@hotmeshio/long-tail 0.5.11 → 0.6.0

package/build/services/escalation/sql.js

@@ -11,7 +11,8 @@
 // `hmsh_escalations` here rather than composed from generic SDK calls.
 // ---------------------------------------------------------------------------
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.RESOLVE_BY_METADATA_ATOMIC = exports.RELEASE_EXPIRED_CLAIMS = void 0;
+exports.RESOLVE_BY_METADATA_ATOMIC = exports.COUNT_SEARCH_ESCALATIONS = exports.RELEASE_EXPIRED_CLAIMS = void 0;
+exports.searchEscalationsQuery = searchEscalationsQuery;
 /**
  * Sweep expired claims back to the available pool.
  *
@@ -31,6 +32,72 @@ SET assigned_to = NULL,
 WHERE status = 'pending'
   AND assigned_to IS NOT NULL
   AND assigned_until <= NOW()`;
+/**
+ * Free-text escalation search.
+ *
+ * The SDK's `client.list()` filters by structured columns only — it has no
+ * free-text predicate. Long-tail's contract needs a search box that matches a
+ * correlation key (order id, ticket id) or any visible field across the WHOLE
+ * result set, not just the current page. That is server-side SQL here (over the
+ * `lt_escalations` view, which adds the computed `available` flag), following the
+ * same raw-SQL-on-the-shared-table pattern as the atomic resolve below — so the
+ * filter flows SQL→service→API→route→dashboard rather than being faked client-side.
+ *
+ * All structured filters are optional and combine with the search term (AND).
+ * `metadata::text ILIKE` scans the JSONB as text (the GIN index is containment-only
+ * and cannot serve ILIKE) — bounded in practice by the other filters and the page.
+ *
+ * Role-scope visibility ($3 allRoles, $10 selfRoles, $11 meUserId):
+ *   - global access  → $3 NULL and $10 NULL → no role filter (sees everything)
+ *   - read_all roles → row.role ∈ $3
+ *   - read_self roles → row.role ∈ $10 AND row.assigned_to = $11 (only the user's own)
+ * The branches union, so a user with mixed scope (read_all on some roles, read_self
+ * on others) is filtered correctly in one pass. `assigned_to` is indexed
+ * (idx_lt_escalations_assigned), so the self-branch is index-served at scale.
+ *
+ * $1 status, $2 role, $3 allRoles (text[]), $4 type, $5 subtype, $6 priority,
+ * $7 assigned_to, $8 available (bool), $9 search, $10 selfRoles (text[]),
+ * $11 meUserId, $12 metadata (jsonb containment, GIN-served). The list query
+ * adds $13 limit, $14 offset.
+ *
+ * `metadata @> $12` is exact JSONB containment (the GIN index serves it) — this is
+ * how findByMetadata routes through the scoped query so its role-scope filter and
+ * count run in SQL (no client-side filtering), the same as free-text/self-scope.
+ */
+const SEARCH_ESCALATIONS_WHERE = `\
+  FROM public.lt_escalations
+  WHERE ($1::text IS NULL OR status = $1)
+    AND ($2::text IS NULL OR role = $2)
+    AND (
+         ($3::text[] IS NULL AND $10::text[] IS NULL)
+      OR ($3::text[] IS NOT NULL AND role = ANY($3))
+      OR ($10::text[] IS NOT NULL AND role = ANY($10) AND assigned_to = $11)
+    )
+    AND ($4::text IS NULL OR type = $4)
+    AND ($5::text IS NULL OR subtype = $5)
+    AND ($6::int IS NULL OR priority = $6)
+    AND ($7::text IS NULL OR assigned_to = $7)
+    AND ($8::boolean IS NULL OR available = $8)
+    AND ($12::jsonb IS NULL OR metadata @> $12)
+    AND ($9::text IS NULL OR (
+          description ILIKE '%' || $9 || '%'
+       OR type ILIKE '%' || $9 || '%'
+       OR subtype ILIKE '%' || $9 || '%'
+       OR role ILIKE '%' || $9 || '%'
+       OR workflow_id ILIKE '%' || $9 || '%'
+       OR origin_id ILIKE '%' || $9 || '%'
+       OR id::text ILIKE '%' || $9 || '%'
+       OR metadata::text ILIKE '%' || $9 || '%'
+    ))`;
+/** Count matching the search WHERE (params $1–$12). */
+exports.COUNT_SEARCH_ESCALATIONS = `SELECT COUNT(*)::int AS total\n${SEARCH_ESCALATIONS_WHERE}`;
+/**
+ * Build the search SELECT. `orderBy` is composed from a whitelist by the caller
+ * (never raw user input), so it is safe to interpolate; everything else is bound.
+ */
+function searchEscalationsQuery(orderBy) {
+    return `SELECT *\n${SEARCH_ESCALATIONS_WHERE}\n  ORDER BY ${orderBy}\n  LIMIT $13 OFFSET $14`;
+}
 /**
  * Atomic resolve by metadata with signal guard.
  *
@@ -51,7 +118,13 @@ WHERE status = 'pending'
  * The `resolved` CTE still skips signal_id rows — the workflow resolves durably.
  *
  * $1 = metadata filter (jsonb), $2 = userId, $3 = resolver_payload (jsonb),
- * $4 = metadata patch (jsonb, nullable), $5 = allowed roles (text[], null = no filter)
+ * $4 = metadata patch (jsonb, nullable), $5 = write_all roles (text[], null = global /
+ * no filter), $6 = write_self roles (text[], nullable).
+ *
+ * Write-scope is folded into the same FOR UPDATE statement (no TOCTOU): the row
+ * is resolvable if the caller has global access ($5 NULL), or the row's role is in
+ * their write_all set, or the row's role is in their write_self set AND it is
+ * already assigned to them ($2). assigned_to is indexed, so the self-branch scales.
  */
 exports.RESOLVE_BY_METADATA_ATOMIC = `\
 WITH target AS MATERIALIZED (
@@ -59,7 +132,11 @@ WITH target AS MATERIALIZED (
   FROM public.hmsh_escalations
   WHERE metadata @> $1::jsonb
     AND status = 'pending'
-    AND ($5::text[] IS NULL OR role = ANY($5))
+    AND (
+         $5::text[] IS NULL
+      OR role = ANY($5)
+      OR (role = ANY($6::text[]) AND assigned_to = $2)
+    )
   ORDER BY priority ASC, created_at ASC
   LIMIT 1
   FOR UPDATE

