@paperclipai/server 0.2.2

package/dist/middleware/board-mutation-guard.js

@@ -0,0 +1,60 @@
+const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
+const DEFAULT_DEV_ORIGINS = [
+    "http://localhost:3100",
+    "http://127.0.0.1:3100",
+];
+function parseOrigin(value) {
+    if (!value)
+        return null;
+    try {
+        const url = new URL(value);
+        return `${url.protocol}//${url.host}`.toLowerCase();
+    }
+    catch {
+        return null;
+    }
+}
+function trustedOriginsForRequest(req) {
+    const origins = new Set(DEFAULT_DEV_ORIGINS.map((value) => value.toLowerCase()));
+    const host = req.header("host")?.trim();
+    if (host) {
+        origins.add(`http://${host}`.toLowerCase());
+        origins.add(`https://${host}`.toLowerCase());
+    }
+    return origins;
+}
+function isTrustedBoardMutationRequest(req) {
+    const allowedOrigins = trustedOriginsForRequest(req);
+    const origin = parseOrigin(req.header("origin"));
+    if (origin && allowedOrigins.has(origin))
+        return true;
+    const refererOrigin = parseOrigin(req.header("referer"));
+    if (refererOrigin && allowedOrigins.has(refererOrigin))
+        return true;
+    return false;
+}
+export function boardMutationGuard() {
+    return (req, res, next) => {
+        if (SAFE_METHODS.has(req.method.toUpperCase())) {
+            next();
+            return;
+        }
+        if (req.actor.type !== "board") {
+            next();
+            return;
+        }
+        // Local-trusted mode uses an implicit board actor for localhost-only development.
+        // In this mode, origin/referer headers can be omitted by some clients for multipart
+        // uploads; do not block those mutations.
+        if (req.actor.source === "local_implicit") {
+            next();
+            return;
+        }
+        if (!isTrustedBoardMutationRequest(req)) {
+            res.status(403).json({ error: "Board mutation requires trusted browser origin" });
+            return;
+        }
+        next();
+    };
+}
+//# sourceMappingURL=board-mutation-guard.js.map

package/dist/middleware/board-mutation-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"board-mutation-guard.js","sourceRoot":"","sources":["../../src/middleware/board-mutation-guard.ts"],"names":[],"mappings":"AAEA,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AACzD,MAAM,mBAAmB,GAAG;IAC1B,uBAAuB;IACvB,uBAAuB;CACxB,CAAC;AAEF,SAAS,WAAW,CAAC,KAAyB;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,GAAY;IAC5C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACjF,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;IACxC,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,6BAA6B,CAAC,GAAY;IACjD,MAAM,cAAc,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjD,IAAI,MAAM,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtD,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IACzD,IAAI,aAAa,IAAI,cAAc,CAAC,GAAG,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC/C,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC/B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,kFAAkF;QAClF,oFAAoF;QACpF,yCAAyC;QACzC,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;YAC1C,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/error-handler.d.ts

@@ -0,0 +1,3 @@
+import type { Request, Response, NextFunction } from "express";
+export declare function errorHandler(err: unknown, req: Request, res: Response, _next: NextFunction): void;
+//# sourceMappingURL=error-handler.d.ts.map

package/dist/middleware/error-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-handler.d.ts","sourceRoot":"","sources":["../../src/middleware/error-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAK/D,wBAAgB,YAAY,CAC1B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,KAAK,EAAE,YAAY,QA2BpB"}

package/dist/middleware/error-handler.js

@@ -0,0 +1,22 @@
+import { ZodError } from "zod";
+import { logger } from "./logger.js";
+import { HttpError } from "../errors.js";
+export function errorHandler(err, req, res, _next) {
+    if (err instanceof HttpError) {
+        res.status(err.status).json({
+            error: err.message,
+            ...(err.details ? { details: err.details } : {}),
+        });
+        return;
+    }
+    if (err instanceof ZodError) {
+        res.status(400).json({ error: "Validation error", details: err.errors });
+        return;
+    }
+    const errObj = err instanceof Error
+        ? { message: err.message, stack: err.stack, name: err.name }
+        : { raw: err };
+    logger.error({ err: errObj, method: req.method, url: req.originalUrl }, "Unhandled error: %s %s — %s", req.method, req.originalUrl, err instanceof Error ? err.message : String(err));
+    res.status(500).json({ error: "Internal server error" });
+}
+//# sourceMappingURL=error-handler.js.map

