@open-mercato/events 0.8.1-develop.7296.1.2111d779db → 0.9.0

package/dist/modules/events/api/stream/route.js

@@ -1,5 +1,6 @@
 import { resolveRequestContext } from "@open-mercato/shared/lib/api/context";
 import { createLogger } from "@open-mercato/shared/lib/logger";
+import { parseNumberWithDefault } from "@open-mercato/shared/lib/number";
 import { isBroadcastEvent } from "@open-mercato/shared/modules/events";
 import {
   CROSS_PROCESS_EVENT_INSTANCE_ID,
@@ -10,8 +11,88 @@ const metadata = {
   GET: { requireAuth: true }
 };
 const HEARTBEAT_INTERVAL_MS = 3e4;
+const DEFAULT_AUTH_REVALIDATION_INTERVAL_MS = 3e4;
+const DEFAULT_CONNECTION_MAX_AGE_MS = 5 * 6e4;
+const MIN_AUTH_REVALIDATION_INTERVAL_MS = 1e3;
+const MIN_CONNECTION_MAX_AGE_MS = 1e3;
+const CONNECTION_MAX_AGE_JITTER_RATIO = 0.15;
+const MAX_TIMER_DELAY_MS = 2147483647;
 const MAX_PAYLOAD_BYTES = 4096;
 const logger = createLogger("events").child({ component: "stream" });
+function resolveTimingConfig() {
+  return {
+    authRevalidationIntervalMs: Math.min(
+      parseNumberWithDefault(
+        process.env.OM_EVENTS_SSE_AUTH_REVALIDATION_INTERVAL_MS,
+        DEFAULT_AUTH_REVALIDATION_INTERVAL_MS,
+        { integer: true, min: MIN_AUTH_REVALIDATION_INTERVAL_MS }
+      ),
+      MAX_TIMER_DELAY_MS
+    ),
+    connectionMaxAgeMs: applyConnectionMaxAgeJitter(
+      parseNumberWithDefault(
+        process.env.OM_EVENTS_SSE_CONNECTION_MAX_AGE_MS,
+        DEFAULT_CONNECTION_MAX_AGE_MS,
+        { integer: true, min: MIN_CONNECTION_MAX_AGE_MS }
+      )
+    )
+  };
+}
+function applyConnectionMaxAgeJitter(configuredMs) {
+  const jitterFactor = 1 + (Math.random() * 2 - 1) * CONNECTION_MAX_AGE_JITTER_RATIO;
+  const jitteredMs = Math.round(configuredMs * jitterFactor);
+  return Math.min(Math.max(jitteredMs, MIN_CONNECTION_MAX_AGE_MS), MAX_TIMER_DELAY_MS);
+}
+function normalizeRoleIds(input) {
+  if (!Array.isArray(input)) return [];
+  return Array.from(new Set(
+    input.filter((role) => typeof role === "string").map((role) => role.trim()).filter((role) => role.length > 0)
+  )).sort((left, right) => left.localeCompare(right));
+}
+function resolveOrganizationScopeService(ctx) {
+  try {
+    const service = ctx.container.resolve("organizationScopeService");
+    return service && typeof service.resolveForRequest === "function" ? service : null;
+  } catch {
+    return null;
+  }
+}
+function normalizeId(input) {
+  return typeof input === "string" && input.trim().length > 0 ? input.trim() : null;
+}
+async function resolveConnectionIdentity(ctx, request) {
+  const canonicalTenantId = normalizeId(ctx.auth?.tenantId);
+  if (!canonicalTenantId || !ctx.auth?.sub) return null;
+  const organizationScopeService = resolveOrganizationScopeService(ctx);
+  if (!organizationScopeService) return null;
+  const scope = await organizationScopeService.resolveForRequest({ auth: ctx.auth, request });
+  const tenantId = normalizeId(scope.tenantId);
+  const organizationId = normalizeId(scope.selectedId) ?? normalizeId(ctx.auth.orgId);
+  if (!tenantId || tenantId !== canonicalTenantId || scope.selectionRejected) return null;
+  if (organizationId && Array.isArray(scope.allowedIds) && !scope.allowedIds.includes(organizationId)) {
+    return null;
+  }
+  return {
+    tenantId,
+    organizationId,
+    userId: ctx.auth.sub,
+    roleIds: normalizeRoleIds(ctx.auth.roles)
+  };
+}
+function identitiesMatch(left, right) {
+  return left.tenantId === right.tenantId && left.organizationId === right.organizationId && left.userId === right.userId && left.roleIds.length === right.roleIds.length && left.roleIds.every((roleId, index) => roleId === right.roleIds[index]);
+}
+function hasApiKeyCredentials(req) {
+  if ((req.headers.get("x-api-key") ?? "").trim().length > 0) return true;
+  const authorization = (req.headers.get("authorization") ?? "").trim();
+  return /^apikey(?:\s|$)/i.test(authorization);
+}
+function createAuthRevalidationRequest(req) {
+  return new Request(req.url, {
+    method: req.method,
+    headers: req.headers
+  });
+}
 function collectStringValues(input) {
   if (!Array.isArray(input)) return [];
   const values = [];
@@ -65,16 +146,16 @@ function normalizeAudience(data, options) {
 }
 function matchesAudience(conn, audience) {
   if (!audience.tenantId) return false;
-  if (conn.tenantId !== audience.tenantId) return false;
+  if (conn.identity.tenantId !== audience.tenantId) return false;
   if (audience.organizationScopes.length > 0) {
-    if (!conn.organizationId) return false;
-    if (!audience.organizationScopes.includes(conn.organizationId)) return false;
+    if (!conn.identity.organizationId) return false;
+    if (!audience.organizationScopes.includes(conn.identity.organizationId)) return false;
   }
-  if (audience.recipientUserScopes.length > 0 && !audience.recipientUserScopes.includes(conn.userId)) {
+  if (audience.recipientUserScopes.length > 0 && !audience.recipientUserScopes.includes(conn.identity.userId)) {
     return false;
   }
   if (audience.recipientRoleScopes.length > 0) {
-    const roleMatched = conn.roleIds.some((roleId) => audience.recipientRoleScopes.includes(roleId));
+    const roleMatched = conn.identity.roleIds.some((roleId) => audience.recipientRoleScopes.includes(roleId));
     if (!roleMatched) return false;
   }
   return true;
@@ -147,59 +228,119 @@ function ensureGlobalTapSubscription() {
   });
 }
 async function GET(req) {
+  if (hasApiKeyCredentials(req)) {
+    return new Response("Unauthorized", { status: 401 });
+  }
   const { ctx } = await resolveRequestContext(req);
-  if (!ctx.auth?.tenantId || !ctx.auth?.sub) {
+  if (ctx.auth?.isApiKey === true) {
     return new Response("Unauthorized", { status: 401 });
   }
-  const tenantId = ctx.auth.tenantId;
-  const organizationId = ctx.selectedOrganizationId ?? ctx.auth.orgId ?? null;
-  const userId = ctx.auth.sub;
-  const roleIds = Array.isArray(ctx.auth.roles) ? ctx.auth.roles.filter((role) => typeof role === "string" && role.trim().length > 0) : [];
+  const initialIdentity = await resolveConnectionIdentity(ctx, req);
+  if (!initialIdentity) {
+    return new Response("Unauthorized", { status: 401 });
+  }
+  const authorizedIdentity = initialIdentity;
+  const { authRevalidationIntervalMs, connectionMaxAgeMs } = resolveTimingConfig();
   ensureGlobalTapSubscription();
   const encoder = new TextEncoder();
   let heartbeatTimer = null;
+  let authRevalidationTimer = null;
+  let maxAgeTimer = null;
+  let streamController = null;
   let connection = null;
-  const onAbort = () => cleanup();
+  let authRevalidationInFlight = false;
+  let cleanedUp = false;
+  const onAbort = () => closeConnection();
   const stream = new ReadableStream({
     start(controller) {
+      streamController = controller;
       const send = (data) => {
-        controller.enqueue(encoder.encode(`data: ${data}
+        if (cleanedUp) return;
+        try {
+          streamController?.enqueue(encoder.encode(`data: ${data}
 
 `));
+        } catch {
+          closeConnection();
+        }
       };
       connection = {
-        tenantId,
-        organizationId,
-        userId,
-        roleIds,
+        identity: authorizedIdentity,
         send,
-        close: () => controller.close()
+        close: closeConnection
       };
       connections.add(connection);
-      controller.enqueue(encoder.encode(": connected\n\n"));
+      streamController.enqueue(encoder.encode(": connected\n\n"));
       heartbeatTimer = setInterval(() => {
         try {
-          controller.enqueue(encoder.encode(":heartbeat\ndata: :heartbeat\n\n"));
+          streamController?.enqueue(encoder.encode(":heartbeat\ndata: :heartbeat\n\n"));
         } catch {
+          closeConnection();
         }
       }, HEARTBEAT_INTERVAL_MS);
+      authRevalidationTimer = setInterval(() => {
+        void revalidateAuthorization();
+      }, authRevalidationIntervalMs);
