@exulu/backend 1.27.0 → 1.27.2

package/dist/index.cjs

@@ -47,7 +47,7 @@ __export(index_exports, {
   ExuluTool: () => ExuluTool2,
   ExuluUtils: () => ExuluUtils,
   ExuluVariables: () => ExuluVariables,
-  db: () => db3
+  db: () => db2
 });
 module.exports = __toCommonJS(index_exports);
 var import_config = require("dotenv/config");
@@ -444,7 +444,7 @@ var authentication = async ({
   apikey,
   authtoken,
   internalkey,
-  db: db4
+  db: db3
 }) => {
   if (internalkey) {
     if (!process.env.INTERNAL_SECRET) {
@@ -490,9 +490,9 @@ var authentication = async ({
           code: 401
         };
       }
-      const user = await db4.from("users").select("*").where("email", authtoken?.email).first();
+      const user = await db3.from("users").select("*").where("email", authtoken?.email).first();
       if (user?.role) {
-        const role = await db4.from("roles").select("*").where("id", user?.role).first();
+        const role = await db3.from("roles").select("*").where("id", user?.role).first();
         if (role) {
           user.role = role;
         }
@@ -519,7 +519,7 @@ var authentication = async ({
     }
   }
   if (apikey) {
-    const users = await db4.from("users").select("*").where("type", "api");
+    const users = await db3.from("users").select("*").where("type", "api");
     if (!users || users.length === 0) {
       return {
         error: true,
@@ -551,11 +551,11 @@ var authentication = async ({
       const user_key_compare_value = user.apikey.substring(0, user_key_last_slash_index);
       const isMatch = await import_bcryptjs.default.compare(request_key_compare_value, user_key_compare_value);
       if (isMatch) {
-        await db4.from("users").where({ id: user.id }).update({
+        await db3.from("users").where({ id: user.id }).update({
           last_used: /* @__PURE__ */ new Date()
         }).returning("id");
         if (user?.role) {
-          const role = await db4.from("roles").select("*").where("id", user?.role).first();
+          const role = await db3.from("roles").select("*").where("id", user?.role).first();
           if (role) {
             user.role = role;
           }
@@ -585,7 +585,7 @@ var authentication = async ({
 var requestValidators = {
   authenticate: async (req) => {
     const apikey = req.headers["exulu-api-key"] || null;
-    const { db: db4 } = await postgresClient();
+    const { db: db3 } = await postgresClient();
     let authtoken = null;
     if (typeof apikey !== "string") {
       authtoken = await getToken((req.headers["authorization"] || req.headers["x-api-key"]) ?? "");
@@ -593,7 +593,7 @@ var requestValidators = {
     return await authentication({
       authtoken,
       apikey,
-      db: db4
+      db: db3
     });
   },
   workflows: (req) => {
@@ -733,7 +733,7 @@ var requestValidators = {
 };
 
 // src/registry/utils/graphql.ts
-var import_bcryptjs2 = __toESM(require("bcryptjs"), 1);
+var import_bcryptjs3 = __toESM(require("bcryptjs"), 1);
 
 // src/postgres/core-schema.ts
 var agentMessagesSchema = {
@@ -1432,10 +1432,10 @@ var getEnabledTools = async (agentInstance, allExuluTools, disabledTools = [], a
 };
 var loadAgentCache = /* @__PURE__ */ new Map();
 var loadAgents = async () => {
-  const { db: db4 } = await postgresClient();
-  const agents = await db4.from("agents");
+  const { db: db3 } = await postgresClient();
+  const agents = await db3.from("agents");
   for (const agent of agents) {
-    const agentRbac = await RBACResolver(db4, "agent", agent.id, agent.rights_mode || "private");
+    const agentRbac = await RBACResolver(db3, "agent", agent.id, agent.rights_mode || "private");
     agent.RBAC = agentRbac;
     loadAgentCache.set(agent.id, {
       agent,
@@ -1450,11 +1450,11 @@ var loadAgent = async (id) => {
   if (cachedAgent && cachedAgent.expiresAt > /* @__PURE__ */ new Date()) {
     return cachedAgent.agent;
   }
-  const { db: db4 } = await postgresClient();
-  const agentInstance = await db4.from("agents").where({
+  const { db: db3 } = await postgresClient();
+  const agentInstance = await db3.from("agents").where({
     id
   }).first();
-  const agentRbac = await RBACResolver(db4, "agent", agentInstance.id, agentInstance.rights_mode || "private");
+  const agentRbac = await RBACResolver(db3, "agent", agentInstance.id, agentInstance.rights_mode || "private");
   agentInstance.RBAC = agentRbac;
   if (!agentInstance) {
     throw new Error("Agent instance not found.");
@@ -1540,6 +1540,59 @@ var checkRecordAccess = async (record, request, user) => {
   return false;
 };
 
+// src/auth/generate-key.ts
+var import_bcryptjs2 = __toESM(require("bcryptjs"), 1);
+var SALT_ROUNDS = 12;
+async function encryptString(string) {
+  const hash = await import_bcryptjs2.default.hash(string, SALT_ROUNDS);
+  return hash;
+}
+var generateApiKey = async (name, email) => {
+  const { db: db3 } = await postgresClient();
+  console.log("[EXULU] Inserting default user and admin role.");
+  const existingRole = await db3.from("roles").where({ name: "admin" }).first();
+  let roleId;
+  if (!existingRole) {
+    console.log("[EXULU] Creating default admin role.");
+    const role = await db3.from("roles").insert({
+      name: "admin",
+      agents: "write",
+      workflows: "write",
+      variables: "write",
+      users: "write"
+    }).returning("id");
+    roleId = role[0].id;
+  } else {
+    roleId = existingRole.id;
+  }
+  const newKeyName = name;
+  const plainKey = `sk_${Math.random().toString(36).substring(2, 15)}_${Math.random().toString(36).substring(2, 15)}`;
+  const postFix = `/${newKeyName.toLowerCase().trim().replaceAll(" ", "_")}`;
+  const encryptedKey = await encryptString(plainKey);
+  const existingApiUser = await db3.from("users").where({ email }).first();
+  if (!existingApiUser) {
+    console.log("[EXULU] Creating default api user.");
+    await db3.from("users").insert({
+      name,
+      email,
+      super_admin: true,
+      createdAt: /* @__PURE__ */ new Date(),
+      updatedAt: /* @__PURE__ */ new Date(),
+      type: "api",
+      emailVerified: /* @__PURE__ */ new Date(),
+      apikey: `${encryptedKey}${postFix}`,
+      // password: "admin", todo add this again when we implement password auth / encryption as alternative to OTP
+      role: roleId
+    });
+    console.log("[EXULU] Default api user created. Key: ", `${plainKey}${postFix}`);
+  } else {
+    console.log("[EXULU] API user with that name already exists.");
+  }
+  return {
+    key: `${plainKey}${postFix}`
+  };
+};
+
 // src/registry/utils/graphql.ts
 var GraphQLDate = new import_graphql2.GraphQLScalarType({
   name: "Date",
@@ -1761,10 +1814,10 @@ var getRequestedFields = (info) => {
   }, {}));
   return fields.filter((field) => field !== "pageInfo" && field !== "items" && field !== "RBAC");
 };
-var handleRBACUpdate = async (db4, entityName, resourceId, rbacData, existingRbacRecords) => {
+var handleRBACUpdate = async (db3, entityName, resourceId, rbacData, existingRbacRecords) => {
   const { users = [], roles = [], projects = [] } = rbacData;
   if (!existingRbacRecords) {
-    existingRbacRecords = await db4.from("rbac").where({
+    existingRbacRecords = await db3.from("rbac").where({
       entity: entityName,
       target_resource_id: resourceId
     }).select("*");
@@ -1782,13 +1835,13 @@ var handleRBACUpdate = async (db4, entityName, resourceId, rbacData, existingRba
   const rolesToRemove = existingRbacRecords.filter((r) => r.access_type === "Role" && !newRoleRecords.has(`${r.role_id}:${r.rights}`));
   const projectsToRemove = existingRbacRecords.filter((r) => r.access_type === "Project" && !newProjectRecords.has(`${r.project_id}:${r.rights}`));
   if (usersToRemove.length > 0) {
-    await db4.from("rbac").whereIn("id", usersToRemove.map((r) => r.id)).del();
+    await db3.from("rbac").whereIn("id", usersToRemove.map((r) => r.id)).del();
   }
   if (rolesToRemove.length > 0) {
-    await db4.from("rbac").whereIn("id", rolesToRemove.map((r) => r.id)).del();
+    await db3.from("rbac").whereIn("id", rolesToRemove.map((r) => r.id)).del();
   }
   if (projectsToRemove.length > 0) {
-    await db4.from("rbac").whereIn("id", projectsToRemove.map((r) => r.id)).del();
