@hotmeshio/long-tail 0.1.4 → 0.1.6

package/build/services/oauth/sql.js

@@ -0,0 +1,32 @@
+"use strict";
+// ─── OAuth token CRUD ───────────────────────────────────────────────────────
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GET_USER_BY_OAUTH = exports.DELETE_TOKEN_DEFAULT = exports.DELETE_TOKEN = exports.LIST_CONNECTIONS = exports.GET_TOKEN_DEFAULT = exports.GET_TOKEN = exports.UPSERT_TOKEN = void 0;
+exports.UPSERT_TOKEN = `
+  INSERT INTO lt_oauth_tokens
+    (user_id, provider, label, access_token_enc, refresh_token_enc, token_type, scopes,
+     expires_at, provider_user_id, provider_email, metadata)
+  VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)
+  ON CONFLICT (user_id, provider, label) DO UPDATE SET
+    access_token_enc = EXCLUDED.access_token_enc,
+    refresh_token_enc = COALESCE(EXCLUDED.refresh_token_enc, lt_oauth_tokens.refresh_token_enc),
+    token_type = EXCLUDED.token_type,
+    scopes = EXCLUDED.scopes,
+    expires_at = EXCLUDED.expires_at,
+    provider_user_id = EXCLUDED.provider_user_id,
+    provider_email = COALESCE(EXCLUDED.provider_email, lt_oauth_tokens.provider_email),
+    metadata = COALESCE(EXCLUDED.metadata, lt_oauth_tokens.metadata)
+  RETURNING id`;
+exports.GET_TOKEN = `
+  SELECT * FROM lt_oauth_tokens WHERE user_id = $1 AND provider = $2 AND label = $3`;
+exports.GET_TOKEN_DEFAULT = `
+  SELECT * FROM lt_oauth_tokens WHERE user_id = $1 AND provider = $2 AND label = 'default'`;
+exports.LIST_CONNECTIONS = `
+  SELECT provider, label, provider_email, scopes, expires_at, metadata
+  FROM lt_oauth_tokens WHERE user_id = $1 ORDER BY provider, label`;
+exports.DELETE_TOKEN = `
+  DELETE FROM lt_oauth_tokens WHERE user_id = $1 AND provider = $2 AND label = $3`;
+exports.DELETE_TOKEN_DEFAULT = `
+  DELETE FROM lt_oauth_tokens WHERE user_id = $1 AND provider = $2 AND label = 'default'`;
+exports.GET_USER_BY_OAUTH = `
+  SELECT * FROM lt_users WHERE oauth_provider = $1 AND oauth_provider_id = $2`;

package/build/services/orchestrator/index.js

@@ -69,13 +69,13 @@ async function executeLT(options) {
     const { ltCreateTask, ltStartTask, ltCompleteTask, ltGetWorkflowConfig, ltGetProviderData, } = hotmesh_1.Durable.workflow.proxyActivities({
         activities: interceptorActivities,
         taskQueue: LT_ACTIVITY_QUEUE,
-        retryPolicy: { maximumAttempts: 3 },
+        retry: { maximumAttempts: 3 },
     });
     // Derive child workflow ID deterministically from the parent context.
     // Combines parent workflowId (globally unique) with the execution
     // counter (unique per step within this workflow) — zero-cost, fully
     // replay-safe, and self-documents its lineage.
-    const ctx = hotmesh_1.Durable.workflow.getContext();
+    const ctx = hotmesh_1.Durable.workflow.workflowInfo();
     const childWorkflowId = options.workflowId || `${workflowName}-${ctx.workflowId}-${ctx.counter}`;
     const signalId = `lt-result-${childWorkflowId}`;
     // Read orchestrator context (set by interceptor wrapping the container)
@@ -142,7 +142,7 @@ async function executeLT(options) {
         entity: workflowName,
     });
     // 6. Wait for the child's interceptor to signal back with the result
-    const result = await hotmesh_1.Durable.workflow.waitFor(signalId);
+    const result = await hotmesh_1.Durable.workflow.condition(signalId);
     // 7. Complete the task — persist result data
     await ltCompleteTask({
         taskId,

