@growthub/cli 0.3.12 → 0.3.13

package/dist/runtime/server/dist/routes/assets.js

@@ -1,309 +0,0 @@
-import { Router } from "express";
-import multer from "multer";
-import createDOMPurify from "dompurify";
-import { JSDOM } from "jsdom";
-import { createAssetImageMetadataSchema } from "@paperclipai/shared";
-import { assetService, logActivity } from "../services/index.js";
-import { isAllowedContentType, MAX_ATTACHMENT_BYTES } from "../attachment-types.js";
-import { assertCompanyAccess, getActorInfo } from "./authz.js";
-const SVG_CONTENT_TYPE = "image/svg+xml";
-const ALLOWED_COMPANY_LOGO_CONTENT_TYPES = new Set([
-    "image/png",
-    "image/jpeg",
-    "image/jpg",
-    "image/webp",
-    "image/gif",
-    SVG_CONTENT_TYPE,
-]);
-function sanitizeSvgBuffer(input) {
-    const raw = input.toString("utf8").trim();
-    if (!raw)
-        return null;
-    const baseDom = new JSDOM("");
-    const domPurify = createDOMPurify(baseDom.window);
-    domPurify.addHook("uponSanitizeAttribute", (_node, data) => {
-        const attrName = data.attrName.toLowerCase();
-        const attrValue = (data.attrValue ?? "").trim();
-        if (attrName.startsWith("on")) {
-            data.keepAttr = false;
-            return;
-        }
-        if ((attrName === "href" || attrName === "xlink:href") && attrValue && !attrValue.startsWith("#")) {
-            data.keepAttr = false;
-        }
-    });
-    let parsedDom = null;
-    try {
-        const sanitized = domPurify.sanitize(raw, {
-            USE_PROFILES: { svg: true, svgFilters: true, html: false },
-            FORBID_TAGS: ["script", "foreignObject"],
-            FORBID_CONTENTS: ["script", "foreignObject"],
-            RETURN_TRUSTED_TYPE: false,
-        });
-        parsedDom = new JSDOM(sanitized, { contentType: SVG_CONTENT_TYPE });
-        const document = parsedDom.window.document;
-        const root = document.documentElement;
-        if (!root || root.tagName.toLowerCase() !== "svg")
-            return null;
-        for (const el of Array.from(root.querySelectorAll("script, foreignObject"))) {
-            el.remove();
-        }
-        for (const el of Array.from(root.querySelectorAll("*"))) {
-            for (const attr of Array.from(el.attributes)) {
-                const attrName = attr.name.toLowerCase();
-                const attrValue = attr.value.trim();
-                if (attrName.startsWith("on")) {
-                    el.removeAttribute(attr.name);
-                    continue;
-                }
-                if ((attrName === "href" || attrName === "xlink:href") && attrValue && !attrValue.startsWith("#")) {
-                    el.removeAttribute(attr.name);
-                }
-            }
-        }
-        const output = root.outerHTML.trim();
-        if (!output || !/^<svg[\s>]/i.test(output))
-            return null;
-        return Buffer.from(output, "utf8");
-    }
-    catch {
-        return null;
-    }
-    finally {
-        parsedDom?.window.close();
-        baseDom.window.close();
-    }
-}
-export function assetRoutes(db, storage) {
-    const router = Router();
-    const svc = assetService(db);
-    const assetUpload = multer({
-        storage: multer.memoryStorage(),
-        limits: { fileSize: MAX_ATTACHMENT_BYTES, files: 1 },
-    });
-    const companyLogoUpload = multer({
-        storage: multer.memoryStorage(),
-        limits: { fileSize: MAX_ATTACHMENT_BYTES, files: 1 },
-    });
-    async function runSingleFileUpload(upload, req, res) {
-        await new Promise((resolve, reject) => {
-            upload.single("file")(req, res, (err) => {
-                if (err)
-                    reject(err);
-                else
-                    resolve();
-            });
-        });
-    }
-    router.post("/companies/:companyId/assets/images", async (req, res) => {
-        const companyId = req.params.companyId;
-        assertCompanyAccess(req, companyId);
-        try {
-            await runSingleFileUpload(assetUpload, req, res);
-        }
-        catch (err) {
-            if (err instanceof multer.MulterError) {
-                if (err.code === "LIMIT_FILE_SIZE") {
