@adminiumjs/adminium 0.1.0-rc.1

package/dist/rbac/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/rbac/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EACL,kBAAkB,GAMnB,MAAM,gBAAgB,CAAC;AAExB,sEAAsE;AACtE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAGjG,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,MAAM,CAAU,CAAC;AAGtD,wEAAwE;AACxE,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,WAAW,EAAE,qBAAqB;IAClC,WAAW,EAAE,qBAAqB;IAClC,cAAc,EAAE,wBAAwB;IACxC,SAAS,EAAE,mBAAmB;IAC9B,aAAa,EAAE,wBAAwB;IACvC,wEAAwE;IACxE,qEAAqE;IACrE,iEAAiE;IACjE,aAAa,EAAE,uBAAuB;IACtC,aAAa,EAAE,uBAAuB;IACtC,aAAa,EAAE,uBAAuB;IACtC,iEAAiE;IACjE,sEAAsE;IACtE,qCAAqC;IACrC,QAAQ,EAAE,kBAAkB;IAC5B,UAAU,EAAE,oBAAoB;CACxB,CAAC;AAaX,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAC;AACxE,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;AACrE,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;AAEnE,6EAA6E;AAC7E,SAAS,YAAY,CAAC,OAAe;IACnC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAEzB,IAAI,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/C,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,QAAoC,CAAC;QAC5D,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5D,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,6BAA6B;QAC5E,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,gBAAgB;QACzE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxC,CAAC;IAED,IAAI,IAAI,KAAK,OAAO,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,QAA4C,CAAC;QACrF,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACrE,IAAI,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACjE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,MAA2B,EAAE,CAAC;IACrF,CAAC;IAED,IAAI,IAAI,KAAK,MAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,QAAoC,CAAC;QAChE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,IAAI,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAChE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAA0B,EAAE,CAAC;IACtE,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,IAAI,MAAM,CAAC,YAAY,KAAK,GAAG,IAAI,MAAM,CAAC,KAAK,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC9F,OAAO,MAA0B,CAAC;IACpC,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAChE,OAAO,MAA0B,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,YAAoB,EAAE,eAAuB;IACnE,OAAO,YAAY,KAAK,GAAG,IAAI,YAAY,KAAK,eAAe,CAAC;AAClE,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,QAAgB;IAC1D,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAChE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,EAAE,GAAG,CAA6C,CAAC;YACzD,OAAO,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC;QAClD,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,EAAE,GAAG,CAA4C,CAAC;YACxD,OAAO,CACL,cAAc,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC,YAAY,CAAC;gBAC/C,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC;gBACjC,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CACpC,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,EAAE,GAAG,CAA2C,CAAC;YACvD,OAAO,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,MAA2B,EAAE,QAAgB;IACrE,IAAI,eAAe,CAAC,QAAQ,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACrD,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;IACxE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAEhF,yEAAyE;AACzE,SAAS,aAAa,CAAC,WAAmB;IACxC,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,KAAK,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAChE,OAAO,EAAE,YAAY,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;AAC5F,CAAC;AAED,2EAA2E;AAC3E,SAAS,cAAc,CAAC,WAAmB;IACzC,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,oBAAoB,CAAC,IAA+B;IAClE,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC5C,IAAI,GAAG,KAAK,IAAI,IAAK,GAAG,CAAC,OAAiC,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC5E,MAAM,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YAChD,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,YAAY,KAAK,OAAO,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC3C,IAAI,GAAG,KAAK,IAAI;gBAAE,SAAS;YAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,OAAuB,CAAC;YAC5C,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;gBACnC,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI;oBAAE,MAAM,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,KAAK,IAAI,MAAM,EAAE,CAAC,CAAC;YAChG,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAsB,CAAC;QAC3C,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;YAClC,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI;gBAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,WAAW,IAAI,MAAM,EAAE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAcD,SAAS,iBAAiB;IACxB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AACpG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAyB;IAC5D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAwB,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;IAChD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IAErC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,UAAU,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAChD,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACrD,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,iBAAiB,EAAE,CAAC;YAC1D,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC1B,KAAK,MAAM,MAAM,IAAI,aAAa;oBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;YAC7D,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;YAChC,CAAC;YACD,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC5E,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;YACpB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;QAChC,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,IAAI,GAAqB,EAAE,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,UAAU;QAAE,IAAI,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAClH,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IACxG,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,QAAQ;QAAE,IAAI,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IACtG,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC"}

