@hotmeshio/long-tail 0.4.21 → 0.4.23

package/build/api/dba.d.ts

@@ -19,6 +19,7 @@ import type { LTApiResult } from '../types/sdk';
  * @returns `{ status: 200, data: <prune result summary> }`
  */
 export declare function prune(input: {
+    appId: string;
     expire?: string;
     jobs?: boolean;
     streams?: boolean;
@@ -39,4 +40,4 @@ export declare function prune(input: {
  *
  * @returns `{ status: 200, data: { ok: true } }`
  */
-export declare function deploy(): Promise<LTApiResult>;
+export declare function deploy(appId: string): Promise<LTApiResult>;

package/build/api/dba.js

@@ -58,6 +58,7 @@ const dbaService = __importStar(require("../services/dba"));
 async function prune(input) {
     try {
         const result = await dbaService.prune({
+            appId: input.appId,
             expire: input.expire,
             jobs: input.jobs,
             streams: input.streams,
@@ -84,9 +85,9 @@ async function prune(input) {
  *
  * @returns `{ status: 200, data: { ok: true } }`
  */
-async function deploy() {
+async function deploy(appId) {
     try {
-        await dbaService.deploy();
+        await dbaService.deploy(appId);
         return { status: 200, data: { ok: true } };
     }
     catch (err) {

package/build/api/escalations/claim.d.ts

@@ -1,3 +1,4 @@
+import { type ProvisionIfAbsent } from './helpers';
 import type { LTApiResult, LTApiAuth } from '../../types/sdk';
 /**
  * Claim a pending escalation for the authenticated user.
@@ -14,6 +15,7 @@ import type { LTApiResult, LTApiAuth } from '../../types/sdk';
 export declare function claimEscalation(input: {
     id: string;
     durationMinutes?: number;
+    provisionIfAbsent?: ProvisionIfAbsent;
 }, auth: LTApiAuth): Promise<LTApiResult>;
 /**
  * Release a claimed escalation back to the pool.

package/build/api/escalations/claim.js

@@ -52,26 +52,30 @@ const helpers_1 = require("./helpers");
  */
 async function claimEscalation(input, auth) {
     try {
-        const { id, durationMinutes } = input;
+        const { id, durationMinutes, provisionIfAbsent } = input;
         const escalation = await escalationService.getEscalation(id);
         if (!escalation) {
             return { status: 404, error: 'Escalation not found' };
         }
+        // Happy path: try claim assuming user has the role
         const hasGlobal = await (0, helpers_1.hasGlobalEscalationAccess)(auth.userId);
         if (!hasGlobal) {
             const userHasRole = await userService.hasRole(auth.userId, escalation.role);
             if (!userHasRole) {
-                return {
-                    status: 403,
-                    error: `You must have the "${escalation.role}" role to claim this escalation`,
-                };
+                // Unhappy path: provision role if flag present, then retry
+                const provisioned = await (0, helpers_1.ensureRoleMembership)(auth.userId, escalation.role, auth.userId, provisionIfAbsent);
+                if (!provisioned) {
+                    return {
+                        status: 403,
+                        error: `You must have the "${escalation.role}" role to claim this escalation`,
+                    };
+                }
             }
         }
         const result = await escalationService.claimEscalation(id, auth.userId, durationMinutes);
         if (!result) {
             return { status: 409, error: 'Escalation not available for claim' };
         }
-        // Event published by service layer (services/escalation/crud.ts)
         return { status: 200, data: result };
     }
     catch (err) {