+    await db3.from("rbac").whereIn("id", projectsToRemove.map((r) => r.id)).del();
   }
   const recordsToInsert = [];
   usersToCreate.forEach((user) => {
@@ -1825,14 +1878,14 @@ var handleRBACUpdate = async (db4, entityName, resourceId, rbacData, existingRba
     });
   });
   if (recordsToInsert.length > 0) {
-    await db4.from("rbac").insert(recordsToInsert);
+    await db3.from("rbac").insert(recordsToInsert);
   }
 };
 function createMutations(table, agents, contexts, tools, config) {
   const tableNamePlural = table.name.plural.toLowerCase();
   const validateWriteAccess = async (id, context) => {
     try {
-      const { db: db4, req, user } = context;
+      const { db: db3, req, user } = context;
       if (user.super_admin === true) {
         return true;
       }
@@ -1844,7 +1897,7 @@ function createMutations(table, agents, contexts, tools, config) {
       if (!hasRBAC) {
         return true;
       }
-      const record = await db4.from(tableNamePlural).select(["rights_mode", "created_by"]).where({ id }).first();
+      const record = await db3.from(tableNamePlural).select(["rights_mode", "created_by"]).where({ id }).first();
       if (!record) {
         throw new Error("Record not found");
       }
@@ -1863,7 +1916,7 @@ function createMutations(table, agents, contexts, tools, config) {
         throw new Error("Only the creator can edit this private record");
       }
       if (record.rights_mode === "users") {
-        const rbacRecord = await db4.from("rbac").where({
+        const rbacRecord = await db3.from("rbac").where({
           entity: table.name.singular,
           target_resource_id: id,
           access_type: "User",
@@ -1876,7 +1929,7 @@ function createMutations(table, agents, contexts, tools, config) {
         throw new Error("Insufficient user permissions to edit this record");
       }
       if (record.rights_mode === "roles" && user.role) {
-        const rbacRecord = await db4.from("rbac").where({
+        const rbacRecord = await db3.from("rbac").where({
           entity: table.name.singular,
           target_resource_id: id,
           access_type: "Role",
@@ -1889,7 +1942,7 @@ function createMutations(table, agents, contexts, tools, config) {
         throw new Error("Insufficient role permissions to edit this record");
       }
       if (record.rights_mode === "projects") {
-        const projects = await db4.from("rbac").where({
+        const projects = await db3.from("rbac").where({
           entity: table.name.singular,
           target_resource_id: id,
           access_type: "Project",
@@ -1903,7 +1956,7 @@ function createMutations(table, agents, contexts, tools, config) {
             return false;
           }
           if (project.rights_mode === "users") {
-            const rbacRecord = await db4.from("rbac").where({
+            const rbacRecord = await db3.from("rbac").where({
               entity: "project",
               target_resource_id: project.id,
               access_type: "User",
@@ -1916,7 +1969,7 @@ function createMutations(table, agents, contexts, tools, config) {
             return false;
           }
           if (record.rights_mode === "roles" && user.role) {
-            const rbacRecord = await db4.from("rbac").where({
+            const rbacRecord = await db3.from("rbac").where({
               entity: "project",
               target_resource_id: project.id,
               access_type: "Role",
@@ -1942,9 +1995,8 @@ function createMutations(table, agents, contexts, tools, config) {
   };
   const mutations = {
     [`${tableNamePlural}CreateOne`]: async (_, args, context, info) => {
-      const { db: db4 } = context;
+      const { db: db3 } = context;
       const requestedFields = getRequestedFields(info);
-      const sanitizedFields = sanitizeRequestedFields(table, requestedFields);
       let { input } = args;
       const rbacData = input.RBAC;
       delete input.RBAC;
@@ -1957,7 +2009,9 @@ function createMutations(table, agents, contexts, tools, config) {
         throw new Error("You are not authorized to create users");
       }
       if (table.name.singular === "user" && input.password) {
-        input.password = await import_bcryptjs2.default.hash(input.password, 10);
+        console.log("[EXULU] Hashing password", input.password);
+        input.password = await import_bcryptjs3.default.hash(input.password, SALT_ROUNDS);
+        console.log("[EXULU] Hashed password", input.password);
       }
       Object.keys(input).forEach((key) => {
         if (table.fields.find((field) => field.name === key)?.type === "json") {
@@ -1967,10 +2021,13 @@ function createMutations(table, agents, contexts, tools, config) {
         }
       });
       if (!input.id) {
-        input.id = db4.fn.uuid();
+        const idField = table.fields.find((field) => field.name === "id");
+        if (!idField || idField?.type !== "number") {
+          input.id = db3.fn.uuid();
+        }
       }
-      const columns = await db4(tableNamePlural).columnInfo();
-      const insert = db4(tableNamePlural).insert({
+      const columns = await db3(tableNamePlural).columnInfo();
+      const insert = db3(tableNamePlural).insert({
         ...input,
         ...table.RBAC ? { rights_mode: "private" } : {}
       }).returning(Object.keys(columns));
@@ -1979,7 +2036,7 @@ function createMutations(table, agents, contexts, tools, config) {
       }
       let results = await insert;
       if (table.RBAC && rbacData && results[0]) {
-        await handleRBACUpdate(db4, table.name.singular, results[0].id, rbacData, []);
+        await handleRBACUpdate(db3, table.name.singular, results[0].id, rbacData, []);
       }
       const { job } = await postprocessUpdate({
         table,
@@ -1999,13 +2056,18 @@ function createMutations(table, agents, contexts, tools, config) {
       };
     },
     [`${tableNamePlural}UpdateOne`]: async (_, args, context, info) => {
-      const { db: db4, req } = context;
+      const { db: db3, req } = context;
       let { where, input } = args;
       await validateCreateOrRemoveSuperAdminPermission(tableNamePlural, input, req);
       const rbacData = input.RBAC;
       delete input.RBAC;
       delete input.created_by;
       input = encryptSensitiveFields(input);
+      if (table.name.singular === "user" && input.password) {
+        console.log("[EXULU] Hashing password", input.password);
+        input.password = await import_bcryptjs3.default.hash(input.password, SALT_ROUNDS);
+        console.log("[EXULU] Hashed password", input.password);
+      }
       Object.keys(input).forEach((key) => {
         if (table.fields.find((field) => field.name === key)?.type === "json") {
           if (typeof input[key] === "object" || Array.isArray(input[key])) {
@@ -2015,13 +2077,13 @@ function createMutations(table, agents, contexts, tools, config) {
       });
       const requestedFields = getRequestedFields(info);
       const sanitizedFields = sanitizeRequestedFields(table, requestedFields);
-      const item = await db4.from(tableNamePlural).select(sanitizedFields).where(where).first();
+      const item = await db3.from(tableNamePlural).select(sanitizedFields).where(where).first();
       if (!item) {
         throw new Error("Record not found");
       }
       await validateWriteAccess(item.id, context);
-      const columns = await db4(tableNamePlural).columnInfo();
-      const result = await db4(tableNamePlural).where({ id: item.id }).update({
+      const columns = await db3(tableNamePlural).columnInfo();
+      const result = await db3(tableNamePlural).where({ id: item.id }).update({
         ...input,
         updatedAt: /* @__PURE__ */ new Date()
       }).returning(Object.keys(columns));
@@ -2029,20 +2091,20 @@ function createMutations(table, agents, contexts, tools, config) {
         throw new Error("Something went wrong with the update, no id returned.");
       }
       if (table.RBAC && rbacData && result.id) {
-        const existingRbacRecords = await db4.from("rbac").where({
+        const existingRbacRecords = await db3.from("rbac").where({
           entity: table.name.singular,
           target_resource_id: result.id
