@hotmeshio/long-tail 0.23.2 → 0.24.1

package/build/api/settings.js

@@ -10,6 +10,7 @@ const config_1 = require("../modules/config");
 const features_1 = require("../modules/features");
 const search_1 = require("../modules/search");
 const branding_1 = require("../modules/branding");
+const oauth_server_1 = require("../modules/oauth-server");
 const display_1 = require("../modules/display");
 const version_1 = require("../modules/version");
 const sso_1 = require("../modules/sso");
@@ -66,6 +67,12 @@ async function getSettings(req) {
                 events: {
                     transport,
                     natsWsUrl: natsAdapter ? resolveNatsWsUrl(natsAdapter, req) : null,
+                    reconnect: {
+                        initialDelayMs: config_1.config.NATS_RECONNECT_INITIAL_MS,
+                        maxDelayMs: config_1.config.NATS_RECONNECT_MAX_MS,
+                        noticeAfterMs: config_1.config.NATS_LIVE_NOTICE_AFTER_MS,
+                        spreadMs: config_1.config.NATS_RECONNECT_SPREAD_MS,
+                    },
                 },
                 auth: {
                     sso: (0, sso_1.isSSOEnabled)(),
@@ -73,6 +80,8 @@ async function getSettings(req) {
                     // Session keepalive dials for the SPA (null = no keepalive / no idle gate).
                     ssoKeepaliveSeconds: (0, sso_1.getSSOConfig)()?.keepaliveSeconds ?? null,
                     ssoKeepaliveIdleTimeoutSeconds: (0, sso_1.getSSOConfig)()?.keepaliveIdleTimeoutSeconds ?? null,
+                    // The OAuth authorization server for MCP clients (Connected apps).
+                    oauthServer: (0, oauth_server_1.getOAuthServerSettings)() !== null,
                 },
                 ai: {
                     enabled: (0, llm_1.hasLLMApiKey)(),

package/build/api/tasks.d.ts

@@ -47,7 +47,7 @@ export declare function listTasks(input: {
     origin_id?: string;
     limit?: number;
     offset?: number;
-}): Promise<LTApiResult>;
+}, auth?: LTApiAuth): Promise<LTApiResult>;
 /**
  * Return aggregate process statistics.
  *
@@ -82,7 +82,7 @@ export declare function listProcesses(input: {
  */
 export declare function getProcess(input: {
     originId: string;
-}): Promise<LTApiResult>;
+}, auth?: LTApiAuth): Promise<LTApiResult>;
 /**
  * Get a single task by ID.
  *
@@ -91,4 +91,4 @@ export declare function getProcess(input: {
  */
 export declare function getTask(input: {
     id: string;
-}): Promise<LTApiResult>;
+}, auth?: LTApiAuth): Promise<LTApiResult>;