package/build/services/interceptor/activities/escalation.d.ts

@@ -8,6 +8,8 @@
 export declare function ltResolveEscalation(input: {
     escalationId: string;
     resolverPayload: Record<string, any>;
+    /** Outcome patch merged into the row inside the same atomic resolve (see resolveEscalation). */
+    metadata?: Record<string, any>;
 }): Promise<void>;
 /**
  * Claim an escalation to a specific user. Used for auto-assignment

package/build/services/interceptor/activities/escalation.js

@@ -47,7 +47,7 @@ const logger_1 = require("../../../lib/logger");
  * retries this activity.
  */
 async function ltResolveEscalation(input) {
-    const result = await escalationService.resolveEscalation(input.escalationId, input.resolverPayload);
+    const result = await escalationService.resolveEscalation(input.escalationId, input.resolverPayload, input.metadata);
     if (!result) {
         logger_1.loggerRegistry.warn(`[ltResolveEscalation] Escalation ${input.escalationId} already resolved or not found`);
     }

package/build/services/interceptor/lifecycle.js

@@ -53,9 +53,13 @@ async function resolveReRun(activities, envelope, existingTask, wf, taskQueue) {
     const escalationId = envelope?.lt?.escalationId;
     const isRealEscalation = isReRun && escalationId && !escalationId.startsWith('auto-triage-');
     if (isRealEscalation) {
+        // Thread the outcome patch carried on the re-run envelope so it merges into the
+        // prior escalation's metadata inside this SAME atomic resolve — never a separate
+        // write. (resolve orchestrator Path E sets envelope.lt.escalationMetadata.)
         await activities.ltResolveEscalation({
             escalationId: escalationId,
             resolverPayload: envelope.resolver,
+            metadata: envelope.lt?.escalationMetadata,
         });
         // escalation.resolved event published by service layer (services/escalation/crud.ts)
     }

