@hotmeshio/long-tail 0.1.3 → 0.1.5

package/build/routes/insight.js

@@ -10,7 +10,7 @@ const router = (0, express_1.Router)();
  */
 router.post('/mcp-query', async (req, res) => {
     try {
-        const { prompt, tags, wait, direct } = req.body;
+        const { prompt, tags, wait, direct, context } = req.body;
         if (!prompt || typeof prompt !== 'string') {
             res.status(400).json({ error: 'prompt is required' });
             return;
@@ -24,6 +24,7 @@ router.post('/mcp-query', async (req, res) => {
             tags,
             wait,
             direct,
+            context,
             userId: req.auth?.userId,
         });
         res.json(result);

package/build/routes/mcp.js

@@ -243,8 +243,9 @@ router.post('/servers/:id/tools/:toolName/call', async (req, res) => {
             res.status(400).json({ error: 'MCP adapter not registered' });
             return;
         }
-        const authContext = req.auth?.userId
-            ? { userId: req.auth.userId }
+        const executeAs = req.body.execute_as;
+        const authContext = (executeAs || req.auth?.userId)
+            ? { userId: executeAs || req.auth?.userId }
             : undefined;
         const result = await adapter.callTool(req.params.id, req.params.toolName, req.body.arguments || {}, authContext);
         res.json({ result });

package/build/routes/oauth.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.setOAuthConfig = setOAuthConfig;
 const express_1 = require("express");
 const auth_1 = require("../modules/auth");
-const logger_1 = require("../services/logger");
+const logger_1 = require("../lib/logger");
 const oauth_1 = require("../services/oauth");
 const user_1 = require("../services/user");
 const router = (0, express_1.Router)();

package/build/routes/settings.js

@@ -1,10 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const express_1 = require("express");
-const telemetry_1 = require("../services/telemetry");
-const events_1 = require("../services/events");
-const nats_1 = require("../services/events/nats");
-const socketio_1 = require("../services/events/socketio");
+const telemetry_1 = require("../lib/telemetry");
+const events_1 = require("../lib/events");
+const nats_1 = require("../lib/events/nats");
+const socketio_1 = require("../lib/events/socketio");
 const defaults_1 = require("../modules/defaults");
 const router = (0, express_1.Router)();
 /**

package/build/routes/workflows/discovery.js

@@ -36,8 +36,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const express_1 = require("express");
 const configService = __importStar(require("../../services/config"));
 const cron_1 = require("../../services/cron");
-const db_1 = require("../../services/db");
+const db_1 = require("../../lib/db");
 const registry_1 = require("../../services/workers/registry");
+const sql_1 = require("../../services/mcp-runs/sql");
 const router = (0, express_1.Router)();
 // ── Active workers ───────────────────────────────────────────────────────────
 /**
@@ -78,9 +79,8 @@ router.get('/discovered', async (req, res) => {
         // 1. Active workers from in-memory registry
         const activeWorkers = (0, registry_1.getRegisteredWorkers)();
         // 2. Historical entities from durable.jobs
-        const DISTINCT_ENTITIES = `SELECT DISTINCT entity FROM durable.jobs WHERE entity IS NOT NULL AND entity != '' ORDER BY entity`;
         const pool = (0, db_1.getPool)();
-        const { rows: entityRows } = await pool.query(DISTINCT_ENTITIES);
+        const { rows: entityRows } = await pool.query(sql_1.DISTINCT_ENTITIES_DURABLE);
         const historicalEntities = new Set(entityRows.map((r) => r.entity));
         // 3. Registered configs
         const configs = await configService.listWorkflowConfigs();

package/build/routes/workflows/invocation.js

@@ -136,7 +136,7 @@ router.post('/:workflowId/terminate', async (req, res) => {
             return;
         const client = (0, workers_1.createClient)();
         const handle = await client.workflow.getHandle(resolved.taskQueue, resolved.workflowName, req.params.workflowId);
-        await handle.interrupt();
+        await handle.terminate();
         res.json({ terminated: true, workflowId: req.params.workflowId });
     }
     catch (err) {