package/build/api/tasks.js

@@ -41,6 +41,24 @@ exports.getProcess = getProcess;
 exports.getTask = getTask;
 const taskService = __importStar(require("../services/task"));
 const escalationService = __importStar(require("../services/escalation"));
+const helpers_1 = require("./escalations/helpers");
+const capabilities_1 = require("../modules/capabilities");
+/**
+ * How a caller sees task rows. A builder, and the person a run was started by
+ * or runs as, see the whole row; anyone else sees it without the run's input
+ * (`envelope`), output (`data`) and `metadata`. An in-process call (no auth)
+ * sees whole rows.
+ */
+async function taskViewFor(auth) {
+    if (!auth?.userId || (await (0, capabilities_1.mayBuild)(auth)))
+        return (task) => task;
+    return (task) => {
+        if (task.initiated_by === auth.userId || task.executing_as === auth.userId)
+            return task;
+        const { envelope: _envelope, data: _data, metadata: _metadata, ...rest } = task;
+        return rest;
+    };
+}
 /**
  * Create a task record.
  *
@@ -104,10 +122,10 @@ async function createTask(input, auth) {
  * @param input.offset — pagination offset (default: 0)
  * @returns `{ status: 200, data: { tasks, total } }`
  */
-async function listTasks(input) {
+async function listTasks(input, auth) {
     try {
-        const result = await taskService.listTasks(input);
-        return { status: 200, data: result };
+        const [result, view] = await Promise.all([taskService.listTasks(input), taskViewFor(auth)]);
+        return { status: 200, data: { ...result, tasks: result.tasks.map(view) } };
     }
     catch (err) {
         return { status: 500, error: err.message };
@@ -153,12 +171,17 @@ async function listProcesses(input) {
  * @param input.originId — root process origin ID
  * @returns `{ status: 200, data: { origin_id, tasks, escalations } }`
  */
-async function getProcess(input) {
+async function getProcess(input, auth) {
     try {
-        const [tasks, escalations] = await Promise.all([
+        const [rows, all, view] = await Promise.all([
             taskService.getProcessTasks(input.originId),
             escalationService.getEscalationsByOriginId(input.originId),
+            taskViewFor(auth),
         ]);
+        const tasks = rows.map(view);
+        // With a caller, only the escalations that caller may read.
+        const scope = auth?.userId ? await (0, helpers_1.getEscalationReadScope)(auth.userId) : null;
+        const escalations = scope ? all.filter((e) => (0, helpers_1.scopeAdmits)(scope, auth.userId, e)) : all;
         return {
             status: 200,
             data: { origin_id: input.originId, tasks, escalations },
@@ -174,13 +197,13 @@ async function getProcess(input) {
  * @param input.id — task UUID
  * @returns `{ status: 200, data: <task record> }` or 404
  */
-async function getTask(input) {
+async function getTask(input, auth) {
     try {
         const task = await taskService.getTask(input.id);
         if (!task) {
             return { status: 404, error: 'Task not found' };
         }
-        return { status: 200, data: task };
+        return { status: 200, data: (await taskViewFor(auth))(task) };
     }
     catch (err) {
         return { status: 500, error: err.message };

package/build/api/workflows/input-lookups.js

@@ -57,7 +57,7 @@ async function getWorkflowInputLookups(input, auth) {
             return { status: 404, error: 'Workflow config not found' };
         }
         const user = auth.userId ? await userService.getUser(auth.userId) : null;
-        if (!(0, invocation_access_1.canInvokeWorkflow)(config, user?.roles ?? [], auth.role)) {
+        if (!(0, invocation_access_1.canInvokeWorkflow)(config, user?.roles ?? [])) {
             return { status: 403, error: 'Not authorized to invoke this workflow' };
         }
         const lookups = await (0, knowledge_1.resolveLookupRefs)(config.input_lookups ?? []);

package/build/api/workflows/invocable.js

@@ -88,9 +88,9 @@ async function listInvocableWorkflows(auth) {
         ]);
         const roles = user?.roles ?? [];
         const workflows = configs
-            .filter((c) => (0, invocation_access_1.canInvokeWorkflow)(c, roles, auth.role))
+            .filter((c) => (0, invocation_access_1.canInvokeWorkflow)(c, roles))
             .map((c) => ({ ...c, tier: tierOf(c) }));
-        if ((0, invocation_access_1.hasGlobalInvocationAccess)(roles, auth.role)) {
+        if ((0, invocation_access_1.hasGlobalInvocationAccess)(roles)) {
             const registered = new Set(configs.map((c) => c.workflow_type));
             for (const [name, { taskQueue }] of (0, registry_1.getRegisteredWorkers)()) {
                 if (registered.has(name) || registry_1.SYSTEM_WORKFLOWS.has(name))

package/build/api/workflows/invocation.js

@@ -62,7 +62,7 @@ function isResolveError(err) {
  */
 async function invokeWorkflow(input, auth) {
     try {
-        await (0, workflow_invocation_1.checkInvocationRoles)(input.type, auth.userId, auth.role);
+        await (0, workflow_invocation_1.authorizeInvocation)({ workflowType: input.type, userId: auth.userId, executeAs: input.execute_as });
         const config = await configService.getWorkflowConfig(input.type);
         const violation = await (0, input_validation_1.checkInvokeInput)(config, input.data, input.metadata);
         if (violation)