package/dist/rbac/principal.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The RBAC principal — "who is acting" (08-server-api.md §8: the auth layer
+ * resolves a principal, not a session, so API keys and users flow through the
+ * same enforcement path).
+ *
+ * Session users are decorated as `request.user` by `plugins/auth.ts`; this
+ * module reads that decoration *structurally* (no import, no augmentation) so
+ * the two plugins stay independently buildable. API-key principals are set by
+ * `plugins/rbac.ts` itself from `Authorization: Bearer adm_sk_…`.
+ */
+import type { FastifyRequest } from 'fastify';
+export interface UserPrincipal {
+    kind: 'user';
+    id: string;
+    /** Display snapshot for audit `actor_label` (07-meta-store.md §3.11). */
+    label: string;
+}
+export interface ApiKeyPrincipal {
+    kind: 'api-key';
+    /** The `adminium_api_keys` row id. */
+    id: string;
+    label: string;
+    /** The key acts with this role's permissions (07-meta-store.md §3.7). */
+    roleId: string;
+}
+export type RbacPrincipal = UserPrincipal | ApiKeyPrincipal;
+/**
+ * Resolve the acting principal for a request: an API-key principal (set by
+ * the rbac plugin's bearer hook) wins, then the auth plugin's session user.
+ * `null` means unauthenticated.
+ */
+export declare function getPrincipal(request: FastifyRequest): RbacPrincipal | null;
+//# sourceMappingURL=principal.d.ts.map

package/dist/rbac/principal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal.d.ts","sourceRoot":"","sources":["../../src/rbac/principal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,SAAS,CAAC;IAChB,sCAAsC;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,aAAa,GAAG,aAAa,GAAG,eAAe,CAAC;AAS5D;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,cAAc,GAAG,aAAa,GAAG,IAAI,CAe1E"}

package/dist/rbac/principal.js

@@ -0,0 +1,31 @@
+/**
+ * The RBAC principal — "who is acting" (08-server-api.md §8: the auth layer
+ * resolves a principal, not a session, so API keys and users flow through the
+ * same enforcement path).
+ *
+ * Session users are decorated as `request.user` by `plugins/auth.ts`; this
+ * module reads that decoration *structurally* (no import, no augmentation) so
+ * the two plugins stay independently buildable. API-key principals are set by
+ * `plugins/rbac.ts` itself from `Authorization: Bearer adm_sk_…`.
+ */
+/**
+ * Resolve the acting principal for a request: an API-key principal (set by
+ * the rbac plugin's bearer hook) wins, then the auth plugin's session user.
+ * `null` means unauthenticated.
+ */
+export function getPrincipal(request) {
+    if (request.apiKeyPrincipal !== null && request.apiKeyPrincipal !== undefined) {
+        return request.apiKeyPrincipal;
+    }
+    const user = request.user;
+    if (user !== null && user !== undefined && typeof user.id === 'string') {
+        const label = typeof user.name === 'string' && user.name.length > 0
+            ? user.name
+            : typeof user.email === 'string'
+                ? user.email
+                : user.id;
+        return { kind: 'user', id: user.id, label };
+    }
+    return null;
+}
+//# sourceMappingURL=principal.js.map

package/dist/rbac/principal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal.js","sourceRoot":"","sources":["../../src/rbac/principal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AA6BH;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,OAAuB;IAClD,IAAI,OAAO,CAAC,eAAe,KAAK,IAAI,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC9E,OAAO,OAAO,CAAC,eAAe,CAAC;IACjC,CAAC;IACD,MAAM,IAAI,GAAI,OAAqD,CAAC,IAAI,CAAC;IACzE,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QACvE,MAAM,KAAK,GACT,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;YACnD,CAAC,CAAC,IAAI,CAAC,IAAI;YACX,CAAC,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;gBAC9B,CAAC,CAAC,IAAI,CAAC,KAAK;gBACZ,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QAChB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC;IAC9C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/rbac/resolver.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Effective-permission resolution (08-server-api.md §5.1): principal →
+ * roles (`adminium_user_roles`, or the API key's single role) → union of the
+ * roles' matrix rows as grant strings. `super-admin` short-circuits to
+ * allow-all; everything else is deny-by-default via {@link isGranted}.
+ */
+import { type MetaDb, type Role } from '@adminium/meta';
+import type { RbacPrincipal } from './principal.js';
+/** Built-in slug whose members bypass every check (07-meta-store.md §3.8). */
+export declare const SUPER_ADMIN_SLUG = "super-admin";
+export interface PermissionSet {
+    superAdmin: boolean;
+    grants: ReadonlySet<string>;
+    roleIds: readonly string[];
+}
+export declare function emptyPermissionSet(): PermissionSet;
+/** Union the grant strings of a concrete role list. */
+export declare function resolveForRoles(meta: MetaDb, roles: readonly Role[]): Promise<PermissionSet>;
+/**
+ * Resolve the acting principal's permission set. Unknown role ids (e.g. an
+ * API key whose role was deleted) resolve to the empty set — deny.
+ */
+export declare function resolvePermissionSet(meta: MetaDb, principal: RbacPrincipal): Promise<PermissionSet>;
+/** The single allow/deny decision: super-admin bypass, then the grant union. */
+export declare function permissionSetAllows(set: PermissionSet, permission: string): boolean;
+//# sourceMappingURL=resolver.d.ts.map

package/dist/rbac/resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../src/rbac/resolver.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAA8B,KAAK,MAAM,EAAE,KAAK,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAGpF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpD,8EAA8E;AAC9E,eAAO,MAAM,gBAAgB,gBAAgB,CAAC;AAE9C,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC5B,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5B;AAED,wBAAgB,kBAAkB,IAAI,aAAa,CAElD;AAED,uDAAuD;AACvD,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,IAAI,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAYlG;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAOzG;AAED,gFAAgF;AAChF,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAGnF"}