package/build/routes/yaml-workflows/crud.js

@@ -128,7 +128,7 @@ router.post('/', async (req, res) => {
     }
     catch (err) {
         if (err.message?.includes('duplicate key') || err.code === '23505') {
-            res.status(409).json({ error: 'A YAML workflow with that name already exists' });
+            res.status(409).json({ error: 'A tool with that name already exists' });
             return;
         }
         res.status(500).json({ error: err.message });

package/build/routes/yaml-workflows/deployment.js

@@ -134,6 +134,31 @@ router.post('/:id/invoke', async (req, res) => {
             return;
         }
         const data = req.body.data || {};
+        // Inject _scope so compiled workflow activities have identity context
+        const executeAs = req.body.execute_as;
+        const userId = req.auth?.userId;
+        if (!data._scope) {
+            const { resolvePrincipal } = await Promise.resolve().then(() => __importStar(require('../../services/iam/principal')));
+            if (executeAs) {
+                const [botPrincipal, invokerPrincipal] = await Promise.all([
+                    resolvePrincipal(executeAs),
+                    userId ? resolvePrincipal(userId) : Promise.resolve(null),
+                ]);
+                if (botPrincipal) {
+                    data._scope = {
+                        principal: botPrincipal,
+                        scopes: ['mcp:tool:call'],
+                        ...(invokerPrincipal ? { initiatedBy: userId, initiatingPrincipal: invokerPrincipal } : {}),
+                    };
+                }
+            }
+            else if (userId) {
+                const principal = await resolvePrincipal(userId);
+                if (principal) {
+                    data._scope = { principal, scopes: ['mcp:tool:call'] };
+                }
+            }
+        }
         if (req.body.sync) {
             const { job_id, result } = await yamlDeployer.invokeYamlWorkflowSync(wf.app_id, wf.graph_topic, data, req.body.timeout, wf.graph_topic);
             res.json({ job_id, result });

package/build/services/auth/bot-api-key.js

@@ -42,7 +42,7 @@ exports.revokeBotApiKey = revokeBotApiKey;
 exports.listBotApiKeys = listBotApiKeys;
 const crypto = __importStar(require("crypto"));
 const bcryptjs_1 = __importDefault(require("bcryptjs"));
-const db_1 = require("../db");
+const db_1 = require("../../lib/db");
 const TOKEN_PREFIX = 'lt_bot_';
 const INSERT_KEY = `
   INSERT INTO lt_bot_api_keys (name, user_id, key_hash, scopes, expires_at)

package/build/services/auth/index.d.ts

@@ -0,0 +1,4 @@
+export { generateBotApiKey, validateBotApiKey, revokeBotApiKey, listBotApiKeys, } from './bot-api-key';
+export type { BotApiKeyRecord } from './bot-api-key';
+export { createDelegationToken, validateDelegationToken, requireScope, } from './delegation';
+export { generateServiceToken, validateServiceToken, revokeServiceToken, listServiceTokens, } from './service-token';

package/build/services/auth/index.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.listServiceTokens = exports.revokeServiceToken = exports.validateServiceToken = exports.generateServiceToken = exports.requireScope = exports.validateDelegationToken = exports.createDelegationToken = exports.listBotApiKeys = exports.revokeBotApiKey = exports.validateBotApiKey = exports.generateBotApiKey = void 0;
+var bot_api_key_1 = require("./bot-api-key");
+Object.defineProperty(exports, "generateBotApiKey", { enumerable: true, get: function () { return bot_api_key_1.generateBotApiKey; } });
+Object.defineProperty(exports, "validateBotApiKey", { enumerable: true, get: function () { return bot_api_key_1.validateBotApiKey; } });
+Object.defineProperty(exports, "revokeBotApiKey", { enumerable: true, get: function () { return bot_api_key_1.revokeBotApiKey; } });
+Object.defineProperty(exports, "listBotApiKeys", { enumerable: true, get: function () { return bot_api_key_1.listBotApiKeys; } });
+var delegation_1 = require("./delegation");
+Object.defineProperty(exports, "createDelegationToken", { enumerable: true, get: function () { return delegation_1.createDelegationToken; } });
+Object.defineProperty(exports, "validateDelegationToken", { enumerable: true, get: function () { return delegation_1.validateDelegationToken; } });
+Object.defineProperty(exports, "requireScope", { enumerable: true, get: function () { return delegation_1.requireScope; } });
+var service_token_1 = require("./service-token");
+Object.defineProperty(exports, "generateServiceToken", { enumerable: true, get: function () { return service_token_1.generateServiceToken; } });
+Object.defineProperty(exports, "validateServiceToken", { enumerable: true, get: function () { return service_token_1.validateServiceToken; } });
+Object.defineProperty(exports, "revokeServiceToken", { enumerable: true, get: function () { return service_token_1.revokeServiceToken; } });
+Object.defineProperty(exports, "listServiceTokens", { enumerable: true, get: function () { return service_token_1.listServiceTokens; } });