-                    res.status(422).json({ error: `File exceeds ${MAX_ATTACHMENT_BYTES} bytes` });
-                    return;
-                }
-                res.status(400).json({ error: err.message });
-                return;
-            }
-            throw err;
-        }
-        const file = req.file;
-        if (!file) {
-            res.status(400).json({ error: "Missing file field 'file'" });
-            return;
-        }
-        const parsedMeta = createAssetImageMetadataSchema.safeParse(req.body ?? {});
-        if (!parsedMeta.success) {
-            res.status(400).json({ error: "Invalid image metadata", details: parsedMeta.error.issues });
-            return;
-        }
-        const namespaceSuffix = parsedMeta.data.namespace ?? "general";
-        const contentType = (file.mimetype || "").toLowerCase();
-        if (contentType !== SVG_CONTENT_TYPE && !isAllowedContentType(contentType)) {
-            res.status(422).json({ error: `Unsupported file type: ${contentType || "unknown"}` });
-            return;
-        }
-        let fileBody = file.buffer;
-        if (contentType === SVG_CONTENT_TYPE) {
-            const sanitized = sanitizeSvgBuffer(file.buffer);
-            if (!sanitized || sanitized.length <= 0) {
-                res.status(422).json({ error: "SVG could not be sanitized" });
-                return;
-            }
-            fileBody = sanitized;
-        }
-        if (fileBody.length <= 0) {
-            res.status(422).json({ error: "Image is empty" });
-            return;
-        }
-        const actor = getActorInfo(req);
-        const stored = await storage.putFile({
-            companyId,
-            namespace: `assets/${namespaceSuffix}`,
-            originalFilename: file.originalname || null,
-            contentType,
-            body: fileBody,
-        });
-        const asset = await svc.create(companyId, {
-            provider: stored.provider,
-            objectKey: stored.objectKey,
-            contentType: stored.contentType,
-            byteSize: stored.byteSize,
-            sha256: stored.sha256,
-            originalFilename: stored.originalFilename,
-            createdByAgentId: actor.agentId,
-            createdByUserId: actor.actorType === "user" ? actor.actorId : null,
-        });
-        await logActivity(db, {
-            companyId,
-            actorType: actor.actorType,
-            actorId: actor.actorId,
-            agentId: actor.agentId,
-            runId: actor.runId,
-            action: "asset.created",
-            entityType: "asset",
-            entityId: asset.id,
-            details: {
-                originalFilename: asset.originalFilename,
-                contentType: asset.contentType,
-                byteSize: asset.byteSize,
-            },
-        });
-        res.status(201).json({
-            assetId: asset.id,
-            companyId: asset.companyId,
-            provider: asset.provider,
-            objectKey: asset.objectKey,
-            contentType: asset.contentType,
-            byteSize: asset.byteSize,
-            sha256: asset.sha256,
-            originalFilename: asset.originalFilename,
-            createdByAgentId: asset.createdByAgentId,
-            createdByUserId: asset.createdByUserId,
-            createdAt: asset.createdAt,
-            updatedAt: asset.updatedAt,
-            contentPath: `/api/assets/${asset.id}/content`,
-        });
-    });
-    router.post("/companies/:companyId/logo", async (req, res) => {
-        const companyId = req.params.companyId;
-        assertCompanyAccess(req, companyId);
-        try {
-            await runSingleFileUpload(companyLogoUpload, req, res);
-        }
-        catch (err) {
-            if (err instanceof multer.MulterError) {
-                if (err.code === "LIMIT_FILE_SIZE") {
-                    res.status(422).json({ error: `Image exceeds ${MAX_ATTACHMENT_BYTES} bytes` });
-                    return;
-                }
-                res.status(400).json({ error: err.message });
-                return;
-            }
-            throw err;
-        }
-        const file = req.file;
-        if (!file) {
