@massdriver/backstage-plugin-backend 1.0.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,48 @@
+# @massdriver/backstage-plugin-backend
+
+Backend relay for the
+[Massdriver Backstage plugin](https://www.npmjs.com/package/@massdriver/backstage-plugin).
+It is the only component that holds Massdriver credentials:
+
+- **`POST /api/massdriver/graphql`** — forwards read-only GraphQL queries to
+  the Massdriver v2 API, injecting the service-account token and your
+  `organizationId` server-side. The browser never sees the token, and
+  client-supplied organization IDs never win over the configured one.
+- **`POST /api/massdriver/subscribe`** — bridges Massdriver's realtime
+  (Phoenix/Absinthe WebSocket) events to the browser as Server-Sent Events, so
+  the frontend stays live without holding credentials.
+
+There are **no mutation endpoints** — the integration is read-only by design.
+
+## Installation
+
+```bash
+# From your Backstage repo root
+yarn --cwd packages/backend add @massdriver/backstage-plugin-backend
+```
+
+Then add it in `packages/backend/src/index.ts`:
+
+```ts
+backend.add(import('@massdriver/backstage-plugin-backend'));
+```
+
+## Configuration
+
+Reads the `massdriver` block from your app config — see the
+[frontend plugin README](https://www.npmjs.com/package/@massdriver/backstage-plugin)
+for the full reference, including where to find your organization ID and how
+to mint a service-account token. Minimal setup:
+
+```yaml
+# app-config.yaml
+massdriver:
+  organizationId: ${MASSDRIVER_ORG_ID}
+  apiToken: ${MASSDRIVER_API_TOKEN} # secret — backend only
+```
+
+## Deployment note
+
+The backend needs outbound HTTPS **and WebSocket (WSS)** access to your
+Massdriver API origin (`https://api.massdriver.cloud` by default, or your
+`massdriver.baseUrl` if self-hosted) — WebSockets power the realtime bridge.

package/dist/absinthe.cjs.js

@@ -0,0 +1,162 @@
+'use strict';
+
+var WebSocket = require('ws');
+
+function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e : { default: e }; }
+
+var WebSocket__default = /*#__PURE__*/_interopDefaultCompat(WebSocket);
+
+const CONTROL_TOPIC = "__absinthe__:control";
+const HEARTBEAT_INTERVAL_MS = 3e4;
+const buildWebsocketUrl = (socketUrl, token) => {
+  const base = socketUrl.replace(/\/+$/, "");
+  const params = new URLSearchParams({ token, vsn: "2.0.0" });
+  return `${base}/websocket?${params.toString()}`;
+};
+const parsePhoenixMessage = (raw) => {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (!Array.isArray(parsed) || parsed.length !== 5) return null;
+  const [joinRef, ref, topic, event, payload] = parsed;
+  if (typeof topic !== "string" || typeof event !== "string") return null;
+  return [
+    joinRef,
+    ref,
+    topic,
+    event,
+    payload ?? {}
+  ];
+};
+const openAbsintheSubscription = (options) => {
+  const {
+    socketUrl,
+    token,
+    query,
+    variables,
+    onData,
+    onError,
+    onClose,
+    logger
+  } = options;
+  const createSocket = options.createSocket ?? ((url) => new WebSocket__default.default(url));
+  let ws;
+  try {
+    ws = createSocket(buildWebsocketUrl(socketUrl, token));
+  } catch (creationError) {
+    queueMicrotask(() => {
+      onError(creationError);
+      onClose?.();
+    });
+    return { close: () => {
+    } };
+  }
+  let refCounter = 0;
+  const nextRef = () => String(++refCounter);
+  const joinRef = nextRef();
+  let joinReplyRef = null;
+  let docRef = null;
+  let subscriptionId = null;
+  let heartbeat;
+  let awaitingHeartbeat = false;
+  let closed = false;
+  const send = (message) => {
+    if (ws.readyState === WebSocket__default.default.OPEN) ws.send(JSON.stringify(message));
+  };
+  const cleanup = () => {
+    if (heartbeat) clearInterval(heartbeat);
+    heartbeat = void 0;
+  };
+  const close = () => {
+    if (closed) return;
+    closed = true;
+    cleanup();
+    try {
+      if (ws.readyState === WebSocket__default.default.OPEN) {
+        send([joinRef, nextRef(), CONTROL_TOPIC, "phx_leave", {}]);
+      }
+      ws.close();
+    } catch {
+    }
+  };
+  ws.on("open", () => {
+    joinReplyRef = nextRef();
+    send([joinRef, joinReplyRef, CONTROL_TOPIC, "phx_join", {}]);
+    heartbeat = setInterval(() => {
+      if (awaitingHeartbeat) {
+        logger?.debug?.("Absinthe socket heartbeat timed out; terminating");
+        ws.terminate();
+        return;
+      }
+      awaitingHeartbeat = true;
+      send([null, nextRef(), "phoenix", "heartbeat", {}]);
+    }, HEARTBEAT_INTERVAL_MS);
+  });
+  ws.on("message", (raw) => {
+    if (closed) return;
+    awaitingHeartbeat = false;
+    const message = parsePhoenixMessage(raw.toString());
+    if (!message) return;
+    const [, ref, topic, event, payload] = message;
+    if (event === "phx_reply") {
+      const status = payload.status;
+      const response = payload.response ?? {};
+      if (status === "error") {
+        const channelError = Object.assign(
+          new Error(
+            `Absinthe channel error: ${JSON.stringify(response) || "unknown"}`
+          ),
+          { fatal: true }
+        );
+        onError(channelError);
+        close();
+        return;
+      }
+      if (ref === joinReplyRef) {
+        docRef = nextRef();
+        send([joinRef, docRef, CONTROL_TOPIC, "doc", { query, variables }]);
+        return;
+      }
+      if (ref === docRef) {
+        const replySubscriptionId = response.subscriptionId;
+        if (replySubscriptionId) {
+          subscriptionId = replySubscriptionId;
+        } else if ("data" in response) {
+          onData(response.data);
+        }
+        return;
+      }
+      return;
+    }
+    if (event === "subscription:data") {
+      const payloadSubscriptionId = payload.subscriptionId;
+      if (payloadSubscriptionId && subscriptionId && payloadSubscriptionId !== subscriptionId) {
+        return;
+      }
+      const result = payload.result ?? {};
+      onData(result.data);
+      return;
+    }
+    if (event === "phx_error" || event === "phx_close") {
+      logger?.debug?.(`Absinthe channel ${event} on ${topic}`);
+    }
+  });
+  ws.on("error", (error) => {
+    logger?.error(`Absinthe socket error: ${error.message}`);
+    if (!closed) onError(error);
+  });
+  ws.on("close", () => {
+    cleanup();
+    closed = true;
+    onClose?.();
+  });
+  return { close };
+};
+
+exports.buildWebsocketUrl = buildWebsocketUrl;
+exports.openAbsintheSubscription = openAbsintheSubscription;
+exports.parsePhoenixMessage = parsePhoenixMessage;
+//# sourceMappingURL=absinthe.cjs.js.map