package/dist/middleware/error-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-handler.js","sourceRoot":"","sources":["../../src/middleware/error-handler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,MAAM,UAAU,YAAY,CAC1B,GAAY,EACZ,GAAY,EACZ,GAAa,EACb,KAAmB;IAEnB,IAAI,GAAG,YAAY,SAAS,EAAE,CAAC;QAC7B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;YAC1B,KAAK,EAAE,GAAG,CAAC,OAAO;YAClB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;QAC5B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACzE,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK;QACjC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;QAC5D,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IAEjB,MAAM,CAAC,KAAK,CACV,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE,EACzD,6BAA6B,EAC7B,GAAG,CAAC,MAAM,EACV,GAAG,CAAC,WAAW,EACf,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;IACF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;AAC3D,CAAC"}

package/dist/middleware/index.d.ts

@@ -0,0 +1,4 @@
+export { logger, httpLogger } from "./logger.js";
+export { errorHandler } from "./error-handler.js";
+export { validate } from "./validate.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/middleware/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC"}

package/dist/middleware/index.js

@@ -0,0 +1,4 @@
+export { logger, httpLogger } from "./logger.js";
+export { errorHandler } from "./error-handler.js";
+export { validate } from "./validate.js";
+//# sourceMappingURL=index.js.map

package/dist/middleware/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC"}

package/dist/middleware/logger.d.ts

@@ -0,0 +1,4 @@
+import pino from "pino";
+export declare const logger: pino.Logger<never, boolean>;
+export declare const httpLogger: import("pino-http").HttpLogger<import("http").IncomingMessage, import("http").ServerResponse<import("http").IncomingMessage>, never>;
+//# sourceMappingURL=logger.d.ts.map

package/dist/middleware/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/middleware/logger.ts"],"names":[],"mappings":"AAEA,OAAO,IAAI,MAAM,MAAM,CAAC;AAaxB,eAAO,MAAM,MAAM,6BAehB,CAAC;AAEJ,eAAO,MAAM,UAAU,sIAQrB,CAAC"}

package/dist/middleware/logger.js

@@ -0,0 +1,37 @@
+import path from "node:path";
+import fs from "node:fs";
+import pino from "pino";
+import { pinoHttp } from "pino-http";
+const logDir = path.resolve(process.cwd(), ".paperclip", "logs");
+fs.mkdirSync(logDir, { recursive: true });
+const logFile = path.join(logDir, "server.log");
+const sharedOpts = {
+    translateTime: "HH:MM:ss",
+    ignore: "pid,hostname",
+};
+export const logger = pino({
+    level: "debug",
+}, pino.transport({
+    targets: [
+        {
+            target: "pino-pretty",
+            options: { ...sharedOpts, ignore: "pid,hostname,req,res,responseTime", colorize: true, destination: 1 },
+            level: "info",
+        },
+        {
+            target: "pino-pretty",
+            options: { ...sharedOpts, colorize: false, destination: logFile, mkdir: true },
+            level: "debug",
+        },
+    ],
+}));
+export const httpLogger = pinoHttp({
+    logger,
+    customSuccessMessage(req, res) {
+        return `${req.method} ${req.url} ${res.statusCode}`;
+    },
+    customErrorMessage(req, res) {
+        return `${req.method} ${req.url} ${res.statusCode}`;
+    },
+});
+//# sourceMappingURL=logger.js.map

package/dist/middleware/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/middleware/logger.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;AACjE,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAE1C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AAEhD,MAAM,UAAU,GAAG;IACjB,aAAa,EAAE,UAAU;IACzB,MAAM,EAAE,cAAc;CACvB,CAAC;AAEF,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,OAAO;CACf,EAAE,IAAI,CAAC,SAAS,CAAC;IAChB,OAAO,EAAE;QACP;YACE,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,mCAAmC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;YACvG,KAAK,EAAE,MAAM;SACd;QACD;YACE,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE;YAC9E,KAAK,EAAE,OAAO;SACf;KACF;CACF,CAAC,CAAC,CAAC;AAEJ,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAC;IACjC,MAAM;IACN,oBAAoB,CAAC,GAAG,EAAE,GAAG;QAC3B,OAAO,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;IACtD,CAAC;IACD,kBAAkB,CAAC,GAAG,EAAE,GAAG;QACzB,OAAO,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;IACtD,CAAC;CACF,CAAC,CAAC"}