+      maxAgeTimer = setTimeout(() => {
+        closeConnection();
+      }, connectionMaxAgeMs);
     },
     cancel() {
       cleanup();
     }
   });
+  async function revalidateAuthorization() {
+    if (cleanedUp || authRevalidationInFlight) return;
+    authRevalidationInFlight = true;
+    try {
+      const validationRequest = createAuthRevalidationRequest(req);
+      const { ctx: freshCtx } = await resolveRequestContext(validationRequest);
+      if (cleanedUp) return;
+      const freshIdentity = await resolveConnectionIdentity(freshCtx, validationRequest);
+      if (!freshIdentity || !identitiesMatch(authorizedIdentity, freshIdentity)) {
+        closeConnection();
+        return;
+      }
+      if (connection) connection.identity = freshIdentity;
+    } catch {
+      closeConnection();
+    } finally {
+      authRevalidationInFlight = false;
+    }
+  }
+  function closeConnection() {
+    if (cleanedUp) return;
+    const controller = streamController;
+    cleanup();
+    try {
+      controller?.close();
+    } catch {
+    }
+  }
   function cleanup() {
+    if (cleanedUp) return;
+    cleanedUp = true;
     if (heartbeatTimer) {
       clearInterval(heartbeatTimer);
       heartbeatTimer = null;
     }
+    if (authRevalidationTimer) {
+      clearInterval(authRevalidationTimer);
+      authRevalidationTimer = null;
+    }
+    if (maxAgeTimer) {
+      clearTimeout(maxAgeTimer);
+      maxAgeTimer = null;
+    }
     if (connection) {
       connections.delete(connection);
       connection = null;
     }
+    streamController = null;
     req.signal.removeEventListener("abort", onAbort);
   }
   req.signal.addEventListener("abort", onAbort, { once: true });
+  if (req.signal.aborted) onAbort();
   return new Response(stream, {
     status: 200,
     headers: {
@@ -213,7 +354,7 @@ async function GET(req) {
 const openApi = {
   GET: {
     summary: "Subscribe to server events via SSE (DOM Event Bridge)",
-    description: "Long-lived SSE connection that receives server-side events marked with clientBroadcast: true. Events are server-filtered by tenant, organization, recipient user, and recipient role.",
+    description: "Server-bounded SSE connection for staff cookie or Bearer authentication that receives server-side events marked with clientBroadcast: true. API-key credentials are not accepted. Events are server-filtered by tenant, organization, recipient user, and recipient role, with periodic canonical authorization revalidation.",
     tags: ["Events"],
     responses: {
       200: {

package/dist/modules/events/api/stream/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/events/api/stream/route.ts"],
-  "sourcesContent": ["/**\n * SSE Event Stream \u2014 DOM Event Bridge\n *\n * Server-Sent Events endpoint that bridges server-side events to the browser.\n * Only events with `clientBroadcast: true` in their EventDefinition are sent.\n * Events are scoped to the authenticated user's tenant.\n *\n * Client consumer: `packages/ui/src/backend/injection/eventBridge.ts`\n */\n\nimport { resolveRequestContext } from '@open-mercato/shared/lib/api/context'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { isBroadcastEvent } from '@open-mercato/shared/modules/events'\nimport {\n  CROSS_PROCESS_EVENT_INSTANCE_ID,\n  registerCrossProcessEventListener,\n  registerGlobalEventTap,\n} from '../../../../bus'\nimport type { EmitOptions } from '../../../../types'\n\nexport const metadata = {\n  GET: { requireAuth: true },\n}\n\nconst HEARTBEAT_INTERVAL_MS = 30_000\nconst MAX_PAYLOAD_BYTES = 4096\n\nconst logger = createLogger('events').child({ component: 'stream' })\n\ntype SseConnection = {\n  tenantId: string\n  organizationId: string | null\n  userId: string\n  roleIds: string[]\n  send: (data: string) => void\n  close: () => void\n}\n\nfunction collectStringValues(input: unknown): string[] {\n  if (!Array.isArray(input)) return []\n  const values: string[] = []\n  for (const value of input) {\n    if (typeof value !== 'string') continue\n    const trimmed = value.trim()\n    if (!trimmed) continue\n    values.push(trimmed)\n  }\n  return values\n}\n\nfunction normalizeAudience(data: Record<string, unknown>, options?: EmitOptions): {\n  tenantId: string | null\n  organizationScopes: string[]\n  recipientUserScopes: string[]\n  recipientRoleScopes: string[]\n} {\n  const hasTrustedScope = options != null\n    && Object.prototype.hasOwnProperty.call(options, 'tenantId')\n  const trustedTenantId = typeof options?.tenantId === 'string' && options.tenantId.trim().length > 0\n    ? options.tenantId.trim()\n    : null\n  const tenantId = hasTrustedScope\n    ? trustedTenantId\n    : (typeof data.tenantId === 'string' ? data.tenantId : null)\n  const organizationScopes = new Set<string>()\n  const trustedOrganizationId = typeof options?.organizationId === 'string' && options.organizationId.trim().length > 0\n    ? options.organizationId.trim()\n    : null\n  if (hasTrustedScope) {\n    if (trustedOrganizationId) organizationScopes.add(trustedOrganizationId)\n    for (const organizationId of collectStringValues(options?.organizationIds)) {\n      organizationScopes.add(organizationId)\n    }\n  } else {\n    if (typeof data.organizationId === 'string' && data.organizationId.trim().length > 0) {\n      organizationScopes.add(data.organizationId.trim())\n    }\n    for (const organizationId of collectStringValues(data.organizationIds)) {\n      organizationScopes.add(organizationId)\n    }\n  }\n\n  const recipientUserScopes = new Set<string>()\n  if (typeof data.recipientUserId === 'string' && data.recipientUserId.trim().length > 0) {\n    recipientUserScopes.add(data.recipientUserId.trim())\n  }\n  for (const userId of collectStringValues(data.recipientUserIds)) {\n    recipientUserScopes.add(userId)\n  }\n\n  const recipientRoleScopes = new Set<string>()\n  if (typeof data.recipientRoleId === 'string' && data.recipientRoleId.trim().length > 0) {\n    recipientRoleScopes.add(data.recipientRoleId.trim())\n  }\n  for (const roleId of collectStringValues(data.recipientRoleIds)) {\n    recipientRoleScopes.add(roleId)\n  }\n\n  return {\n    tenantId,\n    organizationScopes: Array.from(organizationScopes),\n    recipientUserScopes: Array.from(recipientUserScopes),\n    recipientRoleScopes: Array.from(recipientRoleScopes),\n  }\n}\n\nfunction matchesAudience(conn: SseConnection, audience: ReturnType<typeof normalizeAudience>): boolean {\n  if (!audience.tenantId) return false\n  if (conn.tenantId !== audience.tenantId) return false\n\n  if (audience.organizationScopes.length > 0) {\n    if (!conn.organizationId) return false\n    if (!audience.organizationScopes.includes(conn.organizationId)) return false\n  }\n\n  if (audience.recipientUserScopes.length > 0 && !audience.recipientUserScopes.includes(conn.userId)) {\n    return false\n  }\n\n  if (audience.recipientRoleScopes.length > 0) {\n    const roleMatched = conn.roleIds.some((roleId) => audience.recipientRoleScopes.includes(roleId))\n    if (!roleMatched) return false\n  }\n\n  return true\n}\n\n/**\n * Global connection registry.\n * All active SSE connections are tracked here.\n * The event bus subscriber iterates this set on each broadcast event.