package/dist/absinthe.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"absinthe.cjs.js","sources":["../src/absinthe.ts"],"sourcesContent":["import WebSocket from 'ws';\n\n/**\n * Minimal headless Absinthe-over-Phoenix subscription client.\n *\n * The Massdriver web app subscribes over a Phoenix/Absinthe WebSocket using\n * `@absinthe/socket` + `phoenix` in the browser. Those libraries assume a\n * browser environment, so rather than run them in Node we speak the Phoenix v2\n * channel protocol directly over `ws` — the same wire format their stack emits.\n *\n * Each client owns exactly one subscription: it connects, joins the Absinthe\n * control channel, pushes the subscription document, and forwards every\n * `subscription:data` payload to `onData`. The backend relay opens one of these\n * per browser SSE connection and streams the results down.\n *\n * The service-account token is passed as the socket's `token` query param\n * (mirroring the web app's `params: () => ({ token })`) and never leaves the\n * backend.\n */\n\n// Phoenix v2 serializer frames every message as a positional tuple:\n// [join_ref, ref, topic, event, payload].\ntype PhoenixMessage = [\n  string | null,\n  string | null,\n  string,\n  string,\n  Record<string, unknown>,\n];\n\nconst CONTROL_TOPIC = '__absinthe__:control';\nconst HEARTBEAT_INTERVAL_MS = 30_000;\n\n/**\n * Build the raw WebSocket URL from the socket endpoint. Phoenix appends\n * `/websocket` to the endpoint and takes connection params (here, the auth\n * token and the serializer version) as query string.\n */\nexport const buildWebsocketUrl = (socketUrl: string, token: string): string => {\n  const base = socketUrl.replace(/\\/+$/, '');\n  const params = new URLSearchParams({ token, vsn: '2.0.0' });\n  return `${base}/websocket?${params.toString()}`;\n};\n\n/**\n * Parse a raw Phoenix frame. Returns null when the payload is not a well-formed\n * v2 tuple (so a malformed/heartbeat-only frame is ignored rather than throwing).\n */\nexport const parsePhoenixMessage = (raw: string): PhoenixMessage | null => {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    return null;\n  }\n  if (!Array.isArray(parsed) || parsed.length !== 5) return null;\n  const [joinRef, ref, topic, event, payload] = parsed as unknown[];\n  if (typeof topic !== 'string' || typeof event !== 'string') return null;\n  return [\n    joinRef as string | null,\n    ref as string | null,\n    topic,\n    event,\n    (payload ?? {}) as Record<string, unknown>,\n  ];\n};\n\n/**\n * Errors from a channel-level `phx_reply` with `status: 'error'` (join or doc\n * rejection — bad token, invalid document, unknown environment) carry\n * `fatal: true`: retrying with the same inputs cannot succeed, so the frontend\n * stops reconnecting. Transport errors stay retryable (no flag).\n */\nexport type AbsintheSubscriptionError = Error & { fatal?: boolean };\n\nexport interface AbsintheSubscriptionOptions {\n  /** Socket endpoint, e.g. `wss://api.massdriver.cloud/api/socket`. */\n  socketUrl: string;\n  /** Service-account bearer token (query param, backend-only). */\n  token: string;\n  /** Subscription document. */\n  query: string;\n  /** Operation variables (`organizationId` is injected by the caller). */\n  variables?: Record<string, unknown>;\n  /** Called with `result.data` for each streamed `subscription:data`. */\n  onData: (data: unknown) => void;\n  /** Called on a transport/protocol error. */\n  onError: (error: AbsintheSubscriptionError) => void;\n  /** Called once the socket closes (after `onError`, if any). */\n  onClose?: () => void;\n  logger?: {\n    error: (message: string) => void;\n    debug?: (message: string) => void;\n  };\n  /** Socket factory — injection seam for tests. Defaults to `new WebSocket(url)`. */\n  createSocket?: (url: string) => WebSocket;\n}\n\n/** A live subscription handle; call `close()` to tear it down. */\nexport interface AbsintheSubscription {\n  close: () => void;\n}\n\n/**\n * Open a single Absinthe subscription and stream its results to `onData`.\n * Returns a handle whose `close()` leaves the channel and closes the socket.\n */\nexport const openAbsintheSubscription = (\n  options: AbsintheSubscriptionOptions,\n): AbsintheSubscription => {\n  const {\n    socketUrl,\n    token,\n    query,\n    variables,\n    onData,\n    onError,\n    onClose,\n    logger,\n  } = options;\n  const createSocket = options.createSocket ?? (url => new WebSocket(url));\n\n  let ws: WebSocket;\n  try {\n    ws = createSocket(buildWebsocketUrl(socketUrl, token));\n  } catch (creationError) {\n    // Fail asynchronously so the caller has its handle (and, for the SSE\n    // relay, its already-flushed headers) before the error lands.