@hotmeshio/long-tail 0.1.4 → 0.1.5

package/build/services/config/write.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.upsertWorkflowConfig = upsertWorkflowConfig;
 exports.deleteWorkflowConfig = deleteWorkflowConfig;
-const db_1 = require("../db");
+const db_1 = require("../../lib/db");
 const read_1 = require("./read");
 const sql_1 = require("./sql");
 async function upsertWorkflowConfig(config) {

package/build/services/controlplane/index.js

@@ -8,9 +8,7 @@ exports.getStreamStats = getStreamStats;
 exports.subscribeMesh = subscribeMesh;
 exports.isBridgeActive = isBridgeActive;
 const hotmesh_1 = require("@hotmeshio/hotmesh");
-const pg_1 = require("pg");
-const config_1 = require("../../modules/config");
-const db_1 = require("../db");
+const db_1 = require("../../lib/db");
 const sql_1 = require("./sql");
 const quorum_bridge_1 = require("./quorum-bridge");
 // ─── Engine cache ───────────────────────────────────────────────────────────
@@ -27,8 +25,9 @@ async function getEngine(appId) {
         return cached;
     const engine = await hotmesh_1.HotMesh.init({
         appId,
+        guid: `controlplane::${appId}-${hotmesh_1.HotMesh.guid()}`,
         engine: {
-            connection: { class: pg_1.Client, options: config_1.postgres_options },
+            connection: (0, db_1.getConnection)(),
         },
     });
     engines.set(appId, engine);

package/build/services/controlplane/quorum-bridge.js

@@ -3,8 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.createQuorumBridgeCallback = createQuorumBridgeCallback;
 exports.getActiveCallback = getActiveCallback;
 exports.startQuorumBridge = startQuorumBridge;
-const events_1 = require("../events");
-const logger_1 = require("../logger");
+const events_1 = require("../../lib/events");
+const logger_1 = require("../../lib/logger");
 /**
  * Bridge HotMesh quorum messages to the NATS event system.
  *

package/build/services/cron/index.js

@@ -35,10 +35,9 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.cronRegistry = void 0;
 const hotmesh_1 = require("@hotmeshio/hotmesh");
-const pg_1 = require("pg");
-const config_1 = require("../../modules/config");
+const db_1 = require("../../lib/db");
 const defaults_1 = require("../../modules/defaults");
-const logger_1 = require("../logger");
+const logger_1 = require("../../lib/logger");
 const configService = __importStar(require("../config"));
 const principal_1 = require("../iam/principal");
 const CRON_TOPIC_PREFIX = 'lt.cron';
@@ -83,7 +82,7 @@ class LTCronRegistry {
     async startCron(config) {
         if (!config.cron_schedule || !config.task_queue)
             return;
-        const connection = { class: pg_1.Client, options: config_1.postgres_options };
+        const connection = (0, db_1.getConnection)();
         const topic = `${CRON_TOPIC_PREFIX}.${config.workflow_type}`;
         const cronId = `${CRON_ID_PREFIX}-${config.workflow_type}`;
         const defaultEnvelope = config.envelope_schema
@@ -147,7 +146,7 @@ class LTCronRegistry {
         const cronId = this.activeCrons.get(workflowType);
         if (!cronId)
             return;
-        const connection = { class: pg_1.Client, options: config_1.postgres_options };
+        const connection = (0, db_1.getConnection)();
         const topic = `${CRON_TOPIC_PREFIX}.${workflowType}`;
         try {
             await hotmesh_1.Virtual.interrupt({

package/build/services/dba.d.ts

@@ -20,6 +20,10 @@ export declare function prune(options: {
     expire?: string;
     jobs?: boolean;
     streams?: boolean;
+    engineStreams?: boolean;
+    engineStreamsExpire?: string;
+    workerStreams?: boolean;
+    workerStreamsExpire?: string;
     attributes?: boolean;
     entities?: string[];
     pruneTransient?: boolean;

