@evermore.work/server 2026.509.0-canary.0

package/dist/middleware/board-mutation-guard.js

@@ -0,0 +1,67 @@
+const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
+const DEFAULT_DEV_ORIGINS = [
+    "http://localhost:3100",
+    "http://127.0.0.1:3100",
+];
+function parseOrigin(value) {
+    if (!value)
+        return null;
+    try {
+        const url = new URL(value);
+        return `${url.protocol}//${url.host}`.toLowerCase();
+    }
+    catch {
+        return null;
+    }
+}
+function trustedOriginsForRequest(req) {
+    const origins = new Set(DEFAULT_DEV_ORIGINS.map((value) => value.toLowerCase()));
+    const forwardedHost = req.header("x-forwarded-host")?.split(",")[0]?.trim();
+    const host = forwardedHost || req.header("host")?.trim();
+    if (host) {
+        origins.add(`http://${host}`.toLowerCase());
+        origins.add(`https://${host}`.toLowerCase());
+    }
+    // Behind some reverse proxies the Host / X-Forwarded-Host header may
+    // not match the public URL (for example when TLS terminates at the
+    // edge and the inbound Host is an internal service name). Trust the
+    // explicitly-configured EVERMORE_PUBLIC_URL when it's set.
+    const publicUrl = parseOrigin(process.env.EVERMORE_PUBLIC_URL?.trim());
+    if (publicUrl)
+        origins.add(publicUrl);
+    return origins;
+}
+function isTrustedBoardMutationRequest(req) {
+    const allowedOrigins = trustedOriginsForRequest(req);
+    const origin = parseOrigin(req.header("origin"));
+    if (origin && allowedOrigins.has(origin))
+        return true;
+    const refererOrigin = parseOrigin(req.header("referer"));
+    if (refererOrigin && allowedOrigins.has(refererOrigin))
+        return true;
+    return false;
+}
+export function boardMutationGuard() {
+    return (req, res, next) => {
+        if (SAFE_METHODS.has(req.method.toUpperCase())) {
+            next();
+            return;
+        }
+        if (req.actor.type !== "board") {
+            next();
+            return;
+        }
+        // Local-trusted mode and board bearer keys are not browser-session requests.
+        // In these modes, origin/referer headers can be absent; do not block those mutations.
+        if (req.actor.source === "local_implicit" || req.actor.source === "board_key") {
+            next();
+            return;
+        }
+        if (!isTrustedBoardMutationRequest(req)) {
+            res.status(403).json({ error: "Board mutation requires trusted browser origin" });
+            return;
+        }
+        next();
+    };
+}
+//# sourceMappingURL=board-mutation-guard.js.map

package/dist/middleware/board-mutation-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"board-mutation-guard.js","sourceRoot":"","sources":["../../src/middleware/board-mutation-guard.ts"],"names":[],"mappings":"AAEA,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AACzD,MAAM,mBAAmB,GAAG;IAC1B,uBAAuB;IACvB,uBAAuB;CACxB,CAAC;AAEF,SAAS,WAAW,CAAC,KAAyB;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,GAAY;IAC5C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACjF,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAC5E,MAAM,IAAI,GAAG,aAAa,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;IACzD,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,qEAAqE;IACrE,mEAAmE;IACnE,oEAAoE;IACpE,2DAA2D;IAC3D,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;IACvE,IAAI,SAAS;QAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,6BAA6B,CAAC,GAAY;IACjD,MAAM,cAAc,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjD,IAAI,MAAM,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtD,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IACzD,IAAI,aAAa,IAAI,cAAc,CAAC,GAAG,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC/C,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC/B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,6EAA6E;QAC7E,sFAAsF;QACtF,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,gBAAgB,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAC9E,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/error-handler.d.ts