package/build/api/yaml-workflows/cron.d.ts

@@ -1,4 +1,4 @@
-import type { LTApiResult } from '../../types/sdk';
+import type { LTApiAuth, LTApiResult } from '../../types/sdk';
 /**
  * Set or update the cron schedule for a YAML workflow.
  *
@@ -9,6 +9,7 @@ import type { LTApiResult } from '../../types/sdk';
  * @param input.cron_schedule — cron expression (e.g. "0 * * * *")
  * @param input.cron_envelope — optional payload passed to each scheduled invocation
  * @param input.execute_as — optional identity override for scheduled executions
+ * @param auth - the scheduling caller; the run identity must be able to call every built-in tool the workflow uses
  * @returns `{ status: 200, data: YamlWorkflow }` the updated workflow record with cron fields set
  */
 export declare function setCronSchedule(input: {
@@ -16,7 +17,7 @@ export declare function setCronSchedule(input: {
     cron_schedule: string;
     cron_envelope?: any;
     execute_as?: string;
-}): Promise<LTApiResult>;
+}, auth?: LTApiAuth): Promise<LTApiResult>;
 /**
  * Remove the cron schedule from a YAML workflow.
  *

package/build/api/yaml-workflows/cron.js

@@ -38,6 +38,7 @@ exports.clearCronSchedule = clearCronSchedule;
 exports.getCronStatus = getCronStatus;
 const yamlDb = __importStar(require("../../services/yaml-workflow/db"));
 const cron_1 = require("../../services/cron");
+const deploy_1 = require("./deploy");
 const helpers_1 = require("./helpers");
 /**
  * Set or update the cron schedule for a YAML workflow.
@@ -49,14 +50,18 @@ const helpers_1 = require("./helpers");
  * @param input.cron_schedule — cron expression (e.g. "0 * * * *")
  * @param input.cron_envelope — optional payload passed to each scheduled invocation
  * @param input.execute_as — optional identity override for scheduled executions
+ * @param auth - the scheduling caller; the run identity must be able to call every built-in tool the workflow uses
  * @returns `{ status: 200, data: YamlWorkflow }` the updated workflow record with cron fields set
  */
-async function setCronSchedule(input) {
+async function setCronSchedule(input, auth) {
     try {
         const wf = await yamlDb.getYamlWorkflow(input.id);
         if (!wf) {
             return { status: 404, error: 'YAML workflow not found' };
         }
+        const refused = await (0, deploy_1.invokeRefusal)(wf, auth, input.execute_as);
+        if (refused)
+            return refused;
         if (!input.cron_schedule || typeof input.cron_schedule !== 'string') {
             return { status: 400, error: 'cron_schedule is required' };
         }

package/build/api/yaml-workflows/deploy.d.ts

@@ -1,3 +1,16 @@
+import type { LTYamlWorkflowRecord } from '../../types/yaml-workflow';
+/**
+ * Deploying or activating a compiled workflow needs the caller to be able to
+ * call every built-in tool it uses: automation never does more than its
+ * author may. Null when allowed; without a caller (in-process), allowed.
+ */
+export declare function deployRefusal(wf: LTYamlWorkflowRecord, auth: LTApiAuth | undefined): Promise<LTApiResult | null>;
+/**
+ * Invoking or scheduling a compiled workflow needs the identity it runs as
+ * (execute_as, else the caller) to be able to call every built-in tool it
+ * uses. Without a caller (in-process), allowed.
+ */
+export declare function invokeRefusal(wf: LTYamlWorkflowRecord, auth: LTApiAuth | undefined, executeAs?: string): Promise<LTApiResult | null>;
 import type { LTApiResult, LTApiAuth } from '../../types/sdk';
 /**
  * Deploy a YAML workflow and all sibling workflows sharing its app_id namespace.
@@ -11,7 +24,7 @@ import type { LTApiResult, LTApiAuth } from '../../types/sdk';
  */
 export declare function deployYamlWorkflow(input: {
     id: string;
-}): Promise<LTApiResult>;
+}, auth?: LTApiAuth): Promise<LTApiResult>;
 /**
  * Activate a previously deployed YAML workflow and its app_id siblings.
  *
@@ -24,7 +37,7 @@ export declare function deployYamlWorkflow(input: {
  */
 export declare function activateYamlWorkflow(input: {
     id: string;
-}): Promise<LTApiResult>;
+}, auth?: LTApiAuth): Promise<LTApiResult>;
 /**
  * Invoke an active YAML workflow, executing its DAG pipeline.
  *

