@relaycast/engine 5.0.0 → 5.0.2

package/dist/auth/index.js

@@ -1,6 +1,8 @@
 import { eq } from 'drizzle-orm';
-import { workspaces, agents } from '../db/schema.js';
+import { workspaces, agents, nodes } from '../db/schema.js';
 import { sha256Hex } from '../lib/crypto.js';
+import { getActiveObserverTokenByHash } from '../engine/observerToken.js';
+import { parseAuthToken, validateTokenRequirement } from './tokenKind.js';
 /** SHA-256 hash of a raw token to its stored form. */
 export function hashToken(token) {
     return sha256Hex(token);
@@ -22,20 +24,22 @@ export class SqliteApiKeyAuthProvider {
     }
     async authenticate(args) {
         const { token, require, db } = args;
+        const parsedToken = parseAuthToken(token);
+        if (!parsedToken) {
+            return unauthorized('Invalid token format');
+        }
+        const requirement = validateTokenRequirement(parsedToken.kind, require);
+        if (!requirement.ok) {
+            return unauthorized(requirement.message, requirement.code);
+        }
         const hash = await hashToken(token);
-        if (token.startsWith('rk_live_')) {
-            if (require === 'agent') {
-                return unauthorized('Agent token required (at_live_...)');
-            }
+        if (parsedToken.kind === 'workspace') {
             const [workspace] = await db.select().from(workspaces).where(eq(workspaces.apiKeyHash, hash));
             if (!workspace)
                 return unauthorized('Invalid API key');
             return { ok: true, workspace };
         }
-        if (token.startsWith('at_live_')) {
-            if (require === 'workspace') {
-                return unauthorized('Workspace key required (rk_live_...)');
-            }
+        if (parsedToken.kind === 'agent') {
             const [agent] = await db.select().from(agents).where(eq(agents.tokenHash, hash));
             if (!agent)
                 return unauthorized('Invalid agent token', 'agent_token_invalid');
@@ -44,6 +48,24 @@ export class SqliteApiKeyAuthProvider {
                 return unauthorized('Workspace not found');
             return { ok: true, workspace, agent };
         }
+        if (parsedToken.kind === 'node') {
+            const [node] = await db.select().from(nodes).where(eq(nodes.tokenHash, hash));
+            if (!node)
+                return unauthorized('Invalid node token', 'node_token_invalid');
+            const [workspace] = await db.select().from(workspaces).where(eq(workspaces.id, node.workspaceId));
+            if (!workspace)
+                return unauthorized('Workspace not found');
+            return { ok: true, workspace, node };
+        }
+        if (parsedToken.kind === 'observer') {
+            const observerToken = await getActiveObserverTokenByHash(db, hash);
+            if (!observerToken)
+                return unauthorized('Invalid observer token', 'observer_token_invalid');
+            const [workspace] = await db.select().from(workspaces).where(eq(workspaces.id, observerToken.workspaceId));
+            if (!workspace)
+                return unauthorized('Workspace not found');
+            return { ok: true, workspace, observerToken };
+        }
         return unauthorized('Invalid token format');
     }
 }