@@ -0,0 +1,17 @@
+import type { Request, Response, NextFunction } from "express";
+export interface ErrorContext {
+    error: {
+        message: string;
+        stack?: string;
+        name?: string;
+        details?: unknown;
+        raw?: unknown;
+    };
+    method: string;
+    url: string;
+    reqBody?: unknown;
+    reqParams?: unknown;
+    reqQuery?: unknown;
+}
+export declare function errorHandler(err: unknown, req: Request, res: Response, _next: NextFunction): void;
+//# sourceMappingURL=error-handler.d.ts.map

package/dist/middleware/error-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-handler.d.ts","sourceRoot":"","sources":["../../src/middleware/error-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAM/D,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,GAAG,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC5F,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAqBD,wBAAgB,YAAY,CAC1B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,KAAK,EAAE,YAAY,QAuCpB"}

package/dist/middleware/error-handler.js

@@ -0,0 +1,45 @@
+import { ZodError } from "zod";
+import { HttpError } from "../errors.js";
+import { trackErrorHandlerCrash } from "@evermore.work/shared/telemetry";
+import { getTelemetryClient } from "../telemetry.js";
+function attachErrorContext(req, res, payload, rawError) {
+    res.__errorContext = {
+        error: payload,
+        method: req.method,
+        url: req.originalUrl,
+        reqBody: req.body,
+        reqParams: req.params,
+        reqQuery: req.query,
+    };
+    if (rawError) {
+        res.err = rawError;
+    }
+}
+export function errorHandler(err, req, res, _next) {
+    if (err instanceof HttpError) {
+        if (err.status >= 500) {
+            attachErrorContext(req, res, { message: err.message, stack: err.stack, name: err.name, details: err.details }, err);
+            const tc = getTelemetryClient();
+            if (tc)
+                trackErrorHandlerCrash(tc, { errorCode: err.name });
+        }
+        res.status(err.status).json({
+            error: err.message,
+            ...(err.details ? { details: err.details } : {}),
+        });
+        return;
+    }
+    if (err instanceof ZodError) {
+        res.status(400).json({ error: "Validation error", details: err.errors });
+        return;
+    }
+    const rootError = err instanceof Error ? err : new Error(String(err));
+    attachErrorContext(req, res, err instanceof Error
+        ? { message: err.message, stack: err.stack, name: err.name }
+        : { message: String(err), raw: err, stack: rootError.stack, name: rootError.name }, rootError);
+    const tc = getTelemetryClient();
+    if (tc)
+        trackErrorHandlerCrash(tc, { errorCode: rootError.name });
+    res.status(500).json({ error: "Internal server error" });
+}
+//# sourceMappingURL=error-handler.js.map

package/dist/middleware/error-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-handler.js","sourceRoot":"","sources":["../../src/middleware/error-handler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAWrD,SAAS,kBAAkB,CACzB,GAAY,EACZ,GAAa,EACb,OAA8B,EAC9B,QAAgB;IAEf,GAAW,CAAC,cAAc,GAAG;QAC5B,KAAK,EAAE,OAAO;QACd,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,GAAG,EAAE,GAAG,CAAC,WAAW;QACpB,OAAO,EAAE,GAAG,CAAC,IAAI;QACjB,SAAS,EAAE,GAAG,CAAC,MAAM;QACrB,QAAQ,EAAE,GAAG,CAAC,KAAK;KACG,CAAC;IACzB,IAAI,QAAQ,EAAE,CAAC;QACZ,GAAW,CAAC,GAAG,GAAG,QAAQ,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,GAAY,EACZ,GAAY,EACZ,GAAa,EACb,KAAmB;IAEnB,IAAI,GAAG,YAAY,SAAS,EAAE,CAAC;QAC7B,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YACtB,kBAAkB,CAChB,GAAG,EACH,GAAG,EACH,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAChF,GAAG,CACJ,CAAC;YACF,MAAM,EAAE,GAAG,kBAAkB,EAAE,CAAC;YAChC,IAAI,EAAE;gBAAE,sBAAsB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;YAC1B,KAAK,EAAE,GAAG,CAAC,OAAO;YAClB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;QAC5B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACzE,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACtE,kBAAkB,CAChB,GAAG,EACH,GAAG,EACH,GAAG,YAAY,KAAK;QAClB,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;QAC5D,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,EACpF,SAAS,CACV,CAAC;IAEF,MAAM,EAAE,GAAG,kBAAkB,EAAE,CAAC;IAChC,IAAI,EAAE;QAAE,sBAAsB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IAElE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;AAC3D,CAAC"}

package/dist/middleware/http-log-policy.d.ts

@@ -0,0 +1,2 @@
+export declare function shouldSilenceHttpSuccessLog(method: string | undefined, url: string | undefined, statusCode: number): boolean;
+//# sourceMappingURL=http-log-policy.d.ts.map

package/dist/middleware/http-log-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-log-policy.d.ts","sourceRoot":"","sources":["../../src/middleware/http-log-policy.ts"],"names":[],"mappings":"AAuCA,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAU5H"}

