@hotmeshio/long-tail 0.30.3 → 0.30.4

package/build/api/scan-codes/verbs-subject.d.ts

@@ -9,7 +9,9 @@ export declare function bags(ctx: StepContext, container?: LTEscalationRecord, i
 export declare function claimGuard(step: ScanStep, ctx: StepContext, subject: HeldSubject): Promise<ScanResult | null>;
 /**
  * The pre-write guard. Returns the refusal when the pairing is wrong, null
- * when it holds (or the step declares no match).
+ * when it holds (or the step declares no match). `match.facets` compares the
+ * held subject with the row the scan located: the item's own row when there
+ * is one, else the container.
  */
 export declare function matchGuard(step: ScanStep, ctx: StepContext, container?: LTEscalationRecord, item?: LTEscalationRecord): ScanResult | null;
 /**

package/build/api/scan-codes/verbs-subject.js

@@ -117,7 +117,9 @@ function expandTarget(template, tpl) {
 }
 /**
  * The pre-write guard. Returns the refusal when the pairing is wrong, null
- * when it holds (or the step declares no match).
+ * when it holds (or the step declares no match). `match.facets` compares the
+ * held subject with the row the scan located: the item's own row when there
+ * is one, else the container.
  */
 function matchGuard(step, ctx, container, item) {
     const match = step.match;
@@ -127,9 +129,10 @@ function matchGuard(step, ctx, container, item) {
     const expected = (match.target ?? []).flatMap((t) => expandTarget(t, tpl));
     const targetOk = match.target === undefined || expected.includes(ctx.parsed.target);
     const subjectMeta = (ctx.subject?.row.metadata ?? {});
-    const containerMeta = (container?.metadata ?? {});
-    // With no container located there is nothing to compare; the step falls through.
-    const facetsOk = match.facets === undefined || !container || (match.facets.every((f) => subjectMeta[f] !== undefined && subjectMeta[f] !== null && String(subjectMeta[f]) === String(containerMeta[f])));
+    const paired = item ?? container;
+    const pairedMeta = (paired?.metadata ?? {});
+    // With no row located there is nothing to compare; the step falls through.
+    const facetsOk = match.facets === undefined || !paired || (match.facets.every((f) => subjectMeta[f] !== undefined && subjectMeta[f] !== null && String(subjectMeta[f]) === String(pairedMeta[f])));
     if (targetOk && facetsOk)
         return null;
     const markdown = scanCodeService.renderScanCopy(step.refuse?.markdown ?? STOCK_REFUSAL, tpl);

package/build/system/mcp-servers/human-queue-lookups.d.ts

@@ -0,0 +1,7 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+/**
+ * get_escalation_lookups: the editions pinned on a row, for anyone who may read
+ * the row. Runs the same read check as GET /api/escalations/:id/lookups, as the
+ * /mcp caller, else lt-system for an internal call.
+ */
+export declare function registerEscalationLookupsTool(server: McpServer): void;

package/build/system/mcp-servers/human-queue-lookups.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerEscalationLookupsTool = registerEscalationLookupsTool;
+const lookups_1 = require("../../api/escalations/lookups");
+const caller_auth_1 = require("./caller-auth");
+const human_queue_schemas_1 = require("./human-queue-schemas");
+/**
+ * get_escalation_lookups: the editions pinned on a row, for anyone who may read
+ * the row. Runs the same read check as GET /api/escalations/:id/lookups, as the
+ * /mcp caller, else lt-system for an internal call.
+ */
+function registerEscalationLookupsTool(server) {
+    server.registerTool('get_escalation_lookups', {
+        title: 'Get Escalation Lookups',
+        description: 'Resolve the versioned knowledge lookups pinned on an escalation (envelope.lookups), ' +
+            'for a caller who may read the escalation. Each ref answers with its edition; a ref ' +
+            'whose snapshot does not exist answers with missing: true.',
+        inputSchema: human_queue_schemas_1.getEscalationLookupsSchema,
+    }, async (args, extra) => {
+        const result = await (0, lookups_1.getEscalationLookups)({ id: args.escalation_id }, await (0, caller_auth_1.callerAuth)(extra));
+        if (result.error) {
+            return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
+        }
+        return {
+            content: [{
+                    type: 'text',
+                    text: JSON.stringify({ escalation_id: args.escalation_id, ...result.data }),
+                }],
+        };
+    });
+}

package/build/system/mcp-servers/human-queue-schemas.d.ts

@@ -31,6 +31,13 @@ export declare const checkResolutionSchema: z.ZodObject<{
 }, {
     escalation_id: string;
 }>;
+export declare const getEscalationLookupsSchema: z.ZodObject<{
+    escalation_id: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    escalation_id: string;
+}, {
+    escalation_id: string;
+}>;
 export declare const getAvailableWorkSchema: z.ZodObject<{
     role: z.ZodString;
     limit: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;

package/build/system/mcp-servers/human-queue-schemas.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.escalateAndWaitSchema = exports.removeItemSchema = exports.accumulateItemSchema = exports.resolveBatchItemSchema = exports.resolveEscalationSchema = exports.claimAndResolveSchema = exports.getAvailableWorkSchema = exports.checkResolutionSchema = exports.escalateSchema = void 0;
+exports.escalateAndWaitSchema = exports.removeItemSchema = exports.accumulateItemSchema = exports.resolveBatchItemSchema = exports.resolveEscalationSchema = exports.claimAndResolveSchema = exports.getAvailableWorkSchema = exports.getEscalationLookupsSchema = exports.checkResolutionSchema = exports.escalateSchema = void 0;
 const zod_1 = require("zod");
 // ── Schemas (extracted to break TS2589 deep-instantiation in registerTool generics) ──
 exports.escalateSchema = zod_1.z.object({
@@ -17,6 +17,9 @@ exports.escalateSchema = zod_1.z.object({
 exports.checkResolutionSchema = zod_1.z.object({
     escalation_id: zod_1.z.string().describe('The escalation ID to check'),
 });
+exports.getEscalationLookupsSchema = zod_1.z.object({
+    escalation_id: zod_1.z.string().describe('The escalation whose pinned knowledge lookups to resolve'),
+});
 exports.getAvailableWorkSchema = zod_1.z.object({
     role: zod_1.z.string().describe('Role to filter by'),
     limit: zod_1.z.number().optional().default(10).describe('Max results to return'),

package/build/system/mcp-servers/human-queue.d.ts

@@ -5,6 +5,7 @@ import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
  * Registers the tools that expose the escalation API:
  * - escalate_to_human — create a new escalation (fire-and-forget)
  * - check_resolution — check escalation status
+ * - get_escalation_lookups — read the knowledge editions pinned on an escalation the caller may read
  * - get_available_work — list available escalations by role
  * - claim_and_resolve — claim + resolve in one step
  * - resolve_escalation — resolve an already-claimed escalation

package/build/system/mcp-servers/human-queue.js

@@ -41,6 +41,7 @@ const mcp_js_1 = require("@modelcontextprotocol/sdk/server/mcp.js");
 const logger_1 = require("../../lib/logger");
 const caller_auth_1 = require("./caller-auth");
 const registered_tools_1 = require("../../services/mcp/registered-tools");
+const human_queue_lookups_1 = require("./human-queue-lookups");
 const escalationService = __importStar(require("../../services/escalation"));
 const resolver_validation_1 = require("../../services/escalation/resolver-validation");
 const enforcement_cache_1 = require("../../services/role/enforcement-cache");
@@ -78,6 +79,7 @@ async function checkResolveToolPayload(escalationId, payload) {
  * Registers the tools that expose the escalation API:
  * - escalate_to_human — create a new escalation (fire-and-forget)
  * - check_resolution — check escalation status
+ * - get_escalation_lookups — read the knowledge editions pinned on an escalation the caller may read
  * - get_available_work — list available escalations by role
  * - claim_and_resolve — claim + resolve in one step
  * - resolve_escalation — resolve an already-claimed escalation
@@ -172,6 +174,7 @@ async function createHumanQueueServer(options) {
             content: [{ type: 'text', text: JSON.stringify(result) }],
         };
     });
+    (0, human_queue_lookups_1.registerEscalationLookupsTool)(server);
     // ── get_available_work ──────────────────────────────────────────────
     server.registerTool('get_available_work', {
         title: 'Get Available Work',

package/build/system/seed/tool-manifests-escalation.js

@@ -36,8 +36,8 @@ exports.HUMAN_QUEUE_TOOLS = [
     },
     {
         name: 'get_escalation_lookups',
-        gate: 'superadmin',
-        description: 'Resolve the versioned knowledge lookups pinned on an escalation (envelope.lookups). Each ref answers with its immutable edition; a ref whose snapshot does not exist answers with missing: true.',
+        gate: 'caller',
+        description: 'Resolve the versioned knowledge lookups pinned on an escalation (envelope.lookups), for a caller who may read the escalation. Each ref answers with its edition; a ref whose snapshot does not exist answers with missing: true.',
         read_safe: true,
         inputSchema: {
             type: 'object',