-            res.status(400).json({ error: "Missing file field 'file'" });
-            return;
-        }
-        const contentType = (file.mimetype || "").toLowerCase();
-        if (!ALLOWED_COMPANY_LOGO_CONTENT_TYPES.has(contentType)) {
-            res.status(422).json({ error: `Unsupported image type: ${contentType || "unknown"}` });
-            return;
-        }
-        let fileBody = file.buffer;
-        if (contentType === SVG_CONTENT_TYPE) {
-            const sanitized = sanitizeSvgBuffer(file.buffer);
-            if (!sanitized || sanitized.length <= 0) {
-                res.status(422).json({ error: "SVG could not be sanitized" });
-                return;
-            }
-            fileBody = sanitized;
-        }
-        if (fileBody.length <= 0) {
-            res.status(422).json({ error: "Image is empty" });
-            return;
-        }
-        const actor = getActorInfo(req);
-        const stored = await storage.putFile({
-            companyId,
-            namespace: "assets/companies",
-            originalFilename: file.originalname || null,
-            contentType,
-            body: fileBody,
-        });
-        const asset = await svc.create(companyId, {
-            provider: stored.provider,
-            objectKey: stored.objectKey,
-            contentType: stored.contentType,
-            byteSize: stored.byteSize,
-            sha256: stored.sha256,
-            originalFilename: stored.originalFilename,
-            createdByAgentId: actor.agentId,
-            createdByUserId: actor.actorType === "user" ? actor.actorId : null,
-        });
-        await logActivity(db, {
-            companyId,
-            actorType: actor.actorType,
-            actorId: actor.actorId,
-            agentId: actor.agentId,
-            runId: actor.runId,
-            action: "asset.created",
-            entityType: "asset",
-            entityId: asset.id,
-            details: {
-                originalFilename: asset.originalFilename,
-                contentType: asset.contentType,
-                byteSize: asset.byteSize,
-                namespace: "assets/companies",
-            },
-        });
-        res.status(201).json({
-            assetId: asset.id,
-            companyId: asset.companyId,
-            provider: asset.provider,
-            objectKey: asset.objectKey,
-            contentType: asset.contentType,
-            byteSize: asset.byteSize,
-            sha256: asset.sha256,
-            originalFilename: asset.originalFilename,
-            createdByAgentId: asset.createdByAgentId,
-            createdByUserId: asset.createdByUserId,
-            createdAt: asset.createdAt,
-            updatedAt: asset.updatedAt,
-            contentPath: `/api/assets/${asset.id}/content`,
-        });
-    });
-    router.get("/assets/:assetId/content", async (req, res, next) => {
-        const assetId = req.params.assetId;
-        const asset = await svc.getById(assetId);
-        if (!asset) {
-            res.status(404).json({ error: "Asset not found" });
-            return;
-        }
-        assertCompanyAccess(req, asset.companyId);
-        const object = await storage.getObject(asset.companyId, asset.objectKey);
-        const responseContentType = asset.contentType || object.contentType || "application/octet-stream";
-        res.setHeader("Content-Type", responseContentType);
-        res.setHeader("Content-Length", String(asset.byteSize || object.contentLength || 0));
-        res.setHeader("Cache-Control", "private, max-age=60");
-        res.setHeader("X-Content-Type-Options", "nosniff");
-        if (responseContentType === SVG_CONTENT_TYPE) {
-            res.setHeader("Content-Security-Policy", "sandbox; default-src 'none'; img-src 'self' data:; style-src 'unsafe-inline'");
-        }
-        const filename = asset.originalFilename ?? "asset";
-        res.setHeader("Content-Disposition", `inline; filename=\"${filename.replaceAll("\"", "")}\"`);
-        object.stream.on("error", (err) => {
-            next(err);
-        });
-        object.stream.pipe(res);
-    });
-    return router;
-}
-//# sourceMappingURL=assets.js.map