package/build/api/escalations/helpers.d.ts

@@ -8,13 +8,30 @@ export declare function checkBulkPermission(userId: string, ids: string[]): Prom
     status: 403;
     error: string;
 }>;
+/**
+ * Identity to provision when the assignee doesn't exist in lt_users
+ * or lacks the required role. Only honored for callers with global
+ * escalation access (superadmin, admin/admin).
+ */
+export interface ProvisionIfAbsent {
+    displayName?: string;
+    email?: string;
+    roles?: Array<{
+        role: string;
+        type?: string;
+    }>;
+}
 /**
  * Resolve an optional assignee external_id to an internal userId.
  * When omitted, returns the caller's userId from auth.
+ *
+ * When `provisionIfAbsent` is provided and the caller has global access,
+ * the user is JIT-provisioned if absent and roles are ensured. This avoids
+ * pre-flight queries — the happy path (user exists) is one lookup.
  */
 export declare function resolveAssignee(assignee: string | undefined, auth: {
     userId: string;
-}): Promise<{
+}, provisionIfAbsent?: ProvisionIfAbsent): Promise<{
     userId: string;
 } | {
     error: {
@@ -22,4 +39,10 @@ export declare function resolveAssignee(assignee: string | undefined, auth: {
         error: string;
     };
 }>;
+/**
+ * Ensure a user has the required role for an escalation.
+ * Called after claim when the atomic SQL returns null due to role mismatch.
+ * Only adds the role if `provisionIfAbsent` declares it and caller has authority.
+ */
+export declare function ensureRoleMembership(userId: string, requiredRole: string, callerUserId: string, provisionIfAbsent?: ProvisionIfAbsent): Promise<boolean>;
 export declare function publishBulkClaimEvents(ids: string[], assignedTo: string): void;

package/build/api/escalations/helpers.js

@@ -38,6 +38,7 @@ exports.getVisibleRoles = getVisibleRoles;
 exports.validateIds = validateIds;
 exports.checkBulkPermission = checkBulkPermission;
 exports.resolveAssignee = resolveAssignee;
+exports.ensureRoleMembership = ensureRoleMembership;
 exports.publishBulkClaimEvents = publishBulkClaimEvents;
 const escalationService = __importStar(require("../../services/escalation"));
 const userService = __importStar(require("../../services/user"));
@@ -71,15 +72,59 @@ async function checkBulkPermission(userId, ids) {
 /**
  * Resolve an optional assignee external_id to an internal userId.
  * When omitted, returns the caller's userId from auth.
+ *
+ * When `provisionIfAbsent` is provided and the caller has global access,
+ * the user is JIT-provisioned if absent and roles are ensured. This avoids
+ * pre-flight queries — the happy path (user exists) is one lookup.
  */
-async function resolveAssignee(assignee, auth) {
+async function resolveAssignee(assignee, auth, provisionIfAbsent) {
     if (!assignee)
         return { userId: auth.userId };
+    // Happy path: user exists
     const user = await userService.getUserByExternalId(assignee);
-    if (!user) {
+    if (user)
+        return { userId: user.id };
+    // User not found — provision if caller has authority and flag is set
+    if (!provisionIfAbsent) {
         return { error: { status: 404, error: `User not found for external_id: ${assignee}` } };
     }
-    return { userId: user.id };
+    const hasAuthority = await userService.hasGlobalEscalationAccess(auth.userId);
+    if (!hasAuthority) {
+        return { error: { status: 403, error: 'Only superadmin or admin can provision users on claim' } };
+    }
+    // Provision the user
+    const created = await userService.createUser({
+        external_id: assignee,
+        display_name: provisionIfAbsent.displayName || assignee,
+        email: provisionIfAbsent.email,
+        roles: (provisionIfAbsent.roles || []).map((r) => ({
+            role: r.role,
+            type: (r.type || 'member'),
+        })),
+    });
+    return { userId: created.id };
+}
+/**
+ * Ensure a user has the required role for an escalation.
+ * Called after claim when the atomic SQL returns null due to role mismatch.
+ * Only adds the role if `provisionIfAbsent` declares it and caller has authority.
+ */
+async function ensureRoleMembership(userId, requiredRole, callerUserId, provisionIfAbsent) {
+    if (!provisionIfAbsent)
+        return false;
+    const hasAuthority = await userService.hasGlobalEscalationAccess(callerUserId);
+    if (!hasAuthority)
+        return false;
+    // Check if the provision declares this role
+    const declaredRole = provisionIfAbsent.roles?.find((r) => r.role === requiredRole);
+    if (!declaredRole)
+        return false;
+    // Add the role — idempotent (ON CONFLICT DO NOTHING)
+    try {
+        await userService.addUserRole(userId, requiredRole, (declaredRole.type || 'member'));
+    }
+    catch { /* already has it */ }
+    return true;
 }
 function publishBulkClaimEvents(ids, assignedTo) {
     for (const id of ids) {