         }).select("*");
-        await handleRBACUpdate(db4, table.name.singular, result.id, rbacData, existingRbacRecords);
+        await handleRBACUpdate(db3, table.name.singular, result.id, rbacData, existingRbacRecords);
       }
-      const { job } = await postprocessUpdate({ table, requestedFields, agents, contexts, tools, result, user: context.user.id, role: context.user.role?.id });
+      const { job } = await postprocessUpdate({ table, requestedFields, agents, contexts, tools, result, user: context.user.id, role: context.user.role?.id, config });
       return {
         item: finalizeRequestedFields({ table, requestedFields, agents, contexts, tools, result, user: context.user.id }),
         job
       };
     },
     [`${tableNamePlural}UpdateOneById`]: async (_, args, context, info) => {
-      const { db: db4, req } = context;
+      const { db: db3, req } = context;
       let { id, input } = args;
       await validateCreateOrRemoveSuperAdminPermission(tableNamePlural, input, req);
       await validateWriteAccess(id, context);
@@ -2050,6 +2112,11 @@ function createMutations(table, agents, contexts, tools, config) {
       delete input.RBAC;
       delete input.created_by;
       input = encryptSensitiveFields(input);
+      if (table.name.singular === "user" && input.password) {
+        console.log("[EXULU] Hashing password", input.password);
+        input.password = await import_bcryptjs3.default.hash(input.password, SALT_ROUNDS);
+        console.log("[EXULU] Hashed password", input.password);
+      }
       Object.keys(input).forEach((key) => {
         if (table.fields.find((field) => field.name === key)?.type === "json") {
           if (typeof input[key] === "object" || Array.isArray(input[key])) {
@@ -2057,21 +2124,21 @@ function createMutations(table, agents, contexts, tools, config) {
           }
         }
       });
-      await db4(tableNamePlural).where({ id }).update({
+      await db3(tableNamePlural).where({ id }).update({
         ...input,
         updatedAt: /* @__PURE__ */ new Date()
       });
       if (table.RBAC && rbacData) {
-        const existingRbacRecords = await db4.from("rbac").where({
+        const existingRbacRecords = await db3.from("rbac").where({
           entity: table.name.singular,
           target_resource_id: id
         }).select("*");
-        await handleRBACUpdate(db4, table.name.singular, id, rbacData, existingRbacRecords);
+        await handleRBACUpdate(db3, table.name.singular, id, rbacData, existingRbacRecords);
       }
       const requestedFields = getRequestedFields(info);
-      const columns = await db4(tableNamePlural).columnInfo();
-      const result = await db4.from(tableNamePlural).select(Object.keys(columns)).where({ id }).first();
-      const { job } = await postprocessUpdate({ table, requestedFields, agents, contexts, tools, result, user: context.user.id, role: context.user.role?.id });
+      const columns = await db3(tableNamePlural).columnInfo();
+      const result = await db3.from(tableNamePlural).select(Object.keys(columns)).where({ id }).first();
+      const { job } = await postprocessUpdate({ table, requestedFields, agents, contexts, tools, result, user: context.user.id, role: context.user.role?.id, config });
       return {
         item: finalizeRequestedFields({ table, requestedFields, agents, contexts, tools, result, user: context.user.id }),
         job
@@ -2079,11 +2146,11 @@ function createMutations(table, agents, contexts, tools, config) {
     },
     [`${tableNamePlural}RemoveOneById`]: async (_, args, context, info) => {
       const { id } = args;
-      const { db: db4 } = context;
+      const { db: db3 } = context;
       await validateWriteAccess(id, context);
       const requestedFields = getRequestedFields(info);
       const sanitizedFields = sanitizeRequestedFields(table, requestedFields);
-      const result = await db4.from(tableNamePlural).select(sanitizedFields).where({ id }).first();
+      const result = await db3.from(tableNamePlural).select(sanitizedFields).where({ id }).first();
       if (!result) {
         throw new Error("Record not found");
       }
@@ -2094,12 +2161,12 @@ function createMutations(table, agents, contexts, tools, config) {
         }
         const chunksTableExists = await context2.chunksTableExists();
         if (chunksTableExists) {
-          await db4.from(getChunksTableName(context2.id)).where({ source: result.id }).del();
+          await db3.from(getChunksTableName(context2.id)).where({ source: result.id }).del();
         }
       }
-      await db4(tableNamePlural).where({ id }).del();
+      await db3(tableNamePlural).where({ id }).del();
       if (table.RBAC) {
-        await db4.from("rbac").where({
+        await db3.from("rbac").where({
           entity: table.name.singular,
           target_resource_id: id
         }).del();
@@ -2109,10 +2176,10 @@ function createMutations(table, agents, contexts, tools, config) {
     },
     [`${tableNamePlural}RemoveOne`]: async (_, args, context, info) => {
       const { where } = args;
-      const { db: db4 } = context;
+      const { db: db3 } = context;
       const requestedFields = getRequestedFields(info);
       const sanitizedFields = sanitizeRequestedFields(table, requestedFields);
-      const result = await db4.from(tableNamePlural).select(sanitizedFields).where(where).first();
+      const result = await db3.from(tableNamePlural).select(sanitizedFields).where(where).first();
       if (!result) {
         throw new Error("Record not found");
       }
@@ -2124,10 +2191,10 @@ function createMutations(table, agents, contexts, tools, config) {
         }
         const chunksTableExists = await context2.chunksTableExists();
         if (chunksTableExists) {
-          await db4.from(getChunksTableName(context2.id)).where({ source: result.id }).del();
+          await db3.from(getChunksTableName(context2.id)).where({ source: result.id }).del();
         }
       }
-      await db4(tableNamePlural).where(where).del();
+      await db3(tableNamePlural).where(where).del();
       await postprocessDeletion({ table, requestedFields, agents, contexts, tools, result });
       return finalizeRequestedFields({ table, requestedFields, agents, contexts, tools, result, user: context.user.id });
     }
@@ -2157,8 +2224,8 @@ function createMutations(table, agents, contexts, tools, config) {
       if (!field.processor) {
         throw new Error(`Processor not set for field ${args.field} in context ${exists.id}.`);
       }
-      const { db: db4 } = context;
-      let query = db4.from(tableNamePlural).select("*").where({ id: args.item });
+      const { db: db3 } = context;
+      let query = db3.from(tableNamePlural).select("*").where({ id: args.item });
       query = applyAccessControl(table, context.user, query);
       const item = await query.first();
       if (!item) {
@@ -2183,15 +2250,15 @@ function createMutations(table, agents, contexts, tools, config) {
       if (!context.user?.super_admin) {
         throw new Error("You are not authorized to delete chunks via API, user must be super admin.");
       }
-      const { db: db4 } = await postgresClient();
+      const { db: db3 } = await postgresClient();
       const exists = contexts.find((context2) => context2.id === table.id);
       if (!exists) {
         throw new Error(`Context ${table.id} not found.`);
       }
       const { id, embeddings } = exists;
       const mainTable = getTableName(id);
-      const columns = await db4(mainTable).columnInfo();
-      let query = db4.from(mainTable).select(Object.keys(columns));
+      const columns = await db3(mainTable).columnInfo();
+      let query = db3.from(mainTable).select(Object.keys(columns));
       if (!args.where) {
         const {
           jobs: jobs2,
@@ -2234,12 +2301,12 @@ function createMutations(table, agents, contexts, tools, config) {
       if (!context.user?.super_admin) {
         throw new Error("You are not authorized to delete chunks via API, user must be super admin.");
       }
-      const { db: db4 } = await postgresClient();
+      const { db: db3 } = await postgresClient();
