@hotmeshio/long-tail 0.4.18 → 0.4.19

package/build/services/mcp/external-server.js

@@ -0,0 +1,125 @@
+"use strict";
+/**
+ * Unified MCP server for external clients.
+ *
+ * Aggregates tools from all shipped built-in servers into a single
+ * McpServer instance that can be connected to a StreamableHTTPServerTransport.
+ * Created per-request in stateless mode (pure in-memory, no IO).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createUnifiedMcpServer = createUnifiedMcpServer;
+const mcp_js_1 = require("@modelcontextprotocol/sdk/server/mcp.js");
+const logger_1 = require("../../lib/logger");
+const system_1 = require("../../system");
+// ── Shipped server allowlist ─────────────────────────────────────────────────
+// Only these servers are exposed via the /mcp endpoint.
+// Example servers (playwright, gmail, image-tools) are excluded.
+const SHIPPED_SERVERS = new Set([
+    'long-tail-admin',
+    'long-tail-human-queue',
+    'long-tail-file-storage',
+    'long-tail-http-fetch',
+    'long-tail-schema-exchange',
+    'long-tail-oauth',
+    'long-tail-knowledge',
+    'long-tail-docs',
+    'long-tail-events',
+    'long-tail-vision',
+    'long-tail-translation',
+    'long-tail-claude-code',
+]);
+// ── Server instance cache ────────────────────────────────────────────────────
+// Built-in servers are lazily created once and reused across requests.
+// Tool handlers are stateless — safe to share.
+const serverCache = new Map();
+async function getOrCreateServer(name) {
+    if (serverCache.has(name))
+        return serverCache.get(name);
+    const entry = system_1.builtinMcpServerFactories[name];
+    if (!entry)
+        return null;
+    const server = await entry.factory();
+    serverCache.set(name, server);
+    return server;
+}
+// ── Exposure filtering ───────────────────────────────────────────────────────
+function isServerAllowed(name, exposure) {
+    if (!SHIPPED_SERVERS.has(name))
+        return false;
+    if (exposure?.allowServers?.length) {
+        if (!exposure.allowServers.includes(name))
+            return false;
+    }
+    if (exposure?.denyServers?.length) {
+        if (exposure.denyServers.includes(name))
+            return false;
+    }
+    if (exposure?.hideAiWhenUnavailable !== false) {
+        const config = system_1.builtinMcpServerFactories[name]?.config;
+        if (config?.aiRequired) {
+            const hasKey = !!(process.env.OPENAI_API_KEY || process.env.ANTHROPIC_API_KEY);
+            if (!hasKey)
+                return false;
+        }
+    }
+    return true;
+}
+function isToolAllowed(toolName, serverName, exposure, callerScopes) {
+    // Per-caller scope filtering: mcp:read callers only see read_safe tools
+    const isReadOnly = exposure?.readOnly
+        || (callerScopes?.length && callerScopes.includes('mcp:read') && !callerScopes.includes('mcp:full'));
+    if (!isReadOnly)
+        return true;
+    // Check read_safe in the tool manifest
+    const config = system_1.builtinMcpServerFactories[serverName]?.config;
+    const manifest = config?.toolManifest;
+    if (!manifest)
+        return true; // no manifest = allow (conservative)
+    const entry = manifest.find((t) => t.name === toolName);
+    return entry?.read_safe !== false; // allow if read_safe is true or absent
+}
+// ── Unified server creation ──────────────────────────────────────────────────
+/**
+ * Create a unified McpServer with tools from all qualifying shipped servers.
+ * Called per-request in stateless mode. Server instances are cached; only
+ * the McpServer wrapper and tool registrations are fresh (pure in-memory).
+ */
+async function createUnifiedMcpServer(exposure, callerScopes) {
+    const unified = new mcp_js_1.McpServer({ name: 'long-tail', version: '1.0.0' });
+    const registered = new Set();
+    for (const [name, entry] of Object.entries(system_1.builtinMcpServerFactories)) {
+        if (!isServerAllowed(name, exposure))
+            continue;
+        const server = await getOrCreateServer(name);
+        if (!server)
+            continue;
+        const tools = server._registeredTools;
+        if (!tools)
+            continue;
+        for (const [toolName, tool] of Object.entries(tools)) {
+            if (!tool?.handler || !tool.enabled)
+                continue;
+            if (!isToolAllowed(toolName, name, exposure, callerScopes))
+                continue;
+            // Deduplicate: prefix with server short name on collision
+            let finalName = toolName;
+            if (registered.has(toolName)) {
+                const prefix = name.replace('long-tail-', '').replace(/-/g, '_');
+                finalName = `${prefix}_${toolName}`;
+                if (registered.has(finalName))
+                    continue; // still a collision — skip
+            }
+            registered.add(finalName);
+            // Re-register the tool handler on the unified server.
+            // Use the low-level `tool()` API since we already have the parsed handler.
+            unified.registerTool(finalName, {
+                title: tool.title,
+                description: tool.description,
+                inputSchema: tool.inputSchema,
+                annotations: tool.annotations,
+            }, tool.handler);
+        }
+    }
+    logger_1.loggerRegistry.info(`[lt-mcp:endpoint] unified server ready (${registered.size} tools)`);
+    return unified;
+}

