@cat-factory/server 0.160.0 → 0.162.0

package/dist/events/machineSubscribe.d.ts

@@ -0,0 +1,56 @@
+import type { AuthConfig } from '../config/types.js';
+import { type MachinePayload } from '../auth/signing.js';
+/**
+ * The path the mothership serves the machine subscribe handshake on. Shared so the controller,
+ * the Node upgrade listener's matcher, and the local client's URL builder cannot drift.
+ * `:workspaceId` is a single path segment; the node's stable `?cid=` rides the query string
+ * (matching the browser stream's `?cid=`, which is what the fan-out's echo suppression keys off).
+ */
+export declare const MACHINE_EVENTS_SUBSCRIBE_PATH = "/internal/events/subscribe";
+/** Matches `/internal/events/subscribe/<workspaceId>`, capturing the (still-encoded) id. */
+export declare const MACHINE_EVENTS_SUBSCRIBE_PATTERN: RegExp;
+/**
+ * The verdict of authorising a machine subscribe handshake, modelled like {@link WsUpgradeAuth}
+ * so each facade maps it onto its own transport's rejection (an HTTP `Response` on the Worker, a
+ * raw status line written to the socket on Node).
+ */
+export type MachineSubscribeAuth = {
+    ok: true;
+    payload: MachinePayload;
+} | {
+    ok: false;
+    status: 403 | 404 | 503;
+    message: string;
+};
+/** Resolves a workspace to its owning account — the mothership's own `workspaceRepository`. */
+export type AccountOfWorkspace = (workspaceId: string) => Promise<string | null | undefined> | string | null | undefined;
+/**
+ * Authorise a machine subscribe handshake for `workspaceId`.
+ *
+ * The order is load-bearing and mirrors the other `/internal/*` surfaces:
+ *
+ *  1. **Machine-token audience pin FIRST**, before any capability probe, so a token-less caller
+ *     cannot distinguish a mothership from a facade that isn't one (403 either way).
+ *  2. **Capability probe** — a facade with no account store to scope against can't serve this
+ *     safely, so it reports 503 (only ever reachable WITH a valid token, by step 1).
+ *  3. **Account-scope binding** — resolve the workspace to its owning account and refuse
+ *     anything outside the token's scope as **404**, the auth gate's existence-non-leak policy.
+ *     An unknown workspace and an out-of-scope one are indistinguishable.
+ *
+ * Note what this deliberately does NOT check: a role. A machine token scopes whole ACCOUNTS, not
+ * a role within them (the same rule that keeps admin-gated mutations off the persistence RPC).
+ * That is sound here because the subscription is READ-ONLY and workspace-scoped — it delivers the
+ * same frames any member of the account already receives over the browser stream, and the
+ * transport ignores anything a subscriber sends.
+ */
+export declare function authorizeMachineSubscribe(opts: {
+    auth: AuthConfig;
+    /** The bearer token as presented (already stripped of the `Bearer ` prefix, or raw header). */
+    token: string | undefined;
+    workspaceId: string;
+    /** The mothership's workspace → account resolver; absent ⇒ this facade is not a mothership. */
+    accountOf: AccountOfWorkspace | undefined;
+}): Promise<MachineSubscribeAuth>;
+/** Accepts either a raw token or a full `Authorization: Bearer …` header value. */
+export declare function stripBearer(value: string | undefined): string | undefined;
+//# sourceMappingURL=machineSubscribe.d.ts.map

package/dist/events/machineSubscribe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"machineSubscribe.d.ts","sourceRoot":"","sources":["../../src/events/machineSubscribe.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,KAAK,cAAc,EAA6B,MAAM,oBAAoB,CAAA;AAwBnF;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,+BAA+B,CAAA;AAEzE,4FAA4F;AAC5F,eAAO,MAAM,gCAAgC,QAA6C,CAAA;AAE1F;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,cAAc,CAAA;CAAE,GACrC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AAE3D,+FAA+F;AAC/F,MAAM,MAAM,kBAAkB,GAAG,CAC/B,WAAW,EAAE,MAAM,KAChB,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;AAEnE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,yBAAyB,CAAC,IAAI,EAAE;IACpD,IAAI,EAAE,UAAU,CAAA;IAChB,+FAA+F;IAC/F,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;IACzB,WAAW,EAAE,MAAM,CAAA;IACnB,+FAA+F;IAC/F,SAAS,EAAE,kBAAkB,GAAG,SAAS,CAAA;CAC1C,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAoBhC;AAED,mFAAmF;AACnF,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAEzE"}

