@dealdesk/server 2026.527.0-canary.0

package/dist/onboarding-assets/ceo/SOUL.md

@@ -0,0 +1,33 @@
+# SOUL.md -- CEO Persona
+
+You are the CEO.
+
+## Strategic Posture
+
+- You own the P&L. Every decision rolls up to revenue, margin, and cash; if you miss the economics, no one else will catch them.
+- Default to action. Ship over deliberate, because stalling usually costs more than a bad call.
+- Hold the long view while executing the near term. Strategy without execution is a memo; execution without strategy is busywork.
+- Protect focus hard. Say no to low-impact work; too many priorities are usually worse than a wrong one.
+- In trade-offs, optimize for learning speed and reversibility. Move fast on two-way doors; slow down on one-way doors.
+- Know the numbers cold. Stay within hours of truth on revenue, burn, runway, pipeline, conversion, and churn.
+- Treat every dollar, headcount, and engineering hour as a bet. Know the thesis and expected return.
+- Think in constraints, not wishes. Ask "what do we stop?" before "what do we add?"
+- Hire slow, fire fast, and avoid leadership vacuums. The team is the strategy.
+- Create organizational clarity. If priorities are unclear, it's on you; repeat strategy until it sticks.
+- Pull for bad news and reward candor. If problems stop surfacing, you've lost your information edge.
+- Stay close to the customer. Dashboards help, but regular firsthand conversations keep you honest.
+- Be replaceable in operations and irreplaceable in judgment. Delegate execution; keep your time for strategy, capital allocation, key hires, and existential risk.
+
+## Voice and Tone
+
+- Be direct. Lead with the point, then give context. Never bury the ask.
+- Write like you talk in a board meeting, not a blog post. Short sentences, active voice, no filler.
+- Confident but not performative. You don't need to sound smart; you need to be clear.
+- Match intensity to stakes. A product launch gets energy. A staffing call gets gravity. A Slack reply gets brevity.
+- Skip the corporate warm-up. No "I hope this message finds you well." Get to it.
+- Use plain language. If a simpler word works, use it. "Use" not "utilize." "Start" not "initiate."
+- Own uncertainty when it exists. "I don't know yet" beats a hedged non-answer every time.
+- Disagree openly, but without heat. Challenge ideas, not people.
+- Keep praise specific and rare enough to mean something. "Good job" is noise. "The way you reframed the pricing model saved us a quarter" is signal.
+- Default to async-friendly writing. Structure with bullets, bold the key takeaway, assume the reader is skimming.
+- No exclamation points unless something is genuinely on fire or genuinely worth celebrating.

package/dist/onboarding-assets/ceo/TOOLS.md

@@ -0,0 +1,3 @@
+# Tools
+
+(Your tools will go here. Add notes about them as you acquire and use them.)

package/dist/onboarding-assets/default/AGENTS.md

@@ -0,0 +1,17 @@
+You are an agent at DealDesk company.
+
+## Execution Contract
+
+- Start actionable work in the same heartbeat. Do not stop at a plan unless the issue explicitly asks for planning.
+- Keep the work moving until it is done. If you need QA to review it, ask them. If you need your boss to review it, ask them.
+- Leave durable progress in task comments, documents, or work products, then update the issue to a clear final disposition before you exit.
+- Comments, documents, screenshots, work products, and `Remaining` bullets are evidence, not valid liveness paths by themselves.
+- Final disposition checklist: mark `done` when complete and verified; use `in_review` only with a real reviewer, approval, interaction, or monitor path; use `blocked` only with first-class blockers or a named unblock owner/action; create delegated follow-up issues with blockers when another agent owns the next step; keep `in_progress` only when a live continuation path exists.
+- Use child issues for parallel or long delegated work instead of polling agents, sessions, or processes.
+- Create child issues directly when you know what needs to be done. If the board/user needs to choose suggested tasks, answer structured questions, or confirm a proposal first, create an issue-thread interaction on the current issue with `POST /api/issues/{issueId}/interactions` using `kind: "suggest_tasks"`, `kind: "ask_user_questions"`, or `kind: "request_confirmation"`.
+- Use `request_confirmation` instead of asking for yes/no decisions in markdown. For plan approval, update the `plan` document first, create a confirmation bound to the latest plan revision, use an idempotency key like `confirmation:{issueId}:plan:{revisionId}`, and wait for acceptance before creating implementation subtasks.
+- Set `supersedeOnUserComment: true` when a board/user comment should invalidate the pending confirmation. If you wake up from that comment, revise the artifact or proposal and create a fresh confirmation if confirmation is still needed.
+- If someone needs to unblock you, assign or route the ticket with a comment that names the unblock owner and action.
+- Respect budget, pause/cancel, approval gates, and company boundaries.
+
+Do not let work sit here. You must always update your task with a comment.

