@hotmeshio/long-tail 0.5.10 → 0.5.12

package/build/services/task/sql.d.ts

@@ -5,7 +5,12 @@ export declare const GET_TASK_BY_SIGNAL_ID = "SELECT * FROM lt_tasks WHERE signa
 export declare const GET_TASK_BY_WORKFLOW_ID = "SELECT * FROM lt_tasks WHERE workflow_id = $1 ORDER BY created_at DESC LIMIT 1";
 export declare const RESOLVE_TASK_BY_WORKFLOW_ID = "SELECT workflow_type, task_queue FROM lt_tasks WHERE workflow_id = $1 ORDER BY created_at DESC LIMIT 1";
 export declare const RESOLVE_CONFIG_TASK_QUEUE = "SELECT task_queue FROM lt_config_workflows WHERE workflow_type = $1";
-export declare const RESOLVE_JOB_ENTITY = "SELECT entity FROM durable.jobs WHERE key = $1 LIMIT 1";
+/**
+ * Look up a job's entity tag in a specific HotMesh namespace. The namespace is a
+ * Postgres schema name, so it is interpolated (not a bind param) — same pattern
+ * as the diagnostics queries. Callers pass the trusted app_id from config.
+ */
+export declare const RESOLVE_JOB_ENTITY: (appId: string) => string;
 export declare const GET_PROCESS_TASKS = "SELECT * FROM lt_tasks WHERE origin_id = $1 ORDER BY created_at ASC";
 /**
  * Build the process-stats totals CTE query for a given interval.

package/build/services/task/sql.js

@@ -25,7 +25,13 @@ exports.GET_TASK_BY_WORKFLOW_ID = `SELECT * FROM lt_tasks WHERE workflow_id = $1
 // ---- resolve.ts queries ---------------------------------------------------
 exports.RESOLVE_TASK_BY_WORKFLOW_ID = `SELECT workflow_type, task_queue FROM lt_tasks WHERE workflow_id = $1 ORDER BY created_at DESC LIMIT 1`;
 exports.RESOLVE_CONFIG_TASK_QUEUE = `SELECT task_queue FROM lt_config_workflows WHERE workflow_type = $1`;
-exports.RESOLVE_JOB_ENTITY = `SELECT entity FROM durable.jobs WHERE key = $1 LIMIT 1`;
+/**
+ * Look up a job's entity tag in a specific HotMesh namespace. The namespace is a
+ * Postgres schema name, so it is interpolated (not a bind param) — same pattern
+ * as the diagnostics queries. Callers pass the trusted app_id from config.
+ */
+const RESOLVE_JOB_ENTITY = (appId) => `SELECT entity FROM "${appId}".jobs WHERE key = $1 LIMIT 1`;
+exports.RESOLVE_JOB_ENTITY = RESOLVE_JOB_ENTITY;
 // ---- process.ts queries ---------------------------------------------------
 exports.GET_PROCESS_TASKS = `SELECT * FROM lt_tasks WHERE origin_id = $1 ORDER BY created_at ASC`;
 /**

package/build/start/adapters.js

@@ -15,12 +15,15 @@ const adapter_1 = require("../services/mcp/adapter");
 const escalation_strategy_1 = require("../services/escalation-strategy");
 const default_1 = require("../services/escalation-strategy/default");
 const mcp_2 = require("../services/escalation-strategy/mcp");
+const features_1 = require("../modules/features");
 const socket_auth_1 = require("./socket-auth");
 /**
  * Register all adapters (logging, telemetry, events, maintenance,
  * escalation strategy, MCP) based on the startup config.
  */
 function registerAdapters(startConfig) {
+    // Dashboard feature flags (default permissive; deployment opts out).
+    (0, features_1.configureFeatureFlags)(startConfig.features);
     // Logging (register first so subsequent log calls use it)
     if (startConfig.logging?.adapter) {
         logger_1.loggerRegistry.register(startConfig.logging.adapter);

