@open-mercato/events 0.6.6-develop.6516.1.86a8538145 → 0.6.6-develop.6520.1.55df6df792

package/dist/modules/events/api/route.js

@@ -2,7 +2,7 @@ import { z } from "zod";
 import { getDeclaredEvents } from "@open-mercato/shared/modules/events";
 const metadata = {
   path: "/events",
-  GET: { requireAuth: true }
+  GET: { requireAuth: true, requireFeatures: ["workflows.view"] }
 };
 const eventDefinitionSchema = z.object({
   id: z.string(),

package/dist/modules/events/api/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/events/api/route.ts"],
-  "sourcesContent": ["/**\n * Events registry API \u2014 returns declared events from module `events.ts` files.\n *\n * Uses the globally registered event configs (populated during bootstrap). Data\n * leaked here (event ids, module ids, entity ids, clientBroadcast/portalBroadcast\n * flags) is recon-grade and MUST NOT be served to anonymous callers; the route\n * is protected by the standard `[...slug]` dispatcher with `requireAuth: true`.\n * Consumer: `packages/ui/src/backend/inputs/EventSelect.tsx` (workflow triggers,\n * business rules, webhook config).\n */\n\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getDeclaredEvents } from '@open-mercato/shared/modules/events'\n\nexport const metadata = {\n  path: '/events',\n  GET: { requireAuth: true },\n}\n\nconst eventDefinitionSchema = z.object({\n  id: z.string(),\n  label: z.string(),\n  description: z.string().optional(),\n  category: z.enum(['crud', 'lifecycle', 'system', 'custom']).optional(),\n  module: z.string().optional(),\n  entity: z.string().optional(),\n  excludeFromTriggers: z.boolean().optional(),\n  clientBroadcast: z.boolean().optional(),\n  portalBroadcast: z.boolean().optional(),\n})\n\nconst eventsResponseSchema = z.object({\n  data: z.array(eventDefinitionSchema),\n  total: z.number().int().nonnegative(),\n})\n\nexport async function GET(req: Request): Promise<Response> {\n  const { searchParams } = new URL(req.url)\n  const category = searchParams.get('category')\n  const moduleId = searchParams.get('module')\n  const excludeTriggerExcluded = searchParams.get('excludeTriggerExcluded') !== 'false'\n\n  let filteredEvents = getDeclaredEvents()\n\n  if (excludeTriggerExcluded) {\n    filteredEvents = filteredEvents.filter((e) => !e.excludeFromTriggers)\n  }\n  if (category) {\n    filteredEvents = filteredEvents.filter((e) => e.category === category)\n  }\n  if (moduleId) {\n    filteredEvents = filteredEvents.filter((e) => e.module === moduleId)\n  }\n\n  return Response.json({\n    data: filteredEvents,\n    total: filteredEvents.length,\n  })\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'List declared platform events',\n  description: 'Returns all declared platform events from every enabled module. Supports optional category and module filters.',\n  methods: {\n    GET: {\n      summary: 'List declared events',\n      description: 'Returns every declared event. Filters: category, module, excludeTriggerExcluded (default true).',\n      responses: [{ status: 200, description: 'Declared events', schema: eventsResponseSchema }],\n    },\n  },\n}\n"],
-  "mappings": "AAWA,SAAS,SAAS;AAElB,SAAS,yBAAyB;AAE3B,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,KAAK,EAAE,aAAa,KAAK;AAC3B;AAEA,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,IAAI,EAAE,OAAO;AAAA,EACb,OAAO,EAAE,OAAO;AAAA,EAChB,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,UAAU,EAAE,KAAK,CAAC,QAAQ,aAAa,UAAU,QAAQ,CAAC,EAAE,SAAS;AAAA,EACrE,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,qBAAqB,EAAE,QAAQ,EAAE,SAAS;AAAA,EAC1C,iBAAiB,EAAE,QAAQ,EAAE,SAAS;AAAA,EACtC,iBAAiB,EAAE,QAAQ,EAAE,SAAS;AACxC,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,MAAM,EAAE,MAAM,qBAAqB;AAAA,EACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AACtC,CAAC;AAED,eAAsB,IAAI,KAAiC;AACzD,QAAM,EAAE,aAAa,IAAI,IAAI,IAAI,IAAI,GAAG;AACxC,QAAM,WAAW,aAAa,IAAI,UAAU;AAC5C,QAAM,WAAW,aAAa,IAAI,QAAQ;AAC1C,QAAM,yBAAyB,aAAa,IAAI,wBAAwB,MAAM;AAE9E,MAAI,iBAAiB,kBAAkB;AAEvC,MAAI,wBAAwB;AAC1B,qBAAiB,eAAe,OAAO,CAAC,MAAM,CAAC,EAAE,mBAAmB;AAAA,EACtE;AACA,MAAI,UAAU;AACZ,qBAAiB,eAAe,OAAO,CAAC,MAAM,EAAE,aAAa,QAAQ;AAAA,EACvE;AACA,MAAI,UAAU;AACZ,qBAAiB,eAAe,OAAO,CAAC,MAAM,EAAE,WAAW,QAAQ;AAAA,EACrE;AAEA,SAAO,SAAS,KAAK;AAAA,IACnB,MAAM;AAAA,IACN,OAAO,eAAe;AAAA,EACxB,CAAC;AACH;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,qBAAqB,CAAC;AAAA,IAC3F;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * Events registry API \u2014 returns declared events from module `events.ts` files.\n *\n * Uses the globally registered event configs (populated during bootstrap). Data\n * leaked here (event ids, module ids, entity ids, clientBroadcast/portalBroadcast\n * flags) is recon-grade and MUST NOT be served to anonymous callers; the route\n * is protected by the standard `[...slug]` dispatcher with `requireAuth: true`.\n * Consumer: `packages/ui/src/backend/inputs/EventSelect.tsx` (workflow triggers,\n * business rules, webhook config).\n */\n\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getDeclaredEvents } from '@open-mercato/shared/modules/events'\n\nexport const metadata = {\n  path: '/events',\n  GET: { requireAuth: true, requireFeatures: ['workflows.view'] },\n}\n\nconst eventDefinitionSchema = z.object({\n  id: z.string(),\n  label: z.string(),\n  description: z.string().optional(),\n  category: z.enum(['crud', 'lifecycle', 'system', 'custom']).optional(),\n  module: z.string().optional(),\n  entity: z.string().optional(),\n  excludeFromTriggers: z.boolean().optional(),\n  clientBroadcast: z.boolean().optional(),\n  portalBroadcast: z.boolean().optional(),\n})\n\nconst eventsResponseSchema = z.object({\n  data: z.array(eventDefinitionSchema),\n  total: z.number().int().nonnegative(),\n})\n\nexport async function GET(req: Request): Promise<Response> {\n  const { searchParams } = new URL(req.url)\n  const category = searchParams.get('category')\n  const moduleId = searchParams.get('module')\n  const excludeTriggerExcluded = searchParams.get('excludeTriggerExcluded') !== 'false'\n\n  let filteredEvents = getDeclaredEvents()\n\n  if (excludeTriggerExcluded) {\n    filteredEvents = filteredEvents.filter((e) => !e.excludeFromTriggers)\n  }\n  if (category) {\n    filteredEvents = filteredEvents.filter((e) => e.category === category)\n  }\n  if (moduleId) {\n    filteredEvents = filteredEvents.filter((e) => e.module === moduleId)\n  }\n\n  return Response.json({\n    data: filteredEvents,\n    total: filteredEvents.length,\n  })\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'List declared platform events',\n  description: 'Returns all declared platform events from every enabled module. Supports optional category and module filters.',\n  methods: {\n    GET: {\n      summary: 'List declared events',\n      description: 'Returns every declared event. Filters: category, module, excludeTriggerExcluded (default true).',\n      responses: [{ status: 200, description: 'Declared events', schema: eventsResponseSchema }],\n    },\n  },\n}\n"],
+  "mappings": "AAWA,SAAS,SAAS;AAElB,SAAS,yBAAyB;AAE3B,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AAChE;AAEA,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,IAAI,EAAE,OAAO;AAAA,EACb,OAAO,EAAE,OAAO;AAAA,EAChB,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,UAAU,EAAE,KAAK,CAAC,QAAQ,aAAa,UAAU,QAAQ,CAAC,EAAE,SAAS;AAAA,EACrE,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,qBAAqB,EAAE,QAAQ,EAAE,SAAS;AAAA,EAC1C,iBAAiB,EAAE,QAAQ,EAAE,SAAS;AAAA,EACtC,iBAAiB,EAAE,QAAQ,EAAE,SAAS;AACxC,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,MAAM,EAAE,MAAM,qBAAqB;AAAA,EACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AACtC,CAAC;AAED,eAAsB,IAAI,KAAiC;AACzD,QAAM,EAAE,aAAa,IAAI,IAAI,IAAI,IAAI,GAAG;AACxC,QAAM,WAAW,aAAa,IAAI,UAAU;AAC5C,QAAM,WAAW,aAAa,IAAI,QAAQ;AAC1C,QAAM,yBAAyB,aAAa,IAAI,wBAAwB,MAAM;AAE9E,MAAI,iBAAiB,kBAAkB;AAEvC,MAAI,wBAAwB;AAC1B,qBAAiB,eAAe,OAAO,CAAC,MAAM,CAAC,EAAE,mBAAmB;AAAA,EACtE;AACA,MAAI,UAAU;AACZ,qBAAiB,eAAe,OAAO,CAAC,MAAM,EAAE,aAAa,QAAQ;AAAA,EACvE;AACA,MAAI,UAAU;AACZ,qBAAiB,eAAe,OAAO,CAAC,MAAM,EAAE,WAAW,QAAQ;AAAA,EACrE;AAEA,SAAO,SAAS,KAAK;AAAA,IACnB,MAAM;AAAA,IACN,OAAO,eAAe;AAAA,EACxB,CAAC;AACH;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,qBAAqB,CAAC;AAAA,IAC3F;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/events/api/stream/route.js