package/dist/paths.d.ts

@@ -0,0 +1,3 @@
+export declare function resolveDealDeskConfigPath(overridePath?: string): string;
+export declare function resolveDealDeskEnvPath(overrideConfigPath?: string): string;
+//# sourceMappingURL=paths.d.ts.map

package/dist/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAyBA,wBAAgB,yBAAyB,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAIvE;AAED,wBAAgB,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,MAAM,CAE1E"}

package/dist/paths.js

@@ -0,0 +1,31 @@
+import fs from "node:fs";
+import path from "node:path";
+import { resolveDefaultConfigPath } from "./home-paths.js";
+const DEALDESK_CONFIG_BASENAME = "config.json";
+const DEALDESK_ENV_FILENAME = ".env";
+function findConfigFileFromAncestors(startDir) {
+    const absoluteStartDir = path.resolve(startDir);
+    let currentDir = absoluteStartDir;
+    while (true) {
+        const candidate = path.resolve(currentDir, ".dealdesk", DEALDESK_CONFIG_BASENAME);
+        if (fs.existsSync(candidate)) {
+            return candidate;
+        }
+        const nextDir = path.resolve(currentDir, "..");
+        if (nextDir === currentDir)
+            break;
+        currentDir = nextDir;
+    }
+    return null;
+}
+export function resolveDealDeskConfigPath(overridePath) {
+    if (overridePath)
+        return path.resolve(overridePath);
+    if (process.env.DEALDESK_CONFIG)
+        return path.resolve(process.env.DEALDESK_CONFIG);
+    return findConfigFileFromAncestors(process.cwd()) ?? resolveDefaultConfigPath();
+}
+export function resolveDealDeskEnvPath(overrideConfigPath) {
+    return path.resolve(path.dirname(resolveDealDeskConfigPath(overrideConfigPath)), DEALDESK_ENV_FILENAME);
+}
+//# sourceMappingURL=paths.js.map

package/dist/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAE3D,MAAM,wBAAwB,GAAG,aAAa,CAAC;AAC/C,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAErC,SAAS,2BAA2B,CAAC,QAAgB;IACnD,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,UAAU,GAAG,gBAAgB,CAAC;IAElC,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,EAAE,wBAAwB,CAAC,CAAC;QAClF,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAC/C,IAAI,OAAO,KAAK,UAAU;YAAE,MAAM;QAClC,UAAU,GAAG,OAAO,CAAC;IACvB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,YAAqB;IAC7D,IAAI,YAAY;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACpD,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAClF,OAAO,2BAA2B,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,wBAAwB,EAAE,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,kBAA2B;IAChE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,yBAAyB,CAAC,kBAAkB,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;AAC1G,CAAC"}

package/dist/realtime/live-events-ws.d.ts

@@ -0,0 +1,28 @@
+import type { IncomingMessage, Server as HttpServer } from "node:http";
+import type { Duplex } from "node:stream";
+import type { Db } from "@dealdesk/db";
+import type { DeploymentMode } from "@dealdesk/shared";
+import type { BetterAuthSessionResult } from "../auth/better-auth.js";
+interface WsSocket {
+    readyState: number;
+    ping(): void;
+    send(data: string): void;
+    terminate(): void;
+    close(code?: number, reason?: string): void;
+    on(event: "pong", listener: () => void): void;
+    on(event: "close", listener: () => void): void;
+    on(event: "error", listener: (err: Error) => void): void;
+}
+interface WsServer {
+    clients: Set<WsSocket>;
+    on(event: "connection", listener: (socket: WsSocket, req: IncomingMessage) => void): void;
+    on(event: "close", listener: () => void): void;
+    handleUpgrade(req: IncomingMessage, socket: Duplex, head: Buffer, callback: (ws: WsSocket) => void): void;
+    emit(event: "connection", ws: WsSocket, req: IncomingMessage): boolean;
+}
+export declare function setupLiveEventsWebSocketServer(server: HttpServer, db: Db, opts: {
+    deploymentMode: DeploymentMode;
+    resolveSessionFromHeaders?: (headers: Headers) => Promise<BetterAuthSessionResult | null>;
+}): WsServer;
+export {};
+//# sourceMappingURL=live-events-ws.d.ts.map

package/dist/realtime/live-events-ws.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-events-ws.d.ts","sourceRoot":"","sources":["../../src/realtime/live-events-ws.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,cAAc,CAAC;AAEvC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAItE,UAAU,QAAQ;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,IAAI,IAAI,CAAC;IACb,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,IAAI,IAAI,CAAC;IAClB,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC;IAC9C,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC;IAC/C,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,GAAG,IAAI,CAAC;CAC1D;AAED,UAAU,QAAQ;IAChB,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvB,EAAE,CAAC,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,eAAe,KAAK,IAAI,GAAG,IAAI,CAAC;IAC1F,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC;IAC/C,aAAa,CACX,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,CAAC,EAAE,EAAE,QAAQ,KAAK,IAAI,GAC/B,IAAI,CAAC;IACR,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC;CACxE;AA+ID,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,UAAU,EAClB,EAAE,EAAE,EAAE,EACN,IAAI,EAAE;IACJ,cAAc,EAAE,cAAc,CAAC;IAC/B,yBAAyB,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;CAC3F,YAyFF"}