package/build/services/dba.js

@@ -3,8 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.deploy = deploy;
 exports.prune = prune;
 const hotmesh_1 = require("@hotmeshio/hotmesh");
-const pg_1 = require("pg");
-const config_1 = require("../modules/config");
+const db_1 = require("../lib/db");
 const APP_ID = 'durable';
 /**
  * Deploy the server-side prune() Postgres function and run
@@ -12,8 +11,7 @@ const APP_ID = 'durable';
  * Idempotent — safe to call on every startup.
  */
 async function deploy() {
-    const connection = { class: pg_1.Client, options: config_1.postgres_options };
-    await hotmesh_1.DBA.deploy(connection, APP_ID);
+    await hotmesh_1.DBA.deploy((0, db_1.getConnection)(), APP_ID);
 }
 /**
  * Prune expired jobs, streams, and/or execution artifacts.
@@ -27,6 +25,5 @@ async function deploy() {
  * - `keepHmark` — preserve hmark rows during stripping
  */
 async function prune(options) {
-    const connection = { class: pg_1.Client, options: config_1.postgres_options };
-    return hotmesh_1.DBA.prune({ appId: APP_ID, connection, ...options });
+    return hotmesh_1.DBA.prune({ appId: APP_ID, connection: (0, db_1.getConnection)(), ...options });
 }

package/build/services/escalation/bulk.js

@@ -4,7 +4,7 @@ exports.bulkClaimEscalations = bulkClaimEscalations;
 exports.bulkAssignEscalations = bulkAssignEscalations;
 exports.bulkEscalateToRole = bulkEscalateToRole;
 exports.bulkResolveForTriage = bulkResolveForTriage;
-const db_1 = require("../db");
+const db_1 = require("../../lib/db");
 const sql_1 = require("./sql");
 /**
  * Bulk claim escalations for a user.

package/build/services/escalation/crud.js

@@ -14,7 +14,7 @@ exports.getEscalationsByWorkflowId = getEscalationsByWorkflowId;
 exports.updateEscalationMetadata = updateEscalationMetadata;
 exports.enrichEscalationRouting = enrichEscalationRouting;
 exports.getEscalationsByOriginId = getEscalationsByOriginId;
-const db_1 = require("../db");
+const db_1 = require("../../lib/db");
 const sql_1 = require("./sql");
 async function createEscalation(input) {
     const pool = (0, db_1.getPool)();

package/build/services/escalation/queries.js

@@ -4,7 +4,7 @@ exports.getEscalationStats = getEscalationStats;
 exports.listDistinctTypes = listDistinctTypes;
 exports.listEscalations = listEscalations;
 exports.listAvailableEscalations = listAvailableEscalations;
-const db_1 = require("../db");
+const db_1 = require("../../lib/db");
 const types_1 = require("./types");
 const sql_1 = require("./sql");
 function buildOrderBy(sortBy, order, fallback = 'priority ASC, created_at ASC') {

package/build/services/export/client.js

@@ -3,12 +3,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.createClient = createClient;
 exports.getHandle = getHandle;
 const hotmesh_1 = require("@hotmeshio/hotmesh");
-const pg_1 = require("pg");
-const config_1 = require("../../modules/config");
+const db_1 = require("../../lib/db");
 function createClient() {
-    return new hotmesh_1.Durable.Client({
-        connection: { class: pg_1.Client, options: config_1.postgres_options },
-    });
+    return new hotmesh_1.Durable.Client({ connection: (0, db_1.getConnection)() });
 }
 async function getHandle(taskQueue, workflowName, workflowId) {
     const client = createClient();

