@cat-factory/server 0.159.0 → 0.161.0

package/dist/modules/events/EventsRelayController.js

@@ -1,5 +1,7 @@
 import { Hono } from 'hono';
 import { TOKEN_AUDIENCE, signerFor } from '../../auth/signing.js';
+import { authorizeMachineSubscribe } from '../../events/machineSubscribe.js';
+import { param } from '../../http/params.js';
 /**
  * Upper bound on a relayed `payload` frame (characters). A serialized `WorkspaceEvent` is small
  * (ids + a reason + a compact instance snapshot); 1 MiB is a generous ceiling that still brakes a
@@ -8,7 +10,9 @@ import { TOKEN_AUDIENCE, signerFor } from '../../auth/signing.js';
  */
 const MAX_RELAYED_PAYLOAD_CHARS = 1_000_000;
 /**
- * The mothership-mode real-time UPSTREAM machine API: `POST /internal/events/publish`.
+ * The mothership-mode real-time machine API — BOTH directions:
+ * `POST /internal/events/publish` (upstream) and
+ * `GET /internal/events/subscribe/:workspaceId` (inbound).
  *
  * A mothership-mode local node runs the engine locally but delegates org/durable state to the
  * mothership. Its engine events must ALSO reach the mothership's real-time fan-out, so a hosted
@@ -91,6 +95,51 @@ export function eventsRelayController() {
         }
         return c.json({ ok: true });
     });
+    // The INBOUND leg: the node subscribes to a workspace's stream so org activity raised on the
+    // mothership (a hosted teammate, or a peer laptop relaying upstream) reaches the laptop's SPA.
+    //
+    // It is deliberately NOT a new fan-out. The upgrade is handed to the SAME per-workspace realtime
+    // transport the browser stream uses (`gateways.realtime.upgrade` — the `WorkspaceEventsHub`
+    // Durable Object on Cloudflare), so a subscribed node is just another socket in the workspace's
+    // room and every event reaches laptops and browsers through one code path. The node's stable
+    // `?cid=` rides through to that transport, which is what lets the mothership skip echoing the
+    // node's OWN relayed events back to it (the outbound leg stamps the same id as
+    // `originConnectionId`).
+    //
+    // Auth is the shared `authorizeMachineSubscribe` (token pin → capability → account scope), the
+    // same helper the Node facade calls from its HTTP-server `upgrade` listener — Node can't upgrade
+    // from a Hono `Response`, so this handler is unreachable there, exactly like the browser stream's
+    // GET in `eventsController`.
+    app.get(`/internal/events/subscribe/:workspaceId`, async (c) => {
+        const container = c.get('container');
+        const workspaceId = param(c, 'workspaceId');
+        // The scope resolution reuses the mothership's own repository registry (attached alongside the
+        // relay on every mothership), exactly like the publish handler above. The registry is
+        // reflective (`Record<string, Record<string, fn>>`), so narrow the one method we call.
+        const workspaceRepository = container.repositories?.workspaceRepository;
+        const auth = await authorizeMachineSubscribe({
+            auth: container.config.auth,
+            token: c.req.header('authorization'),
+            workspaceId,
+            accountOf: workspaceRepository?.accountOf
+                ? (id) => workspaceRepository.accountOf(id)
+                : undefined,
+        });
+        if (!auth.ok) {
+            return c.json({
+                ok: false,
+                error: { code: auth.status === 404 ? 'not_found' : 'forbidden', message: auth.message },
+            }, auth.status);
+        }
+        // Checked AFTER auth so the handshake shape isn't probeable without a token.
+        if (c.req.header('Upgrade')?.toLowerCase() !== 'websocket') {
+            return c.text('expected a websocket upgrade', 426);
+        }
+        const upgraded = await container.gateways.realtime.upgrade(workspaceId, c.req.raw);
+        if (!upgraded)
+            return c.text('real-time events are not enabled', 501);
+        return upgraded;
+    });
     return app;
 }
 //# sourceMappingURL=EventsRelayController.js.map