package/build/services/mcp/seed-service-account.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Seed the MCP service account at startup.
+ *
+ * Creates a single `mcp-service` bot account with two API keys:
+ *   - `mcp:read`  — read-safe tools only (discovery, monitoring)
+ *   - `mcp:full`  — all tools (automation, orchestration)
+ *
+ * Idempotent — skips creation if the account already exists.
+ * Keys are generated once and logged; they cannot be retrieved again.
+ */
+export declare function seedMcpServiceAccount(): Promise<void>;

package/build/services/mcp/seed-service-account.js

@@ -0,0 +1,77 @@
+"use strict";
+/**
+ * Seed the MCP service account at startup.
+ *
+ * Creates a single `mcp-service` bot account with two API keys:
+ *   - `mcp:read`  — read-safe tools only (discovery, monitoring)
+ *   - `mcp:full`  — all tools (automation, orchestration)
+ *
+ * Idempotent — skips creation if the account already exists.
+ * Keys are generated once and logged; they cannot be retrieved again.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.seedMcpServiceAccount = seedMcpServiceAccount;
+const logger_1 = require("../../lib/logger");
+const crud_1 = require("../user/crud");
+const iam = __importStar(require("../iam"));
+const SERVICE_ACCOUNT_NAME = 'mcp-service';
+async function seedMcpServiceAccount() {
+    try {
+        // Check if account already exists (bot external_id = name)
+        const existing = await (0, crud_1.getUserByExternalId)(SERVICE_ACCOUNT_NAME);
+        if (existing) {
+            logger_1.loggerRegistry.info(`[seed-mcp] ${SERVICE_ACCOUNT_NAME} already exists, skipping`);
+            return;
+        }
+        // Create the service account
+        const bot = await iam.createBot({
+            name: SERVICE_ACCOUNT_NAME,
+            description: 'MCP service account for external tool access. Use the read key to explore, full key to automate.',
+            display_name: 'MCP Service',
+            roles: [{ role: 'system', type: 'member' }],
+        });
+        // Generate read key (scoped to mcp:read)
+        const readKey = await iam.createBotKey(bot.id, 'read', ['mcp:read']);
+        logger_1.loggerRegistry.info(`[seed-mcp] read key: ${readKey.rawKey}`);
+        // Generate full key (scoped to mcp:full)
+        const fullKey = await iam.createBotKey(bot.id, 'full', ['mcp:read', 'mcp:full']);
+        logger_1.loggerRegistry.info(`[seed-mcp] full key: ${fullKey.rawKey}`);
+        logger_1.loggerRegistry.info(`[seed-mcp] ${SERVICE_ACCOUNT_NAME} created with read + full API keys`);
+    }
+    catch (err) {
+        logger_1.loggerRegistry.warn(`[seed-mcp] failed to seed: ${err.message}`);
+    }
+}

package/build/services/role/index.d.ts

@@ -21,7 +21,7 @@ export declare function removeEscalationChain(sourceRole: string, targetRole: st
 export declare function replaceEscalationTargets(sourceRole: string, targets: string[]): Promise<void>;
 /**
  * Check whether a user can escalate from sourceRole to targetRole.
- * Superadmins can escalate to any role.
+ * Superadmins and admin/admin can escalate to any role.
  * Others must hold the sourceRole AND the chain must exist.
  */
 export declare function canEscalateTo(userId: string, sourceRole: string, targetRole: string): Promise<boolean>;

