@hotmeshio/long-tail 0.4.18 → 0.4.19

package/build/system/seed/tool-manifests-knowledge.d.ts

@@ -1,6 +1,7 @@
 export declare const KNOWLEDGE_TOOLS: ({
     name: string;
     description: string;
+    read_safe: boolean;
     inputSchema: {
         type: string;
         properties: {
@@ -37,6 +38,7 @@ export declare const KNOWLEDGE_TOOLS: ({
 } | {
     name: string;
     description: string;
+    read_safe: boolean;
     inputSchema: {
         type: string;
         properties: {
@@ -62,6 +64,7 @@ export declare const KNOWLEDGE_TOOLS: ({
 } | {
     name: string;
     description: string;
+    read_safe: boolean;
     inputSchema: {
         type: string;
         properties: {
@@ -96,6 +99,7 @@ export declare const KNOWLEDGE_TOOLS: ({
 } | {
     name: string;
     description: string;
+    read_safe: boolean;
     inputSchema: {
         type: string;
         properties: {
@@ -130,6 +134,7 @@ export declare const KNOWLEDGE_TOOLS: ({
 } | {
     name: string;
     description: string;
+    read_safe: boolean;
     inputSchema: {
         type: string;
         properties: {
@@ -149,6 +154,7 @@ export declare const KNOWLEDGE_TOOLS: ({
 } | {
     name: string;
     description: string;
+    read_safe: boolean;
     inputSchema: {
         type: string;
         properties: {

package/build/system/seed/tool-manifests-knowledge.js

@@ -6,6 +6,7 @@ exports.KNOWLEDGE_TOOLS = [
     {
         name: 'store_knowledge',
         description: 'Store a value in a 3-level additive hierarchy: domain > key > field. Upserts by domain+key — fields accumulate across calls. Same domain+key+field overwrites that field. When field is provided, data can be any type. When omitted, data must be an object.',
+        read_safe: false,
         inputSchema: {
             type: 'object',
             properties: {
@@ -21,6 +22,7 @@ exports.KNOWLEDGE_TOOLS = [
     {
         name: 'get_knowledge',
         description: 'Retrieve a single knowledge entry by domain and key.',
+        read_safe: true,
         inputSchema: {
             type: 'object',
             properties: {
@@ -33,6 +35,7 @@ exports.KNOWLEDGE_TOOLS = [
     {
         name: 'search_knowledge',
         description: 'Search knowledge entries using JSONB containment queries. The query object matches entries whose data contains the specified key-value pairs.',
+        read_safe: true,
         inputSchema: {
             type: 'object',
             properties: {
@@ -47,6 +50,7 @@ exports.KNOWLEDGE_TOOLS = [
     {
         name: 'list_knowledge',
         description: 'List knowledge entries in a domain, optionally filtered by tags. Returns most recently updated first.',
+        read_safe: true,
         inputSchema: {
             type: 'object',
             properties: {
@@ -61,6 +65,7 @@ exports.KNOWLEDGE_TOOLS = [
     {
         name: 'delete_knowledge',
         description: 'Delete a knowledge entry by domain and key.',
+        read_safe: false,
         inputSchema: {
             type: 'object',
             properties: {
@@ -73,6 +78,7 @@ exports.KNOWLEDGE_TOOLS = [
     {
         name: 'list_domains',
         description: 'List all knowledge domains with entry counts and last-updated timestamps.',
+        read_safe: true,
         inputSchema: {
             type: 'object',
             properties: {},
@@ -81,6 +87,7 @@ exports.KNOWLEDGE_TOOLS = [
     {
         name: 'append_knowledge',
         description: 'Append a value to an array field within a knowledge entry. Creates the entry and array if they do not exist.',
+        read_safe: false,
         inputSchema: {
             type: 'object',
             properties: {

package/build/system/seed/tool-manifests-workflows.d.ts

@@ -1,6 +1,7 @@
 export declare const MCP_WORKFLOW_TOOLS: ({
     name: string;
     description: string;
+    read_safe: boolean;
     inputSchema: {
         type: string;
         properties: {
@@ -18,6 +19,7 @@ export declare const MCP_WORKFLOW_TOOLS: ({
 } | {
     name: string;
     description: string;
+    read_safe: boolean;
     inputSchema: {
         type: string;
         properties: {
@@ -35,6 +37,7 @@ export declare const MCP_WORKFLOW_TOOLS: ({
 } | {
     name: string;
     description: string;
+    read_safe: boolean;
     inputSchema: {
         type: string;
         properties: {
@@ -62,6 +65,7 @@ export declare const MCP_WORKFLOW_TOOLS: ({
 export declare const WORKFLOW_COMPILER_TOOLS: ({
     name: string;
     description: string;
+    read_safe: boolean;
     inputSchema: {
         type: string;
         properties: {
@@ -96,6 +100,7 @@ export declare const WORKFLOW_COMPILER_TOOLS: ({
 } | {
     name: string;
     description: string;
+    read_safe: boolean;
     inputSchema: {
         type: string;
         properties: {
@@ -121,6 +126,7 @@ export declare const WORKFLOW_COMPILER_TOOLS: ({
 } | {
     name: string;
     description: string;
+    read_safe: boolean;
     inputSchema: {
         type: string;
         properties: {
@@ -150,6 +156,7 @@ export declare const WORKFLOW_COMPILER_TOOLS: ({
 export declare const CLAUDE_CODE_TOOLS: ({
     name: string;
     description: string;
+    read_safe: boolean;
     inputSchema: {
         type: string;
         properties: {
@@ -201,6 +208,7 @@ export declare const CLAUDE_CODE_TOOLS: ({
 } | {
     name: string;
     description: string;
+    read_safe: boolean;
     inputSchema: {
         type: string;
         properties: {

package/build/system/seed/tool-manifests-workflows.js

@@ -6,6 +6,7 @@ exports.MCP_WORKFLOW_TOOLS = [
     {
         name: 'list_workflows',
         description: 'List available compiled YAML workflows. These are deterministic pipelines converted from successful MCP triage executions. Each workflow represents a proven solution to a specific edge case. Defaults to listing active (invocable) workflows.',
+        read_safe: true,
         inputSchema: {
             type: 'object',
             properties: {
@@ -16,6 +17,7 @@ exports.MCP_WORKFLOW_TOOLS = [
     {
         name: 'get_workflow',
         description: 'Inspect a compiled workflow by name. Returns the activity manifest, input/output schemas, and provenance.',
+        read_safe: true,
         inputSchema: {
             type: 'object',
             properties: {
@@ -27,6 +29,7 @@ exports.MCP_WORKFLOW_TOOLS = [
     {
         name: 'invoke_workflow',
         description: 'Run a compiled YAML workflow by name. Deterministic — no LLM reasoning, just direct tool-to-tool data piping. Use list_workflows to discover available workflows and their input schemas. Set async=true for fire-and-forget.',
+        read_safe: false,
         inputSchema: {
             type: 'object',
             properties: {
@@ -43,6 +46,7 @@ exports.WORKFLOW_COMPILER_TOOLS = [
     {
         name: 'convert_execution_to_yaml',
         description: 'Analyze a completed workflow execution and convert its tool call sequence into a deterministic HotMesh YAML workflow. Extracts tool call pairs and replaces LLM reasoning with direct tool-to-tool data piping. The generated YAML is stored as a draft that can be deployed and activated.',
+        read_safe: false,
         inputSchema: {
             type: 'object',
             properties: {
@@ -58,6 +62,7 @@ exports.WORKFLOW_COMPILER_TOOLS = [
     {
         name: 'deploy_yaml_workflow',
         description: 'Deploy a stored YAML workflow to HotMesh. Optionally activate it immediately and register workers so it can receive invocations.',
+        read_safe: false,
         inputSchema: {
             type: 'object',
             properties: {
@@ -70,6 +75,7 @@ exports.WORKFLOW_COMPILER_TOOLS = [
     {
         name: 'list_yaml_workflows',
         description: 'List stored YAML workflows with optional status filter.',
+        read_safe: true,
         inputSchema: {
             type: 'object',
             properties: {
@@ -85,6 +91,7 @@ exports.CLAUDE_CODE_TOOLS = [
         name: 'execute_task',
         description: 'Run a task using Claude Code CLI. Claude Code is an agentic coding assistant with terminal access, ' +
             'file I/O, code search, and editing. Returns structured output with result text, cost, and duration.',
+        read_safe: false,
         inputSchema: {
             type: 'object',
             properties: {
@@ -135,6 +142,7 @@ exports.CLAUDE_CODE_TOOLS = [
     {
         name: 'check_availability',
         description: 'Check if Claude Code CLI is installed and an API key is available. Returns version and readiness status.',
+        read_safe: true,
         inputSchema: {
             type: 'object',
             properties: {},