package/build/system/mcp-servers/admin/diagnostics.d.ts

@@ -1,10 +1,17 @@
 /**
- * Diagnostics tools — mirrors routes/diagnostics.ts
+ * Diagnostics tools — mirrors routes/diagnostics.ts. Pure read-only.
  *
  * Three tools:
- *   diagnose_job            — full per-job diagnosis: events + stream messages + findings
- *   find_stalled_jobs       — fleet-level: running jobs with no recent progress
- *   find_orphaned_signals   — fleet-level: suspended jobs with no escalation row
+ *   diagnose_job            — per-job verdict (compact by default; opt into events/streams)
+ *   find_stalled_jobs       — fleet-level: running jobs with no recent status change
+ *   find_orphaned_signals   — fleet-level: suspended waiters with no escalation row
+ *
+ * Efficient usage: start fleet-wide (find_orphaned_signals for the genuinely
+ * broken case, find_stalled_jobs for candidates), then call diagnose_job on a
+ * specific id for root cause — do not fan diagnose_job across every job.
+ * diagnose_job returns the verdict only by default; add include: ['events'] or
+ * ['streams'] for the heavy arrays. For full raw message payloads, use the
+ * stream browser (list_stream_messages filtered by jid).
  */
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 export declare function registerDiagnosticsTools(server: McpServer): void;