package/build/api/yaml-workflows/deploy.js

@@ -33,6 +33,8 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.deployRefusal = deployRefusal;
+exports.invokeRefusal = invokeRefusal;
 exports.deployYamlWorkflow = deployYamlWorkflow;
 exports.activateYamlWorkflow = activateYamlWorkflow;
 exports.invokeYamlWorkflow = invokeYamlWorkflow;
@@ -42,6 +44,55 @@ const yamlDb = __importStar(require("../../services/yaml-workflow/db"));
 const yamlDeployer = __importStar(require("../../services/yaml-workflow/deployer"));
 const yamlWorkers = __importStar(require("../../services/yaml-workflow/workers"));
 const invoke_1 = require("../../services/yaml-workflow/invoke");
+const workflow_invocation_1 = require("../../services/workflow-invocation");
+const capabilities_1 = require("../../modules/capabilities");
+const userService = __importStar(require("../../services/user"));
+const uuid_1 = require("../../lib/uuid");
+const tools_1 = require("../mcp/tools");
+/**
+ * A refusal when the person cannot call every built-in tool these workflows'
+ * steps use; null when they can. Steps run as the invoker under each tool's
+ * gate, so this answers up front what the run would refuse step by step.
+ */
+async function toolStepRefusal(workflows, userId) {
+    const access = (0, capabilities_1.capabilityAccess)({ userId });
+    for (const step of workflows.flatMap((w) => w.activity_manifest ?? [])) {
+        if (step.tool_source !== 'mcp' || !step.mcp_server_id || !step.mcp_tool_name)
+            continue;
+        const builtin = await (0, tools_1.builtinServerFor)(step.mcp_server_id);
+        if (builtin && !(await access((0, tools_1.builtinToolGate)(builtin, step.mcp_tool_name)))) {
+            return { status: 403, error: `Forbidden: this workflow calls ${step.mcp_tool_name}, which is not available to you` };
+        }
+    }
+    return null;
+}
+/**
+ * Deploying or activating a compiled workflow needs the caller to be able to
+ * call every built-in tool it uses: automation never does more than its
+ * author may. Null when allowed; without a caller (in-process), allowed.
+ */
+async function deployRefusal(wf, auth) {
+    if (!auth?.userId)
+        return null;
+    // A deploy publishes every workflow sharing the app id, so every one is checked.
+    const siblings = await yamlDb.listYamlWorkflowsByAppId(wf.app_id);
+    return toolStepRefusal([wf, ...siblings.filter((w) => w.id !== wf.id)], auth.userId);
+}
+/**
+ * Invoking or scheduling a compiled workflow needs the identity it runs as
+ * (execute_as, else the caller) to be able to call every built-in tool it
+ * uses. Without a caller (in-process), allowed.
+ */
+async function invokeRefusal(wf, auth, executeAs) {
+    if (!auth?.userId)
+        return null;
+    if (!executeAs)
+        return toolStepRefusal([wf], auth.userId);
+    const runAs = (0, uuid_1.isUuid)(executeAs) ? await userService.getUser(executeAs) : await userService.getUserByExternalId(executeAs);
+    if (!runAs)
