@relaycast/engine 5.0.0 → 5.0.2

package/dist/engine/observerToken.d.ts

@@ -0,0 +1,110 @@
+import { OBSERVER_SCOPES } from '@relaycast/types';
+import type { ObserverScope as SharedObserverScope } from '@relaycast/types';
+import type { getDb } from '../db/index.js';
+import { observerTokens } from '../db/schema.js';
+import type { ObserverTokenFilters } from '../db/schema.js';
+type Db = ReturnType<typeof getDb>;
+export type ObserverToken = typeof observerTokens.$inferSelect;
+export { OBSERVER_SCOPES };
+export type ObserverScope = SharedObserverScope;
+export declare const OBSERVER_SCOPE_SET: Set<string>;
+export interface PublicObserverToken {
+    id: string;
+    name: string;
+    description: string | null;
+    scopes: ObserverScope[];
+    filters: ObserverTokenFilters;
+    status: string;
+    expires_at: string | null;
+    created_at: string;
+    updated_at: string | null;
+    revoked_at: string | null;
+    last_used_at: string | null;
+    token?: string;
+}
+export interface CreateObserverTokenInput {
+    name: string;
+    description?: string | null;
+    scopes: ObserverScope[];
+    filters?: ObserverTokenFilters;
+    expires_at?: string | null;
+}
+export interface UpdateObserverTokenInput {
+    name?: string;
+    description?: string | null;
+    scopes?: ObserverScope[];
+    filters?: ObserverTokenFilters;
+    expires_at?: string | null;
+}
+export declare function normalizeObserverFilters(filters?: ObserverTokenFilters | null): ObserverTokenFilters;
+export declare function createObserverToken(db: Db, workspaceId: string, input: CreateObserverTokenInput): Promise<PublicObserverToken>;
+export declare function listObserverTokens(db: Db, workspaceId: string): Promise<PublicObserverToken[]>;
+export declare function getObserverToken(db: Db, workspaceId: string, id: string): Promise<PublicObserverToken | null>;
+export declare function updateObserverToken(db: Db, workspaceId: string, id: string, input: UpdateObserverTokenInput): Promise<PublicObserverToken | null>;
+export declare function rotateObserverToken(db: Db, workspaceId: string, id: string): Promise<PublicObserverToken | null>;
+export declare function revokeObserverToken(db: Db, workspaceId: string, id: string): Promise<boolean>;
+export declare function getActiveObserverTokenByHash(db: Db, tokenHash: string): Promise<ObserverToken | null>;
+export declare function hasObserverScope(observer: Pick<ObserverToken, 'scopes'>, scope: ObserverScope): boolean;
+export declare function hasAnyObserverScope(observer: Pick<ObserverToken, 'scopes'>, scopes: ObserverScope[]): boolean;
+export declare function observerAllowsChannel(observer: Pick<ObserverToken, 'filters'> | undefined, channel: {
+    id?: string | null;
+    name?: string | null;
+    channel_type?: number | null;
+}): boolean;
+export declare function observerAllowsConversation(observer: Pick<ObserverToken, 'filters' | 'scopes'> | undefined, conversationId: string | null | undefined): boolean;
+export declare function observerAllowsAgent(observer: Pick<ObserverToken, 'filters'> | undefined, agentId: string | null | undefined): boolean;
+export declare function observerAllowsCreatedAt(observer: Pick<ObserverToken, 'filters'> | undefined, createdAt: string | Date | number | null | undefined): boolean;
+export declare function observerAllowsMessage(observer: Pick<ObserverToken, 'filters'> | undefined, message: {
+    agent_id?: string | null;
+    created_at?: string | Date | number | null;
+}): boolean;
+export type MessageObserverResource = {
+    channel_id: string;
+    channel_name: string;
+    channel_type: number;
+    conversation_id: string | null;
+    agent_id: string;
+    created_at: string;
+};
+export declare function observerAllowsMessageResource(observer: Pick<ObserverToken, 'filters' | 'scopes'> | undefined, resource: MessageObserverResource, options?: {
+    normalScope?: ObserverScope;
+}): boolean;
+export type FileObserverResource = {
+    id: string;
+    uploaded_by_id: string;
