@growthub/cli 0.3.13 → 0.3.15

package/dist/runtime/server/dist/log-redaction.js

@@ -0,0 +1,110 @@
+import os from "node:os";
+export const CURRENT_USER_REDACTION_TOKEN = "[]";
+function isPlainObject(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return false;
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function uniqueNonEmpty(values) {
+    return Array.from(new Set(values.map((value) => value?.trim() ?? "").filter(Boolean)));
+}
+function splitPathSegments(value) {
+    return value.replace(/[\\/]+$/, "").split(/[\\/]+/).filter(Boolean);
+}
+function replaceLastPathSegment(pathValue, replacement) {
+    const normalized = pathValue.replace(/[\\/]+$/, "");
+    const lastSeparator = Math.max(normalized.lastIndexOf("/"), normalized.lastIndexOf("\\"));
+    if (lastSeparator < 0)
+        return replacement;
+    return `${normalized.slice(0, lastSeparator + 1)}${replacement}`;
+}
+function defaultUserNames() {
+    const candidates = [
+        process.env.USER,
+        process.env.LOGNAME,
+        process.env.USERNAME,
+    ];
+    try {
+        candidates.push(os.userInfo().username);
+    }
+    catch {
+        // Some environments do not expose userInfo; env vars are enough fallback.
+    }
+    return uniqueNonEmpty(candidates);
+}
+function defaultHomeDirs(userNames) {
+    const candidates = [
+        process.env.HOME,
+        process.env.USERPROFILE,
+    ];
+    try {
+        candidates.push(os.homedir());
+    }
+    catch {
+        // Ignore and fall back to env hints below.
+    }
+    for (const userName of userNames) {
+        candidates.push(`/Users/${userName}`);
+        candidates.push(`/home/${userName}`);
+        candidates.push(`C:\\Users\\${userName}`);
+    }
+    return uniqueNonEmpty(candidates);
+}
+let cachedCurrentUserCandidates = null;
+function getDefaultCurrentUserCandidates() {
+    if (cachedCurrentUserCandidates)
+        return cachedCurrentUserCandidates;
+    const userNames = defaultUserNames();
+    cachedCurrentUserCandidates = {
+        userNames,
+        homeDirs: defaultHomeDirs(userNames),
+        replacement: CURRENT_USER_REDACTION_TOKEN,
+    };
+    return cachedCurrentUserCandidates;
+}
+function resolveCurrentUserCandidates(opts) {
+    const defaults = getDefaultCurrentUserCandidates();
+    const userNames = uniqueNonEmpty(opts?.userNames ?? defaults.userNames);
+    const homeDirs = uniqueNonEmpty(opts?.homeDirs ?? defaults.homeDirs);
+    const replacement = opts?.replacement?.trim() || defaults.replacement;
+    return { userNames, homeDirs, replacement };
+}
+export function redactCurrentUserText(input, opts) {
+    if (!input)
+        return input;
+    const { userNames, homeDirs, replacement } = resolveCurrentUserCandidates(opts);
+    let result = input;
+    for (const homeDir of [...homeDirs].sort((a, b) => b.length - a.length)) {
+        const lastSegment = splitPathSegments(homeDir).pop() ?? "";
+        const replacementDir = userNames.includes(lastSegment)
+            ? replaceLastPathSegment(homeDir, replacement)
+            : replacement;
+        result = result.split(homeDir).join(replacementDir);
+    }
+    for (const userName of [...userNames].sort((a, b) => b.length - a.length)) {
+        const pattern = new RegExp(`(?<![A-Za-z0-9._-])${escapeRegExp(userName)}(?![A-Za-z0-9._-])`, "g");
+        result = result.replace(pattern, replacement);
+    }
+    return result;
+}
+export function redactCurrentUserValue(value, opts) {
+    if (typeof value === "string") {
+        return redactCurrentUserText(value, opts);
+    }
+    if (Array.isArray(value)) {
+        return value.map((entry) => redactCurrentUserValue(entry, opts));
+    }
+    if (!isPlainObject(value)) {
+        return value;
+    }
+    const redacted = {};
+    for (const [key, entry] of Object.entries(value)) {
+        redacted[key] = redactCurrentUserValue(entry, opts);
+    }
+    return redacted;
+}
+//# sourceMappingURL=log-redaction.js.map