package/dist/events/machineSubscribe.js

@@ -0,0 +1,75 @@
+import { TOKEN_AUDIENCE, signerFor } from '../auth/signing.js';
+// Mothership-mode real-time INBOUND subscribe (docs/initiatives/mothership-mode.md, PR 2).
+//
+// The OUTBOUND leg (`POST /internal/events/publish`) carries a laptop's engine events UP to the
+// mothership. This is the mirror: a mothership-mode node opens a long-lived subscription to the
+// mothership's per-workspace stream so org activity raised ELSEWHERE — by a hosted teammate, or by
+// a peer laptop relaying upstream — reaches the laptop's own SPA. Without it a mothership-mode
+// board is write-only in real time: the laptop pushes but never hears.
+//
+// The mothership SERVE side is deliberately not a new fan-out. It is the SAME per-workspace
+// realtime transport the browser stream already uses (`gateways.realtime.upgrade` — the
+// `WorkspaceEventsHub` Durable Object on Cloudflare, the `NodeRealtimeHub` on Node), reached over
+// a machine-authed route. So a subscribed node is, to the mothership, just another socket in the
+// workspace's room: no per-runtime subscriber registry to invent, and a relayed event fans to
+// laptops and browsers through one code path.
+//
+// This module is the AUTHORIZATION half, and it lives here (not inline in the controller) for
+// exactly the reason `wsTicket.ts` does: both runtimes need it, and they reach the handshake
+// differently. Cloudflare authorises inside the shared `eventsRelayController` GET handler; Node
+// authorises in its HTTP-server `upgrade` listener, because `@hono/node-server` cannot upgrade
+// from a Hono `Response` and the request therefore never reaches the controller. One
+// implementation keeps the two handshakes authorising identically.
+/**
+ * The path the mothership serves the machine subscribe handshake on. Shared so the controller,
+ * the Node upgrade listener's matcher, and the local client's URL builder cannot drift.
+ * `:workspaceId` is a single path segment; the node's stable `?cid=` rides the query string
+ * (matching the browser stream's `?cid=`, which is what the fan-out's echo suppression keys off).
+ */
+export const MACHINE_EVENTS_SUBSCRIBE_PATH = '/internal/events/subscribe';
+/** Matches `/internal/events/subscribe/<workspaceId>`, capturing the (still-encoded) id. */
+export const MACHINE_EVENTS_SUBSCRIBE_PATTERN = /^\/internal\/events\/subscribe\/([^/]+)$/;
+/**
+ * Authorise a machine subscribe handshake for `workspaceId`.
+ *
+ * The order is load-bearing and mirrors the other `/internal/*` surfaces:
+ *
+ *  1. **Machine-token audience pin FIRST**, before any capability probe, so a token-less caller
+ *     cannot distinguish a mothership from a facade that isn't one (403 either way).
+ *  2. **Capability probe** — a facade with no account store to scope against can't serve this
+ *     safely, so it reports 503 (only ever reachable WITH a valid token, by step 1).
+ *  3. **Account-scope binding** — resolve the workspace to its owning account and refuse
+ *     anything outside the token's scope as **404**, the auth gate's existence-non-leak policy.
+ *     An unknown workspace and an out-of-scope one are indistinguishable.
+ *
+ * Note what this deliberately does NOT check: a role. A machine token scopes whole ACCOUNTS, not
+ * a role within them (the same rule that keeps admin-gated mutations off the persistence RPC).
+ * That is sound here because the subscription is READ-ONLY and workspace-scoped — it delivers the
+ * same frames any member of the account already receives over the browser stream, and the
+ * transport ignores anything a subscriber sends.
+ */
+export async function authorizeMachineSubscribe(opts) {
+    const secret = opts.auth.sessionSecret;
+    const payload = secret
+        ? await signerFor(secret).verify(stripBearer(opts.token), {
+            aud: TOKEN_AUDIENCE.machine,
+        })
+        : null;
+    if (!payload)
+        return { ok: false, status: 403, message: 'invalid machine token' };
+    if (!opts.accountOf) {
+        return { ok: false, status: 503, message: 'event subscription is not enabled' };
+    }
+    // A resolver failure is treated exactly like "unknown workspace": fail closed, and never let
+    // the caller tell a lookup error from an out-of-scope board.
+    const accountId = await Promise.resolve(opts.accountOf(opts.workspaceId)).catch(() => undefined);
+    if (!accountId || !payload.scope.accountIds.includes(accountId)) {
+        return { ok: false, status: 404, message: 'workspace not found' };
+    }
+    return { ok: true, payload };
+}
+/** Accepts either a raw token or a full `Authorization: Bearer …` header value. */
+export function stripBearer(value) {
+    return value?.replace(/^Bearer\s+/i, '');
+}
+//# sourceMappingURL=machineSubscribe.js.map

package/dist/events/machineSubscribe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"machineSubscribe.js","sourceRoot":"","sources":["../../src/events/machineSubscribe.ts"],"names":[],"mappings":"AACA,OAAO,EAAuB,cAAc,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAEnF,2FAA2F;AAC3F,EAAE;AACF,gGAAgG;AAChG,gGAAgG;AAChG,mGAAmG;AACnG,+FAA+F;AAC/F,uEAAuE;AACvE,EAAE;AACF,4FAA4F;AAC5F,wFAAwF;AACxF,kGAAkG;AAClG,iGAAiG;AACjG,8FAA8F;AAC9F,8CAA8C;AAC9C,EAAE;AACF,8FAA8F;AAC9F,6FAA6F;AAC7F,iGAAiG;AACjG,+FAA+F;AAC/F,qFAAqF;AACrF,mEAAmE;AAEnE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,4BAA4B,CAAA;AAEzE,4FAA4F;AAC5F,MAAM,CAAC,MAAM,gCAAgC,GAAG,0CAA0C,CAAA;AAgB1F;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,IAO/C;IACC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAA;IACtC,MAAM,OAAO,GAAG,MAAM;QACpB,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,MAAM,CAAiB,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YACtE,GAAG,EAAE,cAAc,CAAC,OAAO;SAC5B,CAAC;QACJ,CAAC,CAAC,IAAI,CAAA;IACR,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAA;IAEjF,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAA;IACjF,CAAC;IAED,6FAA6F;IAC7F,6DAA6D;IAC7D,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IAChG,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAA;IACnE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;AAC9B,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,WAAW,CAAC,KAAyB;IACnD,OAAO,KAAK,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAA;AAC1C,CAAC"}

