@hotmeshio/long-tail 0.1.0

package/build/routes/bot-accounts.js

@@ -0,0 +1,280 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const express_1 = require("express");
+const auth_1 = require("../modules/auth");
+const iam = __importStar(require("../services/iam"));
+const user_1 = require("../services/user");
+const router = (0, express_1.Router)();
+// All bot account routes require admin access
+router.use(auth_1.requireAdmin);
+// ── Bot CRUD ─────────────────────────────────────────────────────────────────
+/**
+ * GET /api/bot-accounts
+ * List all bot accounts.
+ * Query: ?limit=50&offset=0
+ */
+router.get('/', async (req, res) => {
+    try {
+        const limit = req.query.limit ? parseInt(req.query.limit, 10) : 50;
+        const offset = req.query.offset ? parseInt(req.query.offset, 10) : 0;
+        const result = await iam.listBots(limit, offset);
+        res.json(result);
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+/**
+ * GET /api/bot-accounts/:id
+ * Get a single bot account.
+ */
+router.get('/:id', async (req, res) => {
+    try {
+        const bot = await iam.getBot(req.params.id);
+        if (!bot) {
+            res.status(404).json({ error: 'Bot not found' });
+            return;
+        }
+        res.json(bot);
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+/**
+ * POST /api/bot-accounts
+ * Create a new bot account.
+ * Body: { name, description?, display_name?, roles?: [{ role, type }] }
+ */
+router.post('/', async (req, res) => {
+    try {
+        const { name, description, display_name, roles } = req.body || {};
+        if (!name) {
+            res.status(400).json({ error: 'name is required' });
+            return;
+        }
+        if (roles) {
+            for (const r of roles) {
+                if (!r.role || !r.type || !(0, user_1.isValidRoleType)(r.type)) {
+                    res.status(400).json({
+                        error: 'Each role must have a role name and type (superadmin, admin, member)',
+                    });
+                    return;
+                }
+            }
+        }
+        const bot = await iam.createBot({
+            name,
+            description,
+            display_name,
+            roles,
+            created_by: req.auth?.userId,
+        });
+        res.status(201).json(bot);
+    }
+    catch (err) {
+        if (err.code === '23505') {
+            res.status(409).json({ error: 'Bot with this name already exists' });
+            return;
+        }
+        res.status(500).json({ error: err.message });
+    }
+});
+/**
+ * PUT /api/bot-accounts/:id
+ * Update a bot account.
+ * Body: { display_name?, description?, status? }
+ */
+router.put('/:id', async (req, res) => {
+    try {
+        const bot = await iam.updateBot(req.params.id, req.body || {});
+        if (!bot) {
+            res.status(404).json({ error: 'Bot not found' });
+            return;
+        }
+        res.json(bot);
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+/**
+ * DELETE /api/bot-accounts/:id
+ * Delete a bot account.
+ */
+router.delete('/:id', async (req, res) => {
+    try {
+        const deleted = await iam.deleteBot(req.params.id);
+        if (!deleted) {
+            res.status(404).json({ error: 'Bot not found' });
+            return;
+        }
+        res.json({ deleted: true });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+// ── Bot roles ────────────────────────────────────────────────────────────────
+/**
+ * GET /api/bot-accounts/:id/roles
+ * List roles for a bot.
+ */
+router.get('/:id/roles', async (req, res) => {
+    try {
+        const bot = await iam.getBot(req.params.id);
+        if (!bot) {
+            res.status(404).json({ error: 'Bot not found' });
+            return;
+        }
+        const roles = await iam.getBotRoles(req.params.id);
+        res.json({ roles });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+/**
+ * POST /api/bot-accounts/:id/roles
+ * Add a role to a bot.
+ * Body: { role, type }
+ */
+router.post('/:id/roles', async (req, res) => {
+    try {
+        const { role, type } = req.body || {};
+        if (!role || !type) {
+            res.status(400).json({ error: 'role and type are required' });
+            return;
+        }
+        if (!(0, user_1.isValidRoleType)(type)) {
+            res.status(400).json({ error: 'type must be superadmin, admin, or member' });
+            return;
+        }
+        const bot = await iam.getBot(req.params.id);
+        if (!bot) {
+            res.status(404).json({ error: 'Bot not found' });
+            return;
+        }
+        const result = await iam.addBotRole(req.params.id, role, type);
+        res.status(201).json(result);
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+/**
+ * DELETE /api/bot-accounts/:id/roles/:role
+ * Remove a role from a bot.
+ */
+router.delete('/:id/roles/:role', async (req, res) => {
+    try {
+        const removed = await iam.removeBotRole(req.params.id, req.params.role);
+        if (!removed) {
+            res.status(404).json({ error: 'Role not found' });
+            return;
+        }
+        res.json({ removed: true });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+// ── API keys ─────────────────────────────────────────────────────────────────
+/**
+ * GET /api/bot-accounts/:id/api-keys
+ * List API keys for a bot (without secret values).
+ */
+router.get('/:id/api-keys', async (req, res) => {
+    try {
+        const bot = await iam.getBot(req.params.id);
+        if (!bot) {
+            res.status(404).json({ error: 'Bot not found' });
+            return;
+        }
+        const keys = await iam.listBotKeys(req.params.id);
+        res.json({ keys });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+/**
+ * POST /api/bot-accounts/:id/api-keys
+ * Generate a new API key for a bot.
+ * Body: { name, scopes?: string[], expires_at?: string }
+ * Returns the raw key ONCE — it cannot be retrieved again.
+ */
+router.post('/:id/api-keys', async (req, res) => {
+    try {
+        const { name, scopes, expires_at } = req.body || {};
+        if (!name) {
+            res.status(400).json({ error: 'name is required' });
+            return;
+        }
+        const expiresAt = expires_at ? new Date(expires_at) : undefined;
+        const result = await iam.createBotKey(req.params.id, name, scopes || [], expiresAt);
+        res.status(201).json(result);
+    }
+    catch (err) {
+        if (err.message === 'Bot not found') {
+            res.status(404).json({ error: err.message });
+            return;
+        }
+        if (err.code === '23505') {
+            res.status(409).json({ error: 'API key with this name already exists for this bot' });
+            return;
+        }
+        res.status(500).json({ error: err.message });
+    }
+});
+/**
+ * DELETE /api/bot-accounts/:id/api-keys/:keyId
+ * Revoke (delete) a bot API key.
+ */
+router.delete('/:id/api-keys/:keyId', async (req, res) => {
+    try {
+        const revoked = await iam.revokeBotKey(req.params.keyId);
+        if (!revoked) {
+            res.status(404).json({ error: 'API key not found' });
+            return;
+        }
+        res.json({ revoked: true });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+exports.default = router;