package/build/tsconfig.tsbuildinfo

@@ -1 +1 @@
-{"root":["../index.ts","../vitest.config.ts","../vitest.integration.config.ts","../adapters/express.ts","../api/agent-subscriptions.ts","../api/agents.ts","../api/auth.ts","../api/bot-accounts.ts","../api/capabilities.ts","../api/controlplane.ts","../api/dba.ts","../api/exports.ts","../api/files.ts","../api/index.ts","../api/insight.ts","../api/knowledge.ts","../api/maintenance.ts","../api/namespaces.ts","../api/pipelines.ts","../api/roles.ts","../api/settings.ts","../api/tasks.ts","../api/topics.ts","../api/users.ts","../api/workflow-sets.ts","../api/escalations/bulk.ts","../api/escalations/claim.ts","../api/escalations/create.ts","../api/escalations/helpers.ts","../api/escalations/index.ts","../api/escalations/list.ts","../api/escalations/metadata.ts","../api/escalations/resolve.ts","../api/escalations/single.ts","../api/mcp/index.ts","../api/mcp/servers.ts","../api/mcp/tools.ts","../api/workflows/config.ts","../api/workflows/discovery.ts","../api/workflows/index.ts","../api/workflows/invocation.ts","../api/yaml-workflows/cron.ts","../api/yaml-workflows/crud.ts","../api/yaml-workflows/deploy.ts","../api/yaml-workflows/helpers.ts","../api/yaml-workflows/index.ts","../api/yaml-workflows/versions.ts","../bin/ltc.ts","../lib/cli/auth.ts","../lib/cli/client.ts","../lib/cli/compile.ts","../lib/cli/format.ts","../lib/cli/init.ts","../lib/cli/output.ts","../lib/cli/scanner.ts","../lib/cli/types.ts","../lib/cli/commands/escalations.ts","../lib/cli/commands/knowledge.ts","../lib/cli/commands/mcp.ts","../lib/cli/commands/pipelines.ts","../lib/cli/commands/status.ts","../lib/cli/commands/streams.ts","../lib/cli/commands/users.ts","../lib/cli/commands/workflows.ts","../lib/db/index.ts","../lib/db/migrate.ts","../lib/events/callback.ts","../lib/events/index.ts","../lib/events/matching.ts","../lib/events/memory.ts","../lib/events/nats-ws-proxy.ts","../lib/events/nats.ts","../lib/events/publish.ts","../lib/events/socketio.ts","../lib/logger/index.ts","../lib/logger/pino.ts","../lib/storage/index.ts","../lib/storage/local.ts","../lib/storage/mime.ts","../lib/storage/s3.ts","../lib/storage/types.ts","../lib/telemetry/honeycomb.ts","../lib/telemetry/index.ts","../modules/auth.ts","../modules/config.ts","../modules/defaults.ts","../modules/ltconfig.ts","../modules/maintenance.ts","../modules/utils.ts","../routes/agents.ts","../routes/auth.ts","../routes/bot-accounts.ts","../routes/capabilities.ts","../routes/controlplane.ts","../routes/dba.ts","../routes/delegation.ts","../routes/docs.ts","../routes/exports.ts","../routes/file-browser.ts","../routes/files.ts","../routes/index.ts","../routes/insight.ts","../routes/knowledge.ts","../routes/maintenance.ts","../routes/mcp.ts","../routes/namespaces.ts","../routes/nats-credentials.ts","../routes/oauth.ts","../routes/pipelines.ts","../routes/roles.ts","../routes/settings.ts","../routes/tasks.ts","../routes/topics.ts","../routes/users.ts","../routes/workflow-sets.ts","../routes/escalations/bulk.ts","../routes/escalations/index.ts","../routes/escalations/list.ts","../routes/escalations/metadata.ts","../routes/escalations/resolve.ts","../routes/escalations/single.ts","../routes/workflows/config.ts","../routes/workflows/discovery.ts","../routes/workflows/index.ts","../routes/workflows/invocation.ts","../routes/yaml-workflows/cron.ts","../routes/yaml-workflows/crud.ts","../routes/yaml-workflows/deployment.ts","../routes/yaml-workflows/index.ts","../routes/yaml-workflows/versions.ts","../scripts/process-helpers.ts","../scripts/process.ts","../scripts/token.ts","../sdk/index.ts","../services/dba.ts","../services/hotmesh-utils.ts","../services/workflow-invocation.ts","../services/agent/index.ts","../services/agent/input-mapper.ts","../services/agent/sql.ts","../services/agent/subscription-sql.ts","../services/agent/subscriptions.ts","../services/agent/trigger-registry.ts","../services/auth/bot-api-key.ts","../services/auth/delegation.ts","../services/auth/index.ts","../services/auth/service-token.ts","../services/config/cache.ts","../services/config/index.ts","../services/config/provider.ts","../services/config/read.ts","../services/config/sql.ts","../services/config/write.ts","../services/controlplane/index.ts","../services/controlplane/quorum-bridge.ts","../services/controlplane/sql.ts","../services/controlplane/stream-messages-sql.ts","../services/controlplane/types.ts","../services/cron/index.ts","../services/escalation/bulk.ts","../services/escalation/crud.ts","../services/escalation/index.ts","../services/escalation/queries.ts","../services/escalation/sql.ts","../services/escalation/types.ts","../services/escalation-strategy/default.ts","../services/escalation-strategy/index.ts","../services/escalation-strategy/mcp.ts","../services/export/client.ts","../services/export/index.ts","../services/export/post-process.ts","../services/export/types.ts","../services/iam/activity.ts","../services/iam/bots.ts","../services/iam/context.ts","../services/iam/credentials.ts","../services/iam/envelope.ts","../services/iam/ephemeral.ts","../services/iam/index.ts","../services/iam/principal.ts","../services/iam/resolve.ts","../services/iam/sql.ts","../services/insight/index.ts","../services/insight/prompts.ts","../services/interceptor/activity-interceptor.ts","../services/interceptor/completion.ts","../services/interceptor/context.ts","../services/interceptor/escalation.ts","../services/interceptor/index.ts","../services/interceptor/lifecycle.ts","../services/interceptor/state.ts","../services/interceptor/types.ts","../services/interceptor/activities/config.ts","../services/interceptor/activities/escalation.ts","../services/interceptor/activities/index.ts","../services/interceptor/activities/task.ts","../services/interceptor/activities/workflow.ts","../services/llm/detect.ts","../services/llm/index.ts","../services/llm/translate.ts","../services/llm/types.ts","../services/llm/providers/anthropic.ts","../services/llm/providers/openai.ts","../services/maintenance/index.ts","../services/mcp/adapter.ts","../services/mcp/db.ts","../services/mcp/index.ts","../services/mcp/register-tool.ts","../services/mcp/server-lifecycle.ts","../services/mcp/server-tools.ts","../services/mcp/server.ts","../services/mcp/sql.ts","../services/mcp/types.ts","../services/mcp/workflow-compiler-server.ts","../services/mcp/workflow-server.ts","../services/mcp/client/connection-dispatch.ts","../services/mcp/client/connection-lifecycle.ts","../services/mcp/client/connection-test.ts","../services/mcp/client/connection.ts","../services/mcp/client/index.ts","../services/mcp/client/tools.ts","../services/mcp/db-server/index.ts","../services/mcp/db-server/schemas.ts","../services/mcp/db-server/tools.ts","../services/mcp/playwright-server/index.ts","../services/mcp/playwright-server/lifecycle.ts","../services/mcp/playwright-server/schemas.ts","../services/mcp/playwright-server/tools.ts","../services/namespace/index.ts","../services/namespace/sql.ts","../services/namespace/types.ts","../services/oauth/crypto.ts","../services/oauth/db.ts","../services/oauth/index.ts","../services/oauth/sql.ts","../services/oauth/state.ts","../services/oauth/providers/anthropic.ts","../services/oauth/providers/github.ts","../services/oauth/providers/google.ts","../services/oauth/providers/index.ts","../services/oauth/providers/microsoft.ts","../services/oauth/providers/mock.ts","../services/oauth/providers/registry.ts","../services/oauth/providers/types.ts","../services/orchestrator/condition.ts","../services/orchestrator/index.ts","../services/orchestrator/types.ts","../services/pipelines/enrichment.ts","../services/pipelines/events.ts","../services/pipelines/execution-builder.ts","../services/pipelines/index.ts","../services/pipelines/queries.ts","../services/pipelines/sql.ts","../services/pipelines/types.ts","../services/role/index.ts","../services/role/sql.ts","../services/role/types.ts","../services/task/crud.ts","../services/task/index.ts","../services/task/process.ts","../services/task/resolve.ts","../services/task/sql.ts","../services/task/types.ts","../services/topics/index.ts","../services/topics/sql.ts","../services/topics/system-topics.ts","../services/user/auth.ts","../services/user/crud.ts","../services/user/index.ts","../services/user/rbac.ts","../services/user/