+    created_at: string;
+    attachments: Array<{
+        channel_id: string;
+        channel_name: string;
+        channel_type: number;
+        conversation_id: string | null;
+    }>;
+};
+export declare function observerAllowsFile(observer: Pick<ObserverToken, 'filters' | 'scopes'> | undefined, file: FileObserverResource): boolean;
+export declare function observerAllowsAnyEventType(observer: Pick<ObserverToken, 'filters'> | undefined, eventTypes: string[]): boolean;
+export declare function observerAllowsEvent(observer: Pick<ObserverToken, 'filters' | 'scopes'> | undefined, event: Record<string, unknown>): boolean;
+export declare function getMessageObserverResource(db: Db, workspaceId: string, messageId: string): Promise<MessageObserverResource | null>;
+export declare function getChannelObserverResource(db: Db, workspaceId: string, name: string): Promise<{
+    id: string;
+    name: string;
+    channel_type: number;
+} | null>;
+export declare function getFileObserverResource(db: Db, workspaceId: string, fileId: string): Promise<FileObserverResource | null>;
+export declare function getFileObserverResources(db: Db, workspaceId: string, fileIds: string[]): Promise<Map<string, FileObserverResource>>;
+export declare function filterObserverFileResults<T extends {
+    id: string;
+}>(db: Db, workspaceId: string, observer: Pick<ObserverToken, 'filters' | 'scopes'> | undefined, results: T[]): Promise<T[]>;
+export declare function filterObserverSearchResults<T extends {
+    channel_id?: string;
+    channel_name?: string | null;
+    channel_type?: number | null;
+    conversation_id?: string | null;
+    agent_id?: string | null;
+    created_at?: string | null;
+}>(db: Db, workspaceId: string, observer: Pick<ObserverToken, 'filters' | 'scopes'> | undefined, results: T[], opts?: {
+    eventTypes?: (result: T) => string[];
+}): Promise<T[]>;
+export declare function getObserverTokenFromContext(c: {
+    get(key: 'observerToken'): ObserverToken | undefined;
+}): ObserverToken | undefined;
+//# sourceMappingURL=observerToken.d.ts.map

package/dist/engine/observerToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"observerToken.d.ts","sourceRoot":"","sources":["../../src/engine/observerToken.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,aAAa,IAAI,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAA8E,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC7H,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAK5D,KAAK,EAAE,GAAG,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC;AACnC,MAAM,MAAM,aAAa,GAAG,OAAO,cAAc,CAAC,YAAY,CAAC;AAG/D,OAAO,EAAE,eAAe,EAAE,CAAC;AAC3B,MAAM,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAEhD,eAAO,MAAM,kBAAkB,aAAmC,CAAC;AAEnE,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,OAAO,EAAE,oBAAoB,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,OAAO,CAAC,EAAE,oBAAoB,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,aAAa,EAAE,CAAC;IACzB,OAAO,CAAC,EAAE,oBAAoB,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAcD,wBAAgB,wBAAwB,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG,IAAI,GAAG,oBAAoB,CAUpG;AAmDD,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,mBAAmB,CAAC,CAiC9B;AAED,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAMpG;AAED,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAMrC;AAED,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CA2BrC;AAED,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAarC;AAED,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,OAAO,CAAC,CAYlB;AAED,wBAAsB,4BAA4B,CAChD,EAAE,EAAE,EAAE,EACN,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CA0B/B;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,aAAa,GAAG,OAAO,CAEvG;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAE7G;AAeD,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,GAAG,SAAS,EACpD,OAAO,EAAE;IAAE,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAClF,OAAO,CAQT;AAED,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,GAAG,QAAQ,CAAC,GAAG,SAAS,EAC/D,