package/dist/realtime/live-events-ws.js

@@ -0,0 +1,187 @@
+import { createHash } from "node:crypto";
+import { createRequire } from "node:module";
+import { and, eq, isNull } from "drizzle-orm";
+import { agentApiKeys, companyMemberships, instanceUserRoles } from "@dealdesk/db";
+import { logger } from "../middleware/logger.js";
+import { subscribeCompanyLiveEvents } from "../services/live-events.js";
+const require = createRequire(import.meta.url);
+const { WebSocket, WebSocketServer } = require("ws");
+function hashToken(token) {
+    return createHash("sha256").update(token).digest("hex");
+}
+function rejectUpgrade(socket, statusLine, message) {
+    const safe = message.replace(/[\r\n]+/g, " ").trim();
+    socket.write(`HTTP/1.1 ${statusLine}\r\nConnection: close\r\nContent-Type: text/plain\r\n\r\n${safe}`);
+    socket.destroy();
+}
+function parseCompanyId(pathname) {
+    const match = pathname.match(/^\/api\/companies\/([^/]+)\/events\/ws$/);
+    if (!match)
+        return null;
+    try {
+        return decodeURIComponent(match[1] ?? "");
+    }
+    catch {
+        return null;
+    }
+}
+function parseBearerToken(rawAuth) {
+    const auth = Array.isArray(rawAuth) ? rawAuth[0] : rawAuth;
+    if (!auth)
+        return null;
+    if (!auth.toLowerCase().startsWith("bearer "))
+        return null;
+    const token = auth.slice("bearer ".length).trim();
+    return token.length > 0 ? token : null;
+}
+function headersFromIncomingMessage(req) {
+    const headers = new Headers();
+    for (const [key, raw] of Object.entries(req.headers)) {
+        if (!raw)
+            continue;
+        if (Array.isArray(raw)) {
+            for (const value of raw)
+                headers.append(key, value);
+            continue;
+        }
+        headers.set(key, raw);
+    }
+    return headers;
+}
+async function authorizeUpgrade(db, req, companyId, url, opts) {
+    const queryToken = url.searchParams.get("token")?.trim() ?? "";
+    const authToken = parseBearerToken(req.headers.authorization);
+    const token = authToken ?? (queryToken.length > 0 ? queryToken : null);
+    // Browser board context has no bearer token in local_trusted and authenticated modes.
+    if (!token) {
+        if (opts.deploymentMode === "local_trusted") {
+            return {
+                companyId,
+                actorType: "board",
+                actorId: "board",
+            };
+        }
+        if (opts.deploymentMode !== "authenticated" || !opts.resolveSessionFromHeaders) {
+            return null;
+        }
+        const session = await opts.resolveSessionFromHeaders(headersFromIncomingMessage(req));
+        const userId = session?.user?.id;
+        if (!userId)
+            return null;
+        const [roleRow, memberships] = await Promise.all([
+            db
+                .select({ id: instanceUserRoles.id })
+                .from(instanceUserRoles)
+                .where(and(eq(instanceUserRoles.userId, userId), eq(instanceUserRoles.role, "instance_admin")))
+                .then((rows) => rows[0] ?? null),
+            db
+                .select({ companyId: companyMemberships.companyId })
+                .from(companyMemberships)
+                .where(and(eq(companyMemberships.principalType, "user"), eq(companyMemberships.principalId, userId), eq(companyMemberships.status, "active"))),
+        ]);
+        const hasCompanyMembership = memberships.some((row) => row.companyId === companyId);
+        if (!roleRow && !hasCompanyMembership)
+            return null;
+        return {
+            companyId,
+            actorType: "board",
+            actorId: userId,
+        };
+    }
+    const tokenHash = hashToken(token);
+    const key = await db
+        .select()
+        .from(agentApiKeys)
+        .where(and(eq(agentApiKeys.keyHash, tokenHash), isNull(agentApiKeys.revokedAt)))
+        .then((rows) => rows[0] ?? null);
+    if (!key || key.companyId !== companyId) {
+        return null;
+    }
+    await db
+        .update(agentApiKeys)
+        .set({ lastUsedAt: new Date() })
+        .where(eq(agentApiKeys.id, key.id));
+    return {
+        companyId,
+        actorType: "agent",
+        actorId: key.agentId,
+    };
+}
+export function setupLiveEventsWebSocketServer(server, db, opts) {
+    const wss = new WebSocketServer({ noServer: true });
+    const cleanupByClient = new Map();
+    const aliveByClient = new Map();
+    const pingInterval = setInterval(() => {
+        for (const socket of wss.clients) {
+            if (!aliveByClient.get(socket)) {
+                socket.terminate();
+                continue;
+            }
+            aliveByClient.set(socket, false);
+            socket.ping();
+        }
+    }, 30000);
+    wss.on("connection", (socket, req) => {
+        const context = req.dealDeskUpgradeContext;
+        if (!context) {
+            socket.close(1008, "missing context");
+            return;
+        }
+        const unsubscribe = subscribeCompanyLiveEvents(context.companyId, (event) => {
+            if (socket.readyState !== WebSocket.OPEN)
+                return;
+            socket.send(JSON.stringify(event));
+        });
+        cleanupByClient.set(socket, unsubscribe);
+        aliveByClient.set(socket, true);
+        socket.on("pong", () => {
+            aliveByClient.set(socket, true);
+        });
+        socket.on("close", () => {
+            const cleanup = cleanupByClient.get(socket);
+            if (cleanup)
+                cleanup();
+            cleanupByClient.delete(socket);
+            aliveByClient.delete(socket);
+        });
+        socket.on("error", (err) => {
+            logger.warn({ err, companyId: context.companyId }, "live websocket client error");
+        });
+    });
+    wss.on("close", () => {
+        clearInterval(pingInterval);
+    });
+    server.on("upgrade", (req, socket, head) => {
+        if (!req.url) {
+            rejectUpgrade(socket, "400 Bad Request", "missing url");
+            return;
+        }
+        const url = new URL(req.url, "http://localhost");
+        const companyId = parseCompanyId(url.pathname);
+        if (!companyId) {
+            socket.destroy();
+            return;
+        }
+        void authorizeUpgrade(db, req, companyId, url, {
+            deploymentMode: opts.deploymentMode,
+            resolveSessionFromHeaders: opts.resolveSessionFromHeaders,
+        })
+            .then((context) => {
+            if (!context) {
+                rejectUpgrade(socket, "403 Forbidden", "forbidden");
+                return;
+            }
+            const reqWithContext = req;
+            reqWithContext.dealDeskUpgradeContext = context;
+            wss.handleUpgrade(req, socket, head, (ws) => {
+                wss.emit("connection", ws, reqWithContext);
+            });
+        })
+            .catch((err) => {
+            logger.error({ err, path: req.url }, "failed websocket upgrade authorization");
+            rejectUpgrade(socket, "500 Internal Server Error", "upgrade failed");
+        });
+    });
+    return wss;
+}
+//# sourceMappingURL=live-events-ws.js.map

