@archlast/server 0.0.1

package/dist/websocket/server.js

@@ -0,0 +1,693 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ArchlastWebSocketHandler = void 0;
+const logger_js_1 = require("../logging/logger.js");
+const cookies_js_1 = require("../auth/system/cookies.js");
+const MAX_MESSAGE_BYTES = Number(process.env.WS_MAX_MESSAGE_BYTES ?? 65536);
+const RATE_LIMIT_WINDOW_MS = Number(process.env.WS_RATE_LIMIT_WINDOW_MS ?? 1000);
+const MAX_MESSAGES_PER_WINDOW = Number(process.env.WS_MAX_MESSAGES_PER_WINDOW ?? 50);
+const HEARTBEAT_INTERVAL_MS = Number(process.env.WS_HEARTBEAT_INTERVAL_MS ?? 15000);
+const IDLE_TIMEOUT_MS = Number(process.env.WS_IDLE_TIMEOUT_MS ?? 45000);
+const REVALIDATION_DEBOUNCE_MS = Number(process.env.REVALIDATION_DEBOUNCE_MS ?? 10);
+const role_helpers_js_1 = require("../auth/role-helpers.js");
+const context_helper_js_1 = require("../http/context-helper.js");
+// Cookie name for Better-Auth session
+const BETTER_AUTH_SESSION_COOKIE = "better-auth.session_token";
+// ... existing imports ...
+class ArchlastWebSocketHandler {
+    authResolver;
+    engine;
+    db;
+    // Map<QueryId, Set<WebSocket>>
+    // Note: QueryId here is the "canonical" ID (e.g. hash of name+args)
+    // But for simplicity, we'll use the client-provided queryId and assume it's unique per client connection.
+    // Actually, to support "re-run all clients who asked for X", we need a way to map "canonical query" -> clients.
+    // But the DependencyGraph tracks "QueryId".
+    // If we use ClientQueryId as the ID in DependencyGraph, then we have one entry per client per query.
+    // This is fine for now. It means if 100 clients watch "tasks", we have 100 entries in the graph.
+    // Optimization: Deduplicate identical queries. (Not doing this for Phase 1).
+    // So we just need to map QueryId -> WebSocket to push updates.
+    querySubscribers = new Map();
+    // Map canonical function keys to session-specific query IDs
+    // This allows job-executed queries to trigger revalidation of WebSocket queries
+    // Example: "fn:tasks.list:abc123" → Set("session1:query1", "session2:query5")
+    functionToQueryIds = new Map();
+    revalidationQueue = new Set();
+    revalidationTimer = null;
+    // Track all active WebSocket connections
+    connectedClients = new Set();
+    // Track admin connections for admin events broadcasting
+    adminConnections = new Set();
+    constructor(authResolver, engine, db) {
+        this.authResolver = authResolver;
+        this.engine = engine;
+        this.db = db;
+    }
+    async open(ws) {
+        ws.data.subscriptions = new Map();
+        ws.data.lastSeen = Date.now();
+        ws.data.msgWindowStart = Date.now();
+        ws.data.msgCount = 0;
+        ws.data.heartbeatTimer = setInterval(() => {
+            const last = ws.data.lastSeen ?? 0;
+            if (Date.now() - last > IDLE_TIMEOUT_MS) {
+                clearInterval(ws.data.heartbeatTimer);
+                ws.close(1001, "idle timeout");
+            }
+        }, HEARTBEAT_INTERVAL_MS);
+        // Track this connection
+        this.connectedClients.add(ws);
+        logger_js_1.logger.log({
+            timestamp: Date.now(),
+            level: "info",
+            kind: "system",
+            message: `[WebSocket] Opened connection. Total: ${this.connectedClients.size}`,
+        });
+    }
+    async message(ws, message) {
+        try {
+            // Calculate message size for limit check
+            let size;
+            if (typeof message === "string") {
+                size = Buffer.byteLength(message);
+            }
+            else if (Buffer.isBuffer(message) || message instanceof ArrayBuffer) {
+                size = message.byteLength;
+            }
+            else {
+                // Pre-parsed object from Elysia
+                size = JSON.stringify(message).length;
+            }
+            if (size > MAX_MESSAGE_BYTES) {
+                ws.close(1009, "message too large");
+                return;
+            }
+            const now = Date.now();
+            ws.data.lastSeen = now;
+            const windowStart = ws.data.msgWindowStart ?? now;
+            const count = ws.data.msgCount ?? 0;
+            if (now - windowStart > RATE_LIMIT_WINDOW_MS) {
+                ws.data.msgWindowStart = now;
+                ws.data.msgCount = 0;
+            }
+            else if (count >= MAX_MESSAGES_PER_WINDOW) {
+                ws.close(1011, "rate limit");
+                return;
+            }
+            ws.data.msgCount = (ws.data.msgCount ?? 0) + 1;
+            // Handle message parsing - Elysia may pass pre-parsed JSON objects
+            let msg;
+            if (typeof message === "object" && message !== null && !Buffer.isBuffer(message)) {
+                // Already parsed by Elysia
+                msg = message;
+            }
+            else {
+                // Raw string or buffer - need to parse
+                const data = typeof message === "string" ? message : message.toString();
+                msg = JSON.parse(data);
+            }
+            if (msg.type === "connect") {