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACxC,OAAO,CAQT;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,GAAG,SAAS,EACpD,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACjC,OAAO,CAKT;AAUD,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,GAAG,SAAS,EACpD,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,GACnD,OAAO,CAQT;AAED,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,GAAG,SAAS,EACpD,OAAO,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;CAAE,GAChF,OAAO,CAGT;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,GAAG,QAAQ,CAAC,GAAG,SAAS,EAC/D,QAAQ,EAAE,uBAAuB,EACjC,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,aAAa,CAAA;CAAO,GAC5C,OAAO,CAYT;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,KAAK,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,MAAM,CAAC;QACrB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;KAChC,CAAC,CAAC;CACJ,CAAC;AAEF,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,GAAG,QAAQ,CAAC,GAAG,SAAS,EAC/D,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAgBT;AA+DD,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,GAAG,SAAS,EACpD,UAAU,EAAE,MAAM,EAAE,GACnB,OAAO,CAKT;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,GAAG,QAAQ,CAAC,GAAG,SAAS,EAC/D,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,CAwCT;AAED,wBAAsB,0BAA0B,CAC9C,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAezC;AAED,wBAAsB,0BAA0B,CAC9C,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAMpE;AAED,wBAAsB,uBAAuB,CAC3C,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAEtC;AAED,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAwD5C;AAED,wBAAsB,yBAAyB,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EACtE,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,GAAG,QAAQ,CAAC,GAAG,SAAS,EAC/D,OAAO,EAAE,CAAC,EAAE,GACX,OAAO,CAAC,CAAC,EAAE,CAAC,CAOd;AAED,wBAAsB,2BAA2B,CAAC,CAAC,SAAS;IAC1D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,EACC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,GAAG,QAAQ,CAAC,GAAG,SAAS,EAC/D,OAAO,EAAE,CAAC,EAAE,EACZ,IAAI,GAAE;IAAE,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,MAAM,EAAE,CAAA;CAAO,GAClD,OAAO,CAAC,CAAC,EAAE,CAAC,CA4Bd;AAED,wBAAgB,2BAA2B,CAAC,CAAC,EAAE;IAAE,GAAG,CAAC,GAAG,EAAE,eAAe,GAAG,aAAa,GAAG,SAAS,CAAA;CAAE,GAAG,aAAa,GAAG,SAAS,CAElI"}

package/dist/engine/observerToken.js

@@ -0,0 +1,528 @@
+import { and, eq, or, gt, isNull, inArray, ne } from 'drizzle-orm';
+import { OBSERVER_SCOPES } from '@relaycast/types';
+import { channels, dmConversations, files as fileRows, messageAttachments, messages, observerTokens } from '../db/schema.js';
+import { randomHex, sha256Hex } from '../lib/crypto.js';
+import { codedError } from '../lib/httpError.js';
+import { generateId } from './snowflake.js';
+const LAST_USED_DEBOUNCE_MS = 30_000;
+export { OBSERVER_SCOPES };
+export const OBSERVER_SCOPE_SET = new Set(OBSERVER_SCOPES);
+function parseExpiresAt(value) {
+    if (value == null)
+        return null;
+    const date = new Date(value);
+    if (Number.isNaN(date.getTime())) {
+        throw codedError('expires_at must be an ISO-8601 timestamp', 'invalid_request', 400);
+    }
+    if (date.getTime() <= Date.now()) {
+        throw codedError('expires_at must be in the future', 'invalid_request', 400);
+    }
+    return date;
+}
+export function normalizeObserverFilters(filters) {
+    return {
+        ...(filters?.channel_ids?.length ? { channel_ids: [...new Set(filters.channel_ids)] } : {}),
+        ...(filters?.channel_names?.length ? { channel_names: [...new Set(filters.channel_names)] } : {}),
+        include_dms: filters?.include_dms === true,
+        ...(filters?.dm_conversation_ids?.length ? { dm_conversation_ids: [...new Set(filters.dm_conversation_ids)] } : {}),
+        ...(filters?.agent_ids?.length ? { agent_ids: [...new Set(filters.agent_ids)] } : {}),
+        ...(filters?.event_types?.length ? { event_types: [...new Set(filters.event_types)] } : {}),
+        ...(filters?.created_after ? { created_after: filters.created_after } : {}),