package/dist/runtime/server/dist/routes/assets.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"assets.js","sourceRoot":"","sources":["../../src/routes/assets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAA+B,MAAM,SAAS,CAAC;AAC9D,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,eAAe,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAE9B,OAAO,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AAErE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/D,MAAM,gBAAgB,GAAG,eAAe,CAAC;AACzC,MAAM,kCAAkC,GAAG,IAAI,GAAG,CAAC;IACjD,WAAW;IACX,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,WAAW;IACX,gBAAgB;CACjB,CAAC,CAAC;AAEH,SAAS,iBAAiB,CAAC,KAAa;IACtC,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,MAAM,OAAO,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC;IAC9B,MAAM,SAAS,GAAG,eAAe,CAC/B,OAAO,CAAC,MAA0D,CACnE,CAAC;IACF,SAAS,CAAC,OAAO,CAAC,uBAAuB,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAEhD,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;YACtB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,YAAY,CAAC,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAClG,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,SAAS,GAAiB,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE;YACxC,YAAY,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE;YAC1D,WAAW,EAAE,CAAC,QAAQ,EAAE,eAAe,CAAC;YACxC,eAAe,EAAE,CAAC,QAAQ,EAAE,eAAe,CAAC;YAC5C,mBAAmB,EAAE,KAAK;SAC3B,CAAC,CAAC;QAEH,SAAS,GAAG,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,eAAe,CAAC;QACtC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAE/D,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,CAAC,EAAE,CAAC;YAC5E,EAAE,CAAC,MAAM,EAAE,CAAC;QACd,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACxD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACzC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBACpC,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9B,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC9B,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,YAAY,CAAC,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBAClG,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAChC,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACxD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,SAAS,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAAM,EAAE,OAAuB;IACzD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,WAAW,GAAG,MAAM,CAAC;QACzB,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE;QAC/B,MAAM,EAAE,EAAE,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE;KACrD,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,MAAM,CAAC;QAC/B,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE;QAC/B,MAAM,EAAE,EAAE,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE;KACrD,CAAC,CAAC;IAEH,KAAK,UAAU,mBAAmB,CAChC,MAAiC,EACjC,GAAY,EACZ,GAAa;QAEb,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAY,EAAE,EAAE;gBAC/C,IAAI,GAAG;oBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;oBAChB,OAAO,EAAE,CAAC;YACjB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACpE,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,SAAmB,CAAC;QACjD,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAEpC,IAAI,CAAC;YACH,MAAM,mBAAmB,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,MAAM,CAAC,WAAW,EAAE,CAAC;gBACtC,IAAI,GAAG,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;oBACnC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,oBAAoB,QAAQ,EAAE,CAAC,CAAC;oBAC9E,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,MAAM,IAAI,GAAI,GAAuF,CAAC,IAAI,CAAC;QAC3G,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,8BAA8B,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5F,OAAO;QACT,CAAC;QAED,MAAM,eAAe,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC;QAC/D,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACxD,IAAI,WAAW,KAAK,gBAAgB,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,WAAW,IAAI,SAAS,EAAE,EAAE,CAAC,CAAC;YACtF,OAAO;QACT,CAAC;QACD,IAAI,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,WAAW,KAAK,gBAAgB,EAAE,CAAC;YACrC,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACjD,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YACD,QAAQ,GAAG,SAAS,CAAC;QACvB,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAClD,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;YACnC,SAAS;YACT,SAAS,EAAE,UAAU,eAAe,EAAE;YACtC,gBAAgB,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI;YAC3C,WAAW;YACX,IAAI,EAAE,QAAQ;SACf,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE;YACxC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,gBAAgB,EAAE,KAAK,CAAC,OAAO;YAC/B,eAAe,EAAE,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;SACnE,CAAC,CAAC;QAEH,MAAM,WAAW,CAAC,EAAE,EAAE;YACpB,SAAS;YACT,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,eAAe;YACvB,UAAU,EAAE,OAAO;YACnB,QAAQ,EAAE,KAAK,CAAC,EAAE;YAClB,OAAO,EAAE;gBACP,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;gBACxC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB;SACF,CAAC,CAAC;QAEH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,eAAe,KAAK,CAAC,EAAE,UAAU;SAC/C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC3D,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,SAAmB,CAAC;QACjD,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAEpC,IAAI,CAAC;YACH,MAAM,mBAAmB,CAAC,iBAAiB,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,MAAM,CAAC,WAAW,EAAE,CAAC;gBACtC,IAAI,GAAG,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;oBACnC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,oBAAoB,QAAQ,EAAE,CAAC,CAAC;oBAC/E,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,MAAM,IAAI,GAAI,GAAuF,CAAC,IAAI,CAAC;QAC3G,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACxD,IAAI,CAAC,kCAAkC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,WAAW,IAAI,SAAS,EAAE,EAAE,CAAC,CAAC;YACvF,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,WAAW,KAAK,gBAAgB,EAAE,CAAC;YACrC,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACjD,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YACD,QAAQ,GAAG,SAAS,CAAC;QACvB,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAClD,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;YACnC,SAAS;YACT,SAAS,EAAE,kBAAkB;YAC7B,gBAAgB,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI;YAC3C,WAAW;YACX,IAAI,EAAE,QAAQ;SACf,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE;YACxC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,gBAAgB,EAAE,KAAK,CAAC,OAAO;YAC/B,eAAe,EAAE,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;SACnE,CAAC,CAAC;QAEH,MAAM,WAAW,CAAC,EAAE,EAAE;YACpB,SAAS;YACT,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,eAAe;YACvB,UAAU,EAAE,OAAO;YACnB,QAAQ,EAAE,KAAK,CAAC,EAAE;YAClB,OAAO,EAAE;gBACP,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;gBACxC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,SAAS,EAAE,kBAAkB;aAC9B;SACF,CAAC,CAAC;QAEH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,eAAe,KAAK,CAAC,EAAE,UAAU;SAC/C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC9D,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,OAAiB,CAAC;QAC7C,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QACD,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACzE,MAAM,mBAAmB,GAAG,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,IAAI,0BAA0B,CAAC;QAClG,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC;QACnD,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC,CAAC;QACrF,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC;QACtD,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QACnD,IAAI,mBAAmB,KAAK,gBAAgB,EAAE,CAAC;YAC7C,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,8EAA8E,CAAC,CAAC;QAC3H,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,gBAAgB,IAAI,OAAO,CAAC;QACnD,GAAG,CAAC,SAAS,CAAC,qBAAqB,EAAE,sBAAsB,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QAE9F,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YAChC,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/runtime/server/dist/routes/authz.d.ts