\n */\nconst connections = new Set<SseConnection>()\n\nlet globalTapRegistered = false\n\nasync function broadcastEventToConnections(\n  eventName: string,\n  payload: Record<string, unknown>,\n  options?: EmitOptions,\n): Promise<void> {\n  if (!eventName || connections.size === 0) return\n\n  if (!isBroadcastEvent(eventName)) return\n\n  const data = payload ?? {}\n  const audience = normalizeAudience(data, options)\n\n  const organizationId = audience.organizationScopes[0] ?? ''\n  let ssePayload = buildSsePayload(eventName, data, organizationId)\n\n  if (new TextEncoder().encode(ssePayload).length > MAX_PAYLOAD_BYTES) {\n    ssePayload = buildTruncatedPayload(eventName, data, organizationId)\n    if (new TextEncoder().encode(ssePayload).length > MAX_PAYLOAD_BYTES) {\n      logger.warn('Event payload exceeds size limit, skipping', { event: eventName, maxBytes: MAX_PAYLOAD_BYTES })\n      return\n    }\n  }\n\n  for (const conn of connections) {\n    if (!matchesAudience(conn, audience)) continue\n\n    try {\n      conn.send(ssePayload)\n    } catch {\n      // Connection may have been closed; cleanup happens via abort handler\n    }\n  }\n}\n\nfunction buildSsePayload(eventName: string, data: Record<string, unknown>, organizationId: string): string {\n  return JSON.stringify({\n    id: eventName,\n    payload: data,\n    timestamp: Date.now(),\n    organizationId,\n  })\n}\n\nfunction buildTruncatedPayload(eventName: string, data: Record<string, unknown>, organizationId: string): string {\n  const entityRef: Record<string, unknown> = {\n    truncated: true,\n  }\n  if (typeof data.id === 'string' && data.id.trim().length > 0) {\n    entityRef.id = data.id.trim()\n  }\n  if (typeof data.entityId === 'string' && data.entityId.trim().length > 0) {\n    entityRef.entityId = data.entityId.trim()\n  }\n  if (typeof data.entityType === 'string' && data.entityType.trim().length > 0) {\n    entityRef.entityType = data.entityType.trim()\n  }\n  return JSON.stringify({\n    id: eventName,\n    payload: entityRef,\n    timestamp: Date.now(),\n    organizationId,\n  })\n}\n\n/**\n * Ensure a process-wide event tap is registered (once).\n * This captures emits from all request-scoped EventBus instances.\n */\nfunction ensureGlobalTapSubscription(): void {\n  if (globalTapRegistered) return\n  globalTapRegistered = true\n\n  registerGlobalEventTap(async (eventName, payload, options) => {\n    await broadcastEventToConnections(eventName, (payload ?? {}) as Record<string, unknown>, options)\n  })\n\n  registerCrossProcessEventListener(async (envelope) => {\n    // Every envelope this process publishes carries originInstanceId, so an\n    // envelope without one can only come from an older process during a\n    // rolling deploy and is always foreign. Falling back to originPid would\n    // discard it whenever both containers run under the same pid \u2014 commonly\n    // pid 1 \u2014 silently dropping browser events across the upgrade window.\n    if (envelope.originInstanceId === CROSS_PROCESS_EVENT_INSTANCE_ID) return\n    await broadcastEventToConnections(\n      envelope.event,\n      (envelope.payload ?? {}) as Record<string, unknown>,\n      envelope.options,\n    )\n  })\n}\n\nexport async function GET(req: Request): Promise<Response> {\n  const { ctx } = await resolveRequestContext(req)\n\n  if (!ctx.auth?.tenantId || !ctx.auth?.sub) {\n    return new Response('Unauthorized', { status: 401 })\n  }\n\n  const tenantId = ctx.auth.tenantId\n  const organizationId = (ctx.selectedOrganizationId as string) ?? ctx.auth.orgId ?? null\n  const userId = ctx.auth.sub\n  const roleIds = Array.isArray(ctx.auth.roles)\n    ? ctx.auth.roles.filter((role): role is string => typeof role === 'string' && role.trim().length > 0)\n    : []\n\n  ensureGlobalTapSubscription()\n\n  const encoder = new TextEncoder()\n  let heartbeatTimer: ReturnType<typeof setInterval> | null = null\n  let connection: SseConnection | null = null\n  const onAbort = () => cleanup()\n\n  const stream = new ReadableStream({\n    start(controller) {\n      const send = (data: string) => {\n        controller.enqueue(encoder.encode(`data: ${data}\\n\\n`))\n      }\n\n      connection = {\n        tenantId,\n        organizationId,\n        userId,\n        roleIds,\n        send,\n        close: () => controller.close(),\n      }\n      connections.add(connection)\n\n      // Flush an initial comment so the runtime sends the response headers and\n      // first body byte immediately. Without it, the streamed Response stays\n      // unflushed until the first heartbeat (30s) or matching event, which\n      // delays the browser EventSource `open` event \u2014 clients that gate work on\n      // a \"connected\" signal would otherwise stall for up to 30s after mount.\n      // Comment lines (`:` prefix) are ignored by EventSource message parsing.\n      controller.enqueue(encoder.encode(': connected\\n\\n'))\n\n      // Start heartbeat to keep connection alive\n      heartbeatTimer = setInterval(() => {\n        try {\n          controller.enqueue(encoder.encode(':heartbeat\\ndata: :heartbeat\\n\\n'))\n        } catch {\n          // Stream may have been closed\n        }\n      }, HEARTBEAT_INTERVAL_MS)\n    },\n    cancel() {\n      cleanup()\n    },\n  })\n\n  function cleanup() {\n    if (heartbeatTimer) {\n      clearInterval(heartbeatTimer)\n      heartbeatTimer = null\n    }\n    if (connection) {\n      connections.delete(connection)\n      connection = null\n    }\n    // Detach from the request signal so reconnect churn does not accumulate\n    // listeners and closures on long-lived AbortSignals.\n    req.signal.removeEventListener('abort', onAbort)\n  }\n\n  req.signal.addEventListener('abort', onAbort, { once: true })\n\n  return new Response(stream, {\n    status: 200,\n    headers: {\n      'Content-Type': 'text/event-stream',\n      'Cache-Control': 'no-cache, no-transform',\n      'Connection': 'keep-alive',\n      'X-Accel-Buffering': 'no',\n    },\n  })\n}\n\nexport const openApi = {\n  GET: {\n    summary: 'Subscribe to server events via SSE (DOM Event Bridge)',\n    description: 'Long-lived SSE connection that receives server-side events marked with clientBroadcast: true. Events are server-filtered by tenant, organization, recipient user, and recipient role.',\n    tags: ['Events'],\n    responses: {\n      200: {\n        description: 'Event stream (text/event-stream)',\n        content: {\n          'text/event-stream': {\n            schema: {\n              type: 'object',\n              properties: {\n                id: { type: 'string', description: 'Event identifier (e.g., example.todo.created)' },\n                payload: { type: 'object', description: 'Event-specific data' },\n                timestamp: { type: 'number', description: 'Server timestamp (ms since epoch)' },\n                organizationId: { type: 'string', description: 'Organization scope' },\n              },\n            },\n          },\n        },\n      },\n      401: { description: 'Not authenticated' },\n    },\n  },\n}\n"],
-  "mappings": "AAUA,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAC7B,SAAS,wBAAwB;AACjC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGA,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAC3B;AAEA,MAAM,wBAAwB;AAC9B,MAAM,oBAAoB;AAE1B,MAAM,SAAS,aAAa,QAAQ,EAAE,MAAM,EAAE,WAAW,SAAS,CAAC;AAWnE,SAAS,oBAAoB,OAA0B;AACrD,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO,CAAC;AACnC,QAAM,SAAmB,CAAC;AAC1B,aAAW,SAAS,OAAO;AACzB,QAAI,OAAO,UAAU,SAAU;AAC/B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,QAAS;AACd,WAAO,KAAK,OAAO;AAAA,EACrB;AACA,SAAO;AACT;AAEA,SAAS,kBAAkB,MAA+B,SAKxD;AACA,QAAM,kBAAkB,WAAW,QAC9B,OAAO,UAAU,eAAe,KAAK,SAAS,UAAU;AAC7D,QAAM,kBAAkB,OAAO,SAAS,aAAa,YAAY,QAAQ,SAAS,KAAK,EAAE,SAAS,IAC9F,QAAQ,SAAS,KAAK,IACtB;AACJ,QAAM,WAAW,kBACb,kBACC,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;AACzD,QAAM,qBAAqB,oBAAI,IAAY;AAC3C,QAAM,wBAAwB,OAAO,SAAS,mBAAmB,YAAY,QAAQ,eAAe,KAAK,EAAE,SAAS,IAChH,QAAQ,eAAe,KAAK,IAC5B;AACJ,MAAI,iBAAiB;AACnB,QAAI,sBAAuB,oBAAmB,IAAI,qBAAqB;AACvE,eAAW,kBAAkB,oBAAoB,SAAS,eAAe,GAAG;AAC1E,yBAAmB,IAAI,cAAc;AAAA,IACvC;AAAA,EACF,OAAO;AACL,QAAI,OAAO,KAAK,mBAAmB,YAAY,KAAK,eAAe,KAAK,EAAE,SAAS,GAAG;AACpF,yBAAmB,IAAI,KAAK,eAAe,KAAK,CAAC;AAAA,IACnD;AACA,eAAW,kBAAkB,oBAAoB,KAAK,eAAe,GAAG;AACtE,yBAAmB,IAAI,cAAc;AAAA,IACvC;AAAA,EACF;AAEA,QAAM,sBAAsB,oBAAI,IAAY;AAC5C,MAAI,OAAO,KAAK,oBAAoB,YAAY,KAAK,gBAAgB,KAAK,EAAE,SAAS,GAAG;AACtF,wBAAoB,IAAI,KAAK,gBAAgB,KAAK,CAAC;AAAA,EACrD;AACA,aAAW,UAAU,oBAAoB,KAAK,gBAAgB,GAAG;AAC/D,wBAAoB,IAAI,MAAM;AAAA,EAChC