@hotmeshio/long-tail 0.1.0

package/build/modules/auth.js

@@ -0,0 +1,163 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requireAdmin = exports.requireAuth = exports.JwtAuthAdapter = void 0;
+exports.createAuthMiddleware = createAuthMiddleware;
+exports.setAuthAdapter = setAuthAdapter;
+exports.signToken = signToken;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const config_1 = require("./config");
+const user_1 = require("../services/user");
+const bot_api_key_1 = require("../services/auth/bot-api-key");
+const principal_1 = require("../services/iam/principal");
+/**
+ * Reference JWT auth adapter using `jsonwebtoken`.
+ *
+ * Reads a Bearer token from the Authorization header and verifies it
+ * with the configured secret. Returns the decoded payload or null.
+ */
+class JwtAuthAdapter {
+    constructor(secret) {
+        this.explicitSecret = secret;
+    }
+    authenticate(req) {
+        const header = req.headers.authorization;
+        if (!header?.startsWith('Bearer '))
+            return null;
+        const token = header.slice(7);
+        // Bot API key authentication (async path)
+        if (token.startsWith('lt_bot_')) {
+            return this.authenticateBotApiKey(token);
+        }
+        // JWT authentication (sync path)
+        const secret = this.explicitSecret ?? config_1.config.JWT_SECRET;
+        if (!secret)
+            return null;
+        try {
+            return jsonwebtoken_1.default.verify(token, secret);
+        }
+        catch (err) {
+            if (err instanceof jsonwebtoken_1.default.TokenExpiredError) {
+                // Tag the request so the middleware can return a specific message
+                req._authError = 'expired';
+            }
+            return null;
+        }
+    }
+    async authenticateBotApiKey(rawKey) {
+        try {
+            const keyRecord = await (0, bot_api_key_1.validateBotApiKey)(rawKey);
+            if (!keyRecord)
+                return null;
+            // Resolve bot's actual roles (single JOIN query) instead of hardcoding 'member'
+            const principal = await (0, principal_1.resolvePrincipal)(keyRecord.user_id);
+            const role = principal?.roleType ?? 'member';
+            return {
+                userId: keyRecord.user_id,
+                role,
+                scopes: keyRecord.scopes ?? [],
+                principalType: 'bot',
+            };
+        }
+        catch {
+            return null;
+        }
+    }
+}
+exports.JwtAuthAdapter = JwtAuthAdapter;
+/**
+ * Create Express middleware from any auth adapter.
+ *
+ * The adapter handles token extraction and verification.
+ * This middleware handles the HTTP response (401) and ensures
+ * the payload contains a `userId` claim before setting `req.auth`.
+ *
+ * Usage:
+ * ```typescript
+ * import { createAuthMiddleware, JwtAuthAdapter } from '@hotmeshio/long-tail';
+ *
+ * // Use the reference JWT adapter
+ * app.use(createAuthMiddleware(new JwtAuthAdapter('my-secret')));
+ *
+ * // Or plug in your own adapter
+ * app.use(createAuthMiddleware(myClerkAdapter));
+ * ```
+ */
+function createAuthMiddleware(adapter) {
+    return async (req, res, next) => {
+        try {
+            const payload = await adapter.authenticate(req);
+            if (!payload) {
+                const isExpired = req._authError === 'expired';
+                res.status(401).json({ error: isExpired ? 'Token expired' : 'Unauthorized' });
+                return;
+            }
+            if (!payload.userId) {
+                res.status(401).json({ error: 'Token missing required userId claim' });
+                return;
+            }
+            req.auth = payload;
+            next();
+        }
+        catch {
+            res.status(401).json({ error: 'Unauthorized' });
+        }
+    };
+}
+/**
+ * Default auth middleware using JWT with `config.JWT_SECRET`.
+ * Drop-in replacement for custom middleware — just import and use.
+ *
+ * When `setAuthAdapter()` is called (e.g., from `start()`), this
+ * middleware delegates to the custom adapter instead.
+ */
+let _authMiddleware = null;
+const requireAuth = (req, res, next) => {
+    const mw = _authMiddleware || createAuthMiddleware(new JwtAuthAdapter());
+    mw(req, res, next);
+};
+exports.requireAuth = requireAuth;
+/**
+ * Replace the auth adapter used by `requireAuth`.
+ * Call before starting the server.
+ */
+function setAuthAdapter(adapter) {
+    _authMiddleware = createAuthMiddleware(adapter);
+}
+/**
+ * Middleware that requires admin access. Must be placed AFTER requireAuth.
+ *
+ * Checks isSuperAdmin() via the database first, then falls back to the
+ * JWT `role` claim for stateless admin checks. Returns 403 otherwise.
+ */
+const requireAdmin = async (req, res, next) => {
+    try {
+        if (!req.auth?.userId) {
+            res.status(403).json({ error: 'Forbidden' });
+            return;
+        }
+        // Fast path: trust the JWT role claim for admin/superadmin
+        if (req.auth.role === 'admin' || req.auth.role === 'superadmin') {
+            next();
+            return;
+        }
+        // Slow path: check database for superadmin role type
+        if (await (0, user_1.isSuperAdmin)(req.auth.userId)) {
+            next();
+            return;
+        }
+        res.status(403).json({ error: 'Forbidden: admin access required' });
+    }
+    catch {
+        res.status(403).json({ error: 'Forbidden' });
+    }
+};
+exports.requireAdmin = requireAdmin;
+/**
+ * Generate a JWT token. Utility for tests and token provisioning.
+ */
+function signToken(payload, expiresIn = '24h') {
+    return jsonwebtoken_1.default.sign(payload, config_1.config.JWT_SECRET, { expiresIn });
+}