package/dist/index.d.ts

@@ -32,6 +32,7 @@ export { registerCoreControllers } from './app.js';
 export { FanOutEventPublisher, type FanOutEventPublisherDependencies, } from './events/FanOutEventPublisher.js';
 export { InAppNotificationChannel } from './events/InAppNotificationChannel.js';
 export { type MachineEventRelay, type MachineEventClient, type RelayedRealtimeEvent, HttpMachineEventClient, } from './events/machineEvents.js';
+export { type AccountOfWorkspace, type MachineSubscribeAuth, MACHINE_EVENTS_SUBSCRIBE_PATH, MACHINE_EVENTS_SUBSCRIBE_PATTERN, authorizeMachineSubscribe, stripBearer, } from './events/machineSubscribe.js';
 export { type DelegatedNotificationRequest, type MachineNotificationClient, type HttpMachineNotificationClientOptions, type RemoteNotificationChannelOptions, HttpMachineNotificationClient, RemoteNotificationChannel, } from './notifications/machineNotifications.js';
 export { mountAuthGate } from './http/authGate.js';
 export { param } from './http/params.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAE,KAAK,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EACL,KAAK,MAAM,EACX,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,eAAe,GACrB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAA;AAC9E,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AAC/E,OAAO,EAAE,mBAAmB,EAAE,KAAK,yBAAyB,EAAE,MAAM,6BAA6B,CAAA;AACjG,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAA;AAC/E,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,KAAK,mBAAmB,GACzB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAClE,OAAO,EACL,WAAW,EACX,KAAK,uBAAuB,EAC5B,KAAK,cAAc,GACpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,WAAW,EACX,KAAK,uBAAuB,EAC5B,KAAK,cAAc,GACpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,WAAW,EAAE,KAAK,uBAAuB,EAAE,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAA;AAC7E,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,SAAS,GACf,MAAM,yCAAyC,CAAA;AAIhD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAA;AAC3E,OAAO,EACL,sBAAsB,EACtB,KAAK,kCAAkC,EACvC,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,GAC5B,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,uBAAuB,EAAE,KAAK,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAClG,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAC1F,OAAO,EACL,iCAAiC,EACjC,uBAAuB,EACvB,KAAK,0BAA0B,GAChC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,4BAA4B,EAC5B,KAAK,kBAAkB,GACxB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACL,yBAAyB,EACzB,KAAK,qCAAqC,GAC3C,MAAM,uCAAuC,CAAA;AAC9C,OAAO,EACL,0BAA0B,EAC1B,KAAK,sCAAsC,GAC5C,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,6BAA6B,EAClC,KAAK,8BAA8B,EACnC,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,YAAY,GAClB,MAAM,+BAA+B,CAAA;AAGtC,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,oBAAoB,EACpB,6BAA6B,EAC7B,yBAAyB,EACzB,UAAU,GACX,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,qBAAqB,EACrB,KAAK,6BAA6B,GACnC,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EACL,oBAAoB,EACpB,KAAK,gCAAgC,GACtC,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,sBAAsB,GACvB,MAAM,2BAA2B,CAAA;AAKlC,OAAO,EACL,KAAK,4BAA4B,EACjC,KAAK,yBAAyB,EAC9B,KAAK,oCAAoC,EACzC,KAAK,gCAAgC,EACrC,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,yCAAyC,CAAA;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,UAAU,EACV,oBAAoB,EACpB,0BAA0B,EAC1B,wBAAwB,EACxB,QAAQ,EACR,KAAK,aAAa,GACnB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAA;AACjG,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EAAE,eAAe,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAA;AACjF,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAIlG,OAAO,EACL,qBAAqB,EACrB,KAAK,4BAA4B,GAClC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAA;AAEzF,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,4BAA4B,CAAA;AAEnC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC3F,OAAO,EACL,aAAa,EACb,KAAK,yBAAyB,EAC9B,mCAAmC,GACpC,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,aAAa,EAClB,KAAK,cAAc,GACpB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AAKpF,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,KAAK,6BAA6B,GACnC,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,2BAA2B,EAC3B,KAAK,uCAAuC,GAC7C,MAAM,yCAAyC,CAAA;AAChD,OAAO,EACL,sBAAsB,EACtB,KAAK,6BAA6B,GACnC,MAAM,oCAAoC,CAAA;AAG3C,OAAO,EACL,6BAA6B,EAC7B,KAAK,yCAAyC,GAC/C,MAAM,2CAA2C,CAAA;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EACL,sBAAsB,EACtB,KAAK,kCAAkC,GACxC,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACL,wBAAwB,EACxB,KAAK,oCAAoC,GAC1C,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EACL,+BAA+B,EAC/B,KAAK,2CAA2C,GACjD,MAAM,6CAA6C,CAAA;AACpD,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,KAAK,sCAAsC,GAC5C,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,mBAAmB,EACnB,KAAK,+BAA+B,GACrC,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,uBAAuB,EACvB,KAAK,mCAAmC,GACzC,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,uBAAuB,EACvB,KAAK,mCAAmC,GACzC,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,UAAU,EACV,cAAc,EACd,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,aAAa,GACnB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,4BAA4B,EAC5B,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,KAAK,QAAQ,EACb,KAAK,aAAa,GACnB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,YAAY,EACZ,SAAS,EACT,UAAU,EACV,mBAAmB,EACnB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,qBAAqB,EACrB,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,yBAAyB,EACzB,UAAU,EACV,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,WAAW,GACZ,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,gCAAgC,EAChC,0BAA0B,EAC1B,KAAK,qBAAqB,GAC3B,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EACL,yBAAyB,EACzB,KAAK,0BAA0B,GAChC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