;AAEA,QAAM,sBAAsB,oBAAI,IAAY;AAC5C,MAAI,OAAO,KAAK,oBAAoB,YAAY,KAAK,gBAAgB,KAAK,EAAE,SAAS,GAAG;AACtF,wBAAoB,IAAI,KAAK,gBAAgB,KAAK,CAAC;AAAA,EACrD;AACA,aAAW,UAAU,oBAAoB,KAAK,gBAAgB,GAAG;AAC/D,wBAAoB,IAAI,MAAM;AAAA,EAChC;AAEA,SAAO;AAAA,IACL;AAAA,IACA,oBAAoB,MAAM,KAAK,kBAAkB;AAAA,IACjD,qBAAqB,MAAM,KAAK,mBAAmB;AAAA,IACnD,qBAAqB,MAAM,KAAK,mBAAmB;AAAA,EACrD;AACF;AAEA,SAAS,gBAAgB,MAAqB,UAAyD;AACrG,MAAI,CAAC,SAAS,SAAU,QAAO;AAC/B,MAAI,KAAK,aAAa,SAAS,SAAU,QAAO;AAEhD,MAAI,SAAS,mBAAmB,SAAS,GAAG;AAC1C,QAAI,CAAC,KAAK,eAAgB,QAAO;AACjC,QAAI,CAAC,SAAS,mBAAmB,SAAS,KAAK,cAAc,EAAG,QAAO;AAAA,EACzE;AAEA,MAAI,SAAS,oBAAoB,SAAS,KAAK,CAAC,SAAS,oBAAoB,SAAS,KAAK,MAAM,GAAG;AAClG,WAAO;AAAA,EACT;AAEA,MAAI,SAAS,oBAAoB,SAAS,GAAG;AAC3C,UAAM,cAAc,KAAK,QAAQ,KAAK,CAAC,WAAW,SAAS,oBAAoB,SAAS,MAAM,CAAC;AAC/F,QAAI,CAAC,YAAa,QAAO;AAAA,EAC3B;AAEA,SAAO;AACT;AAOA,MAAM,cAAc,oBAAI,IAAmB;AAE3C,IAAI,sBAAsB;AAE1B,eAAe,4BACb,WACA,SACA,SACe;AACf,MAAI,CAAC,aAAa,YAAY,SAAS,EAAG;AAE1C,MAAI,CAAC,iBAAiB,SAAS,EAAG;AAElC,QAAM,OAAO,WAAW,CAAC;AACzB,QAAM,WAAW,kBAAkB,MAAM,OAAO;AAEhD,QAAM,iBAAiB,SAAS,mBAAmB,CAAC,KAAK;AACzD,MAAI,aAAa,gBAAgB,WAAW,MAAM,cAAc;AAEhE,MAAI,IAAI,YAAY,EAAE,OAAO,UAAU,EAAE,SAAS,mBAAmB;AACnE,iBAAa,sBAAsB,WAAW,MAAM,cAAc;AAClE,QAAI,IAAI,YAAY,EAAE,OAAO,UAAU,EAAE,SAAS,mBAAmB;AACnE,aAAO,KAAK,8CAA8C,EAAE,OAAO,WAAW,UAAU,kBAAkB,CAAC;AAC3G;AAAA,IACF;AAAA,EACF;AAEA,aAAW,QAAQ,aAAa;AAC9B,QAAI,CAAC,gBAAgB,MAAM,QAAQ,EAAG;AAEtC,QAAI;AACF,WAAK,KAAK,UAAU;AAAA,IACtB,QAAQ;AAAA,IAER;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,WAAmB,MAA+B,gBAAgC;AACzG,SAAO,KAAK,UAAU;AAAA,IACpB,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,WAAW,KAAK,IAAI;AAAA,IACpB;AAAA,EACF,CAAC;AACH;AAEA,SAAS,sBAAsB,WAAmB,MAA+B,gBAAgC;AAC/G,QAAM,YAAqC;AAAA,IACzC,WAAW;AAAA,EACb;AACA,MAAI,OAAO,KAAK,OAAO,YAAY,KAAK,GAAG,KAAK,EAAE,SAAS,GAAG;AAC5D,cAAU,KAAK,KAAK,GAAG,KAAK;AAAA,EAC9B;AACA,MAAI,OAAO,KAAK,aAAa,YAAY,KAAK,SAAS,KAAK,EAAE,SAAS,GAAG;AACxE,cAAU,WAAW,KAAK,SAAS,KAAK;AAAA,EAC1C;AACA,MAAI,OAAO,KAAK,eAAe,YAAY,KAAK,WAAW,KAAK,EAAE,SAAS,GAAG;AAC5E,cAAU,aAAa,KAAK,WAAW,KAAK;AAAA,EAC9C;AACA,SAAO,KAAK,UAAU;AAAA,IACpB,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,WAAW,KAAK,IAAI;AAAA,IACpB;AAAA,EACF,CAAC;AACH;AAMA,SAAS,8BAAoC;AAC3C,MAAI,oBAAqB;AACzB,wBAAsB;AAEtB,yBAAuB,OAAO,WAAW,SAAS,YAAY;AAC5D,UAAM,4BAA4B,WAAY,WAAW,CAAC,GAA+B,OAAO;AAAA,EAClG,CAAC;AAED,oCAAkC,OAAO,aAAa;AAMpD,QAAI,SAAS,qBAAqB,gCAAiC;AACnE,UAAM;AAAA,MACJ,SAAS;AAAA,MACR,SAAS,WAAW,CAAC;AAAA,MACtB,SAAS;AAAA,IACX;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,IAAI,KAAiC;AACzD,QAAM,EAAE,IAAI,IAAI,MAAM,sBAAsB,GAAG;AAE/C,MAAI,CAAC,IAAI,MAAM,YAAY,CAAC,IAAI,MAAM,KAAK;AACzC,WAAO,IAAI,SAAS,gBAAgB,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrD;AAEA,QAAM,WAAW,IAAI,KAAK;AAC1B,QAAM,iBAAkB,IAAI,0BAAqC,IAAI,KAAK,SAAS;AACnF,QAAM,SAAS,IAAI,KAAK;AACxB,QAAM,UAAU,MAAM,QAAQ,IAAI,KAAK,KAAK,IACxC,IAAI,KAAK,MAAM,OAAO,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,KAAK,EAAE,SAAS,CAAC,IAClG,CAAC;AAEL,8BAA4B;AAE5B,QAAM,UAAU,IAAI,YAAY;AAChC,MAAI,iBAAwD;AAC5D,MAAI,aAAmC;AACvC,QAAM,UAAU,MAAM,QAAQ;AAE9B,QAAM,SAAS,IAAI,eAAe;AAAA,IAChC,MAAM,YAAY;AAChB,YAAM,OAAO,CAAC,SAAiB;AAC7B,mBAAW,QAAQ,QAAQ,OAAO,SAAS,IAAI;AAAA;AAAA,CAAM,CAAC;AAAA,MACxD;AAEA,mBAAa;AAAA,QACX;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,OAAO,MAAM,WAAW,MAAM;AAAA,MAChC;AACA,kBAAY,IAAI,UAAU;AAQ1B,iBAAW,QAAQ,QAAQ,OAAO,iBAAiB,CAAC;AAGpD,uBAAiB,YAAY,MAAM;AACjC,YAAI;AACF,qBAAW,QAAQ,QAAQ,OAAO,kCAAkC,CAAC;AAAA,QACvE,QAAQ;AAAA,QAER;AAAA,MACF,GAAG,qBAAqB;AAAA,IAC1B;AAAA,IACA,SAAS;AACP,cAAQ;AAAA,IACV;AAAA,EACF,CAAC;AAED,WAAS,UAAU;AACjB,QAAI,gBAAgB;AAClB,oBAAc,cAAc;AAC5B,uBAAiB;AAAA,IACnB;AACA,QAAI,YAAY;AACd,kBAAY,OAAO,UAAU;AAC7B,mBAAa;AAAA,IACf;AAGA,QAAI,OAAO,oBAAoB,SAAS,OAAO;AAAA,EACjD;AAEA,MAAI,OAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AAE5D,SAAO,IAAI,SAAS,QAAQ;AAAA,IAC1B,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,iBAAiB;AAAA,MACjB,cAAc;AAAA,MACd,qBAAqB;AAAA,IACvB;AAAA,EACF,CAAC;AACH;AAEO,MAAM,UAAU;AAAA,EACrB,KAAK;AAAA,IACH,SAAS;AAAA,IACT,aAAa;AAAA,IACb,MAAM,CAAC,QAAQ;AAAA,IACf,WAAW;AAAA,MACT,KAAK;AAAA,QACH,aAAa;AAAA,QACb,SAAS;AAAA,UACP,qBAAqB;AAAA,YACnB,QAAQ;AAAA,cACN,MAAM;AAAA,cACN,YAAY;AAAA,gBACV,IAAI,EAAE,MAAM,UAAU,aAAa,gDAAgD;AAAA,gBACnF,SAAS,EAAE,MAAM,UAAU,aAAa,sBAAsB;AAAA,gBAC9D,WAAW,EAAE,MAAM,UAAU,aAAa,oCAAoC;AAAA,gBAC9E,gBAAgB,EAAE,MAAM,UAAU,aAAa,qBAAqB;AAAA,cACtE;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,MACA,KAAK,EAAE,aAAa,oBAAoB;AAAA,IAC1C;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * SSE Event Stream \u2014 DOM Event Bridge\n *\n * Server-Sent Events endpoint that bridges server-side events to the browser.\n * Only events with `clientBroadcast: true` in their EventDefinition are sent.\n * Events are scoped to the authenticated user's tenant.\n *\n * Client consumer: `packages/ui/src/backend/injection/eventBridge.ts`\n */\n\nimport { resolveRequestContext } from '@open-mercato/shared/lib/api/context'\nimport type { OrganizationScopeService } from '@open-mercato/shared/lib/auth/principal-service'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { parseNumberWithDefault } from '@open-mercato/shared/lib/number'\nimport { isBroadcastEvent } from '@open-mercato/shared/modules/events'\nimport {\n  CROSS_PROCESS_EVENT_INSTANCE_ID,\n  registerCrossProcessEventListener,\n  registerGlobalEventTap,\n} from '../../../../bus'\nimport type { EmitOptions } from '../../../../types'\n\nexport const metadata = {\n  GET: { requireAuth: true },\n}\n\nconst HEARTBEAT_INTERVAL_MS = 30_000\nconst DEFAULT_AUTH_REVALIDATION_INTERVAL_MS = 30_000\nconst DEFAULT_CONNECTION_MAX_AGE_MS = 5 * 60_000\nconst MIN_AUTH_REVALIDATION_INTERVAL_MS = 1_000\nconst MIN_CONNECTION_MAX_AGE_MS = 1_000\nconst CONNECTION_MAX_AGE_JITTER_RATIO = 0.15\nconst MAX_TIMER_DELAY_MS = 2_147_483_647\nconst MAX_PAYLOAD_BYTES = 4096\n\nconst logger = createLogger('events').child({ component: 'stream' })\n\ntype SseConnectionIdentity = {\n  tenantId: string\n  organizationId: string | null\n  userId: string\n  roleIds: string[]\n}\n\ntype SseConnection = {\n  identity: SseConnectionIdentity\n  send: (data: string) => void\n  close: () => void\n}\n\nfunction resolveTimingConfig(): {\n  authRevalidationIntervalMs: number\n  connectionMaxAgeMs: number\n} {\n  return {\n    authRevalidationIntervalMs: Math.min(\n      parseNumberWithDefault(\n        process.env.OM_EVENTS_SSE_AUTH_REVALIDATION_INTERVAL_MS,\n        DEFAULT_AUTH_REVALIDATION_INTERVAL_MS,\n        { integer: true, min: MIN_AUTH_REVALIDATION_INTERVAL_MS },\n      ),\n      MAX_TIMER_DELAY_MS,\n    ),\n    connectionMaxAgeMs: applyConnectionMaxAgeJitter(\n      parseNumberWithDefault(\n        process.env.OM_EVENTS_SSE_CONNECTION_MAX_AGE_MS,\n        DEFAULT_CONNECTION_MAX_AGE_MS,\n        { integer: true, min: MIN_CONNECTION_MAX_AGE_MS },\n      ),\n    ),\n  }\n}\n\nfunction applyConnectionMaxAgeJitter(configuredMs: number): number {\n  const jitterFactor = 1 + (Math.random() * 2 - 1) * CONNECTION_MAX_AGE_JITTER_RATIO\n  const jitteredMs = Math.round(configuredMs * jitterFactor)\n  return Math.min(Math.max(jitteredMs, MIN_CONNECTION_MAX_AGE_MS), MAX_TIMER_DELAY_MS)\n}\n\nfunction normalizeRoleIds(input: unknown): string[] {\n  if (!Array.isArray(input)) return []\n  return Array.from(new Set(\n    input\n      .filter((role): role is string => typeof role === 'string')\n      .map((role) => role.trim())\n      .filter((role) => role.length > 0),\n  )).sort((left, right) => left.localeCompare(right))\n}\n\nfunction resolveOrganizationScopeService(\n  ctx: Awaited<ReturnType<typeof resolveRequestContext>>['ctx'],\n): OrganizationScopeService | null {\n  try {\n    const service = ctx.container.resolve<OrganizationScopeService>('organizationScopeService')\n    return service && typeof service.resolveForRequest === 'function' ? service : null\n  } catch {\n    return null\n  }\n}\n\nfunction normalizeId(input: unknown): string | null {\n  return typeof input === 'string' && input.trim().length > 0 ? input.trim() : null\n}\n\nasync function resolveConnectionIdentity(\n  ctx: Awaited<ReturnType<typeof resolveRequestContext>>['ctx'],\n  request: Request,\n): Promise<SseConnectionIdentity | null> {\n  const canonicalTenantId = normalizeId(ctx.auth?.tenantId)\n  if (!canonicalTenantId || !ctx.auth?.sub) return null\n  const organizationScopeService = resolveOrganizationScopeService(ctx)\n  if (!organizationScopeService) return null\n  const scope = await organizationScopeService.resolveForRequest({ auth: ctx.auth, request })\n  const tenantId = normalizeId(scope.tenantId)\n  // `selectedId` is null whenever the caller has \"All organizations\" selected \u2014\n  // the default an unrestricted admin's organization switcher persists \u2014 so using\n  // it alone leaves the connection with no organization and `matchesAudience`\n  // then rejects EVERY organization-scoped event. Keep the home-organization\n  // fallback the bridge has always used; the allowed-set check below still\n  // refuses an organization the principal may not see.