package/dist/rbac/resolver.js

@@ -0,0 +1,46 @@
+/**
+ * Effective-permission resolution (08-server-api.md §5.1): principal →
+ * roles (`adminium_user_roles`, or the API key's single role) → union of the
+ * roles' matrix rows as grant strings. `super-admin` short-circuits to
+ * allow-all; everything else is deny-by-default via {@link isGranted}.
+ */
+import { permissionsRepo, rolesRepo } from '@adminium/meta';
+import { grantsFromMatrixRows, isGranted } from './permissions.js';
+/** Built-in slug whose members bypass every check (07-meta-store.md §3.8). */
+export const SUPER_ADMIN_SLUG = 'super-admin';
+export function emptyPermissionSet() {
+    return { superAdmin: false, grants: new Set(), roleIds: [] };
+}
+/** Union the grant strings of a concrete role list. */
+export async function resolveForRoles(meta, roles) {
+    const superAdmin = roles.some((role) => role.slug === SUPER_ADMIN_SLUG);
+    const permissions = permissionsRepo(meta);
+    const grants = new Set();
+    if (!superAdmin) {
+        for (const role of roles) {
+            for (const grant of grantsFromMatrixRows(await permissions.listForRole(role.id))) {
+                grants.add(grant);
+            }
+        }
+    }
+    return { superAdmin, grants, roleIds: roles.map((role) => role.id) };
+}
+/**
+ * Resolve the acting principal's permission set. Unknown role ids (e.g. an
+ * API key whose role was deleted) resolve to the empty set — deny.
+ */
+export async function resolvePermissionSet(meta, principal) {
+    const roles = rolesRepo(meta);
+    if (principal.kind === 'api-key') {
+        const role = await roles.findById(principal.roleId);
+        return role === null ? emptyPermissionSet() : resolveForRoles(meta, [role]);
+    }
+    return resolveForRoles(meta, await roles.rolesForUser(principal.id));
+}
+/** The single allow/deny decision: super-admin bypass, then the grant union. */
+export function permissionSetAllows(set, permission) {
+    if (set.superAdmin)
+        return true;
+    return isGranted(set.grants, permission);
+}
+//# sourceMappingURL=resolver.js.map

package/dist/rbac/resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../../src/rbac/resolver.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAA0B,MAAM,gBAAgB,CAAC;AAEpF,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAGnE,8EAA8E;AAC9E,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAQ9C,MAAM,UAAU,kBAAkB;IAChC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AAC/D,CAAC;AAED,uDAAuD;AACvD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,KAAsB;IACxE,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC;IACxE,MAAM,WAAW,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,KAAK,MAAM,KAAK,IAAI,oBAAoB,CAAC,MAAM,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBACjF,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AACvE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAY,EAAE,SAAwB;IAC/E,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACpD,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,EAAE,MAAM,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,mBAAmB,CAAC,GAAkB,EAAE,UAAkB;IACxE,IAAI,GAAG,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAC3C,CAAC"}