+                const authInput = msg.auth || {};
+                // Merge client-provided connect auth payload with best-effort header/cookie resolution.
+                // This enables cookie-based sessions for WS when the client forwards a Cookie header.
+                // Headers from the HTTP Upgrade request (captured in http/server.ts via derive)
+                const upgradeHeaders = ws.data.requestHeaders || {};
+                // Headers from the "connect" message payload (optional manual override)
+                const connectPayloadHeaders = {
+                    ...(typeof authInput?.headers === "object" &&
+                        authInput?.headers
+                        ? authInput.headers
+                        : {}),
+                };
+                const mergedHeaders = {
+                    ...upgradeHeaders,
+                    ...connectPayloadHeaders,
+                };
+                // Parse cookies from Upgrade headers
+                const upgradeCookieHeader = upgradeHeaders["cookie"] || upgradeHeaders["Cookie"] || "";
+                const upgradeCookies = (0, cookies_js_1.parseCookieHeader)(upgradeCookieHeader);
+                // Parse cookies from "connect" message payload
+                const payloadCookieHeaderRaw = typeof authInput?.headers?.cookie === "string"
+                    ? authInput.headers.cookie
+                    : typeof authInput?.headers?.Cookie === "string"
+                        ? authInput.headers.Cookie
+                        : "";
+                const payloadCookiesFromHeader = (0, cookies_js_1.parseCookieHeader)(payloadCookieHeaderRaw);
+                const payloadCookiesDirect = typeof authInput?.cookies === "object" && authInput?.cookies
+                    ? authInput.cookies
+                    : {};
+                const mergedCookies = {
+                    ...upgradeCookies,
+                    ...payloadCookiesFromHeader,
+                    ...payloadCookiesDirect,
+                };
+                ws.data.requestHeaders = mergedHeaders;
+                ws.data.requestCookies = mergedCookies;
+                // Dynamic cookie resolution for legacy auth
+                const appId = mergedHeaders["x-archlast-app-id"] || mergedHeaders["X-Archlast-App-Id"];
+                const cookieName = appId ? `archlast_session_${appId}` : "archlast_session";
+                const token = mergedCookies[cookieName];
+                // For Better-Auth: check if we have a Better-Auth session cookie
+                // Better-Auth uses cookies like "better-auth.session_token" or "better-auth.session_token.X"
+                let betterAuthToken = null;
+                for (const [key, value] of Object.entries(mergedCookies)) {
+                    if (key.startsWith("better-auth.session_token")) {
+                        betterAuthToken = value;
+                        break;
+                    }
+                }
+                // Use Better-Auth token if available, otherwise fallback to legacy token
+                const resolvedToken = authInput.token || betterAuthToken || token;
+                const authContext = await this.authResolver.resolve({
+                    ...authInput,
+                    token: resolvedToken,
+                    headers: mergedHeaders,
+                    cookies: mergedCookies,
+                });
+                let finalAuthContext = authContext;
+                // Check for admin authentication via Authorization header, x-api-key, or cookies
+                // This validates: Better-Auth sessions, API keys (arch_*), and username/password sign-in
+                if (!finalAuthContext.isAuthenticated) {
+                    // Check x-api-key header first (Better-Auth API key)
+                    const apiKeyHeader = mergedHeaders["x-api-key"] || mergedHeaders["X-Api-Key"];
+                    // Check Authorization header (client sends Bearer token)
+                    const authHeader = mergedHeaders["authorization"] || mergedHeaders["Authorization"];
+                    // Check Better-Auth session cookie
+                    const adminCookie = mergedCookies[BETTER_AUTH_SESSION_COOKIE] ||
+                        mergedCookies["better-auth.session_token"] ||
+                        mergedCookies["archlast_admin_session"];
+                    if (apiKeyHeader || authHeader || adminCookie) {
+                        try {
+                            // Create a synthetic Request object to use with requireAdmin
+                            const headers = new Headers();
+                            if (apiKeyHeader) {
+                                headers.set("x-api-key", apiKeyHeader);
+                            }
+                            if (authHeader) {
+                                headers.set("authorization", authHeader);
+                            }
+                            if (adminCookie) {
+                                headers.set("cookie", `${BETTER_AUTH_SESSION_COOKIE}=${adminCookie}`);
+                            }
+                            // Also include user-agent for logging