       const id = contexts.find((context2) => context2.id === table.id)?.id;
       if (!id) {
         throw new Error(`Context ${table.id} not found.`);
       }
-      let query = db4.from(getTableName(id)).select("id");
+      let query = db3.from(getTableName(id)).select("id");
       if (args.where) {
         query = applyFilters(query, args.where);
       }
@@ -2248,7 +2315,7 @@ function createMutations(table, agents, contexts, tools, config) {
         throw new Error("No items found to delete chunks for.");
       }
       for (const item of items) {
-        await db4.from(getChunksTableName(id)).where({ source: item.id }).delete();
+        await db3.from(getChunksTableName(id)).where({ source: item.id }).delete();
       }
       return {
         message: "Chunks deleted successfully.",
@@ -2265,16 +2332,19 @@ var applyAccessControl = (table, user, query) => {
     query = query.where("created_by", user.id);
     return query;
   }
-  const hasRBAC = table.RBAC === true;
-  if (!hasRBAC) {
-    return query;
-  }
   if (table.name.plural !== "agent_sessions" && user.super_admin === true) {
     return query;
   }
+  console.log("[EXULU] user.role", user.role);
+  console.log("[EXULU] table.name.plural", table.name.plural);
   if (!user.super_admin && (!user.role || !(table.name.plural === "agents" && (user.role.agents === "read" || user.role.agents === "write")) && !(table.name.plural === "workflow_templates" && (user.role.workflows === "read" || user.role.workflows === "write")) && !(table.name.plural === "variables" && (user.role.variables === "read" || user.role.variables === "write")) && !(table.name.plural === "users" && (user.role.users === "read" || user.role.users === "write")) && !((table.name.plural === "test_cases" || table.name.plural === "eval_sets" || table.name.plural === "eval_runs") && (user.role.evals === "read" || user.role.evals === "write")))) {
     console.error("==== Access control error: no role found or no access to entity type. ====");
-    return query.where("1", "=", "0");
+    return query.where("id", "=", "0");
+  }
+  const hasRBAC = table.RBAC === true;
+  console.log("[EXULU] hasRBAC", hasRBAC);
+  if (!hasRBAC) {
+    return query;
   }
   try {
     query = query.where(function() {
@@ -2451,9 +2521,9 @@ var postprocessUpdate = async ({
       if (!context.embedder) {
         return result;
       }
-      const { db: db4 } = await postgresClient();
+      const { db: db3 } = await postgresClient();
       console.log("[EXULU] Deleting chunks for item", result.id);
-      await db4.from(getChunksTableName(context.id)).where({ source: result.id }).delete();
+      await db3.from(getChunksTableName(context.id)).where({ source: result.id }).delete();
       console.log("[EXULU] Deleted chunks for item", result.id);
       console.log("[EXULU] Embedder", context.embedder);
       console.log("[EXULU] Configuration", context.configuration);
@@ -2503,11 +2573,11 @@ var postprocessDeletion = async ({
       if (!context.embedder) {
         return result;
       }
-      const { db: db4 } = await postgresClient();
+      const { db: db3 } = await postgresClient();
       console.log("[EXULU] Deleting chunks for item", result.id);
-      const chunks = await db4.from(getChunksTableName(context.id)).where({ source: result.id }).select("id");
+      const chunks = await db3.from(getChunksTableName(context.id)).where({ source: result.id }).select("id");
       if (chunks.length > 0) {
-        await db4.from(getChunksTableName(context.id)).where({ source: result.id }).delete();
+        await db3.from(getChunksTableName(context.id)).where({ source: result.id }).delete();
       }
       return result;
     }
@@ -2554,10 +2624,10 @@ var finalizeRequestedFields = async ({
           result.chunks = [];
           return result;
         }
-        const { db: db4 } = await postgresClient();
-        const query = db4.from(getChunksTableName(context.id)).where({ source: result.id }).select("id", "content", "source", "chunk_index", "createdAt", "updatedAt");
+        const { db: db3 } = await postgresClient();
+        const query = db3.from(getChunksTableName(context.id)).where({ source: result.id }).select("id", "content", "source", "chunk_index", "createdAt", "updatedAt");
         query.select(
-          db4.raw("vector_dims(??) as embedding_size", [`embedding`])
+          db3.raw("vector_dims(??) as embedding_size", [`embedding`])
         );
         const chunks = await query;
         result.chunks = chunks.map((chunk) => ({
@@ -2608,29 +2678,29 @@ function createQueries(table, agents, tools, contexts) {
   const tableNameSingular = table.name.singular.toLowerCase();
   const queries = {
     [`${tableNameSingular}ById`]: async (_, args, context, info) => {
-      const { db: db4 } = context;
+      const { db: db3 } = context;
       const requestedFields = getRequestedFields(info);
       const sanitizedFields = sanitizeRequestedFields(table, requestedFields);
-      let query = db4.from(tableNamePlural).select(sanitizedFields).where({ id: args.id });
+      let query = db3.from(tableNamePlural).select(sanitizedFields).where({ id: args.id });
       query = applyAccessControl(table, context.user, query);
       let result = await query.first();
       return finalizeRequestedFields({ table, requestedFields, agents, contexts, tools, result, user: context.user });
     },
     [`${tableNameSingular}ByIds`]: async (_, args, context, info) => {
-      const { db: db4 } = context;
+      const { db: db3 } = context;
       const requestedFields = getRequestedFields(info);
       const sanitizedFields = sanitizeRequestedFields(table, requestedFields);
-      let query = db4.from(tableNamePlural).select(sanitizedFields).whereIn("id", args.ids);
+      let query = db3.from(tableNamePlural).select(sanitizedFields).whereIn("id", args.ids);
       query = applyAccessControl(table, context.user, query);
       let result = await query;
       return finalizeRequestedFields({ table, requestedFields, agents, contexts, tools, result, user: context.user });
     },
     [`${tableNameSingular}One`]: async (_, args, context, info) => {
       const { filters = [], sort } = args;
-      const { db: db4 } = context;
+      const { db: db3 } = context;
       const requestedFields = getRequestedFields(info);
       const sanitizedFields = sanitizeRequestedFields(table, requestedFields);
-      let query = db4.from(tableNamePlural).select(sanitizedFields);
+      let query = db3.from(tableNamePlural).select(sanitizedFields);
       query = applyFilters(query, filters);
       query = applyAccessControl(table, context.user, query);
       query = applySorting(query, sort);
@@ -2639,11 +2709,11 @@ function createQueries(table, agents, tools, contexts) {
     },
     [`${tableNamePlural}Pagination`]: async (_, args, context, info) => {
       const { limit = 10, page = 0, filters = [], sort } = args;
-      const { db: db4 } = context;
+      const { db: db3 } = context;
       if (limit > 500) {
         throw new Error("Limit cannot be greater than 500.");
       }
-      let countQuery = db4(tableNamePlural);
+      let countQuery = db3(tableNamePlural);
       countQuery = applyFilters(countQuery, filters);
       countQuery = applyAccessControl(table, context.user, countQuery);
       const countResult = await countQuery.count("* as count");
@@ -2652,7 +2722,7 @@ function createQueries(table, agents, tools, contexts) {
       const currentPage = page;
       const hasPreviousPage = currentPage > 1;
       const hasNextPage = currentPage < pageCount - 1;
-      let dataQuery = db4(tableNamePlural);
+      let dataQuery = db3(tableNamePlural);
       dataQuery = applyFilters(dataQuery, filters);
       dataQuery = applyAccessControl(table, context.user, dataQuery);
       const requestedFields = getRequestedFields(info);
@@ -2676,8 +2746,8 @@ function createQueries(table, agents, tools, contexts) {
     // Add generic statistics query for all tables
     [`${tableNamePlural}Statistics`]: async (_, args, context, info) => {
       const { filters = [], groupBy } = args;
-      const { db: db4 } = context;