package/build/services/export/index.js

@@ -5,7 +5,7 @@ exports.getWorkflowStatus = getWorkflowStatus;
 exports.exportWorkflowExecution = exportWorkflowExecution;
 exports.getWorkflowState = getWorkflowState;
 exports.listJobs = listJobs;
-const db_1 = require("../db");
+const db_1 = require("../../lib/db");
 const client_1 = require("./client");
 const post_process_1 = require("./post-process");
 /** Error thrown when a workflow job is not found (expired or never existed). */
@@ -140,8 +140,20 @@ async function listJobs(params) {
     const where = conditions.join(' AND ');
     const [countResult, dataResult] = await Promise.all([
         pool.query(`SELECT COUNT(*) FROM durable.jobs j WHERE ${where}`, values),
-        pool.query(`SELECT j.key, j.entity, j.status, j.is_live, j.created_at, j.updated_at
+        pool.query(`WITH ju_symbols AS (
+         SELECT value FROM durable.symbols
+         WHERE key LIKE 'hmsh:durable:sym:keys:%' AND field = 'metadata/ju'
+       )
+       SELECT j.key, j.entity, j.status, j.is_live, j.created_at,
+         CASE WHEN j.updated_at != j.created_at THEN j.updated_at
+              WHEN ju.value IS NOT NULL THEN to_timestamp(ju.value, 'YYYYMMDDHH24MISS.MS')
+              ELSE j.updated_at
+         END as updated_at
        FROM durable.jobs j
+       LEFT JOIN durable.jobs_attributes ju
+         ON ju.job_id = j.id
+         AND ju.symbol IN (SELECT value FROM ju_symbols)
+         AND (ju.dimension IS NULL OR ju.dimension = '')
        WHERE ${where}
        ORDER BY ${buildJobOrderBy(params.sort_by, params.order)}
        LIMIT $${idx++} OFFSET $${idx++}`, [...values, limit, offset]),

package/build/services/hotmesh-utils.js

@@ -10,7 +10,7 @@ exports.loadSymbolMap = loadSymbolMap;
 exports.inflateAttributes = inflateAttributes;
 exports.restoreHierarchy = restoreHierarchy;
 exports.extractActivities = extractActivities;
-const db_1 = require("./db");
+const db_1 = require("../lib/db");
 // ── HotMesh timestamp helpers ───────────────────────────────────────────────
 /**
  * Convert HotMesh's compact timestamp (YYYYMMDDHHmmss.SSS) to ISO 8601.

package/build/services/iam/bots.js

@@ -16,7 +16,7 @@ exports.ensureSystemBot = ensureSystemBot;
  * They share the same RBAC, OAuth credentials, and delegation tokens
  * as human users — no separate infrastructure needed.
  */
-const db_1 = require("../db");
+const db_1 = require("../../lib/db");
 const user_1 = require("../user");
 const user_2 = require("../user");
 Object.defineProperty(exports, "addBotRole", { enumerable: true, get: function () { return user_2.addUserRole; } });
@@ -25,13 +25,7 @@ Object.defineProperty(exports, "getBotRoles", { enumerable: true, get: function
 const bot_api_key_1 = require("../auth/bot-api-key");
 Object.defineProperty(exports, "listBotKeys", { enumerable: true, get: function () { return bot_api_key_1.listBotApiKeys; } });
 Object.defineProperty(exports, "revokeBotKey", { enumerable: true, get: function () { return bot_api_key_1.revokeBotApiKey; } });
-const LIST_BOTS = `
-  SELECT * FROM lt_users
-  WHERE account_type = 'bot'
-  ORDER BY created_at DESC
-  LIMIT $1 OFFSET $2`;
-const COUNT_BOTS = `
-  SELECT COUNT(*)::int AS total FROM lt_users WHERE account_type = 'bot'`;
+const sql_1 = require("./sql");
 /**
  * Create a new bot account.
  */
@@ -49,7 +43,7 @@ async function createBot(input) {
     // Create the user row, then set account_type column
     const user = await (0, user_1.createUser)(userInput);
     const pool = await (0, db_1.getPool)();
-    await pool.query('UPDATE lt_users SET account_type = $1 WHERE id = $2', ['bot', user.id]);
+    await pool.query(sql_1.SET_ACCOUNT_TYPE_BOT, ['bot', user.id]);
     return toBotRecord(user, input.description, input.created_by);
 }
 /**
@@ -67,8 +61,8 @@ async function getBot(id) {
 async function listBots(limit = 50, offset = 0) {
     const pool = await (0, db_1.getPool)();
     const [{ rows }, countResult] = await Promise.all([
-        pool.query(LIST_BOTS, [limit, offset]),
-        pool.query(COUNT_BOTS),
+        pool.query(sql_1.LIST_BOTS, [limit, offset]),
+        pool.query(sql_1.COUNT_BOTS),
     ]);
     // Attach roles to each bot
     const bots = await Promise.all(rows.map(async (row) => {
@@ -135,7 +129,7 @@ const SYSTEM_BOT_NAME = 'lt-system';
  */
 async function ensureSystemBot() {
     const pool = await (0, db_1.getPool)();
-    const { rows } = await pool.query('SELECT id FROM lt_users WHERE external_id = $1', [SYSTEM_BOT_NAME]);
+    const { rows } = await pool.query(sql_1.GET_USER_BY_EXTERNAL_ID, [SYSTEM_BOT_NAME]);
     if (rows.length > 0)
         return rows[0].id;
     const bot = await createBot({