package/dist/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAI7C,sDAAsD;AACtD,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,YAAY,CAAC,OAAe,EAAE,IAAI,GAAG,cAAc;IAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,wBAAwB;IACnC,SAAS,CAAC,KAAa;QACrB,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAA2D;QAC5E,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;QAEpC,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACjC,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;gBACxB,OAAO,YAAY,CAAC,oCAAoC,CAAC,CAAC;YAC5D,CAAC;YACD,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;YAC9F,IAAI,CAAC,SAAS;gBAAE,OAAO,YAAY,CAAC,iBAAiB,CAAC,CAAC;YACvD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACjC,CAAC;QAED,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACjC,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;gBAC5B,OAAO,YAAY,CAAC,sCAAsC,CAAC,CAAC;YAC9D,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;YACjF,IAAI,CAAC,KAAK;gBAAE,OAAO,YAAY,CAAC,qBAAqB,EAAE,qBAAqB,CAAC,CAAC;YAC9E,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;YACnG,IAAI,CAAC,SAAS;gBAAE,OAAO,YAAY,CAAC,qBAAqB,CAAC,CAAC;YAC3D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QACxC,CAAC;QAED,OAAO,YAAY,CAAC,sBAAsB,CAAC,CAAC;IAC9C,CAAC;CACF"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAG1E,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE1E,sDAAsD;AACtD,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,YAAY,CAAC,OAAe,EAAE,IAAI,GAAG,cAAc;IAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,wBAAwB;IACnC,SAAS,CAAC,KAAa;QACrB,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAA2D;QAC5E,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;QACpC,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,YAAY,CAAC,sBAAsB,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,WAAW,GAAG,wBAAwB,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxE,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACpB,OAAO,YAAY,CAAC,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;QAEpC,IAAI,WAAW,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACrC,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;YAC9F,IAAI,CAAC,SAAS;gBAAE,OAAO,YAAY,CAAC,iBAAiB,CAAC,CAAC;YACvD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACjC,CAAC;QAED,IAAI,WAAW,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACjC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;YACjF,IAAI,CAAC,KAAK;gBAAE,OAAO,YAAY,CAAC,qBAAqB,EAAE,qBAAqB,CAAC,CAAC;YAC9E,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;YACnG,IAAI,CAAC,SAAS;gBAAE,OAAO,YAAY,CAAC,qBAAqB,CAAC,CAAC;YAC3D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QACxC,CAAC;QAED,IAAI,WAAW,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;YAC9E,IAAI,CAAC,IAAI;gBAAE,OAAO,YAAY,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,CAAC;YAC3E,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;YAClG,IAAI,CAAC,SAAS;gBAAE,OAAO,YAAY,CAAC,qBAAqB,CAAC,CAAC;YAC3D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACvC,CAAC;QAED,IAAI,WAAW,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACpC,MAAM,aAAa,GAAG,MAAM,4BAA4B,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACnE,IAAI,CAAC,aAAa;gBAAE,OAAO,YAAY,CAAC,wBAAwB,EAAE,wBAAwB,CAAC,CAAC;YAC5F,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;YAC3G,IAAI,CAAC,SAAS;gBAAE,OAAO,YAAY,CAAC,qBAAqB,CAAC,CAAC;YAC3D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;QAChD,CAAC;QAED,OAAO,YAAY,CAAC,sBAAsB,CAAC,CAAC;IAC9C,CAAC;CACF"}

package/dist/auth/tokenKind.d.ts

@@ -0,0 +1,40 @@
+import { z } from 'zod';
+import type { AuthRequire } from '../ports/auth.js';
+declare const tokenKindConfig: {
+    readonly workspace: {
+        readonly prefix: "rk_live_";
+        readonly requiredMessage: "Workspace key required (rk_live_...)";
+    };
+    readonly agent: {
+        readonly prefix: "at_live_";
+        readonly requiredMessage: "Agent token required (at_live_...)";
+    };
+    readonly node: {
+        readonly prefix: "nt_live_";
+        readonly requiredMessage: "Node token required (nt_live_...)";
+    };
+    readonly observer: {
+        readonly prefix: "ot_live_";
+        readonly requiredMessage: "Observer token required (ot_live_...)";
+    };
+};
+export type AuthTokenKind = keyof typeof tokenKindConfig;
+type ParsedTokenFor<Kind extends AuthTokenKind> = {
+    kind: Kind;
+    token: string;
+};
+export declare const authTokenSchema: z.ZodUnion<readonly [z.ZodPipe<z.ZodString, z.ZodTransform<ParsedTokenFor<"workspace">, string>>, z.ZodPipe<z.ZodString, z.ZodTransform<ParsedTokenFor<"agent">, string>>, z.ZodPipe<z.ZodString, z.ZodTransform<ParsedTokenFor<"node">, string>>, z.ZodPipe<z.ZodString, z.ZodTransform<ParsedTokenFor<"observer">, string>>]>;
+export type ParsedAuthToken = z.infer<typeof authTokenSchema>;
+export declare function parseAuthToken(token: string): ParsedAuthToken | undefined;
+export declare function getAuthTokenKind(token: string): AuthTokenKind | undefined;
+export declare function requiredTokenMessage(kind: Exclude<AuthRequire, 'any'>): string;
+export type AuthRequirementValidation = {
+    ok: true;
+} | {
+    ok: false;
+    code: string;
+    message: string;
+};
+export declare function validateTokenRequirement(tokenKind: AuthTokenKind, require: AuthRequire): AuthRequirementValidation;
+export {};
+//# sourceMappingURL=tokenKind.d.ts.map