\n    queueMicrotask(() => {\n      onError(creationError as Error);\n      onClose?.();\n    });\n    return { close: () => {} };\n  }\n\n  let refCounter = 0;\n  const nextRef = () => String(++refCounter);\n  const joinRef = nextRef();\n  let joinReplyRef: string | null = null;\n  let docRef: string | null = null;\n  // The `__absinthe__:doc:<hash>` subscription id from the doc reply.\n  let subscriptionId: string | null = null;\n  let heartbeat: ReturnType<typeof setInterval> | undefined;\n  let awaitingHeartbeat = false;\n  let closed = false;\n\n  const send = (message: PhoenixMessage) => {\n    if (ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify(message));\n  };\n\n  const cleanup = () => {\n    if (heartbeat) clearInterval(heartbeat);\n    heartbeat = undefined;\n  };\n\n  const close = () => {\n    if (closed) return;\n    closed = true;\n    cleanup();\n    // Best-effort leave; ignore if the socket is already gone.\n    try {\n      if (ws.readyState === WebSocket.OPEN) {\n        send([joinRef, nextRef(), CONTROL_TOPIC, 'phx_leave', {}]);\n      }\n      ws.close();\n    } catch {\n      /* already closing */\n    }\n  };\n\n  ws.on('open', () => {\n    joinReplyRef = nextRef();\n    send([joinRef, joinReplyRef, CONTROL_TOPIC, 'phx_join', {}]);\n    heartbeat = setInterval(() => {\n      // A heartbeat interval elapsing with no traffic since the last one means\n      // the connection is half-open — terminate so 'close' fires and the\n      // frontend's reconnect loop takes over.\n      if (awaitingHeartbeat) {\n        logger?.debug?.('Absinthe socket heartbeat timed out; terminating');\n        ws.terminate();\n        return;\n      }\n      awaitingHeartbeat = true;\n      send([null, nextRef(), 'phoenix', 'heartbeat', {}]);\n    }, HEARTBEAT_INTERVAL_MS);\n  });\n\n  ws.on('message', (raw: WebSocket.RawData) => {\n    if (closed) return;\n    awaitingHeartbeat = false; // any traffic proves liveness\n    const message = parsePhoenixMessage(raw.toString());\n    if (!message) return;\n    const [, ref, topic, event, payload] = message;\n\n    if (event === 'phx_reply') {\n      const status = payload.status as string | undefined;\n      const response = (payload.response ?? {}) as Record<string, unknown>;\n\n      if (status === 'error') {\n        // A channel-level rejection (bad token, invalid doc, unknown\n        // environment) won't succeed on retry — mark it fatal so the\n        // frontend stops reconnecting.\n        const channelError: AbsintheSubscriptionError = Object.assign(\n          new Error(\n            `Absinthe channel error: ${JSON.stringify(response) || 'unknown'}`,\n          ),\n          { fatal: true },\n        );\n        onError(channelError);\n        close();\n        return;\n      }\n\n      // Join succeeded → push the subscription document.\n      if (ref === joinReplyRef) {\n        docRef = nextRef();\n        send([joinRef, docRef, CONTROL_TOPIC, 'doc', { query, variables }]);\n        return;\n      }\n\n      // Document accepted → remember the subscription id.\n      if (ref === docRef) {\n        const replySubscriptionId = response.subscriptionId as\n          | string\n          | undefined;\n        if (replySubscriptionId) {\n          subscriptionId = replySubscriptionId;\n        } else if ('data' in response) {\n          // A non-subscription document (query/mutation) resolves inline.\n          onData(response.data);\n        }\n        return;\n      }\n      return;\n    }\n\n    if (event === 'subscription:data') {\n      // Mirror `@absinthe/socket`: match on the event alone and correlate by\n      // the payload's subscriptionId when both sides carry one. Each socket\n      // owns exactly one subscription, so a topic check adds only fragility\n      // (a framing change upstream would silently drop every event).\n      const payloadSubscriptionId = payload.subscriptionId as\n        | string\n        | undefined;\n      if (\n        payloadSubscriptionId &&\n        subscriptionId &&\n        payloadSubscriptionId !== subscriptionId\n      ) {\n        return;\n      }\n      const result = (payload.result ?? {}) as { data?: unknown };\n      onData(result.data);\n      return;\n    }\n\n    if (event === 'phx_error' || event === 'phx_close') {\n      logger?.debug?.(`Absinthe channel ${event} on ${topic}`);\n    }\n  });\n\n  ws.on('error', (error: Error) => {\n    logger?.error(`Absinthe socket error: ${error.message}`);\n    if (!closed) onError(error);\n  });\n\n  ws.on('close', () => {\n    cleanup();\n    closed = true;\n    onClose?.