package/build/services/role/index.js

@@ -10,7 +10,7 @@ exports.listDistinctRoles = listDistinctRoles;
 exports.listRolesWithDetails = listRolesWithDetails;
 exports.createRole = createRole;
 exports.deleteRole = deleteRole;
-const db_1 = require("../db");
+const db_1 = require("../../lib/db");
 const user_1 = require("../user");
 const sql_1 = require("./sql");
 /**

package/build/services/task/crud.js

@@ -7,7 +7,7 @@ exports.getTask = getTask;
 exports.getTaskBySignalId = getTaskBySignalId;
 exports.getTaskByWorkflowId = getTaskByWorkflowId;
 exports.listTasks = listTasks;
-const db_1 = require("../db");
+const db_1 = require("../../lib/db");
 const sql_1 = require("./sql");
 async function createTask(input) {
     const pool = (0, db_1.getPool)();

package/build/services/task/process.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.listProcesses = listProcesses;
 exports.getProcessStats = getProcessStats;
 exports.getProcessTasks = getProcessTasks;
-const db_1 = require("../db");
+const db_1 = require("../../lib/db");
 const types_1 = require("./types");
 const sql_1 = require("./sql");
 async function listProcesses(filters) {

package/build/services/task/resolve.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveWorkflowHandle = resolveWorkflowHandle;
-const db_1 = require("../db");
+const db_1 = require("../../lib/db");
 const registry_1 = require("../workers/registry");
 const sql_1 = require("./sql");
 /**

package/build/services/user/auth.js

@@ -5,7 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.verifyPassword = verifyPassword;
 const bcryptjs_1 = __importDefault(require("bcryptjs"));
-const db_1 = require("../db");
+const db_1 = require("../../lib/db");
 const crud_1 = require("./crud");
 const sql_1 = require("./sql");
 // ─── Password authentication ────────────────────────────────────────────────

package/build/services/user/crud.js

@@ -12,7 +12,7 @@ exports.updateUser = updateUser;
 exports.deleteUser = deleteUser;
 exports.listUsers = listUsers;
 const bcryptjs_1 = __importDefault(require("bcryptjs"));
-const db_1 = require("../db");
+const db_1 = require("../../lib/db");
 const sql_1 = require("./sql");
 // ─── Private helpers (exported for internal use by auth.ts) ──────────────────
 async function attachRoles(user) {

package/build/services/user/rbac.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.isSuperAdmin = isSuperAdmin;
 exports.isGroupAdmin = isGroupAdmin;
 exports.canManageRole = canManageRole;
-const db_1 = require("../db");
+const db_1 = require("../../lib/db");
 const roles_1 = require("./roles");
 const sql_1 = require("./sql");
 // ─── RBAC helpers ─────────────────────────────────────────────────────────────

package/build/services/user/roles.js

@@ -6,7 +6,7 @@ exports.removeUserRole = removeUserRole;
 exports.getUserRoles = getUserRoles;
 exports.hasRole = hasRole;
 exports.hasRoleType = hasRoleType;
-const db_1 = require("../db");
+const db_1 = require("../../lib/db");
 const sql_1 = require("./sql");
 const types_1 = require("./types");
 // ─── Role management ──────────────────────────────────────────────────────────

package/build/services/user/sql.d.ts

@@ -8,6 +8,8 @@ export declare const INSERT_USER = "INSERT INTO lt_users (external_id, email, di
 export declare const GET_USER_BY_EMAIL = "SELECT * FROM lt_users WHERE email = $1 LIMIT 1";
 export declare const INSERT_USER_ROLE_IGNORE = "INSERT INTO lt_user_roles (user_id, role, type) VALUES ($1, $2, $3)\n   ON CONFLICT DO NOTHING";
 export declare const GET_USER_BY_ID = "SELECT * FROM lt_users WHERE id = $1";
+/** Check if a user exists by id. Lightweight — returns only the id column. */
+export declare const VERIFY_USER_BY_ID = "SELECT id FROM lt_users WHERE id = $1 LIMIT 1";
 /** Fetch user + roles in a single query. Returns one row per role (or one row with nulls if no roles). */
 export declare const GET_USER_WITH_ROLES = "SELECT u.id, u.external_id, u.display_name, u.status, u.metadata,\n          r.role, r.type AS role_type\n   FROM lt_users u\n   LEFT JOIN lt_user_roles r ON r.user_id = u.id\n   WHERE u.external_id = $1\n   ORDER BY r.created_at";
 export declare const DELETE_USER_BY_ID = "DELETE FROM lt_users WHERE id = $1";