roles.ts","../services/user/seed-admin.ts","../services/user/sql.ts","../services/user/types.ts","../services/workers/registry.ts","../services/workflow-sets/db.ts","../services/workflow-sets/index.ts","../services/workflow-sets/sql.ts","../services/yaml-workflow/builder-regenerate.ts","../services/yaml-workflow/db-utils.ts","../services/yaml-workflow/db-versions.ts","../services/yaml-workflow/db.ts","../services/yaml-workflow/deployer-helpers.ts","../services/yaml-workflow/deployer.ts","../services/yaml-workflow/generator.ts","../services/yaml-workflow/index.ts","../services/yaml-workflow/input-analyzer-helpers.ts","../services/yaml-workflow/input-analyzer.ts","../services/yaml-workflow/invoke.ts","../services/yaml-workflow/sql.ts","../services/yaml-workflow/types.ts","../services/yaml-workflow/durable-compiler/index.ts","../services/yaml-workflow/durable-compiler/parser.ts","../services/yaml-workflow/durable-compiler/prompts.ts","../services/yaml-workflow/durable-compiler/types.ts","../services/yaml-workflow/pattern-detector/array-source.ts","../services/yaml-workflow/pattern-detector/collapse.ts","../services/yaml-workflow/pattern-detector/index.ts","../services/yaml-workflow/pattern-detector/run-detection.ts","../services/yaml-workflow/pattern-detector/types.ts","../services/yaml-workflow/pipeline/analyze.ts","../services/yaml-workflow/pipeline/extract-helpers.ts","../services/yaml-workflow/pipeline/extract.ts","../services/yaml-workflow/pipeline/index.ts","../services/yaml-workflow/pipeline/prompt-templates.ts","../services/yaml-workflow/pipeline/prompts.ts","../services/yaml-workflow/pipeline/validate.ts","../services/yaml-workflow/pipeline/build/dag-assembly.ts","../services/yaml-workflow/pipeline/build/dag.ts","../services/yaml-workflow/pipeline/build/index.ts","../services/yaml-workflow/pipeline/build/iteration.ts","../services/yaml-workflow/pipeline/build/metadata.ts","../services/yaml-workflow/pipeline/build/transform.ts","../services/yaml-workflow/pipeline/build/utils.ts","../services/yaml-workflow/pipeline/build/wiring.ts","../services/yaml-workflow/pipeline/compile/index.ts","../services/yaml-workflow/pipeline/compile/llm-call.ts","../services/yaml-workflow/pipeline/compile/parse-plan.ts","../services/yaml-workflow/pipeline/compile/summarize.ts","../services/yaml-workflow/workers/callbacks.ts","../services/yaml-workflow/workers/events.ts","../services/yaml-workflow/workers/index.ts","../services/yaml-workflow/workers/register.ts","../services/yaml-workflow/workers/scope.ts","../start/adapters.ts","../start/config.ts","../start/index.ts","../start/server.ts","../start/socket-auth.ts","../start/workers.ts","../system/index.ts","../system/activities/claude-code.ts","../system/activities/file-storage.ts","../system/activities/http.ts","../system/activities/knowledge.ts","../system/activities/oauth.ts","../system/activities/schema-exchange.ts","../system/activities/sql.ts","../system/activities/triage/cache.ts","../system/activities/triage/context.ts","../system/activities/triage/discovery.ts","../system/activities/triage/index.ts","../system/activities/triage/llm.ts","../system/activities/triage/tools.ts","../system/mcp-servers/claude-code.ts","../system/mcp-servers/docs.ts","../system/mcp-servers/events.ts","../system/mcp-servers/file-storage.ts","../system/mcp-servers/http-fetch.ts","../system/mcp-servers/human-queue-schemas.ts","../system/mcp-servers/human-queue.ts","../system/mcp-servers/knowledge.ts","../system/mcp-servers/oauth.ts","../system/mcp-servers/schema-exchange.ts","../system/mcp-servers/translation.ts","../system/mcp-servers/vision-prompts.ts","../system/mcp-servers/vision.ts","../system/mcp-servers/workflow-compiler.ts","../system/mcp-servers/workflow.ts","../system/mcp-servers/admin/escalations.ts","../system/mcp-servers/admin/index.ts","../system/mcp-servers/admin/maintenance.ts","../system/mcp-servers/admin/mcp-servers.ts","../system/mcp-servers/admin/schemas.ts","../system/mcp-servers/admin/tasks.ts","../system/mcp-servers/admin/users.ts","../system/mcp-servers/admin/workflow-config.ts","../system/mcp-servers/admin/workflows.ts","../system/mcp-servers/admin/yaml-workflows.ts","../system/mcp-servers/db-query/index.ts","../system/mcp-servers/db-query/schemas.ts","../system/mcp-servers/db-query/tools.ts","../system/mcp-servers/playwright/browser-lifecycle.ts","../system/mcp-servers/playwright/index.ts","../system/mcp-servers/playwright/schemas.ts","../system/mcp-servers/playwright/tools-atomic.ts","../system/mcp-servers/playwright/tools-navigation.ts","../system/mcp-servers/playwright/tools-page-interaction.ts","../system/mcp-servers/playwright/tools-run-script.ts","../system/mcp-servers/playwright/types.ts","../system/mcp-servers/playwright/vision-helper.ts","../system/mcp-servers/playwright-cli/helpers.ts","../system/mcp-servers/playwright-cli/index.ts","../system/mcp-servers/playwright-cli/schemas.ts","../system/mcp-servers/playwright-cli/tools-auth.ts","../system/mcp-servers/playwright-cli/tools-capture.ts","../system/seed/index.ts","../system/seed/tool-manifests-admin.ts","../system/seed/tool-manifests-browser.ts","../system/seed/tool-manifests-data.ts","../system/seed/tool-manifests-escalation.ts","../system/seed/tool-manifests-events.ts","../system/seed/tool-manifests-knowledge.ts","../system/seed/tool-manifests-workflows.ts","../system/workflows/tool-result-guard.ts","../system/workflows/capability-invoke/activities.ts","../system/workflows/capability-invoke/index.ts","../system/workflows/mcp-deterministic/activities.ts","../system/workflows/mcp-deterministic/index.ts","../system/workflows/mcp-query/index.ts","../system/workflows/mcp-query/prompts.ts","../system/workflows/mcp-query/strategy-advisors.ts","../system/workflows/mcp-query/types.ts","../system/workflows/mcp-query/activities/caches.ts","../system/workflows/mcp-query/activities/discovery.ts","../system/workflows/mcp-query/activities/index.ts","../system/workflows/mcp-query/activities/llm.ts","../system/workflows/mcp-query/activities/tool-executor.ts","../system/workflows/mcp-query/activities/tool-loader.ts","../system/workflows/mcp-query-router/activities.ts","../system/workflows/mcp-query-router/index.ts","../system/workflows/mcp-query-router/prompts.ts","../system/workflows/mcp-triage/activities-proxy.ts","../system/workflows/mcp-triage/index.ts","../system/workflows/mcp-triage/prompts.ts","../system/workflows/mcp-triage/response-builders.ts","../system/workflows/mcp-triage/response.ts","../system/workflows/mcp-triage/types.ts","../system/workflows/mcp-triage-deterministic/activities.ts","../system/workflows/mcp-triage-deterministic/index.ts","../system/workflows/mcp-triage-router/activities.ts","../system/workflows/mcp-triage-router/index.ts","../system/workflows/mcp-workflow-builder/index.ts","../system/workflows/mcp-workflow-builder/prompts.ts","../system/workflows/mcp-workflow-builder/activities/caches.ts","../system/workflows/mcp-workflow-builder/activities/index.ts","../system/workflows/mcp-workflow-builder/activities/llm.ts","../system/workflows/mcp-workflow-builder/activities/tool-loader.ts","../system/workflows/mcp-workflow-planner/index.ts","../system/workflows/mcp-workflow-planner/prompts.ts","../system/workflows/mcp-workflow-planner/activities/analyze.ts","../system/workflows/mcp-workflow-planner/activities/index.ts","../system/workflows/mcp-workflow-planner/activities/persist.ts","../system/workflows/mcp-workflow-planner/activities/plan.ts","../system/workflows/shared/discovery.ts","../system/workflows/shared/index.ts","../system/workflows/shared/llm-caller.ts","../system/workflows/shared/prompts.ts","../system/workflows/shared/strategy-advisors.ts","../system/workflows/shared/tool-executor.ts","../system/workflows/shared/tool-loader.ts","../system/workflows/shared/types.ts","../types/agent.ts","../types/auth.ts","../types/config.ts","../types/delegation.ts","../types/discovery.ts","../types/envelope.ts","../types/escalation-strategy.ts","../types/escalation.ts","../types/events.ts","../types/export.ts","../types/express.d.ts","../types/index.ts","../types/logger.ts","../types/maintenance.ts","../types/mcp.ts","../types/oauth.ts","../types/sdk.ts","../types/startup.ts","../types/task.ts","../types/telemetry.ts","../types/tool-context.ts","../types/user.ts","../types/workflow-set.ts","../types/workflow.ts","../types/yaml-workflow.ts","../workers/index.ts"],"version":"5.9.3"}