@@ -19,14 +19,20 @@ function collectStringValues(input) {
   }
   return values;
 }
-function normalizeAudience(data) {
-  const tenantId = typeof data.tenantId === "string" ? data.tenantId : null;
+function normalizeAudience(data, options) {
+  const trustedTenantId = typeof options?.tenantId === "string" && options.tenantId.trim().length > 0 ? options.tenantId.trim() : null;
+  const tenantId = trustedTenantId ?? (typeof data.tenantId === "string" ? data.tenantId : null);
   const organizationScopes = /* @__PURE__ */ new Set();
-  if (typeof data.organizationId === "string" && data.organizationId.trim().length > 0) {
-    organizationScopes.add(data.organizationId.trim());
-  }
-  for (const organizationId of collectStringValues(data.organizationIds)) {
-    organizationScopes.add(organizationId);
+  const trustedOrganizationId = typeof options?.organizationId === "string" && options.organizationId.trim().length > 0 ? options.organizationId.trim() : null;
+  if (trustedOrganizationId) {
+    organizationScopes.add(trustedOrganizationId);
+  } else {
+    if (typeof data.organizationId === "string" && data.organizationId.trim().length > 0) {
+      organizationScopes.add(data.organizationId.trim());
+    }
+    for (const organizationId of collectStringValues(data.organizationIds)) {
+      organizationScopes.add(organizationId);
+    }
   }
   const recipientUserScopes = /* @__PURE__ */ new Set();
   if (typeof data.recipientUserId === "string" && data.recipientUserId.trim().length > 0) {
@@ -67,11 +73,11 @@ function matchesAudience(conn, audience) {
 }
 const connections = /* @__PURE__ */ new Set();
 let globalTapRegistered = false;
-async function broadcastEventToConnections(eventName, payload) {
+async function broadcastEventToConnections(eventName, payload, options) {
   if (!eventName || connections.size === 0) return;
   if (!isBroadcastEvent(eventName)) return;
   const data = payload ?? {};
-  const audience = normalizeAudience(data);
+  const audience = normalizeAudience(data, options);
   const organizationId = audience.organizationScopes[0] ?? "";
   let ssePayload = buildSsePayload(eventName, data, organizationId);
   if (new TextEncoder().encode(ssePayload).length > MAX_PAYLOAD_BYTES) {
@@ -120,14 +126,15 @@ function buildTruncatedPayload(eventName, data, organizationId) {
 function ensureGlobalTapSubscription() {
   if (globalTapRegistered) return;
   globalTapRegistered = true;
-  registerGlobalEventTap(async (eventName, payload) => {
-    await broadcastEventToConnections(eventName, payload ?? {});
+  registerGlobalEventTap(async (eventName, payload, options) => {
+    await broadcastEventToConnections(eventName, payload ?? {}, options);
   });
   registerCrossProcessEventListener(async (envelope) => {
     if (envelope.originPid === process.pid) return;
     await broadcastEventToConnections(
       envelope.event,
-      envelope.payload ?? {}
+      envelope.payload ?? {},
+      envelope.options
     );
   });
 }