package/dist/middleware/private-hostname-guard.d.ts

@@ -0,0 +1,11 @@
+import type { RequestHandler } from "express";
+export declare function resolvePrivateHostnameAllowSet(opts: {
+    allowedHostnames: string[];
+    bindHost: string;
+}): Set<string>;
+export declare function privateHostnameGuard(opts: {
+    enabled: boolean;
+    allowedHostnames: string[];
+    bindHost: string;
+}): RequestHandler;
+//# sourceMappingURL=private-hostname-guard.d.ts.map

package/dist/middleware/private-hostname-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-hostname-guard.d.ts","sourceRoot":"","sources":["../../src/middleware/private-hostname-guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,cAAc,EAAE,MAAM,SAAS,CAAC;AA8BvD,wBAAgB,8BAA8B,CAAC,IAAI,EAAE;IAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAYlH;AASD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,cAAc,CAoCjB"}

package/dist/middleware/private-hostname-guard.js

@@ -0,0 +1,78 @@
+function isLoopbackHostname(hostname) {
+    const normalized = hostname.trim().toLowerCase();
+    return normalized === "localhost" || normalized === "127.0.0.1" || normalized === "::1";
+}
+function extractHostname(req) {
+    const forwardedHost = req.header("x-forwarded-host")?.split(",")[0]?.trim();
+    const hostHeader = req.header("host")?.trim();
+    const raw = forwardedHost || hostHeader;
+    if (!raw)
+        return null;
+    try {
+        return new URL(`http://${raw}`).hostname.trim().toLowerCase();
+    }
+    catch {
+        return raw.trim().toLowerCase();
+    }
+}
+function normalizeAllowedHostnames(values) {
+    const unique = new Set();
+    for (const value of values) {
+        const trimmed = value.trim().toLowerCase();
+        if (!trimmed)
+            continue;
+        unique.add(trimmed);
+    }
+    return Array.from(unique);
+}
+export function resolvePrivateHostnameAllowSet(opts) {
+    const configuredAllow = normalizeAllowedHostnames(opts.allowedHostnames);
+    const bindHost = opts.bindHost.trim().toLowerCase();
+    const allowSet = new Set(configuredAllow);
+    if (bindHost && bindHost !== "0.0.0.0") {
+        allowSet.add(bindHost);
+    }
+    allowSet.add("localhost");
+    allowSet.add("127.0.0.1");
+    allowSet.add("::1");
+    return allowSet;
+}
+function blockedHostnameMessage(hostname) {
+    return (`Hostname '${hostname}' is not allowed for this Paperclip instance. ` +
+        `If you want to allow this hostname, please run pnpm paperclipai allowed-hostname ${hostname}`);
+}
+export function privateHostnameGuard(opts) {
+    if (!opts.enabled) {
+        return (_req, _res, next) => next();
+    }
+    const allowSet = resolvePrivateHostnameAllowSet({
+        allowedHostnames: opts.allowedHostnames,
+        bindHost: opts.bindHost,
+    });
+    return (req, res, next) => {
+        const hostname = extractHostname(req);
+        const wantsJson = req.path.startsWith("/api") || req.accepts(["json", "html", "text"]) === "json";
+        if (!hostname) {
+            const error = "Missing Host header. If you want to allow a hostname, run pnpm paperclipai allowed-hostname <host>.";
+            if (wantsJson) {
+                res.status(403).json({ error });
+            }
+            else {
+                res.status(403).type("text/plain").send(error);
+            }
+            return;
+        }
+        if (isLoopbackHostname(hostname) || allowSet.has(hostname)) {
+            next();
+            return;
+        }
+        const error = blockedHostnameMessage(hostname);
+        if (wantsJson) {
+            res.status(403).json({ error });
+        }
+        else {
+            res.status(403).type("text/plain").send(error);
+        }
+    };
+}
+//# sourceMappingURL=private-hostname-guard.js.map