();\n  });\n\n  return { close };\n};\n"],"names":["WebSocket"],"mappings":";;;;;;;;AA8BA,MAAM,aAAA,GAAgB,sBAAA;AACtB,MAAM,qBAAA,GAAwB,GAAA;AAOvB,MAAM,iBAAA,GAAoB,CAAC,SAAA,EAAmB,KAAA,KAA0B;AAC7E,EAAA,MAAM,IAAA,GAAO,SAAA,CAAU,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AACzC,EAAA,MAAM,SAAS,IAAI,eAAA,CAAgB,EAAE,KAAA,EAAO,GAAA,EAAK,SAAS,CAAA;AAC1D,EAAA,OAAO,CAAA,EAAG,IAAI,CAAA,WAAA,EAAc,MAAA,CAAO,UAAU,CAAA,CAAA;AAC/C;AAMO,MAAM,mBAAA,GAAsB,CAAC,GAAA,KAAuC;AACzE,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,EACzB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,MAAM,KAAK,MAAA,CAAO,MAAA,KAAW,GAAG,OAAO,IAAA;AAC1D,EAAA,MAAM,CAAC,OAAA,EAAS,GAAA,EAAK,KAAA,EAAO,KAAA,EAAO,OAAO,CAAA,GAAI,MAAA;AAC9C,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,OAAO,KAAA,KAAU,UAAU,OAAO,IAAA;AACnE,EAAA,OAAO;AAAA,IACL,OAAA;AAAA,IACA,GAAA;AAAA,IACA,KAAA;AAAA,IACA,KAAA;AAAA,IACC,WAAW;AAAC,GACf;AACF;AA0CO,MAAM,wBAAA,GAA2B,CACtC,OAAA,KACyB;AACzB,EAAA,MAAM;AAAA,IACJ,SAAA;AAAA,IACA,KAAA;AAAA,IACA,KAAA;AAAA,IACA,SAAA;AAAA,IACA,MAAA;AAAA,IACA,OAAA;AAAA,IACA,OAAA;AAAA,IACA;AAAA,GACF,GAAI,OAAA;AACJ,EAAA,MAAM,eAAe,OAAA,CAAQ,YAAA,KAAiB,CAAA,GAAA,KAAO,IAAIA,2BAAU,GAAG,CAAA,CAAA;AAEtE,EAAA,IAAI,EAAA;AACJ,EAAA,IAAI;AACF,IAAA,EAAA,GAAK,YAAA,CAAa,iBAAA,CAAkB,SAAA,EAAW,KAAK,CAAC,CAAA;AAAA,EACvD,SAAS,aAAA,EAAe;AAGtB,IAAA,cAAA,CAAe,MAAM;AACnB,MAAA,OAAA,CAAQ,aAAsB,CAAA;AAC9B,MAAA,OAAA,IAAU;AAAA,IACZ,CAAC,CAAA;AACD,IAAA,OAAO,EAAE,OAAO,MAAM;AAAA,IAAC,CAAA,EAAE;AAAA,EAC3B;AAEA,EAAA,IAAI,UAAA,GAAa,CAAA;AACjB,EAAA,MAAM,OAAA,GAAU,MAAM,MAAA,CAAO,EAAE,UAAU,CAAA;AACzC,EAAA,MAAM,UAAU,OAAA,EAAQ;AACxB,EAAA,IAAI,YAAA,GAA8B,IAAA;AAClC,EAAA,IAAI,MAAA,GAAwB,IAAA;AAE5B,EAAA,IAAI,cAAA,GAAgC,IAAA;AACpC,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI,iBAAA,GAAoB,KAAA;AACxB,EAAA,IAAI,MAAA,GAAS,KAAA;AAEb,EAAA,MAAM,IAAA,GAAO,CAAC,OAAA,KAA4B;AACxC,IAAA,IAAI,EAAA,CAAG,eAAeA,0BAAA,CAAU,IAAA,KAAS,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,OAAO,CAAC,CAAA;AAAA,EACvE,CAAA;AAEA,EAAA,MAAM,UAAU,MAAM;AACpB,IAAA,IAAI,SAAA,gBAAyB,SAAS,CAAA;AACtC,IAAA,SAAA,GAAY,MAAA;AAAA,EACd,CAAA;AAEA,EAAA,MAAM,QAAQ,MAAM;AAClB,IAAA,IAAI,MAAA,EAAQ;AACZ,IAAA,MAAA,GAAS,IAAA;AACT,IAAA,OAAA,EAAQ;AAER,IAAA,IAAI;AACF,MAAA,IAAI,EAAA,CAAG,UAAA,KAAeA,0BAAA,CAAU,IAAA,EAAM;AACpC,QAAA,IAAA,CAAK,CAAC,SAAS,OAAA,EAAQ,EAAG,eAAe,WAAA,EAAa,EAAE,CAAC,CAAA;AAAA,MAC3D;AACA,MAAA,EAAA,CAAG,KAAA,EAAM;AAAA,IACX,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF,CAAA;AAEA,EAAA,EAAA,CAAG,EAAA,CAAG,QAAQ,MAAM;AAClB,IAAA,YAAA,GAAe,OAAA,EAAQ;AACvB,IAAA,IAAA,CAAK,CAAC,OAAA,EAAS,YAAA,EAAc,eAAe,UAAA,EAAY,EAAE,CAAC,CAAA;AAC3D,IAAA,SAAA,GAAY,YAAY,MAAM;AAI5B,MAAA,IAAI,iBAAA,EAAmB;AACrB,QAAA,MAAA,EAAQ,QAAQ,kDAAkD,CAAA;AAClE,QAAA,EAAA,CAAG,SAAA,EAAU;AACb,QAAA;AAAA,MACF;AACA,MAAA,iBAAA,GAAoB,IAAA;AACpB,MAAA,IAAA,CAAK,CAAC,MAAM,OAAA,EAAQ,EAAG,WAAW,WAAA,EAAa,EAAE,CAAC,CAAA;AAAA,IACpD,GAAG,qBAAqB,CAAA;AAAA,EAC1B,CAAC,CAAA;AAED,EAAA,EAAA,CAAG,EAAA,CAAG,SAAA,EAAW,CAAC,GAAA,KAA2B;AAC3C,IAAA,IAAI,MAAA,EAAQ;AACZ,IAAA,iBAAA,GAAoB,KAAA;AACpB,IAAA,MAAM,OAAA,GAAU,mBAAA,CAAoB,GAAA,CAAI,QAAA,EAAU,CAAA;AAClD,IAAA,IAAI,CAAC,OAAA,EAAS;AACd,IAAA,MAAM,GAAG,GAAA,EAAK,KAAA,EAAO,KAAA,EAAO,OAAO,CAAA,GAAI,OAAA;AAEvC,IAAA,IAAI,UAAU,WAAA,EAAa;AACzB,MAAA,MAAM,SAAS,OAAA,CAAQ,MAAA;AACvB,MAAA,MAAM,QAAA,GAAY,OAAA,CAAQ,QAAA,IAAY,EAAC;AAEvC,MAAA,IAAI,WAAW,OAAA,EAAS;AAItB,QAAA,MAAM,eAA0C,MAAA,CAAO,MAAA;AAAA,UACrD,IAAI,KAAA;AAAA,YACF,CAAA,wBAAA,EAA2B,IAAA,CAAK,SAAA,CAAU,QAAQ,KAAK,SAAS,CAAA;AAAA,WAClE;AAAA,UACA,EAAE,OAAO,IAAA;AAAK,SAChB;AACA,QAAA,OAAA,CAAQ,YAAY,CAAA;AACpB,QAAA,KAAA,EAAM;AACN,QAAA;AAAA,MACF;AAGA,MAAA,IAAI,QAAQ,YAAA,EAAc;AACxB,QAAA,MAAA,GAAS,OAAA,EAAQ;AACjB,QAAA,IAAA,CAAK,CAAC,SAAS,MAAA,EAAQ,aAAA,EAAe,OAAO,EAAE,KAAA,EAAO,SAAA,EAAW,CAAC,CAAA;AAClE,QAAA;AAAA,MACF;AAGA,MAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,QAAA,MAAM,sBAAsB,QAAA,CAAS,cAAA;AAGrC,QAAA,IAAI,mBAAA,EAAqB;AACvB,UAAA,cAAA,GAAiB,mBAAA;AAAA,QACnB,CAAA,MAAA,IAAW,UAAU,QAAA,EAAU;AAE7B,UAAA,MAAA,CAAO,SAAS,IAAI,CAAA;AAAA,QACtB;AACA,QAAA;AAAA,MACF;AACA,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,UAAU,mBAAA,EAAqB;AAKjC,MAAA,MAAM,wBAAwB,OAAA,CAAQ,cAAA;AAGtC,MAAA,IACE,qBAAA,IACA,cAAA,IACA,qBAAA,KAA0B,cAAA,EAC1B;AACA,QAAA;AAAA,MACF;AACA,MAAA,MAAM,MAAA,GAAU,OAAA,CAAQ,MAAA,IAAU,EAAC;AACnC,MAAA,MAAA,CAAO,OAAO,IAAI,CAAA;AAClB,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,KAAA,KAAU,WAAA,IAAe,KAAA,KAAU,WAAA,EAAa;AAClD,MAAA,MAAA,EAAQ,KAAA,GAAQ,CAAA,iBAAA,EAAoB,KAAK,CAAA,IAAA,EAAO,KAAK,CAAA,CAAE,CAAA;AAAA,IACzD;AAAA,EACF,CAAC,CAAA;AAED,EAAA,EAAA,CAAG,EAAA,CAAG,OAAA,EAAS,CAAC,KAAA,KAAiB;AAC/B,IAAA,MAAA,EAAQ,KAAA,CAAM,CAAA,uBAAA,EAA0B,KAAA,CAAM,OAAO,CAAA,CAAE,CAAA;AACvD,IAAA,IAAI,CAAC,MAAA,EAAQ,OAAA,CAAQ,KAAK,CAAA;AAAA,EAC5B,CAAC,CAAA;AAED,EAAA,EAAA,CAAG,EAAA,CAAG,SAAS,MAAM;AACnB,IAAA,OAAA,EAAQ;AACR,IAAA,MAAA,GAAS,IAAA;AACT,IAAA,OAAA,IAAU;AAAA,EACZ,CAAC,CAAA;AAED,EAAA,OAAO,EAAE,KAAA,EAAM;AACjB;;;;;;"}