package/dist/middleware/http-log-policy.js

@@ -0,0 +1,52 @@
+const SILENCED_SUCCESS_METHODS = new Set(["GET", "HEAD"]);
+const SILENCED_SUCCESS_API_PATHS = [
+    /^\/api\/health(?:\/|$)/,
+    /^\/api\/companies\/[^/]+\/activity(?:\/|$)/,
+    /^\/api\/companies\/[^/]+\/dashboard(?:\/|$)/,
+    /^\/api\/companies\/[^/]+\/heartbeat-runs(?:\/|$)/,
+    /^\/api\/companies\/[^/]+\/issues(?:\/|$)/,
+    /^\/api\/companies\/[^/]+\/live-runs(?:\/|$)/,
+    /^\/api\/companies\/[^/]+\/sidebar-badges(?:\/|$)/,
+    /^\/api\/heartbeat-runs\/[^/]+\/log(?:\/|$)/,
+];
+const SILENCED_SUCCESS_STATIC_PREFIXES = [
+    "/@fs/",
+    "/@id/",
+    "/@react-refresh",
+    "/@vite/",
+    "/_plugins/",
+    "/assets/",
+    "/node_modules/",
+    "/src/",
+];
+const SILENCED_SUCCESS_STATIC_PATHS = new Set([
+    "/",
+    "/index.html",
+    "/favicon.ico",
+    "/site.webmanifest",
+    "/sw.js",
+]);
+function normalizePath(url) {
+    const trimmed = url.trim();
+    if (trimmed.length === 0)
+        return "/";
+    const pathname = trimmed.split("?")[0]?.trim() ?? "/";
+    return pathname.length > 0 ? pathname : "/";
+}
+export function shouldSilenceHttpSuccessLog(method, url, statusCode) {
+    if (statusCode >= 400)
+        return false;
+    if (statusCode === 304)
+        return true;
+    if (!method || !url)
+        return false;
+    if (!SILENCED_SUCCESS_METHODS.has(method.toUpperCase()))
+        return false;
+    const pathname = normalizePath(url);
+    if (SILENCED_SUCCESS_STATIC_PATHS.has(pathname))
+        return true;
+    if (SILENCED_SUCCESS_STATIC_PREFIXES.some((prefix) => pathname.startsWith(prefix)))
+        return true;
+    return SILENCED_SUCCESS_API_PATHS.some((pattern) => pattern.test(pathname));
+}
+//# sourceMappingURL=http-log-policy.js.map

package/dist/middleware/http-log-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-log-policy.js","sourceRoot":"","sources":["../../src/middleware/http-log-policy.ts"],"names":[],"mappings":"AAAA,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAE1D,MAAM,0BAA0B,GAAG;IACjC,wBAAwB;IACxB,4CAA4C;IAC5C,6CAA6C;IAC7C,kDAAkD;IAClD,0CAA0C;IAC1C,6CAA6C;IAC7C,kDAAkD;IAClD,4CAA4C;CAC7C,CAAC;AAEF,MAAM,gCAAgC,GAAG;IACvC,OAAO;IACP,OAAO;IACP,iBAAiB;IACjB,SAAS;IACT,YAAY;IACZ,UAAU;IACV,gBAAgB;IAChB,OAAO;CACR,CAAC;AAEF,MAAM,6BAA6B,GAAG,IAAI,GAAG,CAAC;IAC5C,GAAG;IACH,aAAa;IACb,cAAc;IACd,mBAAmB;IACnB,QAAQ;CACT,CAAC,CAAC;AAEH,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC;IACtD,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAA0B,EAAE,GAAuB,EAAE,UAAkB;IACjH,IAAI,UAAU,IAAI,GAAG;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,UAAU,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAClC,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAEtE,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,6BAA6B,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,gCAAgC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChG,OAAO,0BAA0B,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC9E,CAAC"}

package/dist/middleware/index.d.ts

@@ -0,0 +1,4 @@
+export { logger, httpLogger } from "./logger.js";
+export { errorHandler } from "./error-handler.js";
+export { validate } from "./validate.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/middleware/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC"}

package/dist/middleware/index.js

@@ -0,0 +1,4 @@
+export { logger, httpLogger } from "./logger.js";
+export { errorHandler } from "./error-handler.js";
+export { validate } from "./validate.js";
+//# sourceMappingURL=index.js.map