package/dist/modules/events/api/stream/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/events/api/stream/route.ts"],
-  "sourcesContent": ["/**\n * SSE Event Stream \u2014 DOM Event Bridge\n *\n * Server-Sent Events endpoint that bridges server-side events to the browser.\n * Only events with `clientBroadcast: true` in their EventDefinition are sent.\n * Events are scoped to the authenticated user's tenant.\n *\n * Client consumer: `packages/ui/src/backend/injection/eventBridge.ts`\n */\n\nimport { resolveRequestContext } from '@open-mercato/shared/lib/api/context'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { isBroadcastEvent } from '@open-mercato/shared/modules/events'\nimport { registerCrossProcessEventListener, registerGlobalEventTap } from '../../../../bus'\n\nexport const metadata = {\n  GET: { requireAuth: true },\n}\n\nconst HEARTBEAT_INTERVAL_MS = 30_000\nconst MAX_PAYLOAD_BYTES = 4096\n\nconst logger = createLogger('events').child({ component: 'stream' })\n\ntype SseConnection = {\n  tenantId: string\n  organizationId: string | null\n  userId: string\n  roleIds: string[]\n  send: (data: string) => void\n  close: () => void\n}\n\nfunction collectStringValues(input: unknown): string[] {\n  if (!Array.isArray(input)) return []\n  const values: string[] = []\n  for (const value of input) {\n    if (typeof value !== 'string') continue\n    const trimmed = value.trim()\n    if (!trimmed) continue\n    values.push(trimmed)\n  }\n  return values\n}\n\nfunction normalizeAudience(data: Record<string, unknown>): {\n  tenantId: string | null\n  organizationScopes: string[]\n  recipientUserScopes: string[]\n  recipientRoleScopes: string[]\n} {\n  const tenantId = typeof data.tenantId === 'string' ? data.tenantId : null\n  const organizationScopes = new Set<string>()\n  if (typeof data.organizationId === 'string' && data.organizationId.trim().length > 0) {\n    organizationScopes.add(data.organizationId.trim())\n  }\n  for (const organizationId of collectStringValues(data.organizationIds)) {\n    organizationScopes.add(organizationId)\n  }\n\n  const recipientUserScopes = new Set<string>()\n  if (typeof data.recipientUserId === 'string' && data.recipientUserId.trim().length > 0) {\n    recipientUserScopes.add(data.recipientUserId.trim())\n  }\n  for (const userId of collectStringValues(data.recipientUserIds)) {\n    recipientUserScopes.add(userId)\n  }\n\n  const recipientRoleScopes = new Set<string>()\n  if (typeof data.recipientRoleId === 'string' && data.recipientRoleId.trim().length > 0) {\n    recipientRoleScopes.add(data.recipientRoleId.trim())\n  }\n  for (const roleId of collectStringValues(data.recipientRoleIds)) {\n    recipientRoleScopes.add(roleId)\n  }\n\n  return {\n    tenantId,\n    organizationScopes: Array.from(organizationScopes),\n    recipientUserScopes: Array.from(recipientUserScopes),\n    recipientRoleScopes: Array.from(recipientRoleScopes),\n  }\n}\n\nfunction matchesAudience(conn: SseConnection, audience: ReturnType<typeof normalizeAudience>): boolean {\n  if (!audience.tenantId) return false\n  if (conn.tenantId !== audience.tenantId) return false\n\n  if (audience.organizationScopes.length > 0) {\n    if (!conn.organizationId) return false\n    if (!audience.organizationScopes.includes(conn.organizationId)) return false\n  }\n\n  if (audience.recipientUserScopes.length > 0 && !audience.recipientUserScopes.includes(conn.userId)) {\n    return false\n  }\n\n  if (audience.recipientRoleScopes.length > 0) {\n    const roleMatched = conn.roleIds.some((roleId) => audience.recipientRoleScopes.includes(roleId))\n    if (!roleMatched) return false\n  }\n\n  return true\n}\n\n/**\n * Global connection registry.\n * All active SSE connections are tracked here.\n * The event bus subscriber iterates this set on each broadcast event.\n */\nconst connections = new Set<SseConnection>()\n\nlet globalTapRegistered = false\n\nasync function broadcastEventToConnections(eventName: string, payload: Record<string, unknown>): Promise<void> {\n  if (!eventName || connections.size === 0) return\n\n  if (!isBroadcastEvent(eventName)) return\n\n  const data = payload ?? {}\n  const audience = normalizeAudience(data)\n\n  const organizationId = audience.organizationScopes[0] ?? ''\n  let ssePayload = buildSsePayload(eventName, data, organizationId)\n\n  if (new TextEncoder().encode(ssePayload).length > MAX_PAYLOAD_BYTES) {\n    ssePayload = buildTruncatedPayload(eventName, data, organizationId)\n    if (new TextEncoder().encode(ssePayload).length > MAX_PAYLOAD_BYTES) {\n      logger.warn('Event payload exceeds size limit, skipping', { event: eventName, maxBytes: MAX_PAYLOAD_BYTES })\n      return\n    }\n  }\n\n  for (const conn of connections) {\n    if (!matchesAudience(conn, audience)) continue\n\n    try {\n      conn.send(ssePayload)\n    } catch {\n      // Connection may have been closed; cleanup happens via abort handler\n    }\n  }\n}\n\nfunction buildSsePayload(eventName: string, data: Record<string, unknown>, organizationId: string): string {\n  return JSON.stringify({\n    id: eventName,\n    payload: data,\n    timestamp: Date.now(),\n    organizationId,\n  })\n}\n\nfunction buildTruncatedPayload(eventName: string, data: Record<string, unknown>, organizationId: string): string {\n  const entityRef: Record<string, unknown> = {\n    truncated: true,\n  }\n  if (typeof data.id === 'string' && data.id.trim().length > 0) {\n    entityRef.id = data.id.trim()\n  }\n  if (typeof data.entityId === 'string' && data.entityId.trim().length > 0) {\n    entityRef.entityId = data.entityId.trim()\n  }\n  if (typeof data.entityType === 'string' && data.entityType.trim().length > 0) {\n    entityRef.entityType = data.entityType.trim()\n  }\n  return JSON.stringify({\n    id: eventName,\n    payload: entityRef,\n    timestamp: Date.now(),\n    organizationId,\n  })\n}\n\n/**\n * Ensure a process-wide event tap is registered (once).\n * This captures emits from all request-scoped EventBus instances.