package/dist/index.cjs.js

@@ -0,0 +1,10 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var plugin = require('./plugin.cjs.js');
+
+
+
+exports.default = plugin.massdriverPlugin;
+//# sourceMappingURL=index.cjs.js.map

package/dist/index.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;"}

package/dist/index.d.ts

@@ -0,0 +1,15 @@
+import * as _backstage_backend_plugin_api from '@backstage/backend-plugin-api';
+
+/**
+ * Massdriver backend plugin.
+ *
+ * Exposes an authenticated GraphQL relay at `/api/massdriver/graphql` that
+ * forwards queries to the Massdriver v2 API with a service-account bearer token
+ * injected server-side. The token is read from config and never reaches the
+ * browser.
+ *
+ * @public
+ */
+declare const massdriverPlugin: _backstage_backend_plugin_api.BackendFeature;
+
+export { massdriverPlugin as default };

package/dist/plugin.cjs.js

@@ -0,0 +1,24 @@
+'use strict';
+
+var backendPluginApi = require('@backstage/backend-plugin-api');
+var router = require('./router.cjs.js');
+
+const massdriverPlugin = backendPluginApi.createBackendPlugin({
+  pluginId: "massdriver",
+  register(env) {
+    env.registerInit({
+      deps: {
+        logger: backendPluginApi.coreServices.logger,
+        config: backendPluginApi.coreServices.rootConfig,
+        httpAuth: backendPluginApi.coreServices.httpAuth,
+        httpRouter: backendPluginApi.coreServices.httpRouter
+      },
+      async init({ logger, config, httpAuth, httpRouter }) {
+        httpRouter.use(await router.createRouter({ logger, config, httpAuth }));
+      }
+    });
+  }
+});
+
+exports.massdriverPlugin = massdriverPlugin;
+//# sourceMappingURL=plugin.cjs.js.map

package/dist/plugin.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.cjs.js","sources":["../src/plugin.ts"],"sourcesContent":["import {\n  coreServices,\n  createBackendPlugin,\n} from '@backstage/backend-plugin-api';\nimport { createRouter } from './router';\n\n/**\n * Massdriver backend plugin.\n *\n * Exposes an authenticated GraphQL relay at `/api/massdriver/graphql` that\n * forwards queries to the Massdriver v2 API with a service-account bearer token\n * injected server-side. The token is read from config and never reaches the\n * browser.\n *\n * @public\n */\nexport const massdriverPlugin = createBackendPlugin({\n  pluginId: 'massdriver',\n  register(env) {\n    env.registerInit({\n      deps: {\n        logger: coreServices.logger,\n        config: coreServices.rootConfig,\n        httpAuth: coreServices.httpAuth,\n        httpRouter: coreServices.httpRouter,\n      },\n      async init({ logger, config, httpAuth, httpRouter }) {\n        httpRouter.use(await createRouter({ logger, config, httpAuth }));\n      },\n    });\n  },\n});\n"],"names":["createBackendPlugin","coreServices","createRouter"],"mappings":";;;;;AAgBO,MAAM,mBAAmBA,oCAAA,CAAoB;AAAA,EAClD,QAAA,EAAU,YAAA;AAAA,EACV,SAAS,GAAA,EAAK;AACZ,IAAA,GAAA,CAAI,YAAA,CAAa;AAAA,MACf,IAAA,EAAM;AAAA,QACJ,QAAQC,6BAAA,CAAa,MAAA;AAAA,QACrB,QAAQA,6BAAA,CAAa,UAAA;AAAA,QACrB,UAAUA,6BAAA,CAAa,QAAA;AAAA,QACvB,YAAYA,6BAAA,CAAa;AAAA,OAC3B;AAAA,MACA,MAAM,IAAA,CAAK,EAAE,QAAQ,MAAA,EAAQ,QAAA,EAAU,YAAW,EAAG;AACnD,QAAA,UAAA,CAAW,GAAA,CAAI,MAAMC,mBAAA,CAAa,EAAE,QAAQ,MAAA,EAAQ,QAAA,EAAU,CAAC,CAAA;AAAA,MACjE;AAAA,KACD,CAAA;AAAA,EACH;AACF,CAAC;;;;"}

package/dist/router.cjs.js

@@ -0,0 +1,138 @@
+'use strict';
+
+var errors = require('@backstage/errors');
+var backstagePluginCommon = require('@massdriver/backstage-plugin-common');
+var express = require('express');
+var Router = require('express-promise-router');
+var absinthe = require('./absinthe.cjs.js');
+
+function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e : { default: e }; }
+
+var express__default = /*#__PURE__*/_interopDefaultCompat(express);
+var Router__default = /*#__PURE__*/_interopDefaultCompat(Router);
+
+const SSE_KEEPALIVE_MS = 25e3;
+async function createRouter({
+  config,
+  logger,
+  httpAuth
+}) {
+  let settings;
+  const getConfig = () => {
+    if (!settings) {
+      settings = backstagePluginCommon.readMassdriverConfig(config);
+      logger.info(
+        `Massdriver relay initialised for organization "${settings.organizationId}"`
+      );
+    }
+    return settings;
+  };
+  let client;
+  const getClient = () => {
+    if (!client) {
+      const { organizationId, apiToken, baseUrl } = getConfig();
+      client = backstagePluginCommon.createMassdriverClient({
+        token: apiToken,
+        organizationId,
+        baseUrl
+      });
+    }
+    return client;
+  };
+  const router = Router__default.default();
+  router.use(express__default.default.json());
+  router.post("/graphql", async (req, res) => {
+    await httpAuth.credentials(req, { allow: ["user"] });
+    const { query, variables } = req.body ?? {};
+    if (typeof query !== "string" || !query.trim()) {
+      throw new errors.InputError(
+        "Request body must include a non-empty `query` string"
+      );
+    }
+    const data = await getClient().query(query, variables);
+    res.json({ data });
+  });
+  router.get("/content", async (req, res) => {
+    await httpAuth.credentials(req, { allow: ["user"] });
+    const { url } = req.query;
+    if (typeof url !== "string" || !url) {
+      throw new errors.InputError("A `url` query parameter is required");
+    }
+    const { apiToken, baseUrl } = getConfig();
+    const apiOrigin = new URL(backstagePluginCommon.graphqlUrl(baseUrl)).origin;
+    let target;
+    try {
+      target = new URL(url);
+    } catch {
+      throw new errors.InputError("`url` must be an absolute URL");
+    }
+    if (target.origin !== apiOrigin) {
+      throw new errors.InputError(
+        `\`url\` must be on the Massdriver API origin (${apiOrigin})`
+      );
+    }
+    const upstream = await fetch(target, {
+      headers: { Authorization: `Bearer ${apiToken}` }
+    });
+    res.status(upstream.status);
+    const contentType = upstream.headers.get("content-type");
+    if (contentType) res.setHeader("Content-Type", contentType);
+    res.send(Buffer.from(await upstream.arrayBuffer()));
+  });
+  router.post("/subscribe", async (req, res) => {
+    await httpAuth.credentials(req, { allow: ["user"] });
+    const { query, variables } = req.body ?? {};
+    if (typeof query !== "string" || !query.trim()) {
+      throw new errors.InputError(
+        "Request body must include a non-empty `query` string"
+      );
+    }
+    const { organizationId, apiToken, baseUrl } = getConfig();
+    res.writeHead(200, {
+      "Content-Type": "text/event-stream",
+      "Cache-Control": "no-cache, no-transform",
+      Connection: "keep-alive",
+      // Disable proxy buffering (nginx) so events flush immediately.
+      "X-Accel-Buffering": "no"
+    });
+    res.flushHeaders?.();
+    const write = (event, data) => {
+      if (res.writableEnded) return;
+      if (event) res.write(`event: ${event}
+`);
+      res.write(`data: ${JSON.stringify(data)}
+
+`);
+    };
+    const keepalive = setInterval(() => {
+      if (!res.writableEnded) res.write(": ping\n\n");
+    }, SSE_KEEPALIVE_MS);
+    const subscription = absinthe.openAbsintheSubscription({
+      socketUrl: backstagePluginCommon.socketUrl(baseUrl),
+      token: apiToken,
+      query,
+      // Server-injected org id must win over request variables.
+      variables: { ...variables ?? {}, organizationId },
+      logger,
+      onData: (data) => write(null, data),
+      onError: (error) => {
+        write("error", { message: error.message, fatal: Boolean(error.fatal) });
+        teardown();
+      },
+      onClose: () => teardown()
+    });
+    let torndown = false;
+    function teardown() {
+      if (torndown) return;
+      torndown = true;
+      clearInterval(keepalive);
+      subscription.close();
+      if (!res.writableEnded) res.end();
+    }
+    res.on("close", teardown);
+  });
+  return router;
+}
+
+exports.createRouter = createRouter;
+//# sourceMappingURL=router.cjs.js.map