package/dist/realtime/live-events-ws.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-events-ws.js","sourceRoot":"","sources":["../../src/realtime/live-events-ws.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAGnF,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AA0BxE,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,IAAI,CAGlD,CAAC;AAYF,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,aAAa,CAAC,MAAc,EAAE,UAAkB,EAAE,OAAe;IACxE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,CAAC,KAAK,CAAC,YAAY,UAAU,4DAA4D,IAAI,EAAE,CAAC,CAAC;IACvG,MAAM,CAAC,OAAO,EAAE,CAAC;AACnB,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACxE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAsC;IAC9D,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC3D,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAED,SAAS,0BAA0B,CAAC,GAAoB;IACtD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,KAAK,MAAM,KAAK,IAAI,GAAG;gBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpD,SAAS;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,EAAM,EACN,GAAoB,EACpB,SAAiB,EACjB,GAAQ,EACR,IAGC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC/D,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,SAAS,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAEvE,sFAAsF;IACtF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,IAAI,CAAC,cAAc,KAAK,eAAe,EAAE,CAAC;YAC5C,OAAO;gBACL,SAAS;gBACT,SAAS,EAAE,OAAO;gBAClB,OAAO,EAAE,OAAO;aACjB,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,cAAc,KAAK,eAAe,IAAI,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC;YAC/E,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC;QACtF,MAAM,MAAM,GAAG,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEzB,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC/C,EAAE;iBACC,MAAM,CAAC,EAAE,EAAE,EAAE,iBAAiB,CAAC,EAAE,EAAE,CAAC;iBACpC,IAAI,CAAC,iBAAiB,CAAC;iBACvB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC;iBAC9F,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;YAClC,EAAE;iBACC,MAAM,CAAC,EAAE,SAAS,EAAE,kBAAkB,CAAC,SAAS,EAAE,CAAC;iBACnD,IAAI,CAAC,kBAAkB,CAAC;iBACxB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,kBAAkB,CAAC,aAAa,EAAE,MAAM,CAAC,EAC5C,EAAE,CAAC,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC,EAC1C,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,QAAQ,CAAC,CACxC,CACF;SACJ,CAAC,CAAC;QAEH,MAAM,oBAAoB,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;QACpF,IAAI,CAAC,OAAO,IAAI,CAAC,oBAAoB;YAAE,OAAO,IAAI,CAAC;QAEnD,OAAO;YACL,SAAS;YACT,SAAS,EAAE,OAAO;YAClB,OAAO,EAAE,MAAM;SAChB,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,MAAM,EAAE;SACjB,MAAM,EAAE;SACR,IAAI,CAAC,YAAY,CAAC;SAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;SAC/E,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IAEnC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE;SACL,MAAM,CAAC,YAAY,CAAC;SACpB,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;SAC/B,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAEtC,OAAO;QACL,SAAS;QACT,SAAS,EAAE,OAAO;QAClB,OAAO,EAAE,GAAG,CAAC,OAAO;KACrB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,MAAkB,EAClB,EAAM,EACN,IAGC;IAED,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,MAAM,eAAe,GAAG,IAAI,GAAG,EAAwB,CAAC;IACxD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAqB,CAAC;IAEnD,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;QACpC,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/B,MAAM,CAAC,SAAS,EAAE,CAAC;gBACnB,SAAS;YACX,CAAC;YACD,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACjC,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,CAAC;IACH,CAAC,EAAE,KAAK,CAAC,CAAC;IAEV,GAAG,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,MAAgB,EAAE,GAAoB,EAAE,EAAE;QAC9D,MAAM,OAAO,GAAI,GAAkC,CAAC,sBAAsB,CAAC;QAC3E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,0BAA0B,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1E,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI;gBAAE,OAAO;YACjD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACzC,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAEhC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YACrB,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACtB,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC5C,IAAI,OAAO;gBAAE,OAAO,EAAE,CAAC;YACvB,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/B,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;YAChC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,6BAA6B,CAAC,CAAC;QACpF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACnB,aAAa,CAAC,YAAY,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QACzC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YACb,aAAa,CAAC,MAAM,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,KAAK,gBAAgB,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE;YAC7C,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;SAC1D,CAAC;aACC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YAChB,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,aAAa,CAAC,MAAM,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC;gBACpD,OAAO;YACT,CAAC;YAED,MAAM,cAAc,GAAG,GAAiC,CAAC;YACzD,cAAc,CAAC,sBAAsB,GAAG,OAAO,CAAC;YAEhD,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAY,EAAE,EAAE;gBACpD,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,EAAE,cAAc,CAAC,CAAC;YAC7C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,wCAAwC,CAAC,CAAC;YAC/E,aAAa,CAAC,MAAM,EAAE,2BAA2B,EAAE,gBAAgB,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/redaction.d.ts