package/build/modules/config.d.ts

@@ -0,0 +1,19 @@
+export declare const config: {
+    POSTGRES_HOST: string;
+    POSTGRES_PORT: number;
+    POSTGRES_USER: string;
+    POSTGRES_PASSWORD: string;
+    POSTGRES_DB: string;
+    NATS_URL: string;
+    PORT: number;
+    NODE_ENV: string;
+    JWT_SECRET: string;
+    HONEYCOMB_API_KEY: string;
+};
+export declare const postgres_options: {
+    host: string;
+    port: number;
+    user: string;
+    password: string;
+    database: string;
+};

package/build/modules/config.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.postgres_options = exports.config = void 0;
+exports.config = {
+    POSTGRES_HOST: process.env.POSTGRES_HOST || 'localhost',
+    POSTGRES_PORT: parseInt(process.env.POSTGRES_PORT || '5432', 10),
+    POSTGRES_USER: process.env.POSTGRES_USER || 'postgres',
+    POSTGRES_PASSWORD: process.env.POSTGRES_PASSWORD || 'password',
+    // In test environments, always use the test database to prevent accidental
+    // pollution of the dev/prod database from test runs.
+    POSTGRES_DB: process.env.NODE_ENV === 'test'
+        ? 'longtail_test'
+        : (process.env.POSTGRES_DB || 'longtail'),
+    NATS_URL: process.env.NATS_URL || 'nats://localhost:4222',
+    PORT: parseInt(process.env.PORT || '3000', 10),
+    NODE_ENV: process.env.NODE_ENV || 'development',
+    JWT_SECRET: process.env.JWT_SECRET || '',
+    HONEYCOMB_API_KEY: process.env.HONEYCOMB_API_KEY || '',
+};
+exports.postgres_options = {
+    host: exports.config.POSTGRES_HOST,
+    port: exports.config.POSTGRES_PORT,
+    user: exports.config.POSTGRES_USER,
+    password: exports.config.POSTGRES_PASSWORD,
+    database: exports.config.POSTGRES_DB,
+};