\n  const organizationId = normalizeId(scope.selectedId) ?? normalizeId(ctx.auth.orgId)\n  if (!tenantId || tenantId !== canonicalTenantId || scope.selectionRejected) return null\n  if (organizationId && Array.isArray(scope.allowedIds) && !scope.allowedIds.includes(organizationId)) {\n    return null\n  }\n  return {\n    tenantId,\n    organizationId,\n    userId: ctx.auth.sub,\n    roleIds: normalizeRoleIds(ctx.auth.roles),\n  }\n}\n\nfunction identitiesMatch(left: SseConnectionIdentity, right: SseConnectionIdentity): boolean {\n  return left.tenantId === right.tenantId\n    && left.organizationId === right.organizationId\n    && left.userId === right.userId\n    && left.roleIds.length === right.roleIds.length\n    && left.roleIds.every((roleId, index) => roleId === right.roleIds[index])\n}\n\nfunction hasApiKeyCredentials(req: Request): boolean {\n  if ((req.headers.get('x-api-key') ?? '').trim().length > 0) return true\n  const authorization = (req.headers.get('authorization') ?? '').trim()\n  return /^apikey(?:\\s|$)/i.test(authorization)\n}\n\nfunction createAuthRevalidationRequest(req: Request): Request {\n  return new Request(req.url, {\n    method: req.method,\n    headers: req.headers,\n  })\n}\n\nfunction collectStringValues(input: unknown): string[] {\n  if (!Array.isArray(input)) return []\n  const values: string[] = []\n  for (const value of input) {\n    if (typeof value !== 'string') continue\n    const trimmed = value.trim()\n    if (!trimmed) continue\n    values.push(trimmed)\n  }\n  return values\n}\n\nfunction normalizeAudience(data: Record<string, unknown>, options?: EmitOptions): {\n  tenantId: string | null\n  organizationScopes: string[]\n  recipientUserScopes: string[]\n  recipientRoleScopes: string[]\n} {\n  const hasTrustedScope = options != null\n    && Object.prototype.hasOwnProperty.call(options, 'tenantId')\n  const trustedTenantId = typeof options?.tenantId === 'string' && options.tenantId.trim().length > 0\n    ? options.tenantId.trim()\n    : null\n  const tenantId = hasTrustedScope\n    ? trustedTenantId\n    : (typeof data.tenantId === 'string' ? data.tenantId : null)\n  const organizationScopes = new Set<string>()\n  const trustedOrganizationId = typeof options?.organizationId === 'string' && options.organizationId.trim().length > 0\n    ? options.organizationId.trim()\n    : null\n  if (hasTrustedScope) {\n    if (trustedOrganizationId) organizationScopes.add(trustedOrganizationId)\n    for (const organizationId of collectStringValues(options?.organizationIds)) {\n      organizationScopes.add(organizationId)\n    }\n  } else {\n    if (typeof data.organizationId === 'string' && data.organizationId.trim().length > 0) {\n      organizationScopes.add(data.organizationId.trim())\n    }\n    for (const organizationId of collectStringValues(data.organizationIds)) {\n      organizationScopes.add(organizationId)\n    }\n  }\n\n  const recipientUserScopes = new Set<string>()\n  if (typeof data.recipientUserId === 'string' && data.recipientUserId.trim().length > 0) {\n    recipientUserScopes.add(data.recipientUserId.trim())\n  }\n  for (const userId of collectStringValues(data.recipientUserIds)) {\n    recipientUserScopes.add(userId)\n  }\n\n  const recipientRoleScopes = new Set<string>()\n  if (typeof data.recipientRoleId === 'string' && data.recipientRoleId.trim().length > 0) {\n    recipientRoleScopes.add(data.recipientRoleId.trim())\n  }\n  for (const roleId of collectStringValues(data.recipientRoleIds)) {\n    recipientRoleScopes.add(roleId)\n  }\n\n  return {\n    tenantId,\n    organizationScopes: Array.from(organizationScopes),\n    recipientUserScopes: Array.from(recipientUserScopes),\n    recipientRoleScopes: Array.from(recipientRoleScopes),\n  }\n}\n\nfunction matchesAudience(conn: SseConnection, audience: ReturnType<typeof normalizeAudience>): boolean {\n  if (!audience.tenantId) return false\n  if (conn.identity.tenantId !== audience.tenantId) return false\n\n  if (audience.organizationScopes.length > 0) {\n    if (!conn.identity.organizationId) return false\n    if (!audience.organizationScopes.includes(conn.identity.organizationId)) return false\n  }\n\n  if (audience.recipientUserScopes.length > 0 && !audience.recipientUserScopes.includes(conn.identity.userId)) {\n    return false\n  }\n\n  if (audience.recipientRoleScopes.length > 0) {\n    const roleMatched = conn.identity.roleIds.some((roleId) => audience.recipientRoleScopes.includes(roleId))\n    if (!roleMatched) return false\n  }\n\n  return true\n}\n\n/**\n * Global connection registry.\n * All active SSE connections are tracked here.\n * The event bus subscriber iterates this set on each broadcast event.\n */\nconst connections = new Set<SseConnection>()\n\nlet globalTapRegistered = false\n\nasync function broadcastEventToConnections(\n  eventName: string,\n  payload: Record<string, unknown>,\n  options?: EmitOptions,\n): Promise<void> {\n  if (!eventName || connections.size === 0) return\n\n  if (!isBroadcastEvent(eventName)) return\n\n  const data = payload ?? {}\n  const audience = normalizeAudience(data, options)\n\n  const organizationId = audience.organizationScopes[0] ?? ''\n  let ssePayload = buildSsePayload(eventName, data, organizationId)\n\n  if (new TextEncoder().encode(ssePayload).length > MAX_PAYLOAD_BYTES) {\n    ssePayload = buildTruncatedPayload(eventName, data, organizationId)\n    if (new TextEncoder().encode(ssePayload).length > MAX_PAYLOAD_BYTES) {\n      logger.warn('Event payload exceeds size limit, skipping', { event: eventName, maxBytes: MAX_PAYLOAD_BYTES })\n      return\n    }\n  }\n\n  for (const conn of connections) {\n    if (!matchesAudience(conn, audience)) continue\n\n    try {\n      conn.send(ssePayload)\n    } catch {\n      // Connection may have been closed; cleanup happens via abort handler\n    }\n  }\n}\n\nfunction buildSsePayload(eventName: string, data: Record<string, unknown>, organizationId: string): string {\n  return JSON.stringify({\n    id: eventName,\n    payload: data,\n    timestamp: Date.now(),\n    organizationId,\n  })\n}\n\nfunction buildTruncatedPayload(eventName: string, data: Record<string, unknown>, organizationId: string): string {\n  const entityRef: Record<string, unknown> = {\n    truncated: true,\n  }\n  if (typeof data.id === 'string' && data.id.trim().length > 0) {\n    entityRef.id = data.id.trim()\n  }\n  if (typeof data.entityId === 'string' && data.entityId.trim().length > 0) {\n    entityRef.entityId = data.entityId.trim()\n  }\n  if (typeof data.entityType === 'string' && data.entityType.trim().length > 0) {\n    entityRef.entityType = data.entityType.trim()\n  }\n  return JSON.stringify({\n    id: eventName,\n    payload: entityRef,\n    timestamp: Date.now(),\n    organizationId,\n  })\n}\n\n/**\n * Ensure a process-wide event tap is registered (once).