package/build/api/escalations/metadata.d.ts

@@ -1,3 +1,4 @@
+import { type ProvisionIfAbsent } from './helpers';
 import type { LTApiAuth, LTApiResult } from '../../types/sdk';
 /**
  * Find escalations by a metadata key-value pair.
@@ -25,12 +26,19 @@ export declare function claimByMetadata(input: {
     durationMinutes?: number;
     assignee?: string;
     metadata?: Record<string, any>;
+    provisionIfAbsent?: ProvisionIfAbsent;
 }, auth: LTApiAuth): Promise<LTApiResult>;
 /**
  * Resolve an escalation by metadata key-value pair.
  *
- * Single atomic CTE: find + claim + resolve in one query.
- * RBAC is enforced in the SQL WHERE clause.
+ * Single atomic query with signal guard:
+ * - No signal_id → claim + resolve atomically in SQL. One query. Done.
+ * - signal_id present → SQL returns the signal info without resolving.
+ *   Caller signals the workflow; conditionLT resolves durably inside
+ *   the workflow via ltResolveEscalation.
+ *
+ * Never does SELECT-then-UPDATE. The SQL CTE handles find + RBAC +
+ * claim + resolve (or signal detection) in one round-trip.
  */
 export declare function resolveByMetadata(input: {
     key: string;

package/build/api/escalations/metadata.js

@@ -76,7 +76,7 @@ async function claimByMetadata(input, auth) {
         if (!input.key || !input.value) {
             return { status: 400, error: 'key and value are required' };
         }
-        const resolved = await (0, helpers_1.resolveAssignee)(input.assignee, auth);
+        const resolved = await (0, helpers_1.resolveAssignee)(input.assignee, auth, input.provisionIfAbsent);
         if ('error' in resolved)
             return resolved.error;
         const claimUserId = resolved.userId;
@@ -99,8 +99,14 @@ async function claimByMetadata(input, auth) {
 /**
  * Resolve an escalation by metadata key-value pair.
  *
- * Single atomic CTE: find + claim + resolve in one query.
- * RBAC is enforced in the SQL WHERE clause.
+ * Single atomic query with signal guard:
+ * - No signal_id → claim + resolve atomically in SQL. One query. Done.
+ * - signal_id present → SQL returns the signal info without resolving.
+ *   Caller signals the workflow; conditionLT resolves durably inside
+ *   the workflow via ltResolveEscalation.
+ *
+ * Never does SELECT-then-UPDATE. The SQL CTE handles find + RBAC +
+ * claim + resolve (or signal detection) in one round-trip.
  */
 async function resolveByMetadata(input, auth) {
     try {
@@ -115,11 +121,25 @@ async function resolveByMetadata(input, auth) {
             return resolved.error;
         const resolveUserId = resolved.userId;
         const allowedRoles = await resolveAllowedRoles(auth.userId);
-        const escalation = await escalationService.resolveByMetadataAtomic(input.key, input.value, resolveUserId, input.resolverPayload, input.metadata, allowedRoles);
-        if (!escalation) {
+        const result = await escalationService.resolveByMetadataAtomic(input.key, input.value, resolveUserId, input.resolverPayload, input.metadata, allowedRoles);
+        if (result.outcome === 'not_found') {
             return { status: 404, error: 'No pending escalation found for this metadata, or insufficient role permissions' };
         }
-        return { status: 200, data: { escalation } };
+        if (result.outcome === 'resolved') {
+            return { status: 200, data: { escalation: result.escalation } };
+        }
+        // Signal-backed escalation — signal the workflow, conditionLT resolves durably
+        const { createClient } = await Promise.resolve().then(() => __importStar(require('../../workers')));
+        const client = createClient();
+        const handle = await client.workflow.getHandle(result.taskQueue, result.workflowType, result.workflowId);
+        await handle.signal(result.signalId, {
+            ...input.resolverPayload,
+            $escalation_id: result.escalationId,
+        });
+        return {
+            status: 200,
+            data: { signaled: true, escalationId: result.escalationId, workflowId: result.workflowId },
+        };
     }
     catch (err) {
         return { status: 500, error: err.message };
@@ -134,5 +154,8 @@ async function resolveAllowedRoles(userId) {
     if (await userService.hasGlobalEscalationAccess(userId))
         return null;
     const userRoles = await userService.getUserRoles(userId);
+    // Return the user's roles (may be empty → SQL filters out all rows).
+    // System/service accounts that need unrestricted access should be
+    // seeded with the superadmin role via start({ seed: { admin } }).
     return userRoles.map(r => r.role);
 }