+    };
+}
+function normalizeScopes(scopes) {
+    const unique = [...new Set(scopes)];
+    const invalid = unique.filter((scope) => !OBSERVER_SCOPE_SET.has(scope));
+    if (invalid.length > 0) {
+        throw codedError(`Invalid observer scopes: ${invalid.join(', ')}`, 'invalid_request', 400);
+    }
+    if (unique.length === 0) {
+        throw codedError('At least one observer scope is required', 'invalid_request', 400);
+    }
+    return unique;
+}
+function publicScopes(scopes) {
+    const unique = [...new Set(scopes ?? [])];
+    return unique.filter((scope) => OBSERVER_SCOPE_SET.has(scope));
+}
+function publicObserverToken(row, token) {
+    return {
+        id: row.id,
+        name: row.name,
+        description: row.description,
+        scopes: publicScopes(row.scopes),
+        filters: normalizeObserverFilters(row.filters),
+        status: row.status,
+        expires_at: row.expiresAt?.toISOString() ?? null,
+        created_at: row.createdAt.toISOString(),
+        updated_at: row.updatedAt?.toISOString() ?? null,
+        revoked_at: row.revokedAt?.toISOString() ?? null,
+        last_used_at: row.lastUsedAt?.toISOString() ?? null,
+        ...(token ? { token } : {}),
+    };
+}
+function isObserverTokenNameConflict(err) {
+    const candidate = err;
+    const message = candidate.message ?? '';
+    return (candidate.code === 'SQLITE_CONSTRAINT'
+        || candidate.code === 'SQLITE_CONSTRAINT_UNIQUE'
+        || message.includes('observer_tokens_workspace_name_unique')
+        || message.includes('observer_tokens.workspace_id, observer_tokens.name'));
+}
+function observerTokenNameConflict() {
+    throw codedError('Observer token name already exists in this workspace', 'observer_token_name_conflict', 409);
+}
+export async function createObserverToken(db, workspaceId, input) {
+    const token = `ot_live_${randomHex(24)}`;
+    const tokenHash = await sha256Hex(token);
+    const expiresAt = parseExpiresAt(input.expires_at);
+    const scopes = normalizeScopes(input.scopes);
+    const filters = normalizeObserverFilters(input.filters);
+    let created;
+    try {
+        [created] = await db
+            .insert(observerTokens)
+            .values({
+            id: `ot_${generateId()}`,
+            workspaceId,
+            name: input.name,
+            description: input.description ?? null,
+            tokenHash,
+            scopes,
+            filters,
+            expiresAt,
+            createdBy: workspaceId,
+            createdByType: 'workspace',
+        })
+            .returning();
+    }
+    catch (err) {
+        if (isObserverTokenNameConflict(err))
+            observerTokenNameConflict();
+        throw err;
+    }
+    if (!created) {
+        throw codedError('Failed to create observer token', 'internal_error', 500);
+    }
+    return publicObserverToken(created, token);
+}
+export async function listObserverTokens(db, workspaceId) {
+    const rows = await db
+        .select()
+        .from(observerTokens)
+        .where(eq(observerTokens.workspaceId, workspaceId));
+    return rows.map((row) => publicObserverToken(row));
+}
+export async function getObserverToken(db, workspaceId, id) {
+    const [row] = await db
+        .select()
+        .from(observerTokens)
+        .where(and(eq(observerTokens.workspaceId, workspaceId), eq(observerTokens.id, id)));
+    return row ? publicObserverToken(row) : null;
+}
+export async function updateObserverToken(db, workspaceId, id, input) {
+    const update = {
+        updatedAt: new Date(),
+    };
+    if (input.name !== undefined)
+        update.name = input.name;
+    if (input.description !== undefined)
+        update.description = input.description;
+    if (input.scopes !== undefined)
+        update.scopes = normalizeScopes(input.scopes);
+    if (input.filters !== undefined)
+        update.filters = normalizeObserverFilters(input.filters);
+    if (input.expires_at !== undefined)
+        update.expiresAt = parseExpiresAt(input.expires_at);