package/dist/realtime/hub.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Realtime channel hub (08-server-api.md §3, M2-T07). In-process pub/sub that
+ * both the WS gateway (`realtime/ws.ts`) and the SSE fallback
+ * (`realtime/sse.ts`) attach to, and that the jobs worker publishes into.
+ *
+ * Wave-2 channels:
+ * - `notifications:<userId>`             — own userId only
+ * - `jobs:<jobId>`                       — job owner or `system:jobs:read`
+ * - `config-changed`                     — any authenticated session
+ * - `widget-data:<connectionId>:<table>` — table read permission (04 §5.3)
+ *
+ * Authorization runs at subscribe time (`authorizeChannel`), mirroring the
+ * REST RBAC checks; publishing is server-internal and unchecked. Stream
+ * payloads on `widget-data:*` are PII-masked at the publisher so a subscriber
+ * who passes the table-read check still never receives a forbidden column.
+ */
+/** Minimal identity the realtime layer needs; the auth plugin supplies it. */
+export interface RealtimeUser {
+    id: string;
+}
+/** The wire shape of every server→client realtime event (§3 protocol). */
+export interface RealtimeEvent {
+    channel: string;
+    type: string;
+    data: unknown;
+    /** ISO-8601 UTC. */
+    ts: string;
+}
+/** A delivery sink — one per WS socket / SSE response per channel. */
+export type RealtimeSink = (event: RealtimeEvent) => void;
+/** Permission key guarding non-owner access to `jobs:<jobId>` channels. */
+export declare const JOBS_READ_PERMISSION = "system:jobs:read";
+/** Permission key guarding job enqueue/cancel for non-owners. */
+export declare const JOBS_MANAGE_PERMISSION = "system:jobs:manage";
+/** Parsed identity of a channel name; `null` for unknown/invalid names. */
+export type ChannelDescriptor = {
+    kind: 'notifications';
+    userId: string;
+} | {
+    kind: 'jobs';
+    jobId: string;
+} | {
+    kind: 'config-changed';
+} | {
+    kind: 'widget-data';
+    connectionId: string;
+    table: string;
+};
+/** Prefix of the widget-data stream channels (04-widget-registry.md §5.3). */
+export declare const WIDGET_DATA_CHANNEL_PREFIX = "widget-data";
+/** `widget-data:<connectionId>:<qualifiedTable>` — the stream channel name. */
+export declare function widgetDataChannel(connectionId: string, table: string): string;
+/** RBAC permission gating a widget-data stream subscription (read on the table). */
+export declare function widgetDataReadPermission(connectionId: string, table: string): string;
+/** Parses a channel name into its §3 descriptor (`null` = unknown channel). */
+export declare function parseChannel(channel: string): ChannelDescriptor | null;
+/** What `authorizeChannel` needs from the auth/RBAC layer. */
+export interface ChannelAuthDeps {
+    /** RBAC check, e.g. `can(user, 'system:jobs:read')`. Wired by the integrator. */
+    can(user: RealtimeUser, permission: string): Promise<boolean> | boolean;
+    /**
+     * Resolves the owning userId of a job (payload `userId` convention) so job
+     * owners can follow their own `jobs:<jobId>` channel without the global
+     * read permission. Optional — without it only `system:jobs:read` grants.
+     */
+    getJobOwner?(jobId: string): Promise<string | null> | string | null;
+}
+/**
+ * Subscribe-time authorization (§3 topics table). Unknown channels are always
+ * denied — deny-by-default, so a typo never becomes an open firehose.
+ */
+export declare function authorizeChannel(user: RealtimeUser, channel: string, deps: ChannelAuthDeps): Promise<boolean>;
+/**
+ * The in-process hub. Publishing with zero subscribers is a silent no-op; a
+ * throwing sink never breaks fan-out to its siblings (it is dropped).
+ */
+export declare class RealtimeHub {
+    private readonly channels;
+    /** Attach `sink` to `channel`; returns the matching unsubscribe function. */
+    subscribe(channel: string, sink: RealtimeSink): () => void;
+    /** Build the §3 event frame and fan it out to current subscribers. */
+    publish(channel: string, type: string, data: unknown, at?: number): RealtimeEvent;
+    /** Current subscriber count for a channel (tests/metrics). */
+    subscriberCount(channel: string): number;
+    /** Total distinct channels with at least one subscriber. */
+    get channelCount(): number;
+    /** Drop every subscription (server shutdown). */
+    close(): void;
+}
+//# sourceMappingURL=hub.d.ts.map

package/dist/realtime/hub.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hub.d.ts","sourceRoot":"","sources":["../../src/realtime/hub.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,0EAA0E;AAC1E,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,oBAAoB;IACpB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,sEAAsE;AACtE,MAAM,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC;AAE1D,2EAA2E;AAC3E,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AAEvD,iEAAiE;AACjE,eAAO,MAAM,sBAAsB,uBAAuB,CAAC;AAI3D,2EAA2E;AAC3E,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,GAC1B;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjE,8EAA8E;AAC9E,eAAO,MAAM,0BAA0B,gBAAgB,CAAC;AAExD,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,oFAAoF;AACpF,wBAAgB,wBAAwB,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpF;AAED,+EAA+E;AAC/E,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAqBtE;AAED,8DAA8D;AAC9D,MAAM,WAAW,eAAe;IAC9B,iFAAiF;IACjF,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IACxE;;;;OAIG;IACH,WAAW,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC;CACrE;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,OAAO,CAAC,CAmBlB;AAED;;;GAGG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwC;IAEjE,6EAA6E;IAC7E,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,MAAM,IAAI;IAe1D,sEAAsE;IACtE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,GAAE,MAAmB,GAAG,aAAa;IAkB7F,8DAA8D;IAC9D,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IAIxC,4DAA4D;IAC5D,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED,iDAAiD;IACjD,KAAK,IAAI,IAAI;CAGd"}

