@paperclipai_dld/server 2026.319.0-canary.3

package/dist/board-claim.js

@@ -0,0 +1,115 @@
+import { randomBytes } from "node:crypto";
+import { and, eq } from "drizzle-orm";
+import { companies, companyMemberships, instanceUserRoles } from "@paperclipai_dld/db";
+const LOCAL_BOARD_USER_ID = "local-board";
+const CLAIM_TTL_MS = 1000 * 60 * 60 * 24;
+let activeChallenge = null;
+function createChallenge(now = new Date()) {
+    return {
+        token: randomBytes(24).toString("hex"),
+        code: randomBytes(12).toString("hex"),
+        createdAt: now,
+        expiresAt: new Date(now.getTime() + CLAIM_TTL_MS),
+        claimedAt: null,
+        claimedByUserId: null,
+    };
+}
+function getChallengeStatus(token, code) {
+    if (!activeChallenge)
+        return "invalid";
+    if (activeChallenge.token !== token)
+        return "invalid";
+    if (activeChallenge.code !== (code ?? ""))
+        return "invalid";
+    if (activeChallenge.claimedAt)
+        return "claimed";
+    if (activeChallenge.expiresAt.getTime() <= Date.now())
+        return "expired";
+    return "available";
+}
+export async function initializeBoardClaimChallenge(db, opts) {
+    if (opts.deploymentMode !== "authenticated") {
+        activeChallenge = null;
+        return;
+    }
+    const admins = await db
+        .select({ userId: instanceUserRoles.userId })
+        .from(instanceUserRoles)
+        .where(eq(instanceUserRoles.role, "instance_admin"));
+    const onlyLocalBoardAdmin = admins.length === 1 && admins[0]?.userId === LOCAL_BOARD_USER_ID;
+    if (!onlyLocalBoardAdmin) {
+        activeChallenge = null;
+        return;
+    }
+    if (!activeChallenge || activeChallenge.expiresAt.getTime() <= Date.now() || activeChallenge.claimedAt) {
+        activeChallenge = createChallenge();
+    }
+}
+export function getBoardClaimWarningUrl(host, port) {
+    if (!activeChallenge)
+        return null;
+    if (activeChallenge.claimedAt || activeChallenge.expiresAt.getTime() <= Date.now())
+        return null;
+    const visibleHost = host === "0.0.0.0" ? "localhost" : host;
+    return `http://${visibleHost}:${port}/board-claim/${activeChallenge.token}?code=${activeChallenge.code}`;
+}
+export function inspectBoardClaimChallenge(token, code) {
+    const status = getChallengeStatus(token, code);
+    return {
+        status,
+        requiresSignIn: true,
+        expiresAt: activeChallenge?.expiresAt?.toISOString() ?? null,
+        claimedByUserId: activeChallenge?.claimedByUserId ?? null,
+    };
+}
+export async function claimBoardOwnership(db, opts) {
+    const status = getChallengeStatus(opts.token, opts.code);
+    if (status !== "available")
+        return { status };
+    await db.transaction(async (tx) => {
+        const existingTargetAdmin = await tx
+            .select({ id: instanceUserRoles.id })
+            .from(instanceUserRoles)
+            .where(and(eq(instanceUserRoles.userId, opts.userId), eq(instanceUserRoles.role, "instance_admin")))
+            .then((rows) => rows[0] ?? null);
+        if (!existingTargetAdmin) {
+            await tx.insert(instanceUserRoles).values({
+                userId: opts.userId,
+                role: "instance_admin",
+            });
+        }
+        await tx
+            .delete(instanceUserRoles)
+            .where(and(eq(instanceUserRoles.userId, LOCAL_BOARD_USER_ID), eq(instanceUserRoles.role, "instance_admin")));
+        const allCompanies = await tx.select({ id: companies.id }).from(companies);
+        for (const company of allCompanies) {
+            const existing = await tx
+                .select({ id: companyMemberships.id, status: companyMemberships.status })
+                .from(companyMemberships)
+                .where(and(eq(companyMemberships.companyId, company.id), eq(companyMemberships.principalType, "user"), eq(companyMemberships.principalId, opts.userId)))
+                .then((rows) => rows[0] ?? null);
+            if (!existing) {
+                await tx.insert(companyMemberships).values({
+                    companyId: company.id,
+                    principalType: "user",
+                    principalId: opts.userId,
+                    status: "active",
+                    membershipRole: "owner",
+                });
+                continue;
+            }
+            if (existing.status !== "active") {
+                await tx
+                    .update(companyMemberships)
+                    .set({ status: "active", membershipRole: "owner", updatedAt: new Date() })
+                    .where(eq(companyMemberships.id, existing.id));
+            }
+        }
+    });
+    if (activeChallenge && activeChallenge.token === opts.token) {
+        activeChallenge.claimedAt = new Date();
+        activeChallenge.claimedByUserId = opts.userId;
+    }
+    return { status: "claimed", claimedByUserId: opts.userId };
+}
+//# sourceMappingURL=board-claim.js.map