package/dist/router.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.cjs.js","sources":["../src/router.ts"],"sourcesContent":["import {\n  HttpAuthService,\n  LoggerService,\n  RootConfigService,\n} from '@backstage/backend-plugin-api';\nimport { InputError } from '@backstage/errors';\nimport {\n  createMassdriverClient,\n  graphqlUrl,\n  MassdriverClient,\n  MassdriverConfig,\n  readMassdriverConfig,\n  socketUrl,\n} from '@massdriver/backstage-plugin-common';\nimport express from 'express';\nimport Router from 'express-promise-router';\nimport { openAbsintheSubscription } from './absinthe';\n\n// Keep the downstream SSE connection (and any intermediary proxies) alive\n// between events. The upstream Absinthe socket has its own heartbeat.\nconst SSE_KEEPALIVE_MS = 25_000;\n\n/**\n * Builds the Massdriver relay router.\n *\n * The client is created lazily on first use so the backend still boots when the\n * plugin is installed but not yet configured — misconfiguration surfaces as a\n * request error rather than a startup crash.\n */\nexport async function createRouter({\n  config,\n  logger,\n  httpAuth,\n}: {\n  config: RootConfigService;\n  logger: LoggerService;\n  httpAuth: HttpAuthService;\n}): Promise<express.Router> {\n  let settings: MassdriverConfig | undefined;\n  const getConfig = (): MassdriverConfig => {\n    if (!settings) {\n      settings = readMassdriverConfig(config);\n      logger.info(\n        `Massdriver relay initialised for organization \"${settings.organizationId}\"`,\n      );\n    }\n    return settings;\n  };\n\n  let client: MassdriverClient | undefined;\n  const getClient = (): MassdriverClient => {\n    if (!client) {\n      const { organizationId, apiToken, baseUrl } = getConfig();\n      client = createMassdriverClient({\n        token: apiToken,\n        organizationId,\n        baseUrl,\n      });\n    }\n    return client;\n  };\n\n  const router = Router();\n  router.use(express.json());\n\n  router.post('/graphql', async (req, res) => {\n    // Require an authenticated Backstage user; the relay then queries with the\n    // org's service-account token (org-wide read access — see plugin README).\n    await httpAuth.credentials(req, { allow: ['user'] });\n\n    const { query, variables } = (req.body ?? {}) as {\n      query?: unknown;\n      variables?: Record<string, unknown>;\n    };\n\n    if (typeof query !== 'string' || !query.trim()) {\n      throw new InputError(\n        'Request body must include a non-empty `query` string',\n      );\n    }\n\n    const data = await getClient().query(query, variables);\n    res.json({ data });\n  });\n\n  // Authenticated content proxy. The web app fetches auth-guarded assets (OCI\n  // repo icon SVGs, repo tag file contents) directly with the browser's bearer\n  // token; this plugin's browser holds no token, so the backend fetches with\n  // the service-account token instead. Locked to the configured Massdriver API\n  // origin so this can't be used as an open proxy.\n  router.get('/content', async (req, res) => {\n    await httpAuth.credentials(req, { allow: ['user'] });\n\n    const { url } = req.query as { url?: unknown };\n    if (typeof url !== 'string' || !url) {\n      throw new InputError('A `url` query parameter is required');\n    }\n\n    const { apiToken, baseUrl } = getConfig();\n    const apiOrigin = new URL(graphqlUrl(baseUrl)).origin;\n\n    let target: URL;\n    try {\n      target = new URL(url);\n    } catch {\n      throw new InputError('`url` must be an absolute URL');\n    }\n    if (target.origin !== apiOrigin) {\n      throw new InputError(\n        `\\`url\\` must be on the Massdriver API origin (${apiOrigin})`,\n      );\n    }\n\n    const upstream = await fetch(target, {\n      headers: { Authorization: `Bearer ${apiToken}` },\n    });\n\n    res.status(upstream.status);\n    const contentType = upstream.headers.get('content-type');\n    if (contentType) res.setHeader('Content-Type', contentType);\n    res.send(Buffer.from(await upstream.arrayBuffer()));\n  });\n\n  // Server-Sent Events relay for GraphQL subscriptions. The browser cannot open\n  // the Massdriver Absinthe socket directly (it holds no token), so the backend\n  // opens it with the service-account token and streams each result down as an\n  // SSE `data:` frame. `organizationId` is injected server-side, mirroring the\n  // `/graphql` relay, so callers only declare `$organizationId` in the document.\n  router.post('/subscribe', async (req, res) => {\n    await httpAuth.credentials(req, { allow: ['user'] });\n\n    const { query, variables } = (req.body ?? {}) as {\n      query?: unknown;\n      variables?: Record<string, unknown>;\n    };\n\n    if (typeof query !== 'string' || !query.trim()) {\n      throw new InputError(\n        'Request body must include a non-empty `query` string',\n      );\n    }\n\n    const { organizationId, apiToken, baseUrl } = getConfig();\n\n    res.writeHead(200, {\n      'Content-Type': 'text/event-stream',\n      'Cache-Control': 'no-cache, no-transform',\n      Connection: 'keep-alive',\n      // Disable proxy buffering (nginx) so events flush immediately.\n      'X-Accel-Buffering': 'no',\n    });\n    res.flushHeaders?.();\n\n    const write = (event: string | null, data: unknown) => {\n      if (res.writableEnded) return;\n      if (event) res.write(`event: ${event}\\n`);\n      res.write(`data: ${JSON.stringify(data)}\\n\\n`);\n    };\n\n    const keepalive = setInterval(() => {\n      if (!res.writableEnded) res.write(': ping\\n\\n');\n    }, SSE_KEEPALIVE_MS);\n\n    const subscription = openAbsintheSubscription({\n      socketUrl: socketUrl(baseUrl),\n      token: apiToken,\n      query,\n      // Server-injected org id must win over request variables.