+{"root":["../index.ts","../vitest.config.ts","../vitest.integration.config.ts","../adapters/express.ts","../api/agent-subscriptions.ts","../api/agents.ts","../api/auth-sso.ts","../api/auth.ts","../api/bot-accounts.ts","../api/capabilities.ts","../api/controlplane.ts","../api/dba.ts","../api/exports.ts","../api/files.ts","../api/index.ts","../api/insight.ts","../api/knowledge.ts","../api/maintenance.ts","../api/namespaces.ts","../api/pipelines.ts","../api/roles.ts","../api/settings.ts","../api/tasks.ts","../api/topics.ts","../api/users.ts","../api/workflow-sets.ts","../api/escalations/bulk.ts","../api/escalations/claim.ts","../api/escalations/create.ts","../api/escalations/helpers.ts","../api/escalations/index.ts","../api/escalations/list.ts","../api/escalations/metadata.ts","../api/escalations/resolve.ts","../api/escalations/single.ts","../api/mcp/index.ts","../api/mcp/servers.ts","../api/mcp/tools.ts","../api/workflows/config.ts","../api/workflows/discovery.ts","../api/workflows/index.ts","../api/workflows/invocation.ts","../api/yaml-workflows/cron.ts","../api/yaml-workflows/crud.ts","../api/yaml-workflows/deploy.ts","../api/yaml-workflows/helpers.ts","../api/yaml-workflows/index.ts","../api/yaml-workflows/versions.ts","../bin/ltc.ts","../lib/cli/auth.ts","../lib/cli/client.ts","../lib/cli/compile.ts","../lib/cli/format.ts","../lib/cli/init.ts","../lib/cli/output.ts","../lib/cli/scanner.ts","../lib/cli/types.ts","../lib/cli/commands/escalations.ts","../lib/cli/commands/knowledge.ts","../lib/cli/commands/mcp.ts","../lib/cli/commands/pipelines.ts","../lib/cli/commands/status.ts","../lib/cli/commands/streams.ts","../lib/cli/commands/users.ts","../lib/cli/commands/workflows.ts","../lib/db/index.ts","../lib/db/migrate.ts","../lib/events/callback.ts","../lib/events/index.ts","../lib/events/matching.ts","../lib/events/memory.ts","../lib/events/nats-ws-proxy.ts","../lib/events/nats.ts","../lib/events/publish.ts","../lib/events/socketio.ts","../lib/logger/index.ts","../lib/logger/pino.ts","../lib/storage/index.ts","../lib/storage/local.ts","../lib/storage/mime.ts","../lib/storage/s3.ts","../lib/storage/types.ts","../lib/telemetry/honeycomb.ts","../lib/telemetry/index.ts","../modules/auth.ts","../modules/config.ts","../modules/defaults.ts","../modules/ltconfig.ts","../modules/maintenance.ts","../modules/sso.ts","../modules/utils.ts","../routes/agents.ts","../routes/auth-sso.ts","../routes/auth.ts","../routes/bot-accounts.ts","../routes/capabilities.ts","../routes/controlplane.ts","../routes/dba.ts","../routes/delegation.ts","../routes/docs.ts","../routes/exports.ts","../routes/file-browser.ts","../routes/files.ts","../routes/index.ts","../routes/insight.ts","../routes/knowledge.ts","../routes/maintenance.ts","../routes/mcp-endpoint.ts","../routes/mcp.ts","../routes/namespaces.ts","../routes/nats-credentials.ts","../routes/oauth.ts","../routes/pipelines.ts","../routes/roles.ts","../routes/settings.ts","../routes/tasks.ts","../routes/topics.ts","../routes/users.ts","../routes/workflow-sets.ts","../routes/escalations/bulk.ts","../routes/escalations/index.ts","../routes/escalations/list.ts","../routes/escalations/metadata.ts","../routes/escalations/resolve.ts","../routes/escalations/single.ts","../routes/workflows/config.ts","../routes/workflows/discovery.ts","../routes/workflows/index.ts","../routes/workflows/invocation.ts","../routes/yaml-workflows/cron.ts","../routes/yaml-workflows/crud.ts","../routes/yaml-workflows/deployment.ts","../routes/yaml-workflows/index.ts","../routes/yaml-workflows/versions.ts","../scripts/process-helpers.ts","../scripts/process.ts","../scripts/token.ts","../sdk/index.ts","../services/dba.ts","../services/hotmesh-utils.ts","../services/workflow-invocation.ts","../services/agent/index.ts","../services/agent/input-mapper.ts","../services/agent/sql.ts","../services/agent/subscription-sql.ts","../services/agent/subscriptions.ts","../services/agent/trigger-registry.ts","../services/auth/bot-api-key.ts","../services/auth/delegation.ts","../services/auth/index.ts","../services/auth/service-token.ts","../services/config/cache.ts","../services/config/index.ts","../services/config/provider.ts","../services/config/read.ts","../services/config/sql.ts","../services/config/write.ts","../services/controlplane/index.ts","../services/controlplane/quorum-bridge.ts","../services/controlplane/sql.ts","../services/controlplane/stream-messages-sql.ts","../services/controlplane/types.ts","../services/cron/index.ts","../services/escalation/bulk.ts","../services/escalation/crud.ts","../services/escalation/index.ts","../services/escalation/queries.ts","../services/escalation/sql.ts","../services/escalation/types.ts","../services/escalation-strategy/default.ts","../services/escalation-strategy/index.ts","../services/escalation-strategy/mcp.ts","../services/export/client.ts","../services/export/index.ts","../services/export/post-process.ts","../services/export/types.ts","../services/iam/activity.ts","../services/iam/bots.ts","../services/iam/context.ts","../services/iam/credentials.ts","../services/iam/envelope.ts","../services/iam/ephemeral.ts","../services/iam/index.ts","../services/iam/principal.ts","../services/iam/resolve.ts","../services/iam/sql.ts","../services/insight/index.ts","../services/insight/prompts.ts","../services/interceptor/activity-interceptor.ts","../services/interceptor/completion.ts","../services/interceptor/context.ts","../services/interceptor/escalation.ts","../services/interceptor/index.ts","../services/interceptor/lifecycle.ts","../services/interceptor/state.ts","../services/interceptor/types.ts","../services/interceptor/activities/config.ts","../services/interceptor/activities/escalation.ts","../services/interceptor/activities/index.ts","../services/interceptor/activities/task.ts","../services/interceptor/activities/workflow.ts","../services/llm/detect.ts","../services/llm/index.ts","../services/llm/translate.ts","../services/llm/types.ts","../services/llm/providers/anthropic.ts","../services/llm/providers/openai.ts","../services/maintenance/index.ts","../services/mcp/adapter.ts","../services/mcp/db.ts","../services/mcp/exposure.ts","../services/mcp/external-server.ts","../services/mcp/index.ts","../services/mcp/register-tool.ts","../services/mcp/seed-service-account.ts","../services/mcp/server-lifecycle.ts","../services/mcp/server-tools.ts","../services/mcp/server.ts","../services/mcp/sql.ts","../services/mcp/types.ts","../services/mcp/workflow-compiler-server.ts","../services/mcp/workflow-server.ts","../services/mcp/client/connection-dispatch.ts","../services/mcp/client/connection-lifecycle.ts","../services/mcp/client/connection-test.ts","../services/mcp/client/connection.ts","../services/mcp/client/index.ts","../services/mcp/client/tools.ts","../services/mcp/db-server/index.ts","../services/mcp/db-server/schemas.ts","../services/mcp/db-server/tools.ts","../services/mcp/playwright-server/index.ts","../services/mcp/playwright-server/lifecycle.ts","../services/mcp/playwright-server/schemas.ts","../services/mcp/playwright-server/tools.ts","../services/namespace/index.ts","../services/namespace/sql.ts","../services/namespace/types.ts","../services/oauth/crypto.ts","../services/oauth/db.ts","../services/oauth/index.ts","../services/oauth/sql.ts","../services/oauth/state.ts","../services/oauth/providers/anthropic.ts","../services/oauth/providers/github.ts","../services/oauth/providers/google.ts","../services/oauth/providers/index.ts","../services/oauth/providers/microsoft.ts","../services/oauth/providers/mock.ts","../services/oauth/providers/registry.ts","../services/oauth/providers/types.ts","../services/orchestrator/condition.ts","../services/orchestrator/index.ts","../services/orchestrator/types.ts","../services/pipelines/enrichment.ts","../services/pipelines/events.ts","../services/pipelines/execution-builder.ts","../services/pipelines/index.ts","../services/pipelines/queries.ts","../services/pipelines/sql.ts","../services/pipelines/types.ts","../services/role/index.ts","../services/role/sql.ts","../services/role/types.ts","../services/task/crud.ts","../services/task/index.ts","../services/task/process.ts","../services/task/resolve.ts","../services