\n */\nfunction ensureGlobalTapSubscription(): void {\n  if (globalTapRegistered) return\n  globalTapRegistered = true\n\n  registerGlobalEventTap(async (eventName, payload) => {\n    await broadcastEventToConnections(eventName, (payload ?? {}) as Record<string, unknown>)\n  })\n\n  registerCrossProcessEventListener(async (envelope) => {\n    if (envelope.originPid === process.pid) return\n    await broadcastEventToConnections(\n      envelope.event,\n      (envelope.payload ?? {}) as Record<string, unknown>,\n    )\n  })\n}\n\nexport async function GET(req: Request): Promise<Response> {\n  const { ctx } = await resolveRequestContext(req)\n\n  if (!ctx.auth?.tenantId || !ctx.auth?.sub) {\n    return new Response('Unauthorized', { status: 401 })\n  }\n\n  const tenantId = ctx.auth.tenantId\n  const organizationId = (ctx.selectedOrganizationId as string) ?? ctx.auth.orgId ?? null\n  const userId = ctx.auth.sub\n  const roleIds = Array.isArray(ctx.auth.roles)\n    ? ctx.auth.roles.filter((role): role is string => typeof role === 'string' && role.trim().length > 0)\n    : []\n\n  ensureGlobalTapSubscription()\n\n  const encoder = new TextEncoder()\n  let heartbeatTimer: ReturnType<typeof setInterval> | null = null\n  let connection: SseConnection | null = null\n  const onAbort = () => cleanup()\n\n  const stream = new ReadableStream({\n    start(controller) {\n      const send = (data: string) => {\n        controller.enqueue(encoder.encode(`data: ${data}\\n\\n`))\n      }\n\n      connection = {\n        tenantId,\n        organizationId,\n        userId,\n        roleIds,\n        send,\n        close: () => controller.close(),\n      }\n      connections.add(connection)\n\n      // Flush an initial comment so the runtime sends the response headers and\n      // first body byte immediately. Without it, the streamed Response stays\n      // unflushed until the first heartbeat (30s) or matching event, which\n      // delays the browser EventSource `open` event \u2014 clients that gate work on\n      // a \"connected\" signal would otherwise stall for up to 30s after mount.\n      // Comment lines (`:` prefix) are ignored by EventSource message parsing.\n      controller.enqueue(encoder.encode(': connected\\n\\n'))\n\n      // Start heartbeat to keep connection alive\n      heartbeatTimer = setInterval(() => {\n        try {\n          controller.enqueue(encoder.encode(':heartbeat\\n\\n'))\n        } catch {\n          // Stream may have been closed\n        }\n      }, HEARTBEAT_INTERVAL_MS)\n    },\n    cancel() {\n      cleanup()\n    },\n  })\n\n  function cleanup() {\n    if (heartbeatTimer) {\n      clearInterval(heartbeatTimer)\n      heartbeatTimer = null\n    }\n    if (connection) {\n      connections.delete(connection)\n      connection = null\n    }\n    // Detach from the request signal so reconnect churn does not accumulate\n    // listeners and closures on long-lived AbortSignals.\n    req.signal.removeEventListener('abort', onAbort)\n  }\n\n  req.signal.addEventListener('abort', onAbort, { once: true })\n\n  return new Response(stream, {\n    status: 200,\n    headers: {\n      'Content-Type': 'text/event-stream',\n      'Cache-Control': 'no-cache, no-transform',\n      'Connection': 'keep-alive',\n      'X-Accel-Buffering': 'no',\n    },\n  })\n}\n\nexport const openApi = {\n  GET: {\n    summary: 'Subscribe to server events via SSE (DOM Event Bridge)',\n    description: 'Long-lived SSE connection that receives server-side events marked with clientBroadcast: true. Events are server-filtered by tenant, organization, recipient user, and recipient role.',\n    tags: ['Events'],\n    responses: {\n      200: {\n        description: 'Event stream (text/event-stream)',\n        content: {\n          'text/event-stream': {\n            schema: {\n              type: 'object',\n              properties: {\n                id: { type: 'string', description: 'Event identifier (e.g., example.todo.created)' },\n                payload: { type: 'object', description: 'Event-specific data' },\n                timestamp: { type: 'number', description: 'Server timestamp (ms since epoch)' },\n                organizationId: { type: 'string', description: 'Organization scope' },\n              },\n            },\n          },\n        },\n      },\n      401: { description: 'Not authenticated' },\n    },\n  },\n}\n"],
-  "mappings": "AAUA,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAC7B,SAAS,wBAAwB;AACjC,SAAS,mCAAmC,8BAA8B;AAEnE,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAC3B;AAEA,MAAM,wBAAwB;AAC9B,MAAM,oBAAoB;AAE1B,MAAM,SAAS,aAAa,QAAQ,EAAE,MAAM,EAAE,WAAW,SAAS,CAAC;AAWnE,SAAS,oBAAoB,OAA0B;AACrD,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO,CAAC;AACnC,QAAM,SAAmB,CAAC;AAC1B,aAAW,SAAS,OAAO;AACzB,QAAI,OAAO,UAAU,SAAU;AAC/B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,QAAS;AACd,WAAO,KAAK,OAAO;AAAA,EACrB;AACA,SAAO;AACT;AAEA,SAAS,kBAAkB,MAKzB;AACA,QAAM,WAAW,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;AACrE,QAAM,qBAAqB,oBAAI,IAAY;AAC3C,MAAI,OAAO,KAAK,mBAAmB,YAAY,KAAK,eAAe,KAAK,EAAE,SAAS,GAAG;AACpF,uBAAmB,IAAI,KAAK,eAAe,KAAK,CAAC;AAAA,EACnD;AACA,aAAW,kBAAkB,oBAAoB,KAAK,eAAe,GAAG;AACtE,uBAAmB,IAAI,cAAc;AAAA,EACvC;AAEA,QAAM,sBAAsB,oBAAI,IAAY;AAC5C,MAAI,OAAO,KAAK,oBAAoB,YAAY,KAAK,gBAAgB,KAAK,EAAE,SAAS,GAAG;AACtF,wBAAoB,IAAI,KAAK,gBAAgB,KAAK,CAAC;AAAA,EACrD;AACA,aAAW,UAAU,oBAAoB,KAAK,gBAAgB,GAAG;AAC/D,wBAAoB,IAAI,MAAM;AAAA,EAChC;AAEA,QAAM,sBAAsB,oBAAI,IAAY;AAC5C,MAAI,OAAO,KAAK,oBAAoB,YAAY,KAAK,gBAAgB,KAAK,EAAE,SAAS,GAAG;AACtF,wBAAoB,IAAI,KAAK,gBAAgB,KAAK,CAAC;AAAA,EACrD;AACA,aAAW,UAAU,oBAAoB,KAAK,gBAAgB,GAAG;AAC/D,wBAAoB,IAAI,MAAM;AAAA,EAChC;AAEA,SAAO;AAAA,IACL;AAAA,IACA,oBAAoB,MAAM,KAAK,kBAAkB;AAAA,IACjD,qBAAqB,MAAM,KAAK,mBAAmB;AAAA,IACnD,qBAAqB,MAAM,KAAK,mBAAmB;AAAA,EACrD;AACF;AAEA,SAAS,gBAAgB,MAAqB,UAAyD;AACrG,MAAI,CAAC,SAAS,SAAU,QAAO;AAC/B,MAAI,KAAK,aAAa,SAAS,SAAU,QAAO;AAEhD,MAAI,SAAS,mBAAmB,SAAS,GAAG;AAC1C,QAAI,CAAC,KAAK,eAAgB,QAAO;AACjC,QAAI,CAAC,SAAS,mBAAmB,SAAS,KAAK,cAAc,EAAG,QAAO;AAAA,EACzE;AAEA,MAAI,SAAS,oBAAoB,SAAS,KAAK,CAAC,SAAS,oBAAoB,SAAS,KAAK,MAAM,GAAG;AAClG,WAAO;AAAA,EACT;AAEA,MAAI,SAAS,oBAAoB,SAAS,GAAG;AAC3C,UAAM,cAAc,KAAK,QAAQ,KAAK,CAAC,WAAW,SAAS,oBAAoB,SAAS,MAAM,CAAC;AAC/F,QAAI,CAAC,YAAa,QAAO;AAAA,EAC3B;AAEA,SAAO;AACT;AAOA,MAAM,cAAc,oBAAI,IAAmB;AAE3C,IAAI,sBAAsB;AAE1B,eAAe,4BAA4B,WAAmB,SAAiD;AAC7G,MAAI,CAAC,aAAa,YAAY,SAAS,EAAG;AAE1C,MAAI,CAAC,iBAAiB,SAAS,EAAG;AAElC,QAAM,OAAO,WAAW,CAAC;AACzB,QAAM,WAAW,kBAAkB,IAAI;AAEvC,QAAM,iBAAiB,SAAS,mBAAmB,CAAC,KAAK;AACzD,MAAI,aAAa,gBAAgB,WAAW,MAAM,cAAc;AAEhE,MAAI,IAAI,YAAY,EAAE,OAAO,UAAU,EAAE,SAAS,mBAAmB;AACnE,iBAAa,sBAAsB,WAAW,MAAM,cAAc;AAClE,QAAI,IAAI,YAAY,EAAE,OAAO,UAAU,EAAE,SAAS,mBAAmB;AACnE,aAAO,KAAK,8CAA8C,EAAE,OAAO,WAAW,UAAU,kBAAkB,CAAC;AAC3G;AAAA,IACF;AAAA,EACF;AAEA,aAAW,QAAQ,aAAa;AAC9B,QAAI,CAAC,gBAAgB,MAAM,QAAQ,EAAG;AAEtC,QAAI;AACF,WAAK,KAAK,UAAU;AAAA,IACtB,QAAQ;AAAA,IAER;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,WAAmB,MAA+B,gBAAgC;AACzG,SAAO,KAAK,UAAU;AAAA,IACpB,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,WAAW,KAAK,IAAI;AAAA,IACpB;AAAA,EACF,CAAC;AACH;AAEA,SAAS,sBAAsB,WAAmB,MAA+B,gBAAgC;AAC/G,QAAM,YAAqC;AAAA,IACzC,WAAW;AAAA,EACb;AACA,MAAI,OAAO,KAAK,OAAO,YAAY,KAAK,GAAG,