\n      variables: { ...(variables ?? {}), organizationId },\n      logger,\n      onData: data => write(null, data),\n      onError: error => {\n        // `fatal` marks channel-level rejections (bad token/doc/environment)\n        // that retrying cannot fix — the frontend stops reconnecting on it.\n        write('error', { message: error.message, fatal: Boolean(error.fatal) });\n        teardown();\n      },\n      onClose: () => teardown(),\n    });\n\n    let torndown = false;\n    function teardown() {\n      if (torndown) return;\n      torndown = true;\n      clearInterval(keepalive);\n      subscription.close();\n      if (!res.writableEnded) res.end();\n    }\n\n    // Browser navigated away / closed the EventSource-style reader. The\n    // response 'close' event is the reliable disconnect signal — the request\n    // readable closes as soon as the JSON body is consumed, long before the\n    // client goes away.\n    res.on('close', teardown);\n  });\n\n  return router;\n}\n"],"names":["readMassdriverConfig","createMassdriverClient","Router","express","InputError","graphqlUrl","openAbsintheSubscription","socketUrl"],"mappings":";;;;;;;;;;;;;AAoBA,MAAM,gBAAA,GAAmB,IAAA;AASzB,eAAsB,YAAA,CAAa;AAAA,EACjC,MAAA;AAAA,EACA,MAAA;AAAA,EACA;AACF,CAAA,EAI4B;AAC1B,EAAA,IAAI,QAAA;AACJ,EAAA,MAAM,YAAY,MAAwB;AACxC,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,QAAA,GAAWA,2CAAqB,MAAM,CAAA;AACtC,MAAA,MAAA,CAAO,IAAA;AAAA,QACL,CAAA,+CAAA,EAAkD,SAAS,cAAc,CAAA,CAAA;AAAA,OAC3E;AAAA,IACF;AACA,IAAA,OAAO,QAAA;AAAA,EACT,CAAA;AAEA,EAAA,IAAI,MAAA;AACJ,EAAA,MAAM,YAAY,MAAwB;AACxC,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,MAAM,EAAE,cAAA,EAAgB,QAAA,EAAU,OAAA,KAAY,SAAA,EAAU;AACxD,MAAA,MAAA,GAASC,4CAAA,CAAuB;AAAA,QAC9B,KAAA,EAAO,QAAA;AAAA,QACP,cAAA;AAAA,QACA;AAAA,OACD,CAAA;AAAA,IACH;AACA,IAAA,OAAO,MAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,SAASC,uBAAA,EAAO;AACtB,EAAA,MAAA,CAAO,GAAA,CAAIC,wBAAA,CAAQ,IAAA,EAAM,CAAA;AAEzB,EAAA,MAAA,CAAO,IAAA,CAAK,UAAA,EAAY,OAAO,GAAA,EAAK,GAAA,KAAQ;AAG1C,IAAA,MAAM,QAAA,CAAS,YAAY,GAAA,EAAK,EAAE,OAAO,CAAC,MAAM,GAAG,CAAA;AAEnD,IAAA,MAAM,EAAE,KAAA,EAAO,SAAA,EAAU,GAAK,GAAA,CAAI,QAAQ,EAAC;AAK3C,IAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,MAAK,EAAG;AAC9C,MAAA,MAAM,IAAIC,iBAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,OAAO,MAAM,SAAA,EAAU,CAAE,KAAA,CAAM,OAAO,SAAS,CAAA;AACrD,IAAA,GAAA,CAAI,IAAA,CAAK,EAAE,IAAA,EAAM,CAAA;AAAA,EACnB,CAAC,CAAA;AAOD,EAAA,MAAA,CAAO,GAAA,CAAI,UAAA,EAAY,OAAO,GAAA,EAAK,GAAA,KAAQ;AACzC,IAAA,MAAM,QAAA,CAAS,YAAY,GAAA,EAAK,EAAE,OAAO,CAAC,MAAM,GAAG,CAAA;AAEnD,IAAA,MAAM,EAAE,GAAA,EAAI,GAAI,GAAA,CAAI,KAAA;AACpB,IAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,CAAC,GAAA,EAAK;AACnC,MAAA,MAAM,IAAIA,kBAAW,qCAAqC,CAAA;AAAA,IAC5D;AAEA,IAAA,MAAM,EAAE,QAAA,EAAU,OAAA,EAAQ,GAAI,SAAA,EAAU;AACxC,IAAA,MAAM,YAAY,IAAI,GAAA,CAAIC,gCAAA,CAAW,OAAO,CAAC,CAAA,CAAE,MAAA;AAE/C,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI;AACF,MAAA,MAAA,GAAS,IAAI,IAAI,GAAG,CAAA;AAAA,IACtB,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAID,kBAAW,+BAA+B,CAAA;AAAA,IACtD;AACA,IAAA,IAAI,MAAA,CAAO,WAAW,SAAA,EAAW;AAC/B,MAAA,MAAM,IAAIA,iBAAA;AAAA,QACR,iDAAiD,SAAS,CAAA,CAAA;AAAA,OAC5D;AAAA,IACF;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,MAAA,EAAQ;AAAA,MACnC,OAAA,EAAS,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,QAAQ,CAAA,CAAA;AAAG,KAChD,CAAA;AAED,IAAA,GAAA,CAAI,MAAA,CAAO,SAAS,MAAM,CAAA;AAC1B,IAAA,MAAM,WAAA,GAAc,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA;AACvD,IAAA,IAAI,WAAA,EAAa,GAAA,CAAI,SAAA,CAAU,cAAA,EAAgB,WAAW,CAAA;AAC1D,IAAA,GAAA,CAAI,KAAK,MAAA,CAAO,IAAA,CAAK,MAAM,QAAA,CAAS,WAAA,EAAa,CAAC,CAAA;AAAA,EACpD,CAAC,CAAA;AAOD,EAAA,MAAA,CAAO,IAAA,CAAK,YAAA,EAAc,OAAO,GAAA,EAAK,GAAA,KAAQ;AAC5C,IAAA,MAAM,QAAA,CAAS,YAAY,GAAA,EAAK,EAAE,OAAO,CAAC,MAAM,GAAG,CAAA;AAEnD,IAAA,MAAM,EAAE,KAAA,EAAO,SAAA,EAAU,GAAK,GAAA,CAAI,QAAQ,EAAC;AAK3C,IAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,MAAK,EAAG;AAC9C,MAAA,MAAM,IAAIA,iBAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,EAAE,cAAA,EAAgB,QAAA,EAAU,OAAA,KAAY,SAAA,EAAU;AAExD,IAAA,GAAA,CAAI,UAAU,GAAA,EAAK;AAAA,MACjB,cAAA,EAAgB,mBAAA;AAAA,MAChB,eAAA,EAAiB,wBAAA;AAAA,MACjB,UAAA,EAAY,YAAA;AAAA;AAAA,MAEZ,mBAAA,EAAqB;AAAA,KACtB,CAAA;AACD,IAAA,GAAA,CAAI,YAAA,IAAe;AAEnB,IAAA,MAAM,KAAA,GAAQ,CAAC,KAAA,EAAsB,IAAA,KAAkB;AACrD,MAAA,IAAI,IAAI,aAAA,EAAe;AACvB,MAAA,IAAI,KAAA,EAAO,GAAA,CAAI,KAAA,CAAM,CAAA,OAAA,EAAU,KAAK;AAAA,CAAI,CAAA;AACxC,MAAA,GAAA,CAAI,KAAA,CAAM,CAAA,MAAA,EAAS,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC;;AAAA,CAAM,CAAA;AAAA,IAC/C,CAAA;AAEA,IAAA,MAAM,SAAA,GAAY,YAAY,MAAM;AAClC,MAAA,IAAI,CAAC,GAAA,CAAI,aAAA,EAAe,GAAA,CAAI,MAAM,YAAY,CAAA;AAAA,IAChD,GAAG,gBAAgB,CAAA;AAEnB,IAAA,MAAM,eAAeE,iCAAA,CAAyB;AAAA,MAC5C,SAAA,EAAWC,gCAAU,OAAO,CAAA;AAAA,MAC5B,KAAA,EAAO,QAAA;AAAA,MACP,KAAA;AAAA;AAAA,MAEA,WAAW,EAAE,GAAI,SAAA,IAAa,IAAK,cAAA,EAAe;AAAA,MAClD,MAAA;AAAA,MACA,MAAA,EAAQ,CAAA,IAAA,KAAQ,KAAA,CAAM,IAAA,EAAM,IAAI,CAAA;AAAA,MAChC,SAAS,CAAA,KAAA,KAAS;AAGhB,QAAA,KAAA,CAAM,OAAA,EAAS,EAAE,OAAA,EAAS,KAAA,CAAM,OAAA,EAAS,OAAO,OAAA,CAAQ,KAAA,CAAM,KAAK,CAAA,EAAG,CAAA;AACtE,QAAA,QAAA,EAAS;AAAA,MACX,CAAA;AAAA,MACA,OAAA,EAAS,MAAM,QAAA;AAAS,KACzB,CAAA;AAED,IAAA,IAAI,QAAA,GAAW,KAAA;AACf,IAAA,SAAS,QAAA,GAAW;AAClB,MAAA,IAAI,QAAA,EAAU;AACd,MAAA,QAAA,GAAW,IAAA;AACX,MAAA,aAAA,CAAc,SAAS,CAAA;AACvB,MAAA,YAAA,CAAa,KAAA,EAAM;AACnB,MAAA,IAAI,CAAC,GAAA,CAAI,aAAA,EAAe,GAAA,CAAI,GAAA,EAAI;AAAA,IAClC;AAMA,IAAA,GAAA,CAAI,EAAA,CAAG,SAAS,QAAQ,CAAA;AAAA,EAC1B,CAAC,CAAA;AAED,EAAA,OAAO,MAAA;AACT;;;;"}