package/build/modules/defaults.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Platform defaults — single source of truth for tunable constants.
+ *
+ * Every value can be overridden via the corresponding environment variable.
+ * When adding a new constant, follow the pattern:
+ *   env → parse → fallback to sensible default.
+ *
+ * Grouped by domain so related knobs live together.
+ */
+/** Primary model for agentic/insight workflows (tool-calling capable). */
+export declare const LLM_MODEL_PRIMARY: string;
+/** Lighter model for summarization, interpretation, and vision tasks. */
+export declare const LLM_MODEL_SECONDARY: string;
+/** Base URL for OpenAI-compatible providers (Groq, Together, local). */
+export declare const LLM_BASE_URL: string | undefined;
+/** Default max_tokens when the LLM is called without tool definitions. */
+export declare const LLM_MAX_TOKENS_DEFAULT: number;
+/** Max tokens for structured JSON interpretation steps. */
+export declare const LLM_MAX_TOKENS_JSON: number;
+/** Max tokens for vision/document extraction calls. */
+export declare const LLM_MAX_TOKENS_VISION: number;
+/** Truncate arrays beyond this length before sending to the LLM. */
+export declare const LLM_MAX_ARRAY_ITEMS: number;
+/** Hard character cap on serialized input payloads sent to the LLM. */
+export declare const LLM_MAX_INPUT_CHARS: number;
+/** Max agentic loop iterations for MCP triage workflows. */
+export declare const TOOL_ROUNDS_TRIAGE: number;
+/** Max agentic loop iterations for mcpQuery (higher — includes recall + discover + persist phases). */
+export declare const TOOL_ROUNDS_MCP_QUERY: number;
+/** Cap on `limit` argument baked into generated YAML tool steps. */
+export declare const TOOL_ARG_LIMIT_CAP: number;
+/** Default graph expiry in seconds for generated YAML workflows (5 min — must exceed longest activity chain). */
+export declare const WORKFLOW_EXPIRE_SECS: number;
+/** Default job expiry in seconds for workflow executions (30 days). */
+export declare const JOB_EXPIRE_SECS: number;
+/** Default timeout (ms) for synchronous workflow invocations (5 min — matches WORKFLOW_EXPIRE_SECS). */
+export declare const WORKFLOW_SYNC_TIMEOUT_MS: number;
+/** MCP tool call timeout (ms). Overrides the MCP SDK default of 60s which is too short for browser automation. */
+export declare const MCP_TOOL_TIMEOUT_MS: number;
+/** Config cache TTL in milliseconds. */
+export declare const CONFIG_CACHE_TTL_MS: number;
+/** Default page size for MCP DB tool queries (find_tasks, etc.). */
+export declare const QUERY_LIMIT_DEFAULT: number;
+/** Maximum allowed page size for MCP DB tool queries. */
+export declare const QUERY_LIMIT_MAX: number;
+/** Default page size for YAML workflow listings. */
+export declare const YAML_LIST_LIMIT: number;
+/** Default page size for YAML workflow version history. */
+export declare const YAML_VERSION_LIMIT: number;
+/**
+ * Claim duration presets shown in the dashboard (minutes).
+ * Override via JSON array, e.g. LT_CLAIM_DURATION_OPTIONS='[15,30,60,480]'
+ */
+export declare const CLAIM_DURATION_OPTIONS: number[];
+/** Common stop words filtered from keyword extraction (tag derivation, FTS queries, prompt parsing). */
+export declare const STOP_WORDS: Set<string>;
+/** YAML dump line width. */
+export declare const YAML_LINE_WIDTH: number;