+                            if (mergedHeaders["user-agent"]) {
+                                headers.set("user-agent", mergedHeaders["user-agent"]);
+                            }
+                            const syntheticReq = new Request("http://internal", { headers });
+                            // Use Better-Auth requireAdmin for admin authentication
+                            const adminAuth = await (0, role_helpers_js_1.requireAdmin)((0, context_helper_js_1.getBetterAuth)(), syntheticReq);
+                            if (adminAuth) {
+                                // Extract userId from Better-Auth
+                                const userId = adminAuth.user?.id || adminAuth.user?._id || adminAuth.userId;
+                                const sessionId = adminAuth.session?.id || adminAuth.session?._id || adminAuth.sessionId;
+                                // Create synthetic AuthContext for Admin
+                                finalAuthContext = {
+                                    userId,
+                                    isAuthenticated: true,
+                                    isAdminToken: true, // CRITICAL: Mark as admin token for edge function authorization
+                                    provider: "better-auth",
+                                    type: "session",
+                                    // Minimal implementation for context
+                                    user: adminAuth.user,
+                                    session: adminAuth.session,
+                                    raw: { sessionId },
+                                    permissions: ["*"],
+                                    role: "super_admin",
+                                    hasPermission: () => true,
+                                    requireAuthenticated: () => { },
+                                    requireTenant: () => { }, // Admin doesn't need tenant context usually
+                                    requirePermission: () => { },
+                                    requireRole: () => { },
+                                    apiKey: null,
+                                    apiKeyId: null,
+                                    tenant: null,
+                                    membership: null,
+                                    tenantId: null,
+                                };
+                                logger_js_1.logger.log({
+                                    timestamp: Date.now(),
+                                    level: "info",
+                                    kind: "system",
+                                    message: "[WebSocket] Admin authentication verified successfully",
+                                    context: {
+                                        userId,
+                                        method: apiKeyHeader ? "x-api-key" : authHeader?.startsWith("Bearer ") ? "Bearer token" : "cookie",
+                                    },
+                                });
+                            }
+                            else {
+                                logger_js_1.logger.log({
+                                    timestamp: Date.now(),
+                                    level: "warn",
+                                    kind: "system",
+                                    message: "[WebSocket] Admin authentication failed (invalid token)",
+                                });
+                            }
+                        }
+                        catch (e) {
+                            logger_js_1.logger.log({
+                                timestamp: Date.now(),
+                                level: "error",
+                                kind: "system",
+                                message: "[WebSocket] Admin authentication error",
+                                context: { error: e instanceof Error ? e.message : String(e) },
+                            });
+                        }
+                    }
+                    else {
+                        logger_js_1.logger.log({
+                            timestamp: Date.now(),
+                            level: "warn",
+                            kind: "system",
+                            message: "[WebSocket] No admin credentials found in cookies/headers",
+                            context: {
+                                cookies: Object.keys(mergedCookies),
+                                hasArchlastAdminSession: !!mergedCookies["archlast_admin_session"],
+                                hasAuthHeader: !!authHeader,
+                                hasApiKeyHeader: !!apiKeyHeader,
+                            },
+                        });
+                    }
+                }
+                // Log full headers for debugging
+                if (!finalAuthContext.isAuthenticated) {
+                    logger_js_1.logger.log({
+                        timestamp: Date.now(),
+                        level: "warn",
+                        kind: "system",
+                        message: "[WebSocket] Unauthenticated connection proceeding (restricted access)",