-      let query = db4(tableNamePlural);
+      const { db: db3 } = context;
+      let query = db3(tableNamePlural);
       query = applyFilters(query, filters);
       query = applyAccessControl(table, context.user, query);
       if (groupBy) {
@@ -2740,7 +2810,7 @@ var vectorSearch = async ({
   filters,
   sort,
   context,
-  db: db4,
+  db: db3,
   query,
   method,
   user,
@@ -2777,11 +2847,11 @@ var vectorSearch = async ({
   }
   const mainTable = getTableName(id);
   const chunksTable = getChunksTableName(id);
-  let countQuery = db4(mainTable);
+  let countQuery = db3(mainTable);
   countQuery = applyFilters(countQuery, filters);
   countQuery = applyAccessControl(table, user, countQuery);
-  const columns = await db4(mainTable).columnInfo();
-  let itemsQuery = db4(mainTable).select(Object.keys(columns).map((column) => mainTable + "." + column));
+  const columns = await db3(mainTable).columnInfo();
+  let itemsQuery = db3(mainTable).select(Object.keys(columns).map((column) => mainTable + "." + column));
   itemsQuery = applyFilters(itemsQuery, filters);
   itemsQuery = applyAccessControl(table, user, itemsQuery);
   itemsQuery = applySorting(itemsQuery, sort);
@@ -2798,7 +2868,7 @@ var vectorSearch = async ({
   itemsQuery.select(chunksTable + ".chunk_index");
   itemsQuery.select(chunksTable + ".createdAt as chunk_created_at");
   itemsQuery.select(chunksTable + ".updatedAt as chunk_updated_at");
-  itemsQuery.select(db4.raw("vector_dims(??) as embedding_size", [`${chunksTable}.embedding`]));
+  itemsQuery.select(db3.raw("vector_dims(??) as embedding_size", [`${chunksTable}.embedding`]));
   const { chunks } = await embedder.generateFromQuery(query, {
     label: table.name.singular,
     trigger
@@ -2813,7 +2883,7 @@ var vectorSearch = async ({
   let items = [];
   switch (method) {
     case "tsvector":
-      itemsQuery.select(db4.raw(
+      itemsQuery.select(db3.raw(
         `ts_rank(${chunksTable}.fts, websearch_to_tsquery(?, ?)) as fts_rank`,
         [language, query]
       )).whereRaw(
@@ -2826,7 +2896,7 @@ var vectorSearch = async ({
     default:
       itemsQuery.whereNotNull(`${chunksTable}.embedding`);
       itemsQuery.select(
-        db4.raw(`1 - (${chunksTable}.embedding <=> ${vectorExpr}) AS cosine_distance`)
+        db3.raw(`1 - (${chunksTable}.embedding <=> ${vectorExpr}) AS cosine_distance`)
       );
       itemsQuery.orderByRaw(
         `${chunksTable}.embedding <=> ${vectorExpr} ASC NULLS LAST`
@@ -2916,7 +2986,7 @@ var vectorSearch = async ({
         matchCount
         // final limit
       ];
-      items = await db4.raw(hybridSQL, bindings).then((r) => r.rows ?? r);
+      items = await db3.raw(hybridSQL, bindings).then((r) => r.rows ?? r);
   }
   const seenSources = /* @__PURE__ */ new Map();
   items = items.reduce((acc, item) => {
@@ -3012,8 +3082,8 @@ var vectorSearch = async ({
     items
   };
 };
-var RBACResolver = async (db4, entityName, resourceId, rights_mode) => {
-  const rbacRecords = await db4.from("rbac").where({
+var RBACResolver = async (db3, entityName, resourceId, rights_mode) => {
+  const rbacRecords = await db3.from("rbac").where({
     entity: entityName,
     target_resource_id: resourceId
   }).select("*");
@@ -3290,11 +3360,11 @@ type PageInfo {
         resolvers[rbacResolverName] = {};
       }
       resolvers[rbacResolverName].RBAC = async (parent, args, context) => {
-        const { db: db4 } = context;
+        const { db: db3 } = context;
         const resourceId = parent.id;
         const entityName = table.name.singular;
         const rights_mode = parent.rights_mode;
-        return RBACResolver(db4, entityName, resourceId, rights_mode);
+        return RBACResolver(db3, entityName, resourceId, rights_mode);
       };
     }
   }
@@ -3661,7 +3731,7 @@ var createUppyRoutes = async (app, config) => {
   app.delete("/s3/delete", async (req, res, next) => {
     const apikey = req.headers["exulu-api-key"] || null;
     const internalkey = req.headers["internal-key"] || null;
-    const { db: db4 } = await postgresClient();
+    const { db: db3 } = await postgresClient();
     let authtoken = null;
     if (typeof apikey !== "string" && typeof internalkey !== "string") {
       authtoken = await getToken(req.headers.authorization ?? "");
@@ -3670,7 +3740,7 @@ var createUppyRoutes = async (app, config) => {
       authtoken,
       apikey,
       internalkey,
-      db: db4
+      db: db3
     });
     if (!authenticationResult.user?.id) {
       res.status(authenticationResult.code || 500).json({ detail: `${authenticationResult.message}` });
@@ -3707,7 +3777,7 @@ var createUppyRoutes = async (app, config) => {
   app.get("/s3/download", async (req, res, next) => {
     const apikey = req.headers["exulu-api-key"] || null;
     const internalkey = req.headers["internal-key"] || null;
-    const { db: db4 } = await postgresClient();
+    const { db: db3 } = await postgresClient();
     let authtoken = null;
     if (typeof apikey !== "string" && typeof internalkey !== "string") {
       authtoken = await getToken(req.headers.authorization ?? "");
@@ -3716,7 +3786,7 @@ var createUppyRoutes = async (app, config) => {
       authtoken,
       apikey,
       internalkey,
-      db: db4
+      db: db3
     });
     if (!authenticationResult.user?.id) {
       res.status(authenticationResult.code || 500).json({ detail: `${authenticationResult.message}` });
@@ -3751,7 +3821,7 @@ var createUppyRoutes = async (app, config) => {
   app.post("/s3/object", async (req, res, next) => {
     const apikey = req.headers["exulu-api-key"] || null;
     const internalkey = req.headers["internal-key"] || null;
-    const { db: db4 } = await postgresClient();
+    const { db: db3 } = await postgresClient();
     let authtoken = null;
     if (typeof apikey !== "string" && typeof internalkey !== "string") {
       authtoken = await getToken(req.headers.authorization ?? "");
@@ -3760,7 +3830,7 @@ var createUppyRoutes = async (app, config) => {
       authtoken,
       apikey,
       internalkey,
-      db: db4
+      db: db3
     });
     if (!authenticationResult.user?.id) {
       res.status(authenticationResult.code || 500).json({ detail: `${authenticationResult.message}` });
@@ -3781,7 +3851,7 @@ var createUppyRoutes = async (app, config) => {
   app.get("/s3/list", async (req, res, next) => {
     const apikey = req.headers["exulu-api-key"] || null;
     const internalkey = req.headers["internal-key"] || null;
-    const { db: db4 } = await postgresClient();
+    const { db: db3 } = await postgresClient();
     let authtoken = null;
     if (typeof apikey !== "string" && typeof internalkey !== "string") {
       authtoken = await getToken(req.headers.authorization ?? "");
@@ -3790,7 +3860,7 @@ var createUppyRoutes = async (app, config) => {
       authtoken,
       apikey,
       internalkey,
-      db: db4
+      db: db3
     });
     if (!authenticationResult.user?.id) {
       res.status(authenticationResult.code || 500).json({ detail: `${authenticationResult.message}` });
@@ -3848,7 +3918,7 @@ var createUppyRoutes = async (app, config) => {
   const generateS3Key2 = (filename) => `${(0, import_node_crypto.randomUUID)()}-_EXULU_${filename}`;
   const signOnServer = async (req, res, next) => {
     const apikey = req.headers["exulu-api-key"] || null;
-    const { db: db4 } = await postgresClient();
+    const { db: db3 } = await postgresClient();
     let authtoken = null;
     if (typeof apikey !== "string") {
       authtoken = await getToken(req.headers.authorization ?? "");
@@ -3856,7 +3926,7 @@ var createUppyRoutes = async (app, config) => {
     const authenticationResult = await authentication({
       authtoken,
       apikey,
-      db: db4
+      db: db3
     });
     if (!authenticationResult.user?.id) {
       res.status(authenticationResult.code || 500).json({ detail: `${authenticationResult.message}` });
@@ -3893,7 +3963,7 @@ var createUppyRoutes = async (app, config) => {
   });
   app.post("/s3/multipart", async (req, res, next) => {
     const apikey = req.headers["exulu-api-key"] || null;
-    const { db: db4 } = await postgresClient();
+    const { db: db3 } = await postgresClient();