package/build/system/mcp-servers/admin/diagnostics.js

@@ -39,17 +39,23 @@ const schemas_1 = require("./schemas");
 function registerDiagnosticsTools(server) {
     server.registerTool('diagnose_job', {
         title: 'Diagnose Job',
-        description: 'Complete diagnostic for a single workflow job. Combines the execution event ' +
-            'timeline (from exportWorkflowExecution) with the raw stream messages for that ' +
-            'job (engine + worker, including full JSONB payload, retry state, and timing) ' +
-            'and the escalation row from hmsh_escalations. Returns structured findings[] ' +
-            'with confidence, evidence, and treatment options. ' +
-            'Use when a workflow is stalled, stuck at a condition, has dead-lettered ' +
-            'messages, or shows unexpected behavior. Call find_stalled_jobs or ' +
-            'find_orphaned_signals first to surface job IDs, then call this per job.',
+        description: 'Read-only diagnosis for a single workflow job. Compact by default — returns the ' +
+            'verdict only: status, idle_for_ms, workflow_type, stream_summary (counts), the ' +
+            'escalation row from hmsh_escalations, and structured findings[] with confidence, ' +
+            'evidence, and read-only guidance (where to look next — never recovery; HotMesh ' +
+            'state cannot be unwound). ' +
+            'A workflow sitting at a condition()/waitFor()/sleepFor() for a long time is ' +
+            'classified as a healthy wait, not a fault — only dead-letter, reservation-leak, ' +
+            'or a suspended-waiter-with-no-escalation indicate a real problem. ' +
+            'To opt into the heavy arrays pass include: ["events"] for the execution timeline ' +
+            '(capped by max_events, default 500) and/or include: ["streams"] for raw engine+worker ' +
+            'messages; large result/message payloads are summarized to {bytes,preview,truncated}. ' +
+            'For full untruncated payloads use list_stream_messages filtered by jid (returned in ' +
+            'raw_messages). Call find_orphaned_signals / find_stalled_jobs first to surface IDs, ' +
+            'then this per job.',
         inputSchema: schemas_1.diagnoseJobSchema,
     }, async (args) => {
-        const result = await api.diagnose({ workflowId: args.workflow_id, appId: args.app_id });
+        const result = await api.diagnose({ workflowId: args.workflow_id, appId: args.app_id, maxEvents: args.max_events, include: args.include, verbosity: args.verbosity });
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
         }
@@ -57,15 +63,18 @@ function registerDiagnosticsTools(server) {
     });
     server.registerTool('find_stalled_jobs', {
         title: 'Find Stalled Jobs',
-        description: 'Find all running jobs that have not progressed in N minutes. ' +
-            'Returns workflow_id, workflow_type, stalled_ms, created_at, updated_at. ' +
-            'Use as a first step to surface the scope of a stall incident. ' +
-            'Follow up with diagnose_job on individual results for root cause.',
+        description: 'Find running jobs with no status change in N minutes (bounded, indexed; cap 200). ' +
+            'IMPORTANT: "no recent change" is NOT "broken" — HotMesh bumps updated_at only on ' +
+            'status change, so a frozen timestamp is the normal signature of a workflow waiting ' +
+            'at a condition()/waitFor()/sleepFor(). Each row carries a `likely` classification: ' +
+            '"waiting" (has a pending escalation — healthy) vs "no_recent_progress" (worth a ' +
+            'closer look). Returns workflow_id, workflow_type, idle_ms, has_open_escalation, likely. ' +
+            'Triage the "no_recent_progress" rows with diagnose_job for root cause.',
         inputSchema: schemas_1.findStalledJobsSchema,
     }, async (args) => {
         const result = await api.stalledJobs({
             appId: args.app_id,
-            stalledMinutes: args.stalled_minutes,
+            idleMinutes: args.idle_minutes,
             workflowType: args.workflow_type,
             limit: args.limit,
         });
@@ -76,16 +85,19 @@ function registerDiagnosticsTools(server) {
     });
     server.registerTool('find_orphaned_signals', {
         title: 'Find Orphaned Signals',
-        description: 'Find running workflows that are suspended at a condition() call ' +
-            '(waiter Leg1 committed, signal registered) but have no corresponding ' +
-            'escalation row in hmsh_escalations. These are permanently stalled — ' +
-            'the workflow is waiting for a signal that nothing will ever send. ' +
-            'Returns job_id, signal_id, workflow_name, suspended_at, stalled_ms, ' +
-            'and missing_queue_config (true = pre-0.22 SDK, false = DB error at commit time). ' +
-            'Call diagnose_job on any result for the full picture and recovery options.',
+        description: 'Find running workflows suspended at a condition() (waiter committed, signal ' +
+            'registered) that have NO escalation row in hmsh_escalations — the genuinely ' +
+            'broken case: the workflow waits for a signal nothing will send. ' +
+            'Scans a recent window only (within_hours, default 24, max 720) to stay off a ' +
+            'full-history scan of the partitioned worker_streams table; widen the window ' +
+            'deliberately to reach older orphans, narrow it to go faster. ' +
+            'Returns job_id, signal_id, workflow_name, suspended_at, waiting_ms, and ' +
+            'missing_queue_config (true = pre-0.22 SDK, false = error at commit time), plus ' +
+            'the within_hours actually applied. Call diagnose_job on any result for the full ' +
+            'picture. This is read-only — resolving an orphan needs engineering review.',
         inputSchema: schemas_1.findOrphanedSignalsSchema,
     }, async (args) => {
-        const result = await api.orphanedSignals({ appId: args.app_id, limit: args.limit });
+        const result = await api.orphanedSignals({ appId: args.app_id, withinHours: args.within_hours, limit: args.limit });
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
         }

package/build/system/mcp-servers/admin/escalations.d.ts

@@ -1,5 +1,11 @@
 /**
  * Escalation tools — mirrors routes/escalations/
+ *
+ * Every tool runs as the `lt-system` bot. The escalation RBAC helpers
+ * (getVisibleRoles / getUserRoles / hasGlobalEscalationAccess) query a uuid
+ * column, so the bot's external_id string ('lt-system') would blow up with
+ * `invalid input syntax for type uuid`. `systemAuth()` resolves the bot's real
+ * UUID once and caches it; that UUID (a superadmin) is passed as the principal.
  */
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 export declare function registerEscalationTools(server: McpServer): void;