package/build/services/user/sql.js

@@ -1,7 +1,7 @@
 "use strict";
 // ─── Shared queries (used by multiple modules) ──────────────────────────────
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.IS_GROUP_ADMIN = exports.HAS_ROLE_TYPE = exports.HAS_ROLE = exports.DELETE_USER_ROLE = exports.UPSERT_USER_ROLE = exports.GET_ROLES_BY_USER_IDS = exports.DELETE_USER_BY_ID = exports.GET_USER_WITH_ROLES = exports.GET_USER_BY_ID = exports.INSERT_USER_ROLE_IGNORE = exports.GET_USER_BY_EMAIL = exports.INSERT_USER = exports.GET_USER_BY_EXTERNAL_ID = exports.GET_ROLES_BY_USER_ID = exports.ENSURE_ROLE_EXISTS = void 0;
+exports.IS_GROUP_ADMIN = exports.HAS_ROLE_TYPE = exports.HAS_ROLE = exports.DELETE_USER_ROLE = exports.UPSERT_USER_ROLE = exports.GET_ROLES_BY_USER_IDS = exports.DELETE_USER_BY_ID = exports.GET_USER_WITH_ROLES = exports.VERIFY_USER_BY_ID = exports.GET_USER_BY_ID = exports.INSERT_USER_ROLE_IGNORE = exports.GET_USER_BY_EMAIL = exports.INSERT_USER = exports.GET_USER_BY_EXTERNAL_ID = exports.GET_ROLES_BY_USER_ID = exports.ENSURE_ROLE_EXISTS = void 0;
 /** Ensure a role name exists in the lt_roles lookup table (FK target). */
 exports.ENSURE_ROLE_EXISTS = 'INSERT INTO lt_roles (role) VALUES ($1) ON CONFLICT DO NOTHING';
 /** Fetch roles for a single user, ordered by creation time. */
@@ -16,6 +16,8 @@ exports.GET_USER_BY_EMAIL = `SELECT * FROM lt_users WHERE email = $1 LIMIT 1`;
 exports.INSERT_USER_ROLE_IGNORE = `INSERT INTO lt_user_roles (user_id, role, type) VALUES ($1, $2, $3)
    ON CONFLICT DO NOTHING`;
 exports.GET_USER_BY_ID = 'SELECT * FROM lt_users WHERE id = $1';
+/** Check if a user exists by id. Lightweight — returns only the id column. */
+exports.VERIFY_USER_BY_ID = 'SELECT id FROM lt_users WHERE id = $1 LIMIT 1';
 /** Fetch user + roles in a single query. Returns one row per role (or one row with nulls if no roles). */
 exports.GET_USER_WITH_ROLES = `SELECT u.id, u.external_id, u.display_name, u.status, u.metadata,
           r.role, r.type AS role_type

package/build/services/yaml-workflow/db-utils.js

@@ -4,7 +4,7 @@ exports.parseVersionFromYaml = parseVersionFromYaml;
 exports.updateYamlWorkflowStatus = updateYamlWorkflowStatus;
 exports.listYamlWorkflows = listYamlWorkflows;
 exports.findYamlWorkflowsByTags = findYamlWorkflowsByTags;
-const db_1 = require("../db");
+const db_1 = require("../../lib/db");
 const defaults_1 = require("../../modules/defaults");
 const sql_1 = require("./sql");
 /**

package/build/services/yaml-workflow/db.d.ts

@@ -25,3 +25,6 @@ export declare function getVersionHistory(workflowId: string, limit?: number, of
 export declare function getVersionSnapshot(workflowId: string, version: number): Promise<LTYamlWorkflowVersionRecord | null>;
 export declare function markContentDeployed(workflowId: string): Promise<void>;
 export declare function markAppIdContentDeployed(appId: string): Promise<void>;
+export declare function updateCronSchedule(id: string, cronSchedule: string, cronEnvelope: Record<string, unknown> | null, executeAs: string | null): Promise<LTYamlWorkflowRecord | null>;
+export declare function clearCronSchedule(id: string): Promise<LTYamlWorkflowRecord | null>;
+export declare function getCronScheduledWorkflows(): Promise<LTYamlWorkflowRecord[]>;