package/dist/board-claim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"board-claim.js","sourceRoot":"","sources":["../src/board-claim.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtC,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAGvF,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAC1C,MAAM,YAAY,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAazC,IAAI,eAAe,GAA0B,IAAI,CAAC;AAElD,SAAS,eAAe,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE;IACvC,OAAO;QACL,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QACtC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QACrC,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,YAAY,CAAC;QACjD,SAAS,EAAE,IAAI;QACf,eAAe,EAAE,IAAI;KACtB,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa,EAAE,IAAwB;IACjE,IAAI,CAAC,eAAe;QAAE,OAAO,SAAS,CAAC;IACvC,IAAI,eAAe,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IACtD,IAAI,eAAe,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,eAAe,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IAChD,IAAI,eAAe,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,SAAS,CAAC;IACxE,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,EAAM,EACN,IAAwC;IAExC,IAAI,IAAI,CAAC,cAAc,KAAK,eAAe,EAAE,CAAC;QAC5C,eAAe,GAAG,IAAI,CAAC;QACvB,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC,EAAE,MAAM,EAAE,iBAAiB,CAAC,MAAM,EAAE,CAAC;SAC5C,IAAI,CAAC,iBAAiB,CAAC;SACvB,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAEvD,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,mBAAmB,CAAC;IAC7F,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,eAAe,GAAG,IAAI,CAAC;QACvB,OAAO;IACT,CAAC;IAED,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC,SAAS,EAAE,CAAC;QACvG,eAAe,GAAG,eAAe,EAAE,CAAC;IACtC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAY,EAAE,IAAY;IAChE,IAAI,CAAC,eAAe;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,eAAe,CAAC,SAAS,IAAI,eAAe,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IAChG,MAAM,WAAW,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,OAAO,UAAU,WAAW,IAAI,IAAI,gBAAgB,eAAe,CAAC,KAAK,SAAS,eAAe,CAAC,IAAI,EAAE,CAAC;AAC3G,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAa,EAAE,IAAwB;IAChF,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC/C,OAAO;QACL,MAAM;QACN,cAAc,EAAE,IAAI;QACpB,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,IAAI;QAC5D,eAAe,EAAE,eAAe,EAAE,eAAe,IAAI,IAAI;KAC1D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAM,EACN,IAAiE;IAEjE,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,MAAM,KAAK,WAAW;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAE9C,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QAChC,MAAM,mBAAmB,GAAG,MAAM,EAAE;aACjC,MAAM,CAAC,EAAE,EAAE,EAAE,iBAAiB,CAAC,EAAE,EAAE,CAAC;aACpC,IAAI,CAAC,iBAAiB,CAAC;aACvB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC;aACnG,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,MAAM,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC;gBACxC,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,IAAI,EAAE,gBAAgB;aACvB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE;aACL,MAAM,CAAC,iBAAiB,CAAC;aACzB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,mBAAmB,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;QAE/G,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3E,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAG,MAAM,EAAE;iBACtB,MAAM,CAAC,EAAE,EAAE,EAAE,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,kBAAkB,CAAC,MAAM,EAAE,CAAC;iBACxE,IAAI,CAAC,kBAAkB,CAAC;iBACxB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,kBAAkB,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,EAC5C,EAAE,CAAC,kBAAkB,CAAC,aAAa,EAAE,MAAM,CAAC,EAC5C,EAAE,CAAC,kBAAkB,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,CAChD,CACF;iBACA,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YAEnC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC;oBACzC,SAAS,EAAE,OAAO,CAAC,EAAE;oBACrB,aAAa,EAAE,MAAM;oBACrB,WAAW,EAAE,IAAI,CAAC,MAAM;oBACxB,MAAM,EAAE,QAAQ;oBAChB,cAAc,EAAE,OAAO;iBACxB,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACjC,MAAM,EAAE;qBACL,MAAM,CAAC,kBAAkB,CAAC;qBAC1B,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;qBACzE,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,eAAe,IAAI,eAAe,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QAC5D,eAAe,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QACvC,eAAe,CAAC,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC;IAChD,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;AAC7D,CAAC"}

package/dist/config-file.d.ts

@@ -0,0 +1,3 @@
+import { type PaperclipConfig } from "@paperclipai_dld/shared";
+export declare function readConfigFile(): PaperclipConfig | null;
+//# sourceMappingURL=config-file.d.ts.map

package/dist/config-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-file.d.ts","sourceRoot":"","sources":["../src/config-file.ts"],"names":[],"mappings":"AACA,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAGtF,wBAAgB,cAAc,IAAI,eAAe,GAAG,IAAI,CAWvD"}

package/dist/config-file.js

@@ -0,0 +1,16 @@
+import fs from "node:fs";
+import { paperclipConfigSchema } from "@paperclipai_dld/shared";
+import { resolvePaperclipConfigPath } from "./paths.js";
+export function readConfigFile() {
+    const configPath = resolvePaperclipConfigPath();
+    if (!fs.existsSync(configPath))
+        return null;
+    try {
+        const raw = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+        return paperclipConfigSchema.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=config-file.js.map