package/build/services/auth/service-token.js

@@ -42,7 +42,7 @@ exports.revokeServiceToken = revokeServiceToken;
 exports.listServiceTokens = listServiceTokens;
 const crypto = __importStar(require("crypto"));
 const bcryptjs_1 = __importDefault(require("bcryptjs"));
-const db_1 = require("../db");
+const db_1 = require("../../lib/db");
 const TOKEN_PREFIX = 'lt_svc_';
 const INSERT_TOKEN = `
   INSERT INTO lt_service_tokens (name, token_hash, server_id, scopes, expires_at)

package/build/services/config/provider.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getProviderData = getProviderData;
-const db_1 = require("../db");
+const db_1 = require("../../lib/db");
 const sql_1 = require("./sql");
 async function getProviderData(consumes, originId) {
     if (!consumes.length || !originId)

package/build/services/config/read.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getWorkflowConfig = getWorkflowConfig;
 exports.listWorkflowConfigs = listWorkflowConfigs;
-const db_1 = require("../db");
+const db_1 = require("../../lib/db");
 const sql_1 = require("./sql");
 async function getWorkflowConfig(workflowType) {
     const pool = (0, db_1.getPool)();

package/build/services/config/write.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.upsertWorkflowConfig = upsertWorkflowConfig;
 exports.deleteWorkflowConfig = deleteWorkflowConfig;
-const db_1 = require("../db");
+const db_1 = require("../../lib/db");
 const read_1 = require("./read");
 const sql_1 = require("./sql");
 async function upsertWorkflowConfig(config) {

package/build/services/controlplane/index.js

@@ -8,9 +8,7 @@ exports.getStreamStats = getStreamStats;
 exports.subscribeMesh = subscribeMesh;
 exports.isBridgeActive = isBridgeActive;
 const hotmesh_1 = require("@hotmeshio/hotmesh");
-const pg_1 = require("pg");
-const config_1 = require("../../modules/config");
-const db_1 = require("../db");
+const db_1 = require("../../lib/db");
 const sql_1 = require("./sql");
 const quorum_bridge_1 = require("./quorum-bridge");
 // ─── Engine cache ───────────────────────────────────────────────────────────
@@ -27,8 +25,9 @@ async function getEngine(appId) {
         return cached;
     const engine = await hotmesh_1.HotMesh.init({
         appId,
+        guid: `controlplane::${appId}-${hotmesh_1.HotMesh.guid()}`,
         engine: {
-            connection: { class: pg_1.Client, options: config_1.postgres_options },
+            connection: (0, db_1.getConnection)(),
         },
     });
     engines.set(appId, engine);

package/build/services/controlplane/quorum-bridge.js

@@ -3,8 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.createQuorumBridgeCallback = createQuorumBridgeCallback;
 exports.getActiveCallback = getActiveCallback;
 exports.startQuorumBridge = startQuorumBridge;
-const events_1 = require("../events");
-const logger_1 = require("../logger");
+const events_1 = require("../../lib/events");
+const logger_1 = require("../../lib/logger");
 /**
  * Bridge HotMesh quorum messages to the NATS event system.
  *