package/dist/modules/events/EventsRelayController.js.map

@@ -1 +1 @@
-{"version":3,"file":"EventsRelayController.js","sourceRoot":"","sources":["../../../src/modules/events/EventsRelayController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAuB,cAAc,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAItF;;;;;GAKG;AACH,MAAM,yBAAyB,GAAG,SAAS,CAAA;AAE3C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,qBAAqB;IACnC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAEpC,0FAA0F;QAC1F,yBAAyB;QACzB,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAA;QAClD,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAA;QACvE,MAAM,OAAO,GAAG,MAAM;YACpB,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,MAAM,CAAiB,KAAK,EAAE,EAAE,GAAG,EAAE,cAAc,CAAC,OAAO,EAAE,CAAC;YACxF,CAAC,CAAC,IAAI,CAAA;QACR,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,EAC7E,GAAG,CACJ,CAAA;QACH,CAAC;QAED,MAAM,KAAK,GAAG,SAAS,CAAC,iBAAiB,CAAA;QACzC,yFAAyF;QACzF,4FAA4F;QAC5F,MAAM,mBAAmB,GAAG,SAAS,CAAC,YAAY,EAAE,mBAAmB,CAAA;QACvE,IAAI,CAAC,KAAK,IAAI,CAAC,mBAAmB,EAAE,SAAS,EAAE,CAAC;YAC9C,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,EAC9E,GAAG,CACJ,CAAA;QACH,CAAC;QAED,IAAI,IAA0B,CAAA;QAC9B,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAA;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,EAC7E,GAAG,CACJ,CAAA;QACH,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACtF,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,sCAAsC,EAAE;aAC/E,EACD,GAAG,CACJ,CAAA;QACH,CAAC;QACD,iGAAiG;QACjG,wFAAwF;QACxF,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC;YACpD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;QAChG,CAAC;QAED,iGAAiG;QACjG,kGAAkG;QAClG,+FAA+F;QAC/F,mBAAmB;QACnB,MAAM,SAAS,GAAG,CAAC,MACjB,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAC/C,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAA8B,CAAA;QACtD,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAChE,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAAE,EAC3E,GAAG,CACJ,CAAA;QACH,CAAC;QAED,+FAA+F;QAC/F,gGAAgG;QAChG,kGAAkG;QAClG,6EAA6E;QAC7E,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,MAAM,CAAC;gBACjB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,kBAAkB,EAChB,OAAO,IAAI,CAAC,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI;aAC/E,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;QACvC,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7B,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"EventsRelayController.js","sourceRoot":"","sources":["../../../src/modules/events/EventsRelayController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAuB,cAAc,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAEtF,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAA;AAE5E,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAE5C;;;;;GAKG;AACH,MAAM,yBAAyB,GAAG,SAAS,CAAA;AAE3C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,qBAAqB;IACnC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAEpC,0FAA0F;QAC1F,yBAAyB;QACzB,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAA;QAClD,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAA;QACvE,MAAM,OAAO,GAAG,MAAM;YACpB,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,MAAM,CAAiB,KAAK,EAAE,EAAE,GAAG,EAAE,cAAc,CAAC,OAAO,EAAE,CAAC;YACxF,CAAC,CAAC,IAAI,CAAA;QACR,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,EAC7E,GAAG,CACJ,CAAA;QACH,CAAC;QAED,MAAM,KAAK,GAAG,SAAS,CAAC,iBAAiB,CAAA;QACzC,yFAAyF;QACzF,4FAA4F;QAC5F,MAAM,mBAAmB,GAAG,SAAS,CAAC,YAAY,EAAE,mBAAmB,CAAA;QACvE,IAAI,CAAC,KAAK,IAAI,CAAC,mBAAmB,EAAE,SAAS,EAAE,CAAC;YAC9C,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,EAC9E,GAAG,CACJ,CAAA;QACH,CAAC;QAED,IAAI,IAA0B,CAAA;QAC9B,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAA;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,EAC7E,GAAG,CACJ,CAAA;QACH,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACtF,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,sCAAsC,EAAE;aAC/E,EACD,GAAG,CACJ,CAAA;QACH,CAAC;QACD,iGAAiG;QACjG,wFAAwF;QACxF,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC;YACpD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;QAChG,CAAC;QAED,iGAAiG;QACjG,kGAAkG;QAClG,+FAA+F;QAC/F,mBAAmB;QACnB,MAAM,SAAS,GAAG,CAAC,MACjB,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAC/C,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAA8B,CAAA;QACtD,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAChE,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAAE,EAC3E,GAAG,CACJ,CAAA;QACH,CAAC;QAED,+FAA+F;QAC/F,gGAAgG;QAChG,kGAAkG;QAClG,6EAA6E;QAC7E,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,MAAM,CAAC;gBACjB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,kBAAkB,EAChB,OAAO,IAAI,CAAC,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI;aAC/E,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;QACvC,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7B,CAAC,CAAC,CAAA;IAEF,6FAA6F;IAC7F,+FAA+F;IAC/F,EAAE;IACF,iGAAiG;IACjG,4FAA4F;IAC5F,gGAAgG;IAChG,6FAA6F;IAC7F,8FAA8F;IAC9F,+EAA+E;IAC/E,yBAAyB;IACzB,EAAE;IACF,+FAA+F;IAC/F,iGAAiG;IACjG,kGAAkG;IAClG,6BAA6B;IAC7B,GAAG,CAAC,GAAG,CAAC,yCAAyC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7D,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACpC,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAA;QAE3C,+FAA+F;QAC/F,sFAAsF;QACtF,uFAAuF;QACvF,MAAM,mBAAmB,GAAG,SAAS,CAAC,YAAY,EAAE,mBAAmB,CAAA;QACvE,MAAM,IAAI,GAAG,MAAM,yBAAyB,CAAC;YAC3C,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI;YAC3B,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC;YACpC,WAAW;YACX,SAAS,EAAE,mBAAmB,EAAE,SAAS;gBACvC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,mBAAmB,CAAC,SAAU,CAAC,EAAE,CAAuC;gBAClF,CAAC,CAAC,SAAS;SACd,CAAC,CAAA;QACF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;aACxF,EACD,IAAI,CAAC,MAAM,CACZ,CAAA;QACH,CAAC;QAED,6EAA6E;QAC7E,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,WAAW,EAAE,CAAC;YAC3D,OAAO,CAAC,CAAC,IAAI,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAA;QACpD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAClF,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAA;QACrE,OAAO,QAAQ,CAAA;IACjB,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/persistence/rpc-allowlist.d.ts