+    let row;
+    try {
+        [row] = await db
+            .update(observerTokens)
+            .set(update)
+            .where(and(eq(observerTokens.workspaceId, workspaceId), eq(observerTokens.id, id), eq(observerTokens.status, 'active')))
+            .returning();
+    }
+    catch (err) {
+        if (isObserverTokenNameConflict(err))
+            observerTokenNameConflict();
+        throw err;
+    }
+    return row ? publicObserverToken(row) : null;
+}
+export async function rotateObserverToken(db, workspaceId, id) {
+    const token = `ot_live_${randomHex(24)}`;
+    const tokenHash = await sha256Hex(token);
+    const [row] = await db
+        .update(observerTokens)
+        .set({ tokenHash, updatedAt: new Date(), lastUsedAt: null })
+        .where(and(eq(observerTokens.workspaceId, workspaceId), eq(observerTokens.id, id), eq(observerTokens.status, 'active')))
+        .returning();
+    return row ? publicObserverToken(row, token) : null;
+}
+export async function revokeObserverToken(db, workspaceId, id) {
+    const now = new Date();
+    const [row] = await db
+        .update(observerTokens)
+        .set({ status: 'revoked', revokedAt: now, updatedAt: now })
+        .where(and(eq(observerTokens.workspaceId, workspaceId), eq(observerTokens.id, id), eq(observerTokens.status, 'active')))
+        .returning({ id: observerTokens.id });
+    return Boolean(row);
+}
+export async function getActiveObserverTokenByHash(db, tokenHash) {
+    const now = new Date();
+    const [row] = await db
+        .select()
+        .from(observerTokens)
+        .where(and(eq(observerTokens.tokenHash, tokenHash), eq(observerTokens.status, 'active'), or(isNull(observerTokens.expiresAt), gt(observerTokens.expiresAt, now))));
+    if (!row)
+        return null;
+    if (!row.lastUsedAt || now.getTime() - row.lastUsedAt.getTime() > LAST_USED_DEBOUNCE_MS) {
+        void (async () => {
+            try {
+                await db
+                    .update(observerTokens)
+                    .set({ lastUsedAt: now })
+                    .where(eq(observerTokens.id, row.id));
+            }
+            catch {
+                // last_used_at is best-effort audit metadata; authentication should not fail
+                // solely because a read replica or adapter rejects this update.
+            }
+        })();
+    }
+    return row;
+}
+export function hasObserverScope(observer, scope) {
+    return publicScopes(observer.scopes).includes(scope);
+}
+export function hasAnyObserverScope(observer, scopes) {
+    return scopes.some((scope) => hasObserverScope(observer, scope));
+}
+function filterList(values) {
+    return values && values.length > 0 ? new Set(values) : null;
+}
+function hasChannelOrDmFilter(filters) {
+    return Boolean(filters.channel_ids?.length
+        || filters.channel_names?.length
+        || filters.dm_conversation_ids?.length
+        || filters.include_dms);
+}
+export function observerAllowsChannel(observer, channel) {
+    if (!observer)
+        return true;
+    if (channel.channel_type != null && channel.channel_type !== 0)
+        return false;
+    const filters = normalizeObserverFilters(observer.filters);
+    const ids = filterList(filters.channel_ids);
+    const names = filterList(filters.channel_names);
+    if (!ids && !names)
+        return true;
+    return Boolean((channel.id && ids?.has(channel.id)) || (channel.name && names?.has(channel.name)));
+}
+export function observerAllowsConversation(observer, conversationId) {
+    if (!observer)
+        return true;
+    const filters = normalizeObserverFilters(observer.filters);
+    if (!hasObserverScope(observer, 'dms:read'))
+        return false;
+    if (!filters.include_dms)
+        return false;
+    const ids = filterList(filters.dm_conversation_ids);
+    if (!ids)
+        return true;
+    return Boolean(conversationId && ids.has(conversationId));
+}
+export function observerAllowsAgent(observer, agentId) {
+    if (!observer)