package/build/services/role/index.js

@@ -74,11 +74,11 @@ async function replaceEscalationTargets(sourceRole, targets) {
 }
 /**
  * Check whether a user can escalate from sourceRole to targetRole.
- * Superadmins can escalate to any role.
+ * Superadmins and admin/admin can escalate to any role.
  * Others must hold the sourceRole AND the chain must exist.
  */
 async function canEscalateTo(userId, sourceRole, targetRole) {
-    if (await (0, user_1.isSuperAdmin)(userId))
+    if (await (0, user_1.hasGlobalEscalationAccess)(userId))
         return true;
     if (!(await (0, user_1.hasRole)(userId, sourceRole)))
         return false;

package/build/services/topics/system-topics.js

@@ -19,7 +19,7 @@ function objectSchema(properties) {
 const SYSTEM_TOPICS = [
     // Task lifecycle
     {
-        topic: 'task.created',
+        topic: 'system.task.*.created',
         description: 'A new task has been created and queued for execution.',
         category: 'task',
         payload_schema: objectSchema({ ...WORKFLOW_CONTEXT_PROPS, taskId: { type: 'string', description: 'Task ID' }, status: STATUS_FIELD, data: { type: 'object', description: 'Task input data' } }),
@@ -27,7 +27,7 @@ const SYSTEM_TOPICS = [
         tags: ['lifecycle', 'core'],
     },
     {
-        topic: 'task.started',
+        topic: 'system.task.*.started',
         description: 'A task has begun execution.',
         category: 'task',
         payload_schema: objectSchema({ ...WORKFLOW_CONTEXT_PROPS, taskId: { type: 'string' }, status: STATUS_FIELD }),
@@ -35,7 +35,7 @@ const SYSTEM_TOPICS = [
         tags: ['lifecycle', 'core'],
     },
     {
-        topic: 'task.completed',
+        topic: 'system.task.*.completed',
         description: 'A task has finished successfully.',
         category: 'task',
         payload_schema: objectSchema({ ...WORKFLOW_CONTEXT_PROPS, taskId: { type: 'string' }, status: STATUS_FIELD, milestones: { type: 'array', items: { type: 'object' }, description: 'Milestones reported' }, data: { type: 'object', description: 'Task result data' } }),
@@ -43,7 +43,7 @@ const SYSTEM_TOPICS = [
         tags: ['lifecycle', 'core'],
     },
     {
-        topic: 'task.escalated',
+        topic: 'system.task.*.escalated',
         description: 'A task has been escalated for human review.',
         category: 'task',
         payload_schema: objectSchema({ ...WORKFLOW_CONTEXT_PROPS, taskId: { type: 'string' }, status: STATUS_FIELD, data: { type: 'object' } }),
@@ -51,7 +51,7 @@ const SYSTEM_TOPICS = [
         tags: ['lifecycle', 'escalation'],
     },
     {
-        topic: 'task.failed',
+        topic: 'system.task.*.failed',
         description: 'A task has failed execution.',
         category: 'task',
         payload_schema: objectSchema({ ...WORKFLOW_CONTEXT_PROPS, taskId: { type: 'string' }, status: STATUS_FIELD, data: { type: 'object', description: 'Error details' } }),
@@ -60,7 +60,7 @@ const SYSTEM_TOPICS = [
     },
     // Workflow lifecycle
     {
-        topic: 'workflow.started',
+        topic: 'system.workflow.*.started',
         description: 'A workflow execution has started.',
         category: 'workflow',
         payload_schema: objectSchema({ ...WORKFLOW_CONTEXT_PROPS, taskId: { type: 'string' }, status: STATUS_FIELD }),
@@ -68,7 +68,7 @@ const SYSTEM_TOPICS = [
         tags: ['lifecycle', 'core'],
     },
     {
-        topic: 'workflow.completed',
+        topic: 'system.workflow.*.completed',
         description: 'A workflow execution has completed successfully.',
         category: 'workflow',
         payload_schema: objectSchema({ ...WORKFLOW_CONTEXT_PROPS, taskId: { type: 'string' }, status: STATUS_FIELD, data: { type: 'object' } }),