package/build/modules/defaults.js

@@ -0,0 +1,95 @@
+"use strict";
+/**
+ * Platform defaults — single source of truth for tunable constants.
+ *
+ * Every value can be overridden via the corresponding environment variable.
+ * When adding a new constant, follow the pattern:
+ *   env → parse → fallback to sensible default.
+ *
+ * Grouped by domain so related knobs live together.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.YAML_LINE_WIDTH = exports.STOP_WORDS = exports.CLAIM_DURATION_OPTIONS = exports.YAML_VERSION_LIMIT = exports.YAML_LIST_LIMIT = exports.QUERY_LIMIT_MAX = exports.QUERY_LIMIT_DEFAULT = exports.CONFIG_CACHE_TTL_MS = exports.MCP_TOOL_TIMEOUT_MS = exports.WORKFLOW_SYNC_TIMEOUT_MS = exports.JOB_EXPIRE_SECS = exports.WORKFLOW_EXPIRE_SECS = exports.TOOL_ARG_LIMIT_CAP = exports.TOOL_ROUNDS_MCP_QUERY = exports.TOOL_ROUNDS_TRIAGE = exports.LLM_MAX_INPUT_CHARS = exports.LLM_MAX_ARRAY_ITEMS = exports.LLM_MAX_TOKENS_VISION = exports.LLM_MAX_TOKENS_JSON = exports.LLM_MAX_TOKENS_DEFAULT = exports.LLM_BASE_URL = exports.LLM_MODEL_SECONDARY = exports.LLM_MODEL_PRIMARY = void 0;
+function envInt(key, fallback) {
+    const v = process.env[key];
+    if (v === undefined || v === '')
+        return fallback;
+    const n = parseInt(v, 10);
+    return Number.isNaN(n) ? fallback : n;
+}
+function envStr(key, fallback) {
+    return process.env[key] || fallback;
+}
+// ── LLM ──────────────────────────────────────────────────────────────
+/** Primary model for agentic/insight workflows (tool-calling capable). */
+exports.LLM_MODEL_PRIMARY = envStr('LT_LLM_MODEL_PRIMARY', 'claude-sonnet-4-6');
+/** Lighter model for summarization, interpretation, and vision tasks. */
+exports.LLM_MODEL_SECONDARY = envStr('LT_LLM_MODEL_SECONDARY', 'claude-haiku-4-5-20251001');
+/** Base URL for OpenAI-compatible providers (Groq, Together, local). */
+exports.LLM_BASE_URL = process.env.LT_LLM_BASE_URL || undefined;
+/** Default max_tokens when the LLM is called without tool definitions. */
+exports.LLM_MAX_TOKENS_DEFAULT = envInt('LT_LLM_MAX_TOKENS_DEFAULT', 1500);
+/** Max tokens for structured JSON interpretation steps. */
+exports.LLM_MAX_TOKENS_JSON = envInt('LT_LLM_MAX_TOKENS_JSON', 800);
+/** Max tokens for vision/document extraction calls. */
+exports.LLM_MAX_TOKENS_VISION = envInt('LT_LLM_MAX_TOKENS_VISION', 2000);
+/** Truncate arrays beyond this length before sending to the LLM. */
+exports.LLM_MAX_ARRAY_ITEMS = envInt('LT_LLM_MAX_ARRAY_ITEMS', 25);
+/** Hard character cap on serialized input payloads sent to the LLM. */
+exports.LLM_MAX_INPUT_CHARS = envInt('LT_LLM_MAX_INPUT_CHARS', 12_000);
+// ── Tool execution ───────────────────────────────────────────────────
+/** Max agentic loop iterations for MCP triage workflows. */
+exports.TOOL_ROUNDS_TRIAGE = envInt('LT_TOOL_ROUNDS_TRIAGE', 10);
+/** Max agentic loop iterations for mcpQuery (higher — includes recall + discover + persist phases). */
+exports.TOOL_ROUNDS_MCP_QUERY = envInt('LT_TOOL_ROUNDS_MCP_QUERY', 15);
+/** Cap on `limit` argument baked into generated YAML tool steps. */
+exports.TOOL_ARG_LIMIT_CAP = envInt('LT_TOOL_ARG_LIMIT_CAP', 25);
+// ── Workflow execution ───────────────────────────────────────────────
+/** Default graph expiry in seconds for generated YAML workflows (5 min — must exceed longest activity chain). */
+exports.WORKFLOW_EXPIRE_SECS = envInt('LT_WORKFLOW_EXPIRE_SECS', 300);
+/** Default job expiry in seconds for workflow executions (30 days). */
+exports.JOB_EXPIRE_SECS = envInt('LT_JOB_EXPIRE_SECS', 30 * 24 * 60 * 60);
+/** Default timeout (ms) for synchronous workflow invocations (5 min — matches WORKFLOW_EXPIRE_SECS). */
+exports.WORKFLOW_SYNC_TIMEOUT_MS = envInt('LT_WORKFLOW_SYNC_TIMEOUT_MS', 300_000);
+/** MCP tool call timeout (ms). Overrides the MCP SDK default of 60s which is too short for browser automation. */
+exports.MCP_TOOL_TIMEOUT_MS = envInt('LT_MCP_TOOL_TIMEOUT_MS', 300_000);
+/** Config cache TTL in milliseconds. */
+exports.CONFIG_CACHE_TTL_MS = envInt('LT_CONFIG_CACHE_TTL_MS', 5 * 60 * 1000);
+// ── Query / pagination ───────────────────────────────────────────────
+/** Default page size for MCP DB tool queries (find_tasks, etc.). */
+exports.QUERY_LIMIT_DEFAULT = envInt('LT_QUERY_LIMIT_DEFAULT', 25);
+/** Maximum allowed page size for MCP DB tool queries. */
+exports.QUERY_LIMIT_MAX = envInt('LT_QUERY_LIMIT_MAX', 100);
+/** Default page size for YAML workflow listings. */
+exports.YAML_LIST_LIMIT = envInt('LT_YAML_LIST_LIMIT', 50);
+/** Default page size for YAML workflow version history. */
+exports.YAML_VERSION_LIMIT = envInt('LT_YAML_VERSION_LIMIT', 20);
+// ── Escalation ──────────────────────────────────────────────────────
+/**
+ * Claim duration presets shown in the dashboard (minutes).
+ * Override via JSON array, e.g. LT_CLAIM_DURATION_OPTIONS='[15,30,60,480]'
+ */
+exports.CLAIM_DURATION_OPTIONS = (() => {
+    const raw = process.env.LT_CLAIM_DURATION_OPTIONS;
+    if (!raw)
+        return [15, 30, 60, 240];
+    try {
+        const parsed = JSON.parse(raw);
+        if (Array.isArray(parsed) && parsed.every((n) => typeof n === 'number' && n > 0)) {
+            return parsed;
+        }
+    }
+    catch { /* fall through */ }
+    return [15, 30, 60, 240];
+})();
+// ── Text processing ─────────────────────────────────────────────────
+/** Common stop words filtered from keyword extraction (tag derivation, FTS queries, prompt parsing). */
+exports.STOP_WORDS = new Set([
+    'the', 'and', 'for', 'with', 'from', 'that', 'this', 'are', 'was',
+    'not', 'but', 'has', 'have', 'had', 'been', 'will', 'can', 'all',
+    'please', 'take', 'make', 'show', 'get', 'use', 'find', 'give',
+    'want', 'need', 'would', 'could', 'should', 'about', 'what', 'how',
+]);
+// ── Formatting ───────────────────────────────────────────────────────
+/** YAML dump line width. */
+exports.YAML_LINE_WIDTH = envInt('LT_YAML_LINE_WIDTH', 120);