\n * This captures emits from all request-scoped EventBus instances.\n */\nfunction ensureGlobalTapSubscription(): void {\n  if (globalTapRegistered) return\n  globalTapRegistered = true\n\n  registerGlobalEventTap(async (eventName, payload, options) => {\n    await broadcastEventToConnections(eventName, (payload ?? {}) as Record<string, unknown>, options)\n  })\n\n  registerCrossProcessEventListener(async (envelope) => {\n    // Every envelope this process publishes carries originInstanceId, so an\n    // envelope without one can only come from an older process during a\n    // rolling deploy and is always foreign. Falling back to originPid would\n    // discard it whenever both containers run under the same pid \u2014 commonly\n    // pid 1 \u2014 silently dropping browser events across the upgrade window.\n    if (envelope.originInstanceId === CROSS_PROCESS_EVENT_INSTANCE_ID) return\n    await broadcastEventToConnections(\n      envelope.event,\n      (envelope.payload ?? {}) as Record<string, unknown>,\n      envelope.options,\n    )\n  })\n}\n\nexport async function GET(req: Request): Promise<Response> {\n  if (hasApiKeyCredentials(req)) {\n    return new Response('Unauthorized', { status: 401 })\n  }\n  const { ctx } = await resolveRequestContext(req)\n  if (ctx.auth?.isApiKey === true) {\n    return new Response('Unauthorized', { status: 401 })\n  }\n  const initialIdentity = await resolveConnectionIdentity(ctx, req)\n  if (!initialIdentity) {\n    return new Response('Unauthorized', { status: 401 })\n  }\n  const authorizedIdentity = initialIdentity\n  const { authRevalidationIntervalMs, connectionMaxAgeMs } = resolveTimingConfig()\n\n  ensureGlobalTapSubscription()\n\n  const encoder = new TextEncoder()\n  let heartbeatTimer: ReturnType<typeof setInterval> | null = null\n  let authRevalidationTimer: ReturnType<typeof setInterval> | null = null\n  let maxAgeTimer: ReturnType<typeof setTimeout> | null = null\n  let streamController: ReadableStreamDefaultController<Uint8Array> | null = null\n  let connection: SseConnection | null = null\n  let authRevalidationInFlight = false\n  let cleanedUp = false\n  const onAbort = () => closeConnection()\n\n  const stream = new ReadableStream({\n    start(controller) {\n      streamController = controller\n      const send = (data: string) => {\n        if (cleanedUp) return\n        try {\n          streamController?.enqueue(encoder.encode(`data: ${data}\\n\\n`))\n        } catch {\n          closeConnection()\n        }\n      }\n\n      connection = {\n        identity: authorizedIdentity,\n        send,\n        close: closeConnection,\n      }\n      connections.add(connection)\n\n      // Flush an initial comment so the runtime sends the response headers and\n      // first body byte immediately. Without it, the streamed Response stays\n      // unflushed until the first heartbeat (30s) or matching event, which\n      // delays the browser EventSource `open` event \u2014 clients that gate work on\n      // a \"connected\" signal would otherwise stall for up to 30s after mount.\n      // Comment lines (`:` prefix) are ignored by EventSource message parsing.\n      streamController.enqueue(encoder.encode(': connected\\n\\n'))\n\n      // Start heartbeat to keep connection alive\n      heartbeatTimer = setInterval(() => {\n        try {\n          streamController?.enqueue(encoder.encode(':heartbeat\\ndata: :heartbeat\\n\\n'))\n        } catch {\n          closeConnection()\n        }\n      }, HEARTBEAT_INTERVAL_MS)\n\n      authRevalidationTimer = setInterval(() => {\n        void revalidateAuthorization()\n      }, authRevalidationIntervalMs)\n\n      maxAgeTimer = setTimeout(() => {\n        closeConnection()\n      }, connectionMaxAgeMs)\n    },\n    cancel() {\n      cleanup()\n    },\n  })\n\n  async function revalidateAuthorization(): Promise<void> {\n    if (cleanedUp || authRevalidationInFlight) return\n    authRevalidationInFlight = true\n    try {\n      const validationRequest = createAuthRevalidationRequest(req)\n      const { ctx: freshCtx } = await resolveRequestContext(validationRequest)\n      if (cleanedUp) return\n      const freshIdentity = await resolveConnectionIdentity(freshCtx, validationRequest)\n      if (!freshIdentity || !identitiesMatch(authorizedIdentity, freshIdentity)) {\n        closeConnection()\n        return\n      }\n      if (connection) connection.identity = freshIdentity\n    } catch {\n      closeConnection()\n    } finally {\n      authRevalidationInFlight = false\n    }\n  }\n\n  function closeConnection(): void {\n    if (cleanedUp) return\n    const controller = streamController\n    cleanup()\n    try {\n      controller?.close()\n    } catch {}\n  }\n\n  function cleanup() {\n    if (cleanedUp) return\n    cleanedUp = true\n    if (heartbeatTimer) {\n      clearInterval(heartbeatTimer)\n      heartbeatTimer = null\n    }\n    if (authRevalidationTimer) {\n      clearInterval(authRevalidationTimer)\n      authRevalidationTimer = null\n    }\n    if (maxAgeTimer) {\n      clearTimeout(maxAgeTimer)\n      maxAgeTimer = null\n    }\n    if (connection) {\n      connections.delete(connection)\n      connection = null\n    }\n    streamController = null\n    // Detach from the request signal so reconnect churn does not accumulate\n    // listeners and closures on long-lived AbortSignals.\n    req.signal.removeEventListener('abort', onAbort)\n  }\n\n  req.signal.addEventListener('abort', onAbort, { once: true })\n  if (req.signal.aborted) onAbort()\n\n  return new Response(stream, {\n    status: 200,\n    headers: {\n      'Content-Type': 'text/event-stream',\n      'Cache-Control': 'no-cache, no-transform',\n      'Connection': 'keep-alive',\n      'X-Accel-Buffering': 'no',\n    },\n  })\n}\n\nexport const openApi = {\n  GET: {\n    summary: 'Subscribe to server events via SSE (DOM Event Bridge)',\n    description: 'Server-bounded SSE connection for staff cookie or Bearer authentication that receives server-side events marked with clientBroadcast: true. API-key credentials are not accepted. Events are server-filtered by tenant, organization, recipient user, and recipient role, with periodic canonical authorization revalidation.',\n    tags: ['Events'],\n    responses: {\n      200: {\n        description: 'Event stream (text/event-stream)',\n        content: {\n          'text/event-stream': {\n            schema: {\n              type: 'object',\n              properties: {\n                id: { type: 'string', description: 'Event identifier (e.g., example.todo.created)' },\n                payload: { type: 'object', description: 'Event-specific data' },\n                timestamp: { type: 'number', description: 'Server timestamp (ms since epoch)' },\n                organizationId: { type: 'string', description: 'Organization scope' },\n              },\n            },\n          },\n        },\n      },\n      401: { description: 'Not authenticated' },\n    },\n  },\n}\n"],