@@ -76,7 +76,7 @@ const SYSTEM_TOPICS = [
         tags: ['lifecycle', 'core'],
     },
     {
-        topic: 'workflow.failed',
+        topic: 'system.workflow.*.failed',
         description: 'A workflow execution has failed.',
         category: 'workflow',
         payload_schema: objectSchema({ ...WORKFLOW_CONTEXT_PROPS, taskId: { type: 'string' }, status: STATUS_FIELD, data: { type: 'object', description: 'Error details' } }),
@@ -85,7 +85,7 @@ const SYSTEM_TOPICS = [
     },
     // Escalation lifecycle
     {
-        topic: 'escalation.created',
+        topic: 'system.escalation.*.created',
         description: 'A new escalation has been created for human review.',
         category: 'escalation',
         payload_schema: objectSchema({ ...WORKFLOW_CONTEXT_PROPS, escalationId: { type: 'string' }, status: STATUS_FIELD, data: { type: 'object' } }),
@@ -93,7 +93,7 @@ const SYSTEM_TOPICS = [
         tags: ['lifecycle', 'hitl'],
     },
     {
-        topic: 'escalation.resolved',
+        topic: 'system.escalation.*.resolved',
         description: 'An escalation has been resolved by a human operator.',
         category: 'escalation',
         payload_schema: objectSchema({ ...WORKFLOW_CONTEXT_PROPS, escalationId: { type: 'string' }, status: STATUS_FIELD, data: { type: 'object' } }),
@@ -101,7 +101,7 @@ const SYSTEM_TOPICS = [
         tags: ['lifecycle', 'hitl'],
     },
     {
-        topic: 'escalation.claimed',
+        topic: 'system.escalation.*.claimed',
         description: 'An escalation has been claimed by an operator.',
         category: 'escalation',
         payload_schema: objectSchema({ ...WORKFLOW_CONTEXT_PROPS, escalationId: { type: 'string' }, status: STATUS_FIELD }),
@@ -109,7 +109,7 @@ const SYSTEM_TOPICS = [
         tags: ['lifecycle', 'hitl'],
     },
     {
-        topic: 'escalation.released',
+        topic: 'system.escalation.*.released',
         description: 'An escalation has been released back to the queue.',
         category: 'escalation',
         payload_schema: objectSchema({ ...WORKFLOW_CONTEXT_PROPS, escalationId: { type: 'string' }, status: STATUS_FIELD }),
@@ -118,7 +118,7 @@ const SYSTEM_TOPICS = [
     },
     // Activity lifecycle
     {
-        topic: 'activity.started',
+        topic: 'system.activity.*.*.started',
         description: 'A YAML workflow activity step has started.',
         category: 'activity',
         payload_schema: objectSchema({ ...WORKFLOW_CONTEXT_PROPS, activityName: { type: 'string', description: 'Activity step name' } }),
@@ -126,7 +126,7 @@ const SYSTEM_TOPICS = [
         tags: ['lifecycle', 'yaml'],
     },
     {
-        topic: 'activity.completed',
+        topic: 'system.activity.*.*.completed',
         description: 'A YAML workflow activity step has completed.',
         category: 'activity',
         payload_schema: objectSchema({ ...WORKFLOW_CONTEXT_PROPS, activityName: { type: 'string' }, data: { type: 'object' } }),
@@ -134,7 +134,7 @@ const SYSTEM_TOPICS = [
         tags: ['lifecycle', 'yaml'],
     },
     {
-        topic: 'activity.failed',
+        topic: 'system.activity.*.*.failed',
         description: 'A YAML workflow activity step has failed.',
         category: 'activity',
         payload_schema: objectSchema({ ...WORKFLOW_CONTEXT_PROPS, activityName: { type: 'string' }, data: { type: 'object', description: 'Error details' } }),
@@ -143,7 +143,7 @@ const SYSTEM_TOPICS = [
     },
     // Knowledge lifecycle
     {
-        topic: 'knowledge.stored',
+        topic: 'system.knowledge.*.stored',
         description: 'A knowledge entry has been written to the knowledge store.',
         category: 'knowledge',