/task/sql.ts","../services/task/types.ts","../services/topics/index.ts","../services/topics/sql.ts","../services/topics/system-topics.ts","../services/user/auth.ts","../services/user/crud.ts","../services/user/index.ts","../services/user/rbac.ts","../services/user/roles.ts","../services/user/seed-admin.ts","../services/user/sql.ts","../services/user/sso-provision.ts","../services/user/types.ts","../services/workers/registry.ts","../services/workflow-sets/db.ts","../services/workflow-sets/index.ts","../services/workflow-sets/sql.ts","../services/yaml-workflow/builder-regenerate.ts","../services/yaml-workflow/db-utils.ts","../services/yaml-workflow/db-versions.ts","../services/yaml-workflow/db.ts","../services/yaml-workflow/deployer-helpers.ts","../services/yaml-workflow/deployer.ts","../services/yaml-workflow/generator.ts","../services/yaml-workflow/index.ts","../services/yaml-workflow/input-analyzer-helpers.ts","../services/yaml-workflow/input-analyzer.ts","../services/yaml-workflow/invoke.ts","../services/yaml-workflow/sql.ts","../services/yaml-workflow/types.ts","../services/yaml-workflow/durable-compiler/index.ts","../services/yaml-workflow/durable-compiler/parser.ts","../services/yaml-workflow/durable-compiler/prompts.ts","../services/yaml-workflow/durable-compiler/types.ts","../services/yaml-workflow/pattern-detector/array-source.ts","../services/yaml-workflow/pattern-detector/collapse.ts","../services/yaml-workflow/pattern-detector/index.ts","../services/yaml-workflow/pattern-detector/run-detection.ts","../services/yaml-workflow/pattern-detector/types.ts","../services/yaml-workflow/pipeline/analyze.ts","../services/yaml-workflow/pipeline/extract-helpers.ts","../services/yaml-workflow/pipeline/extract.ts","../services/yaml-workflow/pipeline/index.ts","../services/yaml-workflow/pipeline/prompt-templates.ts","../services/yaml-workflow/pipeline/prompts.ts","../services/yaml-workflow/pipeline/validate.ts","../services/yaml-workflow/pipeline/build/dag-assembly.ts","../services/yaml-workflow/pipeline/build/dag.ts","../services/yaml-workflow/pipeline/build/index.ts","../services/yaml-workflow/pipeline/build/iteration.ts","../services/yaml-workflow/pipeline/build/metadata.ts","../services/yaml-workflow/pipeline/build/transform.ts","../services/yaml-workflow/pipeline/build/utils.ts","../services/yaml-workflow/pipeline/build/wiring.ts","../services/yaml-workflow/pipeline/compile/index.ts","../services/yaml-workflow/pipeline/compile/llm-call.ts","../services/yaml-workflow/pipeline/compile/parse-plan.ts","../services/yaml-workflow/pipeline/compile/summarize.ts","../services/yaml-workflow/workers/callbacks.ts","../services/yaml-workflow/workers/events.ts","../services/yaml-workflow/workers/index.ts","../services/yaml-workflow/workers/register.ts","../services/yaml-workflow/workers/scope.ts","../start/adapters.ts","../start/config.ts","../start/index.ts","../start/server.ts","../start/socket-auth.ts","../start/workers.ts","../system/index.ts","../system/activities/claude-code.ts","../system/activities/file-storage.ts","../system/activities/http.ts","../system/activities/knowledge.ts","../system/activities/oauth.ts","../system/activities/schema-exchange.ts","../system/activities/sql.ts","../system/activities/triage/cache.ts","../system/activities/triage/context.ts","../system/activities/triage/discovery.ts","../system/activities/triage/index.ts","../system/activities/triage/llm.ts","../system/activities/triage/tools.ts","../system/mcp-servers/claude-code.ts","../system/mcp-servers/docs.ts","../system/mcp-servers/events.ts","../system/mcp-servers/file-storage.ts","../system/mcp-servers/http-fetch.ts","../system/mcp-servers/human-queue-schemas.ts","../system/mcp-servers/human-queue.ts","../system/mcp-servers/knowledge.ts","../system/mcp-servers/oauth.ts","../system/mcp-servers/schema-exchange.ts","../system/mcp-servers/translation.ts","../system/mcp-servers/vision-prompts.ts","../system/mcp-servers/vision.ts","../system/mcp-servers/workflow-compiler.ts","../system/mcp-servers/workflow.ts","../system/mcp-servers/admin/agent-subscriptions.ts","../system/mcp-servers/admin/agents.ts","../system/mcp-servers/admin/bot-accounts.ts","../system/mcp-servers/admin/controlplane.ts","../system/mcp-servers/admin/escalations.ts","../system/mcp-servers/admin/exports.ts","../system/mcp-servers/admin/index.ts","../system/mcp-servers/admin/maintenance.ts","../system/mcp-servers/admin/mcp-servers.ts","../system/mcp-servers/admin/pipelines.ts","../system/mcp-servers/admin/schemas.ts","../system/mcp-servers/admin/settings.ts","../system/mcp-servers/admin/tasks.ts","../system/mcp-servers/admin/topics.ts","../system/mcp-servers/admin/users.ts","../system/mcp-servers/admin/workflow-config.ts","../system/mcp-servers/admin/workflows.ts","../system/mcp-servers/admin/yaml-workflows.ts","../system/mcp-servers/db-query/index.ts","../system/mcp-servers/db-query/schemas.ts","../system/mcp-servers/db-query/tools.ts","../system/seed/index.ts","../system/seed/tool-manifests-admin.ts","../system/seed/tool-manifests-data.ts","../system/seed/tool-manifests-escalation.ts","../system/seed/tool-manifests-events.ts","../system/seed/tool-manifests-knowledge.ts","../system/seed/tool-manifests-workflows.ts","../system/workflows/tool-result-guard.ts","../system/workflows/capability-invoke/activities.ts","../system/workflows/capability-invoke/index.ts","../system/workflows/mcp-deterministic/activities.ts","../system/workflows/mcp-deterministic/index.ts","../system/workflows/mcp-query/index.ts","../system/workflows/mcp-query/prompts.ts","../system/workflows/mcp-query/strategy-advisors.ts","../system/workflows/mcp-query/types.ts","../system/workflows/mcp-query/activities/caches.ts","../system/workflows/mcp-query/activities/discovery.ts","../system/workflows/mcp-query/activities/index.ts","../system/workflows/mcp-query/activities/llm.ts","../system/workflows/mcp-query/activities/tool-executor.ts","../system/workflows/mcp-query/activities/tool-loader.ts","../system/workflows/mcp-query-router/activities.ts","../system/workflows/mcp-query-router/index.ts","../system/workflows/mcp-query-router/prompts.ts","../system/workflows/mcp-triage/activities-proxy.ts","../system/workflows/mcp-triage/index.ts","../system/workflows/mcp-triage/prompts.ts","../system/workflows/mcp-triage/response-builders.ts","../system/workflows/mcp-triage/response.ts","../system/workflows/mcp-triage/types.ts","../system/workflows/mcp-triage-deterministic/activities.ts","../system/workflows/mcp-triage-deterministic/index.ts","../system/workflows/mcp-triage-router/activities.ts","../system/workflows/mcp-triage-router/index.ts","../system/workflows/mcp-workflow-builder/index.ts","../system/workflows/mcp-workflow-builder/prompts.ts","../system/workflows/mcp-workflow-builder/activities/caches.ts","../system/workflows/mcp-workflow-builder/activities/index.ts","../system/workflows/mcp-workflow-builder/activities/llm.ts","../system/workflows/mcp-workflow-builder/activities/tool-loader.ts","../system/workflows/mcp-workflow-planner/index.ts","../system/workflows/mcp-workflow-planner/prompts.ts","../system/workflows/mcp-workflow-planner/activities/analyze.ts","../system/workflows/mcp-workflow-planner/activities/index.ts","../system/workflows/mcp-workflow-planner/activities/persist.ts","../system/workflows/mcp-workflow-planner/activities/plan.ts","../system/workflows/shared/discovery.ts","../system/workflows/shared/index.ts","../system/workflows/shared/llm-caller.ts","../system/workflows/shared/prompts.ts","../system/workflows/shared/strategy-advisors.ts","../system/workflows/shared/tool-executor.ts","../system/workflows/shared/tool-loader.ts","../system/workflows/shared/types.ts","../types/agent.ts","../types/auth.ts","../types/config.ts","../types/delegation.ts","../types/discovery.ts","../types/envelope.ts","../types/escalation-strategy.ts","../types/escalation.ts","../types/events.ts","../types/export.ts","../types/express.d.ts","../types/index.ts","../types/logger.ts","../types/maintenance.ts","../types/mcp.ts","../types/oauth.ts","../types/sdk.ts","../types/startup.ts","../types/task.ts","../types/telemetry.ts","../types/tool-context.ts","../types/user.ts","../types/workflow-set.ts","../types/workflow.ts","../types/yaml-workflow.ts","../workers/index.ts"],"version":"5.9.3"}