@@ -1,15 +0,0 @@
-import type { Request } from "express";
-export declare function assertBoard(req: Request): void;
-export declare function assertCompanyAccess(req: Request, companyId: string): void;
-export declare function getActorInfo(req: Request): {
-    actorType: "agent";
-    actorId: string;
-    agentId: string | null;
-    runId: string | null;
-} | {
-    actorType: "user";
-    actorId: string;
-    agentId: null;
-    runId: string | null;
-};
-//# sourceMappingURL=authz.d.ts.map

package/dist/runtime/server/dist/routes/authz.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"authz.d.ts","sourceRoot":"","sources":["../../src/routes/authz.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAGvC,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,QAIvC;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,QAalE;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO;;;;;;;;;;EAmBxC"}

package/dist/runtime/server/dist/routes/authz.js

@@ -1,40 +0,0 @@
-import { forbidden, unauthorized } from "../errors.js";
-export function assertBoard(req) {
-    if (req.actor.type !== "board") {
-        throw forbidden("Board access required");
-    }
-}
-export function assertCompanyAccess(req, companyId) {
-    if (req.actor.type === "none") {
-        throw unauthorized();
-    }
-    if (req.actor.type === "agent" && req.actor.companyId !== companyId) {
-        throw forbidden("Agent key cannot access another company");
-    }
-    if (req.actor.type === "board" && req.actor.source !== "local_implicit" && !req.actor.isInstanceAdmin) {
-        const allowedCompanies = req.actor.companyIds ?? [];
-        if (!allowedCompanies.includes(companyId)) {
-            throw forbidden("User does not have access to this company");
-        }
-    }
-}
-export function getActorInfo(req) {
-    if (req.actor.type === "none") {
-        throw unauthorized();
-    }
-    if (req.actor.type === "agent") {
-        return {
-            actorType: "agent",
-            actorId: req.actor.agentId ?? "unknown-agent",
-            agentId: req.actor.agentId ?? null,
-            runId: req.actor.runId ?? null,
-        };
-    }
-    return {
-        actorType: "user",
-        actorId: req.actor.userId ?? "board",
-        agentId: null,
-        runId: req.actor.runId ?? null,
-    };
-}
-//# sourceMappingURL=authz.js.map