package/dist/realtime/hub.js

@@ -0,0 +1,146 @@
+/**
+ * Realtime channel hub (08-server-api.md §3, M2-T07). In-process pub/sub that
+ * both the WS gateway (`realtime/ws.ts`) and the SSE fallback
+ * (`realtime/sse.ts`) attach to, and that the jobs worker publishes into.
+ *
+ * Wave-2 channels:
+ * - `notifications:<userId>`             — own userId only
+ * - `jobs:<jobId>`                       — job owner or `system:jobs:read`
+ * - `config-changed`                     — any authenticated session
+ * - `widget-data:<connectionId>:<table>` — table read permission (04 §5.3)
+ *
+ * Authorization runs at subscribe time (`authorizeChannel`), mirroring the
+ * REST RBAC checks; publishing is server-internal and unchecked. Stream
+ * payloads on `widget-data:*` are PII-masked at the publisher so a subscriber
+ * who passes the table-read check still never receives a forbidden column.
+ */
+/** Permission key guarding non-owner access to `jobs:<jobId>` channels. */
+export const JOBS_READ_PERMISSION = 'system:jobs:read';
+/** Permission key guarding job enqueue/cancel for non-owners. */
+export const JOBS_MANAGE_PERMISSION = 'system:jobs:manage';
+const MAX_CHANNEL_LENGTH = 200;
+/** Prefix of the widget-data stream channels (04-widget-registry.md §5.3). */
+export const WIDGET_DATA_CHANNEL_PREFIX = 'widget-data';
+/** `widget-data:<connectionId>:<qualifiedTable>` — the stream channel name. */
+export function widgetDataChannel(connectionId, table) {
+    return `${WIDGET_DATA_CHANNEL_PREFIX}:${connectionId}:${table}`;
+}
+/** RBAC permission gating a widget-data stream subscription (read on the table). */
+export function widgetDataReadPermission(connectionId, table) {
+    return `table:${connectionId}:${table}:read`;
+}
+/** Parses a channel name into its §3 descriptor (`null` = unknown channel). */
+export function parseChannel(channel) {
+    if (channel.length === 0 || channel.length > MAX_CHANNEL_LENGTH)
+        return null;
+    if (channel === 'config-changed')
+        return { kind: 'config-changed' };
+    const sep = channel.indexOf(':');
+    if (sep <= 0)
+        return null;
+    const prefix = channel.slice(0, sep);
+    const rest = channel.slice(sep + 1);
+    if (rest.length === 0)
+        return null;
+    if (prefix === 'notifications')
+        return { kind: 'notifications', userId: rest };
+    if (prefix === 'jobs')
+        return { kind: 'jobs', jobId: rest };
+    if (prefix === WIDGET_DATA_CHANNEL_PREFIX) {
+        // `widget-data:<connectionId>:<table>` — split off the connection id; the
+        // rest is the qualified table id (`schema.name`, no colons).
+        const sep2 = rest.indexOf(':');
+        if (sep2 <= 0)
+            return null;
+        const connectionId = rest.slice(0, sep2);
+        const table = rest.slice(sep2 + 1);
+        if (table.length === 0)
+            return null;
+        return { kind: 'widget-data', connectionId, table };
+    }
+    return null;
+}
+/**
+ * Subscribe-time authorization (§3 topics table). Unknown channels are always
+ * denied — deny-by-default, so a typo never becomes an open firehose.
+ */
+export async function authorizeChannel(user, channel, deps) {
+    const parsed = parseChannel(channel);
+    if (parsed === null)
+        return false;
+    switch (parsed.kind) {
+        case 'config-changed':
+            return true; // any authenticated session
+        case 'notifications':
+            return parsed.userId === user.id;
+        case 'jobs': {
+            if (await deps.can(user, JOBS_READ_PERMISSION))
+                return true;
+            if (deps.getJobOwner === undefined)
+                return false;
+            const owner = await deps.getJobOwner(parsed.jobId);
+            return owner !== null && owner === user.id;
+        }
+        case 'widget-data':
+            // Same gate as a widget-data query: read permission on the resolved
+            // table (04 §5.3). PII/secret columns are stripped at publish time.
+            return deps.can(user, widgetDataReadPermission(parsed.connectionId, parsed.table));
+    }
+}
+/**
+ * The in-process hub. Publishing with zero subscribers is a silent no-op; a
+ * throwing sink never breaks fan-out to its siblings (it is dropped).
+ */
+export class RealtimeHub {
+    channels = new Map();
+    /** Attach `sink` to `channel`; returns the matching unsubscribe function. */
+    subscribe(channel, sink) {
+        let sinks = this.channels.get(channel);
+        if (sinks === undefined) {
+            sinks = new Set();
+            this.channels.set(channel, sinks);
+        }
+        sinks.add(sink);
+        return () => {
+            const set = this.channels.get(channel);
+            if (set === undefined)
+                return;
+            set.delete(sink);
+            if (set.size === 0)
+                this.channels.delete(channel);
+        };
+    }
+    /** Build the §3 event frame and fan it out to current subscribers. */
+    publish(channel, type, data, at = Date.now()) {
+        const event = { channel, type, data, ts: new Date(at).toISOString() };
+        const sinks = this.channels.get(channel);
+        if (sinks !== undefined) {
+            for (const sink of [...sinks]) {
+                try {
+                    sink(event);
+                }
+                catch {
+                    // A broken sink (e.g. socket torn down mid-send) must not starve
+                    // the other subscribers; drop it.
+                    sinks.delete(sink);
+                }
+            }
+            if (sinks.size === 0)
+                this.channels.delete(channel);
+        }
+        return event;
+    }
+    /** Current subscriber count for a channel (tests/metrics). */
+    subscriberCount(channel) {
+        return this.channels.get(channel)?.size ?? 0;
+    }
+    /** Total distinct channels with at least one subscriber. */
+    get channelCount() {
+        return this.channels.size;
+    }
+    /** Drop every subscription (server shutdown). */
+    close() {
+        this.channels.clear();
+    }
+}
+//# sourceMappingURL=hub.js.map