package/build/services/cron/index.js

@@ -35,10 +35,9 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.cronRegistry = void 0;
 const hotmesh_1 = require("@hotmeshio/hotmesh");
-const pg_1 = require("pg");
-const config_1 = require("../../modules/config");
+const db_1 = require("../../lib/db");
 const defaults_1 = require("../../modules/defaults");
-const logger_1 = require("../logger");
+const logger_1 = require("../../lib/logger");
 const configService = __importStar(require("../config"));
 const principal_1 = require("../iam/principal");
 const CRON_TOPIC_PREFIX = 'lt.cron';
@@ -83,7 +82,7 @@ class LTCronRegistry {
     async startCron(config) {
         if (!config.cron_schedule || !config.task_queue)
             return;
-        const connection = { class: pg_1.Client, options: config_1.postgres_options };
+        const connection = (0, db_1.getConnection)();
         const topic = `${CRON_TOPIC_PREFIX}.${config.workflow_type}`;
         const cronId = `${CRON_ID_PREFIX}-${config.workflow_type}`;
         const defaultEnvelope = config.envelope_schema
@@ -147,7 +146,7 @@ class LTCronRegistry {
         const cronId = this.activeCrons.get(workflowType);
         if (!cronId)
             return;
-        const connection = { class: pg_1.Client, options: config_1.postgres_options };
+        const connection = (0, db_1.getConnection)();
         const topic = `${CRON_TOPIC_PREFIX}.${workflowType}`;
         try {
             await hotmesh_1.Virtual.interrupt({

package/build/services/dba.d.ts

@@ -20,6 +20,10 @@ export declare function prune(options: {
     expire?: string;
     jobs?: boolean;
     streams?: boolean;
+    engineStreams?: boolean;
+    engineStreamsExpire?: string;
+    workerStreams?: boolean;
+    workerStreamsExpire?: string;
     attributes?: boolean;
     entities?: string[];
     pruneTransient?: boolean;

package/build/services/dba.js

@@ -3,8 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.deploy = deploy;
 exports.prune = prune;
 const hotmesh_1 = require("@hotmeshio/hotmesh");
-const pg_1 = require("pg");
-const config_1 = require("../modules/config");
+const db_1 = require("../lib/db");
 const APP_ID = 'durable';
 /**
  * Deploy the server-side prune() Postgres function and run
@@ -12,8 +11,7 @@ const APP_ID = 'durable';
  * Idempotent — safe to call on every startup.
  */
 async function deploy() {
-    const connection = { class: pg_1.Client, options: config_1.postgres_options };
-    await hotmesh_1.DBA.deploy(connection, APP_ID);
+    await hotmesh_1.DBA.deploy((0, db_1.getConnection)(), APP_ID);
 }
 /**
  * Prune expired jobs, streams, and/or execution artifacts.
@@ -27,6 +25,5 @@ async function deploy() {
  * - `keepHmark` — preserve hmark rows during stripping
  */
 async function prune(options) {
-    const connection = { class: pg_1.Client, options: config_1.postgres_options };
-    return hotmesh_1.DBA.prune({ appId: APP_ID, connection, ...options });
+    return hotmesh_1.DBA.prune({ appId: APP_ID, connection: (0, db_1.getConnection)(), ...options });
 }

package/build/services/escalation/bulk.js

@@ -4,7 +4,7 @@ exports.bulkClaimEscalations = bulkClaimEscalations;
 exports.bulkAssignEscalations = bulkAssignEscalations;
 exports.bulkEscalateToRole = bulkEscalateToRole;
 exports.bulkResolveForTriage = bulkResolveForTriage;
-const db_1 = require("../db");
+const db_1 = require("../../lib/db");
 const sql_1 = require("./sql");
 /**
  * Bulk claim escalations for a user.