package/build/services/iam/context.d.ts

@@ -7,7 +7,7 @@ export declare function runWithToolContext<T>(ctx: ToolContext, fn: () => Promis
 /**
  * Retrieve the ToolContext for the current execution scope.
  *
- * Activities: reads from argumentMetadata (injected by activity interceptor).
+ * Activities: reads from headers (injected by activity interceptor).
  * Workflow scope: reads from AsyncLocalStorage (set by workflow interceptor).
  * Returns undefined when no identity is available.
  */

package/build/services/iam/context.js

@@ -7,9 +7,9 @@ exports.getToolContext = getToolContext;
  *
  * Two paths, checked in order:
  *
- * 1. **argumentMetadata** (production-safe, distributed):
+ * 1. **headers** (production-safe, distributed):
  *    The activity interceptor injects `principal` + `scopes` into
- *    `argumentMetadata`, which HotMesh delivers to the activity worker
+ *    `headers`, which HotMesh delivers to the activity worker
  *    via `Durable.activity.getContext()`. Works across process boundaries.
  *
  * 2. **AsyncLocalStorage** (workflow-local, single-process):
@@ -30,15 +30,15 @@ function runWithToolContext(ctx, fn) {
 /**
  * Retrieve the ToolContext for the current execution scope.
  *
- * Activities: reads from argumentMetadata (injected by activity interceptor).
+ * Activities: reads from headers (injected by activity interceptor).
  * Workflow scope: reads from AsyncLocalStorage (set by workflow interceptor).
  * Returns undefined when no identity is available.
  */
 function getToolContext() {
-    // 1. Try argumentMetadata (activity worker — works distributed)
+    // 1. Try headers (activity worker — works distributed)
     try {
         const actCtx = hotmesh_1.Durable.activity.getContext();
-        const meta = actCtx?.argumentMetadata;
+        const meta = actCtx?.headers;
         if (meta?.principal) {
             const principal = meta.principal;
             return {

package/build/services/iam/credentials.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.MissingCredentialError = void 0;
 exports.resolveCredential = resolveCredential;
 const oauth_1 = require("../oauth");
-const logger_1 = require("../logger");
+const logger_1 = require("../../lib/logger");
 /**
  * Thrown when credential resolution finds no credential for a provider.
  * Caught by route handlers to return structured 422 responses.