package/dist/middleware/private-hostname-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-hostname-guard.js","sourceRoot":"","sources":["../../src/middleware/private-hostname-guard.ts"],"names":[],"mappings":"AAEA,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjD,OAAO,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,KAAK,CAAC;AAC1F,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACnC,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAC5E,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;IAC9C,MAAM,GAAG,GAAG,aAAa,IAAI,UAAU,CAAC;IACxC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClC,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,MAAgB;IACjD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,IAAsD;IACnG,MAAM,eAAe,GAAG,yBAAyB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,eAAe,CAAC,CAAC;IAElD,IAAI,QAAQ,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACvC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC1B,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC1B,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,OAAO,CACL,aAAa,QAAQ,gDAAgD;QACrE,oFAAoF,QAAQ,EAAE,CAC/F,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAIpC;IACC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IACtC,CAAC;IAED,MAAM,QAAQ,GAAG,8BAA8B,CAAC;QAC9C,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,MAAM,CAAC;QAElG,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,qGAAqG,CAAC;YACpH,IAAI,SAAS,EAAE,CAAC;gBACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAClC,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjD,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,kBAAkB,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3D,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,SAAS,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/validate.d.ts

@@ -0,0 +1,4 @@
+import type { Request, Response, NextFunction } from "express";
+import type { ZodSchema } from "zod";
+export declare function validate(schema: ZodSchema): (req: Request, _res: Response, next: NextFunction) => void;
+//# sourceMappingURL=validate.d.ts.map

package/dist/middleware/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/middleware/validate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,KAAK,CAAC;AAErC,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,IAChC,KAAK,OAAO,EAAE,MAAM,QAAQ,EAAE,MAAM,YAAY,UAIzD"}

package/dist/middleware/validate.js

@@ -0,0 +1,7 @@
+export function validate(schema) {
+    return (req, _res, next) => {
+        req.body = schema.parse(req.body);
+        next();
+    };
+}
+//# sourceMappingURL=validate.js.map

package/dist/middleware/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/middleware/validate.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,QAAQ,CAAC,MAAiB;IACxC,OAAO,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB,EAAE,EAAE;QAC1D,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/paths.d.ts

@@ -0,0 +1,3 @@
+export declare function resolvePaperclipConfigPath(overridePath?: string): string;
+export declare function resolvePaperclipEnvPath(overrideConfigPath?: string): string;
+//# sourceMappingURL=paths.d.ts.map

package/dist/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAyBA,wBAAgB,0BAA0B,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAIxE;AAED,wBAAgB,uBAAuB,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,MAAM,CAE3E"}

package/dist/paths.js

@@ -0,0 +1,31 @@
+import fs from "node:fs";
+import path from "node:path";
+import { resolveDefaultConfigPath } from "./home-paths.js";
+const PAPERCLIP_CONFIG_BASENAME = "config.json";
+const PAPERCLIP_ENV_FILENAME = ".env";
+function findConfigFileFromAncestors(startDir) {
+    const absoluteStartDir = path.resolve(startDir);
+    let currentDir = absoluteStartDir;
+    while (true) {
+        const candidate = path.resolve(currentDir, ".paperclip", PAPERCLIP_CONFIG_BASENAME);
+        if (fs.existsSync(candidate)) {
+            return candidate;
+        }
+        const nextDir = path.resolve(currentDir, "..");
+        if (nextDir === currentDir)
+            break;
+        currentDir = nextDir;
+    }
+    return null;
+}
+export function resolvePaperclipConfigPath(overridePath) {
+    if (overridePath)
+        return path.resolve(overridePath);
+    if (process.env.PAPERCLIP_CONFIG)
+        return path.resolve(process.env.PAPERCLIP_CONFIG);
+    return findConfigFileFromAncestors(process.cwd()) ?? resolveDefaultConfigPath();
+}
+export function resolvePaperclipEnvPath(overrideConfigPath) {
+    return path.resolve(path.dirname(resolvePaperclipConfigPath(overrideConfigPath)), PAPERCLIP_ENV_FILENAME);
+}
+//# sourceMappingURL=paths.js.map