package/dist/runtime/server/dist/routes/authz.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"authz.js","sourceRoot":"","sources":["../../src/routes/authz.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEvD,MAAM,UAAU,WAAW,CAAC,GAAY;IACtC,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC/B,MAAM,SAAS,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAY,EAAE,SAAiB;IACjE,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC9B,MAAM,YAAY,EAAE,CAAC;IACvB,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACpE,MAAM,SAAS,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,gBAAgB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;QACtG,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC;QACpD,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,MAAM,SAAS,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC9B,MAAM,YAAY,EAAE,CAAC;IACvB,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC/B,OAAO;YACL,SAAS,EAAE,OAAgB;YAC3B,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,eAAe;YAC7C,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI;YAClC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI;SAC/B,CAAC;IACJ,CAAC;IAED,OAAO;QACL,SAAS,EAAE,MAAe;QAC1B,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,OAAO;QACpC,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI;KAC/B,CAAC;AACJ,CAAC"}

package/dist/runtime/server/dist/routes/companies.d.ts

@@ -1,3 +0,0 @@
-import type { Db } from "@paperclipai/db";
-export declare function companyRoutes(db: Db): import("express-serve-static-core").Router;
-//# sourceMappingURL=companies.d.ts.map

package/dist/runtime/server/dist/routes/companies.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"companies.d.ts","sourceRoot":"","sources":["../../src/routes/companies.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAqB1C,wBAAgB,aAAa,CAAC,EAAE,EAAE,EAAE,8CA4MnC"}