package/build/services/mcp/server-tools.js

@@ -54,14 +54,20 @@ const getAvailableWorkSchema = zod_1.z.object({
     role: zod_1.z.string().describe('Role to filter by'),
     limit: zod_1.z.number().optional().default(10).describe('Max results to return'),
 });
+/** Outcome facets merged onto the row on resolve — see the field describe(). */
+const outcomeMetadata = zod_1.z.record(zod_1.z.any()).optional().describe('Outcome facets to merge into the escalation\'s metadata on resolve — the durable, ' +
+    'queryable record of what happened (disposition, reviewer, timing). Distinct from ' +
+    'payload, which resumes the waiting workflow and is not indexed.');
 const claimAndResolveSchema = zod_1.z.object({
     escalation_id: zod_1.z.string().describe('The escalation ID to claim and resolve'),
     resolver_id: zod_1.z.string().describe('Identifier for who/what is resolving'),
     payload: zod_1.z.record(zod_1.z.any()).describe('Resolution payload data'),
+    metadata: outcomeMetadata,
 });
 const resolveEscalationSchema = zod_1.z.object({
     escalation_id: zod_1.z.string().describe('The escalation ID to resolve'),
     payload: zod_1.z.record(zod_1.z.any()).describe('Resolution payload data'),
+    metadata: outcomeMetadata,
 });
 const escalateAndWaitSchema = zod_1.z.object({
     role: zod_1.z.string().describe('Target role for the escalation (e.g., "reviewer")'),
@@ -176,7 +182,7 @@ function registerHumanQueueTools(server) {
     // ── claim_and_resolve ───────────────────────────────────────────────
     server.registerTool('claim_and_resolve', {
         title: 'Claim and Resolve',
-        description: 'Claim an escalation and immediately resolve it with a payload. Atomic operation.',
+        description: 'Claim an escalation and immediately resolve it with a payload. Atomic operation. Optionally pass `metadata` to record the outcome (disposition, timing) onto the row for the audit trail.',
         inputSchema: claimAndResolveSchema,
     }, async (args) => {
         const claimed = await escalationService.claimEscalation(args.escalation_id, args.resolver_id, 5);
@@ -189,7 +195,7 @@ function registerHumanQueueTools(server) {
                 isError: true,
             };
         }
-        const resolved = await escalationService.resolveEscalation(args.escalation_id, args.payload);
+        const resolved = await escalationService.resolveEscalation(args.escalation_id, args.payload, args.metadata);
         if (!resolved) {
             return {
                 content: [{
@@ -213,10 +219,10 @@ function registerHumanQueueTools(server) {
     // ── resolve_escalation ──────────────────────────────────────────────
     server.registerTool('resolve_escalation', {
         title: 'Resolve Escalation',
-        description: 'Resolve an already-claimed escalation with a payload. Use when the claim happened externally (e.g. via API).',
+        description: 'Resolve an already-claimed escalation with a payload. Use when the claim happened externally (e.g. via API). Optionally pass `metadata` to record the outcome (disposition, timing) onto the row for the audit trail.',
         inputSchema: resolveEscalationSchema,
     }, async (args) => {
-        const resolved = await escalationService.resolveEscalation(args.escalation_id, args.payload);
+        const resolved = await escalationService.resolveEscalation(args.escalation_id, args.payload, args.metadata);
         if (!resolved) {
             return {
                 content: [{

package/build/services/orchestrator/condition.js

@@ -87,11 +87,15 @@ async function conditionLT(signalId, escalation) {
             taskQueue: LT_ACTIVITY_QUEUE,
             retry: { maximumAttempts: 3 },
         });
-        // Strip $escalation_id before passing as resolver payload
-        const { $escalation_id: _, ...resolverPayload } = raw;
+        // Strip the injected control keys ($escalation_id, $escalation_metadata) before the
+        // payload is returned to the caller. The outcome patch ($escalation_metadata, set by
+        // the resolve orchestrator's signal paths) rides INTO the single atomic resolve below
+        // so it merges in the same guarded UPDATE — never a separate write.
+        const { $escalation_id: _id, $escalation_metadata: metadata, ...resolverPayload } = raw;
         await ltResolveEscalation({
             escalationId,
             resolverPayload: resolverPayload,
+            metadata: metadata,
         });
         return resolverPayload;
     }

package/build/services/role/index.js

@@ -34,9 +34,8 @@ async function getAllEscalationChains() {
  */
 async function addEscalationChain(sourceRole, targetRole) {
     const pool = (0, db_1.getPool)();
-    await pool.query(sql_1.ENSURE_ROLE_EXISTS, [sourceRole]);
-    await pool.query(sql_1.ENSURE_ROLE_EXISTS, [targetRole]);
-    await pool.query(sql_1.INSERT_ESCALATION_CHAIN, [sourceRole, targetRole]);
+    // One atomic statement: ensure both role FK targets + insert the chain link.
+    await pool.query(sql_1.ADD_ESCALATION_CHAIN, [sourceRole, targetRole]);
 }
 /**
  * Remove a single escalation chain entry.