,4BAA4B,CAAA;AAInC,cAAc,0BAA0B,CAAA;AACxC,cAAc,kCAAkC,CAAA;AAGhD,cAAc,yBAAyB,CAAA;AAMvC,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,KAAK,oBAAoB,EACzB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,qCAAqC,CAAA;AAK5C,OAAO,EACL,uBAAuB,EACvB,KAAK,6BAA6B,GACnC,MAAM,qCAAqC,CAAA;AAI5C,OAAO,EACL,8BAA8B,EAC9B,KAAK,kCAAkC,EACvC,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,8BAA8B,GACpC,MAAM,sCAAsC,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAE,KAAK,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EACL,KAAK,MAAM,EACX,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,eAAe,GACrB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAA;AAC9E,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AAC/E,OAAO,EAAE,mBAAmB,EAAE,KAAK,yBAAyB,EAAE,MAAM,6BAA6B,CAAA;AACjG,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAA;AAC/E,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,KAAK,mBAAmB,GACzB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAClE,OAAO,EACL,WAAW,EACX,KAAK,uBAAuB,EAC5B,KAAK,cAAc,GACpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,WAAW,EACX,KAAK,uBAAuB,EAC5B,KAAK,cAAc,GACpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,WAAW,EAAE,KAAK,uBAAuB,EAAE,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAA;AAC7E,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,SAAS,GACf,MAAM,yCAAyC,CAAA;AAIhD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAA;AAC3E,OAAO,EACL,sBAAsB,EACtB,KAAK,kCAAkC,EACvC,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,GAC5B,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,uBAAuB,EAAE,KAAK,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAClG,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAC1F,OAAO,EACL,iCAAiC,EACjC,uBAAuB,EACvB,KAAK,0BAA0B,GAChC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,4BAA4B,EAC5B,KAAK,kBAAkB,GACxB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACL,yBAAyB,EACzB,KAAK,qCAAqC,GAC3C,MAAM,uCAAuC,CAAA;AAC9C,OAAO,EACL,0BAA0B,EAC1B,KAAK,sCAAsC,GAC5C,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,6BAA6B,EAClC,KAAK,8BAA8B,EACnC,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,YAAY,GAClB,MAAM,+BAA+B,CAAA;AAGtC,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,oBAAoB,EACpB,6BAA6B,EAC7B,yBAAyB,EACzB,UAAU,GACX,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,qBAAqB,EACrB,KAAK,6BAA6B,GACnC,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EACL,oBAAoB,EACpB,KAAK,gCAAgC,GACtC,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,sBAAsB,GACvB,MAAM,2BAA2B,CAAA;AAIlC,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,6BAA6B,EAC7B,gCAAgC,EAChC,yBAAyB,EACzB,WAAW,GACZ,MAAM,8BAA8B,CAAA;AAKrC,OAAO,EACL,KAAK,4BAA4B,EACjC,KAAK,yBAAyB,EAC9B,KAAK,oCAAoC,EACzC,KAAK,gCAAgC,EACrC,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,yCAAyC,CAAA;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,UAAU,EACV,oBAAoB,EACpB,0BAA0B,EAC1B,wBAAwB,EACxB,QAAQ,EACR,KAAK,aAAa,GACnB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAA;AACjG,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EAAE,eAAe,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAA;AACjF,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAIlG,OAAO,EACL,qBAAqB,EACrB,KAAK,4BAA4B,GAClC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAA;AAEzF,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,4BAA4B,CAAA;AAEnC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC3F,OAAO,EACL,aAAa,EACb,KAAK,yBAAyB,EAC9B,mCAAmC,GACpC,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,aAAa,EAClB,KAAK,cAAc,GACpB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AAKpF,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,KAAK,6BAA6B,GACnC,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,2BAA2B,EAC3B,KAAK,uCAAuC,GAC7C,MAAM,yCAAyC,CAAA;AAChD,OAAO,EACL,sBAAsB,EACtB,KAAK,6BAA6B,GACnC,MAAM,oCAAoC,CAAA;AAG3C,OAAO,EACL,6BAA6B,EAC7B,KAAK,yCAAyC,GAC/C,MAAM,2CAA2C,CAAA;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EACL,sBAAsB,EACtB,KAAK,kCAAkC,GACxC,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACL,wBAAwB,EACxB,KAAK,oCAAoC,GAC1C,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EACL,+BAA+B,EAC/B,KAAK,2CAA2C,GACjD,MAAM,6CAA6C,CAAA;AACpD,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,KAAK,sCAAsC,GAC5C,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,mBAAmB,EACnB,KAAK,+BAA+B,GACrC,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,uBAAuB,EACvB,KAAK,mCAAmC,GACzC,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,uBAAuB,EACvB,KAAK,mCAAmC,GACzC,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,UAAU,EACV,cAAc,EACd,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,aAAa,GACnB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,4BAA4B,EAC5B,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,KAAK,QAAQ,EACb,KAAK,aAAa,GACnB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,YAAY,EACZ,SAAS,EACT,UAAU,EACV,mBAAmB,EACnB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,qBAAqB,EACrB,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,yBAAyB,EACzB,UAAU,EACV,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,WAAW,GACZ,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,gCAAgC,EAChC,0BAA0B,EAC1B,KAAK,qBAAqB,GAC3B,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EACL,yBAAyB,EACzB,KAAK,0BAA0B,GAChC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,4BAA4B,CAAA;AAInC,cAAc,0BAA0B,CAAA;AACxC,cAAc,kCAAkC,CAAA;AAGhD,cAAc,yBAAyB,CAAA;AAMvC,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,KAAK,oBAAoB,EACzB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,qCAAqC,CAAA;AAK5C,OAAO,EACL,uBAAuB,EACvB,KAAK,6BAA6B,GACnC,MAAM,qCAAqC,CAAA;AAI5C,OAAO,EACL,8BAA8B,EAC9B,KAAK,kCAAkC,EACvC,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,8BAA8B,GACpC,MAAM,sCAAsC,CAAA"}