     let authtoken = null;
     if (typeof apikey !== "string") {
       authtoken = await getToken(req.headers.authorization ?? "");
@@ -3901,7 +3971,7 @@ var createUppyRoutes = async (app, config) => {
     const authenticationResult = await authentication({
       authtoken,
       apikey,
-      db: db4
+      db: db3
     });
     if (!authenticationResult.user?.id) {
       res.status(authenticationResult.code || 500).json({ detail: `${authenticationResult.message}` });
@@ -4181,10 +4251,10 @@ var convertToolsArrayToObject = (currentTools, allExuluTools, configs, providera
   };
 };
 var hydrateVariables = async (tool2) => {
-  const { db: db4 } = await postgresClient();
+  const { db: db3 } = await postgresClient();
   const promises = tool2.config.map(async (toolConfig) => {
     const variableName = toolConfig.variable;
-    const variable = await db4.from("variables").where({ name: variableName }).first();
+    const variable = await db3.from("variables").where({ name: variableName }).first();
     if (!variable) {
       console.error("[EXULU] Variable " + variableName + " not found.");
       throw new Error("Variable " + variableName + " not found.");
@@ -4320,8 +4390,8 @@ var ExuluAgent2 = class {
         if (!variableName) {
           throw new Error("Provider API key variable not set for agent: " + agentInstance.name + " (" + agentInstance.id + ") being called as a tool.");
         }
-        const { db: db4 } = await postgresClient();
-        const variable = await db4.from("variables").where({ name: variableName }).first();
+        const { db: db3 } = await postgresClient();
+        const variable = await db3.from("variables").where({ name: variableName }).first();
         if (!variable) {
           throw new Error("Provider API key variable not found for agent: " + agentInstance.name + " (" + agentInstance.id + ") being called as a tool.");
         }
@@ -4689,9 +4759,9 @@ var ExuluAgent2 = class {
   };
 };
 var getAgentMessages = async ({ session, user, limit, page }) => {
-  const { db: db4 } = await postgresClient();
+  const { db: db3 } = await postgresClient();
   console.log("[EXULU] getting agent messages for session: " + session + " and user: " + user + " and page: " + page);
-  const query = db4.from("agent_messages").where({ session, user }).limit(limit);
+  const query = db3.from("agent_messages").where({ session, user }).limit(limit);
   if (page > 0) {
     query.offset((page - 1) * limit);
   }
@@ -4699,9 +4769,9 @@ var getAgentMessages = async ({ session, user, limit, page }) => {
   return messages;
 };
 var saveChat = async ({ session, user, messages }) => {
-  const { db: db4 } = await postgresClient();
+  const { db: db3 } = await postgresClient();
   const promises = messages.map((message) => {
-    return db4.from("agent_messages").insert({
+    return db3.from("agent_messages").insert({
       session,
       user,
       content: JSON.stringify(message),
@@ -4912,25 +4982,25 @@ var ExuluContext = class {
     };
   };
   deleteAll = async () => {
-    const { db: db4 } = await postgresClient();
-    await db4.from(getTableName(this.id)).delete();
-    await db4.from(getChunksTableName(this.id)).delete();
+    const { db: db3 } = await postgresClient();
+    await db3.from(getTableName(this.id)).delete();
+    await db3.from(getChunksTableName(this.id)).delete();
     return {
       count: 0,
       results: []
     };
   };
   tableExists = async () => {
-    const { db: db4 } = await postgresClient();
+    const { db: db3 } = await postgresClient();
     const tableName = getTableName(this.id);
     console.log("[EXULU] checking if table exists.", tableName);
-    const tableExists = await db4.schema.hasTable(tableName);
+    const tableExists = await db3.schema.hasTable(tableName);
     return tableExists;
   };
   chunksTableExists = async () => {
-    const { db: db4 } = await postgresClient();
+    const { db: db3 } = await postgresClient();
     const chunksTableName = getChunksTableName(this.id);
-    const chunksTableExists = await db4.schema.hasTable(chunksTableName);
+    const chunksTableExists = await db3.schema.hasTable(chunksTableName);
     return chunksTableExists;
   };
   createAndUpsertEmbeddings = async (item, config, user, statistics, role, job) => {
@@ -4940,7 +5010,7 @@ var ExuluContext = class {
     if (!item.id) {
       throw new Error("Item id is required for generating embeddings.");
     }
-    const { db: db4 } = await postgresClient();
+    const { db: db3 } = await postgresClient();
     const { id: source, chunks } = await this.embedder.generateFromDocument(
       {
         ...item,
@@ -4954,14 +5024,14 @@ var ExuluContext = class {
       user,
       role
     );
-    await db4.from(getChunksTableName(this.id)).where({ source }).delete();
-    await db4.from(getChunksTableName(this.id)).insert(chunks.map((chunk) => ({
+    await db3.from(getChunksTableName(this.id)).where({ source }).delete();
+    await db3.from(getChunksTableName(this.id)).insert(chunks.map((chunk) => ({
       source,
       content: chunk.content,
       chunk_index: chunk.index,
       embedding: import_knex5.default.toSql(chunk.vector)
     })));
-    await db4.from(getTableName(this.id)).where({ id: item.id }).update({
+    await db3.from(getTableName(this.id)).where({ id: item.id }).update({
       embeddings_updated_at: (/* @__PURE__ */ new Date()).toISOString()
     }).returning("id");
     return {
@@ -4971,8 +5041,8 @@ var ExuluContext = class {
     };
   };
   createItem = async (item, config, user, role, upsert) => {
-    const { db: db4 } = await postgresClient();
-    const mutation = db4.from(getTableName(
+    const { db: db3 } = await postgresClient();
+    const mutation = db3.from(getTableName(
       this.id
     )).insert(
       {
@@ -5006,11 +5076,11 @@ var ExuluContext = class {
     };
   };
   updateItem = async (item, config, user, role) => {
-    const { db: db4 } = await postgresClient();
+    const { db: db3 } = await postgresClient();
     if (item.field) {
       delete item.field;
     }
-    const record = await db4.from(
+    const record = await db3.from(
       getTableName(this.id)
     ).where(
       { id: item.id }
@@ -5018,7 +5088,7 @@ var ExuluContext = class {
     if (!record) {
       throw new Error("Item not found.");
     }
-    const mutation = db4.from(
+    const mutation = db3.from(
       getTableName(this.id)
     ).where(
       { id: record.id }
@@ -5052,17 +5122,17 @@ var ExuluContext = class {
     if (!item.id) {
       throw new Error("Item id is required for deleting item.");
     }
-    const { db: db4 } = await postgresClient();
-    await db4.from(getTableName(this.id)).where({ id: item.id }).delete();
+    const { db: db3 } = await postgresClient();
+    await db3.from(getTableName(this.id)).where({ id: item.id }).delete();
     if (!this.embedder) {
       return {
         id: item.id,
         job: void 0
       };
     }
-    const chunks = await db4.from(getChunksTableName(this.id)).where({ source: item.id }).select("id");
+    const chunks = await db3.from(getChunksTableName(this.id)).where({ source: item.id }).select("id");
     if (chunks.length > 0) {
-      await db4.from(getChunksTableName(this.id)).where({ source: item.id }).delete();
+      await db3.from(getChunksTableName(this.id)).where({ source: item.id }).delete();
     }
     return {
       id: item.id,
@@ -5111,8 +5181,8 @@ var ExuluContext = class {
         }, role, void 0);
       },
       all: async (config, userId, roleId) => {
-        const { db: db4 } = await postgresClient();
-        const items = await db4.from(getTableName(this.id)).select("*");
+        const { db: db3 } = await postgresClient();
+        const items = await db3.from(getTableName(this.id)).select("*");
         const jobs = [];
         const queue = await this.embedder?.queue;
         if (!queue?.queue.name && items.length > 2e3) {
@@ -5141,12 +5211,12 @@ var ExuluContext = class {
     }
   };
   createItemsTable = async () => {
-    const { db: db4 } = await postgresClient();
+    const { db: db3 } = await postgresClient();
     const tableName = getTableName(this.id);