package/build/services/role/sql.d.ts

@@ -1,6 +1,14 @@
 export declare const GET_ESCALATION_TARGETS = "\n  SELECT target_role\n  FROM lt_config_role_escalations\n  WHERE source_role = $1\n  ORDER BY target_role";
 export declare const GET_ALL_ESCALATION_CHAINS = "\n  SELECT source_role, target_role\n  FROM lt_config_role_escalations\n  ORDER BY source_role, target_role";
 export declare const INSERT_ESCALATION_CHAIN = "\n  INSERT INTO lt_config_role_escalations (source_role, target_role)\n  VALUES ($1, $2)\n  ON CONFLICT DO NOTHING";
+/**
+ * Add an escalation chain in ONE atomic statement: ensure both role FK targets
+ * exist, then insert the source→target link. Postgres checks the chain's FK to
+ * lt_roles at statement end (after the sibling ensure CTEs run), so brand-new
+ * roles are valid targets. Replaces the former ensure+ensure+insert three-call
+ * saga, which had no transaction guarding the writes together.
+ */
+export declare const ADD_ESCALATION_CHAIN = "\n  WITH ensured_source AS (\n    INSERT INTO lt_roles (role) VALUES ($1) ON CONFLICT DO NOTHING\n  ), ensured_target AS (\n    INSERT INTO lt_roles (role) VALUES ($2) ON CONFLICT DO NOTHING\n  )\n  INSERT INTO lt_config_role_escalations (source_role, target_role)\n  VALUES ($1, $2)\n  ON CONFLICT DO NOTHING";
 export declare const DELETE_ESCALATION_CHAIN = "\n  DELETE FROM lt_config_role_escalations\n  WHERE source_role = $1 AND target_role = $2";
 export declare const DELETE_ESCALATION_CHAINS_BY_SOURCE = "\n  DELETE FROM lt_config_role_escalations\n  WHERE source_role = $1";
 export declare const CHECK_ESCALATION_CHAIN_EXISTS = "\n  SELECT 1\n  FROM lt_config_role_escalations\n  WHERE source_role = $1 AND target_role = $2";

package/build/services/role/sql.js

@@ -1,7 +1,7 @@
 "use strict";
 // ─── Escalation chain queries ───────────────────────────────────────────────
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.COUNT_ACTIVE_ESCALATION_REFS = exports.COUNT_WORKFLOW_REFS = exports.COUNT_CHAIN_REFS = exports.COUNT_USER_ROLE_REFS = exports.LIST_ROLES_WITH_DETAILS = exports.DELETE_ROLE = exports.LIST_ROLES = exports.ENSURE_ROLE_EXISTS = exports.CHECK_ESCALATION_CHAIN_EXISTS = exports.DELETE_ESCALATION_CHAINS_BY_SOURCE = exports.DELETE_ESCALATION_CHAIN = exports.INSERT_ESCALATION_CHAIN = exports.GET_ALL_ESCALATION_CHAINS = exports.GET_ESCALATION_TARGETS = void 0;
+exports.COUNT_ACTIVE_ESCALATION_REFS = exports.COUNT_WORKFLOW_REFS = exports.COUNT_CHAIN_REFS = exports.COUNT_USER_ROLE_REFS = exports.LIST_ROLES_WITH_DETAILS = exports.DELETE_ROLE = exports.LIST_ROLES = exports.ENSURE_ROLE_EXISTS = exports.CHECK_ESCALATION_CHAIN_EXISTS = exports.DELETE_ESCALATION_CHAINS_BY_SOURCE = exports.DELETE_ESCALATION_CHAIN = exports.ADD_ESCALATION_CHAIN = exports.INSERT_ESCALATION_CHAIN = exports.GET_ALL_ESCALATION_CHAINS = exports.GET_ESCALATION_TARGETS = void 0;
 exports.GET_ESCALATION_TARGETS = `
   SELECT target_role
   FROM lt_config_role_escalations
@@ -15,6 +15,22 @@ exports.INSERT_ESCALATION_CHAIN = `
   INSERT INTO lt_config_role_escalations (source_role, target_role)
   VALUES ($1, $2)
   ON CONFLICT DO NOTHING`;
+/**
+ * Add an escalation chain in ONE atomic statement: ensure both role FK targets
+ * exist, then insert the source→target link. Postgres checks the chain's FK to
+ * lt_roles at statement end (after the sibling ensure CTEs run), so brand-new
+ * roles are valid targets. Replaces the former ensure+ensure+insert three-call
+ * saga, which had no transaction guarding the writes together.
+ */
+exports.ADD_ESCALATION_CHAIN = `
+  WITH ensured_source AS (
+    INSERT INTO lt_roles (role) VALUES ($1) ON CONFLICT DO NOTHING
+  ), ensured_target AS (
+    INSERT INTO lt_roles (role) VALUES ($2) ON CONFLICT DO NOTHING
+  )
+  INSERT INTO lt_config_role_escalations (source_role, target_role)
+  VALUES ($1, $2)
+  ON CONFLICT DO NOTHING`;
 exports.DELETE_ESCALATION_CHAIN = `
   DELETE FROM lt_config_role_escalations
   WHERE source_role = $1 AND target_role = $2`;