package/dist/config-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-file.js","sourceRoot":"","sources":["../src/config-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,qBAAqB,EAAwB,MAAM,yBAAyB,CAAC;AACtF,OAAO,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAExD,MAAM,UAAU,cAAc;IAC5B,MAAM,UAAU,GAAG,0BAA0B,EAAE,CAAC;IAEhD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7D,OAAO,qBAAqB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,38 @@
+import { type AuthBaseUrlMode, type DeploymentExposure, type DeploymentMode, type SecretProvider, type StorageProvider } from "@paperclipai_dld/shared";
+type DatabaseMode = "embedded-postgres" | "postgres";
+export interface Config {
+    deploymentMode: DeploymentMode;
+    deploymentExposure: DeploymentExposure;
+    host: string;
+    port: number;
+    allowedHostnames: string[];
+    authBaseUrlMode: AuthBaseUrlMode;
+    authPublicBaseUrl: string | undefined;
+    authDisableSignUp: boolean;
+    databaseMode: DatabaseMode;
+    databaseUrl: string | undefined;
+    embeddedPostgresDataDir: string;
+    embeddedPostgresPort: number;
+    databaseBackupEnabled: boolean;
+    databaseBackupIntervalMinutes: number;
+    databaseBackupRetentionDays: number;
+    databaseBackupDir: string;
+    serveUi: boolean;
+    uiDevMiddleware: boolean;
+    secretsProvider: SecretProvider;
+    secretsStrictMode: boolean;
+    secretsMasterKeyFilePath: string;
+    storageProvider: StorageProvider;
+    storageLocalDiskBaseDir: string;
+    storageS3Bucket: string;
+    storageS3Region: string;
+    storageS3Endpoint: string | undefined;
+    storageS3Prefix: string;
+    storageS3ForcePathStyle: boolean;
+    heartbeatSchedulerEnabled: boolean;
+    heartbeatSchedulerIntervalMs: number;
+    companyDeletionEnabled: boolean;
+}
+export declare function loadConfig(): Config;
+export {};
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAKA,OAAO,EAML,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,eAAe,EACrB,MAAM,yBAAyB,CAAC;AAsBjC,KAAK,YAAY,GAAG,mBAAmB,GAAG,UAAU,CAAC;AAErD,MAAM,WAAW,MAAM;IACrB,cAAc,EAAE,cAAc,CAAC;IAC/B,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,eAAe,EAAE,eAAe,CAAC;IACjC,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,iBAAiB,EAAE,OAAO,CAAC;IAC3B,YAAY,EAAE,YAAY,CAAC;IAC3B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,uBAAuB,EAAE,MAAM,CAAC;IAChC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,6BAA6B,EAAE,MAAM,CAAC;IACtC,2BAA2B,EAAE,MAAM,CAAC;IACpC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,OAAO,CAAC;IACzB,eAAe,EAAE,cAAc,CAAC;IAChC,iBAAiB,EAAE,OAAO,CAAC;IAC3B,wBAAwB,EAAE,MAAM,CAAC;IACjC,eAAe,EAAE,eAAe,CAAC;IACjC,uBAAuB,EAAE,MAAM,CAAC;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,OAAO,CAAC;IACjC,yBAAyB,EAAE,OAAO,CAAC;IACnC,4BAA4B,EAAE,MAAM,CAAC;IACrC,sBAAsB,EAAE,OAAO,CAAC;CACjC;AAED,wBAAgB,UAAU,IAAI,MAAM,CAqLnC"}