package/dist/realtime/hub.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hub.js","sourceRoot":"","sources":["../../src/realtime/hub.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAmBH,2EAA2E;AAC3E,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAEvD,iEAAiE;AACjE,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AAE3D,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAS/B,8EAA8E;AAC9E,MAAM,CAAC,MAAM,0BAA0B,GAAG,aAAa,CAAC;AAExD,+EAA+E;AAC/E,MAAM,UAAU,iBAAiB,CAAC,YAAoB,EAAE,KAAa;IACnE,OAAO,GAAG,0BAA0B,IAAI,YAAY,IAAI,KAAK,EAAE,CAAC;AAClE,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,wBAAwB,CAAC,YAAoB,EAAE,KAAa;IAC1E,OAAO,SAAS,YAAY,IAAI,KAAK,OAAO,CAAC;AAC/C,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAC7E,IAAI,OAAO,KAAK,gBAAgB;QAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;IACpE,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,MAAM,KAAK,eAAe;QAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC/E,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC5D,IAAI,MAAM,KAAK,0BAA0B,EAAE,CAAC;QAC1C,0EAA0E;QAC1E,6DAA6D;QAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,IAAI,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IACtD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAcD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAkB,EAClB,OAAe,EACf,IAAqB;IAErB,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAClC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,gBAAgB;YACnB,OAAO,IAAI,CAAC,CAAC,4BAA4B;QAC3C,KAAK,eAAe;YAClB,OAAO,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,IAAI,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,oBAAoB,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC5D,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YACjD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnD,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC,EAAE,CAAC;QAC7C,CAAC;QACD,KAAK,aAAa;YAChB,oEAAoE;YACpE,oEAAoE;YACpE,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,wBAAwB,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,WAAW;IACL,QAAQ,GAAG,IAAI,GAAG,EAA6B,CAAC;IAEjE,6EAA6E;IAC7E,SAAS,CAAC,OAAe,EAAE,IAAkB;QAC3C,IAAI,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACpC,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,OAAO,GAAG,EAAE;YACV,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACvC,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO;YAC9B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACjB,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpD,CAAC,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,OAAO,CAAC,OAAe,EAAE,IAAY,EAAE,IAAa,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;QAC3E,MAAM,KAAK,GAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACrF,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC;gBAC9B,IAAI,CAAC;oBACH,IAAI,CAAC,KAAK,CAAC,CAAC;gBACd,CAAC;gBAAC,MAAM,CAAC;oBACP,iEAAiE;oBACjE,kCAAkC;oBAClC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,8DAA8D;IAC9D,eAAe,CAAC,OAAe;QAC7B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC;IAC/C,CAAC;IAED,4DAA4D;IAC5D,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC5B,CAAC;IAED,iDAAiD;IACjD,KAAK;QACH,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;CACF"}

package/dist/realtime/sse.d.ts

@@ -0,0 +1,35 @@
+/**
+ * SSE fallback `GET /api/v1/events?channels=a,b` (08-server-api.md §3,
+ * M2-T07) for proxies/environments without WebSocket. Same channel model and
+ * subscribe-time authorization as `/ws`; events are framed as
+ *
+ *   event: <type>
+ *   data: {"channel":…,"type":…,"data":…,"ts":…}
+ *
+ * with an initial `retry:` hint and `: keep-alive` comments every 25 s.
+ * `?topics=` is accepted as an alias (§3 sketch uses "topics").
+ *
+ * Register inside the `/api/v1` prefix scope — `registerJobsAndRealtime`
+ * (jobs/register.ts) does.
+ */
+import type { FastifyInstance } from 'fastify';
+import { z } from 'zod';
+import type { RealtimeGatewayDeps } from './ws.js';
+/** Keep-alive comment interval. */
+export declare const SSE_KEEPALIVE_MS = 25000;
+/** Client reconnect hint (`retry:` field). */
+export declare const SSE_RETRY_MS = 5000;
+/** Max channels per stream (matches the WS per-socket cap). */
+export declare const SSE_MAX_CHANNELS = 64;
+export declare const eventsQuery: z.ZodObject<{
+    channels: z.ZodOptional<z.ZodString>;
+    topics: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type EventsQuery = z.infer<typeof eventsQuery>;
+export interface SseRouteOptions {
+    /** Keep-alive override for tests. */
+    keepAliveMs?: number | undefined;
+}
+/** Registers `GET /events` on the given (already `/api/v1`-prefixed) scope. */
+export declare function registerSseRoute(app: FastifyInstance, deps: RealtimeGatewayDeps, opts?: SseRouteOptions): void;
+//# sourceMappingURL=sse.d.ts.map