package/build/routes/controlplane.d.ts

@@ -0,0 +1,2 @@
+declare const router: import("express-serve-static-core").Router;
+export default router;

package/build/routes/controlplane.js

@@ -0,0 +1,144 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const express_1 = require("express");
+const auth_1 = require("../modules/auth");
+const controlplane = __importStar(require("../services/controlplane"));
+const events_1 = require("../services/events");
+const router = (0, express_1.Router)();
+/**
+ * GET /api/controlplane/apps
+ * List available HotMesh application IDs.
+ * Admin-only.
+ */
+router.get('/apps', auth_1.requireAdmin, async (_req, res) => {
+    try {
+        const apps = await controlplane.listApps();
+        res.json({ apps });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+/**
+ * GET /api/controlplane/rollcall?app_id=durable&delay=1000
+ * Execute a roll call — discovers all engines and workers.
+ * Admin-only.
+ */
+router.get('/rollcall', auth_1.requireAdmin, async (req, res) => {
+    try {
+        const appId = req.query.app_id || 'durable';
+        const delay = req.query.delay ? parseInt(req.query.delay, 10) : undefined;
+        const profiles = await controlplane.rollCall(appId, delay);
+        res.json({ profiles });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+/**
+ * POST /api/controlplane/throttle
+ * Apply a throttle command to the mesh.
+ * Admin-only.
+ *
+ * Body: { appId: string, throttle: number, topic?: string, guid?: string }
+ *   throttle: ms delay (-1 = pause, 0 = resume, >0 = delay per msg)
+ */
+router.post('/throttle', auth_1.requireAdmin, async (req, res) => {
+    try {
+        const { appId = 'durable', throttle, topic, guid } = req.body;
+        if (typeof throttle !== 'number') {
+            res.status(400).json({ error: 'throttle (number) is required' });
+            return;
+        }
+        const result = await controlplane.applyThrottle(appId, { throttle, topic, guid });
+        // Publish a synthetic event so the dashboard event stream sees it
+        // (throttle commands don't echo back through the quorum subscription)
+        const throttleEvent = {
+            type: 'mesh.throttle',
+            source: 'controlplane',
+            workflowId: guid || '',
+            workflowName: '',
+            taskQueue: appId,
+            data: { throttle, topic, guid, appId },
+            timestamp: new Date().toISOString(),
+        };
+        events_1.eventRegistry.publish(throttleEvent).catch(() => { });
+        res.json({ success: result });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+/**
+ * GET /api/controlplane/streams?app_id=durable&duration=1h&stream=hmsh:durable:x:
+ * Stream processing statistics — pending count + processed volume by time range.
+ * Admin-only.
+ *
+ * duration: 15m | 30m | 1h | 1d | 7d (default: 1h)
+ * stream: optional stream_name filter (specific task queue topic)
+ */
+router.get('/streams', auth_1.requireAdmin, async (req, res) => {
+    try {
+        const schema = req.query.app_id || 'durable';
+        const duration = req.query.duration || '1h';
+        const stream = req.query.stream || undefined;
+        const stats = await controlplane.getStreamStats(schema, duration, stream);
+        res.json(stats);
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+/**
+ * POST /api/controlplane/subscribe
+ * Start the quorum→NATS bridge for an appId.
+ * Subscribes to the HotMesh quorum channel and republishes
+ * all control plane messages to NATS on `lt.mesh.*` topics.
+ * Admin-only.
+ *
+ * Body: { appId: string }
+ */
+router.post('/subscribe', auth_1.requireAdmin, async (req, res) => {
+    try {
+        const { appId = 'durable' } = req.body;
+        await controlplane.subscribeMesh(appId);
+        res.json({ subscribed: true, appId });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+exports.default = router;