package/build/api/exports.d.ts

@@ -15,6 +15,7 @@ import type { ExportMode } from '@hotmeshio/hotmesh/build/types/exporter';
  * @returns `{ status: 200, data: { jobs, total, ... } }` on success
  */
 export declare function listJobs(input: {
+    app_id: string;
     limit?: number;
     offset?: number;
     entity?: string;

package/build/api/exports.js

@@ -55,7 +55,7 @@ const resolve_1 = require("../services/task/resolve");
  */
 async function listJobs(input) {
     try {
-        const result = await exportService.listJobs(input);
+        const result = await exportService.listJobs(input.app_id, input);
         return { status: 200, data: result };
     }
     catch (err) {

package/build/api/maintenance.d.ts

@@ -17,6 +17,7 @@ export declare function getMaintenanceConfig(): LTApiResult;
  * @returns `{ status: 200, data: { config, restarted: true } }`
  */
 export declare function updateMaintenanceConfig(input: {
+    appId: string;
     schedule: string;
     rules: LTMaintenanceConfig['rules'];
 }): Promise<LTApiResult>;

package/build/api/maintenance.js

@@ -26,11 +26,11 @@ function getMaintenanceConfig() {
  */
 async function updateMaintenanceConfig(input) {
     try {
-        if (!input.schedule || !Array.isArray(input.rules)) {
-            return { status: 400, error: 'schedule (string) and rules (array) are required' };
+        if (!input.appId || !input.schedule || !Array.isArray(input.rules)) {
+            return { status: 400, error: 'appId (string), schedule (string), and rules (array) are required' };
         }
         await maintenance_1.maintenanceRegistry.disconnect();
-        maintenance_1.maintenanceRegistry.register({ schedule: input.schedule, rules: input.rules });
+        maintenance_1.maintenanceRegistry.register({ appId: input.appId, schedule: input.schedule, rules: input.rules });
         await maintenance_1.maintenanceRegistry.connect();
         return {
             status: 200,

package/build/api/workflows/discovery.js

@@ -41,6 +41,7 @@ const cron_1 = require("../../services/cron");
 const db_1 = require("../../lib/db");
 const registry_1 = require("../../services/workers/registry");
 const sql_1 = require("../../services/pipelines/sql");
+const hotmesh_utils_1 = require("../../services/hotmesh-utils");
 /**
  * List active workflow workers with their registration status.
  *
@@ -81,9 +82,11 @@ async function listDiscoveredWorkflows(input) {
     try {
         // 1. Active workers from in-memory registry
         const activeWorkers = (0, registry_1.getRegisteredWorkers)();
-        // 2. Historical entities from durable.jobs
+        // 2. Historical entities from jobs table
         const pool = (0, db_1.getPool)();
-        const { rows: entityRows } = await pool.query(sql_1.DISTINCT_ENTITIES_DURABLE);
+        // TODO: accept app_id parameter to avoid hardcoded schema
+        const schema = (0, hotmesh_utils_1.quoteSchema)((0, hotmesh_utils_1.sanitizeAppId)('durable'));
+        const { rows: entityRows } = await pool.query((0, sql_1.DISTINCT_ENTITIES)(schema));
         const historicalEntities = new Set(entityRows.map((r) => r.entity));
         // 3. Registered configs
         const configs = await configService.listWorkflowConfigs();