package/dist/auth/tokenKind.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenKind.d.ts","sourceRoot":"","sources":["../../src/auth/tokenKind.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,QAAA,MAAM,eAAe;;;;;;;;;;;;;;;;;CAiBX,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,eAAe,CAAC;AAEzD,KAAK,cAAc,CAAC,IAAI,SAAS,aAAa,IAAI;IAChD,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAsBF,eAAO,MAAM,eAAe,iUAK1B,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAGzE;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAEzE;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,MAAM,CAE9E;AAYD,MAAM,MAAM,yBAAyB,GACjC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjD,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,WAAW,GACnB,yBAAyB,CA+B3B"}

package/dist/auth/tokenKind.js

@@ -0,0 +1,89 @@
+import { z } from 'zod';
+const tokenKindConfig = {
+    workspace: {
+        prefix: 'rk_live_',
+        requiredMessage: 'Workspace key required (rk_live_...)',
+    },
+    agent: {
+        prefix: 'at_live_',
+        requiredMessage: 'Agent token required (at_live_...)',
+    },
+    node: {
+        prefix: 'nt_live_',
+        requiredMessage: 'Node token required (nt_live_...)',
+    },
+    observer: {
+        prefix: 'ot_live_',
+        requiredMessage: 'Observer token required (ot_live_...)',
+    },
+};
+const workspaceTokenSchema = z
+    .string()
+    .startsWith(tokenKindConfig.workspace.prefix)
+    .transform((token) => ({ kind: 'workspace', token }));
+const agentTokenSchema = z
+    .string()
+    .startsWith(tokenKindConfig.agent.prefix)
+    .transform((token) => ({ kind: 'agent', token }));
+const nodeTokenSchema = z
+    .string()
+    .startsWith(tokenKindConfig.node.prefix)
+    .transform((token) => ({ kind: 'node', token }));
+const observerTokenSchema = z
+    .string()
+    .startsWith(tokenKindConfig.observer.prefix)
+    .transform((token) => ({ kind: 'observer', token }));
+export const authTokenSchema = z.union([
+    workspaceTokenSchema,
+    agentTokenSchema,
+    nodeTokenSchema,
+    observerTokenSchema,
+]);
+export function parseAuthToken(token) {
+    const parsed = authTokenSchema.safeParse(token);
+    return parsed.success ? parsed.data : undefined;
+}
+export function getAuthTokenKind(token) {
+    return parseAuthToken(token)?.kind;
+}
+export function requiredTokenMessage(kind) {
+    return tokenKindConfig[kind].requiredMessage;
+}
+const allowedKindsByRequire = {
+    workspace: ['workspace'],
+    agent: ['agent'],
+    node: ['node'],
+    observer: ['observer'],
+    // `any` intentionally means user/workspace API credentials, not transport-only
+    // node credentials or scoped observer credentials.
+    any: ['workspace', 'agent'],
+};
+export function validateTokenRequirement(tokenKind, require) {
+    const allowedKinds = allowedKindsByRequire[require];
+    if (allowedKinds.includes(tokenKind)) {
+        return { ok: true };
+    }
+    if (tokenKind === 'node') {
+        return {
+            ok: false,
+            code: 'node_token_forbidden',
+            message: 'Node token cannot perform this operation',
+        };
+    }
+    if (tokenKind === 'observer') {
+        return {
+            ok: false,
+            code: 'observer_token_forbidden',
+            message: 'Observer token cannot perform this operation',
+        };
+    }
+    if (require === 'any') {
+        return { ok: false, code: 'unauthorized', message: 'Invalid token format' };
+    }
+    return {
+        ok: false,
+        code: 'unauthorized',
+        message: requiredTokenMessage(require),
+    };
+}
+//# sourceMappingURL=tokenKind.js.map