+        return true;
+    const ids = filterList(normalizeObserverFilters(observer.filters).agent_ids);
+    if (!ids)
+        return true;
+    return Boolean(agentId && ids.has(agentId));
+}
+function timestampMillis(value) {
+    if (value == null)
+        return null;
+    if (value instanceof Date)
+        return value.getTime();
+    if (typeof value === 'number')
+        return Number.isFinite(value) ? value : null;
+    const parsed = new Date(value).getTime();
+    return Number.isNaN(parsed) ? null : parsed;
+}
+export function observerAllowsCreatedAt(observer, createdAt) {
+    if (!observer)
+        return true;
+    const cutoff = normalizeObserverFilters(observer.filters).created_after;
+    if (!cutoff)
+        return true;
+    const cutoffMs = timestampMillis(cutoff);
+    const createdMs = timestampMillis(createdAt);
+    if (cutoffMs == null || createdMs == null)
+        return false;
+    return createdMs >= cutoffMs;
+}
+export function observerAllowsMessage(observer, message) {
+    return observerAllowsAgent(observer, message.agent_id)
+        && observerAllowsCreatedAt(observer, message.created_at);
+}
+export function observerAllowsMessageResource(observer, resource, options = {}) {
+    if (!observer)
+        return true;
+    if (!observerAllowsMessage(observer, resource))
+        return false;
+    if (resource.channel_type !== 0) {
+        return observerAllowsConversation(observer, resource.conversation_id);
+    }
+    if (options.normalScope && !hasObserverScope(observer, options.normalScope))
+        return false;
+    return observerAllowsChannel(observer, {
+        id: resource.channel_id,
+        name: resource.channel_name,
+        channel_type: resource.channel_type,
+    });
+}
+export function observerAllowsFile(observer, file) {
+    if (!observer)
+        return true;
+    if (!observerAllowsAgent(observer, file.uploaded_by_id))
+        return false;
+    if (!observerAllowsCreatedAt(observer, file.created_at))
+        return false;
+    if (file.attachments.length === 0) {
+        return !hasChannelOrDmFilter(normalizeObserverFilters(observer.filters));
+    }
+    return file.attachments.some((attachment) => (attachment.conversation_id
+        ? observerAllowsConversation(observer, attachment.conversation_id)
+        : observerAllowsChannel(observer, {
+            id: attachment.channel_id,
+            name: attachment.channel_name,
+            channel_type: attachment.channel_type,
+        })));
+}
+function nestedRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+function eventChannelName(event) {
+    const channel = event.channel;
+    if (typeof channel === 'string')
+        return channel;
+    const channelObject = nestedRecord(channel);
+    return typeof channelObject.name === 'string' ? channelObject.name : null;
+}
+function eventAgentId(event) {
+    const message = nestedRecord(event.message);
+    const agent = nestedRecord(event.agent);
+    return (typeof event.agent_id === 'string' ? event.agent_id : null)
+        ?? (typeof event.subject_agent_id === 'string' ? event.subject_agent_id : null)
+        ?? (typeof message.agent_id === 'string' ? message.agent_id : null)
+        ?? (typeof agent.id === 'string' ? agent.id : null);
+}
+function eventCreatedAt(event) {
+    const message = nestedRecord(event.message);
+    return (typeof event.created_at === 'string' ? event.created_at : null)
+        ?? (typeof event.timestamp === 'string' ? event.timestamp : null)
+        ?? (typeof message.created_at === 'string' ? message.created_at : null)
+        ?? null;
+}
+/**
+ * Event types that are intrinsically scoped to a single channel. These must
+ * carry channel metadata to be visible to a channel-filtered observer; if the
+ * metadata is missing they are rejected (fail closed). Workspace-wide events
+ * (e.g. `agent.status.*`, `delivery.*`, `node.*`) are not channel-bound, so the
+ * channel filter only applies to them when they actually reference a channel.
