Release 1.4.0: shared @simpleworkjs/* packages; fix discovery envelope drift + client_secret_hash leak

Rewire onto @simpleworkjs/directory-schema, /ldap, and /app-stack. The
directory discovery API now returns the {results} envelope via explicit
/resources, /resources/:slug, /graph, /me handlers and routes every read
through projectResource/projectResources, which unconditionally strips
client_secret_hash (and any /secret|password|privatekey/i key) and reduces
metadata to a public allowlist for non-admins — closing the leak where the ORM
serialized metadata wholesale. The dead routes/api_discovery.js (mounted after
the 404 catcher) is removed; ?group= now returns 200 instead of 404. user_ldap
+ group_ldap take escapeFilter/escapeDN + makeClient/withClient from the shared
ldap package (posix/write-side stays app-local; cert validation unchanged).
build_info unified to {buildVersion,buildHash,buildYear}; ldapts ^8.1.8. New
tests/discovery.test.js locks in the envelope + no-secrets guarantees. Lockfile
regenerated from the registry (no file:/link:).

Co-Authored-By: Claude <noreply@anthropic.com>

nodejs/routes/discovery.js

@@ -1,4 +1,79 @@
-const autoRouter = require('./autoRouter');
-const { Resource } = require('../models/resource');
+'use strict';
 
-module.exports = autoRouter(Resource);
+// Public directory discovery API. Mounted at /api/discovery (app.js, before
+// the 404 catcher). Every response uses the `{ results }` envelope and the
+// security projection from @simpleworkjs/directory-schema, so secrets (e.g. an
+// OAuth client's client_secret_hash) never leave the server and non-admins only
+// see the public metadata allowlist.
+//
+// This replaces the autoRouter mount (which returned bare arrays — the shape
+// jump-host's `data.results || []` silently collapsed to `[]`, so no user could
+// bridge) and absorbs the dead /me handler that used to live in
+// routes/api_discovery.js (mounted after the 404, so unreachable).
+
+const router = require('express').Router();
+const { Resource, ResourceGroup } = require('../models/resource');
+const {
+	envelope,
+	projectResource,
+	projectResources,
+	isDirectoryAdmin,
+} = require('@simpleworkjs/directory-schema');
+
+// GET /api/discovery/resources[?kind=&group=&parent=]
+router.get('/resources', async (req, res, next) => {
+	try {
+		const resources = await Resource.search(req.query);
+		res.json(envelope(projectResources(resources, { fullMetadata: isDirectoryAdmin(req.user) })));
+	} catch (err) { next(err); }
+});
+
+// GET /api/discovery/resources/:slug
+router.get('/resources/:slug', async (req, res, next) => {
+	try {
+		const resource = await Resource.getBySlug(req.params.slug);
+		// parents/children are edges (no secrets); project only the resource body.
+		const projected = projectResource(resource, { fullMetadata: isDirectoryAdmin(req.user) });
+		projected.parents = resource.parents;
+		projected.children = resource.children;
+		res.json(envelope(projected));
+	} catch (err) { next(err); }
+});
+
+// GET /api/discovery/graph
+router.get('/graph', async (req, res, next) => {
+	try {
+		const graph = await Resource.getGraph();
+		res.json(envelope({
+			resources: projectResources(graph.resources, { fullMetadata: isDirectoryAdmin(req.user) }),
+			edges: graph.edges,
+		}));
+	} catch (err) { next(err); }
+});
+
+// GET /api/discovery/me
+// Returns the resources the current caller can reach. Machines see only their
+// own resource; humans get the union of their LDAP groups' resources plus
+// anything flagged isPublic. Uses req.user.groups (populated by the auth
+// middleware for session/PAT callers) rather than re-querying LDAP by DN, so it
+// works for every auth transport without assuming a .dn is present.
+router.get('/me', async (req, res, next) => {
+	try {
+		let accessible;
+		if (req.user && req.user.isMachine) {
+			accessible = await Resource.list({ where: { id: req.resourceId } });
+		} else {
+			const userGroups = (req.user && req.user.groups) || [];
+			const ids = new Set();
+			if (userGroups.length) {
+				const rgs = await ResourceGroup.list({ where: { groupCn: { in: userGroups } } });
+				for (const rg of rgs) ids.add(rg.resourceId);
+			}
+			const all = await Resource.list();
+			accessible = all.filter(r => ids.has(r.id) || (r.metadata && r.metadata.isPublic));
+		}
+		res.json(envelope(projectResources(accessible, { fullMetadata: isDirectoryAdmin(req.user) })));
+	} catch (err) { next(err); }
+});
+
+module.exports = router;