package/dist/index.js

@@ -41,6 +41,10 @@ export { registerCoreControllers } from './app.js';
 export { FanOutEventPublisher, } from './events/FanOutEventPublisher.js';
 export { InAppNotificationChannel } from './events/InAppNotificationChannel.js';
 export { HttpMachineEventClient, } from './events/machineEvents.js';
+// The INBOUND half of mothership real-time: the shared authorisation for a node's long-lived
+// subscription to a workspace's stream. Exported because BOTH facades reach the handshake — the
+// Worker through the shared controller, Node from its HTTP-server `upgrade` listener.
+export { MACHINE_EVENTS_SUBSCRIBE_PATH, MACHINE_EVENTS_SUBSCRIBE_PATTERN, authorizeMachineSubscribe, stripBearer, } from './events/machineSubscribe.js';
 // Mothership-mode notification DELIVERY delegation: the mothership re-reads a laptop-raised
 // notification row and delivers it through the org's external channels (its Slack token never
 // reaches the laptop); a mothership-mode local node plugs `RemoteNotificationChannel` into the

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,gFAAgF;AAChF,8EAA8E;AAC9E,qEAAqE;AACrE,OAAO,EAAE,MAAM,EAAe,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAKN,MAAM,eAAe,CAAA;AACtB,OAAO,EAaN,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAA;AAC9E,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AAC/E,OAAO,EAAE,mBAAmB,EAAkC,MAAM,6BAA6B,CAAA;AACjG,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAA;AAC/E,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GAEpB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,WAAW,EAAqB,MAAM,mBAAmB,CAAA;AAClE,OAAO,EACL,WAAW,GAGZ,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,WAAW,GAGZ,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,WAAW,EAAgC,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAA;AAC7E,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EACL,uBAAuB,EACvB,sBAAsB,GAGvB,MAAM,yCAAyC,CAAA;AAChD,mFAAmF;AACnF,kFAAkF;AAClF,oFAAoF;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAA;AAC3E,OAAO,EACL,sBAAsB,GASvB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,uBAAuB,EAA8B,MAAM,8BAA8B,CAAA;AAClG,OAAO,EAAE,eAAe,EAA+B,MAAM,6BAA6B,CAAA;AAC1F,OAAO,EACL,iCAAiC,EACjC,uBAAuB,GAExB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,4BAA4B,GAE7B,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACL,yBAAyB,GAE1B,MAAM,uCAAuC,CAAA;AAC9C,OAAO,EACL,0BAA0B,GAE3B,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GAMxB,MAAM,+BAA+B,CAAA;AACtC,qFAAqF;AACrF,4FAA4F;AAC5F,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,oBAAoB,EACpB,6BAA6B,EAC7B,yBAAyB,EACzB,UAAU,GACX,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,qBAAqB,GAEtB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EACL,oBAAoB,GAErB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAIL,sBAAsB,GACvB,MAAM,2BAA2B,CAAA;AAClC,4FAA4F;AAC5F,8FAA8F;AAC9F,+FAA+F;AAC/F,2CAA2C;AAC3C,OAAO,EAKL,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,yCAAyC,CAAA;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,UAAU,EACV,oBAAoB,EACpB,0BAA0B,EAC1B,wBAAwB,EACxB,QAAQ,GAET,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAA;AACjG,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EAAE,eAAe,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAA;AACjF,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAClG,kFAAkF;AAClF,8EAA8E;AAC9E,kEAAkE;AAClE,OAAO,EACL,qBAAqB,GAEtB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAA;AACzF,kFAAkF;AAClF,OAAO,EACL,qBAAqB,EACrB,mBAAmB,GAGpB,MAAM,4BAA4B,CAAA;AACnC,oFAAoF;AACpF,OAAO,EAAE,aAAa,EAAE,WAAW,EAAuB,MAAM,2BAA2B,CAAA;AAC3F,OAAO,EACL,aAAa,EAEb,mCAAmC,GACpC,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,iBAAiB,GAIlB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AACpF,gFAAgF;AAChF,kFAAkF;AAClF,qFAAqF;AACrF,6BAA6B;AAC7B,OAAO,EACL,iBAAiB,EACjB,cAAc,GAEf,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,2BAA2B,GAE5B,MAAM,yCAAyC,CAAA;AAChD,OAAO,EACL,sBAAsB,GAEvB,MAAM,oCAAoC,CAAA;AAC3C,oFAAoF;AACpF,qEAAqE;AACrE,OAAO,EACL,6BAA6B,GAE9B,MAAM,2CAA2C,CAAA;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EACL,sBAAsB,GAEvB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACL,wBAAwB,GAEzB,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EACL,+BAA+B,GAEhC,MAAM,6CAA6C,CAAA;AACpD,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,GAErB,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,mBAAmB,GAEpB,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,uBAAuB,GAExB,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,uBAAuB,GAExB,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,UAAU,EACV,cAAc,GAKf,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,4BAA4B,EAC5B,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,GAGb,MAAM,oBAAoB,CAAA;AAyB3B,OAAO,EACL,gCAAgC,EAChC,0BAA0B,GAE3B,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EACL,yBAAyB,GAE1B,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,4BAA4B,CAAA;AAEnC,mFAAmF;AACnF,iEAAiE;AACjE,cAAc,0BAA0B,CAAA;AACxC,cAAc,kCAAkC,CAAA;AAChD,4FAA4F;AAC5F,6FAA6F;AAC7F,cAAc,yBAAyB,CAAA;AAEvC,6FAA6F;AAC7F,wFAAwF;AACxF,6FAA6F;AAC7F,0EAA0E;AAC1E,OAAO,EAWL,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAEL,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,qCAAqC,CAAA;AAC5C,yFAAyF;AACzF,wFAAwF;AACxF,2FAA2F;AAC3F,uFAAuF;AACvF,OAAO,EACL,uBAAuB,GAExB,MAAM,qCAAqC,CAAA;AAE5C,2FAA2F;AAC3F,sEAAsE;AACtE,OAAO,EACL,8BAA8B,GAK/B,MAAM,sCAAsC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,gFAAgF;AAChF,8EAA8E;AAC9E,qEAAqE;AACrE,OAAO,EAAE,MAAM,EAAe,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAKN,MAAM,eAAe,CAAA;AACtB,OAAO,EAaN,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAA;AAC9E,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AAC/E,OAAO,EAAE,mBAAmB,EAAkC,MAAM,6BAA6B,CAAA;AACjG,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAA;AAC/E,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GAEpB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,WAAW,EAAqB,MAAM,mBAAmB,CAAA;AAClE,OAAO,EACL,WAAW,GAGZ,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,WAAW,GAGZ,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,WAAW,EAAgC,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAA;AAC7E,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EACL,uBAAuB,EACvB,sBAAsB,GAGvB,MAAM,yCAAyC,CAAA;AAChD,mFAAmF;AACnF,kFAAkF;AAClF,oFAAoF;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAA;AAC3E,OAAO,EACL,sBAAsB,GASvB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,uBAAuB,EAA8B,MAAM,8BAA8B,CAAA;AAClG,OAAO,EAAE,eAAe,EAA+B,MAAM,6BAA6B,CAAA;AAC1F,OAAO,EACL,iCAAiC,EACjC,uBAAuB,GAExB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,4BAA4B,GAE7B,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACL,yBAAyB,GAE1B,MAAM,uCAAuC,CAAA;AAC9C,OAAO,EACL,0BAA0B,GAE3B,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GAMxB,MAAM,+BAA+B,CAAA;AACtC,qFAAqF;AACrF,4FAA4F;AAC5F,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,oBAAoB,EACpB,6BAA6B,EAC7B,yBAAyB,EACzB,UAAU,GACX,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,qBAAqB,GAEtB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EACL,oBAAoB,GAErB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAIL,sBAAsB,GACvB,MAAM,2BAA2B,CAAA;AAClC,6FAA6F;AAC7F,gGAAgG;AAChG,sFAAsF;AACtF,OAAO,EAGL,6BAA6B,EAC7B,gCAAgC,EAChC,yBAAyB,EACzB,WAAW,GACZ,MAAM,8BAA8B,CAAA;AACrC,4FAA4F;AAC5F,8FAA8F;AAC9F,+FAA+F;AAC/F,2CAA2C;AAC3C,OAAO,EAKL,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,yCAAyC,CAAA;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,UAAU,EACV,oBAAoB,EACpB,0BAA0B,EAC1B,wBAAwB,EACxB,QAAQ,GAET,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAA;AACjG,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EAAE,eAAe,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAA;AACjF,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAClG,kFAAkF;AAClF,8EAA8E;AAC9E,kEAAkE;AAClE,OAAO,EACL,qBAAqB,GAEtB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAA;AACzF,kFAAkF;AAClF,OAAO,EACL,qBAAqB,EACrB,mBAAmB,GAGpB,MAAM,4BAA4B,CAAA;AACnC,oFAAoF;AACpF,OAAO,EAAE,aAAa,EAAE,WAAW,EAAuB,MAAM,2BAA2B,CAAA;AAC3F,OAAO,EACL,aAAa,EAEb,mCAAmC,GACpC,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,iBAAiB,GAIlB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AACpF,gFAAgF;AAChF,kFAAkF;AAClF,qFAAqF;AACrF,6BAA6B;AAC7B,OAAO,EACL,iBAAiB,EACjB,cAAc,GAEf,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,2BAA2B,GAE5B,MAAM,yCAAyC,CAAA;AAChD,OAAO,EACL,sBAAsB,GAEvB,MAAM,oCAAoC,CAAA;AAC3C,oFAAoF;AACpF,qEAAqE;AACrE,OAAO,EACL,6BAA6B,GAE9B,MAAM,2CAA2C,CAAA;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EACL,sBAAsB,GAEvB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACL,wBAAwB,GAEzB,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EACL,+BAA+B,GAEhC,MAAM,6CAA6C,CAAA;AACpD,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,GAErB,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,mBAAmB,GAEpB,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,uBAAuB,GAExB,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,uBAAuB,GAExB,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,UAAU,EACV,cAAc,GAKf,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,4BAA4B,EAC5B,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,GAGb,MAAM,oBAAoB,CAAA;AAyB3B,OAAO,EACL,gCAAgC,EAChC,0BAA0B,GAE3B,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EACL,yBAAyB,GAE1B,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,4BAA4B,CAAA;AAEnC,mFAAmF;AACnF,iEAAiE;AACjE,cAAc,0BAA0B,CAAA;AACxC,cAAc,kCAAkC,CAAA;AAChD,4FAA4F;AAC5F,6FAA6F;AAC7F,cAAc,yBAAyB,CAAA;AAEvC,6FAA6F;AAC7F,wFAAwF;AACxF,6FAA6F;AAC7F,0EAA0E;AAC1E,OAAO,EAWL,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAEL,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,qCAAqC,CAAA;AAC5C,yFAAyF;AACzF,wFAAwF;AACxF,2FAA2F;AAC3F,uFAAuF;AACvF,OAAO,EACL,uBAAuB,GAExB,MAAM,qCAAqC,CAAA;AAE5C,2FAA2F;AAC3F,sEAAsE;AACtE,OAAO,EACL,8BAA8B,GAK/B,MAAM,sCAAsC,CAAA"}