package/dist/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAE3D,MAAM,yBAAyB,GAAG,aAAa,CAAC;AAChD,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAEtC,SAAS,2BAA2B,CAAC,QAAgB;IACnD,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,UAAU,GAAG,gBAAgB,CAAC;IAElC,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,EAAE,yBAAyB,CAAC,CAAC;QACpF,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAC/C,IAAI,OAAO,KAAK,UAAU;YAAE,MAAM;QAClC,UAAU,GAAG,OAAO,CAAC;IACvB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,YAAqB;IAC9D,IAAI,YAAY;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACpD,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACpF,OAAO,2BAA2B,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,wBAAwB,EAAE,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,kBAA2B;IACjE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,0BAA0B,CAAC,kBAAkB,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;AAC5G,CAAC"}

package/dist/realtime/live-events-ws.d.ts

@@ -0,0 +1,10 @@
+import type { IncomingMessage, Server as HttpServer } from "node:http";
+import type { Db } from "@paperclipai/db";
+import type { DeploymentMode } from "@paperclipai/shared";
+import { WebSocket } from "ws";
+import type { BetterAuthSessionResult } from "../auth/better-auth.js";
+export declare function setupLiveEventsWebSocketServer(server: HttpServer, db: Db, opts: {
+    deploymentMode: DeploymentMode;
+    resolveSessionFromHeaders?: (headers: Headers) => Promise<BetterAuthSessionResult | null>;
+}): import("ws").Server<typeof WebSocket, typeof IncomingMessage>;
+//# sourceMappingURL=live-events-ws.d.ts.map

package/dist/realtime/live-events-ws.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-events-ws.d.ts","sourceRoot":"","sources":["../../src/realtime/live-events-ws.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,WAAW,CAAC;AAGvE,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAE1C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAmB,MAAM,IAAI,CAAC;AAChD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AA2ItE,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,UAAU,EAClB,EAAE,EAAE,EAAE,EACN,IAAI,EAAE;IACJ,cAAc,EAAE,cAAc,CAAC;IAC/B,yBAAyB,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;CAC3F,iEAyFF"}