         payload_schema: objectSchema({ domain: { type: 'string', description: 'Knowledge domain' }, key: { type: 'string', description: 'Knowledge entry key' } }),
@@ -151,7 +151,7 @@ const SYSTEM_TOPICS = [
         tags: ['lifecycle', 'knowledge'],
     },
     {
-        topic: 'knowledge.deleted',
+        topic: 'system.knowledge.*.deleted',
         description: 'A knowledge entry has been removed from the knowledge store.',
         category: 'knowledge',
         payload_schema: objectSchema({ domain: { type: 'string', description: 'Knowledge domain' }, key: { type: 'string', description: 'Knowledge entry key' } }),
@@ -160,7 +160,7 @@ const SYSTEM_TOPICS = [
     },
     // File storage
     {
-        topic: 'file.stored',
+        topic: 'system.file.stored',
         description: 'A file has been written to storage.',
         category: 'file',
         payload_schema: objectSchema({
@@ -175,7 +175,7 @@ const SYSTEM_TOPICS = [
         tags: ['lifecycle', 'file', 'storage'],
     },
     {
-        topic: 'file.deleted',
+        topic: 'system.file.deleted',
         description: 'A file has been removed from storage.',
         category: 'file',
         payload_schema: objectSchema({
@@ -189,7 +189,7 @@ const SYSTEM_TOPICS = [
     },
     // Agent lifecycle
     {
-        topic: 'agent.started',
+        topic: 'system.agent.*.started',
         description: 'An agent reaction workflow has started in response to an event.',
         category: 'agent',
         payload_schema: objectSchema({ agentId: { type: 'string', description: 'Agent ID' }, agentName: { type: 'string', description: 'Agent name' }, status: STATUS_FIELD, data: { type: 'object', description: 'Trigger context' } }),
@@ -197,7 +197,7 @@ const SYSTEM_TOPICS = [
         tags: ['lifecycle', 'agent'],
     },
     {
-        topic: 'agent.completed',
+        topic: 'system.agent.*.completed',
         description: 'An agent reaction workflow has completed successfully.',
         category: 'agent',
         payload_schema: objectSchema({ agentId: { type: 'string' }, agentName: { type: 'string' }, status: STATUS_FIELD, data: { type: 'object' } }),
@@ -205,7 +205,7 @@ const SYSTEM_TOPICS = [
         tags: ['lifecycle', 'agent'],
     },
     {
-        topic: 'agent.failed',
+        topic: 'system.agent.*.failed',
         description: 'An agent reaction workflow has failed.',
         category: 'agent',
         payload_schema: objectSchema({ agentId: { type: 'string' }, agentName: { type: 'string' }, status: STATUS_FIELD, data: { type: 'object', description: 'Error details' } }),
@@ -213,7 +213,7 @@ const SYSTEM_TOPICS = [
         tags: ['lifecycle', 'agent', 'error'],
     },
     {
-        topic: 'agent.status_changed',
+        topic: 'system.agent.*.status_changed',
         description: 'An agent\'s status has changed (activated, paused, errored).',
         category: 'agent',
         payload_schema: objectSchema({ agentId: { type: 'string' }, agentName: { type: 'string' }, status: STATUS_FIELD }),
@@ -222,7 +222,7 @@ const SYSTEM_TOPICS = [
     },
     // Milestone
     {
-        topic: 'milestone',
+        topic: 'system.milestone.*',
         description: 'A workflow or activity has reported progress milestones.',
         category: 'milestone',
         payload_schema: objectSchema({
@@ -240,7 +240,11 @@ const SYSTEM_TOPICS = [
  * `app.*` → 'app', everything else → first segment.
  */
 function inferCategory(topic) {
-    return topic.startsWith('app.') ? 'app' : topic.split('.')[0];
+    if (topic.startsWith('app.'))
+        return 'app';
+    if (topic.startsWith('system.'))
+        return topic.split('.')[1]; // system.workflow.* → 'workflow'
+    return topic.split('.')[0];
 }
 /**
  * Seed all 22 built-in system topics into the catalog.