package/build/services/task/crud.js

@@ -31,17 +31,25 @@ async function createTask(input) {
         input.executing_as || null,
         input.status || null,
     ]);
-    const task = rows[0];
-    (0, publish_1.publishTaskEvent)({
-        type: 'task.created',
-        source: 'service',
-        workflowId: task.workflow_id || '',
-        workflowName: task.workflow_type || '',
-        taskQueue: task.task_queue || '',
-        taskId: task.id,
-        originId: task.origin_id || undefined,
-        status: task.status || 'pending',
-    });
+    // ON CONFLICT (workflow_id) makes this idempotent: a retried proxyActivity or
+    // re-driven saga re-targets the same row. `_inserted` (xmax = 0) is true only
+    // when this call actually inserted, so the created event fires exactly once.
+    const row = rows[0];
+    const inserted = row._inserted === true;
+    delete row._inserted;
+    const task = row;
+    if (inserted) {
+        (0, publish_1.publishTaskEvent)({
+            type: 'task.created',
+            source: 'service',
+            workflowId: task.workflow_id || '',
+            workflowName: task.workflow_type || '',
+            taskQueue: task.task_queue || '',
+            taskId: task.id,
+            originId: task.origin_id || undefined,
+            status: task.status || 'pending',
+        });
+    }
     return task;
 }
 async function updateTask(id, input) {
@@ -70,7 +78,7 @@ async function updateTask(id, input) {
         values.push(JSON.stringify(input.milestones));
     }
     values.push(id);
-    const { rows } = await pool.query(`UPDATE lt_tasks SET ${sets.join(', ')} WHERE id = $${idx} RETURNING *`, values);
+    const { rows } = await pool.query((0, sql_1.updateTaskById)(sets.join(', '), idx), values);
     const task = rows[0];
     // Publish status-driven events from the single write path
     if (input.status && task) {
@@ -148,8 +156,8 @@ async function listTasks(filters) {
     const limit = filters.limit || 50;
     const offset = filters.offset || 0;
     const [countResult, dataResult] = await Promise.all([
-        pool.query(`SELECT COUNT(*) FROM lt_tasks ${where}`, values),
-        pool.query(`SELECT * FROM lt_tasks ${where} ORDER BY created_at DESC LIMIT $${idx++} OFFSET $${idx++}`, [...values, limit, offset]),
+        pool.query((0, sql_1.listTasksCount)(where), values),
+        pool.query((0, sql_1.listTasksData)(where, idx++, idx++), [...values, limit, offset]),
     ]);
     return {
         tasks: dataResult.rows,

package/build/services/task/process.js

@@ -44,27 +44,9 @@ async function listProcesses(filters) {
         having = `HAVING COUNT(*) > COUNT(*) FILTER (WHERE status = 'completed')
               AND COUNT(*) FILTER (WHERE status = 'needs_intervention') = 0`;
     }
-    // Count query — wrap in subquery because of HAVING
-    const countSql = having
-        ? `SELECT COUNT(*) FROM (
-         SELECT origin_id FROM lt_tasks ${where}
-         GROUP BY origin_id ${having}
-       ) sub`
-        : `SELECT COUNT(DISTINCT origin_id) FROM lt_tasks ${where}`;
-    const dataSql = `SELECT
-       origin_id,
-       COUNT(*)::int AS task_count,
-       COUNT(*) FILTER (WHERE status = 'completed')::int AS completed,
-       COUNT(*) FILTER (WHERE status = 'needs_intervention')::int AS escalated,
-       array_agg(DISTINCT workflow_type) AS workflow_types,
-       MIN(created_at) AS started_at,
-       MAX(COALESCE(completed_at, created_at)) AS last_activity
-     FROM lt_tasks
-     ${where}
-     GROUP BY origin_id
-     ${having}
-     ORDER BY MAX(created_at) DESC
-     LIMIT $${idx++} OFFSET $${idx++}`;
+    // Count wraps the grouped set in a subquery when a status HAVING filter is present.
+    const countSql = (0, sql_1.listProcessesCount)(where, having);
+    const dataSql = (0, sql_1.listProcessesData)(where, having, idx++, idx++);
     const dataParams = [...filterParams, limit, offset];
     const [countResult, dataResult] = await Promise.all([
         pool.query(countSql, filterParams),