package/dist/realtime/live-events-ws.js

@@ -0,0 +1,185 @@
+import { createHash } from "node:crypto";
+import { and, eq, isNull } from "drizzle-orm";
+import { agentApiKeys, companyMemberships, instanceUserRoles } from "@paperclipai/db";
+import { WebSocket, WebSocketServer } from "ws";
+import { logger } from "../middleware/logger.js";
+import { subscribeCompanyLiveEvents } from "../services/live-events.js";
+function hashToken(token) {
+    return createHash("sha256").update(token).digest("hex");
+}
+function rejectUpgrade(socket, statusLine, message) {
+    const safe = message.replace(/[\r\n]+/g, " ").trim();
+    socket.write(`HTTP/1.1 ${statusLine}\r\nConnection: close\r\nContent-Type: text/plain\r\n\r\n${safe}`);
+    socket.destroy();
+}
+function parseCompanyId(pathname) {
+    const match = pathname.match(/^\/api\/companies\/([^/]+)\/events\/ws$/);
+    if (!match)
+        return null;
+    try {
+        return decodeURIComponent(match[1] ?? "");
+    }
+    catch {
+        return null;
+    }
+}
+function parseBearerToken(rawAuth) {
+    const auth = Array.isArray(rawAuth) ? rawAuth[0] : rawAuth;
+    if (!auth)
+        return null;
+    if (!auth.toLowerCase().startsWith("bearer "))
+        return null;
+    const token = auth.slice("bearer ".length).trim();
+    return token.length > 0 ? token : null;
+}
+function headersFromIncomingMessage(req) {
+    const headers = new Headers();
+    for (const [key, raw] of Object.entries(req.headers)) {
+        if (!raw)
+            continue;
+        if (Array.isArray(raw)) {
+            for (const value of raw)
+                headers.append(key, value);
+            continue;
+        }
+        headers.set(key, raw);
+    }
+    return headers;
+}
+async function authorizeUpgrade(db, req, companyId, url, opts) {
+    const queryToken = url.searchParams.get("token")?.trim() ?? "";
+    const authToken = parseBearerToken(req.headers.authorization);
+    const token = authToken ?? (queryToken.length > 0 ? queryToken : null);
+    // Browser board context has no bearer token in local_trusted and authenticated modes.
+    if (!token) {
+        if (opts.deploymentMode === "local_trusted") {
+            return {
+                companyId,
+                actorType: "board",
+                actorId: "board",
+            };
+        }
+        if (opts.deploymentMode !== "authenticated" || !opts.resolveSessionFromHeaders) {
+            return null;
+        }
+        const session = await opts.resolveSessionFromHeaders(headersFromIncomingMessage(req));
+        const userId = session?.user?.id;
+        if (!userId)
+            return null;
+        const [roleRow, memberships] = await Promise.all([
+            db
+                .select({ id: instanceUserRoles.id })
+                .from(instanceUserRoles)
+                .where(and(eq(instanceUserRoles.userId, userId), eq(instanceUserRoles.role, "instance_admin")))
+                .then((rows) => rows[0] ?? null),
+            db
+                .select({ companyId: companyMemberships.companyId })
+                .from(companyMemberships)
+                .where(and(eq(companyMemberships.principalType, "user"), eq(companyMemberships.principalId, userId), eq(companyMemberships.status, "active"))),
+        ]);
+        const hasCompanyMembership = memberships.some((row) => row.companyId === companyId);
+        if (!roleRow && !hasCompanyMembership)
+            return null;
+        return {
+            companyId,
+            actorType: "board",
+            actorId: userId,
+        };
+    }
+    const tokenHash = hashToken(token);
+    const key = await db
+        .select()
+        .from(agentApiKeys)
+        .where(and(eq(agentApiKeys.keyHash, tokenHash), isNull(agentApiKeys.revokedAt)))
+        .then((rows) => rows[0] ?? null);
+    if (!key || key.companyId !== companyId) {
+        return null;
+    }
+    await db
+        .update(agentApiKeys)
+        .set({ lastUsedAt: new Date() })
+        .where(eq(agentApiKeys.id, key.id));
+    return {
+        companyId,
+        actorType: "agent",
+        actorId: key.agentId,
+    };
+}
+export function setupLiveEventsWebSocketServer(server, db, opts) {
+    const wss = new WebSocketServer({ noServer: true });
+    const cleanupByClient = new Map();
+    const aliveByClient = new Map();
+    const pingInterval = setInterval(() => {
+        for (const socket of wss.clients) {
+            if (!aliveByClient.get(socket)) {
+                socket.terminate();
+                continue;
+            }
+            aliveByClient.set(socket, false);
+            socket.ping();
+        }
+    }, 30000);
+    wss.on("connection", (socket, req) => {
+        const context = req.paperclipUpgradeContext;
+        if (!context) {
+            socket.close(1008, "missing context");
+            return;
+        }
+        const unsubscribe = subscribeCompanyLiveEvents(context.companyId, (event) => {
+            if (socket.readyState !== WebSocket.OPEN)
+                return;
+            socket.send(JSON.stringify(event));
+        });
+        cleanupByClient.set(socket, unsubscribe);
+        aliveByClient.set(socket, true);
+        socket.on("pong", () => {
+            aliveByClient.set(socket, true);
+        });
+        socket.on("close", () => {
+            const cleanup = cleanupByClient.get(socket);
+            if (cleanup)
+                cleanup();
+            cleanupByClient.delete(socket);
+            aliveByClient.delete(socket);
+        });
+        socket.on("error", (err) => {
+            logger.warn({ err, companyId: context.companyId }, "live websocket client error");
+        });
+    });
+    wss.on("close", () => {
+        clearInterval(pingInterval);
+    });
+    server.on("upgrade", (req, socket, head) => {
+        if (!req.url) {
+            rejectUpgrade(socket, "400 Bad Request", "missing url");
+            return;
+        }
+        const url = new URL(req.url, "http://localhost");
+        const companyId = parseCompanyId(url.pathname);
+        if (!companyId) {
+            socket.destroy();
+            return;
+        }
+        void authorizeUpgrade(db, req, companyId, url, {
+            deploymentMode: opts.deploymentMode,
+            resolveSessionFromHeaders: opts.resolveSessionFromHeaders,
+        })
+            .then((context) => {
+            if (!context) {
+                rejectUpgrade(socket, "403 Forbidden", "forbidden");
+                return;
+            }
+            const reqWithContext = req;
+            reqWithContext.paperclipUpgradeContext = context;
+            wss.handleUpgrade(req, socket, head, (ws) => {
+                wss.emit("connection", ws, reqWithContext);
+            });
+        })
+            .catch((err) => {
+            logger.error({ err, path: req.url }, "failed websocket upgrade authorization");
+            rejectUpgrade(socket, "500 Internal Server Error", "upgrade failed");
+        });
+    });
+    return wss;
+}
+//# sourceMappingURL=live-events-ws.js.map