package/build/services/iam/ephemeral.js

@@ -9,9 +9,10 @@ exports.storeEphemeral = storeEphemeral;
 exports.exchangeEphemeral = exchangeEphemeral;
 exports.revokeEphemeral = revokeEphemeral;
 exports.cleanupExpired = cleanupExpired;
-const db_1 = require("../db");
+const db_1 = require("../../lib/db");
 const crypto_1 = require("../oauth/crypto");
-const logger_1 = require("../logger");
+const logger_1 = require("../../lib/logger");
+const sql_1 = require("./sql");
 // ── Token format ────────────────────────────────────────────────────────────
 // Opaque string: eph:v1:<label>:<uuid>
 // The LLM passes these through as-is. Exchange happens inside activity bodies.
@@ -80,9 +81,7 @@ async function storeEphemeral(value, opts = {}) {
     const expiresAt = opts.ttlSeconds
         ? `NOW() + ${opts.ttlSeconds} * INTERVAL '1 second'`
         : 'NULL';
-    const { rows } = await pool.query(`INSERT INTO lt_ephemeral_credentials (value, label, max_uses, expires_at)
-     VALUES ($1, $2, $3, ${expiresAt})
-     RETURNING token`, [Buffer.from(encrypted, 'base64'), opts.label || null, maxUses]);
+    const { rows } = await pool.query((0, sql_1.INSERT_EPHEMERAL)(expiresAt), [Buffer.from(encrypted, 'base64'), opts.label || null, maxUses]);
     return rows[0].token;
 }
 /**
@@ -97,18 +96,13 @@ async function exchangeEphemeral(token) {
     const pool = (0, db_1.getPool)();
     // Atomic increment + check in one query.
     // Returns the row if the exchange is valid, nothing if expired/exhausted.
-    const { rows } = await pool.query(`UPDATE lt_ephemeral_credentials
-     SET use_count = use_count + 1
-     WHERE token = $1
-       AND (expires_at IS NULL OR expires_at > NOW())
-       AND (max_uses = 0 OR use_count < max_uses)
-     RETURNING value, use_count, max_uses`, [token]);
+    const { rows } = await pool.query(sql_1.EXCHANGE_EPHEMERAL, [token]);
     if (rows.length === 0)
         return null;
     const { value: buf, use_count, max_uses } = rows[0];
     // Auto-delete when max_uses is reached (if bounded)
     if (max_uses > 0 && use_count >= max_uses) {
-        await pool.query(`DELETE FROM lt_ephemeral_credentials WHERE token = $1`, [token]);
+        await pool.query(sql_1.DELETE_EPHEMERAL, [token]);
     }
     return (0, crypto_1.decrypt)(buf.toString('base64'));
 }
@@ -117,7 +111,7 @@ async function exchangeEphemeral(token) {
  */
 async function revokeEphemeral(token) {
     const pool = (0, db_1.getPool)();
-    const { rowCount } = await pool.query(`DELETE FROM lt_ephemeral_credentials WHERE token = $1`, [token]);
+    const { rowCount } = await pool.query(sql_1.DELETE_EPHEMERAL, [token]);
     return (rowCount ?? 0) > 0;
 }
 /**
@@ -125,7 +119,6 @@ async function revokeEphemeral(token) {
  */
 async function cleanupExpired() {
     const pool = (0, db_1.getPool)();
-    const { rowCount } = await pool.query(`DELETE FROM lt_ephemeral_credentials
-     WHERE expires_at IS NOT NULL AND expires_at < NOW()`);
+    const { rowCount } = await pool.query(sql_1.CLEANUP_EXPIRED_EPHEMERAL);
     return rowCount ?? 0;
 }

package/build/services/iam/principal.js

@@ -11,21 +11,14 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolvePrincipal = resolvePrincipal;
-const db_1 = require("../db");
+const db_1 = require("../../lib/db");
+const sql_1 = require("./sql");
 /** UUID v4 pattern for distinguishing UUIDs from external_ids. */
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-/** Fetch user + roles by external_id OR id in one query. */
-const GET_USER_WITH_ROLES_FLEXIBLE = `
-  SELECT u.id, u.external_id, u.display_name, u.status, u.metadata,
-         r.role, r.type AS role_type
-  FROM lt_users u
-  LEFT JOIN lt_user_roles r ON r.user_id = u.id
-  WHERE u.external_id = $1 OR u.id::text = $1
-  ORDER BY r.created_at`;
 const ROLE_TYPE_PRIORITY = { superadmin: 3, admin: 2, member: 1 };
 async function resolvePrincipal(identifier) {
     const pool = (0, db_1.getPool)();
-    const { rows } = await pool.query(GET_USER_WITH_ROLES_FLEXIBLE, [identifier]);
+    const { rows } = await pool.query(sql_1.GET_USER_WITH_ROLES_FLEXIBLE, [identifier]);
     if (rows.length === 0)
         return null;
     const user = rows[0];

package/build/services/iam/resolve.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveToolContext = resolveToolContext;
 const delegation_1 = require("../auth/delegation");
 const user_1 = require("../user");
-const logger_1 = require("../logger");
+const logger_1 = require("../../lib/logger");
 /** Role type priority for determining highest role type. */
 const ROLE_TYPE_PRIORITY = { superadmin: 3, admin: 2, member: 1 };
 /**