package/build/services/task/resolve.d.ts

@@ -4,9 +4,11 @@ import type { ResolvedHandle } from './types';
  * HotMesh needs to get a workflow handle.
  *
  * 1. Look up lt_tasks by workflow_id — returns workflow_type and task_queue.
- * 2. If no task record (e.g., orchestrators/containers), fall back to
- *    durable.jobs (entity) + lt_config_workflows (task_queue).
+ * 2. If no task record (e.g., orchestrators/containers, or a child running in
+ *    another app), fall back to `<appId>.jobs` (entity) + lt_config_workflows
+ *    (task_queue). `appId` selects the HotMesh namespace to scan — children of
+ *    a workflow live under their own app's schema, not always `durable`.
  * 3. If task_queue is null (pre-migration record), fall back to lt_config_workflows.
  * 4. Throws if the workflow cannot be resolved.
  */
-export declare function resolveWorkflowHandle(workflowId: string): Promise<ResolvedHandle>;
+export declare function resolveWorkflowHandle(workflowId: string, appId?: string): Promise<ResolvedHandle>;

package/build/services/task/resolve.js

@@ -9,12 +9,14 @@ const sql_1 = require("./sql");
  * HotMesh needs to get a workflow handle.
  *
  * 1. Look up lt_tasks by workflow_id — returns workflow_type and task_queue.
- * 2. If no task record (e.g., orchestrators/containers), fall back to
- *    durable.jobs (entity) + lt_config_workflows (task_queue).
+ * 2. If no task record (e.g., orchestrators/containers, or a child running in
+ *    another app), fall back to `<appId>.jobs` (entity) + lt_config_workflows
+ *    (task_queue). `appId` selects the HotMesh namespace to scan — children of
+ *    a workflow live under their own app's schema, not always `durable`.
  * 3. If task_queue is null (pre-migration record), fall back to lt_config_workflows.
  * 4. Throws if the workflow cannot be resolved.
  */
-async function resolveWorkflowHandle(workflowId) {
+async function resolveWorkflowHandle(workflowId, appId = 'durable') {
     const pool = (0, db_1.getPool)();
     // 1. Try lt_tasks first (leaf workflows)
     const { rows } = await pool.query(sql_1.RESOLVE_TASK_BY_WORKFLOW_ID, [workflowId]);
@@ -29,9 +31,10 @@ async function resolveWorkflowHandle(workflowId) {
             return { taskQueue: configRows[0].task_queue, workflowName: workflow_type };
         }
     }
-    // 2. Fall back to durable.jobs — handles orchestrators/containers that
-    //    have no lt_tasks record but do have a job with an entity tag.
-    const { rows: jobRows } = await pool.query(sql_1.RESOLVE_JOB_ENTITY, [`hmsh:durable:j:${workflowId}`]);
+    // 2. Fall back to <appId>.jobs — handles orchestrators/containers that
+    //    have no lt_tasks record but do have a job with an entity tag, and
+    //    children running in a non-default namespace.
+    const { rows: jobRows } = await pool.query((0, sql_1.RESOLVE_JOB_ENTITY)(appId), [`hmsh:${appId}:j:${workflowId}`]);
     if (jobRows.length > 0 && jobRows[0].entity) {
         const entity = jobRows[0].entity;
         // 2a. Try lt_config_workflows for task_queue