+  "mappings": "AAUA,SAAS,6BAA6B;AAEtC,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,wBAAwB;AACjC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGA,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAC3B;AAEA,MAAM,wBAAwB;AAC9B,MAAM,wCAAwC;AAC9C,MAAM,gCAAgC,IAAI;AAC1C,MAAM,oCAAoC;AAC1C,MAAM,4BAA4B;AAClC,MAAM,kCAAkC;AACxC,MAAM,qBAAqB;AAC3B,MAAM,oBAAoB;AAE1B,MAAM,SAAS,aAAa,QAAQ,EAAE,MAAM,EAAE,WAAW,SAAS,CAAC;AAenE,SAAS,sBAGP;AACA,SAAO;AAAA,IACL,4BAA4B,KAAK;AAAA,MAC/B;AAAA,QACE,QAAQ,IAAI;AAAA,QACZ;AAAA,QACA,EAAE,SAAS,MAAM,KAAK,kCAAkC;AAAA,MAC1D;AAAA,MACA;AAAA,IACF;AAAA,IACA,oBAAoB;AAAA,MAClB;AAAA,QACE,QAAQ,IAAI;AAAA,QACZ;AAAA,QACA,EAAE,SAAS,MAAM,KAAK,0BAA0B;AAAA,MAClD;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,4BAA4B,cAA8B;AACjE,QAAM,eAAe,KAAK,KAAK,OAAO,IAAI,IAAI,KAAK;AACnD,QAAM,aAAa,KAAK,MAAM,eAAe,YAAY;AACzD,SAAO,KAAK,IAAI,KAAK,IAAI,YAAY,yBAAyB,GAAG,kBAAkB;AACrF;AAEA,SAAS,iBAAiB,OAA0B;AAClD,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO,CAAC;AACnC,SAAO,MAAM,KAAK,IAAI;AAAA,IACpB,MACG,OAAO,CAAC,SAAyB,OAAO,SAAS,QAAQ,EACzD,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC;AAAA,EACrC,CAAC,EAAE,KAAK,CAAC,MAAM,UAAU,KAAK,cAAc,KAAK,CAAC;AACpD;AAEA,SAAS,gCACP,KACiC;AACjC,MAAI;AACF,UAAM,UAAU,IAAI,UAAU,QAAkC,0BAA0B;AAC1F,WAAO,WAAW,OAAO,QAAQ,sBAAsB,aAAa,UAAU;AAAA,EAChF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,YAAY,OAA+B;AAClD,SAAO,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,IAAI,MAAM,KAAK,IAAI;AAC/E;AAEA,eAAe,0BACb,KACA,SACuC;AACvC,QAAM,oBAAoB,YAAY,IAAI,MAAM,QAAQ;AACxD,MAAI,CAAC,qBAAqB,CAAC,IAAI,MAAM,IAAK,QAAO;AACjD,QAAM,2BAA2B,gCAAgC,GAAG;AACpE,MAAI,CAAC,yBAA0B,QAAO;AACtC,QAAM,QAAQ,MAAM,yBAAyB,kBAAkB,EAAE,MAAM,IAAI,MAAM,QAAQ,CAAC;AAC1F,QAAM,WAAW,YAAY,MAAM,QAAQ;AAO3C,QAAM,iBAAiB,YAAY,MAAM,UAAU,KAAK,YAAY,IAAI,KAAK,KAAK;AAClF,MAAI,CAAC,YAAY,aAAa,qBAAqB,MAAM,kBAAmB,QAAO;AACnF,MAAI,kBAAkB,MAAM,QAAQ,MAAM,UAAU,KAAK,CAAC,MAAM,WAAW,SAAS,cAAc,GAAG;AACnG,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,QAAQ,IAAI,KAAK;AAAA,IACjB,SAAS,iBAAiB,IAAI,KAAK,KAAK;AAAA,EAC1C;AACF;AAEA,SAAS,gBAAgB,MAA6B,OAAuC;AAC3F,SAAO,KAAK,aAAa,MAAM,YAC1B,KAAK,mBAAmB,MAAM,kBAC9B,KAAK,WAAW,MAAM,UACtB,KAAK,QAAQ,WAAW,MAAM,QAAQ,UACtC,KAAK,QAAQ,MAAM,CAAC,QAAQ,UAAU,WAAW,MAAM,QAAQ,KAAK,CAAC;AAC5E;AAEA,SAAS,qBAAqB,KAAuB;AACnD,OAAK,IAAI,QAAQ,IAAI,WAAW,KAAK,IAAI,KAAK,EAAE,SAAS,EAAG,QAAO;AACnE,QAAM,iBAAiB,IAAI,QAAQ,IAAI,eAAe,KAAK,IAAI,KAAK;AACpE,SAAO,mBAAmB,KAAK,aAAa;AAC9C;AAEA,SAAS,8BAA8B,KAAuB;AAC5D,SAAO,IAAI,QAAQ,IAAI,KAAK;AAAA,IAC1B,QAAQ,IAAI;AAAA,IACZ,SAAS,IAAI;AAAA,EACf,CAAC;AACH;AAEA,SAAS,oBAAoB,OAA0B;AACrD,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO,CAAC;AACnC,QAAM,SAAmB,CAAC;AAC1B,aAAW,SAAS,OAAO;AACzB,QAAI,OAAO,UAAU,SAAU;AAC/B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,QAAS;AACd,WAAO,KAAK,OAAO;AAAA,EACrB;AACA,SAAO;AACT;AAEA,SAAS,kBAAkB,MAA+B,SAKxD;AACA,QAAM,kBAAkB,WAAW,QAC9B,OAAO,UAAU,eAAe,KAAK,SAAS,UAAU;AAC7D,QAAM,kBAAkB,OAAO,SAAS,aAAa,YAAY,QAAQ,SAAS,KAAK,EAAE,SAAS,IAC9F,QAAQ,SAAS,KAAK,IACtB;AACJ,QAAM,WAAW,kBACb,kBACC,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;AACzD,QAAM,qBAAqB,oBAAI,IAAY;AAC3C,QAAM,wBAAwB,OAAO,SAAS,mBAAmB,YAAY,QAAQ,eAAe,KAAK,EAAE,SAAS,IAChH,QAAQ,eAAe,KAAK,IAC5B;AACJ,MAAI,iBAAiB;AACnB,QAAI,sBAAuB,oBAAmB,IAAI,qBAAqB;AACvE,eAAW,kBAAkB,oBAAoB,SAAS,eAAe,GAAG;AAC1E,yBAAmB,IAAI,cAAc;AAAA,IACvC;AAAA,EACF,OAAO;AACL,QAAI,OAAO,KAAK,mBAAmB,YAAY,KAAK,eAAe,KAAK,EAAE,SAAS,GAAG;AACpF,yBAAmB,IAAI,KAAK,eAAe,KAAK,CAAC;AAAA,IACnD;AACA,eAAW,kBAAkB,oBAAoB,KAAK,eAAe,GAAG;AACtE,yBAAmB,IAAI,cAAc;AAAA,IACvC;AAAA,EACF;AAEA,QAAM,sBAAsB,oBAAI,IAAY;AAC5C,MAAI,OAAO,KAAK,oBAAoB,YAAY,KAAK,gBAAgB,KAAK,EAAE,SAAS,GAAG;AACtF,wBAAoB,IAAI,KAAK,gBAAgB,KAAK,CAAC;AAAA,EACrD;AACA,aAAW,UAAU,oBAAoB,KAAK,gBAAgB,GAAG;AAC/D,wBAAoB,IAAI,MAAM;AAAA,EAChC;AAEA,QAAM,sBAAsB,oBAAI,IAAY;AAC5C,MAAI,OAAO,KAAK,oBAAoB,YAAY,KAAK,gBAAgB,KAAK,EAAE,SAAS,GAAG;AACtF,wBAAoB,IAAI,KAAK,gBAAgB,KAAK,CAAC;AAAA,EACrD;AACA,aAAW,UAAU,oBAAoB,KAAK,gBAAgB,GAAG;AAC/D,wBAAoB,IAAI,MAAM;AAAA,EAChC;AAEA,SAAO;AAAA,IACL;AAAA,IACA,oBAAoB,MAAM,KAAK,kBAAkB;AAAA,IACjD,qBAAqB,MAAM,KAAK,mBAAmB;AAAA,IACnD,qBAAqB,MAAM,KAAK,mBAAmB;AAAA,EACrD;AACF;AAEA,SAAS,gBAAgB,MAAqB,UAAyD;AACrG,MAAI,CAAC,SAAS,SAAU,QAAO;AAC/B,MAAI,KAAK,SAAS,aAAa,SAAS,SAAU,QAAO;AAEzD,MAAI,SAAS,mBAAmB,SAAS,GAAG;AAC1C,QAAI,CAAC,KAAK,SAAS,eAAgB,QAAO;AAC1C,QAAI,CAAC,SAAS,mBAAmB,SAAS,KAAK,SAAS,cAAc,EAAG,QAAO;AAAA,EAClF;AAEA,MAAI,SAAS,oBAAoB,SAAS,KAAK,CAAC,SAAS,oBAAoB,SAAS,KAAK,SAAS,MAAM,GAAG;AAC3G,WAAO;AAAA,EACT;AAEA,MAAI,SAAS,oBAAoB,SAAS,GAAG;AAC3C,UAAM,cAAc,KAAK,SAAS,QAAQ,KAAK,CAAC,WAAW,SAAS,oBAAoB,SAAS,MAAM,CAAC;AACxG,QAAI,CAAC,YAAa,QAAO;AAAA,EAC3B;AAEA,SAAO;AACT;AAOA,MAAM,cAAc,oBAAI,IAAmB;AAE3C,IAAI,sBAAsB;AAE1B,eAAe,4BACb,WACA,SACA,SACe;AACf,MAAI,CAAC,aAAa,YAAY,SAAS,EAAG;AAE1C,MAAI,CAAC,iBAAiB,SAAS,EAAG;AAElC,QAAM,OAAO,WAAW,CAAC;AACzB,QAAM,WAAW,kBAAkB,MAAM,OAAO;AAEhD,QAAM,iBAAiB,SAAS,mBAAmB,CAAC,KAAK;AACzD,MAAI,aAAa,gBAAgB,WAAW,MAAM,cAAc;AAEhE,MAAI,IAAI,YAAY,EAAE,OAAO,UAAU,EAAE,SAAS,mBAAmB;AACnE,iBAAa,sBAAsB,WAAW,MAAM,cAAc;AAClE,QAAI,IAAI,YAAY,EAAE,OAAO,UAAU,EAAE,SAAS,mBAAmB;AACnE,aAAO,KAAK,8CAA8C,EAAE,OAAO,WAAW,UAAU,kBAAkB,CAAC;AAC3G;AAAA,IACF;AAAA,EACF;AAEA,aAAW,QAAQ,aAAa;AAC9B,QAAI,CAAC,gBAAgB,MAAM,QAAQ,EAAG;AAEtC,QAAI;AACF,WAAK,KAAK,UAAU;AAAA,IACtB,QAAQ;AAAA,IAER;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,WAAmB,MAA+B,gBAAgC;AACzG,SAAO,KAAK,UAAU;AAAA,IACpB,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,WAAW,KAAK,IAAI;AAAA,IACpB;AAAA,EACF,CAAC;AACH;AAEA,SAAS,sBAAsB,WAAmB,MAA+B,gBAAgC;AAC/G,QAAM,YAAqC;AAAA,IACzC,WAAW;AAAA,EACb;AACA,MAAI,OAAO,KAAK,OAAO,YAAY,KAAK,GAAG,KAAK,EAAE,SAAS,GAAG;AAC5D,cAAU,KAAK,KAAK,GAAG,KAAK;AAAA,EAC9B;AACA,MAAI,OAAO,KAAK,aAAa,YAAY,KAAK,SAAS,KAAK,EAAE,SAAS,GAAG;AACxE,cAAU,WAAW,KAAK,SAAS,KAAK;AAAA,EAC1C;AACA,MAAI,OAAO,KAAK,eAAe,YAAY,KAAK,WAAW,KAAK,EAAE,SAAS,GAAG;AAC5E,cAAU,aAAa,KAAK,WAAW,KAAK;AAAA,EAC9C;AACA,SAAO,KAAK,UAAU;AAAA,IACpB,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,WAAW,KAAK,IAAI;AAAA,IACpB;AAAA,EACF,CAAC;AACH;AAMA,SAAS,8BAAoC;AAC3C,MAAI,oBAAqB;AACzB,wBAAsB;AAEtB,yBAAuB,OAAO,WAAW,SAAS,YAAY;AAC5D,UAAM,4BAA4B,WAAY,WAAW,CAAC,GAA+B,OAAO;AAAA,EAClG,CAAC;AAED,oCAAkC,OAAO,aAAa;AAMpD,QAAI,SAAS,qBAAqB,gCAAiC;AACnE,UAAM;AAAA,MACJ,SAAS;AAAA,MACR,SAAS,WAAW,CAAC;AAAA,MACtB,SAAS;AAAA,IACX;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,IAAI,KAAiC;AACzD,MAAI,qBAAqB,GAAG,GAAG;AAC7B,WAAO,IAAI,SAAS,gBAAgB,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrD;AACA,QAAM,EAAE,IAAI,IAAI,MAAM,sBAAsB,GAAG;AAC/C,MAAI,IAAI,MAAM,aAAa,MAAM;AAC/B,WAAO,IAAI,SAAS,gBAAgB,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrD;AACA,QAAM,kBAAkB,MAAM,0BAA0B,KAAK,GAAG;AAChE,MAAI,CAAC,iBAAiB;AACpB,WAAO,IAAI,SAAS,gBAAgB,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrD;AACA,QAAM,qBAAqB;AAC3B,QAAM,EAAE,4BAA4B,mBAAmB,IAAI,oBAAoB;AAE/E,8BAA4B;AAE5B,QAAM,UAAU,IAAI,YAAY;AAChC,MAAI,iBAAwD;AAC5D,MAAI,wBAA+D;AACnE,MAAI,cAAoD;AACxD,MAAI,mBAAuE;AAC3E,MAAI,aAAmC;AACvC,MAAI,2BAA2B;AAC/B,MAAI,YAAY;AAChB,QAAM,UAAU,MAAM,gBAAgB;AAEtC,QAAM,SAAS,IAAI,eAAe;AAAA,IAChC,MAAM,YAAY;AAChB,yBAAmB;AACnB,YAAM,OAAO,CAAC,SAAiB;AAC7B,YAAI,UAAW;AACf,YAAI;AACF,4BAAkB,QAAQ,QAAQ,OAAO,SAAS,IAAI;AAAA;AAAA,CAAM,CAAC;AAAA,QAC/D,QAAQ;AACN,0BAAgB;AAAA,QAClB;AAAA,MACF;AAEA,mBAAa;AAAA,QACX,UAAU;AAAA,QACV;AAAA,QACA,OAAO;AAAA,MACT;AACA,kBAAY,IAAI,UAAU;AAQ1B,uBAAiB,QAAQ,QAAQ,OAAO,iBAAiB,CAAC;AAG1D,uBAAiB,YAAY,MAAM;AACjC,YAAI;AACF,4BAAkB,QAAQ,QAAQ,OAAO,kCAAkC,CAAC;AAAA,QAC9E,QAAQ;AACN,0BAAgB;AAAA,QAClB;AAAA,MACF,GAAG,qBAAqB;AAExB,8BAAwB,YAAY,MAAM;AACxC,aAAK,wBAAwB;AAAA,MAC/B,GAAG,0BAA0B;AAE7B,oBAAc,WAAW,MAAM;AAC7B,wBAAgB;AAAA,MAClB,GAAG,kBAAkB;AAAA,IACvB;AAAA,IACA,SAAS;AACP,cAAQ;AAAA,IACV;AAAA,EACF,CAAC;AAED,iBAAe,0BAAyC;AACtD,QAAI,aAAa,yBAA0B;AAC3C,+BAA2B;AAC3B,QAAI;AACF,YAAM,oBAAoB,8BAA8B,GAAG;AAC3D,YAAM,EAAE,KAAK,SAAS,IAAI,MAAM,sBAAsB,iBAAiB;AACvE,UAAI,UAAW;AACf,YAAM,gBAAgB,MAAM,0BAA0B,UAAU,iBAAiB;AACjF,UAAI,CAAC,iBAAiB,CAAC,gBAAgB,oBAAoB,aAAa,GAAG;AACzE,wBAAgB;AAChB;AAAA,MACF;AACA,UAAI,WAAY,YAAW,WAAW;AAAA,IACxC,QAAQ;AACN,sBAAgB;AAAA,IAClB,UAAE;AACA,iCAA2B;AAAA,IAC7B;AAAA,EACF;AAEA,WAAS,kBAAwB;AAC/B,QAAI,UAAW;AACf,UAAM,aAAa;AACnB,YAAQ;AACR,QAAI;AACF,kBAAY,MAAM;AAAA,IACpB,QAAQ;AAAA,IAAC;AAAA,EACX;AAEA,WAAS,UAAU;AACjB,QAAI,UAAW;AACf,gBAAY;AACZ,QAAI,gBAAgB;AAClB,oBAAc,cAAc;AAC5B,uBAAiB;AAAA,IACnB;AACA,QAAI,uBAAuB;AACzB,oBAAc,qBAAqB;AACnC,8BAAwB;AAAA,IAC1B;AACA,QAAI,aAAa;AACf,mBAAa,WAAW;AACxB,oBAAc;AAAA,IAChB;AACA,QAAI,YAAY;AACd,kBAAY,OAAO,UAAU;AAC7B,mBAAa;AAAA,IACf;AACA,uBAAmB;AAGnB,QAAI,OAAO,oBAAoB,SAAS,OAAO;AAAA,EACjD;AAEA,MAAI,OAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AAC5D,MAAI,IAAI,OAAO,QAAS,SAAQ;AAEhC,SAAO,IAAI,SAAS,QAAQ;AAAA,IAC1B,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,iBAAiB;AAAA,MACjB,cAAc;AAAA,MACd,qBAAqB;AAAA,IACvB;AAAA,EACF,CAAC;AACH;AAEO,MAAM,UAAU;AAAA,EACrB,KAAK;AAAA,IACH,SAAS;AAAA,IACT,aAAa;AAAA,IACb,MAAM,CAAC,QAAQ;AAAA,IACf,WAAW;AAAA,MACT,KAAK;AAAA,QACH,aAAa;AAAA,QACb,SAAS;AAAA,UACP,qBAAqB;AAAA,YACnB,QAAQ;AAAA,cACN,MAAM;AAAA,cACN,YAAY;AAAA,gBACV,IAAI,EAAE,MAAM,UAAU,aAAa,gDAAgD;AAAA,gBACnF,SAAS,EAAE,MAAM,UAAU,aAAa,sBAAsB;AAAA,gBAC9D,WAAW,EAAE,MAAM,UAAU,aAAa,oCAAoC;AAAA,gBAC9E,gBAAgB,EAAE,MAAM,UAAU,aAAa,qBAAqB;AAAA,cACtE;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,MACA,KAAK,EAAE,aAAa,oBAAoB;AAAA,IAC1C;AAAA,EACF;AACF;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/events",