package/build/routes/dba.d.ts

@@ -0,0 +1,2 @@
+declare const router: import("express-serve-static-core").Router;
+export default router;

package/build/routes/dba.js

@@ -0,0 +1,86 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const express_1 = require("express");
+const auth_1 = require("../modules/auth");
+const dbaService = __importStar(require("../services/dba"));
+const router = (0, express_1.Router)();
+/**
+ * POST /api/dba/prune
+ * Prune expired jobs, streams, and execution artifacts.
+ *
+ * Body (all optional):
+ *   expire         — retention period (default: '7 days')
+ *   jobs           — hard-delete expired jobs (default: true)
+ *   streams        — hard-delete expired streams (default: true)
+ *   attributes     — strip execution artifacts (default: false)
+ *   entities       — entity allowlist (string[])
+ *   pruneTransient — delete jobs where entity IS NULL (default: false)
+ *   keepHmark      — preserve hmark during stripping (default: false)
+ *
+ * Returns: { jobs, streams, attributes, transient, marked }
+ */
+router.post('/prune', auth_1.requireAdmin, async (req, res) => {
+    try {
+        const result = await dbaService.prune({
+            expire: req.body.expire,
+            jobs: req.body.jobs,
+            streams: req.body.streams,
+            attributes: req.body.attributes,
+            entities: req.body.entities,
+            pruneTransient: req.body.pruneTransient,
+            keepHmark: req.body.keepHmark,
+        });
+        res.json(result);
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+/**
+ * POST /api/dba/deploy
+ * Deploy the server-side prune function and run migrations.
+ * Idempotent — safe to call on startup or from CI/CD.
+ */
+router.post('/deploy', auth_1.requireAdmin, async (req, res) => {
+    try {
+        await dbaService.deploy();
+        res.json({ ok: true });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+exports.default = router;

package/build/routes/delegation.d.ts

@@ -0,0 +1,2 @@
+declare const router: import("express-serve-static-core").Router;
+export default router;

package/build/routes/delegation.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const express_1 = require("express");
+const delegation_1 = require("../services/auth/delegation");
+const service_token_1 = require("../services/auth/service-token");
+const oauth_1 = require("../services/oauth");
+const router = (0, express_1.Router)();
+/**
+ * GET /api/delegation/oauth/:provider/token
+ *
+ * Returns a fresh OAuth access token for the user identified in
+ * the delegation token. Requires scope `oauth:<provider>:read`.
+ *
+ * Auth: Bearer <delegation-token>
+ */
+router.get('/oauth/:provider/token', async (req, res) => {
+    const header = req.headers.authorization;
+    if (!header?.startsWith('Bearer ')) {
+        res.status(401).json({ error: 'Delegation token required' });
+        return;
+    }
+    try {
+        const payload = (0, delegation_1.validateDelegationToken)(header.slice(7));
+        const { provider } = req.params;
+        (0, delegation_1.requireScope)(payload, `oauth:${provider}:read`);
+        const label = req.query.label || undefined;
+        const token = await (0, oauth_1.getFreshAccessToken)(payload.sub, provider, label);
+        res.json({
+            access_token: token.accessToken,
+            expires_at: token.expiresAt?.toISOString() ?? null,
+            scopes: token.scopes,
+            provider,
+        });
+    }
+    catch (err) {
+        const status = err.message.includes('missing required scope') ? 403 : 401;
+        res.status(status).json({ error: err.message });
+    }
+});
+/**
+ * POST /api/delegation/validate
+ *
+ * Validates a delegation token and returns its claims.
+ * Used by external MCP servers to verify tokens they receive.
+ *
+ * Auth: Bearer <service-token>
+ * Body: { token: string }
+ */
+router.post('/validate', async (req, res) => {
+    const header = req.headers.authorization;
+    if (!header?.startsWith('Bearer ')) {
+        res.status(401).json({ error: 'Service token required' });
+        return;
+    }
+    // Validate the service token
+    const serviceRecord = await (0, service_token_1.validateServiceToken)(header.slice(7));
+    if (!serviceRecord) {
+        res.status(401).json({ error: 'Invalid service token' });
+        return;
+    }
+    const { token } = req.body || {};
+    if (!token) {
+        res.status(400).json({ error: 'token field required in body' });
+        return;
+    }
+    try {
+        const payload = (0, delegation_1.validateDelegationToken)(token);
+        res.json({
+            valid: true,
+            userId: payload.sub,
+            scopes: payload.scopes,
+            workflowId: payload.workflowId,
+            serverId: payload.serverId,
+            expiresAt: payload.exp ? new Date(payload.exp * 1000).toISOString() : null,
+        });
+    }
+    catch (err) {
+        res.json({ valid: false, error: err.message });
+    }
+});
+exports.default = router;

package/build/routes/escalations/bulk.d.ts

@@ -0,0 +1,2 @@
+import { Router } from 'express';
+export declare function registerBulkRoutes(router: Router): void;