package/dist/realtime/live-events-ws.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-events-ws.js","sourceRoot":"","sources":["../../src/realtime/live-events-ws.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEtF,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,IAAI,CAAC;AAEhD,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AAYxE,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,aAAa,CAAC,MAAc,EAAE,UAAkB,EAAE,OAAe;IACxE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,CAAC,KAAK,CAAC,YAAY,UAAU,4DAA4D,IAAI,EAAE,CAAC,CAAC;IACvG,MAAM,CAAC,OAAO,EAAE,CAAC;AACnB,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACxE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAsC;IAC9D,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC3D,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAED,SAAS,0BAA0B,CAAC,GAAoB;IACtD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,KAAK,MAAM,KAAK,IAAI,GAAG;gBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpD,SAAS;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,EAAM,EACN,GAAoB,EACpB,SAAiB,EACjB,GAAQ,EACR,IAGC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC/D,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,SAAS,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAEvE,sFAAsF;IACtF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,IAAI,CAAC,cAAc,KAAK,eAAe,EAAE,CAAC;YAC5C,OAAO;gBACL,SAAS;gBACT,SAAS,EAAE,OAAO;gBAClB,OAAO,EAAE,OAAO;aACjB,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,cAAc,KAAK,eAAe,IAAI,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC;YAC/E,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC;QACtF,MAAM,MAAM,GAAG,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEzB,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC/C,EAAE;iBACC,MAAM,CAAC,EAAE,EAAE,EAAE,iBAAiB,CAAC,EAAE,EAAE,CAAC;iBACpC,IAAI,CAAC,iBAAiB,CAAC;iBACvB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC;iBAC9F,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;YAClC,EAAE;iBACC,MAAM,CAAC,EAAE,SAAS,EAAE,kBAAkB,CAAC,SAAS,EAAE,CAAC;iBACnD,IAAI,CAAC,kBAAkB,CAAC;iBACxB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,kBAAkB,CAAC,aAAa,EAAE,MAAM,CAAC,EAC5C,EAAE,CAAC,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC,EAC1C,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,QAAQ,CAAC,CACxC,CACF;SACJ,CAAC,CAAC;QAEH,MAAM,oBAAoB,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;QACpF,IAAI,CAAC,OAAO,IAAI,CAAC,oBAAoB;YAAE,OAAO,IAAI,CAAC;QAEnD,OAAO;YACL,SAAS;YACT,SAAS,EAAE,OAAO;YAClB,OAAO,EAAE,MAAM;SAChB,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,MAAM,EAAE;SACjB,MAAM,EAAE;SACR,IAAI,CAAC,YAAY,CAAC;SAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;SAC/E,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IAEnC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE;SACL,MAAM,CAAC,YAAY,CAAC;SACpB,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;SAC/B,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAEtC,OAAO;QACL,SAAS;QACT,SAAS,EAAE,OAAO;QAClB,OAAO,EAAE,GAAG,CAAC,OAAO;KACrB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,MAAkB,EAClB,EAAM,EACN,IAGC;IAED,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,MAAM,eAAe,GAAG,IAAI,GAAG,EAAyB,CAAC;IACzD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAsB,CAAC;IAEpD,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;QACpC,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/B,MAAM,CAAC,SAAS,EAAE,CAAC;gBACnB,SAAS;YACX,CAAC;YACD,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACjC,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,CAAC;IACH,CAAC,EAAE,KAAK,CAAC,CAAC;IAEV,GAAG,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;QACnC,MAAM,OAAO,GAAI,GAAkC,CAAC,uBAAuB,CAAC;QAC5E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,0BAA0B,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1E,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI;gBAAE,OAAO;YACjD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACzC,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAEhC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YACrB,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACtB,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC5C,IAAI,OAAO;gBAAE,OAAO,EAAE,CAAC;YACvB,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/B,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,6BAA6B,CAAC,CAAC;QACpF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACnB,aAAa,CAAC,YAAY,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QACzC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YACb,aAAa,CAAC,MAAM,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,KAAK,gBAAgB,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE;YAC7C,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;SAC1D,CAAC;aACC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YAChB,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,aAAa,CAAC,MAAM,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC;gBACpD,OAAO;YACT,CAAC;YAED,MAAM,cAAc,GAAG,GAAiC,CAAC;YACzD,cAAc,CAAC,uBAAuB,GAAG,OAAO,CAAC;YAEjD,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;gBAC1C,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,EAAE,cAAc,CAAC,CAAC;YAC7C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,wCAAwC,CAAC,CAAC;YAC/E,aAAa,CAAC,MAAM,EAAE,2BAA2B,EAAE,gBAAgB,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/redaction.d.ts