package/dist/runtime/server/dist/log-redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log-redaction.js","sourceRoot":"","sources":["../src/log-redaction.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAC;AAcjD,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3C,OAAO,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC;AACtD,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,cAAc,CAAC,MAAwC;IAC9D,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACzF,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,sBAAsB,CAAC,SAAiB,EAAE,WAAmB;IACpE,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACpD,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1F,IAAI,aAAa,GAAG,CAAC;QAAE,OAAO,WAAW,CAAC;IAC1C,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,GAAG,CAAC,CAAC,GAAG,WAAW,EAAE,CAAC;AACnE,CAAC;AAED,SAAS,gBAAgB;IACvB,MAAM,UAAU,GAAG;QACjB,OAAO,CAAC,GAAG,CAAC,IAAI;QAChB,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,OAAO,CAAC,GAAG,CAAC,QAAQ;KACrB,CAAC;IAEF,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;IAED,OAAO,cAAc,CAAC,UAAU,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,eAAe,CAAC,SAAmB;IAC1C,MAAM,UAAU,GAAqC;QACnD,OAAO,CAAC,GAAG,CAAC,IAAI;QAChB,OAAO,CAAC,GAAG,CAAC,WAAW;KACxB,CAAC;IAEF,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,2CAA2C;IAC7C,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,UAAU,CAAC,IAAI,CAAC,UAAU,QAAQ,EAAE,CAAC,CAAC;QACtC,UAAU,CAAC,IAAI,CAAC,SAAS,QAAQ,EAAE,CAAC,CAAC;QACrC,UAAU,CAAC,IAAI,CAAC,cAAc,QAAQ,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,cAAc,CAAC,UAAU,CAAC,CAAC;AACpC,CAAC;AAED,IAAI,2BAA2B,GAAiC,IAAI,CAAC;AAErE,SAAS,+BAA+B;IACtC,IAAI,2BAA2B;QAAE,OAAO,2BAA2B,CAAC;IACpE,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;IACrC,2BAA2B,GAAG;QAC5B,SAAS;QACT,QAAQ,EAAE,eAAe,CAAC,SAAS,CAAC;QACpC,WAAW,EAAE,4BAA4B;KAC1C,CAAC;IACF,OAAO,2BAA2B,CAAC;AACrC,CAAC;AAED,SAAS,4BAA4B,CAAC,IAAkC;IACtE,MAAM,QAAQ,GAAG,+BAA+B,EAAE,CAAC;IACnD,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,EAAE,SAAS,IAAI,QAAQ,CAAC,SAAS,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,WAAW,CAAC;IACtE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,IAAkC;IACrF,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAEzB,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;IAChF,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,KAAK,MAAM,OAAO,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QACxE,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QAC3D,MAAM,cAAc,GAAG,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;YACpD,CAAC,CAAC,sBAAsB,CAAC,OAAO,EAAE,WAAW,CAAC;YAC9C,CAAC,CAAC,WAAW,CAAC;QAChB,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1E,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,sBAAsB,YAAY,CAAC,QAAQ,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;QAClG,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAI,KAAQ,EAAE,IAAkC;IACpF,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,qBAAqB,CAAC,KAAK,EAAE,IAAI,CAAM,CAAC;IACjD,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAM,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,QAAQ,CAAC,GAAG,CAAC,GAAG,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,QAAa,CAAC;AACvB,CAAC"}

package/dist/runtime/server/dist/middleware/auth.d.ts

@@ -0,0 +1,12 @@
+import type { Request, RequestHandler } from "express";
+import type { Db } from "@paperclipai/db";
+import type { DeploymentMode } from "@paperclipai/shared";
+import type { BetterAuthSessionResult } from "../auth/better-auth.js";
+interface ActorMiddlewareOptions {
+    deploymentMode: DeploymentMode;
+    resolveSession?: (req: Request) => Promise<BetterAuthSessionResult | null>;
+}
+export declare function actorMiddleware(db: Db, opts: ActorMiddlewareOptions): RequestHandler;
+export declare function requireBoard(req: Express.Request): boolean;
+export {};
+//# sourceMappingURL=auth.d.ts.map

package/dist/runtime/server/dist/middleware/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEvD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAG1C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAOtE,UAAU,sBAAsB;IAC9B,cAAc,EAAE,cAAc,CAAC;IAC/B,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;CAC5E;AAED,wBAAgB,eAAe,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,sBAAsB,GAAG,cAAc,CAoIpF;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,WAEhD"}