package/build/services/yaml-workflow/db.js

@@ -16,7 +16,10 @@ exports.getVersionHistory = getVersionHistory;
 exports.getVersionSnapshot = getVersionSnapshot;
 exports.markContentDeployed = markContentDeployed;
 exports.markAppIdContentDeployed = markAppIdContentDeployed;
-const db_1 = require("../db");
+exports.updateCronSchedule = updateCronSchedule;
+exports.clearCronSchedule = clearCronSchedule;
+exports.getCronScheduledWorkflows = getCronScheduledWorkflows;
+const db_1 = require("../../lib/db");
 const defaults_1 = require("../../modules/defaults");
 const sql_1 = require("./sql");
 const db_utils_1 = require("./db-utils");
@@ -194,3 +197,24 @@ async function markAppIdContentDeployed(appId) {
     const pool = (0, db_1.getPool)();
     await pool.query(sql_1.MARK_APP_ID_CONTENT_DEPLOYED, [appId]);
 }
+// -- Cron scheduling ---------------------------------------------------------
+async function updateCronSchedule(id, cronSchedule, cronEnvelope, executeAs) {
+    const pool = (0, db_1.getPool)();
+    const { rows } = await pool.query(sql_1.UPDATE_CRON_SCHEDULE, [
+        id,
+        cronSchedule,
+        cronEnvelope ? JSON.stringify(cronEnvelope) : null,
+        executeAs,
+    ]);
+    return rows[0] || null;
+}
+async function clearCronSchedule(id) {
+    const pool = (0, db_1.getPool)();
+    const { rows } = await pool.query(sql_1.CLEAR_CRON_SCHEDULE, [id]);
+    return rows[0] || null;
+}
+async function getCronScheduledWorkflows() {
+    const pool = (0, db_1.getPool)();
+    const { rows } = await pool.query(sql_1.GET_CRON_SCHEDULED_WORKFLOWS);
+    return rows;
+}

package/build/services/yaml-workflow/deployer-helpers.js

@@ -38,7 +38,7 @@ exports.recompileWithContext = recompileWithContext;
 // eslint-disable-next-line @typescript-eslint/no-var-requires
 const yaml = require('js-yaml');
 const defaults_1 = require("../../modules/defaults");
-const logger_1 = require("../logger");
+const logger_1 = require("../../lib/logger");
 const yamlDb = __importStar(require("./db"));
 /**
  * Merge all YAML graphs for an app_id into a single YAML document.

package/build/services/yaml-workflow/deployer.js

@@ -43,10 +43,9 @@ exports.invokeYamlWorkflowSync = invokeYamlWorkflowSync;
 exports.stopEngine = stopEngine;
 exports.stopAllEngines = stopAllEngines;
 const hotmesh_1 = require("@hotmeshio/hotmesh");
-const pg_1 = require("pg");
-const config_1 = require("../../modules/config");
+const db_1 = require("../../lib/db");
 const defaults_1 = require("../../modules/defaults");
-const logger_1 = require("../logger");
+const logger_1 = require("../../lib/logger");
 const namespaceService = __importStar(require("../namespace"));
 const deployer_helpers_1 = require("./deployer-helpers");
 // Re-export helpers so existing `import * from './deployer'` consumers keep working
@@ -64,8 +63,9 @@ async function getEngine(appId) {
         return cached;
     const engine = await hotmesh_1.HotMesh.init({
         appId,
+        guid: `deployer::${appId}-${hotmesh_1.HotMesh.guid()}`,
         engine: {
-            connection: { class: pg_1.Client, options: config_1.postgres_options },
+            connection: (0, db_1.getConnection)(),
         },
     });
     engines.set(appId, engine);

package/build/services/yaml-workflow/generator.js

@@ -96,7 +96,7 @@ async function generateYamlFromExecution(options) {
     ctx = await (0, validate_1.validate)(ctx);
     // 4. Log validation warnings (informational — do not recompile)
     if (ctx.validationIssues.length > 0) {
-        const { loggerRegistry } = await Promise.resolve().then(() => __importStar(require('../logger')));
+        const { loggerRegistry } = await Promise.resolve().then(() => __importStar(require('../../lib/logger')));
         loggerRegistry.warn(`[yaml-workflow] Validation warnings (${ctx.validationIssues.length}): ${ctx.validationIssues.join('; ')}`);
     }
     // 5. Return result