@@ -0,0 +1,4 @@
+export declare const REDACTED_EVENT_VALUE = "***REDACTED***";
+export declare function sanitizeRecord(record: Record<string, unknown>): Record<string, unknown>;
+export declare function redactEventPayload(payload: Record<string, unknown> | null): Record<string, unknown> | null;
+//# sourceMappingURL=redaction.d.ts.map

package/dist/redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;AA2BrD,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAsBvF;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAI1G"}

package/dist/redaction.js

@@ -0,0 +1,63 @@
+const SECRET_PAYLOAD_KEY_RE = /(api[-_]?key|access[-_]?token|auth(?:_?token)?|authorization|bearer|secret|passwd|password|credential|jwt|private[-_]?key|cookie|connectionstring)/i;
+const JWT_VALUE_RE = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+)?$/;
+export const REDACTED_EVENT_VALUE = "***REDACTED***";
+function isPlainObject(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return false;
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+}
+function sanitizeValue(value) {
+    if (value === null || value === undefined)
+        return value;
+    if (Array.isArray(value))
+        return value.map(sanitizeValue);
+    if (isSecretRefBinding(value))
+        return value;
+    if (isPlainBinding(value))
+        return { type: "plain", value: sanitizeValue(value.value) };
+    if (!isPlainObject(value))
+        return value;
+    return sanitizeRecord(value);
+}
+function isSecretRefBinding(value) {
+    if (!isPlainObject(value))
+        return false;
+    return value.type === "secret_ref" && typeof value.secretId === "string";
+}
+function isPlainBinding(value) {
+    if (!isPlainObject(value))
+        return false;
+    return value.type === "plain" && "value" in value;
+}
+export function sanitizeRecord(record) {
+    const redacted = {};
+    for (const [key, value] of Object.entries(record)) {
+        if (SECRET_PAYLOAD_KEY_RE.test(key)) {
+            if (isSecretRefBinding(value)) {
+                redacted[key] = sanitizeValue(value);
+                continue;
+            }
+            if (isPlainBinding(value)) {
+                redacted[key] = { type: "plain", value: REDACTED_EVENT_VALUE };
+                continue;
+            }
+            redacted[key] = REDACTED_EVENT_VALUE;
+            continue;
+        }
+        if (typeof value === "string" && JWT_VALUE_RE.test(value)) {
+            redacted[key] = REDACTED_EVENT_VALUE;
+            continue;
+        }
+        redacted[key] = sanitizeValue(value);
+    }
+    return redacted;
+}
+export function redactEventPayload(payload) {
+    if (!payload)
+        return null;
+    if (!isPlainObject(payload))
+        return payload;
+    return sanitizeRecord(payload);
+}
+//# sourceMappingURL=redaction.js.map