package/build/services/escalation/crud.js

@@ -14,7 +14,7 @@ exports.getEscalationsByWorkflowId = getEscalationsByWorkflowId;
 exports.updateEscalationMetadata = updateEscalationMetadata;
 exports.enrichEscalationRouting = enrichEscalationRouting;
 exports.getEscalationsByOriginId = getEscalationsByOriginId;
-const db_1 = require("../db");
+const db_1 = require("../../lib/db");
 const sql_1 = require("./sql");
 async function createEscalation(input) {
     const pool = (0, db_1.getPool)();

package/build/services/escalation/queries.js

@@ -4,7 +4,7 @@ exports.getEscalationStats = getEscalationStats;
 exports.listDistinctTypes = listDistinctTypes;
 exports.listEscalations = listEscalations;
 exports.listAvailableEscalations = listAvailableEscalations;
-const db_1 = require("../db");
+const db_1 = require("../../lib/db");
 const types_1 = require("./types");
 const sql_1 = require("./sql");
 function buildOrderBy(sortBy, order, fallback = 'priority ASC, created_at ASC') {

package/build/services/export/client.js

@@ -3,12 +3,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.createClient = createClient;
 exports.getHandle = getHandle;
 const hotmesh_1 = require("@hotmeshio/hotmesh");
-const pg_1 = require("pg");
-const config_1 = require("../../modules/config");
+const db_1 = require("../../lib/db");
 function createClient() {
-    return new hotmesh_1.Durable.Client({
-        connection: { class: pg_1.Client, options: config_1.postgres_options },
-    });
+    return new hotmesh_1.Durable.Client({ connection: (0, db_1.getConnection)() });
 }
 async function getHandle(taskQueue, workflowName, workflowId) {
     const client = createClient();

package/build/services/export/index.js

@@ -5,7 +5,7 @@ exports.getWorkflowStatus = getWorkflowStatus;
 exports.exportWorkflowExecution = exportWorkflowExecution;
 exports.getWorkflowState = getWorkflowState;
 exports.listJobs = listJobs;
-const db_1 = require("../db");
+const db_1 = require("../../lib/db");
 const client_1 = require("./client");
 const post_process_1 = require("./post-process");
 /** Error thrown when a workflow job is not found (expired or never existed). */
@@ -140,8 +140,20 @@ async function listJobs(params) {
     const where = conditions.join(' AND ');
     const [countResult, dataResult] = await Promise.all([
         pool.query(`SELECT COUNT(*) FROM durable.jobs j WHERE ${where}`, values),
-        pool.query(`SELECT j.key, j.entity, j.status, j.is_live, j.created_at, j.updated_at
+        pool.query(`WITH ju_symbols AS (
+         SELECT value FROM durable.symbols
+         WHERE key LIKE 'hmsh:durable:sym:keys:%' AND field = 'metadata/ju'
+       )
+       SELECT j.key, j.entity, j.status, j.is_live, j.created_at,
+         CASE WHEN j.updated_at != j.created_at THEN j.updated_at
+              WHEN ju.value IS NOT NULL THEN to_timestamp(ju.value, 'YYYYMMDDHH24MISS.MS')
+              ELSE j.updated_at
+         END as updated_at
        FROM durable.jobs j
+       LEFT JOIN durable.jobs_attributes ju
+         ON ju.job_id = j.id
+         AND ju.symbol IN (SELECT value FROM ju_symbols)
+         AND (ju.dimension IS NULL OR ju.dimension = '')
        WHERE ${where}
        ORDER BY ${buildJobOrderBy(params.sort_by, params.order)}
        LIMIT $${idx++} OFFSET $${idx++}`, [...values, limit, offset]),

package/build/services/hotmesh-utils.js

@@ -10,7 +10,7 @@ exports.loadSymbolMap = loadSymbolMap;
 exports.inflateAttributes = inflateAttributes;
 exports.restoreHierarchy = restoreHierarchy;
 exports.extractActivities = extractActivities;
-const db_1 = require("./db");
+const db_1 = require("../lib/db");
 // ── HotMesh timestamp helpers ───────────────────────────────────────────────
 /**
  * Convert HotMesh's compact timestamp (YYYYMMDDHHmmss.SSS) to ISO 8601.