package/dist/modules/events/EventsRelayController.d.ts

@@ -1,7 +1,9 @@
 import { Hono } from 'hono';
 import type { AppEnv } from '../../http/env.js';
 /**
- * The mothership-mode real-time UPSTREAM machine API: `POST /internal/events/publish`.
+ * The mothership-mode real-time machine API — BOTH directions:
+ * `POST /internal/events/publish` (upstream) and
+ * `GET /internal/events/subscribe/:workspaceId` (inbound).
  *
  * A mothership-mode local node runs the engine locally but delegates org/durable state to the
  * mothership. Its engine events must ALSO reach the mothership's real-time fan-out, so a hosted

package/dist/modules/events/EventsRelayController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"EventsRelayController.d.ts","sourceRoot":"","sources":["../../../src/modules/events/EventsRelayController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAU/C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAAC,MAAM,CAAC,CAuFpD"}
+{"version":3,"file":"EventsRelayController.d.ts","sourceRoot":"","sources":["../../../src/modules/events/EventsRelayController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAI3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAW/C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAAC,MAAM,CAAC,CA0IpD"}

package/dist/modules/events/EventsRelayController.js

@@ -1,5 +1,7 @@
 import { Hono } from 'hono';
 import { TOKEN_AUDIENCE, signerFor } from '../../auth/signing.js';
+import { authorizeMachineSubscribe } from '../../events/machineSubscribe.js';
+import { param } from '../../http/params.js';
 /**
  * Upper bound on a relayed `payload` frame (characters). A serialized `WorkspaceEvent` is small
  * (ids + a reason + a compact instance snapshot); 1 MiB is a generous ceiling that still brakes a
@@ -8,7 +10,9 @@ import { TOKEN_AUDIENCE, signerFor } from '../../auth/signing.js';
  */
 const MAX_RELAYED_PAYLOAD_CHARS = 1_000_000;
 /**
- * The mothership-mode real-time UPSTREAM machine API: `POST /internal/events/publish`.
+ * The mothership-mode real-time machine API — BOTH directions:
+ * `POST /internal/events/publish` (upstream) and
+ * `GET /internal/events/subscribe/:workspaceId` (inbound).
  *
  * A mothership-mode local node runs the engine locally but delegates org/durable state to the
  * mothership. Its engine events must ALSO reach the mothership's real-time fan-out, so a hosted
@@ -91,6 +95,51 @@ export function eventsRelayController() {
         }
         return c.json({ ok: true });
     });
+    // The INBOUND leg: the node subscribes to a workspace's stream so org activity raised on the
+    // mothership (a hosted teammate, or a peer laptop relaying upstream) reaches the laptop's SPA.
+    //
+    // It is deliberately NOT a new fan-out. The upgrade is handed to the SAME per-workspace realtime
+    // transport the browser stream uses (`gateways.realtime.upgrade` — the `WorkspaceEventsHub`
+    // Durable Object on Cloudflare), so a subscribed node is just another socket in the workspace's
+    // room and every event reaches laptops and browsers through one code path. The node's stable
+    // `?cid=` rides through to that transport, which is what lets the mothership skip echoing the
+    // node's OWN relayed events back to it (the outbound leg stamps the same id as
+    // `originConnectionId`).
+    //
+    // Auth is the shared `authorizeMachineSubscribe` (token pin → capability → account scope), the
+    // same helper the Node facade calls from its HTTP-server `upgrade` listener — Node can't upgrade
+    // from a Hono `Response`, so this handler is unreachable there, exactly like the browser stream's
+    // GET in `eventsController`.
+    app.get(`/internal/events/subscribe/:workspaceId`, async (c) => {
+        const container = c.get('container');
+        const workspaceId = param(c, 'workspaceId');
+        // The scope resolution reuses the mothership's own repository registry (attached alongside the
+        // relay on every mothership), exactly like the publish handler above. The registry is
+        // reflective (`Record<string, Record<string, fn>>`), so narrow the one method we call.
+        const workspaceRepository = container.repositories?.workspaceRepository;
+        const auth = await authorizeMachineSubscribe({
+            auth: container.config.auth,
+            token: c.req.header('authorization'),
+            workspaceId,
+            accountOf: workspaceRepository?.accountOf
+                ? (id) => workspaceRepository.accountOf(id)
+                : undefined,
+        });
+        if (!auth.ok) {
+            return c.json({
+                ok: false,
+                error: { code: auth.status === 404 ? 'not_found' : 'forbidden', message: auth.message },
+            }, auth.status);
+        }
+        // Checked AFTER auth so the handshake shape isn't probeable without a token.
+        if (c.req.header('Upgrade')?.toLowerCase() !== 'websocket') {
+            return c.text('expected a websocket upgrade', 426);
+        }
+        const upgraded = await container.gateways.realtime.upgrade(workspaceId, c.req.raw);
+        if (!upgraded)
+            return c.text('real-time events are not enabled', 501);
+        return upgraded;
+    });
     return app;
 }
 //# sourceMappingURL=EventsRelayController.js.map

package/dist/modules/events/EventsRelayController.js.map

@@ -1 +1 @@