package/build/system/mcp-servers/admin/escalations.js

@@ -35,47 +35,109 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerEscalationTools = registerEscalationTools;
 const escalationService = __importStar(require("../../../services/escalation"));
+const escalationApi = __importStar(require("../../../api/escalations"));
 const escalationMetaApi = __importStar(require("../../../api/escalations/metadata"));
 const escalationBulkApi = __importStar(require("../../../api/escalations/bulk"));
+const iam_1 = require("../../../services/iam");
 const schemas_1 = require("./schemas");
+let systemPrincipalId = null;
+/**
+ * Resolve (and cache) the lt-system bot's real UUID. The escalation RBAC helpers
+ * query the uuid `user_id` column, so the external_id string 'lt-system' would
+ * raise `invalid input syntax for type uuid`. The bot is a superadmin, so it has
+ * global escalation access.
+ */
+async function systemAuth() {
+    if (!systemPrincipalId)
+        systemPrincipalId = await (0, iam_1.ensureSystemBot)();
+    return { userId: systemPrincipalId, role: 'superadmin' };
+}
+/** Project the full escalation record to the MCP-facing shape, including metadata. */
+function projectEscalation(e) {
+    return {
+        id: e.id,
+        type: e.type,
+        subtype: e.subtype,
+        role: e.role,
+        priority: e.priority,
+        status: e.status,
+        description: e.description,
+        workflow_id: e.workflow_id,
+        workflow_type: e.workflow_type,
+        assigned_to: e.assigned_to,
+        assigned_until: e.assigned_until,
+        signal_key: e.signal_key,
+        metadata: e.metadata,
+        created_at: e.created_at,
+        updated_at: e.updated_at,
+    };
+}
 function registerEscalationTools(server) {
+    // ── Read-only ───────────────────────────────────────────────────────────────
     // mirrors GET /api/escalations
     server.registerTool('find_escalations', {
         title: 'Find Escalations',
-        description: 'Search escalations with optional filters. Returns records with ' +
-            'type, role, priority, status, description, and assignment info.',
+        description: 'Search escalations with optional filters (status, role, type, subtype, ' +
+            'assigned_to, priority), free-text `search`, and sorting. `search` matches ' +
+            'across description, type/subtype, role, workflow/origin id, and metadata values ' +
+            '(e.g. a correlation key like an order id) server-side over the full result set. ' +
+            'Returns full records including metadata, workflow linkage, assignment, and signal_key.',
         inputSchema: schemas_1.findEscalationsSchema,
     }, async (args) => {
-        const { escalations, total } = await escalationService.listEscalations({
+        const result = await escalationApi.listEscalations({
             status: args.status,
             role: args.role,
             type: args.type,
+            subtype: args.subtype,
+            assigned_to: args.assigned_to,
+            search: args.search,
             priority: args.priority,
             limit: args.limit,
             offset: args.offset,
-        });
+            sort_by: args.sort_by,
+            order: args.order,
+        }, await systemAuth());
+        if (result.error) {
+            return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
+        }
+        const { escalations, total } = result.data;
         return {
             content: [{
                     type: 'text',
                     text: JSON.stringify({
                         total,
                         count: escalations.length,
-                        escalations: escalations.map((e) => ({
-                            id: e.id,
-                            type: e.type,
-                            subtype: e.subtype,
-                            role: e.role,
-                            priority: e.priority,
-                            status: e.status,
-                            description: e.description,
-                            workflow_type: e.workflow_type,
-                            assigned_to: e.assigned_to,
-                            created_at: e.created_at,
-                        })),
+                        escalations: escalations.map(projectEscalation),
                     }),
                 }],
         };
     });
+    // mirrors GET /api/escalations/:id
+    server.registerTool('get_escalation', {
+        title: 'Get Escalation',
+        description: 'Get a single escalation by ID — the full record including metadata, envelope ' +
+            'linkage, resolver/escalation payloads, signal_key, and assignment state.',
+        inputSchema: schemas_1.getEscalationSchema,
+    }, async (args) => {
+        const result = await escalationApi.getEscalation({ id: args.id }, await systemAuth());
+        if (result.error) {
+            return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
+        }
+        return { content: [{ type: 'text', text: JSON.stringify(result.data) }] };
+    });
+    // mirrors GET /api/escalations/by-workflow/:workflowId
+    server.registerTool('get_escalations_by_workflow', {
+        title: 'Get Escalations by Workflow',
+        description: 'List all escalations linked to a specific workflow ID, newest first. Returns ' +
+            'full records including metadata.',
+        inputSchema: schemas_1.getEscalationsByWorkflowSchema,
+    }, async (args) => {
+        const result = await escalationApi.getEscalationsByWorkflowId({ workflowId: args.workflow_id });