package/dist/runtime/server/dist/middleware/auth.js

@@ -0,0 +1,124 @@
+import { createHash } from "node:crypto";
+import { and, eq, isNull } from "drizzle-orm";
+import { agentApiKeys, agents, companyMemberships, instanceUserRoles } from "@paperclipai/db";
+import { verifyLocalAgentJwt } from "../agent-auth-jwt.js";
+import { logger } from "./logger.js";
+function hashToken(token) {
+    return createHash("sha256").update(token).digest("hex");
+}
+export function actorMiddleware(db, opts) {
+    return async (req, _res, next) => {
+        req.actor =
+            opts.deploymentMode === "local_trusted"
+                ? { type: "board", userId: "local-board", isInstanceAdmin: true, source: "local_implicit" }
+                : { type: "none", source: "none" };
+        const runIdHeader = req.header("x-paperclip-run-id");
+        const authHeader = req.header("authorization");
+        if (!authHeader?.toLowerCase().startsWith("bearer ")) {
+            if (opts.deploymentMode === "authenticated" && opts.resolveSession) {
+                let session = null;
+                try {
+                    session = await opts.resolveSession(req);
+                }
+                catch (err) {
+                    logger.warn({ err, method: req.method, url: req.originalUrl }, "Failed to resolve auth session from request headers");
+                }
+                if (session?.user?.id) {
+                    const userId = session.user.id;
+                    const [roleRow, memberships] = await Promise.all([
+                        db
+                            .select({ id: instanceUserRoles.id })
+                            .from(instanceUserRoles)
+                            .where(and(eq(instanceUserRoles.userId, userId), eq(instanceUserRoles.role, "instance_admin")))
+                            .then((rows) => rows[0] ?? null),
+                        db
+                            .select({ companyId: companyMemberships.companyId })
+                            .from(companyMemberships)
+                            .where(and(eq(companyMemberships.principalType, "user"), eq(companyMemberships.principalId, userId), eq(companyMemberships.status, "active"))),
+                    ]);
+                    req.actor = {
+                        type: "board",
+                        userId,
+                        companyIds: memberships.map((row) => row.companyId),
+                        isInstanceAdmin: Boolean(roleRow),
+                        runId: runIdHeader ?? undefined,
+                        source: "session",
+                    };
+                    next();
+                    return;
+                }
+            }
+            if (runIdHeader)
+                req.actor.runId = runIdHeader;
+            next();
+            return;
+        }
+        const token = authHeader.slice("bearer ".length).trim();
+        if (!token) {
+            next();
+            return;
+        }
+        const tokenHash = hashToken(token);
+        const key = await db
+            .select()
+            .from(agentApiKeys)
+            .where(and(eq(agentApiKeys.keyHash, tokenHash), isNull(agentApiKeys.revokedAt)))
+            .then((rows) => rows[0] ?? null);
+        if (!key) {
+            const claims = verifyLocalAgentJwt(token);
+            if (!claims) {
+                next();
+                return;
+            }
+            const agentRecord = await db
+                .select()
+                .from(agents)
+                .where(eq(agents.id, claims.sub))
+                .then((rows) => rows[0] ?? null);
+            if (!agentRecord || agentRecord.companyId !== claims.company_id) {
+                next();
+                return;
+            }
+            if (agentRecord.status === "terminated" || agentRecord.status === "pending_approval") {
+                next();
+                return;
+            }
+            req.actor = {
+                type: "agent",
+                agentId: claims.sub,
+                companyId: claims.company_id,
+                keyId: undefined,
+                runId: runIdHeader || claims.run_id || undefined,
+                source: "agent_jwt",
+            };
+            next();
+            return;
+        }
+        await db
+            .update(agentApiKeys)
+            .set({ lastUsedAt: new Date() })
+            .where(eq(agentApiKeys.id, key.id));
+        const agentRecord = await db
+            .select()
+            .from(agents)
+            .where(eq(agents.id, key.agentId))
+            .then((rows) => rows[0] ?? null);
+        if (!agentRecord || agentRecord.status === "terminated" || agentRecord.status === "pending_approval") {
+            next();
+            return;
+        }
+        req.actor = {
+            type: "agent",
+            agentId: key.agentId,
+            companyId: key.companyId,
+            keyId: key.id,
+            runId: runIdHeader || undefined,
+            source: "agent_key",
+        };
+        next();
+    };
+}
+export function requireBoard(req) {
+    return req.actor.type === "board";
+}
+//# sourceMappingURL=auth.js.map