package/dist/middleware/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC"}

package/dist/middleware/logger.d.ts

@@ -0,0 +1,4 @@
+import pino from "pino";
+export declare const logger: pino.Logger<never, boolean>;
+export declare const httpLogger: import("pino-http").HttpLogger<import("http").IncomingMessage, import("http").ServerResponse<import("http").IncomingMessage>, never>;
+//# sourceMappingURL=logger.d.ts.map

package/dist/middleware/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/middleware/logger.ts"],"names":[],"mappings":"AAEA,OAAO,IAAI,MAAM,MAAM,CAAC;AA2BxB,eAAO,MAAM,MAAM,6BAgBhB,CAAC;AAEJ,eAAO,MAAM,UAAU,sIA+CrB,CAAC"}

package/dist/middleware/logger.js

@@ -0,0 +1,92 @@
+import path from "node:path";
+import fs from "node:fs";
+import pino from "pino";
+import { pinoHttp } from "pino-http";
+import { readConfigFile } from "../config-file.js";
+import { resolveDefaultLogsDir, resolveHomeAwarePath } from "../home-paths.js";
+import { shouldSilenceHttpSuccessLog } from "./http-log-policy.js";
+function resolveServerLogDir() {
+    const envOverride = process.env.EVERMORE_LOG_DIR?.trim();
+    if (envOverride)
+        return resolveHomeAwarePath(envOverride);
+    const fileLogDir = readConfigFile()?.logging.logDir?.trim();
+    if (fileLogDir)
+        return resolveHomeAwarePath(fileLogDir);
+    return resolveDefaultLogsDir();
+}
+const logDir = resolveServerLogDir();
+fs.mkdirSync(logDir, { recursive: true });
+const logFile = path.join(logDir, "server.log");
+const sharedOpts = {
+    translateTime: "SYS:HH:MM:ss",
+    ignore: "pid,hostname",
+    singleLine: true,
+};
+export const logger = pino({
+    level: "debug",
+    redact: ["req.headers.authorization"],
+}, pino.transport({
+    targets: [
+        {
+            target: "pino-pretty",
+            options: { ...sharedOpts, ignore: "pid,hostname,req,res,responseTime", colorize: true, destination: 1 },
+            level: "info",
+        },
+        {
+            target: "pino-pretty",
+            options: { ...sharedOpts, colorize: false, destination: logFile, mkdir: true },
+            level: "debug",
+        },
+    ],
+}));
+export const httpLogger = pinoHttp({
+    logger,
+    customLogLevel(_req, res, err) {
+        if (shouldSilenceHttpSuccessLog(_req.method, _req.url, res.statusCode)) {
+            return "silent";
+        }
+        if (err || res.statusCode >= 500)
+            return "error";
+        if (res.statusCode >= 400)
+            return "warn";
+        return "info";
+    },
+    customSuccessMessage(req, res) {
+        return `${req.method} ${req.url} ${res.statusCode}`;
+    },
+    customErrorMessage(req, res, err) {
+        const ctx = res.__errorContext;
+        const errMsg = ctx?.error?.message || err?.message || res.err?.message || "unknown error";
+        return `${req.method} ${req.url} ${res.statusCode} — ${errMsg}`;
+    },
+    customProps(req, res) {
+        if (res.statusCode >= 400) {
+            const ctx = res.__errorContext;
+            if (ctx) {
+                return {
+                    errorContext: ctx.error,
+                    reqBody: ctx.reqBody,
+                    reqParams: ctx.reqParams,
+                    reqQuery: ctx.reqQuery,
+                };
+            }
+            const props = {};
+            const { body, params, query } = req;
+            if (body && typeof body === "object" && Object.keys(body).length > 0) {
+                props.reqBody = body;
+            }
+            if (params && typeof params === "object" && Object.keys(params).length > 0) {
+                props.reqParams = params;
+            }
+            if (query && typeof query === "object" && Object.keys(query).length > 0) {
+                props.reqQuery = query;
+            }
+            if (req.route?.path) {
+                props.routePath = req.route.path;
+            }
+            return props;
+        }
+        return {};
+    },
+});
+//# sourceMappingURL=logger.js.map