package/dist/config.js

@@ -0,0 +1,162 @@
+import { readConfigFile } from "./config-file.js";
+import { existsSync, realpathSync } from "node:fs";
+import { resolve } from "node:path";
+import { config as loadDotenv } from "dotenv";
+import { resolvePaperclipEnvPath } from "./paths.js";
+import { AUTH_BASE_URL_MODES, DEPLOYMENT_EXPOSURES, DEPLOYMENT_MODES, SECRET_PROVIDERS, STORAGE_PROVIDERS, } from "@paperclipai_dld/shared";
+import { resolveDefaultBackupDir, resolveDefaultEmbeddedPostgresDir, resolveDefaultSecretsKeyFilePath, resolveDefaultStorageDir, resolveHomeAwarePath, } from "./home-paths.js";
+const PAPERCLIP_ENV_FILE_PATH = resolvePaperclipEnvPath();
+if (existsSync(PAPERCLIP_ENV_FILE_PATH)) {
+    loadDotenv({ path: PAPERCLIP_ENV_FILE_PATH, override: false, quiet: true });
+}
+const CWD_ENV_PATH = resolve(process.cwd(), ".env");
+const isSameFile = existsSync(CWD_ENV_PATH) && existsSync(PAPERCLIP_ENV_FILE_PATH)
+    ? realpathSync(CWD_ENV_PATH) === realpathSync(PAPERCLIP_ENV_FILE_PATH)
+    : CWD_ENV_PATH === PAPERCLIP_ENV_FILE_PATH;
+if (!isSameFile && existsSync(CWD_ENV_PATH)) {
+    loadDotenv({ path: CWD_ENV_PATH, override: false, quiet: true });
+}
+export function loadConfig() {
+    const fileConfig = readConfigFile();
+    const fileDatabaseMode = (fileConfig?.database.mode === "postgres" ? "postgres" : "embedded-postgres");
+    const fileDbUrl = fileDatabaseMode === "postgres"
+        ? fileConfig?.database.connectionString
+        : undefined;
+    const fileDatabaseBackup = fileConfig?.database.backup;
+    const fileSecrets = fileConfig?.secrets;
+    const fileStorage = fileConfig?.storage;
+    const strictModeFromEnv = process.env.PAPERCLIP_SECRETS_STRICT_MODE;
+    const secretsStrictMode = strictModeFromEnv !== undefined
+        ? strictModeFromEnv === "true"
+        : (fileSecrets?.strictMode ?? false);
+    const providerFromEnvRaw = process.env.PAPERCLIP_SECRETS_PROVIDER;
+    const providerFromEnv = providerFromEnvRaw && SECRET_PROVIDERS.includes(providerFromEnvRaw)
+        ? providerFromEnvRaw
+        : null;
+    const providerFromFile = fileSecrets?.provider;
+    const secretsProvider = providerFromEnv ?? providerFromFile ?? "local_encrypted";
+    const storageProviderFromEnvRaw = process.env.PAPERCLIP_STORAGE_PROVIDER;
+    const storageProviderFromEnv = storageProviderFromEnvRaw && STORAGE_PROVIDERS.includes(storageProviderFromEnvRaw)
+        ? storageProviderFromEnvRaw
+        : null;
+    const storageProvider = storageProviderFromEnv ?? fileStorage?.provider ?? "local_disk";
+    const storageLocalDiskBaseDir = resolveHomeAwarePath(process.env.PAPERCLIP_STORAGE_LOCAL_DIR ??
+        fileStorage?.localDisk?.baseDir ??
+        resolveDefaultStorageDir());
+    const storageS3Bucket = process.env.PAPERCLIP_STORAGE_S3_BUCKET ?? fileStorage?.s3?.bucket ?? "paperclip";
+    const storageS3Region = process.env.PAPERCLIP_STORAGE_S3_REGION ?? fileStorage?.s3?.region ?? "us-east-1";
+    const storageS3Endpoint = process.env.PAPERCLIP_STORAGE_S3_ENDPOINT ?? fileStorage?.s3?.endpoint ?? undefined;
+    const storageS3Prefix = process.env.PAPERCLIP_STORAGE_S3_PREFIX ?? fileStorage?.s3?.prefix ?? "";
+    const storageS3ForcePathStyle = process.env.PAPERCLIP_STORAGE_S3_FORCE_PATH_STYLE !== undefined
+        ? process.env.PAPERCLIP_STORAGE_S3_FORCE_PATH_STYLE === "true"
+        : (fileStorage?.s3?.forcePathStyle ?? false);
+    const deploymentModeFromEnvRaw = process.env.PAPERCLIP_DEPLOYMENT_MODE;
+    const deploymentModeFromEnv = deploymentModeFromEnvRaw && DEPLOYMENT_MODES.includes(deploymentModeFromEnvRaw)
+        ? deploymentModeFromEnvRaw
+        : null;
+    const deploymentMode = deploymentModeFromEnv ?? fileConfig?.server.deploymentMode ?? "local_trusted";
+    const deploymentExposureFromEnvRaw = process.env.PAPERCLIP_DEPLOYMENT_EXPOSURE;
+    const deploymentExposureFromEnv = deploymentExposureFromEnvRaw &&
+        DEPLOYMENT_EXPOSURES.includes(deploymentExposureFromEnvRaw)
+        ? deploymentExposureFromEnvRaw
+        : null;
+    const deploymentExposure = deploymentMode === "local_trusted"
+        ? "private"
+        : (deploymentExposureFromEnv ?? fileConfig?.server.exposure ?? "private");
+    const authBaseUrlModeFromEnvRaw = process.env.PAPERCLIP_AUTH_BASE_URL_MODE;
+    const authBaseUrlModeFromEnv = authBaseUrlModeFromEnvRaw &&
+        AUTH_BASE_URL_MODES.includes(authBaseUrlModeFromEnvRaw)
+        ? authBaseUrlModeFromEnvRaw
+        : null;
+    const publicUrlFromEnv = process.env.PAPERCLIP_PUBLIC_URL;
+    const authPublicBaseUrlRaw = process.env.PAPERCLIP_AUTH_PUBLIC_BASE_URL ??
+        process.env.BETTER_AUTH_URL ??
+        process.env.BETTER_AUTH_BASE_URL ??
+        publicUrlFromEnv ??
+        fileConfig?.auth?.publicBaseUrl;
+    const authPublicBaseUrl = authPublicBaseUrlRaw?.trim() || undefined;
+    const authBaseUrlMode = authBaseUrlModeFromEnv ??
+        fileConfig?.auth?.baseUrlMode ??
+        (authPublicBaseUrl ? "explicit" : "auto");
+    const disableSignUpFromEnv = process.env.PAPERCLIP_AUTH_DISABLE_SIGN_UP;
+    const authDisableSignUp = disableSignUpFromEnv !== undefined
+        ? disableSignUpFromEnv === "true"
+        : (fileConfig?.auth?.disableSignUp ?? false);
+    const allowedHostnamesFromEnvRaw = process.env.PAPERCLIP_ALLOWED_HOSTNAMES;
+    const allowedHostnamesFromEnv = allowedHostnamesFromEnvRaw
+        ? allowedHostnamesFromEnvRaw
+            .split(",")
+            .map((value) => value.trim().toLowerCase())
+            .filter((value) => value.length > 0)
+        : null;
+    const publicUrlHostname = authPublicBaseUrl
+        ? (() => {
+            try {