package/dist/realtime/sse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse.d.ts","sourceRoot":"","sources":["../../src/realtime/sse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAEnD,mCAAmC;AACnC,eAAO,MAAM,gBAAgB,QAAS,CAAC;AAEvC,8CAA8C;AAC9C,eAAO,MAAM,YAAY,OAAQ,CAAC;AAElC,+DAA+D;AAC/D,eAAO,MAAM,gBAAgB,KAAK,CAAC;AAEnC,eAAO,MAAM,WAAW;;;iBAKtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,MAAM,WAAW,eAAe;IAC9B,qCAAqC;IACrC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC;AAED,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,mBAAmB,EACzB,IAAI,GAAE,eAAoB,GACzB,IAAI,CAiEN"}

package/dist/realtime/sse.js

@@ -0,0 +1,88 @@
+/**
+ * SSE fallback `GET /api/v1/events?channels=a,b` (08-server-api.md §3,
+ * M2-T07) for proxies/environments without WebSocket. Same channel model and
+ * subscribe-time authorization as `/ws`; events are framed as
+ *
+ *   event: <type>
+ *   data: {"channel":…,"type":…,"data":…,"ts":…}
+ *
+ * with an initial `retry:` hint and `: keep-alive` comments every 25 s.
+ * `?topics=` is accepted as an alias (§3 sketch uses "topics").
+ *
+ * Register inside the `/api/v1` prefix scope — `registerJobsAndRealtime`
+ * (jobs/register.ts) does.
+ */
+import { z } from 'zod';
+import { ForbiddenError, UnauthorizedError, ValidationFailedError } from '../errors.js';
+import { authorizeChannel } from './hub.js';
+/** Keep-alive comment interval. */
+export const SSE_KEEPALIVE_MS = 25_000;
+/** Client reconnect hint (`retry:` field). */
+export const SSE_RETRY_MS = 5_000;
+/** Max channels per stream (matches the WS per-socket cap). */
+export const SSE_MAX_CHANNELS = 64;
+export const eventsQuery = z.object({
+    /** Comma-separated channel list. */
+    channels: z.string().max(4096).optional(),
+    /** Alias per the §3 protocol sketch. */
+    topics: z.string().max(4096).optional(),
+});
+/** Registers `GET /events` on the given (already `/api/v1`-prefixed) scope. */
+export function registerSseRoute(app, deps, opts = {}) {
+    const keepAliveMs = opts.keepAliveMs ?? SSE_KEEPALIVE_MS;
+    app.get('/events', { schema: { querystring: eventsQuery } }, async (request, reply) => {
+        const user = await deps.resolveUser(request);
+        if (user === null)
+            throw new UnauthorizedError();
+        const raw = [request.query.channels, request.query.topics]
+            .filter((v) => typeof v === 'string' && v.length > 0)
+            .join(',');
+        const channels = [...new Set(raw.split(',').map((c) => c.trim()).filter((c) => c.length > 0))];
+        if (channels.length === 0) {
+            throw new ValidationFailedError('at least one channel is required (?channels=a,b)');
+        }
+        if (channels.length > SSE_MAX_CHANNELS) {
+            throw new ValidationFailedError(`at most ${SSE_MAX_CHANNELS} channels per stream`, {
+                requested: channels.length,
+            });
+        }
+        for (const channel of channels) {
+            if (!(await authorizeChannel(user, channel, deps))) {
+                throw new ForbiddenError(`You cannot subscribe to "${channel}".`, 'FORBIDDEN', {
+                    channel,
+                });
+            }
+        }
+        // Long-lived stream: take the raw socket over from Fastify.
+        reply.hijack();
+        const res = reply.raw;
+        res.writeHead(200, {
+            'content-type': 'text/event-stream; charset=utf-8',
+            'cache-control': 'no-cache, no-transform',
+            connection: 'keep-alive',
+            'x-accel-buffering': 'no',
+            'x-request-id': String(request.id),
+        });
+        res.write(`retry: ${SSE_RETRY_MS}\n\n`);
+        const unsubscribes = channels.map((channel) => deps.hub.subscribe(channel, (event) => {
+            res.write(`event: ${event.type}\ndata: ${JSON.stringify(event)}\n\n`);
+        }));
+        const keepAlive = setInterval(() => {
+            res.write(`: keep-alive ${new Date().toISOString()}\n\n`);
+        }, keepAliveMs);
+        keepAlive.unref?.();
+        let closed = false;
+        const close = () => {
+            if (closed)
+                return;
+            closed = true;
+            clearInterval(keepAlive);
+            for (const unsubscribe of unsubscribes)
+                unsubscribe();
+            res.end();
+        };
+        request.raw.on('close', close);
+        res.on('close', close);
+    });
+}
+//# sourceMappingURL=sse.js.map