+        if (result.error) {
+            return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
+        }
+        return { content: [{ type: 'text', text: JSON.stringify(result.data) }] };
+    });
     // mirrors GET /api/escalations/stats
     server.registerTool('get_escalation_stats', {
         title: 'Get Escalation Stats',
@@ -85,12 +147,23 @@ function registerEscalationTools(server) {
     }, async (args) => {
         const stats = await escalationService.getEscalationStats(undefined, args.period);
         return {
-            content: [{
-                    type: 'text',
-                    text: JSON.stringify(stats),
-                }],
+            content: [{ type: 'text', text: JSON.stringify(stats) }],
         };
     });
+    // mirrors GET /api/escalations/by-metadata
+    server.registerTool('find_by_metadata', {
+        title: 'Find by Metadata',
+        description: 'Find escalations by a metadata key-value pair (e.g. a correlation key written ' +
+            'into metadata when the escalation was raised).',
+        inputSchema: schemas_1.findByMetadataSchema,
+    }, async (args) => {
+        const result = await escalationMetaApi.findByMetadata(args, await systemAuth());
+        if (result.error) {
+            return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
+        }
+        return { content: [{ type: 'text', text: JSON.stringify(result.data) }] };
+    });
+    // ── Read-write ────────────────────────────────────────────────────────────────
     // mirrors POST /api/escalations/:id/claim
     server.registerTool('claim_escalation', {
         title: 'Claim Escalation',
@@ -99,23 +172,79 @@ function registerEscalationTools(server) {
             'the escalation returns to the queue.',
         inputSchema: schemas_1.claimEscalationSchema,
     }, async (args) => {
-        const escalation = await escalationService.getEscalation(args.id);
-        if (!escalation) {
-            return {
-                content: [{ type: 'text', text: JSON.stringify({ error: 'Escalation not found' }) }],
-                isError: true,
-            };
+        const result = await escalationApi.claimEscalation({ id: args.id, durationMinutes: args.duration_minutes }, await systemAuth());
+        if (result.error) {
+            return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
         }
-        const result = await escalationService.claimEscalation(args.id, 'lt-system', args.duration_minutes);
-        if (!result) {
-            return {
-                content: [{ type: 'text', text: JSON.stringify({ error: 'Escalation not available for claim' }) }],
-                isError: true,
-            };
+        return { content: [{ type: 'text', text: JSON.stringify(result.data) }] };
+    });
+    // mirrors POST /api/escalations/:id/release
+    server.registerTool('release_escalation', {
+        title: 'Release Escalation',
+        description: 'Release a claimed escalation back to the available pool. Reverses a ' +
+            'claim_escalation so another holder can pick it up.',
+        inputSchema: schemas_1.releaseEscalationSchema,
+    }, async (args) => {
+        const result = await escalationApi.releaseEscalation({ id: args.id }, await systemAuth());
+        if (result.error) {
+            return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
         }
-        return {
-            content: [{ type: 'text', text: JSON.stringify(result) }],
-        };
+        return { content: [{ type: 'text', text: JSON.stringify(result.data) }] };
+    });
+    // mirrors POST /api/escalations/:id/resolve
+    server.registerTool('resolve_escalation', {
+        title: 'Resolve Escalation',
+        description: 'Resolve a pending escalation with a human-provided payload. Routes by escalation ' +
+            'shape: efficient (signal_key) escalations resume the waiting workflow in place; ' +
+            'legacy paths signal via routing metadata or re-run the original workflow. ' +
+            'Password fields in the payload are replaced with ephemeral tokens.',
+        inputSchema: schemas_1.resolveEscalationSchema,
+    }, async (args) => {
+        const result = await escalationApi.resolveEscalation({ id: args.id, resolverPayload: args.resolverPayload }, await systemAuth());
+        if (result.error) {
+            return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
+        }
+        return { content: [{ type: 'text', text: JSON.stringify(result.data) }] };
+    });
+    // mirrors POST /api/escalations/resolve-by-signal-key
+    server.registerTool('resolve_by_signal_key', {
+        title: 'Resolve by Signal Key',
+        description: 'Resolve an efficient (atomic) escalation directly by its signal_key and resume the ' +
+            'waiting workflow in place. For callers that know the deterministic signal id and want ' +
+            'to skip the id lookup.',
+        inputSchema: schemas_1.resolveBySignalKeySchema,
+    }, async (args) => {
+        const result = await escalationApi.resolveBySignalKey({ signalKey: args.signalKey, resolverPayload: args.resolverPayload }, await systemAuth());
+        if (result.error) {
+            return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
+        }
+        return { content: [{ type: 'text', text: JSON.stringify(result.data) }] };
+    });
+    // mirrors PATCH /api/escalations/:id/escalate
+    server.registerTool('escalate_escalation', {
+        title: 'Escalate Escalation',