+        return { status: 404, error: `execute_as principal "${executeAs}" not found` };
+    return toolStepRefusal([wf], runAs.id);
+}
 const helpers_1 = require("./helpers");
 /**
  * Deploy a YAML workflow and all sibling workflows sharing its app_id namespace.
@@ -53,12 +104,15 @@ const helpers_1 = require("./helpers");
  * @param input.id — UUID of the workflow to deploy
  * @returns `{ status: 200, data: YamlWorkflow }` the refreshed workflow record after deployment
  */
-async function deployYamlWorkflow(input) {
+async function deployYamlWorkflow(input, auth) {
     try {
         const wf = await yamlDb.getYamlWorkflow(input.id);
         if (!wf) {
             return { status: 404, error: 'YAML workflow not found' };
         }
+        const refused = await deployRefusal(wf, auth);
+        if (refused)
+            return refused;
         // Compute the next app-level version for the namespace.
         // Each deploy increments regardless of individual tool versions —
         // adding a second tool (v1 of itself) to an app already at v1 produces app v2.
@@ -99,12 +153,15 @@ async function deployYamlWorkflow(input) {
  * @param input.id — UUID of the workflow to activate
  * @returns `{ status: 200, data: YamlWorkflow }` the refreshed workflow record after activation
  */
-async function activateYamlWorkflow(input) {
+async function activateYamlWorkflow(input, auth) {
     try {
         const wf = await yamlDb.getYamlWorkflow(input.id);
         if (!wf) {
             return { status: 404, error: 'YAML workflow not found' };
         }
+        const refused = await deployRefusal(wf, auth);
+        if (refused)
+            return refused;
         if (wf.status !== 'deployed' && wf.status !== 'active') {
             return { status: 400, error: 'Workflow must be deployed before activation' };
         }
@@ -151,6 +208,14 @@ async function invokeYamlWorkflow(input, auth) {
         if (wf.status !== 'active') {
             return { status: 400, error: 'Workflow must be active to invoke' };
         }
+        if (input.execute_as) {
+            if (!auth?.userId)
+                return { status: 403, error: 'execute_as requires an authenticated caller' };
+            await (0, workflow_invocation_1.assertMayActAs)(auth.userId, input.execute_as);
+        }
+        const refused = await invokeRefusal(wf, auth, input.execute_as);
+        if (refused)
+            return refused;
         const result = await (0, invoke_1.invokeYamlWorkflow)(wf, {
             data: input.data,
             sync: input.sync,
@@ -161,6 +226,8 @@ async function invokeYamlWorkflow(input, auth) {
         return { status: 200, data: result };
     }
     catch (err) {
+        if (err instanceof workflow_invocation_1.InvocationError)
+            return { status: err.statusCode, error: err.message };
         if ((0, helpers_1.isNotFoundError)(err)) {
             return { status: 404, error: 'YAML workflow not found' };
         }