-{"version":3,"file":"EventsRelayController.js","sourceRoot":"","sources":["../../../src/modules/events/EventsRelayController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAuB,cAAc,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAItF;;;;;GAKG;AACH,MAAM,yBAAyB,GAAG,SAAS,CAAA;AAE3C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,qBAAqB;IACnC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAEpC,0FAA0F;QAC1F,yBAAyB;QACzB,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAA;QAClD,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAA;QACvE,MAAM,OAAO,GAAG,MAAM;YACpB,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,MAAM,CAAiB,KAAK,EAAE,EAAE,GAAG,EAAE,cAAc,CAAC,OAAO,EAAE,CAAC;YACxF,CAAC,CAAC,IAAI,CAAA;QACR,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,EAC7E,GAAG,CACJ,CAAA;QACH,CAAC;QAED,MAAM,KAAK,GAAG,SAAS,CAAC,iBAAiB,CAAA;QACzC,yFAAyF;QACzF,4FAA4F;QAC5F,MAAM,mBAAmB,GAAG,SAAS,CAAC,YAAY,EAAE,mBAAmB,CAAA;QACvE,IAAI,CAAC,KAAK,IAAI,CAAC,mBAAmB,EAAE,SAAS,EAAE,CAAC;YAC9C,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,EAC9E,GAAG,CACJ,CAAA;QACH,CAAC;QAED,IAAI,IAA0B,CAAA;QAC9B,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAA;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,EAC7E,GAAG,CACJ,CAAA;QACH,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACtF,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,sCAAsC,EAAE;aAC/E,EACD,GAAG,CACJ,CAAA;QACH,CAAC;QACD,iGAAiG;QACjG,wFAAwF;QACxF,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC;YACpD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;QAChG,CAAC;QAED,iGAAiG;QACjG,kGAAkG;QAClG,+FAA+F;QAC/F,mBAAmB;QACnB,MAAM,SAAS,GAAG,CAAC,MACjB,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAC/C,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAA8B,CAAA;QACtD,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAChE,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAAE,EAC3E,GAAG,CACJ,CAAA;QACH,CAAC;QAED,+FAA+F;QAC/F,gGAAgG;QAChG,kGAAkG;QAClG,6EAA6E;QAC7E,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,MAAM,CAAC;gBACjB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,kBAAkB,EAChB,OAAO,IAAI,CAAC,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI;aAC/E,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;QACvC,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7B,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"EventsRelayController.js","sourceRoot":"","sources":["../../../src/modules/events/EventsRelayController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAuB,cAAc,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAEtF,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAA;AAE5E,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAE5C;;;;;GAKG;AACH,MAAM,yBAAyB,GAAG,SAAS,CAAA;AAE3C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,qBAAqB;IACnC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAEpC,0FAA0F;QAC1F,yBAAyB;QACzB,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAA;QAClD,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAA;QACvE,MAAM,OAAO,GAAG,MAAM;YACpB,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,MAAM,CAAiB,KAAK,EAAE,EAAE,GAAG,EAAE,cAAc,CAAC,OAAO,EAAE,CAAC;YACxF,CAAC,CAAC,IAAI,CAAA;QACR,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,EAC7E,GAAG,CACJ,CAAA;QACH,CAAC;QAED,MAAM,KAAK,GAAG,SAAS,CAAC,iBAAiB,CAAA;QACzC,yFAAyF;QACzF,4FAA4F;QAC5F,MAAM,mBAAmB,GAAG,SAAS,CAAC,YAAY,EAAE,mBAAmB,CAAA;QACvE,IAAI,CAAC,KAAK,IAAI,CAAC,mBAAmB,EAAE,SAAS,EAAE,CAAC;YAC9C,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,EAC9E,GAAG,CACJ,CAAA;QACH,CAAC;QAED,IAAI,IAA0B,CAAA;QAC9B,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAA;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,EAC7E,GAAG,CACJ,CAAA;QACH,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACtF,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,sCAAsC,EAAE;aAC/E,EACD,GAAG,CACJ,CAAA;QACH,CAAC;QACD,iGAAiG;QACjG,wFAAwF;QACxF,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC;YACpD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;QAChG,CAAC;QAED,iGAAiG;QACjG,kGAAkG;QAClG,+FAA+F;QAC/F,mBAAmB;QACnB,MAAM,SAAS,GAAG,CAAC,MACjB,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAC/C,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAA8B,CAAA;QACtD,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAChE,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAAE,EAC3E,GAAG,CACJ,CAAA;QACH,CAAC;QAED,+FAA+F;QAC/F,gGAAgG;QAChG,kGAAkG;QAClG,6EAA6E;QAC7E,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,MAAM,CAAC;gBACjB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,kBAAkB,EAChB,OAAO,IAAI,CAAC,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI;aAC/E,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;QACvC,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7B,CAAC,CAAC,CAAA;IAEF,6FAA6F;IAC7F,+FAA+F;IAC/F,EAAE;IACF,iGAAiG;IACjG,4FAA4F;IAC5F,gGAAgG;IAChG,6FAA6F;IAC7F,8FAA8F;IAC9F,+EAA+E;IAC/E,yBAAyB;IACzB,EAAE;IACF,+FAA+F;IAC/F,iGAAiG;IACjG,kGAAkG;IAClG,6BAA6B;IAC7B,GAAG,CAAC,GAAG,CAAC,yCAAyC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7D,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACpC,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAA;QAE3C,+FAA+F;QAC/F,sFAAsF;QACtF,uFAAuF;QACvF,MAAM,mBAAmB,GAAG,SAAS,CAAC,YAAY,EAAE,mBAAmB,CAAA;QACvE,MAAM,IAAI,GAAG,MAAM,yBAAyB,CAAC;YAC3C,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI;YAC3B,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC;YACpC,WAAW;YACX,SAAS,EAAE,mBAAmB,EAAE,SAAS;gBACvC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,mBAAmB,CAAC,SAAU,CAAC,EAAE,CAAuC;gBAClF,CAAC,CAAC,SAAS;SACd,CAAC,CAAA;QACF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;aACxF,EACD,IAAI,CAAC,MAAM,CACZ,CAAA;QACH,CAAC;QAED,6EAA6E;QAC7E,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,WAAW,EAAE,CAAC;YAC3D,OAAO,CAAC,CAAC,IAAI,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAA;QACpD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAClF,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAA;QACrE,OAAO,QAAQ,CAAA;IACjB,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/persistence/rpc-allowlist.d.ts