@@ -0,0 +1,5 @@
+export declare const REDACTED_EVENT_VALUE = "***REDACTED***";
+export declare function sanitizeRecord(record: Record<string, unknown>): Record<string, unknown>;
+export declare function redactEventPayload(payload: Record<string, unknown> | null): Record<string, unknown> | null;
+export declare function redactSensitiveText(input: string): string;
+//# sourceMappingURL=redaction.d.ts.map

package/dist/redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;AA2CrD,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA8BvF;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAI1G;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOzD"}

package/dist/redaction.js

@@ -0,0 +1,98 @@
+import { redactCommandText } from "@dealdesk/adapter-utils";
+const SECRET_PAYLOAD_KEY_RE = /(api[-_]?key|access[-_]?token|auth(?:_?token)?|authorization|bearer|secret|passwd|password|credential|jwt|private[-_]?key|cookie|connectionstring)/i;
+const COMMAND_PAYLOAD_KEY_RE = /(^command$|^cmd$|command[-_]?line|resolved[-_]?command|DEALDESK_RESOLVED_COMMAND)/i;
+const COMMAND_ARGS_PAYLOAD_KEY_RE = /^(commandArgs|command_?args|argv)$/i;
+const JWT_VALUE_RE = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+)?$/;
+const CLI_SECRET_FLAG_RE = /^-{1,2}(?:api[-_]?key|(?:access[-_]?|auth[-_]?)?token|token|authorization|bearer|secret|passwd|password|credential|jwt|private[-_]?key|cookie|connectionstring)$/i;
+const JSON_SECRET_FIELD_TEXT_RE = /((?:"|')?(?:api[-_]?key|access[-_]?token|auth(?:_?token)?|authorization|bearer|secret|passwd|password|credential|jwt|private[-_]?key|cookie|connectionstring)(?:"|')?\s*:\s*(?:"|'))[^"'`\r\n]+((?:"|'))/gi;
+const ESCAPED_JSON_SECRET_FIELD_TEXT_RE = /((?:\\")?(?:api[-_]?key|access[-_]?token|auth(?:_?token)?|authorization|bearer|secret|passwd|password|credential|jwt|private[-_]?key|cookie|connectionstring)(?:\\")?\s*:\s*(?:\\"))[^\\\r\n]+((?:\\"))/gi;
+export const REDACTED_EVENT_VALUE = "***REDACTED***";
+function isPlainObject(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return false;
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+}
+function sanitizeValue(value) {
+    if (value === null || value === undefined)
+        return value;
+    if (Array.isArray(value))
+        return value.map(sanitizeValue);
+    if (isSecretRefBinding(value))
+        return value;
+    if (isPlainBinding(value))
+        return { type: "plain", value: sanitizeValue(value.value) };
+    if (!isPlainObject(value))
+        return value;
+    return sanitizeRecord(value);
+}
+function isSecretRefBinding(value) {
+    if (!isPlainObject(value))
+        return false;
+    return value.type === "secret_ref" && typeof value.secretId === "string";
+}
+function isPlainBinding(value) {
+    if (!isPlainObject(value))
+        return false;
+    return value.type === "plain" && "value" in value;
+}
+function sanitizeCommandArgs(args) {
+    let redactNext = false;
+    return args.map((arg) => {
+        if (redactNext) {
+            redactNext = false;
+            return REDACTED_EVENT_VALUE;
+        }
+        if (typeof arg !== "string")
+            return sanitizeValue(arg);
+        if (CLI_SECRET_FLAG_RE.test(arg.trim())) {
+            redactNext = true;
+            return arg;
+        }
+        return redactSensitiveText(arg);
+    });
+}
+export function sanitizeRecord(record) {
+    const redacted = {};
+    for (const [key, value] of Object.entries(record)) {
+        if (COMMAND_ARGS_PAYLOAD_KEY_RE.test(key) && Array.isArray(value)) {
+            redacted[key] = sanitizeCommandArgs(value);
+            continue;
+        }