package/build/services/task/sql.d.ts

@@ -1,12 +1,40 @@
-export declare const CREATE_TASK = "\n  INSERT INTO lt_tasks\n    (workflow_id, workflow_type, lt_type, task_queue, signal_id,\n     parent_workflow_id, origin_id, parent_id, envelope, metadata, priority,\n     trace_id, span_id, initiated_by, principal_type, executing_as, status)\n  VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, COALESCE($17, 'pending'))\n  RETURNING *";
+export declare const CREATE_TASK = "\n  INSERT INTO lt_tasks\n    (workflow_id, workflow_type, lt_type, task_queue, signal_id,\n     parent_workflow_id, origin_id, parent_id, envelope, metadata, priority,\n     trace_id, span_id, initiated_by, principal_type, executing_as, status)\n  VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, COALESCE($17, 'pending'))\n  ON CONFLICT (workflow_id) DO UPDATE SET workflow_id = lt_tasks.workflow_id\n  RETURNING *, (xmax = 0) AS _inserted";
 export declare const APPEND_MILESTONES = "\n  UPDATE lt_tasks\n  SET milestones = milestones || $1::jsonb\n  WHERE id = $2\n  RETURNING *";
 export declare const GET_TASK = "SELECT * FROM lt_tasks WHERE id = $1";
 export declare const GET_TASK_BY_SIGNAL_ID = "SELECT * FROM lt_tasks WHERE signal_id = $1";
 export declare const GET_TASK_BY_WORKFLOW_ID = "SELECT * FROM lt_tasks WHERE workflow_id = $1 ORDER BY created_at DESC LIMIT 1";
+/**
+ * Build the partial-update statement for updateTask. The caller assembles the
+ * `SET` clause from whichever fields are present (each as a `$n` placeholder) and
+ * passes the placeholder index of the trailing `id` bind. One guarded UPDATE by
+ * primary key — no read-then-write.
+ */
+export declare function updateTaskById(setClause: string, idIdx: number): string;
+/** Count query for listTasks. `where` is the caller-built `WHERE …` clause (or ''). */
+export declare function listTasksCount(where: string): string;
+/** Page query for listTasks. limit/offset placeholder indices follow the filter binds. */
+export declare function listTasksData(where: string, limitIdx: number, offsetIdx: number): string;
 export declare const RESOLVE_TASK_BY_WORKFLOW_ID = "SELECT workflow_type, task_queue FROM lt_tasks WHERE workflow_id = $1 ORDER BY created_at DESC LIMIT 1";
 export declare const RESOLVE_CONFIG_TASK_QUEUE = "SELECT task_queue FROM lt_config_workflows WHERE workflow_type = $1";
-export declare const RESOLVE_JOB_ENTITY = "SELECT entity FROM durable.jobs WHERE key = $1 LIMIT 1";
+/**
+ * Look up a job's entity tag in a specific HotMesh namespace. The namespace is a
+ * Postgres schema name, so it is interpolated (not a bind param) — same pattern
+ * as the diagnostics queries. Callers pass the trusted app_id from config.
+ */
+export declare const RESOLVE_JOB_ENTITY: (appId: string) => string;
 export declare const GET_PROCESS_TASKS = "SELECT * FROM lt_tasks WHERE origin_id = $1 ORDER BY created_at ASC";
+/**
+ * Count query for listProcesses. `where` restricts which origin_ids are in scope;
+ * `having` (empty string when no status filter) aggregates per-origin counts, so the
+ * count must wrap the grouped set in a subquery. Both fragments carry only `$n` binds.
+ */
+export declare function listProcessesCount(where: string, having: string): string;
+/**
+ * Page query for listProcesses — one row per origin_id with rolled-up task counts,
+ * workflow types, and activity window. limit/offset placeholder indices follow the
+ * filter binds.
+ */
+export declare function listProcessesData(where: string, having: string, limitIdx: number, offsetIdx: number): string;
 /**
  * Build the process-stats totals CTE query for a given interval.
  * The interval value MUST come from the VALID_PERIODS whitelist.