+                        context: {
+                            headers: Object.keys(mergedHeaders),
+                            cookies: Object.keys(mergedCookies),
+                            cookieHeader: upgradeCookieHeader,
+                        },
+                    });
+                }
+                else {
+                    logger_js_1.logger.log({
+                        timestamp: Date.now(),
+                        level: "info",
+                        kind: "system",
+                        message: "[WebSocket] Authenticated connection",
+                        context: { userId: finalAuthContext.userId },
+                    });
+                }
+                // ALLOW connection even if unauthenticated
+                // We will enforce auth on specific subscriptions/messages
+                ws.data.authContext = finalAuthContext;
+                ws.data.sessionId = "session-" + Date.now();
+                // Allow proceeding without closing
+                ws.send(JSON.stringify({
+                    type: "connected",
+                    sessionId: ws.data.sessionId,
+                    authenticated: finalAuthContext.isAuthenticated,
+                }));
+                return;
+                ws.data.authContext = finalAuthContext;
+                ws.data.sessionId = "session-" + Date.now();
+                ws.send(JSON.stringify({ type: "connected", sessionId: ws.data.sessionId }));
+                logger_js_1.logger.log({
+                    timestamp: Date.now(),
+                    level: "info",
+                    kind: "system",
+                    message: `Client connected. User: ${finalAuthContext.userId}`,
+                });
+            }
+            else if (msg.type === "query") {
+                if (!ws.data.authContext || !ws.data.authContext.isAuthenticated) {
+                    ws.send(JSON.stringify({ type: "error", message: "Authentication required" }));
+                    return;
+                }
+                const { queryId, name, args } = msg;
+                // Special handling for sys.logs query -> enable log streaming
+                if (name === "sys.logs") {
+                    ws.data.subscribedToLogs = true;
+                    // Register subscription effectively (so client can unsubscribe later via close/unsubscribe)
+                    ws.data.subscriptions.set(queryId, { name, args });
+                    // Send recent logs history so the user sees something immediately
+                    const recentLogs = await logger_js_1.logger.list(100);
+                    for (const log of recentLogs) {
+                        ws.send(JSON.stringify({ type: "log", log }));
+                    }
+                    // Send initial "connected" data packet for the subscription
+                    ws.send(JSON.stringify({ type: "data", queryId, data: { status: "subscribed" } }));
+                    return;
+                }
+                // Register subscription
+                ws.data.subscriptions.set(queryId, { name, args });
+                // We use a composite key for the graph: sessionId:queryId
+                // This ensures uniqueness across clients
+                const uniqueQueryId = `${ws.data.sessionId}:${queryId}`;
+                this.querySubscribers.set(uniqueQueryId, ws);
+                // Register the canonical function key mapping for cross-instance revalidation
+                // This allows job-executed queries to trigger WebSocket query revalidation
+                const argsHash = this.hashArgs(args);
+                const functionCacheKey = `fn:${name}:${argsHash}`;
+                if (!this.functionToQueryIds.has(functionCacheKey)) {
+                    this.functionToQueryIds.set(functionCacheKey, new Set());
+                }
+                this.functionToQueryIds.get(functionCacheKey).add(uniqueQueryId);
+                // Run initial query
+                try {
+                    const { result } = await this.engine.runQuery(name, args, ws.data.authContext, uniqueQueryId);
+                    ws.send(JSON.stringify({ type: "data", queryId, data: result }));
+                }
+                catch (e) {
+                    ws.send(JSON.stringify({ type: "error", message: e.message }));
+                }
+            }
+            else if (msg.type === "mutation") {
+                if (!ws.data.authContext || !ws.data.authContext.isAuthenticated) {
+                    ws.send(JSON.stringify({ type: "error", message: "Authentication required" }));
+                    return;
+                }
+                const { mutationId, name, args } = msg;
+                try {
+                    const { result, affectedQueries } = await this.engine.runMutation(name, args, ws.data.authContext);
+                    // Send mutation result
+                    // (We don't have a specific mutation response type in ClientMessage yet, but let's assume 'data' or similar)
+                    // Actually client expects a promise resolution. We should send a specific mutation response.