-  "version": "0.8.1-develop.7296.1.2111d779db",
+  "version": "0.9.0",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -33,8 +33,8 @@
     }
   },
   "dependencies": {
-    "@open-mercato/queue": "0.8.1-develop.7296.1.2111d779db",
-    "@open-mercato/shared": "0.8.1-develop.7296.1.2111d779db",
+    "@open-mercato/queue": "0.9.0",
+    "@open-mercato/shared": "0.9.0",
     "pg": "8.23.0"
   },
   "devDependencies": {
@@ -50,6 +50,5 @@
     "type": "git",
     "url": "https://github.com/open-mercato/open-mercato",
     "directory": "packages/events"
-  },
-  "stableVersion": "0.8.0"
+  }
 }

package/src/__tests__/broadcast-coalescer.test.ts

@@ -0,0 +1,172 @@
+import {
+  BROADCAST_FLUSH_DEADLINE_MS,
+  flushPendingBroadcasts,
+  resetBroadcastCoalescerForTests,
+  resolveBroadcastCoalesceIntervalMs,
+  submitBroadcast,
+} from '../broadcast-coalescer'
+
+const INTERVAL_MS = 50
+
+function wait(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms))
+}
+
+describe('broadcast coalescer', () => {
+  const originalInterval = process.env.OM_BROADCAST_COALESCE_INTERVAL_MS
+
+  afterEach(() => {
+    resetBroadcastCoalescerForTests()
+    if (originalInterval === undefined) delete process.env.OM_BROADCAST_COALESCE_INTERVAL_MS
+    else process.env.OM_BROADCAST_COALESCE_INTERVAL_MS = originalInterval
+  })
+
+  it('collapses a burst to a leading dispatch plus a trailing flush carrying the newest payload', async () => {
+    const delivered: number[] = []
+
+    for (let index = 0; index < 50; index += 1) {
+      await submitBroadcast('key', async () => { delivered.push(index) }, { intervalMs: INTERVAL_MS })
+    }
+
+    // Leading edge only, so far: the other 49 were superseded, not delivered.
+    expect(delivered).toEqual([0])
+
+    await wait(INTERVAL_MS * 2)
+
+    // The trailing flush is unconditional, and the survivor is the LAST emit —
+    // the property that keeps a DataTable from ending a burst stale.
+    expect(delivered).toEqual([0, 49])
+  })
+
+  it('never lets one key suppress or impersonate another', async () => {
+    const tenantA: string[] = []
+    const tenantB: string[] = []
+
+    await submitBroadcast('event::tenant-a::', async () => { tenantA.push('a1') }, { intervalMs: INTERVAL_MS })
+    await submitBroadcast('event::tenant-b::', async () => { tenantB.push('b1') }, { intervalMs: INTERVAL_MS })
+    await submitBroadcast('event::tenant-a::', async () => { tenantA.push('a2') }, { intervalMs: INTERVAL_MS })
+    await submitBroadcast('event::tenant-b::', async () => { tenantB.push('b2') }, { intervalMs: INTERVAL_MS })
+
+    expect(tenantA).toEqual(['a1'])
+    expect(tenantB).toEqual(['b1'])
+
+    await wait(INTERVAL_MS * 2)
+
+    expect(tenantA).toEqual(['a1', 'a2'])
+    expect(tenantB).toEqual(['b1', 'b2'])
+  })
+
+  it('dispatches every submission synchronously when the interval is zero', async () => {
+    const delivered: number[] = []
+
+    for (let index = 0; index < 5; index += 1) {
+      await submitBroadcast('key', async () => { delivered.push(index) }, { intervalMs: 0 })
+    }
+
+    expect(delivered).toEqual([0, 1, 2, 3, 4])
+  })
+
+  it('contains a failing deferred dispatch so the next window still delivers', async () => {
+    const delivered: string[] = []
+
+    await submitBroadcast('key', async () => { delivered.push('leading') }, { intervalMs: INTERVAL_MS })
+    await submitBroadcast('key', async () => { throw new Error('[internal] pg_notify unavailable') }, { intervalMs: INTERVAL_MS })
+
+    await wait(INTERVAL_MS * 2)
+
+    await submitBroadcast('key', async () => { delivered.push('after-failure') }, { intervalMs: INTERVAL_MS })
+    await wait(INTERVAL_MS * 2)
+
+    expect(delivered).toContain('leading')
+    expect(delivered).toContain('after-failure')
+  })
+
+  it('flushes pending survivors on shutdown instead of dropping the tail', async () => {
+    const delivered: string[] = []
+
+    await submitBroadcast('key', async () => { delivered.push('leading') }, { intervalMs: 10_000 })
+    await submitBroadcast('key', async () => { delivered.push('tail') }, { intervalMs: 10_000 })
+
+    expect(delivered).toEqual(['leading'])
+
+    await flushPendingBroadcasts()
+
+    expect(delivered).toEqual(['leading', 'tail'])
+  })
+
+  it('bounds a shutdown flush by its deadline when a dispatch hangs', async () => {
+    const delivered: string[] = []
+
+    await submitBroadcast('key', async () => { delivered.push('leading') }, { intervalMs: 10_000 })
+    await submitBroadcast('key', () => new Promise<void>(() => {}), { intervalMs: 10_000 })
+    await submitBroadcast('other', async () => { delivered.push('other-leading') }, { intervalMs: 10_000 })
+    await submitBroadcast('other', async () => { delivered.push('other-tail') }, { intervalMs: 10_000 })
+
+    const startedAt = Date.now()
+    await flushPendingBroadcasts({ deadlineMs: INTERVAL_MS })
+    const elapsedMs = Date.now() - startedAt
+
+    expect(elapsedMs).toBeGreaterThanOrEqual(INTERVAL_MS - 5)
+    expect(elapsedMs).toBeLessThan(INTERVAL_MS * 20)
+    expect(delivered).toEqual(['leading', 'other-leading', 'other-tail'])
+  })
+
+  it('exposes a fixed 3000ms exit deadline', () => {
+    expect(BROADCAST_FLUSH_DEADLINE_MS).toBe(3000)
+  })
+
+  it('never runs two deliveries of one key concurrently, so an older payload cannot land last', async () => {
+    const started: string[] = []
+    const finished: string[] = []
+
+    const slowDispatch = (label: string, durationMs: number) => async () => {
+      started.push(label)
+      await wait(durationMs)
+      finished.push(label)
+    }
+
+    // Leading edge takes far longer than one window, so a naive re-arm would fire
+    // the next flush while it is still in flight.
+    await submitBroadcast('key', slowDispatch('first', INTERVAL_MS * 3), { intervalMs: INTERVAL_MS })
+    await submitBroadcast('key', slowDispatch('second', 0), { intervalMs: INTERVAL_MS })
+
+    await wait(INTERVAL_MS * 6)
+
+    expect(started).toEqual(['first', 'second'])
+    expect(finished).toEqual(['first', 'second'])
+    // 'second' must not have started before 'first' completed.
+    expect(started.indexOf('second')).toBeGreaterThanOrEqual(0)
+    expect(finished.indexOf('first')).toBeLessThan(finished.indexOf('second'))
+  })
+
+  it('forgets a key once its burst ends, so pending state stays bounded', async () => {
+    const delivered: string[] = []
+    await submitBroadcast('key', async () => { delivered.push('first') }, { intervalMs: INTERVAL_MS })
+    await wait(INTERVAL_MS * 2)
+
+    // The window closed with nothing superseded, so the next submit is a fresh
+    // leading edge rather than a queued survivor.
+    await submitBroadcast('key', async () => { delivered.push('second') }, { intervalMs: INTERVAL_MS })
+
+    expect(delivered).toEqual(['first', 'second'])
+  })
+
+  describe('interval resolution', () => {
+    it('defaults to 250ms and rejects unusable values', () => {
+      delete process.env.OM_BROADCAST_COALESCE_INTERVAL_MS
+      expect(resolveBroadcastCoalesceIntervalMs()).toBe(250)
+
+      process.env.OM_BROADCAST_COALESCE_INTERVAL_MS = '0'
+      expect(resolveBroadcastCoalesceIntervalMs()).toBe(0)
+
+      process.env.OM_BROADCAST_COALESCE_INTERVAL_MS = '1000'
+      expect(resolveBroadcastCoalesceIntervalMs()).toBe(1000)
+
+      process.env.OM_BROADCAST_COALESCE_INTERVAL_MS = '-5'
+      expect(resolveBroadcastCoalesceIntervalMs()).toBe(250)
+
+      process.env.OM_BROADCAST_COALESCE_INTERVAL_MS = 'soon'
+      expect(resolveBroadcastCoalesceIntervalMs()).toBe(250)
+    })
+  })
+})