package/dist/middleware/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/middleware/logger.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AAEnE,SAAS,mBAAmB;IAC1B,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC;IACzD,IAAI,WAAW;QAAE,OAAO,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAE1D,MAAM,UAAU,GAAG,cAAc,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IAC5D,IAAI,UAAU;QAAE,OAAO,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAExD,OAAO,qBAAqB,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;AACrC,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAE1C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AAEhD,MAAM,UAAU,GAAG;IACjB,aAAa,EAAE,cAAc;IAC7B,MAAM,EAAE,cAAc;IACtB,UAAU,EAAE,IAAI;CACjB,CAAC;AAEF,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,CAAC,2BAA2B,CAAC;CACtC,EAAE,IAAI,CAAC,SAAS,CAAC;IAChB,OAAO,EAAE;QACP;YACE,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,mCAAmC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;YACvG,KAAK,EAAE,MAAM;SACd;QACD;YACE,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE;YAC9E,KAAK,EAAE,OAAO;SACf;KACF;CACF,CAAC,CAAC,CAAC;AAEJ,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAC;IACjC,MAAM;IACN,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG;QAC3B,IAAI,2BAA2B,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACvE,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG;YAAE,OAAO,OAAO,CAAC;QACjD,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG;YAAE,OAAO,MAAM,CAAC;QACzC,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,oBAAoB,CAAC,GAAG,EAAE,GAAG;QAC3B,OAAO,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;IACtD,CAAC;IACD,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG;QAC9B,MAAM,GAAG,GAAI,GAAW,CAAC,cAAc,CAAC;QACxC,MAAM,MAAM,GAAG,GAAG,EAAE,KAAK,EAAE,OAAO,IAAI,GAAG,EAAE,OAAO,IAAK,GAAW,CAAC,GAAG,EAAE,OAAO,IAAI,eAAe,CAAC;QACnG,OAAO,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,MAAM,MAAM,EAAE,CAAC;IAClE,CAAC;IACD,WAAW,CAAC,GAAG,EAAE,GAAG;QAClB,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAI,GAAW,CAAC,cAAc,CAAC;YACxC,IAAI,GAAG,EAAE,CAAC;gBACR,OAAO;oBACL,YAAY,EAAE,GAAG,CAAC,KAAK;oBACvB,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;iBACvB,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAA4B,EAAE,CAAC;YAC1C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,GAAU,CAAC;YAC3C,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrE,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;YACvB,CAAC;YACD,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3E,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC;YAC3B,CAAC;YACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxE,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC;YACzB,CAAC;YACD,IAAK,GAAW,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;gBAC7B,KAAK,CAAC,SAAS,GAAI,GAAW,CAAC,KAAK,CAAC,IAAI,CAAC;YAC5C,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;CACF,CAAC,CAAC"}

package/dist/middleware/private-hostname-guard.d.ts

@@ -0,0 +1,11 @@
+import type { RequestHandler } from "express";
+export declare function resolvePrivateHostnameAllowSet(opts: {
+    allowedHostnames: string[];
+    bindHost: string;
+}): Set<string>;
+export declare function privateHostnameGuard(opts: {
+    enabled: boolean;
+    allowedHostnames: string[];
+    bindHost: string;
+}): RequestHandler;
+//# sourceMappingURL=private-hostname-guard.d.ts.map

package/dist/middleware/private-hostname-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-hostname-guard.d.ts","sourceRoot":"","sources":["../../src/middleware/private-hostname-guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,cAAc,EAAE,MAAM,SAAS,CAAC;AA8BvD,wBAAgB,8BAA8B,CAAC,IAAI,EAAE;IAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAYlH;AASD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,cAAc,CAoCjB"}