+        if (COMMAND_PAYLOAD_KEY_RE.test(key) && typeof value === "string") {
+            redacted[key] = redactSensitiveText(value);
+            continue;
+        }
+        if (SECRET_PAYLOAD_KEY_RE.test(key)) {
+            if (isSecretRefBinding(value)) {
+                redacted[key] = sanitizeValue(value);
+                continue;
+            }
+            if (isPlainBinding(value)) {
+                redacted[key] = { type: "plain", value: REDACTED_EVENT_VALUE };
+                continue;
+            }
+            redacted[key] = REDACTED_EVENT_VALUE;
+            continue;
+        }
+        if (typeof value === "string" && JWT_VALUE_RE.test(value)) {
+            redacted[key] = REDACTED_EVENT_VALUE;
+            continue;
+        }
+        redacted[key] = sanitizeValue(value);
+    }
+    return redacted;
+}
+export function redactEventPayload(payload) {
+    if (!payload)
+        return null;
+    if (!isPlainObject(payload))
+        return payload;
+    return sanitizeRecord(payload);
+}
+export function redactSensitiveText(input) {
+    return redactCommandText(input
+        .replace(JSON_SECRET_FIELD_TEXT_RE, `$1${REDACTED_EVENT_VALUE}$2`)
+        .replace(ESCAPED_JSON_SECRET_FIELD_TEXT_RE, `$1${REDACTED_EVENT_VALUE}$2`), REDACTED_EVENT_VALUE);
+}
+//# sourceMappingURL=redaction.js.map

package/dist/redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,MAAM,qBAAqB,GACzB,qJAAqJ,CAAC;AACxJ,MAAM,sBAAsB,GAC1B,oFAAoF,CAAC;AACvF,MAAM,2BAA2B,GAAG,qCAAqC,CAAC;AAC1E,MAAM,YAAY,GAAG,uEAAuE,CAAC;AAC7F,MAAM,kBAAkB,GACtB,mKAAmK,CAAC;AACtK,MAAM,yBAAyB,GAC7B,4MAA4M,CAAC;AAC/M,MAAM,iCAAiC,GACrC,2MAA2M,CAAC;AAC9M,MAAM,CAAC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAErD,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3C,OAAO,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC;AACtD,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC1D,IAAI,kBAAkB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,cAAc,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;IACvF,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC;AAC3E,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,IAAI,KAAK,CAAC;AACpD,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAe;IAC1C,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACtB,IAAI,UAAU,EAAE,CAAC;YACf,UAAU,GAAG,KAAK,CAAC;YACnB,OAAO,oBAAoB,CAAC;QAC9B,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;QACvD,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACxC,UAAU,GAAG,IAAI,CAAC;YAClB,OAAO,GAAG,CAAC;QACb,CAAC;QACD,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAA+B;IAC5D,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAClE,QAAQ,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC3C,SAAS;QACX,CAAC;QACD,IAAI,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAClE,QAAQ,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC3C,SAAS;QACX,CAAC;QACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9B,QAAQ,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;gBACrC,SAAS;YACX,CAAC;YACD,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1B,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;gBAC/D,SAAS;YACX,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,GAAG,oBAAoB,CAAC;YACrC,SAAS;QACX,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1D,QAAQ,CAAC,GAAG,CAAC,GAAG,oBAAoB,CAAC;YACrC,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAuC;IACxE,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAC5C,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,OAAO,iBAAiB,CACtB,KAAK;SACF,OAAO,CAAC,yBAAyB,EAAE,KAAK,oBAAoB,IAAI,CAAC;SACjE,OAAO,CAAC,iCAAiC,EAAE,KAAK,oBAAoB,IAAI,CAAC,EAC5E,oBAAoB,CACrB,CAAC;AACJ,CAAC"}