+                    // For now, let's just send it as 'data' with mutationId?
+                    // The client implementation I wrote expects a response.
+                    // Let's add a type "mutationResponse" later.
+                    ws.send(JSON.stringify({
+                        type: "mutationResponse",
+                        mutationId,
+                        data: result,
+                        success: true,
+                    }));
+                    // Handle Reactivity
+                    this.revalidateQueries(affectedQueries);
+                }
+                catch (e) {
+                    ws.send(JSON.stringify({
+                        type: "mutationResponse",
+                        mutationId,
+                        error: e.message,
+                        success: false,
+                    }));
+                }
+            }
+            else if (msg.type === "subscribe_logs") {
+                // Subscribe to real-time log stream
+                ws.data.subscribedToLogs = true;
+                ws.send(JSON.stringify({ type: "logs_subscribed" }));
+            }
+            else if (msg.type === "unsubscribe_logs") {
+                // Unsubscribe from log stream
+                ws.data.subscribedToLogs = false;
+                ws.send(JSON.stringify({ type: "logs_unsubscribed" }));
+            }
+            else if (msg.type === "subscribe_admin_events") {
+                ws.data.isSubscribedToAdminEvents = true;
+                this.adminConnections.add(ws);
+                ws.send(JSON.stringify({ type: "admin_events_subscribed" }));
+            }
+            else if (msg.type === "ping") {
+                ws.send(JSON.stringify({ type: "pong" }));
+            }
+        }
+        catch (e) {
+            logger_js_1.logger.log({
+                timestamp: Date.now(),
+                level: "error",
+                kind: "system",
+                message: "Error handling message",
+                context: { error: e instanceof Error ? e.message : String(e) },
+            });
+            ws.send(JSON.stringify({ type: "error", message: "Invalid message format" }));
+        }
+    }
+    async close(ws, code, reason) {
+        // Remove from connected clients
+        const deleted = this.connectedClients.delete(ws);
+        logger_js_1.logger.log({
+            timestamp: Date.now(),
+            level: "info",
+            kind: "system",
+            message: `[WebSocket] Closed connection ${ws.data.sessionId || "unknown"}. Removed: ${deleted}. Remaining: ${this.connectedClients.size}`,
+            context: { code, reason },
+        });
+        // Remove from admin connections if subscribed
+        if (ws.data.isSubscribedToAdminEvents) {
+            this.adminConnections.delete(ws);
+            logger_js_1.logger.log({
+                timestamp: Date.now(),
+                level: "info",
+                kind: "system",
+                message: `[WebSocket] Admin unsubscribed from events. Remaining admin connections: ${this.adminConnections.size}`,
+                context: { sessionId: ws.data.sessionId },
+            });
+        }
+        // Cleanup subscriptions
+        if (ws.data.subscriptions) {
+            for (const [queryId, sub] of ws.data.subscriptions) {
+                const uniqueQueryId = `${ws.data.sessionId}:${queryId}`;
+                this.querySubscribers.delete(uniqueQueryId);
+                this.engine.clearDependencies(uniqueQueryId);
+                // Clean up function-to-query mapping
+                const argsHash = this.hashArgs(sub.args);
+                const functionCacheKey = `fn:${sub.name}:${argsHash}`;
+                const sessionQueryIds = this.functionToQueryIds.get(functionCacheKey);
+                if (sessionQueryIds) {
+                    sessionQueryIds.delete(uniqueQueryId);
+                    // Remove the mapping entirely if no more sessions
+                    if (sessionQueryIds.size === 0) {
+                        this.functionToQueryIds.delete(functionCacheKey);
+                    }
+                }
+            }
+            ws.data.subscriptions.clear();
+        }
+        // Cleanup log subscription
+        ws.data.subscribedToLogs = false;
+        if (ws.data.heartbeatTimer) {
+            clearInterval(ws.data.heartbeatTimer);
+            ws.data.heartbeatTimer = undefined;
+        }
+    }
+    /**
+     * Broadcast a log entry to all subscribed clients.