package/dist/middleware/private-hostname-guard.js

@@ -0,0 +1,78 @@
+function isLoopbackHostname(hostname) {
+    const normalized = hostname.trim().toLowerCase();
+    return normalized === "localhost" || normalized === "127.0.0.1" || normalized === "::1";
+}
+function extractHostname(req) {
+    const forwardedHost = req.header("x-forwarded-host")?.split(",")[0]?.trim();
+    const hostHeader = req.header("host")?.trim();
+    const raw = forwardedHost || hostHeader;
+    if (!raw)
+        return null;
+    try {
+        return new URL(`http://${raw}`).hostname.trim().toLowerCase();
+    }
+    catch {
+        return raw.trim().toLowerCase();
+    }
+}
+function normalizeAllowedHostnames(values) {
+    const unique = new Set();
+    for (const value of values) {
+        const trimmed = value.trim().toLowerCase();
+        if (!trimmed)
+            continue;
+        unique.add(trimmed);
+    }
+    return Array.from(unique);
+}
+export function resolvePrivateHostnameAllowSet(opts) {
+    const configuredAllow = normalizeAllowedHostnames(opts.allowedHostnames);
+    const bindHost = opts.bindHost.trim().toLowerCase();
+    const allowSet = new Set(configuredAllow);
+    if (bindHost && bindHost !== "0.0.0.0") {
+        allowSet.add(bindHost);
+    }
+    allowSet.add("localhost");
+    allowSet.add("127.0.0.1");
+    allowSet.add("::1");
+    return allowSet;
+}
+function blockedHostnameMessage(hostname) {
+    return (`Hostname '${hostname}' is not allowed for this Evermore instance. ` +
+        `If you want to allow this hostname, please run pnpm evermore allowed-hostname ${hostname}`);
+}
+export function privateHostnameGuard(opts) {
+    if (!opts.enabled) {
+        return (_req, _res, next) => next();
+    }
+    const allowSet = resolvePrivateHostnameAllowSet({
+        allowedHostnames: opts.allowedHostnames,
+        bindHost: opts.bindHost,
+    });
+    return (req, res, next) => {
+        const hostname = extractHostname(req);
+        const wantsJson = req.path.startsWith("/api") || req.accepts(["json", "html", "text"]) === "json";
+        if (!hostname) {
+            const error = "Missing Host header. If you want to allow a hostname, run pnpm evermore allowed-hostname <host>.";
+            if (wantsJson) {
+                res.status(403).json({ error });
+            }
+            else {
+                res.status(403).type("text/plain").send(error);
+            }
+            return;
+        }
+        if (isLoopbackHostname(hostname) || allowSet.has(hostname)) {
+            next();
+            return;
+        }
+        const error = blockedHostnameMessage(hostname);
+        if (wantsJson) {
+            res.status(403).json({ error });
+        }
+        else {
+            res.status(403).type("text/plain").send(error);
+        }
+    };
+}
+//# sourceMappingURL=private-hostname-guard.js.map

package/dist/middleware/private-hostname-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-hostname-guard.js","sourceRoot":"","sources":["../../src/middleware/private-hostname-guard.ts"],"names":[],"mappings":"AAEA,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjD,OAAO,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,KAAK,CAAC;AAC1F,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACnC,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAC5E,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;IAC9C,MAAM,GAAG,GAAG,aAAa,IAAI,UAAU,CAAC;IACxC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClC,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,MAAgB;IACjD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,IAAsD;IACnG,MAAM,eAAe,GAAG,yBAAyB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,eAAe,CAAC,CAAC;IAElD,IAAI,QAAQ,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACvC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC1B,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC1B,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,OAAO,CACL,aAAa,QAAQ,+CAA+C;QACpE,iFAAiF,QAAQ,EAAE,CAC5F,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAIpC;IACC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IACtC,CAAC;IAED,MAAM,QAAQ,GAAG,8BAA8B,CAAC;QAC9C,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,MAAM,CAAC;QAElG,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,kGAAkG,CAAC;YACjH,IAAI,SAAS,EAAE,CAAC;gBACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAClC,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjD,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,kBAAkB,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3D,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,SAAS,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/validate.d.ts

@@ -0,0 +1,4 @@
+import type { Request, Response, NextFunction } from "express";
+import type { ZodSchema } from "zod";
+export declare function validate(schema: ZodSchema): (req: Request, _res: Response, next: NextFunction) => void;
+//# sourceMappingURL=validate.d.ts.map

package/dist/middleware/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/middleware/validate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,KAAK,CAAC;AAErC,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,IAChC,KAAK,OAAO,EAAE,MAAM,QAAQ,EAAE,MAAM,YAAY,UAIzD"}

package/dist/middleware/validate.js

@@ -0,0 +1,7 @@
+export function validate(schema) {
+    return (req, _res, next) => {
+        req.body = schema.parse(req.body);
+        next();
+    };
+}
+//# sourceMappingURL=validate.js.map

package/dist/middleware/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/middleware/validate.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,QAAQ,CAAC,MAAiB;IACxC,OAAO,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB,EAAE,EAAE;QAC1D,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/onboarding-assets/ceo/AGENTS.md