package/build/lib/db/schemas/038_oauth_server.sql

@@ -0,0 +1,46 @@
+-- Migration 038: OAuth authorization server for /mcp
+--
+-- MCP clients register, a person consents to a grant, and the client holds a
+-- refresh token for that grant. Access tokens are self-contained JWTs and are
+-- never stored. Codes and refresh tokens are stored as SHA-256 hashes.
+
+CREATE TABLE IF NOT EXISTS lt_oauth_clients (
+  client_id     TEXT PRIMARY KEY,
+  client_name   TEXT,
+  redirect_uris TEXT[] NOT NULL,
+  created_at    TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+-- A grant is one person's consent for one client. The policy is the rights
+-- the person chose (a preset today); the scope is its coarse summary.
+CREATE TABLE IF NOT EXISTS lt_oauth_grants (
+  id         UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  user_id    UUID NOT NULL REFERENCES lt_users(id) ON DELETE CASCADE,
+  client_id  TEXT NOT NULL REFERENCES lt_oauth_clients(client_id) ON DELETE CASCADE,
+  policy     JSONB NOT NULL,
+  scope      TEXT NOT NULL,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  revoked_at TIMESTAMPTZ
+);
+
+CREATE INDEX IF NOT EXISTS idx_lt_oauth_grants_user ON lt_oauth_grants (user_id);
+
+CREATE TABLE IF NOT EXISTS lt_oauth_codes (
+  code_hash      TEXT PRIMARY KEY,
+  grant_id       UUID NOT NULL REFERENCES lt_oauth_grants(id) ON DELETE CASCADE,
+  redirect_uri   TEXT NOT NULL,
+  code_challenge TEXT NOT NULL,
+  resource       TEXT,
+  expires_at     TIMESTAMPTZ NOT NULL,
+  used_at        TIMESTAMPTZ
+);
+
+CREATE TABLE IF NOT EXISTS lt_oauth_refresh_tokens (
+  token_hash TEXT PRIMARY KEY,
+  grant_id   UUID NOT NULL REFERENCES lt_oauth_grants(id) ON DELETE CASCADE,
+  expires_at TIMESTAMPTZ NOT NULL,
+  used_at    TIMESTAMPTZ,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_lt_oauth_refresh_tokens_grant ON lt_oauth_refresh_tokens (grant_id);

package/build/lib/db/schemas/039_nats_ws_tickets.sql

@@ -0,0 +1,12 @@
+-- Migration 039: single-use NATS WebSocket proxy tickets
+--
+-- A ticket admits one upgrade. The proxy records its id here when it is
+-- spent; a second upgrade with the same ticket finds the row and is refused.
+-- Rows are kept until the ticket expires.
+
+CREATE TABLE IF NOT EXISTS lt_nats_ws_tickets (
+  jti        TEXT PRIMARY KEY,
+  expires_at TIMESTAMPTZ NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_lt_nats_ws_tickets_expires ON lt_nats_ws_tickets (expires_at);

package/build/lib/events/browser-view.d.ts

@@ -0,0 +1,20 @@
+import type { LTEvent } from '../../types';
+/** Escalation event fields a browser needs to route a refresh and follow a claim. */
+export declare const BROWSER_ESCALATION_FIELDS: readonly ["id", "type", "subtype", "status", "priority", "role", "assigned_to", "assigned_until", "workflow_id", "workflow_type", "origin_id", "task_id", "parent_id", "resolved_at", "claimed_at", "bulk", "from_role", "to_role", "reassigned_from"];
+export interface BrowserViewer {
+    builder: boolean;
+}
+/** The event as this viewer receives it. */
+export declare function eventForViewer(event: LTEvent, viewer: BrowserViewer): LTEvent;
+/**
+ * Rewrite one serialized event for a viewer who is not a builder. A payload
+ * that is not an event is withheld (null).
+ */
+export declare function payloadForViewer(payload: Buffer, viewer: BrowserViewer): Buffer | null;
+/** Whether a person is a builder, looked up lazily to keep lib free of an import cycle. */
+export declare function viewerFor(userId: string | null | undefined): Promise<BrowserViewer>;
+/**
+ * How a connection holder sees events, or null when the account is gone or
+ * not active. Looked up lazily to keep lib free of an import cycle.
+ */
+export declare function holderView(userId: string): Promise<BrowserViewer | null>;