package/dist/auth/tokenKind.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenKind.js","sourceRoot":"","sources":["../../src/auth/tokenKind.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,eAAe,GAAG;IACtB,SAAS,EAAE;QACT,MAAM,EAAE,UAAU;QAClB,eAAe,EAAE,sCAAsC;KACxD;IACD,KAAK,EAAE;QACL,MAAM,EAAE,UAAU;QAClB,eAAe,EAAE,oCAAoC;KACtD;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,UAAU;QAClB,eAAe,EAAE,mCAAmC;KACrD;IACD,QAAQ,EAAE;QACR,MAAM,EAAE,UAAU;QAClB,eAAe,EAAE,uCAAuC;KACzD;CACO,CAAC;AASX,MAAM,oBAAoB,GAAG,CAAC;KAC3B,MAAM,EAAE;KACR,UAAU,CAAC,eAAe,CAAC,SAAS,CAAC,MAAM,CAAC;KAC5C,SAAS,CAAC,CAAC,KAAK,EAA+B,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AAErF,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,EAAE;KACR,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC;KACxC,SAAS,CAAC,CAAC,KAAK,EAA2B,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AAE7E,MAAM,eAAe,GAAG,CAAC;KACtB,MAAM,EAAE;KACR,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;KACvC,SAAS,CAAC,CAAC,KAAK,EAA0B,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AAE3E,MAAM,mBAAmB,GAAG,CAAC;KAC1B,MAAM,EAAE;KACR,UAAU,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC;KAC3C,SAAS,CAAC,CAAC,KAAK,EAA8B,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AAEnF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC;IACrC,oBAAoB;IACpB,gBAAgB;IAChB,eAAe;IACf,mBAAmB;CACpB,CAAC,CAAC;AAIH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,cAAc,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAiC;IACpE,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,eAAe,CAAC;AAC/C,CAAC;AAED,MAAM,qBAAqB,GAAG;IAC5B,SAAS,EAAE,CAAC,WAAW,CAAC;IACxB,KAAK,EAAE,CAAC,OAAO,CAAC;IAChB,IAAI,EAAE,CAAC,MAAM,CAAC;IACd,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,+EAA+E;IAC/E,mDAAmD;IACnD,GAAG,EAAE,CAAC,WAAW,EAAE,OAAO,CAAC;CACqC,CAAC;AAMnE,MAAM,UAAU,wBAAwB,CACtC,SAAwB,EACxB,OAAoB;IAEpB,MAAM,YAAY,GAA6B,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC9E,IAAI,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QACzB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,0CAA0C;SACpD,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;QAC7B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,8CAA8C;SACxD,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAC9E,CAAC;IAED,OAAO;QACL,EAAE,EAAE,KAAK;QACT,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,oBAAoB,CAAC,OAAO,CAAC;KACvC,CAAC;AACJ,CAAC"}

package/dist/db/migrations/0025_node_kind_role_adapter.sql

@@ -0,0 +1,45 @@
+-- Split node kind (transport) from node role (ownership/capability) and
+-- collapse WebSocket delivery onto one node envelope.
+
+ALTER TABLE nodes ADD COLUMN role TEXT NOT NULL DEFAULT 'broker';
+ALTER TABLE deliveries ADD COLUMN route_node_role TEXT DEFAULT NULL;
+
+UPDATE nodes
+SET
+  role = CASE
+    WHEN kind = 'direct_ws' THEN 'direct'
+    WHEN kind = 'fleet_ws' THEN 'broker'
+    WHEN kind = 'http_push' AND max_agents = 1 THEN 'direct'
+    WHEN kind = 'http_push' THEN 'broker'
+    ELSE role
+  END,
+  kind = CASE
+    WHEN kind IN ('direct_ws', 'fleet_ws') THEN 'ws'
+    ELSE kind
+  END,
+  delivery_adapter = CASE
+    WHEN delivery_adapter IN ('direct.ws.v1', 'fleet.ws.v1') THEN 'ws.node.v1'
+    ELSE delivery_adapter
+  END;
+
+UPDATE deliveries
+SET
+  route_node_role = CASE
+    WHEN route_node_kind = 'direct_ws' THEN 'direct'
+    WHEN route_node_kind = 'fleet_ws' THEN 'broker'
+    WHEN route_node_id IS NOT NULL THEN (
+      SELECT n.role
+      FROM nodes n
+      WHERE n.workspace_id = deliveries.workspace_id
+        AND n.id = deliveries.route_node_id
+    )
+    ELSE NULL
+  END,
+  route_node_kind = CASE
+    WHEN route_node_kind IN ('direct_ws', 'fleet_ws') THEN 'ws'
+    ELSE route_node_kind
+  END,
+  delivery_adapter = CASE
+    WHEN delivery_adapter IN ('direct.ws.v1', 'fleet.ws.v1') THEN 'ws.node.v1'
+    ELSE delivery_adapter
+  END;