package/build/services/iam/bots.js

@@ -16,7 +16,7 @@ exports.ensureSystemBot = ensureSystemBot;
  * They share the same RBAC, OAuth credentials, and delegation tokens
  * as human users — no separate infrastructure needed.
  */
-const db_1 = require("../db");
+const db_1 = require("../../lib/db");
 const user_1 = require("../user");
 const user_2 = require("../user");
 Object.defineProperty(exports, "addBotRole", { enumerable: true, get: function () { return user_2.addUserRole; } });
@@ -25,13 +25,7 @@ Object.defineProperty(exports, "getBotRoles", { enumerable: true, get: function
 const bot_api_key_1 = require("../auth/bot-api-key");
 Object.defineProperty(exports, "listBotKeys", { enumerable: true, get: function () { return bot_api_key_1.listBotApiKeys; } });
 Object.defineProperty(exports, "revokeBotKey", { enumerable: true, get: function () { return bot_api_key_1.revokeBotApiKey; } });
-const LIST_BOTS = `
-  SELECT * FROM lt_users
-  WHERE account_type = 'bot'
-  ORDER BY created_at DESC
-  LIMIT $1 OFFSET $2`;
-const COUNT_BOTS = `
-  SELECT COUNT(*)::int AS total FROM lt_users WHERE account_type = 'bot'`;
+const sql_1 = require("./sql");
 /**
  * Create a new bot account.
  */
@@ -49,7 +43,7 @@ async function createBot(input) {
     // Create the user row, then set account_type column
     const user = await (0, user_1.createUser)(userInput);
     const pool = await (0, db_1.getPool)();
-    await pool.query('UPDATE lt_users SET account_type = $1 WHERE id = $2', ['bot', user.id]);
+    await pool.query(sql_1.SET_ACCOUNT_TYPE_BOT, ['bot', user.id]);
     return toBotRecord(user, input.description, input.created_by);
 }
 /**
@@ -67,8 +61,8 @@ async function getBot(id) {
 async function listBots(limit = 50, offset = 0) {
     const pool = await (0, db_1.getPool)();
     const [{ rows }, countResult] = await Promise.all([
-        pool.query(LIST_BOTS, [limit, offset]),
-        pool.query(COUNT_BOTS),
+        pool.query(sql_1.LIST_BOTS, [limit, offset]),
+        pool.query(sql_1.COUNT_BOTS),
     ]);
     // Attach roles to each bot
     const bots = await Promise.all(rows.map(async (row) => {
@@ -135,7 +129,7 @@ const SYSTEM_BOT_NAME = 'lt-system';
  */
 async function ensureSystemBot() {
     const pool = await (0, db_1.getPool)();
-    const { rows } = await pool.query('SELECT id FROM lt_users WHERE external_id = $1', [SYSTEM_BOT_NAME]);
+    const { rows } = await pool.query(sql_1.GET_USER_BY_EXTERNAL_ID, [SYSTEM_BOT_NAME]);
     if (rows.length > 0)
         return rows[0].id;
     const bot = await createBot({

package/build/services/iam/context.d.ts

@@ -7,7 +7,7 @@ export declare function runWithToolContext<T>(ctx: ToolContext, fn: () => Promis
 /**
  * Retrieve the ToolContext for the current execution scope.
  *
- * Activities: reads from argumentMetadata (injected by activity interceptor).
+ * Activities: reads from headers (injected by activity interceptor).
  * Workflow scope: reads from AsyncLocalStorage (set by workflow interceptor).
  * Returns undefined when no identity is available.
  */

package/build/services/iam/context.js

@@ -7,9 +7,9 @@ exports.getToolContext = getToolContext;
  *
  * Two paths, checked in order:
  *
- * 1. **argumentMetadata** (production-safe, distributed):
+ * 1. **headers** (production-safe, distributed):
  *    The activity interceptor injects `principal` + `scopes` into
- *    `argumentMetadata`, which HotMesh delivers to the activity worker
+ *    `headers`, which HotMesh delivers to the activity worker
  *    via `Durable.activity.getContext()`. Works across process boundaries.
  *
  * 2. **AsyncLocalStorage** (workflow-local, single-process):
@@ -30,15 +30,15 @@ function runWithToolContext(ctx, fn) {
 /**
  * Retrieve the ToolContext for the current execution scope.
  *
- * Activities: reads from argumentMetadata (injected by activity interceptor).
+ * Activities: reads from headers (injected by activity interceptor).
  * Workflow scope: reads from AsyncLocalStorage (set by workflow interceptor).
  * Returns undefined when no identity is available.
  */
 function getToolContext() {
-    // 1. Try argumentMetadata (activity worker — works distributed)
+    // 1. Try headers (activity worker — works distributed)
     try {
         const actCtx = hotmesh_1.Durable.activity.getContext();
-        const meta = actCtx?.argumentMetadata;
+        const meta = actCtx?.headers;
         if (meta?.principal) {
             const principal = meta.principal;
             return {