package/build/types/auth.d.ts

@@ -32,3 +32,74 @@ export interface AuthPayload {
 export interface LTAuthAdapter {
     authenticate(req: Request): Promise<AuthPayload | null> | (AuthPayload | null);
 }
+/**
+ * Identity resolved from the host application's authentication.
+ *
+ * Returned by the SSO `resolve` function. Long Tail maps this to an
+ * `lt_users` record via JIT provisioning — the host never touches
+ * Long Tail's user tables directly.
+ */
+export interface SSOIdentity {
+    /** Stable external identifier (e.g., host user UUID, employee ID).
+     *  Mapped to `lt_users.external_id`. */
+    externalId: string;
+    /** Display name for the user. */
+    displayName?: string;
+    /** Email address. */
+    email?: string;
+    /** Role names from the host system. Mapped to LT roles via `roleMap`
+     *  (if provided) or passed through directly as LT role names. */
+    roles?: string[];
+    /** Arbitrary metadata stored on the `lt_users.metadata` JSONB field. */
+    metadata?: Record<string, any>;
+}
+/**
+ * SSO configuration for embedded deployments.
+ *
+ * When Long Tail is mounted inside a host application (NestJS, Express, etc.),
+ * the host's auth middleware validates users before requests reach Long Tail.
+ * This config tells Long Tail how to extract that identity and provision
+ * matching `lt_users` records.
+ *
+ * The host provides ONE function (`resolve`). Long Tail handles JIT provisioning,
+ * role sync, JWT issuance, and dashboard awareness.
+ *
+ * @example NestJS (Hike Medical)
+ * ```typescript
+ * await start({
+ *   auth: {
+ *     secret: process.env.JWT_SECRET,
+ *     sso: {
+ *       resolve: (req) => {
+ *         const user = (req as any).user; // set by NestJS middleware
+ *         if (!user) return null;
+ *         return {
+ *           externalId: user.id,
+ *           displayName: user.displayName,
+ *           email: user.email,
+ *           roles: ['grinder', 'quality-inspector'],
+ *         };
+ *       },
+ *       roleMap: { admin: 'superadmin' },
+ *       logoutUrl: '/auth/logout',
+ *     },
+ *   },
+ * });
+ * ```
+ */
+export interface LTSSOConfig {
+    /** Extract user identity from the host's authenticated request.
+     *  Return `null` if the request is not authenticated by the host.
+     *  The `req` object carries cookies, headers, and any properties
+     *  attached by upstream middleware (e.g., `req.user`). */
+    resolve: (req: Request) => Promise<SSOIdentity | null> | (SSOIdentity | null);
+    /** Map host role names to LT role names.
+     *  Key = host role, value = LT role name.
+     *  Unmapped roles are ignored. If omitted, host roles pass through as-is. */
+    roleMap?: Record<string, string>;
+    /** Default LT role type for provisioned users. Default: `'member'`. */
+    defaultRoleType?: 'admin' | 'member';
+    /** URL to redirect the browser on logout (host's logout endpoint).
+     *  If omitted, the dashboard shows its own login page on logout. */
+    logoutUrl?: string;
+}