KAAK,EAAE,SAAS,GAAG;AAC5D,cAAU,KAAK,KAAK,GAAG,KAAK;AAAA,EAC9B;AACA,MAAI,OAAO,KAAK,aAAa,YAAY,KAAK,SAAS,KAAK,EAAE,SAAS,GAAG;AACxE,cAAU,WAAW,KAAK,SAAS,KAAK;AAAA,EAC1C;AACA,MAAI,OAAO,KAAK,eAAe,YAAY,KAAK,WAAW,KAAK,EAAE,SAAS,GAAG;AAC5E,cAAU,aAAa,KAAK,WAAW,KAAK;AAAA,EAC9C;AACA,SAAO,KAAK,UAAU;AAAA,IACpB,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,WAAW,KAAK,IAAI;AAAA,IACpB;AAAA,EACF,CAAC;AACH;AAMA,SAAS,8BAAoC;AAC3C,MAAI,oBAAqB;AACzB,wBAAsB;AAEtB,yBAAuB,OAAO,WAAW,YAAY;AACnD,UAAM,4BAA4B,WAAY,WAAW,CAAC,CAA6B;AAAA,EACzF,CAAC;AAED,oCAAkC,OAAO,aAAa;AACpD,QAAI,SAAS,cAAc,QAAQ,IAAK;AACxC,UAAM;AAAA,MACJ,SAAS;AAAA,MACR,SAAS,WAAW,CAAC;AAAA,IACxB;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,IAAI,KAAiC;AACzD,QAAM,EAAE,IAAI,IAAI,MAAM,sBAAsB,GAAG;AAE/C,MAAI,CAAC,IAAI,MAAM,YAAY,CAAC,IAAI,MAAM,KAAK;AACzC,WAAO,IAAI,SAAS,gBAAgB,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrD;AAEA,QAAM,WAAW,IAAI,KAAK;AAC1B,QAAM,iBAAkB,IAAI,0BAAqC,IAAI,KAAK,SAAS;AACnF,QAAM,SAAS,IAAI,KAAK;AACxB,QAAM,UAAU,MAAM,QAAQ,IAAI,KAAK,KAAK,IACxC,IAAI,KAAK,MAAM,OAAO,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,KAAK,EAAE,SAAS,CAAC,IAClG,CAAC;AAEL,8BAA4B;AAE5B,QAAM,UAAU,IAAI,YAAY;AAChC,MAAI,iBAAwD;AAC5D,MAAI,aAAmC;AACvC,QAAM,UAAU,MAAM,QAAQ;AAE9B,QAAM,SAAS,IAAI,eAAe;AAAA,IAChC,MAAM,YAAY;AAChB,YAAM,OAAO,CAAC,SAAiB;AAC7B,mBAAW,QAAQ,QAAQ,OAAO,SAAS,IAAI;AAAA;AAAA,CAAM,CAAC;AAAA,MACxD;AAEA,mBAAa;AAAA,QACX;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,OAAO,MAAM,WAAW,MAAM;AAAA,MAChC;AACA,kBAAY,IAAI,UAAU;AAQ1B,iBAAW,QAAQ,QAAQ,OAAO,iBAAiB,CAAC;AAGpD,uBAAiB,YAAY,MAAM;AACjC,YAAI;AACF,qBAAW,QAAQ,QAAQ,OAAO,gBAAgB,CAAC;AAAA,QACrD,QAAQ;AAAA,QAER;AAAA,MACF,GAAG,qBAAqB;AAAA,IAC1B;AAAA,IACA,SAAS;AACP,cAAQ;AAAA,IACV;AAAA,EACF,CAAC;AAED,WAAS,UAAU;AACjB,QAAI,gBAAgB;AAClB,oBAAc,cAAc;AAC5B,uBAAiB;AAAA,IACnB;AACA,QAAI,YAAY;AACd,kBAAY,OAAO,UAAU;AAC7B,mBAAa;AAAA,IACf;AAGA,QAAI,OAAO,oBAAoB,SAAS,OAAO;AAAA,EACjD;AAEA,MAAI,OAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AAE5D,SAAO,IAAI,SAAS,QAAQ;AAAA,IAC1B,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,iBAAiB;AAAA,MACjB,cAAc;AAAA,MACd,qBAAqB;AAAA,IACvB;AAAA,EACF,CAAC;AACH;AAEO,MAAM,UAAU;AAAA,EACrB,KAAK;AAAA,IACH,SAAS;AAAA,IACT,aAAa;AAAA,IACb,MAAM,CAAC,QAAQ;AAAA,IACf,WAAW;AAAA,MACT,KAAK;AAAA,QACH,aAAa;AAAA,QACb,SAAS;AAAA,UACP,qBAAqB;AAAA,YACnB,QAAQ;AAAA,cACN,MAAM;AAAA,cACN,YAAY;AAAA,gBACV,IAAI,EAAE,MAAM,UAAU,aAAa,gDAAgD;AAAA,gBACnF,SAAS,EAAE,MAAM,UAAU,aAAa,sBAAsB;AAAA,gBAC9D,WAAW,EAAE,MAAM,UAAU,aAAa,oCAAoC;AAAA,gBAC9E,gBAAgB,EAAE,MAAM,UAAU,aAAa,qBAAqB;AAAA,cACtE;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,MACA,KAAK,EAAE,aAAa,oBAAoB;AAAA,IAC1C;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * SSE Event Stream \u2014 DOM Event Bridge\n *\n * Server-Sent Events endpoint that bridges server-side events to the browser.\n * Only events with `clientBroadcast: true` in their EventDefinition are sent.\n * Events are scoped to the authenticated user's tenant.\n *\n * Client consumer: `packages/ui/src/backend/injection/eventBridge.ts`\n */\n\nimport { resolveRequestContext } from '@open-mercato/shared/lib/api/context'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { isBroadcastEvent } from '@open-mercato/shared/modules/events'\nimport { registerCrossProcessEventListener, registerGlobalEventTap } from '../../../../bus'\nimport type { EmitOptions } from '../../../../types'\n\nexport const metadata = {\n  GET: { requireAuth: true },\n}\n\nconst HEARTBEAT_INTERVAL_MS = 30_000\nconst MAX_PAYLOAD_BYTES = 4096\n\nconst logger = createLogger('events').child({ component: 'stream' })\n\ntype SseConnection = {\n  tenantId: string\n  organizationId: string | null\n  userId: string\n  roleIds: string[]\n  send: (data: string) => void\n  close: () => void\n}\n\nfunction collectStringValues(input: unknown): string[] {\n  if (!Array.isArray(input)) return []\n  const values: string[] = []\n  for (const value of input) {\n    if (typeof value !== 'string') continue\n    const trimmed = value.trim()\n    if (!trimmed) continue\n    values.push(trimmed)\n  }\n  return values\n}\n\nfunction normalizeAudience(data: Record<string, unknown>, options?: EmitOptions): {\n  tenantId: string | null\n  organizationScopes: string[]\n  recipientUserScopes: string[]\n  recipientRoleScopes: string[]\n} {\n  const trustedTenantId = typeof options?.tenantId === 'string' && options.tenantId.trim().length > 0\n    ? options.tenantId.trim()\n    : null\n  const tenantId = trustedTenantId ?? (typeof data.tenantId === 'string' ? data.tenantId : null)\n  const organizationScopes = new Set<string>()\n  const trustedOrganizationId = typeof options?.organizationId === 'string' && options.organizationId.trim().length > 0\n    ? options.organizationId.trim()\n    : null\n  if (trustedOrganizationId) {\n    organizationScopes.add(trustedOrganizationId)\n  } else {\n    if (typeof data.organizationId === 'string' && data.organizationId.trim().length > 0) {\n      organizationScopes.add(data.organizationId.trim())\n    }\n    for (const organizationId of collectStringValues(data.organizationIds)) {\n      organizationScopes.add(organizationId)\n    }\n  }\n\n  const recipientUserScopes = new Set<string>()\n  if (typeof data.recipientUserId === 'string' && data.recipientUserId.trim().length > 0) {\n    recipientUserScopes.add(data.recipientUserId.trim())\n  }\n  for (const userId of collectStringValues(data.recipientUserIds)) {\n    recipientUserScopes.add(userId)\n  }\n\n  const recipientRoleScopes = new Set<string>()\n  if (typeof data.recipientRoleId === 'string' && data.recipientRoleId.trim().length > 0) {\n    recipientRoleScopes.add(data.recipientRoleId.trim())\n  }\n  for (const roleId of collectStringValues(data.recipientRoleIds)) {\n    recipientRoleScopes.add(roleId)\n  }\n\n  return {\n    tenantId,\n    organizationScopes: Array.from(organizationScopes),\n    recipientUserScopes: Array.from(recipientUserScopes),\n    recipientRoleScopes: Array.from(recipientRoleScopes),\n  }\n}\n\nfunction matchesAudience(conn: SseConnection, audience: ReturnType<typeof normalizeAudience>): boolean {\n  if (!audience.tenantId) return false\n  if (conn.tenantId !== audience.tenantId) return false\n\n  if (audience.organizationScopes.length > 0) {\n    if (!conn.organizationId) return false\n    if (!audience.organizationScopes.includes(conn.organizationId)) return false\n  }\n\n  if (audience.recipientUserScopes.length > 0 && !audience.recipientUserScopes.includes(conn.userId)) {\n    return false\n  }\n\n  if (audience.recipientRoleScopes.length > 0) {\n    const roleMatched = conn.roleIds.some((roleId) => audience.recipientRoleScopes.includes(roleId))\n    if (!roleMatched) return false\n  }\n\n  return true\n}\n\n/**\n * Global connection registry.