     console.log("[EXULU] Creating table: " + tableName);
-    return await db4.schema.createTable(tableName, (table) => {
+    return await db3.schema.createTable(tableName, (table) => {
       console.log("[EXULU] Creating fields for table.", this.fields);
-      table.uuid("id").primary().defaultTo(db4.fn.uuid());
+      table.uuid("id").primary().defaultTo(db3.fn.uuid());
       table.text("name");
       table.text("description");
       table.text("tags");
@@ -5169,19 +5239,19 @@ var ExuluContext = class {
         }
         mapType(table, type, sanitizeName(name), void 0, unique);
       }
-      table.timestamp("createdAt").defaultTo(db4.fn.now());
-      table.timestamp("updatedAt").defaultTo(db4.fn.now());
+      table.timestamp("createdAt").defaultTo(db3.fn.now());
+      table.timestamp("updatedAt").defaultTo(db3.fn.now());
     });
   };
   createChunksTable = async () => {
-    const { db: db4 } = await refreshPostgresClient();
+    const { db: db3 } = await refreshPostgresClient();
     const tableName = getChunksTableName(this.id);
     console.log("[EXULU] Creating table: " + tableName);
-    await db4.schema.createTable(tableName, (table) => {
+    await db3.schema.createTable(tableName, (table) => {
       if (!this.embedder) {
         throw new Error("Embedder must be set for context " + this.name + " to create chunks table.");
       }
-      table.uuid("id").primary().defaultTo(db4.fn.uuid());
+      table.uuid("id").primary().defaultTo(db3.fn.uuid());
       table.uuid("source").references("id").inTable(getTableName(this.id));
       table.text("content");
       table.jsonb("metadata");
@@ -5193,10 +5263,10 @@ var ExuluContext = class {
       );
       table.index(["fts"], `${tableName}_fts_gin_idx`, "gin");
       table.index(["source"], `${tableName}_source_idx`);
-      table.timestamp("createdAt").defaultTo(db4.fn.now());
-      table.timestamp("updatedAt").defaultTo(db4.fn.now());
+      table.timestamp("createdAt").defaultTo(db3.fn.now());
+      table.timestamp("updatedAt").defaultTo(db3.fn.now());
     });
-    await db4.raw(`
+    await db3.raw(`
             CREATE INDEX IF NOT EXISTS ${tableName}_embedding_hnsw_cosine
             ON ${tableName}
             USING hnsw (embedding vector_cosine_ops)
@@ -5217,7 +5287,7 @@ var ExuluContext = class {
       config: [],
       description: `Gets information from the context called: ${this.name}. The context description is: ${this.description}.`,
       execute: async ({ query, user, role }) => {
-        const { db: db4 } = await postgresClient();
+        const { db: db3 } = await postgresClient();
         const result = await vectorSearch({
           page: 1,
           limit: 10,
@@ -5227,7 +5297,7 @@ var ExuluContext = class {
           role,
           method: "hybridSearch",
           context: this,
-          db: db4,
+          db: db3,
           sort: void 0,
           trigger: "agent"
         });
@@ -5250,8 +5320,8 @@ var ExuluContext = class {
 var updateStatistic = async (statistic) => {
   console.log("[EXULU] Updating statistic", statistic);
   const currentDate = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
-  const { db: db4 } = await postgresClient();
-  const existing = await db4.from("tracking").where({
+  const { db: db3 } = await postgresClient();
+  const existing = await db3.from("tracking").where({
     ...statistic.user ? { user: statistic.user } : {},
     ...statistic.role ? { role: statistic.role } : {},
     name: statistic.name,
@@ -5261,7 +5331,7 @@ var updateStatistic = async (statistic) => {
   }).first();
   console.log("[EXULU] Existing", existing);
   if (!existing) {
-    await db4.from("tracking").insert({
+    await db3.from("tracking").insert({
       name: statistic.name,
       label: statistic.label,
       type: statistic.type,
@@ -5271,8 +5341,8 @@ var updateStatistic = async (statistic) => {
       ...statistic.role ? { role: statistic.role } : {}
     });
   } else {
-    await db4.from("tracking").update({
-      total: db4.raw("total + ?", [statistic.count ?? 1])
+    await db3.from("tracking").update({
+      total: db3.raw("total + ?", [statistic.count ?? 1])
     }).where({
       name: statistic.name,
       label: statistic.label,
@@ -5557,10 +5627,10 @@ var createExpressRoutes = async (app, agents, tools, contexts, config, tracer) =
         if (!authenticationResult.user?.id) {
           throw new Error(authenticationResult.message);
         }
-        const { db: db4 } = await postgresClient();
+        const { db: db3 } = await postgresClient();
         return {
           req,
-          db: db4,
+          db: db3,
           user: authenticationResult.user
         };
       }
@@ -5580,8 +5650,8 @@ var createExpressRoutes = async (app, agents, tools, contexts, config, tracer) =
       });
       return;
     }
-    const { db: db4 } = await postgresClient();
-    const variable = await db4.from("variables").where({ name: "OPENAI_IMAGE_GENERATION_API_KEY" }).first();
+    const { db: db3 } = await postgresClient();
+    const variable = await db3.from("variables").where({ name: "OPENAI_IMAGE_GENERATION_API_KEY" }).first();
     if (!variable) {
       res.status(400).json({
         message: "Provider API key variable not found."
@@ -5672,8 +5742,8 @@ Mood: friendly and intelligent.
       });
       return;
     }
-    const { db: db4 } = await postgresClient();
-    const evalRun = await db4.from("eval_runs").where({ id: evalRunId }).first();
+    const { db: db3 } = await postgresClient();
+    const evalRun = await db3.from("eval_runs").where({ id: evalRunId }).first();
     if (!evalRun) {
       res.status(404).json({
         message: "Eval run not found."
@@ -5701,7 +5771,7 @@ Mood: friendly and intelligent.
       });
       return;
     }
-    const testCases = await db4.from("test_cases").whereIn("id", testCaseIds);
+    const testCases = await db3.from("test_cases").whereIn("id", testCaseIds);
     if (testCases.length === 0) {
       res.status(404).json({
         message: "No test cases found."
@@ -5767,8 +5837,8 @@ Mood: friendly and intelligent.
     });
   });
   app.get("/theme", async (req, res) => {
-    const { db: db4 } = await postgresClient();
-    const themeConfig = await db4.from("platform_configurations").where({ config_key: "theme_config" }).first();
+    const { db: db3 } = await postgresClient();
+    const themeConfig = await db3.from("platform_configurations").where({ config_key: "theme_config" }).first();
     if (!themeConfig) {
       res.status(200).json({
         theme: {
@@ -5784,6 +5854,7 @@ Mood: friendly and intelligent.
   });
   app.get("/config", async (req, res) => {
     res.status(200).json({
+      authMode: process.env.AUTH_MODE,
       MCP: {
         enabled: config?.MCP.enabled
       },
@@ -5819,7 +5890,7 @@ Mood: friendly and intelligent.
         });
         return;
       }
-      const { db: db4 } = await postgresClient();
+      const { db: db3 } = await postgresClient();
       const agentInstance = await loadAgent(instance);
       const requestValidationResult = requestValidators.agents(req);
       if (requestValidationResult.error) {
@@ -5840,7 +5911,7 @@ Mood: friendly and intelligent.
         return;
       }
       if (headers.session) {
-        const session = await db4.from("agent_sessions").where({
+        const session = await db3.from("agent_sessions").where({
           id: headers.session
         }).first();
         let hasAccessToSession = await checkRecordAccess(session, "write", user);
@@ -5862,7 +5933,7 @@ Mood: friendly and intelligent.
       let enabledTools = await getEnabledTools(agentInstance, tools, disabledTools, agents, user);
       console.log("[EXULU] enabled tools", enabledTools?.map((x) => x.name + " (" + x.id + ")"));
       const variableName = agentInstance.providerapikey;
-      const variable = await db4.from("variables").where({ name: variableName }).first();
+      const variable = await db3.from("variables").where({ name: variableName }).first();
       if (!variable) {
         res.status(400).json({
           message: "Provider API key variable not found."