package/build/modules/auth.d.ts

@@ -55,7 +55,7 @@ export declare const requireAdmin: RequestHandler;
 /**
  * Middleware that requires builder access. Must be placed AFTER requireAuth.
  *
- * Builders are superadmin, admin, or users with the 'engineer' role.
+ * Builders are superadmin or users with the 'engineer' role.
  * This is the backend equivalent of the dashboard's `isBuilder` check.
  */
 export declare const requireBuilder: RequestHandler;

package/build/modules/auth.js

@@ -225,7 +225,7 @@ exports.requireAdmin = requireAdmin;
 /**
  * Middleware that requires builder access. Must be placed AFTER requireAuth.
  *
- * Builders are superadmin, admin, or users with the 'engineer' role.
+ * Builders are superadmin or users with the 'engineer' role.
  * This is the backend equivalent of the dashboard's `isBuilder` check.
  */
 const requireBuilder = async (req, res, next) => {
@@ -234,8 +234,8 @@ const requireBuilder = async (req, res, next) => {
             res.status(403).json({ error: 'Forbidden' });
             return;
         }
-        // Fast path: trust the JWT role claim for admin/superadmin
-        if (req.auth.role === 'admin' || req.auth.role === 'superadmin') {
+        // Fast path: trust the JWT role claim for superadmin
+        if (req.auth.role === 'superadmin') {
             next();
             return;
         }

package/build/modules/maintenance.js

@@ -18,6 +18,7 @@ exports.defaultMaintenanceConfig = void 0;
  * inputs from the execution timeline.
  */
 exports.defaultMaintenanceConfig = {
+    appId: 'durable',
     schedule: '0 2 * * 0',
     rules: [
         {