@@ -0,0 +1,37 @@
+import type { PersistenceMethodTable } from './rpc.js';
+/**
+ * The mothership-mode persistence allow-list: the core domain repositories plus the
+ * workspace-scoped reads a board load (`GET /workspaces/:id`) and an execution exercise.
+ * Every method here binds to an account via its {@link ScopeRule} so a call outside the
+ * machine token's scope is refused as 404.
+ *
+ * The cross-service board-composition reads keyed on `serviceIds[]`/`accountId`
+ * (`listByServices`, `serviceRepository.listByIds`/`listByAccount`, `countByServiceIds`) and the
+ * entity-id-keyed `blockRepository.findById` are allow-listed here too, each bound by the
+ * {@link ScopeRule} `serviceList` / `block` / `account` kinds that resolve the entity's owning
+ * account server-side before the scope check.
+ *
+ * Still EXCLUDED (added in later gate slices, with their own scope rules, or kept
+ * mothership-internal):
+ *   - `subscriptionActivationRepository.deleteByExecution` — the activation row is the local
+ *     `node:sqlite` bucket (per the per-repo checklist), not the remote surface, so it is not
+ *     exposed here.
+ *   - Global sweeper methods (`listStale`, `deleteOlderThan`) and high-impact unscoped ops
+ *     (`workspaceRepository.delete`, `accountRepository.create`).
+ *
+ * Admin-gated mutations are also EXCLUDED here. The RPC dispatches over the raw repository,
+ * bypassing the service layer that normally enforces per-user role checks — e.g.
+ * `AccountService.requireAdmin` guards `accountRepository.rename`/`updateSettings` and
+ * `membershipRepository.upsert`/`remove`. A machine token is scoped to whole ACCOUNTS, not to
+ * a role within them, so exposing those repo methods would let any account member self-promote
+ * to admin or rewrite memberships over the wire. They stay mothership-internal until a later
+ * slice adds a role dimension to the scope (or routes them through the service). Only the
+ * account/membership READS a board load needs are remotely callable. Board-level mutations
+ * (`workspaceRepository.rename`/`setDescription`, block/pipeline/execution CRUD) are
+ * member-level in the service layer, so they remain. The board mutations that stay OUT are
+ * `workspaceRepository.setAccessMode` (the access-mode flip) and `linkAccount` (the legacy-board
+ * auto-heal that adopts a board into an account) — both are `members.manage` (admin-tier), so like
+ * the account/membership admin mutations they must not be reachable over the role-blind machine RPC.
+ */
+export declare const REMOTE_PERSISTENCE_METHODS: PersistenceMethodTable;
+//# sourceMappingURL=rpc-allowlist.d.ts.map

package/dist/persistence/rpc-allowlist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rpc-allowlist.d.ts","sourceRoot":"","sources":["../../src/persistence/rpc-allowlist.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAA;AAgBtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,0BAA0B,EAAE,sBAo1BxC,CAAA"}