/overview/index.ts","../services/overview/sql.ts","../services/persona/index.ts","../services/persona/sql.ts","../services/persona/types.ts","../services/pipelines/enrichment.ts","../services/pipelines/events.ts","../services/pipelines/execution-builder.ts","../services/pipelines/index.ts","../services/pipelines/queries.ts","../services/pipelines/sql.ts","../services/pipelines/types.ts","../services/role/badge-grant.ts","../services/role/enforcement-cache.ts","../services/role/index.ts","../services/role/schema-validator.ts","../services/role/seed.ts","../services/role/sql.ts","../services/role/types.ts","../services/scan-code/index.ts","../services/scan-code/parse.ts","../services/scan-code/read.ts","../services/scan-code/sql.ts","../services/scan-code/validate-facts.ts","../services/scan-code/validate-query.ts","../services/scan-code/validate-subject.ts","../services/scan-code/validate.ts","../services/scan-code/write.ts","../services/task/crud.ts","../services/task/index.ts","../services/task/process.ts","../services/task/resolve.ts","../services/task/sql.ts","../services/task/types.ts","../services/topics/index.ts","../services/topics/sql.ts","../services/topics/system-topics.ts","../services/user/auth.ts","../services/user/crud.ts","../services/user/index.ts","../services/user/preferences.ts","../services/user/rbac.ts","../services/user/roles.ts","../services/user/scope.ts","../services/user/seed-admin.ts","../services/user/sql.ts","../services/user/sso-provision.ts","../services/user/types.ts","../services/workers/registry.ts","../services/workflow-sets/db.ts","../services/workflow-sets/index.ts","../services/workflow-sets/sql.ts","../services/yaml-workflow/builder-regenerate.ts","../services/yaml-workflow/db-utils.ts","../services/yaml-workflow/db-versions.ts","../services/yaml-workflow/db.ts","../services/yaml-workflow/deployer-helpers.ts","../services/yaml-workflow/deployer.ts","../services/yaml-workflow/generator.ts","../services/yaml-workflow/index.ts","../services/yaml-workflow/input-analyzer-helpers.ts","../services/yaml-workflow/input-analyzer.ts","../services/yaml-workflow/invoke.ts","../services/yaml-workflow/pipe-validator.ts","../services/yaml-workflow/sql.ts","../services/yaml-workflow/types.ts","../services/yaml-workflow/durable-compiler/index.ts","../services/yaml-workflow/durable-compiler/parser.ts","../services/yaml-workflow/durable-compiler/prompts.ts","../services/yaml-workflow/durable-compiler/types.ts","../services/yaml-workflow/pattern-detector/array-source.ts","../services/yaml-workflow/pattern-detector/collapse.ts","../services/yaml-workflow/pattern-detector/index.ts","../services/yaml-workflow/pattern-detector/run-detection.ts","../services/yaml-workflow/pattern-detector/types.ts","../services/yaml-workflow/pipeline/analyze.ts","../services/yaml-workflow/pipeline/extract-helpers.ts","../services/yaml-workflow/pipeline/extract.ts","../services/yaml-workflow/pipeline/index.ts","../services/yaml-workflow/pipeline/prompt-templates.ts","../services/yaml-workflow/pipeline/prompts.ts","../services/yaml-workflow/pipeline/validate.ts","../services/yaml-workflow/pipeline/build/dag-assembly.ts","../services/yaml-workflow/pipeline/build/dag.ts","../services/yaml-workflow/pipeline/build/index.ts","../services/yaml-workflow/pipeline/build/iteration.ts","../services/yaml-workflow/pipeline/build/metadata.ts","../services/yaml-workflow/pipeline/build/transform.ts","../services/yaml-workflow/pipeline/build/utils.ts","../services/yaml-workflow/pipeline/build/wiring.ts","../services/yaml-workflow/pipeline/compile/index.ts","../services/yaml-workflow/pipeline/compile/llm-call.ts","../services/yaml-workflow/pipeline/compile/parse-plan.ts","../services/yaml-workflow/pipeline/compile/summarize.ts","../services/yaml-workflow/workers/callbacks.ts","../services/yaml-workflow/workers/events.ts","../services/yaml-workflow/workers/index.ts","../services/yaml-workflow/workers/register.ts","../services