package/dist/runtime/server/dist/middleware/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAC9F,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAG3D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAOD,MAAM,UAAU,eAAe,CAAC,EAAM,EAAE,IAA4B;IAClE,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QAC/B,GAAG,CAAC,KAAK;YACP,IAAI,CAAC,cAAc,KAAK,eAAe;gBACrC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE;gBAC3F,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAEvC,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAErD,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACrD,IAAI,IAAI,CAAC,cAAc,KAAK,eAAe,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBACnE,IAAI,OAAO,GAAmC,IAAI,CAAC;gBACnD,IAAI,CAAC;oBACH,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;gBAC3C,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,CAAC,IAAI,CACT,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE,EACjD,qDAAqD,CACtD,CAAC;gBACJ,CAAC;gBACD,IAAI,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;oBACtB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/B,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;wBAC/C,EAAE;6BACC,MAAM,CAAC,EAAE,EAAE,EAAE,iBAAiB,CAAC,EAAE,EAAE,CAAC;6BACpC,IAAI,CAAC,iBAAiB,CAAC;6BACvB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC;6BAC9F,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;wBAClC,EAAE;6BACC,MAAM,CAAC,EAAE,SAAS,EAAE,kBAAkB,CAAC,SAAS,EAAE,CAAC;6BACnD,IAAI,CAAC,kBAAkB,CAAC;6BACxB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,kBAAkB,CAAC,aAAa,EAAE,MAAM,CAAC,EAC5C,EAAE,CAAC,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC,EAC1C,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,QAAQ,CAAC,CACxC,CACF;qBACJ,CAAC,CAAC;oBACH,GAAG,CAAC,KAAK,GAAG;wBACV,IAAI,EAAE,OAAO;wBACb,MAAM;wBACN,UAAU,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC;wBACnD,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC;wBACjC,KAAK,EAAE,WAAW,IAAI,SAAS;wBAC/B,MAAM,EAAE,SAAS;qBAClB,CAAC;oBACF,IAAI,EAAE,CAAC;oBACP,OAAO;gBACT,CAAC;YACH,CAAC;YACD,IAAI,WAAW;gBAAE,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,WAAW,CAAC;YAC/C,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,MAAM,EAAE;aACjB,MAAM,EAAE;aACR,IAAI,CAAC,YAAY,CAAC;aAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;aAC/E,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;QAEnC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,EAAE;iBACzB,MAAM,EAAE;iBACR,IAAI,CAAC,MAAM,CAAC;iBACZ,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;iBAChC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YAEnC,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,SAAS,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;gBAChE,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YAED,IAAI,WAAW,CAAC,MAAM,KAAK,YAAY,IAAI,WAAW,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;gBACrF,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YAED,GAAG,CAAC,KAAK,GAAG;gBACV,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,MAAM,CAAC,GAAG;gBACnB,SAAS,EAAE,MAAM,CAAC,UAAU;gBAC5B,KAAK,EAAE,SAAS;gBAChB,KAAK,EAAE,WAAW,IAAI,MAAM,CAAC,MAAM,IAAI,SAAS;gBAChD,MAAM,EAAE,WAAW;aACpB,CAAC;YACF,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,EAAE;aACL,MAAM,CAAC,YAAY,CAAC;aACpB,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC/B,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAEtC,MAAM,WAAW,GAAG,MAAM,EAAE;aACzB,MAAM,EAAE;aACR,IAAI,CAAC,MAAM,CAAC;aACZ,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;aACjC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;QAEnC,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,YAAY,IAAI,WAAW,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;YACrG,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,GAAG,CAAC,KAAK,GAAG;YACV,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,KAAK,EAAE,GAAG,CAAC,EAAE;YACb,KAAK,EAAE,WAAW,IAAI,SAAS;YAC/B,MAAM,EAAE,WAAW;SACpB,CAAC;QAEF,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAoB;IAC/C,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC;AACpC,CAAC"}

package/dist/runtime/server/dist/middleware/board-mutation-guard.d.ts

@@ -0,0 +1,3 @@
+import type { RequestHandler } from "express";
+export declare function boardMutationGuard(): RequestHandler;
+//# sourceMappingURL=board-mutation-guard.d.ts.map

package/dist/runtime/server/dist/middleware/board-mutation-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"board-mutation-guard.d.ts","sourceRoot":"","sources":["../../src/middleware/board-mutation-guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,cAAc,EAAE,MAAM,SAAS,CAAC;AAuCvD,wBAAgB,kBAAkB,IAAI,cAAc,CA2BnD"}