@@ -0,0 +1,59 @@
+You are the CEO. Your job is to lead the company, not to do individual contributor work. You own strategy, prioritization, and cross-functional coordination.
+
+Your personal files (life, memory, knowledge) live alongside these instructions. Other agents may have their own folders and you may update them when necessary.
+
+Company-wide artifacts (plans, shared docs) live in the project root, outside your personal directory.
+
+## Delegation (critical)
+
+You MUST delegate work rather than doing it yourself. When a task is assigned to you:
+
+1. **Triage it** -- read the task, understand what's being asked, and determine which department owns it.
+2. **Delegate it** -- create a subtask with `parentId` set to the current task, assign it to the right direct report, and include context about what needs to happen. Use these routing rules:
+   - **Code, bugs, features, infra, devtools, technical tasks** → CTO
+   - **Marketing, content, social media, growth, devrel** → CMO
+   - **UX, design, user research, design-system** → UXDesigner
+   - **Cross-functional or unclear** → break into separate subtasks for each department, or assign to the CTO if it's primarily technical with a design component
+   - If the right report doesn't exist yet, use the `evermore-create-agent` skill to hire one before delegating.
+3. **Do NOT write code, implement features, or fix bugs yourself.** Your reports exist for this. Even if a task seems small or quick, delegate it.
+4. **Follow up** -- if a delegated task is blocked or stale, check in with the assignee via a comment or reassign if needed.
+
+## What you DO personally
+
+- Set priorities and make product decisions
+- Resolve cross-team conflicts or ambiguity
+- Communicate with the board (human users)
+- Approve or reject proposals from your reports
+- Hire new agents when the team needs capacity
+- Unblock your direct reports when they escalate to you
+
+## Keeping work moving
+
+- Don't let tasks sit idle. If you delegate something, check that it's progressing.
+- If a report is blocked, help unblock them -- escalate to the board if needed.
+- If the board asks you to do something and you're unsure who should own it, default to the CTO for technical work.
+- Use child issues for delegated work and wait for Evermore wake events or comments instead of polling agents, sessions, or processes in a loop.
+- Create child issues directly when ownership and scope are clear. Use issue-thread interactions when the board/user needs to choose proposed tasks, answer structured questions, or confirm a proposal before work can continue.
+- Use `request_confirmation` for explicit yes/no decisions instead of asking in markdown. For plan approval, update the `plan` document, create a confirmation targeting the latest plan revision with an idempotency key like `confirmation:{issueId}:plan:{revisionId}`, put the source issue in `in_review`, and wait for acceptance before delegating implementation subtasks.
+- If a board/user comment supersedes a pending confirmation, treat it as fresh direction: revise the artifact or proposal and create a fresh confirmation if approval is still needed.
+- Every handoff should leave durable context: objective, owner, acceptance criteria, current blocker if any, and the next action.
+- You must always update your task with a comment explaining what you did (e.g., who you delegated to and why).
+
+## Memory and Planning
+
+You MUST use the `para-memory-files` skill for all memory operations: storing facts, writing daily notes, creating entities, running weekly synthesis, recalling past context, and managing plans. The skill defines your three-layer memory system (knowledge graph, daily notes, tacit knowledge), the PARA folder structure, atomic fact schemas, memory decay rules, qmd recall, and planning conventions.
+
+Invoke it whenever you need to remember, retrieve, or organize anything.
+
+## Safety Considerations
+
+- Never exfiltrate secrets or private data.
+- Do not perform any destructive commands unless explicitly requested by the board.
+
+## References
+
+These files are essential. Read them.
+
+- `./HEARTBEAT.md` -- execution and extraction checklist. Run every heartbeat.
+- `./SOUL.md` -- who you are and how you should act.
+- `./TOOLS.md` -- tools you have access to

