@lightworkai.official/debug-capture 0.17.4 → 0.18.0

package/dist/server.d.ts

@@ -14,11 +14,15 @@ export interface SupportProfileFact {
     label: string;
     value: string;
 }
-/** Whoever the host has authenticated. Email is the account key. */
+/**
+ * Whoever the host has authenticated. Email is the account key — or, for someone the host knows but holds no email
+ * for (a CIB officer with none in the ERP, 2026-10-27: every report they ever sent landed anonymous, nobody could call
+ * them back), the host's own id alone.
+ */
 export interface SupportUser {
-    /** The host's own id for this person, recorded so a changed email still matches. */
+    /** The host's own id for this person, recorded so a changed email still matches — the key when there is no email. */
     id?: string | null;
-    email: string;
+    email?: string | null;
     name?: string | null;
     /** What the host knows about their work — most important first. Optional; bounded on the way in. */
     profile?: SupportProfileFact[] | null;

package/dist/server.mjs

@@ -23,17 +23,18 @@ function cleanProfile(profile) {
 var DEFAULT_TTL_SECONDS = 120;
 var b64 = (value) => Buffer.from(JSON.stringify(value), "utf8").toString("base64url");
 function createSupportToken(options) {
-  const email = options.user.email?.trim().toLowerCase();
-  if (!email || !email.includes("@"))
-    throw new Error("createSupportToken: a real email is required");
+  const email = options.user.email?.trim().toLowerCase() || null;
+  const id = options.user.id?.trim() || null;
+  if (email ? !email.includes("@") : !id)
+    throw new Error("createSupportToken: a real email, or the host's own id for this person, is required");
   if (!options.secret || options.secret.length < 16) {
     throw new Error("createSupportToken: the realm's reporter secret is missing or too short");
   }
   const now = Math.floor(Date.now() / 1000);
   const expiresIn = Math.min(Math.max(Math.floor(options.ttlSeconds ?? DEFAULT_TTL_SECONDS), 30), 12 * 60 * 60);
   const body = `${b64({ alg: "HS256", typ: "JWT" })}.${b64({
-    sub: options.user.id?.trim() || email,
-    email,
+    sub: id ?? email,
+    ...email ? { email } : {},
     name: options.user.name?.trim() || null,
     ...cleanProfile(options.user.profile) ? { profile: cleanProfile(options.user.profile) } : {},
     jti: randomUUID(),
@@ -59,7 +60,7 @@ function supportTokenHandler(options) {
       return json({ error: "Support identity is not configured" }, 503);
     }
     const user = await options.user();
-    if (!user?.email)
+    if (!user?.email?.trim() && !user?.id?.trim())
       return json({ error: "Unauthorized" }, 401);
     try {
       const { token, expiresIn } = createSupportToken({ secret, user, ttlSeconds: options.ttlSeconds });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lightworkai.official/debug-capture",
-  "version": "0.17.4",
+  "version": "0.18.0",
   "description": "Report-a-problem widget: rolling network/console/action capture, optional rrweb session replay, annotated screenshot, and submission to a Lightwork Support host",
   "type": "module",
   "module": "./dist/index.mjs",

package/src/server.ts

@@ -34,11 +34,15 @@ export interface SupportProfileFact {
   value: string;
 }
 
-/** Whoever the host has authenticated. Email is the account key. */
+/**
+ * Whoever the host has authenticated. Email is the account key — or, for someone the host knows but holds no email
+ * for (a CIB officer with none in the ERP, 2026-10-27: every report they ever sent landed anonymous, nobody could call
+ * them back), the host's own id alone.
+ */
 export interface SupportUser {
-  /** The host's own id for this person, recorded so a changed email still matches. */
+  /** The host's own id for this person, recorded so a changed email still matches — the key when there is no email. */
   id?: string | null;
-  email: string;
+  email?: string | null;
   name?: string | null;
   /** What the host knows about their work — most important first. Optional; bounded on the way in. */
   profile?: SupportProfileFact[] | null;
@@ -95,8 +99,9 @@ export function createSupportToken(options: {
   user: SupportUser;
   ttlSeconds?: number;
 }): { token: string; expiresIn: number } {
-  const email = options.user.email?.trim().toLowerCase();
-  if (!email || !email.includes("@")) throw new Error("createSupportToken: a real email is required");
+  const email = options.user.email?.trim().toLowerCase() || null;
+  const id = options.user.id?.trim() || null;
+  if (email ? !email.includes("@") : !id) throw new Error("createSupportToken: a real email, or the host's own id for this person, is required");
   if (!options.secret || options.secret.length < 16) {
     throw new Error("createSupportToken: the realm's reporter secret is missing or too short");
   }
@@ -105,9 +110,10 @@ export function createSupportToken(options: {
   const expiresIn = Math.min(Math.max(Math.floor(options.ttlSeconds ?? DEFAULT_TTL_SECONDS), 30), 12 * 60 * 60);
   const body = `${b64({ alg: "HS256", typ: "JWT" })}.${b64({
     // The host's own id when it has one, so the same person is recognised even
-    // if their email later changes. The email stands in when it does not.
-    sub: options.user.id?.trim() || email,
-    email,
+    // if their email later changes. The email stands in when it does not; with
+    // no email the id is the whole of who they are, and the claim is left out.
+    sub: id ?? email,
+    ...(email ? { email } : {}),
     name: options.user.name?.trim() || null,
     // Only when there is one: an older support desk ignores the claim, a newer one records it.
     ...(cleanProfile(options.user.profile) ? { profile: cleanProfile(options.user.profile) } : {}),
@@ -184,7 +190,8 @@ export function supportTokenHandler(options: {
     }
 
     const user = await options.user();
-    if (!user?.email) return json({ error: "Unauthorized" }, 401);
+    // Nobody — or somebody the host cannot name by an email or an id of its own.
+    if (!user?.email?.trim() && !user?.id?.trim()) return json({ error: "Unauthorized" }, 401);
 
     try {
       const { token, expiresIn } = createSupportToken({ secret, user, ttlSeconds: options.ttlSeconds });