package/build/modules/ltconfig.d.ts

@@ -0,0 +1,21 @@
+import type { LTResolvedConfig, LTProviderData } from '../types';
+declare class LTConfigCache {
+    private configs;
+    private loadedAt;
+    private loadPromise;
+    private ensureLoaded;
+    private get;
+    isInvocable(name: string): Promise<boolean>;
+    getInvocationRoles(name: string): Promise<string[]>;
+    getTargetEscalationRole(name: string): Promise<string>;
+    getAllowedEscalationRoles(name: string): Promise<string[]>;
+    getToolTags(name: string): Promise<string[]>;
+    getProviders(name: string): Promise<string[]>;
+    getProviderData(name: string, originId: string): Promise<LTProviderData>;
+    /** Force cache reload on next access. Call after config mutations. */
+    invalidate(): void;
+    /** Get the full resolved config for a workflow (used by interceptor activities). */
+    getResolvedConfig(name: string): Promise<LTResolvedConfig | null>;
+}
+export declare const ltConfig: LTConfigCache;
+export {};

package/build/modules/ltconfig.js

@@ -0,0 +1,110 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ltConfig = void 0;
+const configService = __importStar(require("../services/config"));
+const defaults_1 = require("./defaults");
+const TTL_MS = defaults_1.CONFIG_CACHE_TTL_MS;
+class LTConfigCache {
+    constructor() {
+        this.configs = null;
+        this.loadedAt = 0;
+        this.loadPromise = null;
+    }
+    async ensureLoaded() {
+        if (this.configs && Date.now() - this.loadedAt < TTL_MS) {
+            return this.configs;
+        }
+        if (!this.loadPromise) {
+            this.loadPromise = configService
+                .loadAllConfigs()
+                .then((configs) => {
+                this.configs = configs;
+                this.loadedAt = Date.now();
+                return configs;
+            })
+                .finally(() => {
+                this.loadPromise = null;
+            });
+        }
+        return this.loadPromise;
+    }
+    async get(name) {
+        const configs = await this.ensureLoaded();
+        return configs.get(name);
+    }
+    async isInvocable(name) {
+        const config = await this.get(name);
+        return config?.invocable ?? false;
+    }
+    async getInvocationRoles(name) {
+        const config = await this.get(name);
+        return config?.invocationRoles ?? [];
+    }
+    async getTargetEscalationRole(name) {
+        const config = await this.get(name);
+        return config?.role ?? 'reviewer';
+    }
+    async getAllowedEscalationRoles(name) {
+        const config = await this.get(name);
+        return config?.roles ?? [];
+    }
+    async getToolTags(name) {
+        const config = await this.get(name);
+        return config?.toolTags ?? [];
+    }
+    async getProviders(name) {
+        const config = await this.get(name);
+        return config?.consumes ?? [];
+    }
+    async getProviderData(name, originId) {
+        const consumes = await this.getProviders(name);
+        if (!consumes.length || !originId)
+            return {};
+        return configService.getProviderData(consumes, originId);
+    }
+    /** Force cache reload on next access. Call after config mutations. */
+    invalidate() {
+        this.configs = null;
+        this.loadedAt = 0;
+        this.loadPromise = null;
+    }
+    /** Get the full resolved config for a workflow (used by interceptor activities). */
+    async getResolvedConfig(name) {
+        const config = await this.get(name);
+        return config ?? null;
+    }
+}
+exports.ltConfig = new LTConfigCache();