package/build/services/yaml-workflow/input-analyzer-helpers.d.ts

@@ -21,6 +21,7 @@ export interface ExtractedStepLike {
     kind: 'tool' | 'llm';
     toolName: string;
     arguments: Record<string, unknown>;
+    result?: unknown;
 }
 /**
  * Classify a single argument key as dynamic, fixed, or wired.
@@ -29,6 +30,11 @@ export declare function classifyArgument(key: string, value: unknown, _context?:
     stepIndex: number;
     toolName: string;
 }): 'dynamic' | 'fixed' | 'wired';
+/**
+ * Check if an array argument was likely produced by a prior step's result.
+ * Compares the item keys of the argument array against result arrays from prior steps.
+ */
+export declare function isArrayWiredFromPriorStep(value: unknown[], priorSteps: ExtractedStepLike[]): boolean;
 /** Convert a snake_case/camelCase field name to a readable description. */
 export declare function humanize(name: string): string;
 /** Infer a JSON Schema type string from a JS value. */

package/build/services/yaml-workflow/input-analyzer-helpers.js

@@ -8,6 +8,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.WIRED_KEYS = exports.FIXED_KEYS = exports.DYNAMIC_KEYS = exports.MAX_DEFAULT_STRING_LENGTH = exports.MAX_DEFAULT_OBJECT_SIZE = exports.MAX_DEFAULT_ARRAY_LENGTH = void 0;
 exports.classifyArgument = classifyArgument;
+exports.isArrayWiredFromPriorStep = isArrayWiredFromPriorStep;
 exports.humanize = humanize;
 exports.inferType = inferType;
 exports.capDefault = capDefault;
@@ -64,15 +65,11 @@ function classifyArgument(key, value, _context) {
             return 'dynamic';
         }
     }
-    // Arrays: complex instruction arrays (like browser steps) are fixed implementation details.
-    // Only flat data arrays (URLs, IDs) that are large should be dynamic.
+    // Arrays of objects are always fixed (structured implementation details)
+    // or wired (from a prior step's output). Never user-provided dynamic inputs.
     if (Array.isArray(value)) {
         if (value.length > 0 && value[0] && typeof value[0] === 'object' && !Array.isArray(value[0])) {
-            // Array of objects — check if it's an instruction array (has 'action', 'step', 'type' keys)
-            const firstItem = value[0];
-            if ('action' in firstItem || 'step' in firstItem || 'type' in firstItem) {
-                return 'fixed'; // Implementation recipe — not user input
-            }
+            return 'fixed';
         }
         if (value.length > exports.MAX_DEFAULT_ARRAY_LENGTH) {
             return 'dynamic';
@@ -99,6 +96,38 @@ function objectContainsDynamicKeys(obj) {
     }
     return false;
 }
+/**
+ * Check if an array argument was likely produced by a prior step's result.
+ * Compares the item keys of the argument array against result arrays from prior steps.
+ */
+function isArrayWiredFromPriorStep(value, priorSteps) {
+    if (value.length === 0 || !value[0] || typeof value[0] !== 'object')
+        return false;
+    const argKeys = new Set(Object.keys(value[0]));
+    if (argKeys.size === 0)
+        return false;
+    for (const step of priorSteps) {
+        if (!step.result || typeof step.result !== 'object')
+            continue;
+        const result = step.result;
+        for (const field of Object.values(result)) {
+            if (!Array.isArray(field) || field.length === 0)
+                continue;
+            const first = field[0];
+            if (!first || typeof first !== 'object')
+                continue;
+            const resultKeys = new Set(Object.keys(first));
+            // If the result array items share keys with the argument array items, it's wired
+            let overlap = 0;
+            for (const k of argKeys)
+                if (resultKeys.has(k))
+                    overlap++;
+            if (overlap >= 2 || (overlap >= 1 && argKeys.size <= 3))
+                return true;
+        }
+    }
+    return false;
+}
 /** Convert a snake_case/camelCase field name to a readable description. */
 function humanize(name) {
     return name