package/package.json

@@ -0,0 +1,65 @@
+{
+  "name": "@massdriver/backstage-plugin-backend",
+  "version": "1.0.0",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/massdriver-cloud/massdriver-backstage",
+    "directory": "plugins/massdriver-backend"
+  },
+  "main": "dist/index.cjs.js",
+  "types": "dist/index.d.ts",
+  "publishConfig": {
+    "access": "public",
+    "main": "dist/index.cjs.js",
+    "types": "dist/index.d.ts"
+  },
+  "backstage": {
+    "role": "backend-plugin",
+    "pluginId": "massdriver",
+    "pluginPackages": [
+      "@massdriver/backstage-plugin",
+      "@massdriver/backstage-plugin-backend",
+      "@massdriver/backstage-plugin-common"
+    ],
+    "features": {
+      ".": "@backstage/BackendFeature"
+    }
+  },
+  "scripts": {
+    "start": "backstage-cli package start",
+    "build": "backstage-cli package build",
+    "lint": "backstage-cli package lint",
+    "test": "backstage-cli package test",
+    "clean": "backstage-cli package clean",
+    "prepack": "backstage-cli package prepack",
+    "postpack": "backstage-cli package postpack"
+  },
+  "dependencies": {
+    "@backstage/backend-defaults": "^0.17.3",
+    "@backstage/backend-plugin-api": "^1.9.2",
+    "@backstage/errors": "^1.3.1",
+    "@massdriver/backstage-plugin-common": "^1.0.0",
+    "express": "^4.14.0",
+    "express-promise-router": "^4.1.0",
+    "ws": "^8.18.0"
+  },
+  "devDependencies": {
+    "@backstage/backend-test-utils": "^1.11.4",
+    "@backstage/cli": "^0.36.3",
+    "@types/express": "^4.17.6",
+    "@types/supertest": "^2.0.12",
+    "@types/ws": "^8.5.10",
+    "supertest": "^6.2.4"
+  },
+  "files": [
+    "dist"
+  ],
+  "typesVersions": {
+    "*": {
+      "package.json": [
+        "package.json"
+      ]
+    }
+  }
+}