package/dist/runtime/server/dist/middleware/board-mutation-guard.js

@@ -0,0 +1,60 @@
+const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
+const DEFAULT_DEV_ORIGINS = [
+    "http://localhost:3100",
+    "http://127.0.0.1:3100",
+];
+function parseOrigin(value) {
+    if (!value)
+        return null;
+    try {
+        const url = new URL(value);
+        return `${url.protocol}//${url.host}`.toLowerCase();
+    }
+    catch {
+        return null;
+    }
+}
+function trustedOriginsForRequest(req) {
+    const origins = new Set(DEFAULT_DEV_ORIGINS.map((value) => value.toLowerCase()));
+    const host = req.header("host")?.trim();
+    if (host) {
+        origins.add(`http://${host}`.toLowerCase());
+        origins.add(`https://${host}`.toLowerCase());
+    }
+    return origins;
+}
+function isTrustedBoardMutationRequest(req) {
+    const allowedOrigins = trustedOriginsForRequest(req);
+    const origin = parseOrigin(req.header("origin"));
+    if (origin && allowedOrigins.has(origin))
+        return true;
+    const refererOrigin = parseOrigin(req.header("referer"));
+    if (refererOrigin && allowedOrigins.has(refererOrigin))
+        return true;
+    return false;
+}
+export function boardMutationGuard() {
+    return (req, res, next) => {
+        if (SAFE_METHODS.has(req.method.toUpperCase())) {
+            next();
+            return;
+        }
+        if (req.actor.type !== "board") {
+            next();
+            return;
+        }
+        // Local-trusted mode uses an implicit board actor for localhost-only development.
+        // In this mode, origin/referer headers can be omitted by some clients for multipart
+        // uploads; do not block those mutations.
+        if (req.actor.source === "local_implicit") {
+            next();
+            return;
+        }
+        if (!isTrustedBoardMutationRequest(req)) {
+            res.status(403).json({ error: "Board mutation requires trusted browser origin" });
+            return;
+        }
+        next();
+    };
+}
+//# sourceMappingURL=board-mutation-guard.js.map

package/dist/runtime/server/dist/middleware/board-mutation-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"board-mutation-guard.js","sourceRoot":"","sources":["../../src/middleware/board-mutation-guard.ts"],"names":[],"mappings":"AAEA,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AACzD,MAAM,mBAAmB,GAAG;IAC1B,uBAAuB;IACvB,uBAAuB;CACxB,CAAC;AAEF,SAAS,WAAW,CAAC,KAAyB;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,GAAY;IAC5C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACjF,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;IACxC,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,6BAA6B,CAAC,GAAY;IACjD,MAAM,cAAc,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjD,IAAI,MAAM,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtD,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IACzD,IAAI,aAAa,IAAI,cAAc,CAAC,GAAG,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC/C,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC/B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,kFAAkF;QAClF,oFAAoF;QACpF,yCAAyC;QACzC,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;YAC1C,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/runtime/server/dist/middleware/error-handler.d.ts

@@ -0,0 +1,17 @@
+import type { Request, Response, NextFunction } from "express";
+export interface ErrorContext {
+    error: {
+        message: string;
+        stack?: string;
+        name?: string;
+        details?: unknown;
+        raw?: unknown;
+    };
+    method: string;
+    url: string;
+    reqBody?: unknown;
+    reqParams?: unknown;
+    reqQuery?: unknown;
+}
+export declare function errorHandler(err: unknown, req: Request, res: Response, _next: NextFunction): void;
+//# sourceMappingURL=error-handler.d.ts.map

package/dist/runtime/server/dist/middleware/error-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-handler.d.ts","sourceRoot":"","sources":["../../src/middleware/error-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAI/D,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,GAAG,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC5F,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAqBD,wBAAgB,YAAY,CAC1B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,KAAK,EAAE,YAAY,QAkCpB"}

package/dist/runtime/server/dist/middleware/error-handler.js

@@ -0,0 +1,37 @@
+import { ZodError } from "zod";
+import { HttpError } from "../errors.js";
+function attachErrorContext(req, res, payload, rawError) {
+    res.__errorContext = {
+        error: payload,
+        method: req.method,
+        url: req.originalUrl,
+        reqBody: req.body,
+        reqParams: req.params,
+        reqQuery: req.query,
+    };
+    if (rawError) {
+        res.err = rawError;
+    }
+}
+export function errorHandler(err, req, res, _next) {
+    if (err instanceof HttpError) {
+        if (err.status >= 500) {
+            attachErrorContext(req, res, { message: err.message, stack: err.stack, name: err.name, details: err.details }, err);
+        }
+        res.status(err.status).json({
+            error: err.message,
+            ...(err.details ? { details: err.details } : {}),
+        });
+        return;
+    }
+    if (err instanceof ZodError) {
+        res.status(400).json({ error: "Validation error", details: err.errors });
+        return;
+    }
+    const rootError = err instanceof Error ? err : new Error(String(err));
+    attachErrorContext(req, res, err instanceof Error
+        ? { message: err.message, stack: err.stack, name: err.name }
+        : { message: String(err), raw: err, stack: rootError.stack, name: rootError.name }, rootError);
+    res.status(500).json({ error: "Internal server error" });
+}
+//# sourceMappingURL=error-handler.js.map