/yaml-workflow/workers/scope.ts","../services/yaml-workflow/workers/step-tool.ts","../shared/workflow-state.ts","../shared/form-validation/ctx-path.ts","../shared/form-validation/derive-field-label.ts","../shared/form-validation/display-only-widgets.ts","../shared/form-validation/field-validator.ts","../shared/form-validation/index.ts","../shared/form-validation/invoke-context.ts","../shared/form-validation/validate-resolver-payload.ts","../shared/form-validation/x-lt-actions.ts","../shared/form-validation/x-lt-bind.ts","../shared/form-validation/x-lt-help.ts","../shared/form-validation/x-lt-invoke.ts","../shared/form-validation/x-lt-labels.ts","../shared/form-validation/x-lt-options.ts","../shared/form-validation/x-lt-query.ts","../shared/form-validation/x-lt-require-any.ts","../shared/form-validation/x-lt-require-sum.ts","../shared/form-validation/x-lt-roster.ts","../shared/form-validation/x-lt-scan.ts","../shared/form-validation/x-lt-show-if.ts","../shared/form-validation/x-lt-submit-guard.ts","../shared/form-validation/x-lt-submit-on-claim.ts","../shared/form-validation/x-lt-transition.ts","../shared/list-schema/aggregate.ts","../shared/list-schema/index.ts","../shared/list-schema/template.ts","../shared/list-schema/types.ts","../shared/list-schema/validate.ts","../shared/roles/segment.ts","../shared/scan-code/gtin.ts","../shared/scan-code/index.ts","../shared/scan-code/parse.ts","../start/adapters.ts","../start/apply-report.ts","../start/config.ts","../start/graph-workflows.ts","../start/index.ts","../start/server.ts","../start/socket-auth.ts","../start/workers.ts","../system/index.ts","../system/activities/claude-code.ts","../system/activities/file-storage.ts","../system/activities/http.ts","../system/activities/knowledge.ts","../system/activities/oauth.ts","../system/activities/schema-exchange.ts","../system/activities/sql.ts","../system/activities/triage/cache.ts","../system/activities/triage/context.ts","../system/activities/triage/discovery.ts","../system/activities/triage/index.ts","../system/activities/triage/llm.ts","../system/activities/triage/tools.ts","../system/mcp-servers/caller-auth.ts","../system/mcp-servers/claude-code.ts","../system/mcp-servers/docs.ts","../system/mcp-servers/events.ts","../system/mcp-servers/file-storage.ts","../system/mcp-servers/http-fetch.ts","../system/mcp-servers/human-queue-schemas.ts","../system/mcp-servers/human-queue.ts","../system/mcp-servers/knowledge.ts","../system/mcp-servers/machines-schemas.ts","../system/mcp-servers/machines.ts","../system/mcp-servers/oauth.ts","../system/mcp-servers/schema-exchange.ts","../system/mcp-servers/translation.ts","../system/mcp-servers/vision-prompts.ts","../system/mcp-servers/vision.ts","../system/mcp-servers/workflow-compiler.ts","../system/mcp-servers/workflow.ts","../system/mcp-servers/admin/agent-subscriptions.ts","../system/mcp-servers/admin/agents.ts","../system/mcp-servers/admin/announcements.ts","../system/mcp-servers/admin/bot-accounts.ts","../system/mcp-servers/admin/controlplane.ts","../system/mcp-servers/admin/diagnostics.ts","../system/mcp-servers/admin/domain-context.ts","../system/mcp-servers/admin/escalations.ts","../system/mcp-servers/admin/exports.ts","../system/mcp-servers/admin/index.ts","../system/mcp-servers/admin/maintenance.ts","../system/mcp-servers/admin/mcp-servers.ts","../system/mcp-servers/admin/overview.ts","../system/mcp-servers/admin/personas.ts","../system/mcp-servers/admin/pipelines.ts","../system/mcp-servers/admin/run-read.ts","../system/mcp-servers/admin/scan-codes.ts","../system/mcp-servers/admin/schemas.ts","../system/mcp-servers/admin/settings.ts","../system/mcp-servers/admin/tasks.ts","../system/mcp-servers/admin/topics.ts","../system/mcp-servers/admin/users.ts","../system/mcp-servers/admin/workflow-config.ts","../system/mcp-servers/admin/workflows.ts","../system/mcp-servers/admin/yaml-workflows.ts","../system/mcp-servers/db-query/index.ts","../system/mcp-servers/db-query