package/dist/realtime/sse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse.js","sourceRoot":"","sources":["../../src/realtime/sse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACxF,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAG5C,mCAAmC;AACnC,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEvC,8CAA8C;AAC9C,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,CAAC;AAElC,+DAA+D;AAC/D,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAEnC,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,oCAAoC;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IACzC,wCAAwC;IACxC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAQH,+EAA+E;AAC/E,MAAM,UAAU,gBAAgB,CAC9B,GAAoB,EACpB,IAAyB,EACzB,OAAwB,EAAE;IAE1B,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,gBAAgB,CAAC;IAEzD,GAAG,CAAC,GAAG,CACL,SAAS,EACT,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,EACxC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,iBAAiB,EAAE,CAAC;QAEjD,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;aACvD,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;aACjE,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/F,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,qBAAqB,CAAC,kDAAkD,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;YACvC,MAAM,IAAI,qBAAqB,CAAC,WAAW,gBAAgB,sBAAsB,EAAE;gBACjF,SAAS,EAAE,QAAQ,CAAC,MAAM;aAC3B,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;gBACnD,MAAM,IAAI,cAAc,CAAC,4BAA4B,OAAO,IAAI,EAAE,WAAW,EAAE;oBAC7E,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,4DAA4D;QAC5D,KAAK,CAAC,MAAM,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;QACtB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACjB,cAAc,EAAE,kCAAkC;YAClD,eAAe,EAAE,wBAAwB;YACzC,UAAU,EAAE,YAAY;YACxB,mBAAmB,EAAE,IAAI;YACzB,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;SACnC,CAAC,CAAC;QACH,GAAG,CAAC,KAAK,CAAC,UAAU,YAAY,MAAM,CAAC,CAAC;QAExC,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAC5C,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YACpC,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,CAAC,IAAI,WAAW,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACxE,CAAC,CAAC,CACH,CAAC;QAEF,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;YACjC,GAAG,CAAC,KAAK,CAAC,gBAAgB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC5D,CAAC,EAAE,WAAW,CAAC,CAAC;QAChB,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;QAEpB,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,MAAM,KAAK,GAAG,GAAS,EAAE;YACvB,IAAI,MAAM;gBAAE,OAAO;YACnB,MAAM,GAAG,IAAI,CAAC;YACd,aAAa,CAAC,SAAS,CAAC,CAAC;YACzB,KAAK,MAAM,WAAW,IAAI,YAAY;gBAAE,WAAW,EAAE,CAAC;YACtD,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC/B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/realtime/ws.d.ts

@@ -0,0 +1,38 @@
+/**
+ * WebSocket gateway `GET /ws` (08-server-api.md §3, M2-T07). JSON frames:
+ *
+ *   client → server: { op: "subscribe" | "unsubscribe", channel } | { op: "ping" }
+ *   server → client: { channel, type, data, ts } events,
+ *                    { op: "pong" } | { op: "subscribed" | "unsubscribed", channel }
+ *                    | { op: "error", code, channel? }
+ *
+ * (`sub`/`unsub` are accepted as aliases per the §3 protocol sketch.)
+ * Unauthenticated upgrades are rejected pre-handshake; channel authorization
+ * runs at subscribe time via `authorizeChannel`. Hygiene: protocol-level ping
+ * every 30 s (dropped after 2 missed pongs), ≤ 64 channels per socket.
+ *
+ * The `@fastify/websocket` plugin must be registered before this route —
+ * `registerJobsAndRealtime` (jobs/register.ts) does both.
+ */
+import type { FastifyInstance, FastifyRequest } from 'fastify';
+import { type ChannelAuthDeps, type RealtimeHub, type RealtimeUser } from './hub.js';
+/** Max concurrent channel subscriptions per socket. */
+export declare const WS_MAX_CHANNELS = 64;
+/** Protocol-level heartbeat interval. */
+export declare const WS_HEARTBEAT_INTERVAL_MS = 30000;
+/** Heartbeats without a pong before the socket is dropped. */
+export declare const WS_MAX_MISSED_PONGS = 2;
+/** Everything the realtime gateway needs from the rest of the server. */
+export interface RealtimeGatewayDeps extends ChannelAuthDeps {
+    hub: RealtimeHub;
+    /**
+     * Session resolution — wired by the integrator to the auth plugin
+     * (e.g. `(req) => req.user ?? null`).
+     */
+    resolveUser(request: FastifyRequest): Promise<RealtimeUser | null> | RealtimeUser | null;
+    /** Heartbeat override for tests. */
+    heartbeatIntervalMs?: number | undefined;
+}
+/** Registers `GET /ws`. Call after `app.register(websocket)`. */
+export declare function registerWsRoute(app: FastifyInstance, deps: RealtimeGatewayDeps): void;
+//# sourceMappingURL=ws.d.ts.map

package/dist/realtime/ws.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ws.d.ts","sourceRoot":"","sources":["../../src/realtime/ws.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAI/D,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,YAAY,EAClB,MAAM,UAAU,CAAC;AAElB,uDAAuD;AACvD,eAAO,MAAM,eAAe,KAAK,CAAC;AAElC,yCAAyC;AACzC,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAE/C,8DAA8D;AAC9D,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC,yEAAyE;AACzE,MAAM,WAAW,mBAAoB,SAAQ,eAAe;IAC1D,GAAG,EAAE,WAAW,CAAC;IACjB;;;OAGG;IACH,WAAW,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,YAAY,GAAG,IAAI,CAAC;IACzF,oCAAoC;IACpC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C;AAOD,iEAAiE;AACjE,wBAAgB,eAAe,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,mBAAmB,GAAG,IAAI,CA+GrF"}