package/build/tsconfig.tsbuildinfo

@@ -1 +1 @@
-{"root":["../index.ts","../vitest.config.ts","../vitest.fast.config.ts","../vitest.integration.config.ts","../vitest.llm.config.ts","../adapters/express.ts","../api/agent-subscriptions.ts","../api/agents.ts","../api/announcements.ts","../api/auth-sso.ts","../api/auth.ts","../api/bot-accounts.ts","../api/capabilities.ts","../api/controlplane.ts","../api/dba.ts","../api/diagnostics.ts","../api/domain.ts","../api/exports.ts","../api/files.ts","../api/index.ts","../api/insight.ts","../api/knowledge.ts","../api/maintenance.ts","../api/me.ts","../api/namespaces.ts","../api/overview.ts","../api/personas.ts","../api/pipelines.ts","../api/roles.ts","../api/settings.ts","../api/tasks.ts","../api/topics.ts","../api/users.ts","../api/workflow-sets.ts","../api/escalations/accumulate.ts","../api/escalations/analytics.ts","../api/escalations/batch-flag.ts","../api/escalations/bulk.ts","../api/escalations/cancel.ts","../api/escalations/claim.ts","../api/escalations/create.ts","../api/escalations/facets.ts","../api/escalations/helpers.ts","../api/escalations/index.ts","../api/escalations/list.ts","../api/escalations/lookups.ts","../api/escalations/metadata.ts","../api/escalations/related.ts","../api/escalations/resolve-batch.ts","../api/escalations/resolve.ts","../api/escalations/roster-action.ts","../api/escalations/single.ts","../api/mcp/index.ts","../api/mcp/servers.ts","../api/mcp/tools.ts","../api/scan-codes/badge-policy.ts","../api/scan-codes/choice-roles.ts","../api/scan-codes/choice.ts","../api/scan-codes/config.ts","../api/scan-codes/context.ts","../api/scan-codes/execute.ts","../api/scan-codes/fill-labels.ts","../api/scan-codes/grant.ts","../api/scan-codes/hold.ts","../api/scan-codes/identity.ts","../api/scan-codes/index.ts","../api/scan-codes/locate.ts","../api/scan-codes/present.ts","../api/scan-codes/subject.ts","../api/scan-codes/verb-accumulate.ts","../api/scan-codes/verb-fill.ts","../api/scan-codes/verb-into-subject.ts","../api/scan-codes/verbs-subject.ts","../api/scan-codes/verbs.ts","../api/workflows/config.ts","../api/workflows/discovery.ts","../api/workflows/index.ts","../api/workflows/input-lookups.ts","../api/workflows/input-validation.ts","../api/workflows/invocable.ts","../api/workflows/invocation.ts","../api/yaml-workflows/cron.ts","../api/yaml-workflows/crud.ts","../api/yaml-workflows/deploy.ts","../api/yaml-workflows/helpers.ts","../api/yaml-workflows/index.ts","../api/yaml-workflows/versions.ts","../bin/ltc.ts","../lib/facet-value.ts","../lib/typed-resolution.ts","../lib/uuid.ts","../lib/cli/auth.ts","../lib/cli/client.ts","../lib/cli/compile.ts","../lib/cli/format.ts","../lib/cli/init.ts","../lib/cli/output.ts","../lib/cli/scanner.ts","../lib/cli/types.ts","../lib/cli/commands/escalations.ts","../lib/cli/commands/knowledge.ts","../lib/cli/commands/mcp.ts","../lib/cli/commands/personas.ts","../lib/cli/commands/pipelines.ts","../lib/cli/commands/roles.ts","../lib/cli/commands/status.ts","../lib/cli/commands/streams.ts","../lib/cli/commands/users.ts","../lib/cli/commands/workflows.ts","../lib/db/config-lock.ts","../lib/db/index.ts","../lib/db/migrate.ts","../lib/events/browser-view.ts","../lib/events/callback.ts","../lib/events/escalation-wire.ts","../lib/events/index.ts","../lib/events/matching.ts","../lib/events/memory.ts","../lib/events/nats-ws-filter.ts","../lib/events/nats-ws-proxy.ts","../lib/events/nats-ws-server-filter.ts","../lib/events/nats-ws-ticket.ts","../lib/events/nats.ts","../lib/events/publish.ts","../lib/events/socketio.ts","../lib/events/system-events.ts","../lib/http/index.ts","../lib/json-path/pick.ts","../lib/logger/index.ts","../lib/logger/pino.ts","../lib/machines/index.ts","../lib/machines/line.ts","../lib/machines/protocol/codec.ts","../lib/machines/protocol/constants.ts","../lib/machines/protocol/contract.ts","../lib/machines/protocol/envelope.ts","../lib/machines/protocol/index.ts","../lib/machines/protocol/topics.ts","../lib/machines/site/edge-account.ts","../lib/machines/site/mosquitto-conf.ts","../lib/machines/site/site-conf.ts","../lib/machines/transport/callback-feed.ts","../lib/machines/transport/delivery.ts","../lib/machines/transport/index.ts","../lib/machines/transport/memory-broker.ts","../lib/machines/transport/memory.ts","../lib/machines/transport/mqtt-bus.ts","../lib/machines/transport/mqtt-link.ts","../lib/machines/transport/mqtt-session.ts","../lib/machines/transport/nats-bus.ts","../lib/machines/transport/nats-feed.ts","../lib/machines/transport/pubsub-feed.ts","../lib/machines/transport/serial.ts","../lib/machines/transport/stream-bus.ts","../lib/machines/transport/streams.ts","../lib/messaging/config.ts","../lib/messaging/constants.ts","../lib/messaging/index.ts","../lib/messaging/memory.ts","../lib/messaging/subjects.ts","../lib/messaging/nats/permissions.ts","../lib/messaging/nats/provider.ts","../lib/messaging/nats/render-conf.ts","../lib/messaging/nats/streams.ts","../lib/storage/index.ts","../lib/storage/local.ts","../lib/storage/mime.ts","../lib/storage/s3.ts","../lib/storage/types.ts","../lib/telemetry/honeycomb.ts","../lib/telemetry/index.ts","../modules/auth.ts","../modules/branding.ts","../modules/capabilities.ts","../modules/config.ts","../modules/defaults.ts","../modules/display.ts","../modules/features.ts","../modules/ltconfig.ts","../modules/machines.ts","../modules/maintenance.ts","../modules/mcp-auth.ts","../modules/oauth-server.ts","../modules/search.ts","../modules/sso.ts","../modules/utils.ts","../modules/version.ts","../routes/agents.ts","../routes/announcements.ts","../routes/auth-sso.ts","../routes/auth.ts","../routes/bot-accounts.ts","../routes/capabilities.ts","../routes/controlplane.ts","../routes/dba.ts","../routes/delegation.ts","../routes/diagnostics.ts","../routes/docs.ts","../routes/domain.ts","../routes/exports.ts","../routes/file-browser.ts","../routes/files.ts","../routes/index.ts","../routes/insight.ts","../routes/knowledge.ts","../routes/machines.ts","../routes/maintenance.ts","../routes/mcp-endpoint.ts","../routes/mcp.ts","../routes/me.ts","../routes/namespaces.ts","../routes/nats-credentials.ts","../routes/oauth-well-known.ts","../routes/oauth.ts","../routes/overview.ts","../routes/personas.ts","../routes/pipelines.ts","../routes/roles.ts","../routes/scan-codes.ts","../routes/settings.ts","../routes/tasks.ts","../routes/topics.ts","../routes/users.ts","../routes/workflow-sets.ts","../routes/escalations/accumulate.ts","../routes/escalations/acting.ts","../routes/escalations/analytics.ts","../routes/escalations/bulk.ts","../routes/escalations/facets.ts","../routes/escalations/index.ts","../routes/escalations/list.ts","../routes/escalations/metadata.ts","../routes/escalations/related.ts","../routes/escalations/resolve.ts","../routes/escalations/single.ts","../routes/oauth-server/authorize.ts","../routes/oauth-server/grants.ts","../routes/oauth-server/index.ts","../routes/oauth-server/registration.ts","../routes/oauth-server/token.ts","../routes/workflows/config.ts","../routes/workflows/discovery.ts","../routes/workflows/index.ts","../routes/workflows/invocation.ts","../routes/yaml-workflows/cron.ts","../routes/yaml-workflows/crud.ts","../routes/yaml-workflows/deployment.ts","../routes/yaml-workflows/index.ts","../routes/yaml-workflows/versions.ts","../scripts/bambu-boat.ts","../scripts/bambu-print.ts","../scripts/consolidation-sim.ts","../scripts/machine-line.ts","../scripts/ortho-populate.ts","../scripts/printer-cycle.ts","../scripts/process-helpers.ts","../scripts/process.ts","../scripts/token.ts","../scripts/twin-farm.ts","../sdk/index.ts","../services/dba.ts","../services/hotmesh-utils.ts","../services/invocation-access.ts","../services/workflow-invocation.ts","../services/workflow-state.ts","../services/agent/authority.ts","../services/agent/index.ts","../services/agent/input-mapper.ts","../services/agent/sql.ts","../services/agent/subscription-sql.ts","../services/agent/subscriptions.ts","../services/agent/trigger-registry.ts","../services/announcement/index.ts","../services/announcement/sql.ts","../services/auth/bot-api-key.ts","../services/auth/delegation.ts","../services/auth/index.ts","../services/auth/service-token.ts","../services/auth/sql.ts","../services/auth/oauth-server/access-token.ts","../services/auth/oauth-server/authorization.ts","../services/auth/oauth-server/constants.ts","../services/auth/oauth-server/index.ts","../services/auth/oauth-server/metadata.ts","../services/auth/oauth-server/registration.ts","../services/auth/oauth-server/sql.ts","../services/auth/oauth-server/store.ts","../services/config/cache.ts","../services/config/index.ts","../services/config/provider.ts","../services/config/read.ts","../services/config/sql.ts","../services/config/write.ts","../services/controlplane/index.ts","../services/controlplane/quorum-bridge.ts","../services/controlplane/sql.ts","../services/controlplane/stream-messages-sql.ts","../services/controlplane/types.ts","../services/cron/index.ts","../services/diagnostics/index.ts","../services/diagnostics/patterns.ts","../services/domain/index.ts","../services/domain/read.ts","../services/domain/seed.ts","../services