\n * All active SSE connections are tracked here.\n * The event bus subscriber iterates this set on each broadcast event.\n */\nconst connections = new Set<SseConnection>()\n\nlet globalTapRegistered = false\n\nasync function broadcastEventToConnections(\n  eventName: string,\n  payload: Record<string, unknown>,\n  options?: EmitOptions,\n): Promise<void> {\n  if (!eventName || connections.size === 0) return\n\n  if (!isBroadcastEvent(eventName)) return\n\n  const data = payload ?? {}\n  const audience = normalizeAudience(data, options)\n\n  const organizationId = audience.organizationScopes[0] ?? ''\n  let ssePayload = buildSsePayload(eventName, data, organizationId)\n\n  if (new TextEncoder().encode(ssePayload).length > MAX_PAYLOAD_BYTES) {\n    ssePayload = buildTruncatedPayload(eventName, data, organizationId)\n    if (new TextEncoder().encode(ssePayload).length > MAX_PAYLOAD_BYTES) {\n      logger.warn('Event payload exceeds size limit, skipping', { event: eventName, maxBytes: MAX_PAYLOAD_BYTES })\n      return\n    }\n  }\n\n  for (const conn of connections) {\n    if (!matchesAudience(conn, audience)) continue\n\n    try {\n      conn.send(ssePayload)\n    } catch {\n      // Connection may have been closed; cleanup happens via abort handler\n    }\n  }\n}\n\nfunction buildSsePayload(eventName: string, data: Record<string, unknown>, organizationId: string): string {\n  return JSON.stringify({\n    id: eventName,\n    payload: data,\n    timestamp: Date.now(),\n    organizationId,\n  })\n}\n\nfunction buildTruncatedPayload(eventName: string, data: Record<string, unknown>, organizationId: string): string {\n  const entityRef: Record<string, unknown> = {\n    truncated: true,\n  }\n  if (typeof data.id === 'string' && data.id.trim().length > 0) {\n    entityRef.id = data.id.trim()\n  }\n  if (typeof data.entityId === 'string' && data.entityId.trim().length > 0) {\n    entityRef.entityId = data.entityId.trim()\n  }\n  if (typeof data.entityType === 'string' && data.entityType.trim().length > 0) {\n    entityRef.entityType = data.entityType.trim()\n  }\n  return JSON.stringify({\n    id: eventName,\n    payload: entityRef,\n    timestamp: Date.now(),\n    organizationId,\n  })\n}\n\n/**\n * Ensure a process-wide event tap is registered (once).\n * This captures emits from all request-scoped EventBus instances.\n */\nfunction ensureGlobalTapSubscription(): void {\n  if (globalTapRegistered) return\n  globalTapRegistered = true\n\n  registerGlobalEventTap(async (eventName, payload, options) => {\n    await broadcastEventToConnections(eventName, (payload ?? {}) as Record<string, unknown>, options)\n  })\n\n  registerCrossProcessEventListener(async (envelope) => {\n    if (envelope.originPid === process.pid) return\n    await broadcastEventToConnections(\n      envelope.event,\n      (envelope.payload ?? {}) as Record<string, unknown>,\n      envelope.options,\n    )\n  })\n}\n\nexport async function GET(req: Request): Promise<Response> {\n  const { ctx } = await resolveRequestContext(req)\n\n  if (!ctx.auth?.tenantId || !ctx.auth?.sub) {\n    return new Response('Unauthorized', { status: 401 })\n  }\n\n  const tenantId = ctx.auth.tenantId\n  const organizationId = (ctx.selectedOrganizationId as string) ?? ctx.auth.orgId ?? null\n  const userId = ctx.auth.sub\n  const roleIds = Array.isArray(ctx.auth.roles)\n    ? ctx.auth.roles.filter((role): role is string => typeof role === 'string' && role.trim().length > 0)\n    : []\n\n  ensureGlobalTapSubscription()\n\n  const encoder = new TextEncoder()\n  let heartbeatTimer: ReturnType<typeof setInterval> | null = null\n  let connection: SseConnection | null = null\n  const onAbort = () => cleanup()\n\n  const stream = new ReadableStream({\n    start(controller) {\n      const send = (data: string) => {\n        controller.enqueue(encoder.encode(`data: ${data}\\n\\n`))\n      }\n\n      connection = {\n        tenantId,\n        organizationId,\n        userId,\n        roleIds,\n        send,\n        close: () => controller.close(),\n      }\n      connections.add(connection)\n\n      // Flush an initial comment so the runtime sends the response headers and\n      // first body byte immediately. Without it, the streamed Response stays\n      // unflushed until the first heartbeat (30s) or matching event, which\n      // delays the browser EventSource `open` event \u2014 clients that gate work on\n      // a \"connected\" signal would otherwise stall for up to 30s after mount.\n      // Comment lines (`:` prefix) are ignored by EventSource message parsing.\n      controller.enqueue(encoder.encode(': connected\\n\\n'))\n\n      // Start heartbeat to keep connection alive\n      heartbeatTimer = setInterval(() => {\n        try {\n          controller.enqueue(encoder.encode(':heartbeat\\n\\n'))\n        } catch {\n          // Stream may have been closed\n        }\n      }, HEARTBEAT_INTERVAL_MS)\n    },\n    cancel() {\n      cleanup()\n    },\n  })\n\n  function cleanup() {\n    if (heartbeatTimer) {\n      clearInterval(heartbeatTimer)\n      heartbeatTimer = null\n    }\n    if (connection) {\n      connections.delete(connection)\n      connection = null\n    }\n    // Detach from the request signal so reconnect churn does not accumulate\n    // listeners and closures on long-lived AbortSignals.\n    req.signal.removeEventListener('abort', onAbort)\n  }\n\n  req.signal.addEventListener('abort', onAbort, { once: true })\n\n  return new Response(stream, {\n    status: 200,\n    headers: {\n      'Content-Type': 'text/event-stream',\n      'Cache-Control': 'no-cache, no-transform',\n      'Connection': 'keep-alive',\n      'X-Accel-Buffering': 'no',\n    },\n  })\n}\n\nexport const openApi = {\n  GET: {\n    summary: 'Subscribe to server events via SSE (DOM Event Bridge)',\n    description: 'Long-lived SSE connection that receives server-side events marked with clientBroadcast: true. Events are server-filtered by tenant, organization, recipient user, and recipient role.',\n    tags: ['Events'],\n    responses: {\n      200: {\n        description: 'Event stream (text/event-stream)',\n        content: {\n          'text/event-stream': {\n            schema: {\n              type: 'object',\n              properties: {\n                id: { type: 'string', description: 'Event identifier (e.g., example.todo.created)' },\n                payload: { type: 'object', description: 'Event-specific data' },\n                timestamp: { type: 'number', description: 'Server timestamp (ms since epoch)' },\n                organizationId: { type: 'string', description: 'Organization scope' },\n              },\n            },\n          },\n        },\n      },\n      401: { description: 'Not authenticated' },\n    },\n  },\n}\n"],