package/build/routes/controlplane.js

@@ -39,8 +39,8 @@ const api = __importStar(require("../api/controlplane"));
 const router = (0, express_1.Router)();
 /**
  * GET /api/controlplane/apps
- * List available HotMesh application IDs.
- * Admin-only.
+ * List available HotMesh application namespaces.
+ * Builder-only.
  */
 router.get('/apps', auth_1.requireBuilder, async (_req, res) => {
     const result = await api.listApps();
@@ -49,11 +49,16 @@ router.get('/apps', auth_1.requireBuilder, async (_req, res) => {
 /**
  * GET /api/controlplane/rollcall?app_id=durable&delay=1000
  * Execute a roll call — discovers all engines and workers.
- * Admin-only.
+ * Builder-only. app_id is required.
  */
 router.get('/rollcall', auth_1.requireBuilder, async (req, res) => {
+    const appId = req.query.app_id;
+    if (!appId) {
+        res.status(400).json({ error: 'app_id query parameter is required' });
+        return;
+    }
     const result = await api.rollCall({
-        appId: req.query.app_id || 'durable',
+        appId,
         delay: req.query.delay ? parseInt(req.query.delay, 10) : undefined,
     });
     res.status(result.status).json(result.data ?? { error: result.error });
@@ -61,27 +66,32 @@ router.get('/rollcall', auth_1.requireBuilder, async (req, res) => {
 /**
  * POST /api/controlplane/throttle
  * Apply a throttle command to the mesh.
- * Admin-only.
+ * Builder-only. appId is required in body.
  *
  * Body: { appId: string, throttle: number, topic?: string, guid?: string }
- *   throttle: ms delay (-1 = pause, 0 = resume, >0 = delay per msg)
  */
 router.post('/throttle', auth_1.requireBuilder, async (req, res) => {
-    const { appId = 'durable', throttle, topic, guid, scope } = req.body;
+    const { appId, throttle, topic, guid, scope } = req.body;
+    if (!appId) {
+        res.status(400).json({ error: 'appId is required' });
+        return;
+    }
     const result = await api.applyThrottle({ appId, throttle, topic, guid, scope });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**
- * GET /api/controlplane/streams?app_id=durable&duration=1h&stream=hmsh:durable:x:
- * Stream processing statistics — pending count + processed volume by time range.
- * Admin-only.
- *
- * duration: 15m | 30m | 1h | 1d | 7d (default: 1h)
- * stream: optional stream_name filter (specific task queue topic)
+ * GET /api/controlplane/streams?app_id=durable&duration=1h
+ * Stream processing statistics.
+ * Builder-only. app_id is required.
  */
 router.get('/streams', auth_1.requireBuilder, async (req, res) => {
+    const app_id = req.query.app_id;
+    if (!app_id) {
+        res.status(400).json({ error: 'app_id query parameter is required' });
+        return;
+    }
     const result = await api.getStreamStats({
-        app_id: req.query.app_id || 'durable',
+        app_id,
         duration: req.query.duration || '1h',
         stream: req.query.stream || undefined,
     });
@@ -89,18 +99,19 @@ router.get('/streams', auth_1.requireBuilder, async (req, res) => {
 });
 /**
  * GET /api/controlplane/stream-messages?namespace=durable&source=worker
- *     &limit=25&offset=0&sort_by=created_at&order=desc
- *     &status=pending&stream_name=hmsh:durable:w:&msg_type=WORKER
- *
  * Browse stream messages with pagination, filtering, and sorting.
- * Both namespace and source are required — engine and worker streams
- * are separate tables with different schemas.
- * Admin-only.
+ * Builder-only. namespace and source are required.
  */
 router.get('/stream-messages', auth_1.requireBuilder, async (req, res) => {
+    const namespace = req.query.namespace;
+    const source = req.query.source;
+    if (!namespace || !source) {
+        res.status(400).json({ error: 'namespace and source query parameters are required' });
+        return;
+    }
     const result = await api.listStreamMessages({
-        namespace: req.query.namespace,
-        source: req.query.source,
+        namespace,
+        source,
         limit: req.query.limit ? parseInt(req.query.limit, 10) : undefined,
         offset: req.query.offset ? parseInt(req.query.offset, 10) : undefined,
         sort_by: req.query.sort_by || undefined,
@@ -117,15 +128,15 @@ router.get('/stream-messages', auth_1.requireBuilder, async (req, res) => {
 });
 /**
  * POST /api/controlplane/subscribe
- * Start the quorum→NATS bridge for an appId.
- * Subscribes to the HotMesh quorum channel and republishes
- * all control plane messages to NATS on `lt.mesh.*` topics.
- * Admin-only.
- *
- * Body: { appId: string }
+ * Start the quorum→NATS bridge for a namespace.
+ * Builder-only. appId is required in body.
  */
 router.post('/subscribe', auth_1.requireBuilder, async (req, res) => {
-    const { appId = 'durable' } = req.body;
+    const { appId } = req.body;
+    if (!appId) {
+        res.status(400).json({ error: 'appId is required' });
+        return;
+    }
     const result = await api.subscribeMesh({ appId });
     res.status(result.status).json(result.data ?? { error: result.error });
 });