package/build/services/iam/credentials.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.MissingCredentialError = void 0;
 exports.resolveCredential = resolveCredential;
 const oauth_1 = require("../oauth");
-const logger_1 = require("../logger");
+const logger_1 = require("../../lib/logger");
 /**
  * Thrown when credential resolution finds no credential for a provider.
  * Caught by route handlers to return structured 422 responses.

package/build/services/iam/ephemeral.js

@@ -9,9 +9,10 @@ exports.storeEphemeral = storeEphemeral;
 exports.exchangeEphemeral = exchangeEphemeral;
 exports.revokeEphemeral = revokeEphemeral;
 exports.cleanupExpired = cleanupExpired;
-const db_1 = require("../db");
+const db_1 = require("../../lib/db");
 const crypto_1 = require("../oauth/crypto");
-const logger_1 = require("../logger");
+const logger_1 = require("../../lib/logger");
+const sql_1 = require("./sql");
 // ── Token format ────────────────────────────────────────────────────────────
 // Opaque string: eph:v1:<label>:<uuid>
 // The LLM passes these through as-is. Exchange happens inside activity bodies.
@@ -80,9 +81,7 @@ async function storeEphemeral(value, opts = {}) {
     const expiresAt = opts.ttlSeconds
         ? `NOW() + ${opts.ttlSeconds} * INTERVAL '1 second'`
         : 'NULL';
-    const { rows } = await pool.query(`INSERT INTO lt_ephemeral_credentials (value, label, max_uses, expires_at)
-     VALUES ($1, $2, $3, ${expiresAt})
-     RETURNING token`, [Buffer.from(encrypted, 'base64'), opts.label || null, maxUses]);
+    const { rows } = await pool.query((0, sql_1.INSERT_EPHEMERAL)(expiresAt), [Buffer.from(encrypted, 'base64'), opts.label || null, maxUses]);
     return rows[0].token;
 }
 /**
@@ -97,18 +96,13 @@ async function exchangeEphemeral(token) {
     const pool = (0, db_1.getPool)();
     // Atomic increment + check in one query.
     // Returns the row if the exchange is valid, nothing if expired/exhausted.
-    const { rows } = await pool.query(`UPDATE lt_ephemeral_credentials
-     SET use_count = use_count + 1
-     WHERE token = $1
-       AND (expires_at IS NULL OR expires_at > NOW())
-       AND (max_uses = 0 OR use_count < max_uses)
-     RETURNING value, use_count, max_uses`, [token]);
+    const { rows } = await pool.query(sql_1.EXCHANGE_EPHEMERAL, [token]);
     if (rows.length === 0)
         return null;
     const { value: buf, use_count, max_uses } = rows[0];
     // Auto-delete when max_uses is reached (if bounded)
     if (max_uses > 0 && use_count >= max_uses) {
-        await pool.query(`DELETE FROM lt_ephemeral_credentials WHERE token = $1`, [token]);
+        await pool.query(sql_1.DELETE_EPHEMERAL, [token]);
     }
     return (0, crypto_1.decrypt)(buf.toString('base64'));
 }
@@ -117,7 +111,7 @@ async function exchangeEphemeral(token) {
  */
 async function revokeEphemeral(token) {
     const pool = (0, db_1.getPool)();
-    const { rowCount } = await pool.query(`DELETE FROM lt_ephemeral_credentials WHERE token = $1`, [token]);
+    const { rowCount } = await pool.query(sql_1.DELETE_EPHEMERAL, [token]);
     return (rowCount ?? 0) > 0;
 }
 /**
@@ -125,7 +119,6 @@ async function revokeEphemeral(token) {
  */
 async function cleanupExpired() {
     const pool = (0, db_1.getPool)();
-    const { rowCount } = await pool.query(`DELETE FROM lt_ephemeral_credentials
-     WHERE expires_at IS NOT NULL AND expires_at < NOW()`);
+    const { rowCount } = await pool.query(sql_1.CLEANUP_EXPIRED_EPHEMERAL);
     return rowCount ?? 0;
 }