package/build/services/user/index.d.ts

@@ -1,6 +1,6 @@
 export { CreateUserInput, UpdateUserInput, VALID_ROLE_TYPES } from './types';
 export { createUser, getUser, getUserByExternalId, getUserByEmail, updateUser, deleteUser, listUsers, } from './crud';
 export { isValidRoleType, addUserRole, removeUserRole, getUserRoles, hasRole, hasRoleType, } from './roles';
-export { isSuperAdmin, isGroupAdmin, canManageRole } from './rbac';
+export { isSuperAdmin, isGroupAdmin, canManageRole, hasGlobalEscalationAccess } from './rbac';
 export { verifyPassword } from './auth';
 export { seedAdmin } from './seed-admin';

package/build/services/user/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.seedAdmin = exports.verifyPassword = exports.canManageRole = exports.isGroupAdmin = exports.isSuperAdmin = exports.hasRoleType = exports.hasRole = exports.getUserRoles = exports.removeUserRole = exports.addUserRole = exports.isValidRoleType = exports.listUsers = exports.deleteUser = exports.updateUser = exports.getUserByEmail = exports.getUserByExternalId = exports.getUser = exports.createUser = exports.VALID_ROLE_TYPES = void 0;
+exports.seedAdmin = exports.verifyPassword = exports.hasGlobalEscalationAccess = exports.canManageRole = exports.isGroupAdmin = exports.isSuperAdmin = exports.hasRoleType = exports.hasRole = exports.getUserRoles = exports.removeUserRole = exports.addUserRole = exports.isValidRoleType = exports.listUsers = exports.deleteUser = exports.updateUser = exports.getUserByEmail = exports.getUserByExternalId = exports.getUser = exports.createUser = exports.VALID_ROLE_TYPES = void 0;
 var types_1 = require("./types");
 Object.defineProperty(exports, "VALID_ROLE_TYPES", { enumerable: true, get: function () { return types_1.VALID_ROLE_TYPES; } });
 var crud_1 = require("./crud");
@@ -22,6 +22,7 @@ var rbac_1 = require("./rbac");
 Object.defineProperty(exports, "isSuperAdmin", { enumerable: true, get: function () { return rbac_1.isSuperAdmin; } });
 Object.defineProperty(exports, "isGroupAdmin", { enumerable: true, get: function () { return rbac_1.isGroupAdmin; } });
 Object.defineProperty(exports, "canManageRole", { enumerable: true, get: function () { return rbac_1.canManageRole; } });
+Object.defineProperty(exports, "hasGlobalEscalationAccess", { enumerable: true, get: function () { return rbac_1.hasGlobalEscalationAccess; } });
 var auth_1 = require("./auth");
 Object.defineProperty(exports, "verifyPassword", { enumerable: true, get: function () { return auth_1.verifyPassword; } });
 var seed_admin_1 = require("./seed-admin");

package/build/services/user/rbac.d.ts

@@ -13,3 +13,14 @@ export declare function isGroupAdmin(userId: string, role: string): Promise<bool
  * Superadmins can manage any role. Admins can manage roles they belong to.
  */
 export declare function canManageRole(actorId: string, role: string): Promise<boolean>;
+/**
+ * Can this user act on escalations across all roles?
+ *
+ * True for:
+ * - superadmin (any role with type 'superadmin')
+ * - admin/admin (the named 'admin' role with type 'admin')
+ *
+ * These users see all escalations, can claim/resolve/escalate across
+ * all roles, and can perform bulk actions.
+ */
+export declare function hasGlobalEscalationAccess(userId: string): Promise<boolean>;

package/build/services/user/rbac.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.isSuperAdmin = isSuperAdmin;
 exports.isGroupAdmin = isGroupAdmin;
 exports.canManageRole = canManageRole;
+exports.hasGlobalEscalationAccess = hasGlobalEscalationAccess;
 const db_1 = require("../../lib/db");
 const roles_1 = require("./roles");
 const sql_1 = require("./sql");
@@ -30,3 +31,19 @@ async function isGroupAdmin(userId, role) {
 async function canManageRole(actorId, role) {
     return isGroupAdmin(actorId, role);
 }
+/**
+ * Can this user act on escalations across all roles?
+ *
+ * True for:
+ * - superadmin (any role with type 'superadmin')
+ * - admin/admin (the named 'admin' role with type 'admin')
+ *
+ * These users see all escalations, can claim/resolve/escalate across
+ * all roles, and can perform bulk actions.
+ */
+async function hasGlobalEscalationAccess(userId) {
+    if (await isSuperAdmin(userId))
+        return true;
+    const roles = await (0, roles_1.getUserRoles)(userId);
+    return roles.some((r) => r.role === 'admin' && r.type === 'admin');
+}

package/build/services/user/sso-provision.d.ts

@@ -0,0 +1,19 @@
+import type { SSOIdentity, LTSSOConfig } from '../../types/auth';
+export interface ProvisionedUser {
+    userId: string;
+    roles: Array<{
+        role: string;
+        type: string;
+    }>;
+    created: boolean;
+}
+/**
+ * JIT provision or sync an SSO identity to lt_users.
+ *
+ * Lookup by `external_id`. If not found, create with resolved roles.
+ * If found, sync any new roles from the identity.
+ *
+ * Returns the internal `lt_users.id` (UUID) that all RBAC and
+ * escalation queries use.
+ */
+export declare function ssoProvision(identity: SSOIdentity, ssoConfig: LTSSOConfig): Promise<ProvisionedUser>;