package/build/services/yaml-workflow/input-analyzer.js

@@ -37,6 +37,10 @@ function extractSemanticInputs(steps, originalPrompt) {
             // First occurrence wins
             if (seen.has(key))
                 continue;
+            // Arrays of objects that match a prior step's result are wired, not inputs
+            if (Array.isArray(value) && (0, input_analyzer_helpers_1.isArrayWiredFromPriorStep)(value, steps.slice(0, i))) {
+                continue;
+            }
             const classification = (0, input_analyzer_helpers_1.classifyArgument)(key, value, {
                 stepIndex: i,
                 toolName: step.toolName,
@@ -44,10 +48,19 @@ function extractSemanticInputs(steps, originalPrompt) {
             // Skip wired arguments — they come from step chaining
             if (classification === 'wired')
                 continue;
-            // Flatten nested objects that contain dynamic keys.
-            // e.g., login: { url, username, password } → login_url, username, password
+            // Flatten nested objects that contain dynamic keys — but only if the
+            // dynamic children aren't already captured as top-level args from an
+            // earlier step. If all dynamic children are already seen, treat the
+            // whole object as fixed (structured implementation detail).
             if (classification === 'dynamic' && value && typeof value === 'object' && !Array.isArray(value)) {
-                (0, input_analyzer_helpers_1.flattenDynamicObject)(key, value, i, step.toolName, originalPrompt, seen);
+                const obj = value;
+                const dynamicChildren = Object.keys(obj).filter((k) => (0, input_analyzer_helpers_1.classifyArgument)(k, obj[k], { stepIndex: i, toolName: step.toolName }) === 'dynamic');
+                const allDynamicAlreadySeen = dynamicChildren.length > 0 && dynamicChildren.every((k) => seen.has(k));
+                if (allDynamicAlreadySeen) {
+                    // All dynamic values are already captured — treat as fixed, don't flatten
+                    continue;
+                }
+                (0, input_analyzer_helpers_1.flattenDynamicObject)(key, obj, i, step.toolName, originalPrompt, seen);
                 continue;
             }
             let description = (0, input_analyzer_helpers_1.humanize)(key);

package/build/services/yaml-workflow/invoke.d.ts

@@ -0,0 +1,19 @@
+import type { LTYamlWorkflowRecord } from '../../types/yaml-workflow';
+interface InvokeOptions {
+    data?: Record<string, unknown>;
+    sync?: boolean;
+    timeout?: number;
+    execute_as?: string;
+    userId?: string;
+    /** Source identifier for metadata injection (e.g., 'cron') */
+    source?: string;
+}
+/**
+ * Invoke a YAML workflow with scope injection.
+ * Shared by HTTP route and cron callback.
+ */
+export declare function invokeYamlWorkflow(wf: LTYamlWorkflowRecord, options?: InvokeOptions): Promise<{
+    job_id: string;
+    result?: unknown;
+}>;
+export {};

package/build/services/yaml-workflow/invoke.js

@@ -0,0 +1,80 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.invokeYamlWorkflow = invokeYamlWorkflow;
+const yamlDeployer = __importStar(require("./deployer"));
+const principal_1 = require("../iam/principal");
+/**
+ * Invoke a YAML workflow with scope injection.
+ * Shared by HTTP route and cron callback.
+ */
+async function invokeYamlWorkflow(wf, options = {}) {
+    const data = { ...(options.data || {}) };
+    // Inject _scope so compiled workflow activities have identity context
+    if (!data._scope) {
+        const executeAs = options.execute_as;
+        const userId = options.userId;
+        if (executeAs) {
+            const [botPrincipal, invokerPrincipal] = await Promise.all([
+                (0, principal_1.resolvePrincipal)(executeAs),
+                userId ? (0, principal_1.resolvePrincipal)(userId) : Promise.resolve(null),
+            ]);
+            if (botPrincipal) {
+                data._scope = {
+                    principal: botPrincipal,
+                    scopes: ['mcp:tool:call'],
+                    ...(invokerPrincipal ? { initiatedBy: userId, initiatingPrincipal: invokerPrincipal } : {}),
+                };
+            }
+        }
+        else if (userId) {
+            const principal = await (0, principal_1.resolvePrincipal)(userId);
+            if (principal) {
+                data._scope = { principal, scopes: ['mcp:tool:call'] };
+            }
+        }
+    }
+    if (options.source) {
+        if (!data._metadata)
+            data._metadata = {};
+        data._metadata.source = options.source;
+    }
+    if (options.sync) {
+        const { job_id, result } = await yamlDeployer.invokeYamlWorkflowSync(wf.app_id, wf.graph_topic, data, options.timeout, wf.graph_topic);
+        return { job_id, result };
+    }
+    const jobId = await yamlDeployer.invokeYamlWorkflow(wf.app_id, wf.graph_topic, data, wf.graph_topic);
+    return { job_id: jobId };
+}