package/build/types/events.d.ts

@@ -1,12 +1,21 @@
 import type { LTMilestone } from './task';
 /**
- * All event types published through the NATS event system.
+ * System event type patterns.
  *
- * Topic space: `lt.events.{type}` — e.g. `lt.events.task.created`
+ * System events use structured subjects with embedded resource IDs:
+ *   `system.workflow.{workflowId}.completed`
+ *   `system.escalation.{escalationId}.claimed`
+ *   `system.activity.{workflowId}.{activityName}.failed`
  *
- * Dashboard subscribes to `lt.events.>` to receive all events.
+ * On the wire (NATS): `lt.events.system.workflow.abc123.completed`
+ * Dashboard subscribes: `lt.events.system.>` for all system events,
+ * or `lt.events.system.workflow.abc123.>` for a specific workflow.
+ *
+ * The `*` segments in these patterns are replaced with actual IDs at publish time.
  */
-export type LTEventType = 'task.created' | 'task.started' | 'task.completed' | 'task.escalated' | 'task.failed' | 'escalation.created' | 'escalation.resolved' | 'escalation.claimed' | 'escalation.released' | 'workflow.started' | 'workflow.completed' | 'workflow.failed' | 'activity.started' | 'activity.completed' | 'activity.failed' | 'knowledge.stored' | 'knowledge.deleted' | 'file.stored' | 'file.deleted' | 'agent.started' | 'agent.completed' | 'agent.failed' | 'agent.status_changed' | 'agent.triggers_changed' | 'milestone';
+export type LTSystemEventPattern = `system.task.${string}.created` | `system.task.${string}.started` | `system.task.${string}.completed` | `system.task.${string}.escalated` | `system.task.${string}.failed` | `system.escalation.${string}.created` | `system.escalation.${string}.resolved` | `system.escalation.${string}.claimed` | `system.escalation.${string}.released` | `system.workflow.${string}.started` | `system.workflow.${string}.completed` | `system.workflow.${string}.failed` | `system.activity.${string}.${string}.started` | `system.activity.${string}.${string}.completed` | `system.activity.${string}.${string}.failed` | `system.knowledge.${string}.stored` | `system.knowledge.${string}.deleted` | 'system.file.stored' | 'system.file.deleted' | `system.agent.${string}.started` | `system.agent.${string}.completed` | `system.agent.${string}.failed` | `system.agent.${string}.status_changed` | `system.agent.${string}.triggers_changed` | `system.milestone.${string}`;
+/** @deprecated Use LTSystemEventPattern for system events. Kept for backward compat. */
+export type LTEventType = LTSystemEventPattern;
 /**
  * Application-defined event type.
  * Convention: `app.{namespace}.{entity}.{action}`
@@ -17,8 +26,10 @@ export type LTAppEventType = `app.${string}`;
  * Payload published through the events system.
  */
 export interface LTEvent {
-    /** Event classification */
-    type: LTEventType | string;
+    /** Idempotent event identifier. Auto-generated by eventRegistry.publish() if omitted. */
+    id?: string;
+    /** Event classification — structured subject for system events, free-form for app events */
+    type: LTSystemEventPattern | string;
     /** Where the event originated: 'interceptor' | 'orchestrator' | 'activity' */
     source: string;
     /** The workflow instance that produced this event */

package/build/types/index.d.ts

@@ -4,7 +4,7 @@ export type { LTEscalationStatus, LTEscalationPriority, LTEscalationRecord, } fr
 export { isEffectivelyClaimed, isAvailable, } from './escalation';
 export type { LTReturn, LTEscalation, LTActivity, LTResult, } from './workflow';
 export type { LTWorkflowConfig, LTResolvedConfig, LTProviderData, } from './config';
-export type { AuthPayload, LTAuthAdapter, } from './auth';
+export type { AuthPayload, LTAuthAdapter, SSOIdentity, LTSSOConfig, } from './auth';
 export type { LTUserStatus, LTRoleType, LTUserRole, LTUserRecord, } from './user';
 export type { LTEvent, LTEventType, LTAppEventType, LTEventAdapter, } from './events';
 export type { LTTelemetryAdapter, } from './telemetry';

package/build/types/startup.d.ts

@@ -1,5 +1,5 @@
 import type { LoggerOptions } from 'pino';
-import type { LTAuthAdapter } from './auth';
+import type { LTAuthAdapter, LTSSOConfig } from './auth';
 import type { LTOAuthStartConfig } from './oauth';
 import type { LTTelemetryAdapter } from './telemetry';
 import type { LTEventAdapter } from './events';
@@ -52,11 +52,15 @@ export interface LTMcpServerConfig {
     compileHints?: string;
     /** OAuth providers required by this server's tools (e.g., ['google']). */
     credentialProviders?: string[];
+    /** When true, all tools on this server require an AI API key. Server is hidden when no key is configured. */
+    aiRequired?: boolean;
     /** Tool manifest — static JSON schema definitions for each tool. */
     toolManifest?: Array<{
         name: string;
         description: string;
         inputSchema: Record<string, any>;
+        /** Tool only reads data — safe to expose to external MCP consumers without write permission. */
+        read_safe?: boolean;
     }>;
 }
 /**
@@ -185,6 +189,9 @@ export interface LTStartConfig {
         adapter?: LTAuthAdapter;
         /** OAuth/OIDC configuration for identity and resource OAuth. */
         oauth?: LTOAuthStartConfig;
+        /** SSO for embedded deployments. Host auth is trusted; users are
+         *  JIT-provisioned in lt_users from the resolved identity. */
+        sso?: LTSSOConfig;
     };
     /** OpenTelemetry. Register before workers start. */
     telemetry?: {
@@ -299,6 +306,20 @@ export interface LTStartConfig {
         }>;
         /** Replace the built-in MCP adapter entirely. */
         adapter?: LTMcpAdapter;
+        /**
+         * Controls which tools are exposed when this instance acts as an MCP server.
+         * All fields are optional — omit the entire object for unrestricted access.
+         */
+        exposure?: {
+            /** Only expose tools marked `read_safe: true`. Default: false. */
+            readOnly?: boolean;
+            /** Hide servers with `aiRequired: true` when no AI API key is configured. Default: true. */
+            hideAiWhenUnavailable?: boolean;
+            /** When set, only these server IDs are exposed. */
+            allowServers?: string[];
+            /** Server IDs to exclude from exposure. */
+            denyServers?: string[];
+        };
     };
 }
 export interface LTInstance {

package/dashboard/dist/assets/{AdminDashboard-Cfo0mwL2.js → AdminDashboard-BwUGcCxQ.js}