+     * Called from IPC poller when logs arrive from any process.
+     */
+    broadcastLog(log) {
+        const message = JSON.stringify({ type: "log", log });
+        for (const client of this.connectedClients) {
+            if (client.data.subscribedToLogs) {
+                try {
+                    client.send(message);
+                }
+                catch {
+                    // Client may have disconnected, ignore
+                }
+            }
+        }
+    }
+    /**
+     * Hash args to create a canonical function key
+     */
+    hashArgs(args) {
+        try {
+            const str = JSON.stringify(args || {});
+            // Simple hash function (same as used in engine/runner.ts)
+            let hash = 0;
+            for (let i = 0; i < str.length; i++) {
+                const char = str.charCodeAt(i);
+                hash = (hash << 5) - hash + char;
+                hash = hash & hash;
+            }
+            return Math.abs(hash).toString(36);
+        }
+        catch {
+            return "default";
+        }
+    }
+    async revalidateQueries(affectedQueryIds) {
+        this.bufferRevalidation(affectedQueryIds);
+    }
+    broadcastAdminEvent(type, payload) {
+        const message = JSON.stringify({ type, ...payload });
+        for (const adminWs of this.adminConnections) {
+            console.log(`[WebSocket] Broadcasting admin event to ${adminWs.data.sessionId}`);
+            try {
+                adminWs.send(message);
+            }
+            catch {
+                // Client may have disconnected, ignore
+            }
+        }
+        logger_js_1.logger.log({
+            timestamp: Date.now(),
+            level: "info",
+            kind: "system",
+            message: `[WebSocket] Broadcast admin event to ${this.adminConnections.size} admin connections`,
+            context: { type, payload },
+        });
+    }
+    bufferRevalidation(affectedQueryIds) {
+        // Expand affected query IDs to include session-specific IDs
+        const expandedQueryIds = new Set();
+        for (const qid of affectedQueryIds) {
+            // If this is a canonical function key (fn:name:hash), expand it
+            if (qid.startsWith("fn:")) {
+                const sessionQueryIds = this.functionToQueryIds.get(qid);
+                if (sessionQueryIds) {
+                    for (const sessionQid of sessionQueryIds) {
+                        expandedQueryIds.add(sessionQid);
+                    }
+                }
+            }
+            else {
+                // Regular session-specific query ID
+                expandedQueryIds.add(qid);
+            }
+        }
+        for (const q of expandedQueryIds) {
+            this.revalidationQueue.add(q);
+        }
+        if (this.revalidationTimer)
+            return;
+        this.revalidationTimer = setTimeout(() => this.flushRevalidation(), REVALIDATION_DEBOUNCE_MS);
+    }
+    async flushRevalidation() {
+        const queued = this.revalidationQueue;
+        this.revalidationQueue = new Set();
+        this.revalidationTimer = null;
+        logger_js_1.logger.log({
+            timestamp: Date.now(),
+            level: "info",
+            kind: "system",
+            message: "[WebSocket] flushRevalidation:",
+            context: {
+                data: [
+                    {
+                        queuedSize: queued.size,
+                        queued: Array.from(queued).slice(0, 10),
+                    },
+                ],
+            },
+        });
+        for (const uniqueQueryId of queued) {
+            const ws = this.querySubscribers.get(uniqueQueryId);
+            logger_js_1.logger.log({
+                timestamp: Date.now(),
+                level: "info",
+                kind: "system",
+                message: "[WebSocket] Processing query revalidation:",
+                context: {
+                    data: [
+                        {
+                            uniqueQueryId,
+                            hasWebSocket: !!ws,
+                            isOpen: ws?.readyState === WebSocket.OPEN,
+                        },
+                    ],
+                },
+            });
+            if (!ws || ws.readyState !== WebSocket.OPEN) {
+                logger_js_1.logger.log({
+                    timestamp: Date.now(),
+                    level: "info",
+                    kind: "system",
+                    message: "[WebSocket] Cleaning up stale subscription:",