package/dist/db/migrations/0026_observer_tokens.sql

@@ -0,0 +1,32 @@
+-- Add scoped observer tokens for workspace realtime and read-only REST.
+
+CREATE TABLE observer_tokens (
+  id TEXT PRIMARY KEY NOT NULL,
+  workspace_id TEXT NOT NULL,
+  name TEXT NOT NULL,
+  description TEXT,
+  token_hash TEXT NOT NULL,
+  scopes TEXT NOT NULL DEFAULT '[]',
+  filters TEXT NOT NULL DEFAULT '{}',
+  status TEXT NOT NULL DEFAULT 'active',
+  expires_at INTEGER,
+  created_by TEXT,
+  created_by_type TEXT NOT NULL DEFAULT 'workspace',
+  last_used_at INTEGER,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch()),
+  updated_at INTEGER,
+  revoked_at INTEGER,
+  FOREIGN KEY (workspace_id) REFERENCES workspaces(id) ON DELETE CASCADE
+);
+
+CREATE UNIQUE INDEX observer_tokens_workspace_name_unique
+  ON observer_tokens (workspace_id, name);
+
+CREATE UNIQUE INDEX observer_tokens_token_hash_unique
+  ON observer_tokens (token_hash);
+
+CREATE INDEX idx_observer_tokens_workspace_status
+  ON observer_tokens (workspace_id, status);
+
+CREATE INDEX idx_observer_tokens_expires_at
+  ON observer_tokens (expires_at);

package/dist/db/schema.d.ts

@@ -8,6 +8,15 @@ export interface WorkspaceRetentionSettings {
     delivery_ttl_days?: number | null;
     message_log_ttl_days?: number | null;
 }
+export interface ObserverTokenFilters {
+    channel_ids?: string[];
+    channel_names?: string[];
+    include_dms?: boolean;
+    dm_conversation_ids?: string[];
+    agent_ids?: string[];
+    event_types?: string[];
+    created_after?: string;
+}
 export declare const workspaces: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
     name: "workspaces";
     schema: undefined;
@@ -605,6 +614,25 @@ export declare const nodes: import("drizzle-orm/sqlite-core").SQLiteTableWithCol
         }, {}, {
             length: number | undefined;
         }>;
+        role: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "role";
+            tableName: "nodes";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
         deliveryAdapter: import("drizzle-orm/sqlite-core").SQLiteColumn<{
             name: "delivery_adapter";
             tableName: "nodes";
@@ -849,6 +877,288 @@ export declare const nodes: import("drizzle-orm/sqlite-core").SQLiteTableWithCol
     };
     dialect: "sqlite";
 }>;
+export declare const observerTokens: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+    name: "observer_tokens";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "id";
+            tableName: "observer_tokens";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        workspaceId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "workspace_id";
+            tableName: "observer_tokens";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        name: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "name";
+            tableName: "observer_tokens";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        description: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "description";
+            tableName: "observer_tokens";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        tokenHash: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "token_hash";
+            tableName: "observer_tokens";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        scopes: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "scopes";
+            tableName: "observer_tokens";
+            dataType: "json";
+            columnType: "SQLiteTextJson";
+            data: string[];
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: string[];
+        }>;
+        filters: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "filters";
+            tableName: "observer_tokens";
+            dataType: "json";
+            columnType: "SQLiteTextJson";
+            data: ObserverTokenFilters;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: ObserverTokenFilters;
+        }>;
+        status: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "status";
+            tableName: "observer_tokens";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        expiresAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "expires_at";
+            tableName: "observer_tokens";
+            dataType: "date";
+            columnType: "SQLiteTimestamp";
+            data: Date;
+            driverParam: number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdBy: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "created_by";
+            tableName: "observer_tokens";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        createdByType: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "created_by_type";
+            tableName: "observer_tokens";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        lastUsedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "last_used_at";
+            tableName: "observer_tokens";
+            dataType: "date";
+            columnType: "SQLiteTimestamp";
+            data: Date;
+            driverParam: number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "created_at";
+            tableName: "observer_tokens";
+            dataType: "date";
+            columnType: "SQLiteTimestamp";
+            data: Date;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "updated_at";
+            tableName: "observer_tokens";
+            dataType: "date";
+            columnType: "SQLiteTimestamp";
+            data: Date;
+            driverParam: number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        revokedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "revoked_at";
+            tableName: "observer_tokens";
+            dataType: "date";
+            columnType: "SQLiteTimestamp";
+            data: Date;
+            driverParam: number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "sqlite";
+}>;
 export declare const agentNodeBindings: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
     name: "agent_node_bindings";
     schema: undefined;
@@ -5539,6 +5849,25 @@ export declare const deliveries: import("drizzle-orm/sqlite-core").SQLiteTableWi
         }, {}, {
             length: number | undefined;
         }>;
+        routeNodeRole: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "route_node_role";
+            tableName: "deliveries";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
         deliveryAdapter: import("drizzle-orm/sqlite-core").SQLiteColumn<{
             name: "delivery_adapter";
             tableName: "deliveries";