/schemas.ts","../system/mcp-servers/db-query/tools.ts","../system/seed/index.ts","../system/seed/tool-manifests-admin.ts","../system/seed/tool-manifests-data.ts","../system/seed/tool-manifests-escalation.ts","../system/seed/tool-manifests-events.ts","../system/seed/tool-manifests-knowledge.ts","../system/seed/tool-manifests-machines.ts","../system/seed/tool-manifests-workflows.ts","../system/workflows/tool-result-guard.ts","../system/workflows/capability-invoke/activities.ts","../system/workflows/capability-invoke/index.ts","../system/workflows/mcp-deterministic/activities.ts","../system/workflows/mcp-deterministic/index.ts","../system/workflows/mcp-query/index.ts","../system/workflows/mcp-query/prompts.ts","../system/workflows/mcp-query/strategy-advisors.ts","../system/workflows/mcp-query/types.ts","../system/workflows/mcp-query/activities/caches.ts","../system/workflows/mcp-query/activities/discovery.ts","../system/workflows/mcp-query/activities/index.ts","../system/workflows/mcp-query/activities/llm.ts","../system/workflows/mcp-query/activities/tool-executor.ts","../system/workflows/mcp-query/activities/tool-loader.ts","../system/workflows/mcp-query-router/activities.ts","../system/workflows/mcp-query-router/index.ts","../system/workflows/mcp-query-router/prompts.ts","../system/workflows/mcp-triage/activities-proxy.ts","../system/workflows/mcp-triage/index.ts","../system/workflows/mcp-triage/prompts.ts","../system/workflows/mcp-triage/response-builders.ts","../system/workflows/mcp-triage/response.ts","../system/workflows/mcp-triage/types.ts","../system/workflows/mcp-triage-deterministic/activities.ts","../system/workflows/mcp-triage-deterministic/index.ts","../system/workflows/mcp-triage-router/activities.ts","../system/workflows/mcp-triage-router/index.ts","../system/workflows/mcp-workflow-builder/index.ts","../system/workflows/mcp-workflow-builder/prompts.ts","../system/workflows/mcp-workflow-builder/activities/caches.ts","../system/workflows/mcp-workflow-builder/activities/index.ts","../system/workflows/mcp-workflow-builder/activities/llm.ts","../system/workflows/mcp-workflow-builder/activities/tool-loader.ts","../system/workflows/mcp-workflow-planner/index.ts","../system/workflows/mcp-workflow-planner/prompts.ts","../system/workflows/mcp-workflow-planner/activities/analyze.ts","../system/workflows/mcp-workflow-planner/activities/index.ts","../system/workflows/mcp-workflow-planner/activities/persist.ts","../system/workflows/mcp-workflow-planner/activities/plan.ts","../system/workflows/shared/discovery.ts","../system/workflows/shared/index.ts","../system/workflows/shared/llm-caller.ts","../system/workflows/shared/principal-tools.ts","../system/workflows/shared/prompts.ts","../system/workflows/shared/strategy-advisors.ts","../system/workflows/shared/tool-executor.ts","../system/workflows/shared/tool-loader.ts","../system/workflows/shared/types.ts","../themes/midnight.ts","../types/agent.ts","../types/analytics.ts","../types/auth.ts","../types/capability.ts","../types/config.ts","../types/delegation.ts","../types/discovery.ts","../types/domain-manifest.ts","../types/envelope.ts","../types/escalation-strategy.ts","../types/escalation.ts","../types/events.ts","../types/export.ts","../types/express.d.ts","../types/facets.ts","../types/index.ts","../types/logger.ts","../types/machines-view.ts","../types/machines.ts","../types/maintenance.ts","../types/mcp.ts","../types/messaging.ts","../types/oauth-server.ts","../types/oauth.ts","../types/persona.ts","../types/scan-choice.ts","../types/sdk.ts","../types/startup.ts","../types/task.ts","../types/telemetry.ts","../types/tool-context.ts","../types/user.ts","../types/validation.ts","../types/workflow-icons.ts","../types/workflow-set.ts","../types/workflow.ts","../types/yaml-workflow.ts","../types/scan-code/constants.ts","../types/scan-code/index.ts","../types/scan-code/response.ts","../types/scan-code/rule.ts","../workers/index.ts"],"version":"5.9.3"}