@@ -0,0 +1,37 @@
+import type { PersistenceMethodTable } from './rpc.js';
+/**
+ * The mothership-mode persistence allow-list: the core domain repositories plus the
+ * workspace-scoped reads a board load (`GET /workspaces/:id`) and an execution exercise.
+ * Every method here binds to an account via its {@link ScopeRule} so a call outside the
+ * machine token's scope is refused as 404.
+ *
+ * The cross-service board-composition reads keyed on `serviceIds[]`/`accountId`
+ * (`listByServices`, `serviceRepository.listByIds`/`listByAccount`, `countByServiceIds`) and the
+ * entity-id-keyed `blockRepository.findById` are allow-listed here too, each bound by the
+ * {@link ScopeRule} `serviceList` / `block` / `account` kinds that resolve the entity's owning
+ * account server-side before the scope check.
+ *
+ * Still EXCLUDED (added in later gate slices, with their own scope rules, or kept
+ * mothership-internal):
+ *   - `subscriptionActivationRepository.deleteByExecution` — the activation row is the local
+ *     `node:sqlite` bucket (per the per-repo checklist), not the remote surface, so it is not
+ *     exposed here.
+ *   - Global sweeper methods (`listStale`, `deleteOlderThan`) and high-impact unscoped ops
+ *     (`workspaceRepository.delete`, `accountRepository.create`).
+ *
+ * Admin-gated mutations are also EXCLUDED here. The RPC dispatches over the raw repository,
+ * bypassing the service layer that normally enforces per-user role checks — e.g.
+ * `AccountService.requireAdmin` guards `accountRepository.rename`/`updateSettings` and
+ * `membershipRepository.upsert`/`remove`. A machine token is scoped to whole ACCOUNTS, not to
+ * a role within them, so exposing those repo methods would let any account member self-promote
+ * to admin or rewrite memberships over the wire. They stay mothership-internal until a later
+ * slice adds a role dimension to the scope (or routes them through the service). Only the
+ * account/membership READS a board load needs are remotely callable. Board-level mutations
+ * (`workspaceRepository.rename`/`setDescription`, block/pipeline/execution CRUD) are
+ * member-level in the service layer, so they remain. The board mutations that stay OUT are
+ * `workspaceRepository.setAccessMode` (the access-mode flip) and `linkAccount` (the legacy-board
+ * auto-heal that adopts a board into an account) — both are `members.manage` (admin-tier), so like
+ * the account/membership admin mutations they must not be reachable over the role-blind machine RPC.
+ */
+export declare const REMOTE_PERSISTENCE_METHODS: PersistenceMethodTable;
+//# sourceMappingURL=rpc-allowlist.d.ts.map

package/dist/persistence/rpc-allowlist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rpc-allowlist.d.ts","sourceRoot":"","sources":["../../src/persistence/rpc-allowlist.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAA;AAgBtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,0BAA0B,EAAE,sBA01BxC,CAAA"}