package/dist/onboarding-assets/ceo/HEARTBEAT.md

@@ -0,0 +1,85 @@
+# HEARTBEAT.md -- CEO Heartbeat Checklist
+
+Run this checklist on every heartbeat. This covers both your local planning/memory work and your organizational coordination via the Evermore skill.
+
+## 1. Identity and Context
+
+- `GET /api/agents/me` -- confirm your id, role, budget, chainOfCommand.
+- Check wake context: `EVERMORE_TASK_ID`, `EVERMORE_WAKE_REASON`, `EVERMORE_WAKE_COMMENT_ID`.
+
+## 2. Local Planning Check
+
+1. Read today's plan from `$AGENT_HOME/memory/YYYY-MM-DD.md` under "## Today's Plan".
+2. Review each planned item: what's completed, what's blocked, and what up next.
+3. For any blockers, resolve them yourself or escalate to the board.
+4. If you're ahead, start on the next highest priority.
+5. Record progress updates in the daily notes.
+
+## 3. Approval Follow-Up
+
+If `EVERMORE_APPROVAL_ID` is set:
+
+- Review the approval and its linked issues.
+- Close resolved issues or comment on what remains open.
+
+## 4. Get Assignments
+
+- `GET /api/companies/{companyId}/issues?assigneeAgentId={your-id}&status=todo,in_progress,in_review,blocked`
+- Prioritize: `in_progress` first, then `in_review` when you were woken by a comment on it, then `todo`. Skip `blocked` unless you can unblock it.
+- If there is already an active run on an `in_progress` task, just move on to the next thing.
+- If `EVERMORE_TASK_ID` is set and assigned to you, prioritize that task.
+
+## 5. Checkout and Work
+
+- For scoped issue wakes, Evermore may already checkout the current issue in the harness before your run starts.
+- Only call `POST /api/issues/{id}/checkout` yourself when you intentionally switch to a different task or the wake context did not already claim the issue.
+- Never retry a 409 -- that task belongs to someone else.
+- Do the work. Update status and comment when done.
+
+Status quick guide:
+
+- `todo`: ready to execute, but not yet checked out.
+- `in_progress`: actively owned work. Agents should reach this by checkout, not by manually flipping status.
+- `in_review`: waiting on review, approval, board/user confirmation, or issue-thread interaction response. Use it when you create a pending confirmation/question before more work can continue.
+- `blocked`: cannot move until something specific changes. Say what is blocked and use `blockedByIssueIds` if another issue is the blocker.
+- `done`: finished.
+- `cancelled`: intentionally dropped.
+
+## 6. Delegation
+
+- Create subtasks with `POST /api/companies/{companyId}/issues`. Always set `parentId` and `goalId`. For non-child follow-ups that must stay on the same checkout/worktree, set `inheritExecutionWorkspaceFromIssueId` to the source issue.
+- When you know the needed work and owner, create those subtasks directly. When the board/user must choose from a proposed task tree, answer structured questions, or confirm a proposal before you can proceed, create an issue-thread interaction on the current issue with `POST /api/issues/{issueId}/interactions` using `kind: "suggest_tasks"`, `kind: "ask_user_questions"`, or `kind: "request_confirmation"` and `continuationPolicy: "wake_assignee"` when the answer should wake you.
+- For plan approval, update the `plan` document first, create `request_confirmation` targeting the latest `plan` revision, use an idempotency key like `confirmation:{issueId}:plan:{revisionId}`, set the source issue to `in_review`, and do not create implementation subtasks until the board/user accepts it.
+- For confirmations that should become stale after board/user discussion, set `supersedeOnUserComment: true`. If you are woken by a superseding comment, revise the proposal and create a fresh confirmation if the decision is still needed.
+- Use `evermore-create-agent` skill when hiring new agents.
+- Assign work to the right agent for the job.
+
+## 7. Fact Extraction
+
+1. Check for new conversations since last extraction.
+2. Extract durable facts to the relevant entity in `$AGENT_HOME/life/` (PARA).
+3. Update `$AGENT_HOME/memory/YYYY-MM-DD.md` with timeline entries.
+4. Update access metadata (timestamp, access_count) for any referenced facts.
+
+## 8. Exit
+
+- Comment on any in_progress work before exiting.
+- If no assignments and no valid mention-handoff, exit cleanly.
+
+---
+
+## CEO Responsibilities
+
+- Strategic direction: Set goals and priorities aligned with the company mission.
+- Hiring: Spin up new agents when capacity is needed.
+- Unblocking: Escalate or resolve blockers for reports.
+- Budget awareness: Above 80% spend, focus only on critical tasks.
+- Never look for unassigned work -- only work on what is assigned to you.
+- Never cancel cross-team tasks -- reassign to the relevant manager with a comment.
+
+## Rules
+
+- Always use the Evermore skill for coordination.
+- Always include `X-Evermore-Run-Id` header on mutating API calls.
+- Comment in concise markdown: status line + bullets + links.
+- Self-assign via checkout only when explicitly @-mentioned.