@@ -1,2 +1,2 @@
-import{j as o}from"./vendor-query-B2UbickB.js";import{c as n}from"./tasks-4yL5EfxI.js";import{r as m}from"./index-BpN31nuC.js";import{f as c}from"./useEventHooks-NzIyvoGY.js";import{u}from"./mcp-BXN7-wGF.js";import{P as d}from"./PageHeaderWithStats-CRcQEAO1.js";import"./vendor-react-CXumBFUA.js";import"./vendor-icons-CrrAvF2g.js";function j(){var a;c();const{data:s}=n({limit:1}),{data:e}=m({status:"pending",limit:1}),{data:t}=u(),r=((a=t==null?void 0:t.servers)==null?void 0:a.filter(i=>i.status==="connected").length)??0,l=t?`${r}/${t.total}`:"—";return o.jsx("div",{children:o.jsx(d,{title:"Admin",stats:[{label:"Tasks",value:(s==null?void 0:s.total)??"—"},{label:"Pending Escalations",value:(e==null?void 0:e.total)??"—",dotClass:"bg-status-pending"},{label:"MCP Servers",value:l},{label:"System",value:"Healthy",dotClass:"bg-status-success"}]})})}export{j as AdminDashboard};
-//# sourceMappingURL=AdminDashboard-Cfo0mwL2.js.map
+import{j as o}from"./vendor-query-B2UbickB.js";import{c as n}from"./tasks-BrP_8uEN.js";import{r as m}from"./index-_BRA9uFL.js";import{f as c}from"./useEventHooks-XNNzwADV.js";import{u}from"./mcp-MtXuky8q.js";import{P as d}from"./PageHeaderWithStats-yD_PTbOl.js";import"./vendor-react-CXumBFUA.js";import"./vendor-icons-Doy0g69_.js";function j(){var a;c();const{data:s}=n({limit:1}),{data:e}=m({status:"pending",limit:1}),{data:t}=u(),r=((a=t==null?void 0:t.servers)==null?void 0:a.filter(i=>i.status==="connected").length)??0,l=t?`${r}/${t.total}`:"—";return o.jsx("div",{children:o.jsx(d,{title:"Admin",stats:[{label:"Tasks",value:(s==null?void 0:s.total)??"—"},{label:"Pending Escalations",value:(e==null?void 0:e.total)??"—",dotClass:"bg-status-pending"},{label:"MCP Servers",value:l},{label:"System",value:"Healthy",dotClass:"bg-status-success"}]})})}export{j as AdminDashboard};
+//# sourceMappingURL=AdminDashboard-BwUGcCxQ.js.map

package/dashboard/dist/assets/{AdminDashboard-Cfo0mwL2.js.map → AdminDashboard-BwUGcCxQ.js.map}

@@ -1 +1 @@
-{"version":3,"file":"AdminDashboard-Cfo0mwL2.js","sources":["../../src/pages/admin/AdminDashboard.tsx"],"sourcesContent":["import { useTasks } from '../../api/tasks';\nimport { useEscalations } from '../../api/escalations';\nimport { useEscalationListEvents } from '../../hooks/useEventHooks';\nimport { useMcpServers } from '../../api/mcp';\nimport { PageHeaderWithStats } from '../../components/common/layout/PageHeaderWithStats';\n\nexport function AdminDashboard() {\n  useEscalationListEvents();\n  const { data: taskData } = useTasks({ limit: 1 });\n  const { data: pendingEsc } = useEscalations({ status: 'pending', limit: 1 });\n  const { data: mcpData } = useMcpServers();\n\n  const connectedServers =\n    mcpData?.servers?.filter((s) => s.status === 'connected').length ?? 0;\n  const mcpLabel = mcpData ? `${connectedServers}/${mcpData.total}` : '—';\n\n  return (\n    <div>\n      <PageHeaderWithStats\n        title=\"Admin\"\n        stats={[\n          { label: 'Tasks', value: taskData?.total ?? '—' },\n          { label: 'Pending Escalations', value: pendingEsc?.total ?? '—', dotClass: 'bg-status-pending' },\n          { label: 'MCP Servers', value: mcpLabel },\n          { label: 'System', value: 'Healthy', dotClass: 'bg-status-success' },\n        ]}\n      />\n    </div>\n  );\n}\n"],"names":["AdminDashboard","useEscalationListEvents","taskData","useTasks","pendingEsc","useEscalations","mcpData","useMcpServers","connectedServers","_a","s","mcpLabel","jsx","PageHeaderWithStats"],"mappings":"4UAMO,SAASA,GAAiB,OAC/BC,EAAA,EACA,KAAM,CAAE,KAAMC,CAAA,EAAaC,EAAS,CAAE,MAAO,EAAG,EAC1C,CAAE,KAAMC,CAAA,EAAeC,EAAe,CAAE,OAAQ,UAAW,MAAO,EAAG,EACrE,CAAE,KAAMC,CAAA,EAAYC,EAAA,EAEpBC,IACJC,EAAAH,GAAA,YAAAA,EAAS,UAAT,YAAAG,EAAkB,OAAQC,GAAMA,EAAE,SAAW,aAAa,SAAU,EAChEC,EAAWL,EAAU,GAAGE,CAAgB,IAAIF,EAAQ,KAAK,GAAK,IAEpE,aACG,MAAA,CACC,SAAAM,EAAAA,IAACC,EAAA,CACC,MAAM,QACN,MAAO,CACL,CAAE,MAAO,QAAS,OAAOX,GAAA,YAAAA,EAAU,QAAS,GAAA,EAC5C,CAAE,MAAO,sBAAuB,OAAOE,GAAA,YAAAA,EAAY,QAAS,IAAK,SAAU,mBAAA,EAC3E,CAAE,MAAO,cAAe,MAAOO,CAAA,EAC/B,CAAE,MAAO,SAAU,MAAO,UAAW,SAAU,mBAAA,CAAoB,CACrE,CAAA,EAEJ,CAEJ"}
+{"version":3,"file":"AdminDashboard-BwUGcCxQ.js","sources":["../../src/pages/admin/AdminDashboard.tsx"],"sourcesContent":["import { useTasks } from '../../api/tasks';\nimport { useEscalations } from '../../api/escalations';\nimport { useEscalationListEvents } from '../../hooks/useEventHooks';\nimport { useMcpServers } from '../../api/mcp';\nimport { PageHeaderWithStats } from '../../components/common/layout/PageHeaderWithStats';\n\nexport function AdminDashboard() {\n  useEscalationListEvents();\n  const { data: taskData } = useTasks({ limit: 1 });\n  const { data: pendingEsc } = useEscalations({ status: 'pending', limit: 1 });\n  const { data: mcpData } = useMcpServers();\n\n  const connectedServers =\n    mcpData?.servers?.filter((s) => s.status === 'connected').length ?? 0;\n  const mcpLabel = mcpData ? `${connectedServers}/${mcpData.total}` : '—';\n\n  return (\n    <div>\n      <PageHeaderWithStats\n        title=\"Admin\"\n        stats={[\n          { label: 'Tasks', value: taskData?.total ?? '—' },\n          { label: 'Pending Escalations', value: pendingEsc?.total ?? '—', dotClass: 'bg-status-pending' },\n          { label: 'MCP Servers', value: mcpLabel },\n          { label: 'System', value: 'Healthy', dotClass: 'bg-status-success' },\n        ]}\n      />\n    </div>\n  );\n}\n"],"names":["AdminDashboard","useEscalationListEvents","taskData","useTasks","pendingEsc","useEscalations","mcpData","useMcpServers","connectedServers","_a","s","mcpLabel","jsx","PageHeaderWithStats"],"mappings":"4UAMO,SAASA,GAAiB,OAC/BC,EAAA,EACA,KAAM,CAAE,KAAMC,CAAA,EAAaC,EAAS,CAAE,MAAO,EAAG,EAC1C,CAAE,KAAMC,CAAA,EAAeC,EAAe,CAAE,OAAQ,UAAW,MAAO,EAAG,EACrE,CAAE,KAAMC,CAAA,EAAYC,EAAA,EAEpBC,IACJC,EAAAH,GAAA,YAAAA,EAAS,UAAT,YAAAG,EAAkB,OAAQC,GAAMA,EAAE,SAAW,aAAa,SAAU,EAChEC,EAAWL,EAAU,GAAGE,CAAgB,IAAIF,EAAQ,KAAK,GAAK,IAEpE,aACG,MAAA,CACC,SAAAM,EAAAA,IAACC,EAAA,CACC,MAAM,QACN,MAAO,CACL,CAAE,MAAO,QAAS,OAAOX,GAAA,YAAAA,EAAU,QAAS,GAAA,EAC5C,CAAE,MAAO,sBAAuB,OAAOE,GAAA,YAAAA,EAAY,QAAS,IAAK,SAAU,mBAAA,EAC3E,CAAE,MAAO,cAAe,MAAOO,CAAA,EAC/B,CAAE,MAAO,SAAU,MAAO,UAAW,SAAU,mBAAA,CAAoB,CACrE,CAAA,EAEJ,CAEJ"}