+                return new URL(authPublicBaseUrl).hostname.trim().toLowerCase();
+            }
+            catch {
+                return null;
+            }
+        })()
+        : null;
+    const allowedHostnames = Array.from(new Set([
+        ...(allowedHostnamesFromEnv ?? fileConfig?.server.allowedHostnames ?? []),
+        ...(publicUrlHostname ? [publicUrlHostname] : []),
+    ]
+        .map((value) => value.trim().toLowerCase())
+        .filter(Boolean)));
+    const companyDeletionEnvRaw = process.env.PAPERCLIP_ENABLE_COMPANY_DELETION;
+    const companyDeletionEnabled = companyDeletionEnvRaw !== undefined
+        ? companyDeletionEnvRaw === "true"
+        : deploymentMode === "local_trusted";
+    const databaseBackupEnabled = process.env.PAPERCLIP_DB_BACKUP_ENABLED !== undefined
+        ? process.env.PAPERCLIP_DB_BACKUP_ENABLED === "true"
+        : (fileDatabaseBackup?.enabled ?? true);
+    const databaseBackupIntervalMinutes = Math.max(1, Number(process.env.PAPERCLIP_DB_BACKUP_INTERVAL_MINUTES) ||
+        fileDatabaseBackup?.intervalMinutes ||
+        60);
+    const databaseBackupRetentionDays = Math.max(1, Number(process.env.PAPERCLIP_DB_BACKUP_RETENTION_DAYS) ||
+        fileDatabaseBackup?.retentionDays ||
+        30);
+    const databaseBackupDir = resolveHomeAwarePath(process.env.PAPERCLIP_DB_BACKUP_DIR ??
+        fileDatabaseBackup?.dir ??
+        resolveDefaultBackupDir());
+    return {
+        deploymentMode,
+        deploymentExposure,
+        host: process.env.HOST ?? fileConfig?.server.host ?? "127.0.0.1",
+        port: Number(process.env.PORT) || fileConfig?.server.port || 3100,
+        allowedHostnames,
+        authBaseUrlMode,
+        authPublicBaseUrl,
+        authDisableSignUp,
+        databaseMode: fileDatabaseMode,
+        databaseUrl: process.env.DATABASE_URL ?? fileDbUrl,
+        embeddedPostgresDataDir: resolveHomeAwarePath(fileConfig?.database.embeddedPostgresDataDir ?? resolveDefaultEmbeddedPostgresDir()),
+        embeddedPostgresPort: fileConfig?.database.embeddedPostgresPort ?? 54329,
+        databaseBackupEnabled,
+        databaseBackupIntervalMinutes,
+        databaseBackupRetentionDays,
+        databaseBackupDir,
+        serveUi: process.env.SERVE_UI !== undefined
+            ? process.env.SERVE_UI === "true"
+            : fileConfig?.server.serveUi ?? true,
+        uiDevMiddleware: process.env.PAPERCLIP_UI_DEV_MIDDLEWARE === "true",
+        secretsProvider,
+        secretsStrictMode,
+        secretsMasterKeyFilePath: resolveHomeAwarePath(process.env.PAPERCLIP_SECRETS_MASTER_KEY_FILE ??
+            fileSecrets?.localEncrypted.keyFilePath ??
+            resolveDefaultSecretsKeyFilePath()),
+        storageProvider,
+        storageLocalDiskBaseDir,
+        storageS3Bucket,
+        storageS3Region,
+        storageS3Endpoint,
+        storageS3Prefix,
+        storageS3ForcePathStyle,
+        heartbeatSchedulerEnabled: process.env.HEARTBEAT_SCHEDULER_ENABLED !== "false",
+        heartbeatSchedulerIntervalMs: Math.max(10000, Number(process.env.HEARTBEAT_SCHEDULER_INTERVAL_MS) || 30000),
+        companyDeletionEnabled,
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,GAMlB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,uBAAuB,EACvB,iCAAiC,EACjC,gCAAgC,EAChC,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,uBAAuB,GAAG,uBAAuB,EAAE,CAAC;AAC1D,IAAI,UAAU,CAAC,uBAAuB,CAAC,EAAE,CAAC;IACxC,UAAU,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;AACpD,MAAM,UAAU,GAAG,UAAU,CAAC,YAAY,CAAC,IAAI,UAAU,CAAC,uBAAuB,CAAC;IAChF,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,KAAK,YAAY,CAAC,uBAAuB,CAAC;IACtE,CAAC,CAAC,YAAY,KAAK,uBAAuB,CAAC;AAC7C,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;IAC5C,UAAU,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACnE,CAAC;AAsCD,MAAM,UAAU,UAAU;IACxB,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IACpC,MAAM,gBAAgB,GACpB,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,mBAAmB,CAAiB,CAAC;IAEhG,MAAM,SAAS,GACb,gBAAgB,KAAK,UAAU;QAC7B,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,gBAAgB;QACvC,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,kBAAkB,GAAG,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC;IACvD,MAAM,WAAW,GAAG,UAAU,EAAE,OAAO,CAAC;IACxC,MAAM,WAAW,GAAG,UAAU,EAAE,OAAO,CAAC;IACxC,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC;IACpE,MAAM,iBAAiB,GACrB,iBAAiB,KAAK,SAAS;QAC7B,CAAC,CAAC,iBAAiB,KAAK,MAAM;QAC9B,CAAC,CAAC,CAAC,WAAW,EAAE,UAAU,IAAI,KAAK,CAAC,CAAC;IAEzC,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IAClE,MAAM,eAAe,GACnB,kBAAkB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,kBAAoC,CAAC;QACnF,CAAC,CAAE,kBAAqC;QACxC,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,gBAAgB,GAAG,WAAW,EAAE,QAAQ,CAAC;IAC/C,MAAM,eAAe,GAAmB,eAAe,IAAI,gBAAgB,IAAI,iBAAiB,CAAC;IAEjG,MAAM,yBAAyB,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IACzE,MAAM,sBAAsB,GAC1B,yBAAyB,IAAI,iBAAiB,CAAC,QAAQ,CAAC,yBAA4C,CAAC;QACnG,CAAC,CAAE,yBAA6C;QAChD,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,eAAe,GAAoB,sBAAsB,IAAI,WAAW,EAAE,QAAQ,IAAI,YAAY,CAAC;IACzG,MAAM,uBAAuB,GAAG,oBAAoB,CAClD,OAAO,CAAC,GAAG,CAAC,2BAA2B;QACrC,WAAW,EAAE,SAAS,EAAE,OAAO;QAC/B,wBAAwB,EAAE,CAC7B,CAAC;IACF,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,WAAW,EAAE,EAAE,EAAE,MAAM,IAAI,WAAW,CAAC;IAC1G,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,WAAW,EAAE,EAAE,EAAE,MAAM,IAAI,WAAW,CAAC;IAC1G,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,IAAI,WAAW,EAAE,EAAE,EAAE,QAAQ,IAAI,SAAS,CAAC;IAC9G,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,WAAW,EAAE,EAAE,EAAE,MAAM,IAAI,EAAE,CAAC;IACjG,MAAM,uBAAuB,GAC3B,OAAO,CAAC,GAAG,CAAC,qCAAqC,KAAK,SAAS;QAC7D,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,qCAAqC,KAAK,MAAM;QAC9D,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,cAAc,IAAI,KAAK,CAAC,CAAC;IAEjD,MAAM,wBAAwB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IACvE,MAAM,qBAAqB,GACzB,wBAAwB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,wBAA0C,CAAC;QAC/F,CAAC,CAAE,wBAA2C;QAC9C,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,cAAc,GAAmB,qBAAqB,IAAI,UAAU,EAAE,MAAM,CAAC,cAAc,IAAI,eAAe,CAAC;IACrH,MAAM,4BAA4B,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC;IAC/E,MAAM,yBAAyB,GAC7B,4BAA4B;QAC5B,oBAAoB,CAAC,QAAQ,CAAC,4BAAkD,CAAC;QAC/E,CAAC,CAAE,4BAAmD;QACtD,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,kBAAkB,GACtB,cAAc,KAAK,eAAe;QAChC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,CAAC,yBAAyB,IAAI,UAAU,EAAE,MAAM,CAAC,QAAQ,IAAI,SAAS,CAAC,CAAC;IAC9E,MAAM,yBAAyB,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;IAC3E,MAAM,sBAAsB,GAC1B,yBAAyB;QACzB,mBAAmB,CAAC,QAAQ,CAAC,yBAA4C,CAAC;QACxE,CAAC,CAAE,yBAA6C;QAChD,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAC1D,MAAM,oBAAoB,GACxB,OAAO,CAAC,GAAG,CAAC,8BAA8B;QAC1C,OAAO,CAAC,GAAG,CAAC,eAAe;QAC3B,OAAO,CAAC,GAAG,CAAC,oBAAoB;QAChC,gBAAgB;QAChB,UAAU,EAAE,IAAI,EAAE,aAAa,CAAC;IAClC,MAAM,iBAAiB,GAAG,oBAAoB,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACpE,MAAM,eAAe,GACnB,sBAAsB;QACtB,UAAU,EAAE,IAAI,EAAE,WAAW;QAC7B,CAAC,iBAAiB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,oBAAoB,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC;IACxE,MAAM,iBAAiB,GACrB,oBAAoB,KAAK,SAAS;QAChC,CAAC,CAAC,oBAAoB,KAAK,MAAM;QACjC,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,aAAa,IAAI,KAAK,CAAC,CAAC;IACjD,MAAM,0BAA0B,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;IAC3E,MAAM,uBAAuB,GAAG,0BAA0B;QACxD,CAAC,CAAC,0BAA0B;aACzB,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;aAC1C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACtC,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,iBAAiB,GAAG,iBAAiB;QACzC,CAAC,CAAC,CAAC,GAAG,EAAE;YACN,IAAI,CAAC;gBACH,OAAO,IAAI,GAAG,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAClE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,CACjC,IAAI,GAAG,CACL;QACE,GAAG,CAAC,uBAAuB,IAAI,UAAU,EAAE,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAC;QACzE,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD;SACE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAC1C,MAAM,CAAC,OAAO,CAAC,CACnB,CACF,CAAC;IACF,MAAM,qBAAqB,GAAG,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC;IAC5E,MAAM,sBAAsB,GAC1B,qBAAqB,KAAK,SAAS;QACjC,CAAC,CAAC,qBAAqB,KAAK,MAAM;QAClC,CAAC,CAAC,cAAc,KAAK,eAAe,CAAC;IACzC,MAAM,qBAAqB,GACzB,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,SAAS;QACnD,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,MAAM;QACpD,CAAC,CAAC,CAAC,kBAAkB,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC;IAC5C,MAAM,6BAA6B,GAAG,IAAI,CAAC,GAAG,CAC5C,CAAC,EACD,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC;QACtD,kBAAkB,EAAE,eAAe;QACnC,EAAE,CACL,CAAC;IACF,MAAM,2BAA2B,GAAG,IAAI,CAAC,GAAG,CAC1C,CAAC,EACD,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC;QACpD,kBAAkB,EAAE,aAAa;QACjC,EAAE,CACL,CAAC;IACF,MAAM,iBAAiB,GAAG,oBAAoB,CAC5C,OAAO,CAAC,GAAG,CAAC,uBAAuB;QACjC,kBAAkB,EAAE,GAAG;QACvB,uBAAuB,EAAE,CAC5B,CAAC;IAEF,OAAO;QACL,cAAc;QACd,kBAAkB;QAClB,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,UAAU,EAAE,MAAM,CAAC,IAAI,IAAI,WAAW;QAChE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,UAAU,EAAE,MAAM,CAAC,IAAI,IAAI,IAAI;QACjE,gBAAgB;QAChB,eAAe;QACf,iBAAiB;QACjB,iBAAiB;QACjB,YAAY,EAAE,gBAAgB;QAC9B,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,SAAS;QAClD,uBAAuB,EAAE,oBAAoB,CAC3C,UAAU,EAAE,QAAQ,CAAC,uBAAuB,IAAI,iCAAiC,EAAE,CACpF;QACD,oBAAoB,EAAE,UAAU,EAAE,QAAQ,CAAC,oBAAoB,IAAI,KAAK;QACxE,qBAAqB;QACrB,6BAA6B;QAC7B,2BAA2B;QAC3B,iBAAiB;QACjB,OAAO,EACL,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,SAAS;YAChC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM;YACjC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;QACxC,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,MAAM;QACnE,eAAe;QACf,iBAAiB;QACjB,wBAAwB,EACtB,oBAAoB,CAClB,OAAO,CAAC,GAAG,CAAC,iCAAiC;YAC3C,WAAW,EAAE,cAAc,CAAC,WAAW;YACvC,gCAAgC,EAAE,CACrC;QACH,eAAe;QACf,uBAAuB;QACvB,eAAe;QACf,eAAe;QACf,iBAAiB;QACjB,eAAe;QACf,uBAAuB;QACvB,yBAAyB,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,OAAO;QAC9E,4BAA4B,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,IAAI,KAAK,CAAC;QAC3G,sBAAsB;KACvB,CAAC;AACJ,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,12 @@
+export declare class HttpError extends Error {
+    status: number;
+    details?: unknown;
+    constructor(status: number, message: string, details?: unknown);
+}
+export declare function badRequest(message: string, details?: unknown): HttpError;
+export declare function unauthorized(message?: string): HttpError;
+export declare function forbidden(message?: string): HttpError;
+export declare function notFound(message?: string): HttpError;
+export declare function conflict(message: string, details?: unknown): HttpError;
+export declare function unprocessable(message: string, details?: unknown): HttpError;
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,SAAU,SAAQ,KAAK;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;gBAEN,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO;CAK/D;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,aAE5D;AAED,wBAAgB,YAAY,CAAC,OAAO,SAAiB,aAEpD;AAED,wBAAgB,SAAS,CAAC,OAAO,SAAc,aAE9C;AAED,wBAAgB,QAAQ,CAAC,OAAO,SAAc,aAE7C;AAED,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,aAE1D;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,aAE/D"}