package/dist/runtime/server/dist/routes/companies.js

@@ -1,196 +0,0 @@
-import { Router } from "express";
-import { companyPortabilityExportSchema, companyPortabilityImportSchema, companyPortabilityPreviewSchema, createCompanySchema, updateCompanySchema, updateCompanyBrandingSchema, } from "@paperclipai/shared";
-import { forbidden } from "../errors.js";
-import { validate } from "../middleware/validate.js";
-import { accessService, agentService, budgetService, companyPortabilityService, companyService, logActivity, } from "../services/index.js";
-import { assertBoard, assertCompanyAccess, getActorInfo } from "./authz.js";
-export function companyRoutes(db) {
-    const router = Router();
-    const svc = companyService(db);
-    const portability = companyPortabilityService(db);
-    const access = accessService(db);
-    const budgets = budgetService(db);
-    router.get("/", async (req, res) => {
-        assertBoard(req);
-        const result = await svc.list();
-        if (req.actor.source === "local_implicit" || req.actor.isInstanceAdmin) {
-            res.json(result);
-            return;
-        }
-        const allowed = new Set(req.actor.companyIds ?? []);
-        res.json(result.filter((company) => allowed.has(company.id)));
-    });
-    router.get("/stats", async (req, res) => {
-        assertBoard(req);
-        const allowed = req.actor.source === "local_implicit" || req.actor.isInstanceAdmin
-            ? null
-            : new Set(req.actor.companyIds ?? []);
-        const stats = await svc.stats();
-        if (!allowed) {
-            res.json(stats);
-            return;
-        }
-        const filtered = Object.fromEntries(Object.entries(stats).filter(([companyId]) => allowed.has(companyId)));
-        res.json(filtered);
-    });
-    // Common malformed path when companyId is empty in "/api/companies/{companyId}/issues".
-    router.get("/issues", (_req, res) => {
-        res.status(400).json({
-            error: "Missing companyId in path. Use /api/companies/{companyId}/issues.",
-        });
-    });
-    router.get("/:companyId", async (req, res) => {
-        const companyId = req.params.companyId;
-        assertCompanyAccess(req, companyId);
-        // Allow agents (CEO) to read their own company; board always allowed
-        if (req.actor.type !== "agent") {
-            assertBoard(req);
-        }
-        const company = await svc.getById(companyId);
-        if (!company) {
-            res.status(404).json({ error: "Company not found" });
-            return;
-        }
-        res.json(company);
-    });
-    router.post("/:companyId/export", validate(companyPortabilityExportSchema), async (req, res) => {
-        const companyId = req.params.companyId;
-        assertCompanyAccess(req, companyId);
-        const result = await portability.exportBundle(companyId, req.body);
-        res.json(result);
-    });
-    router.post("/import/preview", validate(companyPortabilityPreviewSchema), async (req, res) => {
-        if (req.body.target.mode === "existing_company") {
-            assertCompanyAccess(req, req.body.target.companyId);
-        }
-        else {
-            assertBoard(req);
-        }
-        const preview = await portability.previewImport(req.body);
-        res.json(preview);
-    });
-    router.post("/import", validate(companyPortabilityImportSchema), async (req, res) => {
-        if (req.body.target.mode === "existing_company") {
-            assertCompanyAccess(req, req.body.target.companyId);
-        }
-        else {
-            assertBoard(req);
-        }
-        const actor = getActorInfo(req);
-        const result = await portability.importBundle(req.body, req.actor.type === "board" ? req.actor.userId : null);
-        await logActivity(db, {
-            companyId: result.company.id,
-            actorType: actor.actorType,
-            actorId: actor.actorId,
-            action: "company.imported",
-            entityType: "company",
-            entityId: result.company.id,
-            agentId: actor.agentId,
-            runId: actor.runId,
-            details: {
-                include: req.body.include ?? null,
-                agentCount: result.agents.length,
-                warningCount: result.warnings.length,
-                companyAction: result.company.action,
-            },
-        });
-        res.json(result);
-    });
-    router.post("/", validate(createCompanySchema), async (req, res) => {
-        assertBoard(req);
-        if (!(req.actor.source === "local_implicit" || req.actor.isInstanceAdmin)) {
-            throw forbidden("Instance admin required");
-        }
-        const company = await svc.create(req.body);
-        await access.ensureMembership(company.id, "user", req.actor.userId ?? "local-board", "owner", "active");
-        await logActivity(db, {
-            companyId: company.id,
-            actorType: "user",
-            actorId: req.actor.userId ?? "board",
-            action: "company.created",
-            entityType: "company",
-            entityId: company.id,
-            details: { name: company.name },
-        });
-        if (company.budgetMonthlyCents > 0) {
-            await budgets.upsertPolicy(company.id, {
-                scopeType: "company",
-                scopeId: company.id,
-                amount: company.budgetMonthlyCents,
-                windowKind: "calendar_month_utc",
-            }, req.actor.userId ?? "board");
-        }
-        res.status(201).json(company);
-    });
-    router.patch("/:companyId", async (req, res) => {
-        const companyId = req.params.companyId;
-        assertCompanyAccess(req, companyId);
-        const actor = getActorInfo(req);
-        let body;
-        if (req.actor.type === "agent") {
-            // Only CEO agents may update company branding fields
-            const agentSvc = agentService(db);
-            const actorAgent = req.actor.agentId ? await agentSvc.getById(req.actor.agentId) : null;
-            if (!actorAgent || actorAgent.role !== "ceo") {
-                throw forbidden("Only CEO agents or board users may update company settings");
-            }
-            if (actorAgent.companyId !== companyId) {
-                throw forbidden("Agent key cannot access another company");
-            }
-            body = updateCompanyBrandingSchema.parse(req.body);
-        }
-        else {
-            assertBoard(req);
-            body = updateCompanySchema.parse(req.body);
-        }
-        const company = await svc.update(companyId, body);
-        if (!company) {
-            res.status(404).json({ error: "Company not found" });
-            return;
-        }
-        await logActivity(db, {
-            companyId,
-            actorType: actor.actorType,
-            actorId: actor.actorId,
-            agentId: actor.agentId,
-            runId: actor.runId,
-            action: "company.updated",
-            entityType: "company",
-            entityId: companyId,
-            details: body,
-        });
-        res.json(company);
-    });
-    router.post("/:companyId/archive", async (req, res) => {
-        assertBoard(req);
-        const companyId = req.params.companyId;
-        assertCompanyAccess(req, companyId);
-        const company = await svc.archive(companyId);
-        if (!company) {
-            res.status(404).json({ error: "Company not found" });
-            return;
-        }
-        await logActivity(db, {
-            companyId,
-            actorType: "user",
-            actorId: req.actor.userId ?? "board",
-            action: "company.archived",
-            entityType: "company",
-            entityId: companyId,
-        });
-        res.json(company);
-    });
-    router.delete("/:companyId", async (req, res) => {
-        assertBoard(req);
-        const companyId = req.params.companyId;
-        assertCompanyAccess(req, companyId);
-        const company = await svc.remove(companyId);
-        if (!company) {
-            res.status(404).json({ error: "Company not found" });
-            return;
-        }
-        res.json({ ok: true });
-    });
-    return router;
-}
-//# sourceMappingURL=companies.js.map