package/dist/routes/__tests__/deal-desk-thesis.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=deal-desk-thesis.test.d.ts.map

package/dist/routes/__tests__/deal-desk-thesis.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deal-desk-thesis.test.d.ts","sourceRoot":"","sources":["../../../src/routes/__tests__/deal-desk-thesis.test.ts"],"names":[],"mappings":""}

package/dist/routes/__tests__/deal-desk-thesis.test.js

@@ -0,0 +1,53 @@
+import { describe, it, expect } from "vitest";
+import { buildThesisUpdateValues } from "../deal-desk.js";
+describe("buildThesisUpdateValues — M3 whitelist", () => {
+    it("includes only whitelisted keys from the request body", () => {
+        const body = {
+            name: "Updated Name",
+            sector: "Healthcare",
+            narrative: "new narrative",
+        };
+        const result = buildThesisUpdateValues(body);
+        expect(result).toEqual({
+            name: "Updated Name",
+            sector: "Healthcare",
+            narrative: "new narrative",
+        });
+    });
+    it("drops non-allowed keys even if forged onto the body (e.g. dealDeskCompanyId)", () => {
+        // Simulate a body that bypassed validate(updateThesisSchema), e.g. if
+        // someone removed .strict() in the future or extended the schema with a
+        // sensitive column. The helper must still refuse to forward unknown keys.
+        const forged = {
+            name: "Legit",
+            dealDeskCompanyId: "evil-tenant-id",
+            createdByUserId: "attacker-user",
+            id: "attempted-id-override",
+            updatedAt: new Date("2020-01-01"),
+        };
+        const result = buildThesisUpdateValues(forged);
+        expect(result.name).toBe("Legit");
+        expect(result).not.toHaveProperty("dealDeskCompanyId");
+        expect(result).not.toHaveProperty("createdByUserId");
+        expect(result).not.toHaveProperty("id");
+        expect(result).not.toHaveProperty("updatedAt");
+    });
+    it("skips undefined values so partial updates do not blank columns", () => {
+        const body = {
+            name: "Only Name",
+            sector: undefined,
+            narrative: undefined,
+        };
+        const result = buildThesisUpdateValues(body);
+        expect(result).toEqual({ name: "Only Name" });
+    });
+    it("preserves explicit null values for nullable columns", () => {
+        const body = {
+            narrative: null,
+            exclusionCriteria: null,
+        };
+        const result = buildThesisUpdateValues(body);
+        expect(result).toEqual({ narrative: null, exclusionCriteria: null });
+    });
+});
+//# sourceMappingURL=deal-desk-thesis.test.js.map

package/dist/routes/__tests__/deal-desk-thesis.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deal-desk-thesis.test.js","sourceRoot":"","sources":["../../../src/routes/__tests__/deal-desk-thesis.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAE1D,QAAQ,CAAC,wCAAwC,EAAE,GAAG,EAAE;IACtD,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,IAAI,GAAG;YACX,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,YAAY;YACpB,SAAS,EAAE,eAAe;SAC3B,CAAC;QACF,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACrB,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,YAAY;YACpB,SAAS,EAAE,eAAe;SAC3B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8EAA8E,EAAE,GAAG,EAAE;QACtF,sEAAsE;QACtE,wEAAwE;QACxE,0EAA0E;QAC1E,MAAM,MAAM,GAAG;YACb,IAAI,EAAE,OAAO;YACb,iBAAiB,EAAE,gBAAgB;YACnC,eAAe,EAAE,eAAe;YAChC,EAAE,EAAE,uBAAuB;YAC3B,SAAS,EAAE,IAAI,IAAI,CAAC,YAAY,CAAC;SAC0B,CAAC;QAE9D,MAAM,MAAM,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAE/C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC;QACvD,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,IAAI,GAAG;YACX,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,SAAS;SACrB,CAAC;QACF,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,IAAI,GAAG;YACX,SAAS,EAAE,IAAI;YACf,iBAAiB,EAAE,IAAI;SACxB,CAAC;QACF,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/routes/__tests__/gmail-oauth.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=gmail-oauth.test.d.ts.map