package/dist/errors.js

@@ -0,0 +1,28 @@
+export class HttpError extends Error {
+    status;
+    details;
+    constructor(status, message, details) {
+        super(message);
+        this.status = status;
+        this.details = details;
+    }
+}
+export function badRequest(message, details) {
+    return new HttpError(400, message, details);
+}
+export function unauthorized(message = "Unauthorized") {
+    return new HttpError(401, message);
+}
+export function forbidden(message = "Forbidden") {
+    return new HttpError(403, message);
+}
+export function notFound(message = "Not found") {
+    return new HttpError(404, message);
+}
+export function conflict(message, details) {
+    return new HttpError(409, message, details);
+}
+export function unprocessable(message, details) {
+    return new HttpError(422, message, details);
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,SAAU,SAAQ,KAAK;IAClC,MAAM,CAAS;IACf,OAAO,CAAW;IAElB,YAAY,MAAc,EAAE,OAAe,EAAE,OAAiB;QAC5D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,OAAiB;IAC3D,OAAO,IAAI,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAO,GAAG,cAAc;IACnD,OAAO,IAAI,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAAO,GAAG,WAAW;IAC7C,OAAO,IAAI,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,OAAO,GAAG,WAAW;IAC5C,OAAO,IAAI,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,OAAe,EAAE,OAAiB;IACzD,OAAO,IAAI,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,OAAiB;IAC9D,OAAO,IAAI,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC9C,CAAC"}

package/dist/home-paths.d.ts

@@ -0,0 +1,17 @@
+export declare function resolvePaperclipHomeDir(): string;
+export declare function resolvePaperclipInstanceId(): string;
+export declare function resolvePaperclipInstanceRoot(): string;
+export declare function resolveDefaultConfigPath(): string;
+export declare function resolveDefaultEmbeddedPostgresDir(): string;
+export declare function resolveDefaultLogsDir(): string;
+export declare function resolveDefaultSecretsKeyFilePath(): string;
+export declare function resolveDefaultStorageDir(): string;
+export declare function resolveDefaultBackupDir(): string;
+export declare function resolveDefaultAgentWorkspaceDir(agentId: string): string;
+export declare function resolveManagedProjectWorkspaceDir(input: {
+    companyId: string;
+    projectId: string;
+    repoName?: string | null;
+}): string;
+export declare function resolveHomeAwarePath(value: string): string;
+//# sourceMappingURL=home-paths.d.ts.map

package/dist/home-paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"home-paths.d.ts","sourceRoot":"","sources":["../src/home-paths.ts"],"names":[],"mappings":"AAcA,wBAAgB,uBAAuB,IAAI,MAAM,CAIhD;AAED,wBAAgB,0BAA0B,IAAI,MAAM,CAMnD;AAED,wBAAgB,4BAA4B,IAAI,MAAM,CAErD;AAED,wBAAgB,wBAAwB,IAAI,MAAM,CAEjD;AAED,wBAAgB,iCAAiC,IAAI,MAAM,CAE1D;AAED,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AAED,wBAAgB,gCAAgC,IAAI,MAAM,CAEzD;AAED,wBAAgB,wBAAwB,IAAI,MAAM,CAEjD;AAED,wBAAgB,uBAAuB,IAAI,MAAM,CAEhD;AAED,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAMvE;AAWD,wBAAgB,iCAAiC,CAAC,KAAK,EAAE;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,GAAG,MAAM,CAaT;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1D"}