/domain/sql.ts","../services/domain/validate.ts","../services/domain/write.ts","../services/escalation/accumulate.ts","../services/escalation/aggregate-sql.ts","../services/escalation/aggregate-validate.ts","../services/escalation/aggregates.ts","../services/escalation/batch-flag.ts","../services/escalation/batch.ts","../services/escalation/bulk.ts","../services/escalation/claim-asserted.ts","../services/escalation/client.ts","../services/escalation/crud.ts","../services/escalation/facet-sql.ts","../services/escalation/facets.ts","../services/escalation/grouped-list.ts","../services/escalation/index.ts","../services/escalation/map.ts","../services/escalation/metrics-cache.ts","../services/escalation/queries.ts","../services/escalation/read-scope-sql.ts","../services/escalation/related-extremes.ts","../services/escalation/related.ts","../services/escalation/resolver-validation.ts","../services/escalation/roster.ts","../services/escalation/sql.ts","../services/escalation/submit-guard.ts","../services/escalation/types.ts","../services/escalation-strategy/default.ts","../services/escalation-strategy/index.ts","../services/escalation-strategy/mcp.ts","../services/export/client.ts","../services/export/index.ts","../services/export/post-process.ts","../services/export/types.ts","../services/iam/acting-identity.ts","../services/iam/activity.ts","../services/iam/bots.ts","../services/iam/context.ts","../services/iam/credentials.ts","../services/iam/envelope.ts","../services/iam/ephemeral.ts","../services/iam/index.ts","../services/iam/principal.ts","../services/iam/resolve.ts","../services/iam/sql.ts","../services/insight/index.ts","../services/insight/prompts.ts","../services/interceptor/activity-interceptor.ts","../services/interceptor/completion.ts","../services/interceptor/context.ts","../services/interceptor/escalation.ts","../services/interceptor/index.ts","../services/interceptor/lifecycle.ts","../services/interceptor/state.ts","../services/interceptor/types.ts","../services/interceptor/activities/config.ts","../services/interceptor/activities/escalation.ts","../services/interceptor/activities/index.ts","../services/interceptor/activities/task.ts","../services/interceptor/activities/workflow.ts","../services/knowledge/index.ts","../services/knowledge/lookup-cache.ts","../services/knowledge/lookup-refs.ts","../services/knowledge/sql.ts","../services/llm/detect.ts","../services/llm/index.ts","../services/llm/translate.ts","../services/llm/types.ts","../services/llm/providers/anthropic.ts","../services/llm/providers/openai.ts","../services/machines/commands.ts","../services/machines/config.ts","../services/machines/contracts.ts","../services/machines/forms.ts","../services/machines/identities.ts","../services/machines/index.ts","../services/machines/leadership.ts","../services/machines/line-index.ts","../services/machines/registry-sql.ts","../services/machines/registry-sync.ts","../services/machines/registry.ts","../services/machines/roles.ts","../services/machines/rows.ts","../services/machines/select.ts","../services/machines/surface.ts","../services/machines/gateway/actions.ts","../services/machines/gateway/address-book.ts","../services/machines/gateway/admission.ts","../services/machines/gateway/api-escalations.ts","../services/machines/gateway/dispatcher.ts","../services/machines/gateway/escalations.ts","../services/machines/gateway/executor.ts","../services/machines/gateway/gateway.ts","../services/machines/gateway/index.ts","../services/machines/gateway/inspect.ts","../services/machines/gateway/jobs.ts","../services/machines/gateway/lifecycle.ts","../services/machines/gateway/log.ts","../services/machines/gateway/lt-http.ts","../services/machines/gateway/pacing.ts","../services/machines/gateway/plan-escalation.ts","../services/machines/gateway/plan-machine.ts","../services/machines/gateway/plan-shared.ts","../services/machines/gateway/project.ts","../services/machines/gateway/provision.ts","../services/machines/gateway/receipts.ts","../services/machines/gateway/reconcile.ts","../services/machines/gateway/registration.ts","../services/machines/gateway/reply-waiter.ts","../services/machines/gateway/state.ts","../services/machines/gateway/trace.ts","../services/machines/gateway/wire-window.ts","../services/machines/gateway/wire.ts","../services/machines/testing/fake-long-tail.ts","../services/machines/testing/index.ts","../services/machines/testing/recording-log.ts","../services/machines/testing/wait.ts","../services/maintenance/index.ts","../services/mcp/adapter.ts","../services/mcp/db.ts","../services/mcp/exposure.ts","../services/mcp/external-server.ts","../services/mcp/index.ts","../services/mcp/register-tool.ts","../services/mcp/registered-tools.ts","../services/mcp/seed-service-account.ts","../services/mcp/server-lifecycle.ts","../services/mcp/server-tools.ts","../services/mcp/server.ts","../services/mcp/sql.ts","../services/mcp/types.ts","../services/mcp/workflow-compiler-server.ts","../services/mcp/workflow-server.ts","../services/mcp/client/connection-dispatch.ts","../services/mcp/client/connection-lifecycle.ts","../services/mcp/client/connection-test.ts","../services/mcp/client/connection.ts","../services/mcp/client/index.ts","../services/mcp/client/network-transport.ts","../services/mcp/client/tools.ts","../services/mcp/db-server/index.ts","../services/mcp/db-server/schemas.ts","../services/mcp/db-server/tools.ts","../services/mcp/playwright-server/index.ts","../services/mcp/playwright-server/lifecycle.ts","../services/mcp/playwright-server/schemas.ts","../services/mcp/playwright-server/tools.ts","../services/namespace/index.ts","../services/namespace/sql.ts","../services/namespace/types.ts","../services/oauth/crypto.ts","../services/oauth/db.ts","../services/oauth/index.ts","../services/oauth/provisioning.ts","../services/oauth/sql.ts","../services/oauth/state.ts","../services/oauth/providers/anthropic.ts","../services/oauth/providers/github.ts","../services/oauth/providers/google.ts","../services/oauth/providers/index.ts","../services/oauth/providers/microsoft.ts","../services/oauth/providers/mock.ts","../services/oauth/providers/registry.ts","../services/oauth/providers/types.ts","../services/orchestrator/condition.ts","../services/orchestrator/index.ts","../services/orchestrator/types.ts","../services/overview/index.ts","../services/overview/sql.ts","../services/persona/index.ts","../services/persona/sql.ts","../services/persona/types.ts","../services/pipelines/enrichment.ts","../services/pipelines/events.ts","../services/pipelines/execution-builder.ts","../services/pipelines/index.ts","../services/pipelines/queries.ts","../services/pipelines/sql.ts","../services/pipelines/types.ts","../services/role/badge-grant.ts","../services/role/enforcement-cache.ts","../services/role/index.ts","../services/role/scan-done.ts","../services/role/schema-validator.ts","../services/role/seed.ts","../services/role/sql.ts","../services/role/types.ts","../services/scan-code/index.ts","../services/scan-code/parse.ts","../services/scan-code/read.ts","../services/scan-code/sql.ts","../services/scan-code/validate-facts.ts","../services/scan-code/validate-query.ts","../services/scan-code/validate-scheme-pattern.ts","../services/scan-code/validate-subject.ts","../services/scan-code/validate.ts","../services/scan-code/write.ts","../services/task/crud.ts","../services/task/index.ts","../services/task/process.ts","../services/task/resolve.ts","../services/task/sql.ts","../services/task/types.ts","../services/topics/index.ts","../services/topics/sql.ts","../services/topics/system-topics.ts","../services/user/auth.ts","../services/user/crud.ts","../services/user/index.ts","../services/user/preferences.ts","../services/user/rbac.ts","../services/user/roles.ts","../services/user/scope.ts","../services/user/seed-admin.ts","../services/user/sql.ts","../services/user/sso-provision.ts","../services/user/types.ts","../services/workers/registry.ts","../services/workflow-sets/db.ts","../services/workflow-sets/index.ts","../services/workflow-sets/sql.ts","../services/yaml-workflow/builder-regenerate.ts","../services/yaml-workflow/db-utils.ts","../services/yaml-workflow/db-versions.ts","../services/yaml-workflow/db.ts","../services/yaml-workflow/deployer-helpers.ts","../services/yaml-workflow/deployer.ts","../services/yaml-workflow/generator.ts","../services/yaml-workflow/index.ts","../services/yaml-workflow/input-analyzer-helpers.ts","../services/yaml-workflow/input-analyzer.ts","../services/yaml-workflow/invoke.ts","../services/yaml-workflow/pipe-validator.ts","../services/yaml-workflow/sql.ts","../services/yaml-workflow/types.ts","../services/yaml-workflow/durable-compiler/index.ts","../services/yaml-workflow/durable-compiler/parser.ts","../services/yaml-workflow/durable-compiler/prompts.ts","../services/yaml-workflow/durable-compiler/types.ts","../services/yaml-workflow/pattern-detector/array-source.ts","../services/yaml-workflow/pattern-detector/collapse.ts","../services/yaml-workflow/pattern-detector/index.ts","../services/yaml-workflow/pattern-detector/run-detection.ts","../services/yaml-workflow/pattern-detector/types.ts","