package/build/services/user/sso-provision.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ssoProvision = ssoProvision;
+const logger_1 = require("../../lib/logger");
+const crud_1 = require("./crud");
+const roles_1 = require("./roles");
+/**
+ * JIT provision or sync an SSO identity to lt_users.
+ *
+ * Lookup by `external_id`. If not found, create with resolved roles.
+ * If found, sync any new roles from the identity.
+ *
+ * Returns the internal `lt_users.id` (UUID) that all RBAC and
+ * escalation queries use.
+ */
+async function ssoProvision(identity, ssoConfig) {
+    const defaultRoleType = ssoConfig.defaultRoleType || 'member';
+    const ltRoles = resolveRoles(identity.roles || [], defaultRoleType, ssoConfig.roleMap);
+    const existing = await (0, crud_1.getUserByExternalId)(identity.externalId);
+    if (existing) {
+        // Sync roles: ensure all resolved roles exist on the user
+        const currentRoles = await (0, roles_1.getUserRoles)(existing.id);
+        for (const lr of ltRoles) {
+            const has = currentRoles.some((r) => r.role === lr.role);
+            if (!has) {
+                await (0, roles_1.addUserRole)(existing.id, lr.role, lr.type);
+            }
+        }
+        const updatedRoles = await (0, roles_1.getUserRoles)(existing.id);
+        return {
+            userId: existing.id,
+            roles: updatedRoles.map((r) => ({ role: r.role, type: r.type })),
+            created: false,
+        };
+    }
+    // Create new user
+    const user = await (0, crud_1.createUser)({
+        external_id: identity.externalId,
+        email: identity.email || undefined,
+        display_name: identity.displayName || identity.externalId,
+        roles: ltRoles.map((r) => ({ role: r.role, type: r.type })),
+        metadata: identity.metadata,
+    });
+    logger_1.loggerRegistry.info(`[lt-sso] provisioned user: ${identity.externalId} → ${user.id}`);
+    return {
+        userId: user.id,
+        roles: (user.roles || []).map((r) => ({ role: r.role, type: r.type })),
+        created: true,
+    };
+}
+function resolveRoles(hostRoles, defaultRoleType, roleMap) {
+    const mapped = roleMap
+        ? hostRoles.filter((r) => roleMap[r]).map((r) => roleMap[r])
+        : hostRoles;
+    if (mapped.length === 0) {
+        return [{ role: defaultRoleType, type: defaultRoleType }];
+    }
+    return mapped.map((role) => ({
+        role,
+        type: role === 'superadmin' ? 'superadmin' : role === 'admin' ? 'admin' : 'member',
+    }));
+}

package/build/services/workflow-invocation.js

@@ -148,15 +148,17 @@ async function checkInvocationRoles(workflowType, userId, authRole) {
     // Superadmin from JWT bypasses all invocation role checks
     if (authRole === 'superadmin')
         return;
-    const user = await userService.getUserByExternalId(userId);
+    const user = await userService.getUser(userId);
     if (!user) {
         throw new InvocationError('User not registered', 403);
     }
     const userRoles = user.roles.map((r) => r.role);
     const hasInvocationRole = wfConfig.invocation_roles.some((r) => userRoles.includes(r));
     if (!hasInvocationRole) {
-        const isSuperAdmin = user.roles.some((r) => r.type === 'superadmin');
-        if (!isSuperAdmin) {
+        // superadmin and admin/admin bypass role checks
+        const hasGlobalAccess = user.roles.some((r) => r.type === 'superadmin')
+            || user.roles.some((r) => r.role === 'admin' && r.type === 'admin');
+        if (!hasGlobalAccess) {
             throw new InvocationError('Insufficient role for invocation', 403);
         }
     }

package/build/start/config.js

@@ -100,4 +100,10 @@ async function applyServerAuthConfig(startConfig) {
             baseUrl: startConfig.auth.oauth.baseUrl,
         });
     }
+    // SSO — store config for requireAuth fallback and /api/auth/sso exchange
+    if (startConfig.auth?.sso) {
+        const { setSSOConfig } = await Promise.resolve().then(() => __importStar(require('../modules/sso')));
+        setSSOConfig(startConfig.auth.sso);
+        logger_1.loggerRegistry.info('[long-tail] SSO enabled — host auth will be trusted');
+    }
 }