package/dist/runtime/server/dist/middleware/error-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-handler.js","sourceRoot":"","sources":["../../src/middleware/error-handler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAWzC,SAAS,kBAAkB,CACzB,GAAY,EACZ,GAAa,EACb,OAA8B,EAC9B,QAAgB;IAEf,GAAW,CAAC,cAAc,GAAG;QAC5B,KAAK,EAAE,OAAO;QACd,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,GAAG,EAAE,GAAG,CAAC,WAAW;QACpB,OAAO,EAAE,GAAG,CAAC,IAAI;QACjB,SAAS,EAAE,GAAG,CAAC,MAAM;QACrB,QAAQ,EAAE,GAAG,CAAC,KAAK;KACG,CAAC;IACzB,IAAI,QAAQ,EAAE,CAAC;QACZ,GAAW,CAAC,GAAG,GAAG,QAAQ,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,GAAY,EACZ,GAAY,EACZ,GAAa,EACb,KAAmB;IAEnB,IAAI,GAAG,YAAY,SAAS,EAAE,CAAC;QAC7B,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YACtB,kBAAkB,CAChB,GAAG,EACH,GAAG,EACH,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAChF,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;YAC1B,KAAK,EAAE,GAAG,CAAC,OAAO;YAClB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;QAC5B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACzE,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACtE,kBAAkB,CAChB,GAAG,EACH,GAAG,EACH,GAAG,YAAY,KAAK;QAClB,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;QAC5D,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,EACpF,SAAS,CACV,CAAC;IAEF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;AAC3D,CAAC"}

package/dist/runtime/server/dist/middleware/index.d.ts

@@ -0,0 +1,4 @@
+export { logger, httpLogger } from "./logger.js";
+export { errorHandler } from "./error-handler.js";
+export { validate } from "./validate.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/runtime/server/dist/middleware/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC"}

package/dist/runtime/server/dist/middleware/index.js

@@ -0,0 +1,4 @@
+export { logger, httpLogger } from "./logger.js";
+export { errorHandler } from "./error-handler.js";
+export { validate } from "./validate.js";
+//# sourceMappingURL=index.js.map

package/dist/runtime/server/dist/middleware/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC"}

package/dist/runtime/server/dist/middleware/logger.d.ts

@@ -0,0 +1,4 @@
+import pino from "pino";
+export declare const logger: pino.Logger<never, boolean>;
+export declare const httpLogger: import("pino-http").HttpLogger<import("http").IncomingMessage, import("http").ServerResponse<import("http").IncomingMessage>, never>;
+//# sourceMappingURL=logger.d.ts.map

package/dist/runtime/server/dist/middleware/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/middleware/logger.ts"],"names":[],"mappings":"AAEA,OAAO,IAAI,MAAM,MAAM,CAAC;AA0BxB,eAAO,MAAM,MAAM,6BAehB,CAAC;AAEJ,eAAO,MAAM,UAAU,sIA4CrB,CAAC"}

package/dist/runtime/server/dist/middleware/logger.js

@@ -0,0 +1,87 @@
+import path from "node:path";
+import fs from "node:fs";
+import pino from "pino";
+import { pinoHttp } from "pino-http";
+import { readConfigFile } from "../config-file.js";
+import { resolveDefaultLogsDir, resolveHomeAwarePath } from "../home-paths.js";
+function resolveServerLogDir() {
+    const envOverride = process.env.PAPERCLIP_LOG_DIR?.trim();
+    if (envOverride)
+        return resolveHomeAwarePath(envOverride);
+    const fileLogDir = readConfigFile()?.logging.logDir?.trim();
+    if (fileLogDir)
+        return resolveHomeAwarePath(fileLogDir);
+    return resolveDefaultLogsDir();
+}
+const logDir = resolveServerLogDir();
+fs.mkdirSync(logDir, { recursive: true });
+const logFile = path.join(logDir, "server.log");
+const sharedOpts = {
+    translateTime: "HH:MM:ss",
+    ignore: "pid,hostname",
+    singleLine: true,
+};
+export const logger = pino({
+    level: "debug",
+}, pino.transport({
+    targets: [
+        {
+            target: "pino-pretty",
+            options: { ...sharedOpts, ignore: "pid,hostname,req,res,responseTime", colorize: true, destination: 1 },
+            level: "info",
+        },
+        {
+            target: "pino-pretty",
+            options: { ...sharedOpts, colorize: false, destination: logFile, mkdir: true },
+            level: "debug",
+        },
+    ],
+}));
+export const httpLogger = pinoHttp({
+    logger,
+    customLogLevel(_req, res, err) {
+        if (err || res.statusCode >= 500)
+            return "error";
+        if (res.statusCode >= 400)
+            return "warn";
+        return "info";
+    },
+    customSuccessMessage(req, res) {
+        return `${req.method} ${req.url} ${res.statusCode}`;
+    },
+    customErrorMessage(req, res, err) {
+        const ctx = res.__errorContext;
+        const errMsg = ctx?.error?.message || err?.message || res.err?.message || "unknown error";
+        return `${req.method} ${req.url} ${res.statusCode} — ${errMsg}`;
+    },
+    customProps(req, res) {
+        if (res.statusCode >= 400) {
+            const ctx = res.__errorContext;
+            if (ctx) {
+                return {
+                    errorContext: ctx.error,
+                    reqBody: ctx.reqBody,
+                    reqParams: ctx.reqParams,
+                    reqQuery: ctx.reqQuery,
+                };
+            }
+            const props = {};
+            const { body, params, query } = req;
+            if (body && typeof body === "object" && Object.keys(body).length > 0) {
+                props.reqBody = body;
+            }
+            if (params && typeof params === "object" && Object.keys(params).length > 0) {
+                props.reqParams = params;
+            }
+            if (query && typeof query === "object" && Object.keys(query).length > 0) {
+                props.reqQuery = query;
+            }
+            if (req.route?.path) {
+                props.routePath = req.route.path;
+            }
+            return props;
+        }
+        return {};
+    },
+});
+//# sourceMappingURL=logger.js.map