+        description: 'Route a pending escalation to a different role (per the escalation chain). The new ' +
+            'role becomes responsible for resolving it.',
+        inputSchema: schemas_1.escalateEscalationSchema,
+    }, async (args) => {
+        const result = await escalationApi.escalateToRole({ id: args.id, targetRole: args.targetRole }, await systemAuth());
+        if (result.error) {
+            return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
+        }
+        return { content: [{ type: 'text', text: JSON.stringify(result.data) }] };
+    });
+    // mirrors POST /api/escalations/:id/cancel
+    server.registerTool('cancel_escalation', {
+        title: 'Cancel Escalation',
+        description: 'Permanently cancel a pending escalation — used when the tied workflow has ' +
+            'terminated and can never receive the resolution signal. Preserved for audit.',
+        inputSchema: schemas_1.cancelEscalationSchema,
+    }, async (args) => {
+        const result = await escalationApi.cancelSingleEscalation({ id: args.id }, await systemAuth());
+        if (result.error) {
+            return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
+        }
+        return { content: [{ type: 'text', text: JSON.stringify(result.data) }] };
     });
     // mirrors POST /api/escalations/release-expired
     server.registerTool('release_expired_claims', {
@@ -148,26 +277,13 @@ function registerEscalationTools(server) {
                 }],
         };
     });
-    // ── Metadata-based operations ───────────────────────────────────────────────
-    // mirrors GET /api/escalations/by-metadata
-    server.registerTool('find_by_metadata', {
-        title: 'Find by Metadata',
-        description: 'Find escalations by a metadata key-value pair.',
-        inputSchema: schemas_1.findByMetadataSchema,
-    }, async (args) => {
-        const result = await escalationMetaApi.findByMetadata(args, { userId: 'lt-system' });
-        if (result.error) {
-            return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
-        }
-        return { content: [{ type: 'text', text: JSON.stringify(result.data) }] };
-    });
     // mirrors POST /api/escalations/claim-by-metadata
     server.registerTool('claim_by_metadata', {
         title: 'Claim by Metadata',
         description: 'Find and claim an escalation by metadata key-value pair.',
         inputSchema: schemas_1.claimByMetadataSchema,
     }, async (args) => {
-        const result = await escalationMetaApi.claimByMetadata(args, { userId: 'lt-system' });
+        const result = await escalationMetaApi.claimByMetadata(args, await systemAuth());
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
         }
@@ -179,7 +295,7 @@ function registerEscalationTools(server) {
         description: 'Find and resolve an escalation by metadata key-value pair.',
         inputSchema: schemas_1.resolveByMetadataSchema,
     }, async (args) => {
-        const result = await escalationMetaApi.resolveByMetadata(args, { userId: 'lt-system' });
+        const result = await escalationMetaApi.resolveByMetadata(args, await systemAuth());
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
         }
@@ -192,7 +308,7 @@ function registerEscalationTools(server) {
         description: 'Claim multiple escalations in a single operation.',
         inputSchema: schemas_1.bulkClaimSchema,
     }, async (args) => {
-        const result = await escalationBulkApi.bulkClaim(args, { userId: 'lt-system' });
+        const result = await escalationBulkApi.bulkClaim(args, await systemAuth());
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
         }
@@ -204,7 +320,7 @@ function registerEscalationTools(server) {
         description: 'Assign multiple escalations to a specific user.',
         inputSchema: schemas_1.bulkAssignSchema,
     }, async (args) => {
-        const result = await escalationBulkApi.bulkAssign(args, { userId: 'lt-system' });
+        const result = await escalationBulkApi.bulkAssign(args, await systemAuth());
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
         }
@@ -216,7 +332,19 @@ function registerEscalationTools(server) {
         description: 'Escalate multiple escalations to a different role.',
         inputSchema: schemas_1.bulkEscalateSchema,
     }, async (args) => {
-        const result = await escalationBulkApi.bulkEscalate(args, { userId: 'lt-system' });
+        const result = await escalationBulkApi.bulkEscalate(args, await systemAuth());
+        if (result.error) {
+            return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
+        }
+        return { content: [{ type: 'text', text: JSON.stringify(result.data) }] };
+    });
+    // mirrors POST /api/escalations/bulk-cancel
+    server.registerTool('bulk_cancel', {
+        title: 'Bulk Cancel',
+        description: 'Cancel multiple pending escalations in a single operation.',
+        inputSchema: schemas_1.bulkCancelSchema,
+    }, async (args) => {
+        const result = await escalationApi.bulkCancel(args, await systemAuth());
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
         }
@@ -228,7 +356,7 @@ function registerEscalationTools(server) {
         description: 'Update the priority of multiple escalations.',
         inputSchema: schemas_1.updatePrioritySchema,
     }, async (args) => {
-        const result = await escalationBulkApi.updatePriority(args, { userId: 'lt-system' });
+        const result = await escalationBulkApi.updatePriority(args, await systemAuth());
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
         }