+ */
+function isChannelScopedEventType(type) {
+    return (type === 'message.created'
+        || type === 'message.updated'
+        || type === 'message.read'
+        || type === 'message.reacted'
+        || type === 'thread.reply'
+        || type === 'webhook.received'
+        || type.startsWith('member.')
+        || type.startsWith('channel.'));
+}
+function eventRequiredScopes(type) {
+    if (type === 'message.created' || type === 'message.updated' || type === 'message.read' || type === 'webhook.received')
+        return ['messages:read'];
+    if (type === 'thread.reply')
+        return ['threads:read'];
+    if (type === 'message.reacted')
+        return ['reactions:read'];
+    if (type === 'dm.received' || type === 'group_dm.received')
+        return ['dms:read'];
+    if (type === 'file.uploaded')
+        return ['files:read'];
+    if (type.startsWith('agent.status.'))
+        return ['agents:read'];
+    if (type.startsWith('member.') || type.startsWith('channel.'))
+        return ['channels:read'];
+    if (type.startsWith('delivery.'))
+        return ['deliveries:read'];
+    if (type.startsWith('node.'))
+        return ['nodes:read'];
+    return ['activity:read'];
+}
+export function observerAllowsAnyEventType(observer, eventTypes) {
+    if (!observer)
+        return true;
+    const filters = normalizeObserverFilters(observer.filters);
+    if (!filters.event_types?.length)
+        return true;
+    return eventTypes.some((type) => filters.event_types?.includes(type));
+}
+export function observerAllowsEvent(observer, event) {
+    if (!observer)
+        return true;
+    const filters = normalizeObserverFilters(observer.filters);
+    const type = typeof event.type === 'string' ? event.type : '';
+    if (filters.event_types?.length && !filters.event_types.includes(type)) {
+        return false;
+    }
+    if (!hasAnyObserverScope(observer, eventRequiredScopes(type))) {
+        return false;
+    }
+    if (!observerAllowsCreatedAt(observer, eventCreatedAt(event))) {
+        return false;
+    }
+    const conversationId = typeof event.conversation_id === 'string' ? event.conversation_id : null;
+    const isDm = conversationId !== null || type === 'dm.received' || type === 'group_dm.received';
+    if (isDm) {
+        if (!observerAllowsConversation(observer, conversationId)) {
+            return false;
+        }
+    }
+    else {
+        const channelId = typeof event.channel_id === 'string' ? event.channel_id : null;
+        const channelName = eventChannelName(event);
+        const hasChannelContext = Boolean(channelId || channelName);
+        // Only apply the channel filter when the event carries channel context, or
+        // when its type is intrinsically channel-scoped (so missing metadata fails
+        // closed). Workspace-wide events with no channel context skip this check so
+        // agent_id matching can still apply.
+        if ((hasChannelContext || isChannelScopedEventType(type))
+            && !observerAllowsChannel(observer, { id: channelId, name: channelName })) {
+            return false;
+        }
+    }
+    return observerAllowsAgent(observer, eventAgentId(event));
+}
+export async function getMessageObserverResource(db, workspaceId, messageId) {
+    const [row] = await db
+        .select({
+        channel_id: channels.id,
+        channel_name: channels.name,
+        channel_type: channels.channelType,
+        conversation_id: dmConversations.id,
+        agent_id: messages.agentId,
+        created_at: messages.createdAt,
+    })
+        .from(messages)
+        .innerJoin(channels, eq(messages.channelId, channels.id))
+        .leftJoin(dmConversations, eq(dmConversations.channelId, channels.id))
+        .where(and(eq(messages.id, messageId), eq(messages.workspaceId, workspaceId)));
+    return row ? { ...row, created_at: row.created_at.toISOString() } : null;
+}
+export async function getChannelObserverResource(db, workspaceId, name) {
+    const [row] = await db
+        .select({ id: channels.id, name: channels.name, channel_type: channels.channelType })
+        .from(channels)
+        .where(and(eq(channels.workspaceId, workspaceId), eq(channels.name, name)));