package/dist/runtime/server/dist/middleware/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/middleware/logger.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAE/E,SAAS,mBAAmB;IAC1B,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IAC1D,IAAI,WAAW;QAAE,OAAO,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAE1D,MAAM,UAAU,GAAG,cAAc,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IAC5D,IAAI,UAAU;QAAE,OAAO,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAExD,OAAO,qBAAqB,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;AACrC,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAE1C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AAEhD,MAAM,UAAU,GAAG;IACjB,aAAa,EAAE,UAAU;IACzB,MAAM,EAAE,cAAc;IACtB,UAAU,EAAE,IAAI;CACjB,CAAC;AAEF,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,OAAO;CACf,EAAE,IAAI,CAAC,SAAS,CAAC;IAChB,OAAO,EAAE;QACP;YACE,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,mCAAmC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;YACvG,KAAK,EAAE,MAAM;SACd;QACD;YACE,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE;YAC9E,KAAK,EAAE,OAAO;SACf;KACF;CACF,CAAC,CAAC,CAAC;AAEJ,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAC;IACjC,MAAM;IACN,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG;QAC3B,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG;YAAE,OAAO,OAAO,CAAC;QACjD,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG;YAAE,OAAO,MAAM,CAAC;QACzC,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,oBAAoB,CAAC,GAAG,EAAE,GAAG;QAC3B,OAAO,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;IACtD,CAAC;IACD,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG;QAC9B,MAAM,GAAG,GAAI,GAAW,CAAC,cAAc,CAAC;QACxC,MAAM,MAAM,GAAG,GAAG,EAAE,KAAK,EAAE,OAAO,IAAI,GAAG,EAAE,OAAO,IAAK,GAAW,CAAC,GAAG,EAAE,OAAO,IAAI,eAAe,CAAC;QACnG,OAAO,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,MAAM,MAAM,EAAE,CAAC;IAClE,CAAC;IACD,WAAW,CAAC,GAAG,EAAE,GAAG;QAClB,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAI,GAAW,CAAC,cAAc,CAAC;YACxC,IAAI,GAAG,EAAE,CAAC;gBACR,OAAO;oBACL,YAAY,EAAE,GAAG,CAAC,KAAK;oBACvB,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;iBACvB,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAA4B,EAAE,CAAC;YAC1C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,GAAU,CAAC;YAC3C,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrE,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;YACvB,CAAC;YACD,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3E,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC;YAC3B,CAAC;YACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxE,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC;YACzB,CAAC;YACD,IAAK,GAAW,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;gBAC7B,KAAK,CAAC,SAAS,GAAI,GAAW,CAAC,KAAK,CAAC,IAAI,CAAC;YAC5C,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;CACF,CAAC,CAAC"}

package/dist/runtime/server/dist/middleware/private-hostname-guard.d.ts

@@ -0,0 +1,11 @@
+import type { RequestHandler } from "express";
+export declare function resolvePrivateHostnameAllowSet(opts: {
+    allowedHostnames: string[];
+    bindHost: string;
+}): Set<string>;
+export declare function privateHostnameGuard(opts: {
+    enabled: boolean;
+    allowedHostnames: string[];
+    bindHost: string;
+}): RequestHandler;
+//# sourceMappingURL=private-hostname-guard.d.ts.map