../services/yaml-workflow/pipeline/analyze.ts","../services/yaml-workflow/pipeline/extract-helpers.ts","../services/yaml-workflow/pipeline/extract.ts","../services/yaml-workflow/pipeline/index.ts","../services/yaml-workflow/pipeline/prompt-templates.ts","../services/yaml-workflow/pipeline/prompts.ts","../services/yaml-workflow/pipeline/validate.ts","../services/yaml-workflow/pipeline/build/dag-assembly.ts","../services/yaml-workflow/pipeline/build/dag.ts","../services/yaml-workflow/pipeline/build/index.ts","../services/yaml-workflow/pipeline/build/iteration.ts","../services/yaml-workflow/pipeline/build/metadata.ts","../services/yaml-workflow/pipeline/build/transform.ts","../services/yaml-workflow/pipeline/build/utils.ts","../services/yaml-workflow/pipeline/build/wiring.ts","../services/yaml-workflow/pipeline/compile/index.ts","../services/yaml-workflow/pipeline/compile/llm-call.ts","../services/yaml-workflow/pipeline/compile/parse-plan.ts","../services/yaml-workflow/pipeline/compile/summarize.ts","../services/yaml-workflow/workers/callbacks.ts","../services/yaml-workflow/workers/events.ts","../services/yaml-workflow/workers/index.ts","../services/yaml-workflow/workers/register.ts","../services/yaml-workflow/workers/scope.ts","../services/yaml-workflow/workers/step-tool.ts","../shared/workflow-state.ts","../shared/form-validation/ctx-path.ts","../shared/form-validation/derive-field-label.ts","../shared/form-validation/display-only-widgets.ts","../shared/form-validation/field-validator.ts","../shared/form-validation/index.ts","../shared/form-validation/invoke-context.ts","../shared/form-validation/validate-resolver-payload.ts","../shared/form-validation/x-lt-actions.ts","../shared/form-validation/x-lt-bind.ts","../shared/form-validation/x-lt-help.ts","../shared/form-validation/x-lt-invoke.ts","../shared/form-validation/x-lt-labels.ts","../shared/form-validation/x-lt-options.ts","../shared/form-validation/x-lt-query.ts","../shared/form-validation/x-lt-require-any.ts","../shared/form-validation/x-lt-require-sum.ts","../shared/form-validation/x-lt-roster.ts","../shared/form-validation/x-lt-scan.ts","../shared/form-validation/x-lt-show-if.ts","../shared/form-validation/x-lt-submit-guard.ts","../shared/form-validation/x-lt-submit-on-claim.ts","../shared/form-validation/x-lt-transition.ts","../shared/list-schema/aggregate.ts","../shared/list-schema/index.ts","../shared/list-schema/template.ts","../shared/list-schema/types.ts","../shared/list-schema/validate.ts","../shared/roles/segment.ts","../shared/scan-code/gtin.ts","../shared/scan-code/index.ts","../shared/scan-code/parse.ts","../shared/scan-code/target.ts","../start/adapters.ts","../start/apply-report.ts","../start/config.ts","../start/graph-workflows.ts","../start/index.ts","../start/server.ts","../start/socket-auth.ts","../start/workers.ts","../system/index.ts","../system/activities/claude-code.ts","../system/activities/file-storage.ts","../system/activities/http.ts","../system/activities/knowledge.ts","../system/activities/oauth.ts","../system/activities/schema-exchange.ts","../system/activities/sql.ts","../system/activities/triage/cache.ts","../system/activities/triage/context.ts","../system/activities/triage/discovery.ts","../system/activities/triage/index.ts","../system/activities/triage/llm.ts","../system/activities/triage/tools.ts","../system/mcp-servers/caller-auth.ts","../system/mcp-servers/claude-code.ts","../system/mcp-servers/docs.ts","../system/mcp-servers/events.ts","../system/mcp-servers/file-storage.ts","../system/mcp-servers/http-fetch.ts","../system/mcp-servers/human-queue-schemas.ts","../system/mcp-servers/human-queue.ts","../system/mcp-servers/knowledge.ts","../system/mcp-servers/machines-schemas.ts","../system/mcp-servers/machines.ts","../system/mcp-servers/oauth.ts","../system/mcp-servers/schema-exchange.ts","../system/mcp-servers/translation.ts","../system/mcp-servers/vision-prompts.ts","../system/mcp-servers/vision.ts","../system/mcp-servers/workflow-compiler.ts","../system/mcp-servers/workflow.ts","../system/mcp-servers/admin/agent-subscriptions.ts","../system/mcp-servers/admin/agents.ts","../system/mcp-servers/admin/announcements.ts","../system/mcp-servers/admin/bot-accounts.ts","../system/mcp-servers/admin/controlplane.ts","../system/mcp-servers/admin/diagnostics.ts","../system/mcp-servers/admin/domain-context.ts","../system/mcp-servers/admin/escalations.ts","../system/mcp-servers/admin/exports.ts","../system/mcp-servers/admin/index.ts","../system/mcp-servers/admin/maintenance.ts","../system/mcp-servers/admin/mcp-servers.ts","../system/mcp-servers/admin/overview.ts","../system/mcp-servers/admin/personas.ts","../system/mcp-servers/admin/pipelines.ts","../system/mcp-servers/admin/run-read.ts","../system/mcp-servers/admin/scan-codes.ts","../system/mcp-servers/admin/schemas.ts","../system/mcp-servers/admin/settings.ts","../system/mcp-servers/admin/tasks.ts","../system/mcp-servers/admin/topics.ts","../system/mcp-servers/admin/users.ts","../system/mcp-servers/admin/workflow-config.ts","../system/mcp-servers/admin/workflows.ts","../system/mcp-servers/admin/yaml-workflows.ts","../system/mcp-servers/db-query/index.ts","../system/mcp-servers/db-query/schemas.ts","../system/mcp-servers/db-query/tools.ts","../system/seed/index.ts","../system/seed/tool-manifests-admin.ts","../system/seed/tool-manifests-data.ts","../system/seed/tool-manifests-escalation.ts","../system/seed/tool-manifests-events.ts","../system/seed/tool-manifests-knowledge.ts","../system/seed/tool-manifests-machines.ts","../system/seed/tool-manifests-workflows.ts","../system/workflows/tool-result-guard.ts","../system/workflows/capability-invoke/activities.ts","../system/workflows/capability-invoke/index.ts","../system/workflows/mcp-deterministic/activities.ts","../system/workflows/mcp-deterministic/index.ts","../system/workflows/mcp-query/index.ts","../system/workflows/mcp-query/prompts.ts","../system/workflows/mcp-query/strategy-advisors.ts","../system/workflows/mcp-query/types.ts","../system/workflows/mcp-query/activities/caches.ts","../system/workflows/mcp-query/activities/discovery.ts","../system/workflows/mcp-query/activities/index.ts","../system/workflows/mcp-query/activities/llm.ts","../system/workflows/mcp-query/activities/tool-executor.ts","../system/workflows/mcp-query/activities/tool-loader.ts","../system/workflows/mcp-query-router/activities.ts","../system/workflows/mcp-query-router/index.ts","../system/workflows/mcp-query-router/prompts.ts","../system/workflows/mcp-triage/activities-proxy.ts","../system/workflows/mcp-triage/index.ts","../system/workflows/mcp-triage/prompts.ts","../system/workflows/mcp-triage/response-builders.ts","../system/workflows/mcp-triage/response.ts","../system/workflows/mcp-triage/types.ts","../system/workflows/mcp-triage-deterministic/activities.ts","../system/workflows/mcp-triage-deterministic/index.ts","../system/workflows/mcp-triage-router/activities.ts","../system/workflows/mcp-triage-router/index.ts","../system/workflows/mcp-workflow-builder/index.ts","../system/workflows/mcp-workflow-builder/prompts.ts","../system/workflows/mcp-workflow-builder/activities/caches.ts","../system/workflows/mcp-workflow-builder/activities/index.ts","../system/workflows/mcp-workflow-builder/activities/llm.ts","../system/workflows/mcp-workflow-builder/activities/tool-loader.ts","../system/workflows/mcp-workflow-planner/index.ts","../system/workflows/mcp-workflow-planner/prompts.ts","../system/workflows/mcp-workflow-planner/activities/analyze.ts","../system/workflows/mcp-workflow-planner/activities/index.ts","../system/workflows/mcp-workflow-planner/activities/persist.ts","../system/workflows/mcp-workflow-planner/activities/plan.ts","../system/workflows/shared/discovery.ts","../system/workflows/shared/index.ts","../system/workflows/shared/llm-caller.ts","../system/workflows/shared/principal-tools.ts","../system/workflows/shared/prompts.ts","../system/workflows/shared/strategy-advisors.ts","../system/workflows/shared/tool-executor.ts","../system/workflows/shared/tool-loader.ts","../system/workflows/shared/types.ts","../themes/midnight.ts","../types/agent.ts","../types/analytics.ts","../types/auth.ts","../types/capability.ts","../types/config.ts","../types/delegation.ts","../types/discovery.ts","../types/domain-manifest.ts","../types/envelope.ts","../types/escalation-strategy.ts","../types/escalation.ts","../types/events.ts","../types/export.ts","../types/express.d.ts","../types/facets.ts","../types/index.ts","../types/logger.ts","../types/machines-view.ts","../types/machines.ts","../types/maintenance.ts","../types/mcp.ts","../types/messaging.ts","../types/oauth-server.ts","../types/oauth.ts","../types/persona.ts","../types/scan-choice.ts","../types/sdk.ts","../types/startup.ts","../types/task.ts","../types/telemetry.ts","../types/tool-context.ts","../types/user.ts","../types/validation.ts","../types/workflow-icons.ts","../types/workflow-set.ts","../types/workflow.ts","../types/yaml-workflow.ts","../types/scan-code/constants.ts","../types/scan-code/index.ts","../types/scan-code/response.ts","../types/scan-code/rule.ts","../workers/index.ts"],"version":"5.9.3"}