package/build/services/iam/sql.d.ts

@@ -0,0 +1,10 @@
+/** Build INSERT for ephemeral credentials. expiresExpr is a SQL expression like 'NULL' or "NOW() + N * INTERVAL '1 second'". */
+export declare const INSERT_EPHEMERAL: (expiresExpr: string) => string;
+export declare const EXCHANGE_EPHEMERAL = "\n  UPDATE lt_ephemeral_credentials\n  SET use_count = use_count + 1\n  WHERE token = $1\n    AND (expires_at IS NULL OR expires_at > NOW())\n    AND (max_uses = 0 OR use_count < max_uses)\n  RETURNING value, use_count, max_uses";
+export declare const DELETE_EPHEMERAL = "\n  DELETE FROM lt_ephemeral_credentials WHERE token = $1";
+export declare const CLEANUP_EXPIRED_EPHEMERAL = "\n  DELETE FROM lt_ephemeral_credentials\n  WHERE expires_at IS NOT NULL AND expires_at < NOW()";
+export declare const LIST_BOTS = "\n  SELECT * FROM lt_users\n  WHERE account_type = 'bot'\n  ORDER BY created_at DESC\n  LIMIT $1 OFFSET $2";
+export declare const COUNT_BOTS = "\n  SELECT COUNT(*)::int AS total FROM lt_users WHERE account_type = 'bot'";
+export declare const SET_ACCOUNT_TYPE_BOT = "\n  UPDATE lt_users SET account_type = $1 WHERE id = $2";
+export declare const GET_USER_BY_EXTERNAL_ID = "\n  SELECT id FROM lt_users WHERE external_id = $1";
+export declare const GET_USER_WITH_ROLES_FLEXIBLE = "\n  SELECT u.id, u.external_id, u.display_name, u.status, u.metadata,\n         r.role, r.type AS role_type\n  FROM lt_users u\n  LEFT JOIN lt_user_roles r ON r.user_id = u.id\n  WHERE u.external_id = $1 OR u.id::text = $1\n  ORDER BY r.created_at";

package/build/services/iam/sql.js

@@ -0,0 +1,42 @@
+"use strict";
+// ─── Ephemeral credentials ──────────────────────────────────────────────────
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GET_USER_WITH_ROLES_FLEXIBLE = exports.GET_USER_BY_EXTERNAL_ID = exports.SET_ACCOUNT_TYPE_BOT = exports.COUNT_BOTS = exports.LIST_BOTS = exports.CLEANUP_EXPIRED_EPHEMERAL = exports.DELETE_EPHEMERAL = exports.EXCHANGE_EPHEMERAL = exports.INSERT_EPHEMERAL = void 0;
+/** Build INSERT for ephemeral credentials. expiresExpr is a SQL expression like 'NULL' or "NOW() + N * INTERVAL '1 second'". */
+const INSERT_EPHEMERAL = (expiresExpr) => `
+  INSERT INTO lt_ephemeral_credentials (value, label, max_uses, expires_at)
+  VALUES ($1, $2, $3, ${expiresExpr})
+  RETURNING token`;
+exports.INSERT_EPHEMERAL = INSERT_EPHEMERAL;
+exports.EXCHANGE_EPHEMERAL = `
+  UPDATE lt_ephemeral_credentials
+  SET use_count = use_count + 1
+  WHERE token = $1
+    AND (expires_at IS NULL OR expires_at > NOW())
+    AND (max_uses = 0 OR use_count < max_uses)
+  RETURNING value, use_count, max_uses`;
+exports.DELETE_EPHEMERAL = `
+  DELETE FROM lt_ephemeral_credentials WHERE token = $1`;
+exports.CLEANUP_EXPIRED_EPHEMERAL = `
+  DELETE FROM lt_ephemeral_credentials
+  WHERE expires_at IS NOT NULL AND expires_at < NOW()`;
+// ─── Bot accounts ───────────────────────────────────────────────────────────
+exports.LIST_BOTS = `
+  SELECT * FROM lt_users
+  WHERE account_type = 'bot'
+  ORDER BY created_at DESC
+  LIMIT $1 OFFSET $2`;
+exports.COUNT_BOTS = `
+  SELECT COUNT(*)::int AS total FROM lt_users WHERE account_type = 'bot'`;
+exports.SET_ACCOUNT_TYPE_BOT = `
+  UPDATE lt_users SET account_type = $1 WHERE id = $2`;
+exports.GET_USER_BY_EXTERNAL_ID = `
+  SELECT id FROM lt_users WHERE external_id = $1`;
+// ─── Principal resolution ───────────────────────────────────────────────────
+exports.GET_USER_WITH_ROLES_FLEXIBLE = `
+  SELECT u.id, u.external_id, u.display_name, u.status, u.metadata,
+         r.role, r.type AS role_type
+  FROM lt_users u
+  LEFT JOIN lt_user_roles r ON r.user_id = u.id
+  WHERE u.external_id = $1 OR u.id::text = $1
+  ORDER BY r.created_at`;