package/dist/runtime/server/dist/middleware/private-hostname-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-hostname-guard.d.ts","sourceRoot":"","sources":["../../src/middleware/private-hostname-guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,cAAc,EAAE,MAAM,SAAS,CAAC;AA8BvD,wBAAgB,8BAA8B,CAAC,IAAI,EAAE;IAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAYlH;AASD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,cAAc,CAoCjB"}

package/dist/runtime/server/dist/middleware/private-hostname-guard.js

@@ -0,0 +1,78 @@
+function isLoopbackHostname(hostname) {
+    const normalized = hostname.trim().toLowerCase();
+    return normalized === "localhost" || normalized === "127.0.0.1" || normalized === "::1";
+}
+function extractHostname(req) {
+    const forwardedHost = req.header("x-forwarded-host")?.split(",")[0]?.trim();
+    const hostHeader = req.header("host")?.trim();
+    const raw = forwardedHost || hostHeader;
+    if (!raw)
+        return null;
+    try {
+        return new URL(`http://${raw}`).hostname.trim().toLowerCase();
+    }
+    catch {
+        return raw.trim().toLowerCase();
+    }
+}
+function normalizeAllowedHostnames(values) {
+    const unique = new Set();
+    for (const value of values) {
+        const trimmed = value.trim().toLowerCase();
+        if (!trimmed)
+            continue;
+        unique.add(trimmed);
+    }
+    return Array.from(unique);
+}
+export function resolvePrivateHostnameAllowSet(opts) {
+    const configuredAllow = normalizeAllowedHostnames(opts.allowedHostnames);
+    const bindHost = opts.bindHost.trim().toLowerCase();
+    const allowSet = new Set(configuredAllow);
+    if (bindHost && bindHost !== "0.0.0.0") {
+        allowSet.add(bindHost);
+    }
+    allowSet.add("localhost");
+    allowSet.add("127.0.0.1");
+    allowSet.add("::1");
+    return allowSet;
+}
+function blockedHostnameMessage(hostname) {
+    return (`Hostname '${hostname}' is not allowed for this Paperclip instance. ` +
+        `If you want to allow this hostname, please run pnpm paperclipai allowed-hostname ${hostname}`);
+}
+export function privateHostnameGuard(opts) {
+    if (!opts.enabled) {
+        return (_req, _res, next) => next();
+    }
+    const allowSet = resolvePrivateHostnameAllowSet({
+        allowedHostnames: opts.allowedHostnames,
+        bindHost: opts.bindHost,
+    });
+    return (req, res, next) => {
+        const hostname = extractHostname(req);
+        const wantsJson = req.path.startsWith("/api") || req.accepts(["json", "html", "text"]) === "json";
+        if (!hostname) {
+            const error = "Missing Host header. If you want to allow a hostname, run pnpm paperclipai allowed-hostname <host>.";
+            if (wantsJson) {
+                res.status(403).json({ error });
+            }
+            else {
+                res.status(403).type("text/plain").send(error);
+            }
+            return;
+        }
+        if (isLoopbackHostname(hostname) || allowSet.has(hostname)) {
+            next();
+            return;
+        }
+        const error = blockedHostnameMessage(hostname);
+        if (wantsJson) {
+            res.status(403).json({ error });
+        }
+        else {
+            res.status(403).type("text/plain").send(error);
+        }
+    };
+}
+//# sourceMappingURL=private-hostname-guard.js.map

package/dist/runtime/server/dist/middleware/private-hostname-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-hostname-guard.js","sourceRoot":"","sources":["../../src/middleware/private-hostname-guard.ts"],"names":[],"mappings":"AAEA,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjD,OAAO,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,KAAK,CAAC;AAC1F,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACnC,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAC5E,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;IAC9C,MAAM,GAAG,GAAG,aAAa,IAAI,UAAU,CAAC;IACxC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClC,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,MAAgB;IACjD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,IAAsD;IACnG,MAAM,eAAe,GAAG,yBAAyB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,eAAe,CAAC,CAAC;IAElD,IAAI,QAAQ,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACvC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC1B,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC1B,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,OAAO,CACL,aAAa,QAAQ,gDAAgD;QACrE,oFAAoF,QAAQ,EAAE,CAC/F,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAIpC;IACC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IACtC,CAAC;IAED,MAAM,QAAQ,GAAG,8BAA8B,CAAC;QAC9C,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,MAAM,CAAC;QAElG,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,qGAAqG,CAAC;YACpH,IAAI,SAAS,EAAE,CAAC;gBACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAClC,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjD,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,kBAAkB,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3D,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,SAAS,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}