@@ -5965,8 +6036,8 @@ Mood: friendly and intelligent.
               return;
             }
             console.log("[EXULU] Authenticated call", authenticationResult.user?.email);
-            const { db: db4 } = await postgresClient();
-            let query = db4("agents");
+            const { db: db3 } = await postgresClient();
+            let query = db3("agents");
             query.select("*");
             query = applyAccessControl(agentsSchema2(), authenticationResult.user, query);
             query.where({ id: srcReq.params.id });
@@ -5986,7 +6057,7 @@ Mood: friendly and intelligent.
               return;
             }
             const variableName = agent.providerapikey;
-            const variable = await db4.from("variables").where({ name: variableName }).first();
+            const variable = await db3.from("variables").where({ name: variableName }).first();
             console.log("[EXULU] Variable loaded", variable);
             let providerapikey = variable.value;
             if (!variable.encrypted) {
@@ -6036,8 +6107,8 @@ Mood: friendly and intelligent.
         return;
       }
       const user = authenticationResult.user;
-      const { db: db4 } = await postgresClient();
-      let query = db4("agents");
+      const { db: db3 } = await postgresClient();
+      let query = db3("agents");
       query.select("*");
       query = applyAccessControl(agentsSchema2(), authenticationResult.user, query);
       query.where({ id: req.params.id });
@@ -6064,7 +6135,7 @@ Mood: friendly and intelligent.
         return;
       }
       const variableName = agent.providerapikey;
-      const variable = await db4.from("variables").where({ name: variableName }).first();
+      const variable = await db3.from("variables").where({ name: variableName }).first();
       if (!variable) {
         const arrayBuffer = createCustomAnthropicStreamingMessage(CLAUDE_MESSAGES.anthropic_token_variable_not_found);
         res.setHeader("Content-Type", "application/json");
@@ -6204,7 +6275,7 @@ var createWorkers = async (queues2, config, contexts, tracer) => {
     const worker = new import_bullmq5.Worker(
       `${queue}`,
       async (bullmqJob) => {
-        const { db: db4 } = await postgresClient();
+        const { db: db3 } = await postgresClient();
         try {
           const data = bullmqJob.data;
           bullmq.validate(bullmqJob.id, data);
@@ -6260,7 +6331,7 @@ var createWorkers = async (queues2, config, contexts, tracer) => {
             return result;
           }
         } catch (error) {
-          await db4.from("jobs").where({ redis: bullmqJob.id }).update({
+          await db3.from("jobs").where({ redis: bullmqJob.id }).update({
             status: "failed",
             finishedAt: /* @__PURE__ */ new Date(),
             error: error instanceof Error ? error.message : String(error)
@@ -6999,8 +7070,8 @@ var ExuluApp = class {
         context: contextId,
         item: itemId
       }) => {
-        const { db: db4 } = await postgresClient();
-        const item = await db4.from(getTableName(contextId)).where({ id: itemId }).select("*").first();
+        const { db: db3 } = await postgresClient();
+        const item = await db3.from(getTableName(contextId)).where({ id: itemId }).select("*").first();
         const context = this.contexts.find((x) => contextId === x.id);
         if (!context) {
           throw new Error(`Context ${contextId} not found in registry.`);
@@ -8300,59 +8371,6 @@ var SentenceChunker = class _SentenceChunker extends BaseChunker {
   }
 };
 
-// src/auth/generate-key.ts
-var import_bcryptjs3 = __toESM(require("bcryptjs"), 1);
-var SALT_ROUNDS = 12;
-async function encryptString(string) {
-  const hash = await import_bcryptjs3.default.hash(string, SALT_ROUNDS);
-  return hash;
-}
-var generateApiKey = async (name, email) => {
-  const { db: db4 } = await postgresClient();
-  console.log("[EXULU] Inserting default user and admin role.");
-  const existingRole = await db4.from("roles").where({ name: "admin" }).first();
-  let roleId;
-  if (!existingRole) {
-    console.log("[EXULU] Creating default admin role.");
-    const role = await db4.from("roles").insert({
-      name: "admin",
-      agents: "write",
-      workflows: "write",
-      variables: "write",
-      users: "write"
-    }).returning("id");
-    roleId = role[0].id;
-  } else {
-    roleId = existingRole.id;
-  }
-  const newKeyName = name;
-  const plainKey = `sk_${Math.random().toString(36).substring(2, 15)}_${Math.random().toString(36).substring(2, 15)}`;
-  const postFix = `/${newKeyName.toLowerCase().trim().replaceAll(" ", "_")}`;
-  const encryptedKey = await encryptString(plainKey);
-  const existingApiUser = await db4.from("users").where({ email }).first();
-  if (!existingApiUser) {
-    console.log("[EXULU] Creating default api user.");
-    await db4.from("users").insert({
-      name,
-      email,
-      super_admin: true,
-      createdAt: /* @__PURE__ */ new Date(),
-      updatedAt: /* @__PURE__ */ new Date(),
-      type: "api",
-      emailVerified: /* @__PURE__ */ new Date(),
-      apikey: `${encryptedKey}${postFix}`,
-      // password: "admin", todo add this again when we implement password auth / encryption as alternative to OTP
-      role: roleId
-    });
-    console.log("[EXULU] Default api user created. Key: ", `${plainKey}${postFix}`);
-  } else {
-    console.log("[EXULU] API user with that name already exists.");
-  }
-  return {
-    key: `${plainKey}${postFix}`
-  };
-};
-
 // src/postgres/init-db.ts
 var {
   agentsSchema: agentsSchema3,
@@ -8499,16 +8517,16 @@ var contextDatabases = async (contexts) => {
   }
 };
 var execute = async ({ contexts }) => {
-  const { db: db4 } = await postgresClient();
+  const { db: db3 } = await postgresClient();
   console.log("[EXULU] Checking Exulu IMP database status.");
-  await up(db4);
+  await up(db3);
   await contextDatabases(contexts);
   console.log("[EXULU] Inserting default user and admin role.");
-  const existingRole = await db4.from("roles").where({ name: "admin" }).first();
+  const existingRole = await db3.from("roles").where({ name: "admin" }).first();
   let roleId;
   if (!existingRole) {
     console.log("[EXULU] Creating default admin role.");
-    const role = await db4.from("roles").insert({
+    const role = await db3.from("roles").insert({
       name: "admin",
       agents: "write",
       workflows: "write",
@@ -8519,11 +8537,11 @@ var execute = async ({ contexts }) => {
   } else {
     roleId = existingRole.id;
   }
-  const existingUser = await db4.from("users").where({ email: "admin@exulu.com" }).first();
+  const existingUser = await db3.from("users").where({ email: "admin@exulu.com" }).first();
   if (!existingUser) {
     const password = await encryptString("admin");
     console.log("[EXULU] Creating default admin user.");
-    await db4.from("users").insert({
+    await db3.from("users").insert({
       name: "exulu",
       email: "admin@exulu.com",
       super_admin: true,
@@ -8630,8 +8648,8 @@ var ExuluDefaultAgents = {
 };
 var ExuluVariables = {
   get: async (name) => {
-    const { db: db4 } = await postgresClient();
-    let variable = await db4.from("variables").where({ name }).first();
+    const { db: db3 } = await postgresClient();
+    let variable = await db3.from("variables").where({ name }).first();
     if (!variable) {
       throw new Error(`Variable ${name} not found.`);
     }
@@ -8733,7 +8751,7 @@ var ExuluOtel = {
     });
   }
 };
-var db3 = {
+var db2 = {
   init: async ({
     contexts
   }) => {