+  "mappings": "AAUA,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAC7B,SAAS,wBAAwB;AACjC,SAAS,mCAAmC,8BAA8B;AAGnE,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAC3B;AAEA,MAAM,wBAAwB;AAC9B,MAAM,oBAAoB;AAE1B,MAAM,SAAS,aAAa,QAAQ,EAAE,MAAM,EAAE,WAAW,SAAS,CAAC;AAWnE,SAAS,oBAAoB,OAA0B;AACrD,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO,CAAC;AACnC,QAAM,SAAmB,CAAC;AAC1B,aAAW,SAAS,OAAO;AACzB,QAAI,OAAO,UAAU,SAAU;AAC/B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,QAAS;AACd,WAAO,KAAK,OAAO;AAAA,EACrB;AACA,SAAO;AACT;AAEA,SAAS,kBAAkB,MAA+B,SAKxD;AACA,QAAM,kBAAkB,OAAO,SAAS,aAAa,YAAY,QAAQ,SAAS,KAAK,EAAE,SAAS,IAC9F,QAAQ,SAAS,KAAK,IACtB;AACJ,QAAM,WAAW,oBAAoB,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;AACzF,QAAM,qBAAqB,oBAAI,IAAY;AAC3C,QAAM,wBAAwB,OAAO,SAAS,mBAAmB,YAAY,QAAQ,eAAe,KAAK,EAAE,SAAS,IAChH,QAAQ,eAAe,KAAK,IAC5B;AACJ,MAAI,uBAAuB;AACzB,uBAAmB,IAAI,qBAAqB;AAAA,EAC9C,OAAO;AACL,QAAI,OAAO,KAAK,mBAAmB,YAAY,KAAK,eAAe,KAAK,EAAE,SAAS,GAAG;AACpF,yBAAmB,IAAI,KAAK,eAAe,KAAK,CAAC;AAAA,IACnD;AACA,eAAW,kBAAkB,oBAAoB,KAAK,eAAe,GAAG;AACtE,yBAAmB,IAAI,cAAc;AAAA,IACvC;AAAA,EACF;AAEA,QAAM,sBAAsB,oBAAI,IAAY;AAC5C,MAAI,OAAO,KAAK,oBAAoB,YAAY,KAAK,gBAAgB,KAAK,EAAE,SAAS,GAAG;AACtF,wBAAoB,IAAI,KAAK,gBAAgB,KAAK,CAAC;AAAA,EACrD;AACA,aAAW,UAAU,oBAAoB,KAAK,gBAAgB,GAAG;AAC/D,wBAAoB,IAAI,MAAM;AAAA,EAChC;AAEA,QAAM,sBAAsB,oBAAI,IAAY;AAC5C,MAAI,OAAO,KAAK,oBAAoB,YAAY,KAAK,gBAAgB,KAAK,EAAE,SAAS,GAAG;AACtF,wBAAoB,IAAI,KAAK,gBAAgB,KAAK,CAAC;AAAA,EACrD;AACA,aAAW,UAAU,oBAAoB,KAAK,gBAAgB,GAAG;AAC/D,wBAAoB,IAAI,MAAM;AAAA,EAChC;AAEA,SAAO;AAAA,IACL;AAAA,IACA,oBAAoB,MAAM,KAAK,kBAAkB;AAAA,IACjD,qBAAqB,MAAM,KAAK,mBAAmB;AAAA,IACnD,qBAAqB,MAAM,KAAK,mBAAmB;AAAA,EACrD;AACF;AAEA,SAAS,gBAAgB,MAAqB,UAAyD;AACrG,MAAI,CAAC,SAAS,SAAU,QAAO;AAC/B,MAAI,KAAK,aAAa,SAAS,SAAU,QAAO;AAEhD,MAAI,SAAS,mBAAmB,SAAS,GAAG;AAC1C,QAAI,CAAC,KAAK,eAAgB,QAAO;AACjC,QAAI,CAAC,SAAS,mBAAmB,SAAS,KAAK,cAAc,EAAG,QAAO;AAAA,EACzE;AAEA,MAAI,SAAS,oBAAoB,SAAS,KAAK,CAAC,SAAS,oBAAoB,SAAS,KAAK,MAAM,GAAG;AAClG,WAAO;AAAA,EACT;AAEA,MAAI,SAAS,oBAAoB,SAAS,GAAG;AAC3C,UAAM,cAAc,KAAK,QAAQ,KAAK,CAAC,WAAW,SAAS,oBAAoB,SAAS,MAAM,CAAC;AAC/F,QAAI,CAAC,YAAa,QAAO;AAAA,EAC3B;AAEA,SAAO;AACT;AAOA,MAAM,cAAc,oBAAI,IAAmB;AAE3C,IAAI,sBAAsB;AAE1B,eAAe,4BACb,WACA,SACA,SACe;AACf,MAAI,CAAC,aAAa,YAAY,SAAS,EAAG;AAE1C,MAAI,CAAC,iBAAiB,SAAS,EAAG;AAElC,QAAM,OAAO,WAAW,CAAC;AACzB,QAAM,WAAW,kBAAkB,MAAM,OAAO;AAEhD,QAAM,iBAAiB,SAAS,mBAAmB,CAAC,KAAK;AACzD,MAAI,aAAa,gBAAgB,WAAW,MAAM,cAAc;AAEhE,MAAI,IAAI,YAAY,EAAE,OAAO,UAAU,EAAE,SAAS,mBAAmB;AACnE,iBAAa,sBAAsB,WAAW,MAAM,cAAc;AAClE,QAAI,IAAI,YAAY,EAAE,OAAO,UAAU,EAAE,SAAS,mBAAmB;AACnE,aAAO,KAAK,8CAA8C,EAAE,OAAO,WAAW,UAAU,kBAAkB,CAAC;AAC3G;AAAA,IACF;AAAA,EACF;AAEA,aAAW,QAAQ,aAAa;AAC9B,QAAI,CAAC,gBAAgB,MAAM,QAAQ,EAAG;AAEtC,QAAI;AACF,WAAK,KAAK,UAAU;AAAA,IACtB,QAAQ;AAAA,IAER;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,WAAmB,MAA+B,gBAAgC;AACzG,SAAO,KAAK,UAAU;AAAA,IACpB,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,WAAW,KAAK,IAAI;AAAA,IACpB;AAAA,EACF,CAAC;AACH;AAEA,SAAS,sBAAsB,WAAmB,MAA+B,gBAAgC;AAC/G,QAAM,YAAqC;AAAA,IACzC,WAAW;AAAA,EACb;AACA,MAAI,OAAO,KAAK,OAAO,YAAY,KAAK,GAAG,KAAK,EAAE,SAAS,GAAG;AAC5D,cAAU,KAAK,KAAK,GAAG,KAAK;AAAA,EAC9B;AACA,MAAI,OAAO,KAAK,aAAa,YAAY,KAAK,SAAS,KAAK,EAAE,SAAS,GAAG;AACxE,cAAU,WAAW,KAAK,SAAS,KAAK;AAAA,EAC1C;AACA,MAAI,OAAO,KAAK,eAAe,YAAY,KAAK,WAAW,KAAK,EAAE,SAAS,GAAG;AAC5E,cAAU,aAAa,KAAK,WAAW,KAAK;AAAA,EAC9C;AACA,SAAO,KAAK,UAAU;AAAA,IACpB,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,WAAW,KAAK,IAAI;AAAA,IACpB;AAAA,EACF,CAAC;AACH;AAMA,SAAS,8BAAoC;AAC3C,MAAI,oBAAqB;AACzB,wBAAsB;AAEtB,yBAAuB,OAAO,WAAW,SAAS,YAAY;AAC5D,UAAM,4BAA4B,WAAY,WAAW,CAAC,GAA+B,OAAO;AAAA,EAClG,CAAC;AAED,oCAAkC,OAAO,aAAa;AACpD,QAAI,SAAS,cAAc,QAAQ,IAAK;AACxC,UAAM;AAAA,MACJ,SAAS;AAAA,MACR,SAAS,WAAW,CAAC;AAAA,MACtB,SAAS;AAAA,IACX;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,IAAI,KAAiC;AACzD,QAAM,EAAE,IAAI,IAAI,MAAM,sBAAsB,GAAG;AAE/C,MAAI,CAAC,IAAI,MAAM,YAAY,CAAC,IAAI,MAAM,KAAK;AACzC,WAAO,IAAI,SAAS,gBAAgB,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrD;AAEA,QAAM,WAAW,IAAI,KAAK;AAC1B,QAAM,iBAAkB,IAAI,0BAAqC,IAAI,KAAK,SAAS;AACnF,QAAM,SAAS,IAAI,KAAK;AACxB,QAAM,UAAU,MAAM,QAAQ,IAAI,KAAK,KAAK,IACxC,IAAI,KAAK,MAAM,OAAO,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,KAAK,EAAE,SAAS,CAAC,IAClG,CAAC;AAEL,8BAA4B;AAE5B,QAAM,UAAU,IAAI,YAAY;AAChC,MAAI,iBAAwD;AAC5D,MAAI,aAAmC;AACvC,QAAM,UAAU,MAAM,QAAQ;AAE9B,QAAM,SAAS,IAAI,eAAe;AAAA,IAChC,MAAM,YAAY;AAChB,YAAM,OAAO,CAAC,SAAiB;AAC7B,mBAAW,QAAQ,QAAQ,OAAO,SAAS,IAAI;AAAA;AAAA,CAAM,CAAC;AAAA,MACxD;AAEA,mBAAa;AAAA,QACX;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,OAAO,MAAM,WAAW,MAAM;AAAA,MAChC;AACA,kBAAY,IAAI,UAAU;AAQ1B,iBAAW,QAAQ,QAAQ,OAAO,iBAAiB,CAAC;AAGpD,uBAAiB,YAAY,MAAM;AACjC,YAAI;AACF,qBAAW,QAAQ,QAAQ,OAAO,gBAAgB,CAAC;AAAA,QACrD,QAAQ;AAAA,QAER;AAAA,MACF,GAAG,qBAAqB;AAAA,IAC1B;AAAA,IACA,SAAS;AACP,cAAQ;AAAA,IACV;AAAA,EACF,CAAC;AAED,WAAS,UAAU;AACjB,QAAI,gBAAgB;AAClB,oBAAc,cAAc;AAC5B,uBAAiB;AAAA,IACnB;AACA,QAAI,YAAY;AACd,kBAAY,OAAO,UAAU;AAC7B,mBAAa;AAAA,IACf;AAGA,QAAI,OAAO,oBAAoB,SAAS,OAAO;AAAA,EACjD;AAEA,MAAI,OAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AAE5D,SAAO,IAAI,SAAS,QAAQ;AAAA,IAC1B,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,iBAAiB;AAAA,MACjB,cAAc;AAAA,MACd,qBAAqB;AAAA,IACvB;AAAA,EACF,CAAC;AACH;AAEO,MAAM,UAAU;AAAA,EACrB,KAAK;AAAA,IACH,SAAS;AAAA,IACT,aAAa;AAAA,IACb,MAAM,CAAC,QAAQ;AAAA,IACf,WAAW;AAAA,MACT,KAAK;AAAA,QACH,aAAa;AAAA,QACb,SAAS;AAAA,UACP,qBAAqB;AAAA,YACnB,QAAQ;AAAA,cACN,MAAM;AAAA,cACN,YAAY;AAAA,gBACV,IAAI,EAAE,MAAM,UAAU,aAAa,gDAAgD;AAAA,gBACnF,SAAS,EAAE,MAAM,UAAU,aAAa,sBAAsB;AAAA,gBAC9D,WAAW,EAAE,MAAM,UAAU,aAAa,oCAAoC;AAAA,gBAC9E,gBAAgB,EAAE,MAAM,UAAU,aAAa,qBAAqB;AAAA,cACtE;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,MACA,KAAK,EAAE,aAAa,oBAAoB;AAAA,IAC1C;AAAA,EACF;AACF;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/events",
-  "version": "0.6.6-develop.6516.1.86a8538145",
+  "version": "0.6.6-develop.6520.1.55df6df792",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -33,8 +33,8 @@
     }
   },
   "dependencies": {
-    "@open-mercato/queue": "0.6.6-develop.6516.1.86a8538145",
-    "@open-mercato/shared": "0.6.6-develop.6516.1.86a8538145",
+    "@open-mercato/queue": "0.6.6-develop.6520.1.55df6df792",
+    "@open-mercato/shared": "0.6.6-develop.6520.1.55df6df792",
     "pg": "8.22.0"
   },
   "devDependencies": {