package/dist/home-paths.js

@@ -0,0 +1,75 @@
+import os from "node:os";
+import path from "node:path";
+const DEFAULT_INSTANCE_ID = "default";
+const INSTANCE_ID_RE = /^[a-zA-Z0-9_-]+$/;
+const PATH_SEGMENT_RE = /^[a-zA-Z0-9_-]+$/;
+const FRIENDLY_PATH_SEGMENT_RE = /[^a-zA-Z0-9._-]+/g;
+function expandHomePrefix(value) {
+    if (value === "~")
+        return os.homedir();
+    if (value.startsWith("~/"))
+        return path.resolve(os.homedir(), value.slice(2));
+    return value;
+}
+export function resolvePaperclipHomeDir() {
+    const envHome = process.env.PAPERCLIP_HOME?.trim();
+    if (envHome)
+        return path.resolve(expandHomePrefix(envHome));
+    return path.resolve(os.homedir(), ".paperclip");
+}
+export function resolvePaperclipInstanceId() {
+    const raw = process.env.PAPERCLIP_INSTANCE_ID?.trim() || DEFAULT_INSTANCE_ID;
+    if (!INSTANCE_ID_RE.test(raw)) {
+        throw new Error(`Invalid PAPERCLIP_INSTANCE_ID '${raw}'.`);
+    }
+    return raw;
+}
+export function resolvePaperclipInstanceRoot() {
+    return path.resolve(resolvePaperclipHomeDir(), "instances", resolvePaperclipInstanceId());
+}
+export function resolveDefaultConfigPath() {
+    return path.resolve(resolvePaperclipInstanceRoot(), "config.json");
+}
+export function resolveDefaultEmbeddedPostgresDir() {
+    return path.resolve(resolvePaperclipInstanceRoot(), "db");
+}
+export function resolveDefaultLogsDir() {
+    return path.resolve(resolvePaperclipInstanceRoot(), "logs");
+}
+export function resolveDefaultSecretsKeyFilePath() {
+    return path.resolve(resolvePaperclipInstanceRoot(), "secrets", "master.key");
+}
+export function resolveDefaultStorageDir() {
+    return path.resolve(resolvePaperclipInstanceRoot(), "data", "storage");
+}
+export function resolveDefaultBackupDir() {
+    return path.resolve(resolvePaperclipInstanceRoot(), "data", "backups");
+}
+export function resolveDefaultAgentWorkspaceDir(agentId) {
+    const trimmed = agentId.trim();
+    if (!PATH_SEGMENT_RE.test(trimmed)) {
+        throw new Error(`Invalid agent id for workspace path '${agentId}'.`);
+    }
+    return path.resolve(resolvePaperclipInstanceRoot(), "workspaces", trimmed);
+}
+function sanitizeFriendlyPathSegment(value, fallback = "_default") {
+    const trimmed = value?.trim() ?? "";
+    if (!trimmed)
+        return fallback;
+    const sanitized = trimmed
+        .replace(FRIENDLY_PATH_SEGMENT_RE, "-")
+        .replace(/^-+|-+$/g, "");
+    return sanitized || fallback;
+}
+export function resolveManagedProjectWorkspaceDir(input) {
+    const companyId = input.companyId.trim();
+    const projectId = input.projectId.trim();
+    if (!companyId || !projectId) {
+        throw new Error("Managed project workspace path requires companyId and projectId.");
+    }
+    return path.resolve(resolvePaperclipInstanceRoot(), "projects", sanitizeFriendlyPathSegment(companyId, "company"), sanitizeFriendlyPathSegment(projectId, "project"), sanitizeFriendlyPathSegment(input.repoName, "_default"));
+}
+export function resolveHomeAwarePath(value) {
+    return path.resolve(expandHomePrefix(value));
+}
+//# sourceMappingURL=home-paths.js.map

package/dist/home-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"home-paths.js","sourceRoot":"","sources":["../src/home-paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,mBAAmB,GAAG,SAAS,CAAC;AACtC,MAAM,cAAc,GAAG,kBAAkB,CAAC;AAC1C,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAC3C,MAAM,wBAAwB,GAAG,mBAAmB,CAAC;AAErD,SAAS,gBAAgB,CAAC,KAAa;IACrC,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC;IACvC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IACnD,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5D,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,IAAI,mBAAmB,CAAC;IAC7E,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,IAAI,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,4BAA4B;IAC1C,OAAO,IAAI,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC,CAAC;AAC5F,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,OAAO,IAAI,CAAC,OAAO,CAAC,4BAA4B,EAAE,EAAE,aAAa,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,iCAAiC;IAC/C,OAAO,IAAI,CAAC,OAAO,CAAC,4BAA4B,EAAE,EAAE,IAAI,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,OAAO,IAAI,CAAC,OAAO,CAAC,4BAA4B,EAAE,EAAE,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,gCAAgC;IAC9C,OAAO,IAAI,CAAC,OAAO,CAAC,4BAA4B,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,OAAO,IAAI,CAAC,OAAO,CAAC,4BAA4B,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,OAAO,IAAI,CAAC,OAAO,CAAC,4BAA4B,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,OAAe;IAC7D,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,wCAAwC,OAAO,IAAI,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC,4BAA4B,EAAE,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,2BAA2B,CAAC,KAAgC,EAAE,QAAQ,GAAG,UAAU;IAC1F,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,SAAS,GAAG,OAAO;SACtB,OAAO,CAAC,wBAAwB,EAAE,GAAG,CAAC;SACtC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3B,OAAO,SAAS,IAAI,QAAQ,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,KAIjD;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CACjB,4BAA4B,EAAE,EAC9B,UAAU,EACV,2BAA2B,CAAC,SAAS,EAAE,SAAS,CAAC,EACjD,2BAA2B,CAAC,SAAS,EAAE,SAAS,CAAC,EACjD,2BAA2B,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CACxD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,OAAO,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;AAC/C,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,10 @@
+import { createServer } from "node:http";
+export interface StartedServer {
+    server: ReturnType<typeof createServer>;
+    host: string;
+    listenPort: number;
+    apiUrl: string;
+    databaseUrl: string;
+}
+export declare function startServer(): Promise<StartedServer>;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AA4DzC,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC,CAkoB1D"}