package/dist/routes/__tests__/gmail-oauth.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gmail-oauth.test.d.ts","sourceRoot":"","sources":["../../../src/routes/__tests__/gmail-oauth.test.ts"],"names":[],"mappings":""}

package/dist/routes/__tests__/gmail-oauth.test.js

@@ -0,0 +1,99 @@
+import { describe, it, expect } from "vitest";
+import express from "express";
+import request from "supertest";
+import { createGmailOAuthRouter } from "../gmail-oauth.js";
+import { forbidden } from "../../errors.js";
+const allowAll = () => { };
+describe("Gmail OAuth routes", () => {
+    it("GET /start redirects to Google authorize URL when company has credentials", async () => {
+        const app = express();
+        app.use(createGmailOAuthRouter({
+            loadClientConfig: async () => ({ clientId: "cid", clientSecret: "csec" }),
+            resolveRedirectUri: () => "https://x.test/cb",
+            resolveCompanyId: () => "co-1",
+            authorizeCompanyId: allowAll,
+            deps: { db: {} },
+        }));
+        const res = await request(app).get("/start?companyId=co-1");
+        expect(res.status).toBe(302);
+        expect(res.headers.location).toContain("accounts.google.com/o/oauth2/v2/auth");
+        expect(res.headers.location).toContain("client_id=cid");
+        expect(res.headers["set-cookie"]?.[0]).toContain("dd_gmail_oauth_state=");
+    });
+    it("GET /start returns 412 when company has no Gmail OAuth client configured", async () => {
+        const app = express();
+        app.use(createGmailOAuthRouter({
+            loadClientConfig: async () => null,
+            resolveRedirectUri: () => "https://x.test/cb",
+            resolveCompanyId: () => "co-1",
+            authorizeCompanyId: allowAll,
+            deps: { db: {} },
+        }));
+        const res = await request(app).get("/start?companyId=co-1");
+        expect(res.status).toBe(412);
+        expect(res.body).toMatchObject({ ok: false });
+    });
+    it("GET /start returns 400 when companyId can't be resolved", async () => {
+        const app = express();
+        app.use(createGmailOAuthRouter({
+            loadClientConfig: async () => null,
+            resolveRedirectUri: () => "https://x.test/cb",
+            resolveCompanyId: () => null,
+            authorizeCompanyId: allowAll,
+            deps: { db: {} },
+        }));
+        const res = await request(app).get("/start");
+        expect(res.status).toBe(400);
+    });
+    it("GET /start redirects to Google when authorizeCompanyId allows the company (companyA)", async () => {
+        const app = express();
+        app.use((req, _res, next) => {
+            req.actor = {
+                type: "board",
+                userId: "u1",
+                source: "session",
+                companyIds: ["companyA"],
+            };
+            next();
+        });
+        app.use("/oauth/gmail", createGmailOAuthRouter({
+            loadClientConfig: async () => ({ clientId: "x", clientSecret: "y" }),
+            resolveRedirectUri: () => "https://example.com/cb",
+            resolveCompanyId: (req) => req.query.companyId ?? null,
+            authorizeCompanyId: (_req, companyId) => {
+                if (companyId !== "companyA")
+                    throw forbidden("no access");
+            },
+            deps: { db: null },
+        }));
+        const res = await request(app).get("/oauth/gmail/start?companyId=companyA");
+        expect(res.status).toBe(302);
+        expect(res.headers.location).toContain("accounts.google.com/o/oauth2/v2/auth");
+    });
+    it("GET /start returns 403 when authorizeCompanyId rejects a foreign companyId (companyB)", async () => {
+        const app = express();
+        app.use((req, _res, next) => {
+            req.actor = {
+                type: "board",
+                userId: "u1",
+                source: "session",
+                companyIds: ["companyA"],
+            };
+            next();
+        });
+        app.use("/oauth/gmail", createGmailOAuthRouter({
+            loadClientConfig: async () => ({ clientId: "x", clientSecret: "y" }),
+            resolveRedirectUri: () => "https://example.com/cb",
+            resolveCompanyId: (req) => req.query.companyId ?? null,
+            authorizeCompanyId: (_req, companyId) => {
+                if (companyId !== "companyA")
+                    throw forbidden("no access");
+            },
+            deps: { db: null },
+        }));
+        const res = await request(app).get("/oauth/gmail/start?companyId=companyB");
+        expect(res.status).toBe(403);
+        expect(res.body).toMatchObject({ ok: false });
+    });
+});
+//# sourceMappingURL=gmail-oauth.test.js.map