package/build/services/iam/principal.js

@@ -11,21 +11,14 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolvePrincipal = resolvePrincipal;
-const db_1 = require("../db");
+const db_1 = require("../../lib/db");
+const sql_1 = require("./sql");
 /** UUID v4 pattern for distinguishing UUIDs from external_ids. */
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-/** Fetch user + roles by external_id OR id in one query. */
-const GET_USER_WITH_ROLES_FLEXIBLE = `
-  SELECT u.id, u.external_id, u.display_name, u.status, u.metadata,
-         r.role, r.type AS role_type
-  FROM lt_users u
-  LEFT JOIN lt_user_roles r ON r.user_id = u.id
-  WHERE u.external_id = $1 OR u.id::text = $1
-  ORDER BY r.created_at`;
 const ROLE_TYPE_PRIORITY = { superadmin: 3, admin: 2, member: 1 };
 async function resolvePrincipal(identifier) {
     const pool = (0, db_1.getPool)();
-    const { rows } = await pool.query(GET_USER_WITH_ROLES_FLEXIBLE, [identifier]);
+    const { rows } = await pool.query(sql_1.GET_USER_WITH_ROLES_FLEXIBLE, [identifier]);
     if (rows.length === 0)
         return null;
     const user = rows[0];

package/build/services/iam/resolve.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveToolContext = resolveToolContext;
 const delegation_1 = require("../auth/delegation");
 const user_1 = require("../user");
-const logger_1 = require("../logger");
+const logger_1 = require("../../lib/logger");
 /** Role type priority for determining highest role type. */
 const ROLE_TYPE_PRIORITY = { superadmin: 3, admin: 2, member: 1 };
 /**

package/build/services/iam/sql.d.ts

@@ -0,0 +1,10 @@
+/** Build INSERT for ephemeral credentials. expiresExpr is a SQL expression like 'NULL' or "NOW() + N * INTERVAL '1 second'". */
+export declare const INSERT_EPHEMERAL: (expiresExpr: string) => string;
+export declare const EXCHANGE_EPHEMERAL = "\n  UPDATE lt_ephemeral_credentials\n  SET use_count = use_count + 1\n  WHERE token = $1\n    AND (expires_at IS NULL OR expires_at > NOW())\n    AND (max_uses = 0 OR use_count < max_uses)\n  RETURNING value, use_count, max_uses";
+export declare const DELETE_EPHEMERAL = "\n  DELETE FROM lt_ephemeral_credentials WHERE token = $1";
+export declare const CLEANUP_EXPIRED_EPHEMERAL = "\n  DELETE FROM lt_ephemeral_credentials\n  WHERE expires_at IS NOT NULL AND expires_at < NOW()";
+export declare const LIST_BOTS = "\n  SELECT * FROM lt_users\n  WHERE account_type = 'bot'\n  ORDER BY created_at DESC\n  LIMIT $1 OFFSET $2";
+export declare const COUNT_BOTS = "\n  SELECT COUNT(*)::int AS total FROM lt_users WHERE account_type = 'bot'";
+export declare const SET_ACCOUNT_TYPE_BOT = "\n  UPDATE lt_users SET account_type = $1 WHERE id = $2";
+export declare const GET_USER_BY_EXTERNAL_ID = "\n  SELECT id FROM lt_users WHERE external_id = $1";
+export declare const GET_USER_WITH_ROLES_FLEXIBLE = "\n  SELECT u.id, u.external_id, u.display_name, u.status, u.metadata,\n         r.role, r.type AS role_type\n  FROM lt_users u\n  LEFT JOIN lt_user_roles r ON r.user_id = u.id\n  WHERE u.external_id = $1 OR u.id::text = $1\n  ORDER BY r.created_at";