+{"root":["../index.ts","../vitest.config.ts","../vitest.fast.config.ts","../vitest.integration.config.ts","../vitest.llm.config.ts","../adapters/express.ts","../api/agent-subscriptions.ts","../api/agents.ts","../api/announcements.ts","../api/auth-sso.ts","../api/auth.ts","../api/bot-accounts.ts","../api/capabilities.ts","../api/controlplane.ts","../api/dba.ts","../api/diagnostics.ts","../api/domain.ts","../api/exports.ts","../api/files.ts","../api/index.ts","../api/insight.ts","../api/knowledge.ts","../api/maintenance.ts","../api/me.ts","../api/namespaces.ts","../api/overview.ts","../api/personas.ts","../api/pipelines.ts","../api/roles.ts","../api/settings.ts","../api/tasks.ts","../api/topics.ts","../api/users.ts","../api/workflow-sets.ts","../api/escalations/accumulate.ts","../api/escalations/analytics.ts","../api/escalations/batch-flag.ts","../api/escalations/bulk.ts","../api/escalations/cancel.ts","../api/escalations/claim.ts","../api/escalations/create.ts","../api/escalations/facets.ts","../api/escalations/helpers.ts","../api/escalations/index.ts","../api/escalations/list.ts","../api/escalations/lookups.ts","../api/escalations/metadata.ts","../api/escalations/related.ts","../api/escalations/resolve-batch.ts","../api/escalations/resolve.ts","../api/escalations/roster-action.ts","../api/escalations/single.ts","../api/mcp/index.ts","../api/mcp/servers.ts","../api/mcp/tools.ts","../api/scan-codes/badge-policy.ts","../api/scan-codes/choice-roles.ts","../api/scan-codes/choice.ts","../api/scan-codes/config.ts","../api/scan-codes/context.ts","../api/scan-codes/execute.ts","../api/scan-codes/fill-labels.ts","../api/scan-codes/grant.ts","../api/scan-codes/hold.ts","../api/scan-codes/identity.ts","../api/scan-codes/index.ts","../api/scan-codes/locate.ts","../api/scan-codes/present.ts","../api/scan-codes/subject.ts","../api/scan-codes/verb-accumulate.ts","../api/scan-codes/verb-fill.ts","../api/scan-codes/verb-into-subject.ts","../api/scan-codes/verbs-subject.ts","../api/scan-codes/verbs.ts","../api/workflows/config.ts","../api/workflows/discovery.ts","../api/workflows/index.ts","../api/workflows/input-lookups.ts","../api/workflows/input-validation.ts","../api/workflows/invocable.ts","../api/workflows/invocation.ts","../api/yaml-workflows/cron.ts","../api/yaml-workflows/crud.ts","../api/yaml-workflows/deploy.ts","../api/yaml-workflows/helpers.ts","../api/yaml-workflows/index.ts","../api/yaml-workflows/versions.ts","../bin/ltc.ts","../lib/facet-value.ts","../lib/typed-resolution.ts","../lib/uuid.ts","../lib/cli/auth.ts","../lib/cli/client.ts","../lib/cli/compile.ts","../lib/cli/format.ts","../lib/cli/init.ts","../lib/cli/output.ts","../lib/cli/scanner.ts","../lib/cli/types.ts","../lib/cli/commands/escalations.ts","../lib/cli/commands/knowledge.ts","../lib/cli/commands/mcp.ts","../lib/cli/commands/personas.ts","../lib/cli/commands/pipelines.ts","../lib/cli/commands/roles.ts","../lib/cli/commands/status.ts","../lib/cli/commands/streams.ts","../lib/cli/commands/users.ts","../lib/cli/commands/workflows.ts","../lib/db/config-lock.ts","../lib/db/index.ts","../lib/db/migrate.ts","../lib/events/browser-view.ts","../lib/events/callback.ts","../lib/events/escalation-wire.ts","../lib/events/index.ts","../lib/events/matching.ts","../lib/events/memory.ts","../lib/events/nats-ws-filter.ts","../lib/events/nats-ws-proxy.ts","../lib/events/nats-ws-server-filter.ts","../lib/events/nats-ws-ticket.ts","../lib/events/nats.ts","../lib/events/publish.ts","../lib/events/socketio.ts","../lib/events/system-events.ts","../lib/http/index.ts","../lib/json-path/pick.ts","../lib/logger/index.ts","../lib/logger/pino.ts","../lib/machines/index.ts","../lib/machines/line.ts","../lib/machines/protocol/codec.ts","../lib/machines/protocol/constants.ts","../lib/machines/protocol/contract.ts","../lib/machines/protocol/envelope.ts","../lib/machines/protocol/index.ts","../lib/machines/protocol/topics.ts","../lib/machines/site/edge-account.ts","../lib/machines/site/mosquitto-conf.ts","../lib/machines/site/site-conf.ts","../lib/machines/transport/callback-feed.ts","../lib/machines/transport/delivery.ts","../lib/machines/transport/index.ts","../lib/machines/transport/memory-broker.ts","../lib/machines/transport/memory.ts","../lib/machines/transport/mqtt-bus.ts","../lib/machines/transport/mqtt-link.ts","../lib/machines/transport/mqtt-session.ts","../lib/machines/transport/nats-bus.ts","../lib/machines/transport/nats-feed.ts","../lib/machines/transport/pubsub-feed.ts","../lib/machines/transport/serial.ts","../lib/machines/transport/stream-bus.ts","../lib/machines/transport/streams.ts","../lib/messaging/config.ts","../lib/messaging/constants.ts","../lib/messaging/index.ts","../lib/messaging/memory.ts","../lib/messaging/subjects.ts","../lib/messaging/nats/permissions.ts","../lib/messaging/nats/provider.ts","../lib/messaging/nats/render-conf.ts","../lib/messaging/nats/streams.ts","../lib/storage/index.ts","../lib/storage/local.ts","../lib/storage/mime.ts","../lib/storage/s3.ts","../lib/storage/types.ts","../lib/telemetry/honeycomb.ts","../lib/telemetry/index.ts","../modules/auth.ts","../modules/branding.ts","../modules/capabilities.ts","../modules/config.ts","../modules/defaults.ts","../modules/display.ts","../modules/features.ts","../modules/ltconfig.ts","../modules/machines.ts","../modules/maintenance.ts","../modules/mcp-auth.ts","../modules/oauth-server.ts","../modules/search.ts","../modules/sso.ts","../modules/utils.ts","../modules/version.ts","../routes/agents.ts","../routes/announcements.ts","../routes/auth-sso.ts","../routes/auth.ts","../routes/bot-accounts.ts","../routes/capabilities.ts","../routes/controlplane.ts","../routes/dba.ts","../routes/delegation.ts","../routes/diagnostics.ts","../routes/docs.ts","../routes/domain.ts","../routes/exports.ts","../routes/file-browser.ts","../routes/files.ts","../routes/index.ts","../routes/insight.ts","../routes/knowledge.ts","../routes/machines.ts","../routes/maintenance.ts","../routes/mcp-endpoint.ts","../routes/mcp.ts","../routes/me.ts","../routes/namespaces.ts","../routes/nats-credentials.ts","../routes/oauth-well-known.ts","../routes/oauth.ts","../routes/overview.ts","../routes/personas.ts","../routes/pipelines.ts","../routes/roles.ts","../routes/scan-codes.ts","../routes/settings.ts","../routes/tasks.ts","../routes/topics.ts","../routes/users.ts","../routes/workflow-sets.ts","../routes/escalations/accumulate.ts","../routes/escalations/acting.ts","../routes/escalations/analytics.ts","../routes/escalations/bulk.ts","../routes/escalations/facets.ts","../routes/escalations/index.ts","../routes/escalations/list.ts","../routes/escalations/metadata.ts","../routes/escalations/related.ts","../routes/escalations/resolve.ts","../routes/escalations/single.ts","../routes/oauth-server/authorize.ts","../routes/oauth-server/grants.ts","../routes/oauth-server/index.ts","../routes/oauth-server/registration.ts","../routes/oauth-server/token.ts","../routes/workflows/config.ts","../routes/workflows/discovery.ts","../routes/workflows/index.ts","../routes/workflows/invocation.ts","../routes/yaml-workflows/cron.ts","../routes/yaml-workflows/crud.ts","../routes/yaml-workflows/deployment.ts","../routes/yaml-workflows/index.ts","../routes/yaml-workflows/versions.ts","../scripts/bambu-boat.ts","../scripts/bambu-print.ts","../scripts/consolidation-sim.ts","../scripts/machine-line.ts","../scripts/ortho-populate.ts","../scripts/printer-cycle.ts","../scripts/process-helpers.ts","../scripts/process.ts","../scripts/token.ts","../scripts/twin-farm.ts","../sdk/index.ts","../services/dba.ts","../services/hotmesh-utils.ts","../services/invocation-access.ts","../services/workflow-invocation.ts","../services/workflow-state.ts","../services/agent/authority.ts","../services/agent/index.ts","../services/agent/input-mapper.ts","../services/agent/sql.ts","../services/agent/subscription-sql.ts","../services/agent/subscriptions.ts","../services/agent/trigger-registry.ts","../services/announcement/index.ts","../services/announcement/sql.ts","../services/auth/bot-api-key.ts","../services/auth/delegation.ts","../services/auth/index.ts","../services/auth/service-token.ts","../services/auth/sql.ts","../services/auth/oauth-server/access-token.ts","../services/auth/oauth-server/authorization.ts","../services/auth/oauth-server/constants.ts","../services/auth/oauth-server/index.ts","../services/auth/oauth-server/metadata.ts","../services/auth/oauth-server/registration.ts","../services/auth/oauth-server/sql.ts","../services/auth/oauth-server/store.ts","../services/config/cache.ts","../services/config/index.ts","../services/config/provider.ts","../services/config/read.ts","../services/config/sql.ts","../services/config/write.ts","../services/controlplane/index.ts","../services/controlplane/quorum-bridge.ts","../services/controlplane/sql.ts","../services/controlplane/stream-messages-sql.ts","../services/controlplane/types.ts","../services/cron/index.ts","../services/diagnostics/index.ts","../services/diagnostics/patterns.ts","../services/domain/index.ts","../services/domain/read.ts","../services/domain/seed.ts","../services/domain/sql.ts","../services/domain/validate.