+                    context: { uniqueQueryId },
+                });
+                this.querySubscribers.delete(uniqueQueryId);
+                this.engine.clearDependencies(uniqueQueryId);
+                if (ws?.data?.subscriptions) {
+                    const parts = uniqueQueryId.split(":");
+                    const queryId = parts.slice(1).join(":");
+                    const sub = ws.data.subscriptions.get(queryId);
+                    ws.data.subscriptions.delete(queryId);
+                    // Clean up function-to-query mapping
+                    if (sub) {
+                        const argsHash = this.hashArgs(sub.args);
+                        const functionCacheKey = `fn:${sub.name}:${argsHash}`;
+                        const sessionQueryIds = this.functionToQueryIds.get(functionCacheKey);
+                        if (sessionQueryIds) {
+                            sessionQueryIds.delete(uniqueQueryId);
+                            if (sessionQueryIds.size === 0) {
+                                this.functionToQueryIds.delete(functionCacheKey);
+                            }
+                        }
+                    }
+                }
+                continue;
+            }
+            const parts = uniqueQueryId.split(":");
+            const queryId = parts.slice(1).join(":");
+            const sub = ws.data.subscriptions?.get(queryId);
+            if (sub) {
+                try {
+                    const { result } = await this.engine.runQuery(sub.name, sub.args, ws.data.authContext, uniqueQueryId);
+                    ws.send(JSON.stringify({ type: "data", queryId, data: result }));
+                    logger_js_1.logger.log({
+                        timestamp: Date.now(),
+                        level: "info",
+                        kind: "system",
+                        message: "[WebSocket] ✅ Query revalidation sent to client:",
+                        context: {
+                            data: [
+                                {
+                                    uniqueQueryId,
+                                    queryId,
+                                    hasResult: !!result,
+                                },
+                            ],
+                        },
+                    });
+                }
+                catch (e) {
+                    logger_js_1.logger.log({
+                        timestamp: Date.now(),
+                        level: "error",
+                        kind: "system",
+                        message: "[WebSocket] ✗ Query revalidation failed:",
+                        context: {
+                            data: [
+                                {
+                                    uniqueQueryId,
+                                    error: e instanceof Error ? e.message : String(e),
+                                },
+                            ],
+                        },
+                    });
+                    logger_js_1.logger.log({
+                        timestamp: Date.now(),
+                        level: "error",
+                        kind: "system",
+                        message: `Failed to re-run query ${uniqueQueryId}`,
+                        context: { error: e instanceof Error ? e.message : String(e) },
+                    });
+                }
+            }
+        }
+    }
+    /**
+     * Get introspection data for monitoring dashboard
+     */
+    getIntrospection() {
+        const sessions = Array.from(this.connectedClients)
+            .filter((ws) => ws.readyState === WebSocket.OPEN)
+            .map((ws) => ({
+            sessionId: ws.data.sessionId || "unknown",
+            userId: ws.data.authContext?.userId || null,
+            lastSeen: ws.data.lastSeen || 0,
+            subscriptionCount: ws.data.subscriptions?.size || 0,
+            subscriptions: Array.from(ws.data.subscriptions?.entries() || []).map(([queryId, sub]) => ({
+                queryId,
+                name: sub.name,
+                args: sub.args,
+            })),
+        }));
+        const totalSubscriptions = sessions.reduce((sum, s) => sum + s.subscriptionCount, 0);
+        return {
+            activeConnections: this.connectedClients.size,
+            openConnections: sessions.length,
+            totalSubscriptions,
+            sessions,
+        };
+    }
+}
+exports.ArchlastWebSocketHandler = ArchlastWebSocketHandler;
+//# sourceMappingURL=server.js.map