package/build/services/yaml-workflow/pipeline/analyze.js

@@ -54,7 +54,7 @@ async function analyze(ctx) {
     const consecutiveSameServer = ctx.collapsedSteps.filter((s, i) => s.kind === 'tool' && s.mcpServerId &&
         i > 0 && ctx.collapsedSteps[i - 1].mcpServerId === s.mcpServerId);
     if (consecutiveSameServer.length > 0) {
-        const { loggerRegistry } = await Promise.resolve().then(() => __importStar(require('../../logger')));
+        const { loggerRegistry } = await Promise.resolve().then(() => __importStar(require('../../../lib/logger')));
         const serverIds = [...new Set(consecutiveSameServer.map(s => s.mcpServerId))];
         loggerRegistry.info(`[yaml-workflow] hint: ${consecutiveSameServer.length + 1} consecutive same-server steps detected (${serverIds.join(', ')}) — pattern detector may collapse these`);
     }

package/build/services/yaml-workflow/pipeline/build/dag.js

@@ -78,7 +78,7 @@ function appendNormalStep(dag, idx, step, prefix, graphTopic, plan, steps, trigg
     if (plan) {
         dag.prevActivityId = (0, transform_1.insertTransformActivities)(idx, plan, steps, prefix, graphTopic, dag.triggerId, triggerInputKeys, dag.stepIndexToActivityId, collapsedToCoreIndex, dag.activities, dag.transitions, dag.manifest, dag.prevActivityId);
     }
-    // Wire input mappings from upstream steps
+    // Wire input mappings from upstream steps (may include @pipe objects for derivations)
     const inputMappings = (0, wiring_1.wireStepInputs)(idx, step, plan, dag.stepIndexToActivityId, dag.triggerId, triggerInputKeys, steps, prefix, dag.prevActivityId, dag.prevResult, collapsedToCoreIndex);
     // Build the activity definition
     const resultSchema = step.result ? (0, utils_1.inferSchema)(step.result) : { type: 'object' };
@@ -222,12 +222,17 @@ function extractOutputFields(step) {
     return [];
 }
 function buildJobMaps(stepIdx, totalSteps, outputFields) {
-    if (stepIdx !== totalSteps - 1 || outputFields.length === 0)
+    if (stepIdx !== totalSteps - 1)
         return undefined;
-    return outputFields.reduce((acc, field) => {
-        acc[field] = `{$self.output.data.${field}}`;
-        return acc;
-    }, {});
+    if (outputFields.length > 0) {
+        return outputFields.reduce((acc, field) => {
+            acc[field] = `{$self.output.data.${field}}`;
+            return acc;
+        }, {});
+    }
+    // Final step with no structured output fields (e.g., string result) —
+    // persist the raw response so the workflow result isn't null
+    return { response: '{$self.output.data.response}' };
 }
 function buildManifestEntry(actId, title, step, topic, workflowName, inputMappings, outputFields) {
     const promptTemplate = step.kind === 'llm' && step.promptMessages

package/build/services/yaml-workflow/pipeline/build/wiring.d.ts

@@ -6,4 +6,4 @@ import type { ExtractedStep, EnhancedCompilationPlan } from '../../types';
  * Build input mappings for a step using the compilation plan's data flow edges.
  * Falls back to mechanical backward-scan when no plan is available.
  */
-export declare function wireStepInputs(stepIdx: number, step: ExtractedStep, plan: EnhancedCompilationPlan | null, stepIndexToActivityId: Map<number, string>, triggerId: string, triggerInputKeys: Set<string>, steps: ExtractedStep[], prefix: string, prevActivityId: string, prevResult: unknown, collapsedToCoreIndex?: Map<number, number>): Record<string, string>;
+export declare function wireStepInputs(stepIdx: number, step: ExtractedStep, plan: EnhancedCompilationPlan | null, stepIndexToActivityId: Map<number, string>, triggerId: string, triggerInputKeys: Set<string>, steps: ExtractedStep[], prefix: string, prevActivityId: string, prevResult: unknown, collapsedToCoreIndex?: Map<number, number>): Record<string, unknown>;