package/build/system/mcp-servers/admin/index.js

@@ -55,7 +55,7 @@ const settings_1 = require("./settings");
 const exports_1 = require("./exports");
 const overview_1 = require("./overview");
 const diagnostics_1 = require("./diagnostics");
-const TOOL_COUNT = 75;
+const TOOL_COUNT = 83;
 let server = null;
 async function createAdminServer(options) {
     if (server && !options?.fresh)
@@ -66,7 +66,7 @@ async function createAdminServer(options) {
         server = instance;
     }
     (0, tasks_1.registerTaskTools)(instance); //  2 tools
-    (0, escalations_1.registerEscalationTools)(instance); // 12 tools (5 base + 7 metadata/bulk)
+    (0, escalations_1.registerEscalationTools)(instance); // 20 tools (RO + RW single + metadata + bulk)
     (0, workflow_config_1.registerWorkflowConfigTools)(instance); //  3 tools
     (0, workflows_1.registerWorkflowTools)(instance); //  3 tools
     (0, mcp_servers_1.registerMcpServerTools)(instance); //  4 tools
@@ -83,7 +83,7 @@ async function createAdminServer(options) {
     (0, exports_1.registerExportTools)(instance); //  4 tools
     (0, overview_1.registerOverviewTools)(instance); //  1 tool
     (0, diagnostics_1.registerDiagnosticsTools)(instance); //  3 tools
-    // Total: 75
+    // Total: 83
     logger_1.loggerRegistry.info(`[lt-mcp:admin] ${name} ready (${TOOL_COUNT} tools registered)`);
     return instance;
 }