package/build/modules/maintenance.d.ts

@@ -0,0 +1,18 @@
+import type { LTMaintenanceConfig } from '../types/maintenance';
+/**
+ * Default maintenance rules.
+ *
+ * Schedule: weekly on Sundays at 2 AM.
+ *
+ * Rules (executed sequentially):
+ * 1. Delete stream messages older than 30 days
+ * 2. Delete transient jobs (entity IS NULL) older than 30 days
+ * 3. Strip execution artifacts from entity jobs older than 30 days
+ *    (preserves jdata, udata, jmark, hmark — exports always work)
+ * 4. Hard-delete pruned jobs older than 180 days
+ *
+ * Conservative defaults — execution artifacts (activity inputs, stream
+ * history) are needed for rich export data. Pruning too early strips
+ * inputs from the execution timeline.
+ */
+export declare const defaultMaintenanceConfig: LTMaintenanceConfig;

package/build/modules/maintenance.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultMaintenanceConfig = void 0;
+/**
+ * Default maintenance rules.
+ *
+ * Schedule: weekly on Sundays at 2 AM.
+ *
+ * Rules (executed sequentially):
+ * 1. Delete stream messages older than 30 days
+ * 2. Delete transient jobs (entity IS NULL) older than 30 days
+ * 3. Strip execution artifacts from entity jobs older than 30 days
+ *    (preserves jdata, udata, jmark, hmark — exports always work)
+ * 4. Hard-delete pruned jobs older than 180 days
+ *
+ * Conservative defaults — execution artifacts (activity inputs, stream
+ * history) are needed for rich export data. Pruning too early strips
+ * inputs from the execution timeline.
+ */
+exports.defaultMaintenanceConfig = {
+    schedule: '0 2 * * 0',
+    rules: [
+        {
+            target: 'streams',
+            action: 'delete',
+            olderThan: '30 days',
+        },
+        {
+            target: 'jobs',
+            action: 'delete',
+            olderThan: '30 days',
+            hasEntity: false,
+        },
+        {
+            target: 'jobs',
+            action: 'prune',
+            olderThan: '30 days',
+            hasEntity: true,
+        },
+        {
+            target: 'jobs',
+            action: 'delete',
+            olderThan: '180 days',
+            pruned: true,
+        },
+    ],
+};

package/build/routes/auth.d.ts

@@ -0,0 +1,2 @@
+declare const router: import("express-serve-static-core").Router;
+export default router;

package/build/routes/auth.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const express_1 = require("express");
+const user_1 = require("../services/user");
+const auth_1 = require("../modules/auth");
+const router = (0, express_1.Router)();
+/**
+ * POST /api/auth/login
+ * Authenticate with username (external_id) and password.
+ * Returns a JWT token on success.
+ */
+router.post('/login', async (req, res) => {
+    try {
+        const { username, password } = req.body || {};
+        if (!username || !password) {
+            res.status(400).json({ error: 'username and password are required' });
+            return;
+        }
+        const user = await (0, user_1.verifyPassword)(username, password);
+        if (!user) {
+            res.status(401).json({ error: 'Invalid credentials' });
+            return;
+        }
+        const highestType = user.roles.some((r) => r.type === 'superadmin')
+            ? 'superadmin'
+            : user.roles.some((r) => r.type === 'admin')
+                ? 'admin'
+                : 'member';
+        const token = (0, auth_1.signToken)({
+            userId: user.id,
+            role: highestType,
+            roles: user.roles.map((r) => ({ role: r.role, type: r.type })),
+        }, '24h');
+        res.json({
+            token,
+            user: {
+                id: user.id,
+                external_id: user.external_id,
+                display_name: user.display_name,
+                roles: user.roles,
+            },
+        });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+exports.default = router;

package/build/routes/bot-accounts.d.ts

@@ -0,0 +1,2 @@
+declare const router: import("express-serve-static-core").Router;
+export default router;