package/build/lib/events/browser-view.js

@@ -0,0 +1,117 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BROWSER_ESCALATION_FIELDS = void 0;
+exports.eventForViewer = eventForViewer;
+exports.payloadForViewer = payloadForViewer;
+exports.viewerFor = viewerFor;
+exports.holderView = holderView;
+/**
+ * What a browser receives of an event. Builders receive events whole. Anyone
+ * else receives enough to route and refresh: escalation events keep their
+ * routing fields, and every other event arrives without `data` and
+ * `milestones`. Full records are read through the scoped API, by id.
+ *
+ * Server-side consumers (agent triggers, callbacks) are unaffected: this view
+ * applies only where events leave for a browser.
+ */
+const ESCALATION_SUBJECT = 'system.escalation.';
+const ACTIVE_ACCOUNT = 'active';
+/** Escalation event fields a browser needs to route a refresh and follow a claim. */
+exports.BROWSER_ESCALATION_FIELDS = [
+    'id', 'type', 'subtype', 'status', 'priority', 'role',
+    'assigned_to', 'assigned_until', 'workflow_id', 'workflow_type',
+    'origin_id', 'task_id', 'parent_id', 'resolved_at', 'claimed_at',
+    'bulk', 'from_role', 'to_role', 'reassigned_from',
+];
+/** The event as this viewer receives it. */
+function eventForViewer(event, viewer) {
+    if (viewer.builder)
+        return event;
+    const { data, milestones: _milestones, ...rest } = event;
+    if (typeof event.type === 'string' && event.type.startsWith(ESCALATION_SUBJECT) && data) {
+        const kept = {};
+        for (const key of exports.BROWSER_ESCALATION_FIELDS) {
+            if (data[key] !== undefined)
+                kept[key] = data[key];
+        }
+        return { ...rest, data: kept };
+    }
+    return rest;
+}
+/**
+ * Rewrite one serialized event for a viewer who is not a builder. A payload
+ * that is not an event is withheld (null).
+ */
+function payloadForViewer(payload, viewer) {
+    if (viewer.builder)
+        return payload;
+    let event;
+    try {
+        event = JSON.parse(payload.toString('utf8'));
+    }
+    catch {
+        return null;
+    }
+    if (!event || typeof event !== 'object' || typeof event.type !== 'string')
+        return null;
+    return Buffer.from(JSON.stringify(eventForViewer(event, viewer)), 'utf8');
+}
+/** Whether a person is a builder, looked up lazily to keep lib free of an import cycle. */
+async function viewerFor(userId) {
+    if (!userId)
+        return { builder: false };
+    try {
+        const { mayBuild } = await Promise.resolve().then(() => __importStar(require('../../modules/capabilities')));
+        return { builder: await mayBuild({ userId }) };
+    }
+    catch {
+        return { builder: false };
+    }
+}
+/**
+ * How a connection holder sees events, or null when the account is gone or
+ * not active. Looked up lazily to keep lib free of an import cycle.
+ */
+async function holderView(userId) {
+    const [{ getUser, getUserByExternalId }, { isUuid }] = await Promise.all([
+        Promise.resolve().then(() => __importStar(require('../../services/user'))),
+        Promise.resolve().then(() => __importStar(require('../uuid'))),
+    ]);
+    const user = isUuid(userId) ? await getUser(userId) : await getUserByExternalId(userId);
+    if (!user || user.status !== ACTIVE_ACCOUNT)
+        return null;
+    return viewerFor(user.id);
+}

package/build/lib/events/nats-ws-filter.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The browser's half of a NATS connection, as the WebSocket proxy forwards
+ * it. A browser only subscribes, so the proxy authenticates the connection
+ * itself and lets the browser read, never publish:
+ *
+ * - CONNECT is rewritten to carry the server's credential (the browser is
+ *   never given it), keeping the client's other options.
+ * - SUB, UNSUB, PING and PONG are forwarded, rebuilt from their parsed fields.
+ * - Any other operation, PUB and HPUB included, marks the stream malformed
+ *   and the proxy closes the connection.
+ *
+ * The filter reads lines as nats-server does: fields split on spaces or tabs,
+ * and a line ends at LF with or without a preceding CR. Operations can span
+ * WebSocket frames, so the filter keeps whatever it has not yet seen whole.
+ */
+export declare class NatsClientFilter {
+    private readonly authToken;
+    private pending;
+    private failed;
+    constructor(authToken: string | null);
+    /** Whether the stream was malformed; the proxy closes the connection. */
+    get malformed(): boolean;
+    /** The bytes to forward upstream for one chunk from the browser. */
+    feed(chunk: Buffer): Buffer;
+    private fail;
+    /** The line to forward, or null to forward nothing. */
+    private filterLine;
+    private rewriteConnect;
+}