package/src/modules/events/api/__tests__/route.test.ts

@@ -36,9 +36,10 @@ describe('GET /api/events (core events module route)', () => {
     jest.clearAllMocks()
   })
 
-  it('declares requireAuth: true and explicit path so the dispatcher denies anonymous callers', () => {
+  it('restricts the event catalog to authenticated workflow users', () => {
     expect(metadata.path).toBe('/events')
     expect(metadata.GET?.requireAuth).toBe(true)
+    expect(metadata.GET?.requireFeatures).toEqual(['workflows.view'])
   })
 
   it('returns the full registry by default (excludeTriggerExcluded=true)', async () => {

package/src/modules/events/api/route.ts

@@ -15,7 +15,7 @@ import { getDeclaredEvents } from '@open-mercato/shared/modules/events'
 
 export const metadata = {
   path: '/events',
-  GET: { requireAuth: true },
+  GET: { requireAuth: true, requireFeatures: ['workflows.view'] },
 }
 
 const eventDefinitionSchema = z.object({

package/src/modules/events/api/stream/__tests__/route.test.ts

@@ -8,11 +8,30 @@ jest.mock('@open-mercato/shared/lib/api/context', () => ({
   })),
 }))
 
+type EmitOptions = {
+  tenantId?: string | null
+  organizationId?: string | null
+}
+
+type GlobalEventTap = (
+  eventName: string,
+  payload: Record<string, unknown>,
+  options?: EmitOptions,
+) => void | Promise<void>
+
+let mockGlobalEventTap: GlobalEventTap | undefined
+
 jest.mock('../../../../../bus', () => ({
-  registerGlobalEventTap: jest.fn(),
+  registerGlobalEventTap: jest.fn((handler: GlobalEventTap) => {
+    mockGlobalEventTap = handler
+  }),
   registerCrossProcessEventListener: jest.fn(),
 }))
 
+jest.mock('@open-mercato/shared/modules/events', () => ({
+  isBroadcastEvent: jest.fn(() => true),
+}))
+
 import { GET } from '@open-mercato/events/modules/events/api/stream/route'
 
 // req.signal is a linked/derived signal in Node, so we spy AFTER the
@@ -85,6 +104,33 @@ describe('SSE event stream — abort listener hygiene', () => {
     try { await reader.cancel() } catch {}
   })
 
+  it('uses trusted organization scope when the payload omits it', async () => {
+    const { req } = makeTrackedRequest()
+    const res = await GET(req)
+    expect(res.status).toBe(200)
+
+    const reader = (res.body as ReadableStream<Uint8Array>).getReader()
+    await reader.read()
+
+    expect(mockGlobalEventTap).toBeDefined()
+    await mockGlobalEventTap?.(
+      'progress.job.updated',
+      { tenantId: 't1', marker: 'must-not-arrive' },
+      { tenantId: 't1', organizationId: 'o2' },
+    )
+    await mockGlobalEventTap?.(
+      'progress.job.updated',
+      { tenantId: 't1', marker: 'expected' },
+      { tenantId: 't1', organizationId: 'o1' },
+    )
+
+    const { value, done } = await reader.read()
+    expect(done).toBe(false)
+    expect(new TextDecoder().decode(value)).toContain('"marker":"expected"')
+
+    try { await reader.cancel() } catch {}
+  })
+
   it('does not retain listeners across many reconnects', async () => {
     for (let i = 0; i < 20; i += 1) {
       const { req, controller, addSpy, removeSpy } = makeTrackedRequest()

package/src/modules/events/api/stream/route.ts

@@ -12,6 +12,7 @@ import { resolveRequestContext } from '@open-mercato/shared/lib/api/context'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 import { isBroadcastEvent } from '@open-mercato/shared/modules/events'
 import { registerCrossProcessEventListener, registerGlobalEventTap } from '../../../../bus'
+import type { EmitOptions } from '../../../../types'
 
 export const metadata = {
   GET: { requireAuth: true },
@@ -43,19 +44,29 @@ function collectStringValues(input: unknown): string[] {
   return values
 }
 
-function normalizeAudience(data: Record<string, unknown>): {
+function normalizeAudience(data: Record<string, unknown>, options?: EmitOptions): {
   tenantId: string | null
   organizationScopes: string[]
   recipientUserScopes: string[]
   recipientRoleScopes: string[]
 } {
-  const tenantId = typeof data.tenantId === 'string' ? data.tenantId : null
+  const trustedTenantId = typeof options?.tenantId === 'string' && options.tenantId.trim().length > 0
+    ? options.tenantId.trim()
+    : null
+  const tenantId = trustedTenantId ?? (typeof data.tenantId === 'string' ? data.tenantId : null)
   const organizationScopes = new Set<string>()
-  if (typeof data.organizationId === 'string' && data.organizationId.trim().length > 0) {
-    organizationScopes.add(data.organizationId.trim())
-  }
-  for (const organizationId of collectStringValues(data.organizationIds)) {
-    organizationScopes.add(organizationId)
+  const trustedOrganizationId = typeof options?.organizationId === 'string' && options.organizationId.trim().length > 0
+    ? options.organizationId.trim()
+    : null
+  if (trustedOrganizationId) {
+    organizationScopes.add(trustedOrganizationId)
+  } else {
+    if (typeof data.organizationId === 'string' && data.organizationId.trim().length > 0) {
+      organizationScopes.add(data.organizationId.trim())
+    }
+    for (const organizationId of collectStringValues(data.organizationIds)) {
+      organizationScopes.add(organizationId)
+    }
   }
 
   const recipientUserScopes = new Set<string>()
@@ -112,13 +123,17 @@ const connections = new Set<SseConnection>()
 
 let globalTapRegistered = false
 
-async function broadcastEventToConnections(eventName: string, payload: Record<string, unknown>): Promise<void> {
+async function broadcastEventToConnections(
+  eventName: string,
+  payload: Record<string, unknown>,
+  options?: EmitOptions,
+): Promise<void> {
   if (!eventName || connections.size === 0) return
 
   if (!isBroadcastEvent(eventName)) return
 
   const data = payload ?? {}
-  const audience = normalizeAudience(data)
+  const audience = normalizeAudience(data, options)
 
   const organizationId = audience.organizationScopes[0] ?? ''
   let ssePayload = buildSsePayload(eventName, data, organizationId)
@@ -180,8 +195,8 @@ function ensureGlobalTapSubscription(): void {
   if (globalTapRegistered) return
   globalTapRegistered = true
 
-  registerGlobalEventTap(async (eventName, payload) => {
-    await broadcastEventToConnections(eventName, (payload ?? {}) as Record<string, unknown>)
+  registerGlobalEventTap(async (eventName, payload, options) => {
+    await broadcastEventToConnections(eventName, (payload ?? {}) as Record<string, unknown>, options)
   })
 
   registerCrossProcessEventListener(async (envelope) => {
@@ -189,6 +204,7 @@ function ensureGlobalTapSubscription(): void {
     await broadcastEventToConnections(
       envelope.event,
       (envelope.payload ?? {}) as Record<string, unknown>,
+      envelope.options,
     )
   })
 }