package/build/types/oauth.d.ts

@@ -29,6 +29,8 @@ export interface LTOAuthStartConfig {
     defaultRoleType?: 'admin' | 'member';
     /** Base URL for computing redirect URIs (default: derived from request) */
     baseUrl?: string;
+    /** Email domains a self-provisioned sign-in may come from. Empty: any. Invited accounts are not subject to it. */
+    allowedDomains?: string[];
 }
 /**
  * User info returned from an OAuth provider's userinfo endpoint.

package/docs/machines.md

@@ -115,7 +115,7 @@ When a sender finishes a unit, the gateway records the release on the row and, i
 | `trace` | One entry per unit: `{ unitId, machineId, jobId, result, materials: [{ material, lot }] }` |
 | `lots` | Every lot those units consumed, once each |
 
-Both are containment-searchable, so the rows that used a lot, and with them the units, are one query: `GET /escalations?facets={"lots":["LOT-7"]}`. A unit's whole path is every handoff row whose `units` holds it. The sender's full finished record stays on the row as its `released:<unit>` item. A codec maps its own lot fields into `materials`.
+Both are containment-searchable, so the rows that used a lot, and with them the units, are one query: `GET /escalations?facets={"lots":["LOT-7"]}`. A unit's whole path is every handoff row whose `units` holds it. The sender's full finished record stays on the row as its `released:<unit>` item. When that record is not ok, the row is first claimed for the machine that resolves it, so the record and the `sender-rejected` resolution land on a row no receiver can end in between. A codec maps its own lot fields into `materials`.
 
 ### Job lifecycle on the row
 

package/docs/oauth-and-delegation.md

@@ -80,6 +80,7 @@ await start({
       encryptionKey: process.env.OAUTH_ENCRYPTION_KEY,
       autoProvision: true,      // create user on first OAuth login
       defaultRoleType: 'member', // role for auto-provisioned users
+      allowedDomains: ['example.com'], // email domains that may self-provision
       providers: [
         {
           provider: 'google',
@@ -100,7 +101,7 @@ await start({
 3. Backend generates CSRF state + PKCE code verifier, redirects to Google's consent screen.
 4. Google redirects back to `GET /api/auth/oauth/google/callback` with an authorization code.
 5. Backend exchanges the code for tokens, fetches user info (email, name).
-6. If the user exists (matched by email or OAuth provider ID), they're logged in. If not and `autoProvision` is true, a new user is created.
+6. If the user exists (matched by email or OAuth provider ID), they're logged in. If not and `autoProvision` is true and the email's domain is in `allowedDomains` (or no list is set), a new user is created. Accounts an administrator created by email sign in whatever their domain.
 7. OAuth tokens are encrypted (AES-256-GCM) and stored in `lt_oauth_tokens`.
 8. A JWT is issued and the browser redirects to `/?token=<jwt>`.
 9. The dashboard's `useOAuthCallback` hook picks up the token and completes login.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hotmeshio/long-tail",
-  "version": "0.28.3",
+  "version": "0.29.0",
   "description": "Long Tail Workflows — Durable AI workflows with human-in-the-loop escalation. Powered by PostgreSQL.",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",