package/dist/runtime/server/dist/routes/companies.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"companies.js","sourceRoot":"","sources":["../../src/routes/companies.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,+BAA+B,EAC/B,mBAAmB,EACnB,mBAAmB,EACnB,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EACL,aAAa,EACb,YAAY,EACZ,aAAa,EACb,yBAAyB,EACzB,cAAc,EACd,WAAW,GACZ,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE5E,MAAM,UAAU,aAAa,CAAC,EAAM;IAClC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;IAC/B,MAAM,WAAW,GAAG,yBAAyB,CAAC,EAAE,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;IAElC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACjC,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,gBAAgB,IAAI,GAAG,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;YACvE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACjB,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACpD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtC,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,gBAAgB,IAAI,GAAG,CAAC,KAAK,CAAC,eAAe;YAChF,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;QAChC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC3G,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,wFAAwF;IACxF,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAClC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,mEAAmE;SAC3E,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC3C,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,SAAmB,CAAC;QACjD,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpC,qEAAqE;QACrE,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC/B,WAAW,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,8BAA8B,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7F,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,SAAmB,CAAC;QACjD,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACnE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC,+BAA+B,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC3F,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YAChD,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtD,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1D,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,8BAA8B,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClF,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YAChD,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtD,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC9G,MAAM,WAAW,CAAC,EAAE,EAAE;YACpB,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE;YAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,kBAAkB;YAC1B,UAAU,EAAE,SAAS;YACrB,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE;YAC3B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,OAAO,EAAE;gBACP,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI;gBACjC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;gBAChC,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;gBACpC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;aACrC;SACF,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACjE,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,gBAAgB,IAAI,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;YAC1E,MAAM,SAAS,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,aAAa,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACxG,MAAM,WAAW,CAAC,EAAE,EAAE;YACpB,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,OAAO;YACpC,MAAM,EAAE,iBAAiB;YACzB,UAAU,EAAE,SAAS;YACrB,QAAQ,EAAE,OAAO,CAAC,EAAE;YACpB,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;SAChC,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,kBAAkB,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,OAAO,CAAC,YAAY,CACxB,OAAO,CAAC,EAAE,EACV;gBACE,SAAS,EAAE,SAAS;gBACpB,OAAO,EAAE,OAAO,CAAC,EAAE;gBACnB,MAAM,EAAE,OAAO,CAAC,kBAAkB;gBAClC,UAAU,EAAE,oBAAoB;aACjC,EACD,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,OAAO,CAC5B,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,SAAmB,CAAC;QACjD,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAEpC,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,IAA6B,CAAC;QAElC,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC/B,qDAAqD;YACrD,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;YAClC,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACxF,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;gBAC7C,MAAM,SAAS,CAAC,4DAA4D,CAAC,CAAC;YAChF,CAAC;YACD,IAAI,UAAU,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACvC,MAAM,SAAS,CAAC,yCAAyC,CAAC,CAAC;YAC7D,CAAC;YACD,IAAI,GAAG,2BAA2B,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrD,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,GAAG,CAAC,CAAC;YACjB,IAAI,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,MAAM,WAAW,CAAC,EAAE,EAAE;YACpB,SAAS;YACT,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,iBAAiB;YACzB,UAAU,EAAE,SAAS;YACrB,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACpD,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,SAAmB,CAAC;QACjD,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,MAAM,WAAW,CAAC,EAAE,EAAE;YACpB,SAAS;YACT,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,OAAO;YACpC,MAAM,EAAE,kBAAkB;YAC1B,UAAU,EAAE,SAAS;YACrB,QAAQ,EAAE,SAAS;SACpB,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9C,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,SAAmB,CAAC;QACjD,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/runtime/server/dist/routes/costs.d.ts

@@ -1,3 +0,0 @@
-import type { Db } from "@paperclipai/db";
-export declare function costRoutes(db: Db): import("express-serve-static-core").Router;
-//# sourceMappingURL=costs.d.ts.map

package/dist/runtime/server/dist/routes/costs.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"costs.d.ts","sourceRoot":"","sources":["../../src/routes/costs.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAsB1C,wBAAgB,UAAU,CAAC,EAAE,EAAE,EAAE,8CAsThC"}