ts","../services/domain/write.ts","../services/escalation/accumulate.ts","../services/escalation/aggregate-sql.ts","../services/escalation/aggregate-validate.ts","../services/escalation/aggregates.ts","../services/escalation/batch-flag.ts","../services/escalation/batch.ts","../services/escalation/bulk.ts","../services/escalation/claim-asserted.ts","../services/escalation/client.ts","../services/escalation/crud.ts","../services/escalation/facet-sql.ts","../services/escalation/facets.ts","../services/escalation/grouped-list.ts","../services/escalation/index.ts","../services/escalation/map.ts","../services/escalation/metrics-cache.ts","../services/escalation/queries.ts","../services/escalation/read-scope-sql.ts","../services/escalation/related-extremes.ts","../services/escalation/related.ts","../services/escalation/resolver-validation.ts","../services/escalation/roster.ts","../services/escalation/sql.ts","../services/escalation/submit-guard.ts","../services/escalation/types.ts","../services/escalation-strategy/default.ts","../services/escalation-strategy/index.ts","../services/escalation-strategy/mcp.ts","../services/export/client.ts","../services/export/index.ts","../services/export/post-process.ts","../services/export/types.ts","../services/iam/acting-identity.ts","../services/iam/activity.ts","../services/iam/bots.ts","../services/iam/context.ts","../services/iam/credentials.ts","../services/iam/envelope.ts","../services/iam/ephemeral.ts","../services/iam/index.ts","../services/iam/principal.ts","../services/iam/resolve.ts","../services/iam/sql.ts","../services/insight/index.ts","../services/insight/prompts.ts","../services/interceptor/activity-interceptor.ts","../services/interceptor/completion.ts","../services/interceptor/context.ts","../services/interceptor/escalation.ts","../services/interceptor/index.ts","../services/interceptor/lifecycle.ts","../services/interceptor/state.ts","../services/interceptor/types.ts","../services/interceptor/activities/config.ts","../services/interceptor/activities/escalation.ts","../services/interceptor/activities/index.ts","../services/interceptor/activities/task.ts","../services/interceptor/activities/workflow.ts","../services/knowledge/index.ts","../services/knowledge/lookup-cache.ts","../services/knowledge/lookup-refs.ts","../services/knowledge/sql.ts","../services/llm/detect.ts","../services/llm/index.ts","../services/llm/translate.ts","../services/llm/types.ts","../services/llm/providers/anthropic.ts","../services/llm/providers/openai.ts","../services/machines/commands.ts","../services/machines/config.ts","../services/machines/contracts.ts","../services/machines/forms.ts","../services/machines/identities.ts","../services/machines/index.ts","../services/machines/leadership.ts","../services/machines/line-index.ts","../services/machines/registry-sql.ts","../services/machines/registry-sync.ts","../services/machines/registry.ts","../services/machines/roles.ts","../services/machines/rows.ts","../services/machines/select.ts","../services/machines/surface.ts","../services/machines/gateway/actions.ts","../services/machines/gateway/address-book.ts","../services/machines/gateway/admission.ts","../services/machines/gateway/api-escalations.ts","../services/machines/gateway/dispatcher.ts","../services/machines/gateway/escalations.ts","../services/machines/gateway/executor.ts","../services/machines/gateway/gateway.ts","../services/machines/gateway/index.ts","../services/machines/gateway/inspect.ts","../services/machines/gateway/jobs.ts","../services/machines/gateway/lifecycle.ts","../services/machines/gateway/log.ts","../services/machines/gateway/lt-http.ts","../services/machines/gateway/pacing.ts","../services/machines/gateway/plan-escalation.ts","../services/machines/gateway/plan-machine.ts","../services/machines/gateway/plan-shared.ts","../services/machines/gateway/project.ts","../services/machines/gateway/provision.ts","../services/machines/gateway/receipts.ts","../services/machines/gateway/reconcile.ts","../services/machines/gateway/registration.ts","../services/machines/gateway/reply-waiter.ts","../services/machines/gateway/state.ts","../services/machines/gateway/trace.ts","../services/machines/gateway/wire-window.ts","../services/machines/gateway/wire.ts","../services/machines/testing/fake-long-tail.ts","../services/machines/testing/index.ts","../services/machines/testing/recording-log.ts","../services/machines/testing/wait.ts","../services/maintenance/index.ts","../services/mcp/adapter.ts","../services/mcp/db.ts","../services/mcp/exposure.ts","../services/mcp/external-server.ts","../services/mcp/index.ts","../services/mcp/register-tool.ts","../services/mcp/registered-tools.ts","../services/mcp/seed-service-account.ts","../services/mcp/server-lifecycle.ts","../services/mcp/server-tools.ts","../services/mcp/server.ts","../services/mcp/sql.ts","../services/mcp/types.ts","../services/mcp/workflow-compiler-server.ts","../services/mcp/workflow-server.ts","../services/mcp/client/connection-dispatch.ts","../services/mcp/client/connection-lifecycle.ts","../services/mcp/client/connection-test.ts","../services/mcp/client/connection.ts","../services/mcp/client/index.ts","../services/mcp/client/network-transport.ts","../services/mcp/client/tools.ts","../services/mcp/db-server/index.ts","../services/mcp/db-server/schemas.ts","../services/mcp/db-server/tools.ts","../services/mcp/playwright-server/index.ts","../services/mcp/playwright-server/lifecycle.ts","../services/mcp/playwright-server/schemas.ts","../services/mcp/playwright-server/tools.ts","../services/namespace/index.ts","../services/namespace/sql.ts","../services/namespace/types.ts","../services/oauth/crypto.ts","../services/oauth/db.ts","../services/oauth/index.ts","../services/oauth/provisioning.ts","../services/oauth/sql.ts","../services/oauth/state.ts","../services/oauth/providers/anthropic.ts","../services/oauth/providers/github.ts","../services/oauth/providers/google.ts","../services/oauth/providers/index.ts","../services/oauth/providers/microsoft.ts","../services/oauth/providers/mock.ts","../services/oauth/providers/registry.ts","../services/oauth/providers/types.ts","../services/orchestrator/condition.ts","../services/orchestrator/index.ts","../services/orchestrator/types.ts","../services/overview/index.ts","../services/overview/sql.ts","../services/persona/index.ts","../services/persona/sql.ts","../services/persona/types.ts","../services/pipelines/enrichment.ts","../services/pipelines/events.ts","../services/pipelines/execution-builder.ts","../services/pipelines/index.ts","../services/pipelines/queries.ts","../services/pipelines/sql.ts","../services/pipelines/types.ts","../services/role/badge-grant.ts","../services/role/enforcement-cache.ts","../services/role/index.ts","../services/role/scan-done.ts","../services/role/schema-validator.ts","../services/role/seed.ts","../services/role/sql.ts","../services/role/types.ts","../services/scan-code/index.ts","../services/scan-code/parse.ts","../services/scan-code/read.ts","../services/scan-code/sql.ts","../services/scan-code/validate-facts.ts","../services/scan-code/validate-query.ts","../services/scan-code/validate-scheme-pattern.ts","../services/scan-code/validate-subject.ts","../services/scan-code/validate.ts","../services/scan-code/write.ts","../services/task/crud.ts","../services/task/index.ts","../services/task/process.ts","../services/task/resolve.ts","../services/task/sql.ts","../services/task/types.ts","../services/topics/index.ts","../services/topics/sql.ts","../services/topics/system-topics.ts","../services/user/auth.ts","../services/user/crud.ts","../services/user/index.ts","../services/user/preferences.ts","../services/user/rbac.ts","../services/user/roles.ts","../services/user/scope.ts","../services/user/seed-admin.ts","../services/user/sql.ts","../services/user/sso-provision.ts","../services/user/types.ts","../services/workers/registry.ts","../services/workflow-sets/db.ts","../services/workflow-sets/index.ts","../services/workflow-sets/sql.ts","../services/yaml-workflow/builder-regenerate.ts","../services/yaml-workflow/db-utils.ts","../services/yaml-workflow/db-versions.ts","../services/yaml-workflow/db.ts","../services/yaml-workflow/deployer-helpers.ts","../services/yaml-workflow/deployer.ts","../services/yaml-workflow/generator.ts","../services/yaml-workflow/index.ts","../services/yaml-workflow/input-analyzer-helpers.ts","../services/yaml-workflow/input-analyzer.ts","../services/yaml-workflow/invoke.ts","../services/yaml-workflow/pipe-validator.ts","../services/yaml-workflow/sql.ts","../services/yaml-workflow/types.ts","../services/yaml-workflow/durable-compiler/index.ts","../services/yaml-workflow/durable-compiler/parser.ts","../services/yaml-workflow/durable-compiler/prompts.ts","../services/yaml-workflow/durable-compiler/types.ts","../services/yaml-workflow/pattern-detector/array-source.ts","../services/yaml-workflow/pattern-detector/collapse.ts","../services/yaml-workflow/pattern-detector/index.ts","../services/yaml-workflow/pattern-detector/run-detection.ts","../services/yaml-workflow/pattern-detector/types.ts","../services/yaml-workflow/pipeline/analyze.ts","