+    return row ?? null;
+}
+export async function getFileObserverResource(db, workspaceId, fileId) {
+    return (await getFileObserverResources(db, workspaceId, [fileId])).get(fileId) ?? null;
+}
+export async function getFileObserverResources(db, workspaceId, fileIds) {
+    const ids = [...new Set(fileIds)].filter((id) => id.length > 0);
+    const resources = new Map();
+    if (ids.length === 0)
+        return resources;
+    const files = await db
+        .select({
+        id: fileRows.id,
+        uploaded_by_id: fileRows.uploadedBy,
+        created_at: fileRows.createdAt,
+    })
+        .from(fileRows)
+        .where(and(eq(fileRows.workspaceId, workspaceId), ne(fileRows.status, 'deleted'), inArray(fileRows.id, ids)));
+    for (const file of files) {
+        resources.set(file.id, {
+            id: file.id,
+            uploaded_by_id: file.uploaded_by_id,
+            created_at: file.created_at.toISOString(),
+            attachments: [],
+        });
+    }
+    if (resources.size === 0)
+        return resources;
+    const attachments = await db
+        .select({
+        file_id: messageAttachments.fileId,
+        channel_id: channels.id,
+        channel_name: channels.name,
+        channel_type: channels.channelType,
+        conversation_id: dmConversations.id,
+    })
+        .from(messageAttachments)
+        .innerJoin(messages, eq(messageAttachments.messageId, messages.id))
+        .innerJoin(channels, eq(messages.channelId, channels.id))
+        .leftJoin(dmConversations, eq(dmConversations.channelId, channels.id))
+        .where(and(eq(messages.workspaceId, workspaceId), inArray(messageAttachments.fileId, [...resources.keys()])));
+    for (const attachment of attachments) {
+        const resource = resources.get(attachment.file_id);
+        if (!resource)
+            continue;
+        resource.attachments.push({
+            channel_id: attachment.channel_id,
+            channel_name: attachment.channel_name,
+            channel_type: attachment.channel_type,
+            conversation_id: attachment.conversation_id,
+        });
+    }
+    return resources;
+}
+export async function filterObserverFileResults(db, workspaceId, observer, results) {
+    if (!observer || results.length === 0)
+        return results;
+    const resources = await getFileObserverResources(db, workspaceId, results.map((result) => result.id));
+    return results.filter((result) => {
+        const resource = resources.get(result.id);
+        return Boolean(resource && observerAllowsFile(observer, resource));
+    });
+}
+export async function filterObserverSearchResults(db, workspaceId, observer, results, opts = {}) {
+    if (!observer || results.length === 0)
+        return results;
+    const missingChannelIds = [...new Set(results
+            .filter((result) => !result.channel_name && result.channel_id)
+            .map((result) => result.channel_id))];
+    const channelsById = new Map();
+    if (missingChannelIds.length > 0) {
+        const rows = await db
+            .select({ id: channels.id, name: channels.name, channel_type: channels.channelType })
+            .from(channels)
+            .where(and(eq(channels.workspaceId, workspaceId), inArray(channels.id, missingChannelIds)));
+        for (const row of rows)
+            channelsById.set(row.id, { name: row.name, channel_type: row.channel_type });
+    }
+    return results.filter((result) => {
+        if (opts.eventTypes && !observerAllowsAnyEventType(observer, opts.eventTypes(result)))
+            return false;
+        if (!observerAllowsMessage(observer, result))
+            return false;
+        if (result.conversation_id) {
+            return observerAllowsConversation(observer, result.conversation_id);
+        }
+        const channel = result.channel_id ? channelsById.get(result.channel_id) : undefined;
+        return observerAllowsChannel(observer, {
+            id: result.channel_id,
+            name: result.channel_name ?? channel?.name,
+            channel_type: result.channel_type ?? channel?.channel_type,
+        });
+    });
+}
+export function getObserverTokenFromContext(c) {
+    return c.get('observerToken');
+}
+//# sourceMappingURL=observerToken.js.map