package/build/services/insight/index.d.ts

@@ -7,6 +7,7 @@ export interface McpQueryInput {
     tags?: string[];
     wait?: boolean;
     direct?: boolean;
+    context?: Record<string, any>;
     userId?: string;
 }
 export interface McpQueryResult {

package/build/services/insight/index.js

@@ -6,25 +6,23 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.startMcpQuery = startMcpQuery;
 exports.describeWorkflow = describeWorkflow;
-const pg_1 = require("pg");
 const hotmesh_1 = require("@hotmeshio/hotmesh");
-const config_1 = require("../../modules/config");
+const db_1 = require("../../lib/db");
 const defaults_1 = require("../../modules/defaults");
 const llm_1 = require("../llm");
 const prompts_1 = require("./prompts");
 // ── MCP query invocation ─────────────────────────────────────────────────────
 async function startMcpQuery(input) {
-    const { prompt, tags, wait = true, direct = false, userId } = input;
+    const { prompt, tags, wait = true, direct = false, context, userId } = input;
     const startTime = Date.now();
-    const connection = { class: pg_1.Client, options: config_1.postgres_options };
-    const client = new hotmesh_1.Durable.Client({ connection });
+    const client = new hotmesh_1.Durable.Client({ connection: (0, db_1.getConnection)() });
     const wfName = direct ? 'mcpQuery' : 'mcpQueryRouter';
     const entity = direct ? 'mcpQuery' : 'mcpQueryRouter';
     const prefix = direct ? 'mcp-query-direct' : 'mcp-query';
     const workflowId = `${prefix}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
     const handle = await client.workflow.start({
         args: [{
-                data: { prompt, tags },
+                data: { prompt, tags, context },
                 metadata: { source: 'dashboard' },
                 lt: { userId },
             }],

package/build/services/interceptor/activities/escalation.js

@@ -38,7 +38,7 @@ exports.ltClaimEscalation = ltClaimEscalation;
 exports.ltEnrichEscalationRouting = ltEnrichEscalationRouting;
 exports.ltCreateEscalation = ltCreateEscalation;
 const escalationService = __importStar(require("../../escalation"));
-const logger_1 = require("../../logger");
+const logger_1 = require("../../../lib/logger");
 /**
  * Resolve an escalation record. Called by the interceptor after
  * detecting a re-run (resolver data present in the envelope).

package/build/services/interceptor/activities/task.js

@@ -42,17 +42,20 @@ exports.ltAppendMilestones = ltAppendMilestones;
 exports.ltGetTaskByWorkflowId = ltGetTaskByWorkflowId;
 exports.ltGetTask = ltGetTask;
 const taskService = __importStar(require("../../task"));
-const publish_1 = require("../../events/publish");
-const db_1 = require("../../db");
+const publish_1 = require("../../../lib/events/publish");
+const db_1 = require("../../../lib/db");
+const sql_1 = require("../../user/sql");
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-/** Resolve an external_id to a UUID. Returns null if not found or already a UUID. */
+/** Resolve an identifier to a verified lt_users UUID. Returns undefined if not found. */
 async function resolveUserUuid(identifier) {
     if (!identifier)
         return undefined;
-    if (UUID_RE.test(identifier))
-        return identifier;
     const pool = (0, db_1.getPool)();
-    const { rows } = await pool.query('SELECT id FROM lt_users WHERE external_id = $1 LIMIT 1', [identifier]);
+    if (UUID_RE.test(identifier)) {
+        const { rows } = await pool.query(sql_1.VERIFY_USER_BY_ID, [identifier]);
+        return rows[0]?.id ?? undefined;
+    }
+    const { rows } = await pool.query(sql_1.GET_USER_BY_EXTERNAL_ID, [identifier]);
     return rows[0]?.id ?? undefined;
 }
 /**