../services/yaml-workflow/pipeline/extract-helpers.ts","../services/yaml-workflow/pipeline/extract.ts","../services/yaml-workflow/pipeline/index.ts","../services/yaml-workflow/pipeline/prompt-templates.ts","../services/yaml-workflow/pipeline/prompts.ts","../services/yaml-workflow/pipeline/validate.ts","../services/yaml-workflow/pipeline/build/dag-assembly.ts","../services/yaml-workflow/pipeline/build/dag.ts","../services/yaml-workflow/pipeline/build/index.ts","../services/yaml-workflow/pipeline/build/iteration.ts","../services/yaml-workflow/pipeline/build/metadata.ts","../services/yaml-workflow/pipeline/build/transform.ts","../services/yaml-workflow/pipeline/build/utils.ts","../services/yaml-workflow/pipeline/build/wiring.ts","../services/yaml-workflow/pipeline/compile/index.ts","../services/yaml-workflow/pipeline/compile/llm-call.ts","../services/yaml-workflow/pipeline/compile/parse-plan.ts","../services/yaml-workflow/pipeline/compile/summarize.ts","../services/yaml-workflow/workers/callbacks.ts","../services/yaml-workflow/workers/events.ts","../services/yaml-workflow/workers/index.ts","../services/yaml-workflow/workers/register.ts","../services/yaml-workflow/workers/scope.ts","../services/yaml-workflow/workers/step-tool.ts","../shared/workflow-state.ts","../shared/form-validation/ctx-path.ts","../shared/form-validation/derive-field-label.ts","../shared/form-validation/display-only-widgets.ts","../shared/form-validation/field-validator.ts","../shared/form-validation/index.ts","../shared/form-validation/invoke-context.ts","../shared/form-validation/validate-resolver-payload.ts","../shared/form-validation/x-lt-actions.ts","../shared/form-validation/x-lt-bind.ts","../shared/form-validation/x-lt-help.ts","../shared/form-validation/x-lt-invoke.ts","../shared/form-validation/x-lt-labels.ts","../shared/form-validation/x-lt-options.ts","../shared/form-validation/x-lt-query.ts","../shared/form-validation/x-lt-require-any.ts","../shared/form-validation/x-lt-require-sum.ts","../shared/form-validation/x-lt-roster.ts","../shared/form-validation/x-lt-scan.ts","../shared/form-validation/x-lt-show-if.ts","../shared/form-validation/x-lt-submit-guard.ts","../shared/form-validation/x-lt-submit-on-claim.ts","../shared/form-validation/x-lt-transition.ts","../shared/list-schema/aggregate.ts","../shared/list-schema/index.ts","../shared/list-schema/template.ts","../shared/list-schema/types.ts","../shared/list-schema/validate.ts","../shared/roles/segment.ts","../shared/scan-code/gtin.ts","../shared/scan-code/index.ts","../shared/scan-code/parse.ts","../shared/scan-code/target.ts","../start/adapters.ts","../start/apply-report.ts","../start/config.ts","../start/graph-workflows.ts","../start/index.ts","../start/server.ts","../start/socket-auth.ts","../start/workers.ts","../system/index.ts","../system/activities/claude-code.ts","../system/activities/file-storage.ts","../system/activities/http.ts","../system/activities/knowledge.ts","../system/activities/oauth.ts","../system/activities/schema-exchange.ts","../system/activities/sql.ts","../system/activities/triage/cache.ts","../system/activities/triage/context.ts","../system/activities/triage/discovery.ts","../system/activities/triage/index.ts","../system/activities/triage/llm.ts","../system/activities/triage/tools.ts","../system/mcp-servers/caller-auth.ts","../system/mcp-servers/claude-code.ts","../system/mcp-servers/docs.ts","../system/mcp-servers/events.ts","../system/mcp-servers/file-storage.ts","../system/mcp-servers/http-fetch.ts","../system/mcp-servers/human-queue-lookups.ts","../system/mcp-servers/human-queue-schemas.ts","../system/mcp-servers/human-queue.ts","../system/mcp-servers/knowledge.ts","../system/mcp-servers/machines-schemas.ts","../system/mcp-servers/machines.ts","../system/mcp-servers/oauth.ts","../system/mcp-servers/schema-exchange.ts","../system/mcp-servers/translation.ts","../system/mcp-servers/vision-prompts.ts","../system/mcp-servers/vision.ts","../system/mcp-servers/workflow-compiler.ts","../system/mcp-servers/workflow.ts","../system/mcp-servers/admin/agent-subscriptions.ts","../system/mcp-servers/admin/agents.ts","../system/mcp-servers/admin/announcements.ts","../system/mcp-servers/admin/bot-accounts.ts","../system/mcp-servers/admin/controlplane.ts","../system/mcp-servers/admin/diagnostics.ts","../system/mcp-servers/admin/domain-context.ts","../system/mcp-servers/admin/escalations.ts","../system/mcp-servers/admin/exports.ts","../system/mcp-servers/admin/index.ts","../system/mcp-servers/admin/maintenance.ts","../system/mcp-servers/admin/mcp-servers.ts","../system/mcp-servers/admin/overview.ts","../system/mcp-servers/admin/personas.ts","../system/mcp-servers/admin/pipelines.ts","../system/mcp-servers/admin/run-read.ts","../system/mcp-servers/admin/scan-codes.ts","../system/mcp-servers/admin/schemas.ts","../system/mcp-servers/admin/settings.ts","../system/mcp-servers/admin/tasks.ts","../system/mcp-servers/admin/topics.ts","../system/mcp-servers/admin/users.ts","../system/mcp-servers/admin/workflow-config.ts","../system/mcp-servers/admin/workflows.ts","../system/mcp-servers/admin/yaml-workflows.ts","../system/mcp-servers/db-query/index.ts","../system/mcp-servers/db-query/schemas.ts","../system/mcp-servers/db-query/tools.ts","../system/seed/index.ts","../system/seed/tool-manifests-admin.ts","../system/seed/tool-manifests-data.ts","../system/seed/tool-manifests-escalation.ts","../system/seed/tool-manifests-events.ts","../system/seed/tool-manifests-knowledge.ts","../system/seed/tool-manifests-machines.ts","../system/seed/tool-manifests-workflows.ts","../system/workflows/tool-result-guard.ts","../system/workflows/capability-invoke/activities.ts","../system/workflows/capability-invoke/index.ts","../system/workflows/mcp-deterministic/activities.ts","../system/workflows/mcp-deterministic/index.ts","../system/workflows/mcp-query/index.ts","../system/workflows/mcp-query/prompts.ts","../system/workflows/mcp-query/strategy-advisors.ts","../system/workflows/mcp-query/types.ts","../system/workflows/mcp-query/activities/caches.ts","../system/workflows/mcp-query/activities/discovery.ts","../system/workflows/mcp-query/activities/index.ts","../system/workflows/mcp-query/activities/llm.ts","../system/workflows/mcp-query/activities/tool-executor.ts","../system/workflows/mcp-query/activities/tool-loader.ts","../system/workflows/mcp-query-router/activities.ts","../system/workflows/mcp-query-router/index.ts","../system/workflows/mcp-query-router/prompts.ts","../system/workflows/mcp-triage/activities-proxy.ts","../system/workflows/mcp-triage/index.ts","../system/workflows/mcp-triage/prompts.ts","../system/workflows/mcp-triage/response-builders.ts","../system/workflows/mcp-triage/response.ts","../system/workflows/mcp-triage/types.ts","../system/workflows/mcp-triage-deterministic/activities.ts","../system/workflows/mcp-triage-deterministic/index.ts","../system/workflows/mcp-triage-router/activities.ts","../system/workflows/mcp-triage-router/index.ts","../system/workflows/mcp-workflow-builder/index.ts","../system/workflows/mcp-workflow-builder/prompts.ts","../system/workflows/mcp-workflow-builder/activities/caches.ts","../system/workflows/mcp-workflow-builder/activities/index.ts","../system/workflows/mcp-workflow-builder/activities/llm.ts","../system/workflows/mcp-workflow-builder/activities/tool-loader.ts","../system/workflows/mcp-workflow-planner/index.ts","../system/workflows/mcp-workflow-planner/prompts.ts","../system/workflows/mcp-workflow-planner/activities/analyze.ts","../system/workflows/mcp-workflow-planner/activities/index.ts","../system/workflows/mcp-workflow-planner/activities/persist.ts","../system/workflows/mcp-workflow-planner/activities/plan.ts","../system/workflows/shared/discovery.ts","../system/workflows/shared/index.ts","../system/workflows/shared/llm-caller.ts","../system/workflows/shared/principal-tools.ts","../system/workflows/shared/prompts.ts","../system/workflows/shared/strategy-advisors.ts","../system/workflows/shared/tool-executor.ts","../system/workflows/shared/tool-loader.ts","../system/workflows/shared/types.ts","../themes/midnight.ts","../types/agent.ts","../types/analytics.ts","../types/auth.ts","../types/capability.ts","../types/config.ts","../types/delegation.ts","../types/discovery.ts","../types/domain-manifest.ts","../types/envelope.ts","../types/escalation-strategy.ts","../types/escalation.ts","../types/events.ts","../types/export.ts","../types/express.d.ts","../types/facets.ts","../types/index.ts","../types/logger.ts","../types/machines-view.ts","../types/machines.ts","../types/maintenance.ts","../types/mcp.ts","../types/messaging.ts","../types/oauth-server.ts","../types/oauth.ts","../types/persona.ts","../types/scan-choice.ts","../types/sdk.ts","../types/startup.ts","../types/task.ts","../types/telemetry.ts","../types/tool-context.ts","../types/user.ts","../types/validation.ts","../types/workflow-icons.ts","../types/workflow-set.ts","../types/workflow.ts","../types/yaml-workflow.ts","../types/scan-code/constants.ts","../types/scan-code/index.ts","../types/scan-code/response.ts","../types/scan-code/rule.ts","../workers/index.ts"],"version":"5.9.3"}