package/build/services/task/sql.js

@@ -4,16 +4,29 @@
 // ---------------------------------------------------------------------------
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GET_PROCESS_TASKS = exports.RESOLVE_JOB_ENTITY = exports.RESOLVE_CONFIG_TASK_QUEUE = exports.RESOLVE_TASK_BY_WORKFLOW_ID = exports.GET_TASK_BY_WORKFLOW_ID = exports.GET_TASK_BY_SIGNAL_ID = exports.GET_TASK = exports.APPEND_MILESTONES = exports.CREATE_TASK = void 0;
+exports.updateTaskById = updateTaskById;
+exports.listTasksCount = listTasksCount;
+exports.listTasksData = listTasksData;
+exports.listProcessesCount = listProcessesCount;
+exports.listProcessesData = listProcessesData;
 exports.processStatsTotals = processStatsTotals;
 exports.processStatsByType = processStatsByType;
 // ---- crud.ts queries ------------------------------------------------------
+// A task is 1:1 with its workflow_id. ON CONFLICT (workflow_id) makes createTask
+// idempotent under proxyActivity retry (maximumAttempts: 3) and re-driven sagas:
+// a retry re-targets the SAME row instead of inserting a duplicate. The no-op
+// DO UPDATE is required so RETURNING yields the existing row on conflict; the
+// `(xmax = 0)` flag tells the caller whether this call actually inserted (so the
+// `task.created` event fires exactly once). Requires the unique index from
+// migration 012.
 exports.CREATE_TASK = `
   INSERT INTO lt_tasks
     (workflow_id, workflow_type, lt_type, task_queue, signal_id,
      parent_workflow_id, origin_id, parent_id, envelope, metadata, priority,
      trace_id, span_id, initiated_by, principal_type, executing_as, status)
   VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, COALESCE($17, 'pending'))
-  RETURNING *`;
+  ON CONFLICT (workflow_id) DO UPDATE SET workflow_id = lt_tasks.workflow_id
+  RETURNING *, (xmax = 0) AS _inserted`;
 exports.APPEND_MILESTONES = `
   UPDATE lt_tasks
   SET milestones = milestones || $1::jsonb
@@ -22,12 +35,69 @@ exports.APPEND_MILESTONES = `
 exports.GET_TASK = `SELECT * FROM lt_tasks WHERE id = $1`;
 exports.GET_TASK_BY_SIGNAL_ID = `SELECT * FROM lt_tasks WHERE signal_id = $1`;
 exports.GET_TASK_BY_WORKFLOW_ID = `SELECT * FROM lt_tasks WHERE workflow_id = $1 ORDER BY created_at DESC LIMIT 1`;
+/**
+ * Build the partial-update statement for updateTask. The caller assembles the
+ * `SET` clause from whichever fields are present (each as a `$n` placeholder) and
+ * passes the placeholder index of the trailing `id` bind. One guarded UPDATE by
+ * primary key — no read-then-write.
+ */
+function updateTaskById(setClause, idIdx) {
+    return `UPDATE lt_tasks SET ${setClause} WHERE id = $${idIdx} RETURNING *`;
+}
+/** Count query for listTasks. `where` is the caller-built `WHERE …` clause (or ''). */
+function listTasksCount(where) {
+    return `SELECT COUNT(*) FROM lt_tasks ${where}`;
+}
+/** Page query for listTasks. limit/offset placeholder indices follow the filter binds. */
+function listTasksData(where, limitIdx, offsetIdx) {
+    return `SELECT * FROM lt_tasks ${where} ORDER BY created_at DESC LIMIT $${limitIdx} OFFSET $${offsetIdx}`;
+}
 // ---- resolve.ts queries ---------------------------------------------------
 exports.RESOLVE_TASK_BY_WORKFLOW_ID = `SELECT workflow_type, task_queue FROM lt_tasks WHERE workflow_id = $1 ORDER BY created_at DESC LIMIT 1`;
 exports.RESOLVE_CONFIG_TASK_QUEUE = `SELECT task_queue FROM lt_config_workflows WHERE workflow_type = $1`;
-exports.RESOLVE_JOB_ENTITY = `SELECT entity FROM durable.jobs WHERE key = $1 LIMIT 1`;
+/**
+ * Look up a job's entity tag in a specific HotMesh namespace. The namespace is a
+ * Postgres schema name, so it is interpolated (not a bind param) — same pattern
+ * as the diagnostics queries. Callers pass the trusted app_id from config.
+ */
+const RESOLVE_JOB_ENTITY = (appId) => `SELECT entity FROM "${appId}".jobs WHERE key = $1 LIMIT 1`;
+exports.RESOLVE_JOB_ENTITY = RESOLVE_JOB_ENTITY;
 // ---- process.ts queries ---------------------------------------------------
 exports.GET_PROCESS_TASKS = `SELECT * FROM lt_tasks WHERE origin_id = $1 ORDER BY created_at ASC`;
+/**
+ * Count query for listProcesses. `where` restricts which origin_ids are in scope;
+ * `having` (empty string when no status filter) aggregates per-origin counts, so the
+ * count must wrap the grouped set in a subquery. Both fragments carry only `$n` binds.
+ */
+function listProcessesCount(where, having) {
+    return having
+        ? `SELECT COUNT(*) FROM (
+         SELECT origin_id FROM lt_tasks ${where}
+         GROUP BY origin_id ${having}
+       ) sub`
+        : `SELECT COUNT(DISTINCT origin_id) FROM lt_tasks ${where}`;
+}
+/**
+ * Page query for listProcesses — one row per origin_id with rolled-up task counts,
+ * workflow types, and activity window. limit/offset placeholder indices follow the
+ * filter binds.
+ */
+function listProcessesData(where, having, limitIdx, offsetIdx) {
+    return `SELECT
+       origin_id,
+       COUNT(*)::int AS task_count,
+       COUNT(*) FILTER (WHERE status = 'completed')::int AS completed,
+       COUNT(*) FILTER (WHERE status = 'needs_intervention')::int AS escalated,
+       array_agg(DISTINCT workflow_type) AS workflow_types,
+       MIN(created_at) AS started_at,
+       MAX(COALESCE(completed_at, created_at)) AS last_activity
+     FROM lt_tasks
+     ${where}
+     GROUP BY origin_id
+     ${having}
+     ORDER BY MAX(created_at) DESC
+     LIMIT $${limitIdx} OFFSET $${offsetIdx}`;
+}
 /**
  * Build the process-stats totals CTE query for a given interval.
  * The interval value MUST come from the VALID_PERIODS whitelist.

package/build/services/user/crud.d.ts

@@ -11,6 +11,7 @@ export declare function listUsers(filters: {
     role?: string;
     roleType?: LTRoleType;
     status?: LTUserStatus;
+    search?: string;
     limit?: number;
     offset?: number;
 }): Promise<{