package/build/services/interceptor/activities/workflow.js

@@ -2,11 +2,10 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ltSignalParent = ltSignalParent;
 exports.ltStartWorkflow = ltStartWorkflow;
-const pg_1 = require("pg");
 const hotmesh_1 = require("@hotmeshio/hotmesh");
-const config_1 = require("../../../modules/config");
+const db_1 = require("../../../lib/db");
 const defaults_1 = require("../../../modules/defaults");
-const logger_1 = require("../../logger");
+const logger_1 = require("../../../lib/logger");
 /**
  * Signal an orchestrator workflow from within the interceptor.
  * Used after a child workflow succeeds to send the result back
@@ -14,7 +13,7 @@ const logger_1 = require("../../logger");
  */
 async function ltSignalParent(input) {
     const client = new hotmesh_1.Durable.Client({
-        connection: { class: pg_1.Client, options: config_1.postgres_options },
+        connection: (0, db_1.getConnection)(),
     });
     const handle = await client.workflow.getHandle(input.parentTaskQueue, input.parentWorkflowType, input.parentWorkflowId);
     await handle.signal(input.signalId, input.data);
@@ -28,7 +27,7 @@ async function ltSignalParent(input) {
  */
 async function ltStartWorkflow(input) {
     const client = new hotmesh_1.Durable.Client({
-        connection: { class: pg_1.Client, options: config_1.postgres_options },
+        connection: (0, db_1.getConnection)(),
     });
     await client.workflow.start({
         workflowName: input.workflowName,

package/build/services/interceptor/activity-interceptor.d.ts

@@ -10,7 +10,7 @@
  *    the stored activity result → after-phase runs
  *
  * Before phase:
- *   Injects the envelope's pre-resolved principal into argumentMetadata
+ *   Injects the envelope's pre-resolved principal into headers
  *   so activities can read it via `Durable.activity.getContext()`.
  *   Skipped for `lt*` interceptor activities (they don't need identity).
  *

package/build/services/interceptor/activity-interceptor.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createLTActivityInterceptor = createLTActivityInterceptor;
 const hotmesh_1 = require("@hotmeshio/hotmesh");
-const publish_1 = require("../events/publish");
+const publish_1 = require("../../lib/events/publish");
 const state_1 = require("./state");
 /**
  * Create an LT Activity Interceptor.
@@ -16,7 +16,7 @@ const state_1 = require("./state");
  *    the stored activity result → after-phase runs
  *
  * Before phase:
- *   Injects the envelope's pre-resolved principal into argumentMetadata
+ *   Injects the envelope's pre-resolved principal into headers
  *   so activities can read it via `Durable.activity.getContext()`.
  *   Skipped for `lt*` interceptor activities (they don't need identity).
  *
@@ -32,7 +32,7 @@ function createLTActivityInterceptor(_options) {
         async execute(activityCtx, workflowCtx, next) {
             try {
                 // ── Before phase ─────────────────────────────────────────
-                // Inject principal into argumentMetadata for non-interceptor activities.
+                // Inject principal into headers for non-interceptor activities.
                 // The principal was resolved at the front door and travels in the envelope.
                 if (!activityCtx.activityName.startsWith('lt')) {
                     const envelope = (0, state_1.extractEnvelope)(workflowCtx);
@@ -40,8 +40,8 @@ function createLTActivityInterceptor(_options) {
                     if (principal) {
                         activityCtx.options = {
                             ...activityCtx.options,
-                            argumentMetadata: {
-                                ...(activityCtx.options?.argumentMetadata ?? {}),
+                            headers: {
+                                ...(activityCtx.options?.headers ?? {}),
                                 principal,
                                 scopes: envelope.lt?.scopes,
                                 ...(envelope.lt?.initiatingPrincipal

package/build/services/interceptor/completion.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.handleCompletion = handleCompletion;
 const state_1 = require("./state");
-const publish_1 = require("../events/publish");
+const publish_1 = require("../../lib/events/publish");
 /**
  * Handle a workflow that returned { type: 'return' }.
  *