package/build/types/scan-code/rule.d.ts

@@ -171,7 +171,7 @@ export interface ScanSubjectGate {
 export interface ScanMatch {
     /** The scanned target must equal one of these (templates). */
     target?: string[];
-    /** The located container must share each of these facets with the subject. */
+    /** The located row (the item's own row on an into-subject add, else the container) must share each of these facets with the subject. */
     facets?: string[];
 }
 /** What the station says when a step refuses. Markdown templates. */

package/docs/api/mcp/human-queue.md

@@ -13,6 +13,8 @@ Built-in escalation and human queue management. Exposes the escalation API as MC
 
 These tools act with full authority. At `/mcp` they are listed for superadmin accounts only. Other accounts work the queue through the role-checked escalation tools on [long-tail-admin](admin.md).
 
+`get_escalation_lookups` is listed for every account. It runs as the caller, with the read check `GET /api/escalations/:id/lookups` runs.
+
 ## Compile Hints
 
 escalate_and_wait creates a durable pause point. The step AFTER escalate_and_wait is always a signal step (kind: "signal") that receives the human response. Fields from the signal step output (e.g., password) must be wired via data_flow edges to ALL downstream steps that need them.
@@ -55,7 +57,9 @@ Check the status of an escalation. Returns status and resolver payload if resolv
 
 ### get_escalation_lookups
 
-Resolve the versioned knowledge lookups pinned on an escalation (`envelope.lookups`). Each ref answers with its immutable edition; a ref whose snapshot does not exist answers with `missing: true`. Like the other tools on this server, the call carries no per-user identity — the MCP surface reads at service scope.
+Resolve the versioned knowledge lookups pinned on an escalation (`envelope.lookups`). Each ref answers with its edition; a ref whose snapshot does not exist answers with `missing: true`. A closed row answers with the editions current when it closed.
+
+Any caller who may read the escalation may call it: a superadmin, a member of the row's role with read scope `all`, or a read scope `self` member while the row is assigned to them. Others get `Not authorized to view this escalation` and no edition content. The refs on the row are the grant, so a member reads the editions their row names without a knowledge grant. An internal call reads as lt-system.
 
 | | |
 |---|---|

package/docs/dashboard.md

@@ -507,7 +507,7 @@ Accessible at `/knowledge` (builder-only — superadmin or the `engineer` role).
 - **Version rail** — the entry detail's version dropdown lists every edition, newest first, the current one marked. Selecting a past edition sets `?version=<N>` and shows an immutable, read-only snapshot with a "back to current" affordance.
 - **Field-level edits** — set or remove a value at a dot-path (`jsonb_set` / path delete) without clobbering sibling keys; each still mints an edition when the data changes.
 
-**How workflows and forms consume it.** A workflow pins knowledge onto an escalation as versioned lookup refs on the reserved `envelope.lookups` key — `{ domain, key, version, as? }`. Because the ref names an exact edition, the resolver always sees the data the workflow was written against, even as the entry later evolves. Resolving those refs (`GET /api/escalations/:id/lookups`, in-process LRU cached) exposes a `lookup.<key>` domain to the form: a field's `x-lt-options` reads `lookup.materials.items`, and cascades interpolate the live form — `lookup.geo.regions.{{resolver.country}}` narrows the second select from the first. The reader needs no separate knowledge grant; the ref on an escalation they can read *is* the grant. Agents reach the same data through the `get_knowledge` MCP tool (with an optional `version`).
+**How workflows and forms consume it.** A workflow pins knowledge onto an escalation as versioned lookup refs on the reserved `envelope.lookups` key — `{ domain, key, version, as? }`. Because the ref names an exact edition, the resolver always sees the data the workflow was written against, even as the entry later evolves. Resolving those refs (`GET /api/escalations/:id/lookups`, in-process LRU cached) exposes a `lookup.<key>` domain to the form: a field's `x-lt-options` reads `lookup.materials.items`, and cascades interpolate the live form — `lookup.geo.regions.{{resolver.country}}` narrows the second select from the first. The reader needs no separate knowledge grant; the ref on an escalation they can read *is* the grant. Agents read a row's editions with the `get_escalation_lookups` MCP tool under the same grant; builders reach any entry through `get_knowledge` (with an optional `version`).
 
 **API:** `GET /api/knowledge/domains` and `/entries?domain=` list; `GET /api/knowledge/entry?domain=&key=&version=` fetches the live entry or a pinned edition; `GET /api/knowledge/entry/versions?domain=&key=` returns the lineage. `POST /api/knowledge/entry` creates or merges, `PUT /api/knowledge/field` sets a path, `DELETE /api/knowledge/field` removes one, `DELETE /api/knowledge/entry` deletes (cascading its editions). See [Knowledge HTTP API](api/http/knowledge.md).
 

package/docs/hitl/lookups.md

@@ -88,6 +88,8 @@ GET /api/escalations/:id/lookups
 
 `version` is the edition served; `current: true` marks a ref that follows the newest edition.
 
+An agent reads the same answer with the `get_escalation_lookups` MCP tool, as the account it signed in with and under the same read check.
+
 The general knowledge API (`/api/knowledge/*`) is a builder surface — superadmin or engineer. A member never queries the knowledge store directly; the escalation-scoped endpoint serves them precisely the editions their work item carries, and nothing else. A ref whose snapshot does not exist answers with `missing: true` for that ref — the batch never fails.
 
 ## Form Addressing

package/docs/mcp.md

@@ -371,6 +371,8 @@ The Human Queue is a built-in MCP server that exposes Long Tail's escalation API
 
 These tools act with full authority, so at `/mcp` they are listed for superadmin accounts. Workflows and agents inside Long Tail call them directly. An external agent with any other role works the queue through the role-checked escalation tools: `find_escalations`, `claim_escalation`, `admin_resolve_escalation`.
 
+`get_escalation_lookups` is listed for every account and runs as the caller: anyone who may read the escalation reads the knowledge editions it names, the same grant `GET /api/escalations/:id/lookups` serves.
+
 ### Tools
 
 | Tool | Purpose |

package/docs/scan-codes.md

@@ -427,8 +427,12 @@ its code; without `fill.labels`, both tokens read codes.
 
 **`match` and `refuse`** check the pairing before anything is written.
 `match.target` lists templates the scanned target must equal (e.g.
-`["{subject.containerCode}"]`); `match.facets` lists facets the located container
-must share with the held row (e.g. `["containerKey"]`). A miss answers `refused`
+`["{subject.containerCode}"]`); `match.facets` lists facets the located row must
+share with the held row (e.g. `["containerKey"]`). The located row is the
+container the scan named, or on an add into the held subject with
+`accumulate.item`, the item's own row: a held container refuses an item whose
+own row names another `route`. Each facet must be present on both rows, compared
+as strings. A miss answers `refused`
 with `refuse.markdown` rendered, and nothing is written. The copy may read
 `{container.<facet>}` (the container the scan named), `{fill.pending}`
 (what a fill still expects) and `{fill.next}` (the next open entry), so the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hotmeshio/long-tail",
-  "version": "0.30.3",
+  "version": "0.30.4",
   "description": "Long Tail Workflows — Durable AI workflows with human-in-the-loop escalation. Powered by PostgreSQL.",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",