package/build/routes/dba.js

@@ -53,7 +53,13 @@ const router = (0, express_1.Router)();
  * Returns: { jobs, streams, attributes, transient, marked }
  */
 router.post('/prune', auth_1.requireAdmin, async (req, res) => {
+    const appId = req.body.app_id;
+    if (!appId) {
+        res.status(400).json({ error: 'app_id is required' });
+        return;
+    }
     const result = await api.prune({
+        appId,
         expire: req.body.expire,
         jobs: req.body.jobs,
         streams: req.body.streams,
@@ -73,8 +79,13 @@ router.post('/prune', auth_1.requireAdmin, async (req, res) => {
  * Deploy the server-side prune function and run migrations.
  * Idempotent — safe to call on startup or from CI/CD.
  */
-router.post('/deploy', auth_1.requireAdmin, async (_req, res) => {
-    const result = await api.deploy();
+router.post('/deploy', auth_1.requireAdmin, async (req, res) => {
+    const appId = req.body.app_id;
+    if (!appId) {
+        res.status(400).json({ error: 'app_id is required' });
+        return;
+    }
+    const result = await api.deploy(appId);
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 exports.default = router;

package/build/routes/escalations/metadata.js

@@ -58,7 +58,7 @@ function registerMetadataRoutes(router) {
     /**
      * POST /api/escalations/claim-by-metadata
      * Find and claim an escalation by metadata key-value pair.
-     * Body: { key, value, durationMinutes?, assignee?, metadata? }
+     * Body: { key, value, durationMinutes?, assignee?, metadata?, provisionIfAbsent? }
      */
     router.post('/claim-by-metadata', async (req, res) => {
         const result = await api.claimByMetadata({
@@ -67,6 +67,7 @@ function registerMetadataRoutes(router) {
             durationMinutes: req.body?.durationMinutes,
             assignee: req.body?.assignee,
             metadata: req.body?.metadata,
+            provisionIfAbsent: req.body?.provisionIfAbsent,
         }, req.auth);
         res.status(result.status).json(result.data ?? { error: result.error });
     });

package/build/routes/escalations/single.js

@@ -71,7 +71,7 @@ function registerSingleRoutes(router) {
      * Body: { durationMinutes?: number }
      */
     router.post('/:id/claim', async (req, res) => {
-        const result = await api.claimEscalation({ id: req.params.id, durationMinutes: req.body?.durationMinutes }, req.auth);
+        const result = await api.claimEscalation({ id: req.params.id, durationMinutes: req.body?.durationMinutes, provisionIfAbsent: req.body?.provisionIfAbsent }, req.auth);
         res.status(result.status).json(result.data ?? { error: result.error });
     });
     /**

package/build/routes/exports.js

@@ -41,7 +41,13 @@ const router = (0, express_1.Router)();
  * List workflow jobs with optional filtering and pagination.
  */
 router.get('/jobs', async (req, res) => {
+    const app_id = (req.query.app_id || req.query.namespace);
+    if (!app_id) {
+        res.status(400).json({ error: 'app_id (or namespace) query parameter is required' });
+        return;
+    }
     const result = await api.listJobs({
+        app_id,
         limit: parseInt(req.query.limit) || undefined,
         offset: parseInt(req.query.offset) || undefined,
         entity: req.query.entity || undefined,

package/build/routes/maintenance.js

@@ -54,6 +54,7 @@ router.get('/', (_req, res) => {
  */
 router.put('/', auth_1.requireAdmin, async (req, res) => {
     const result = await api.updateMaintenanceConfig({
+        appId: req.body?.appId ?? req.body?.app_id,
         schedule: req.body?.schedule,
         rules: req.body?.rules,
     });

package/build/sdk/index.d.ts

@@ -121,6 +121,7 @@ export declare function createClient(options?: LTClientOptions): {
         claim: (input: {
             id: string;
             durationMinutes?: number;
+            provisionIfAbsent?: import("../api/escalations/helpers").ProvisionIfAbsent;
         }, auth?: LTApiAuth) => Promise<LTApiResult<any>>;
         release: (input: {
             id: string;
@@ -164,6 +165,7 @@ export declare function createClient(options?: LTClientOptions): {
             durationMinutes?: number;
             assignee?: string;
             metadata?: Record<string, any>;
+            provisionIfAbsent?: import("../api/escalations/helpers").ProvisionIfAbsent;
         }, auth?: LTApiAuth) => Promise<LTApiResult<any>>;
         resolveByMetadata: (input: {
             key: string;