@rudderhq/server 0.1.0-canary.0

package/dist/middleware/board-mutation-guard.js

@@ -0,0 +1,59 @@
+const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
+const DEFAULT_DEV_ORIGINS = [
+    "http://localhost:3100",
+    "http://127.0.0.1:3100",
+];
+function parseOrigin(value) {
+    if (!value)
+        return null;
+    try {
+        const url = new URL(value);
+        return `${url.protocol}//${url.host}`.toLowerCase();
+    }
+    catch {
+        return null;
+    }
+}
+function trustedOriginsForRequest(req) {
+    const origins = new Set(DEFAULT_DEV_ORIGINS.map((value) => value.toLowerCase()));
+    const host = req.header("host")?.trim();
+    if (host) {
+        origins.add(`http://${host}`.toLowerCase());
+        origins.add(`https://${host}`.toLowerCase());
+    }
+    return origins;
+}
+function isTrustedBoardMutationRequest(req) {
+    const allowedOrigins = trustedOriginsForRequest(req);
+    const origin = parseOrigin(req.header("origin"));
+    if (origin && allowedOrigins.has(origin))
+        return true;
+    const refererOrigin = parseOrigin(req.header("referer"));
+    if (refererOrigin && allowedOrigins.has(refererOrigin))
+        return true;
+    return false;
+}
+export function boardMutationGuard() {
+    return (req, res, next) => {
+        if (SAFE_METHODS.has(req.method.toUpperCase())) {
+            next();
+            return;
+        }
+        if (req.actor.type !== "board") {
+            next();
+            return;
+        }
+        // Local-trusted mode and board bearer keys are not browser-session requests.
+        // In these modes, origin/referer headers can be absent; do not block those mutations.
+        if (req.actor.source === "local_implicit" || req.actor.source === "board_key") {
+            next();
+            return;
+        }
+        if (!isTrustedBoardMutationRequest(req)) {
+            res.status(403).json({ error: "Board mutation requires trusted browser origin" });
+            return;
+        }
+        next();
+    };
+}
+//# sourceMappingURL=board-mutation-guard.js.map

package/dist/middleware/board-mutation-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"board-mutation-guard.js","sourceRoot":"","sources":["../../src/middleware/board-mutation-guard.ts"],"names":[],"mappings":"AAEA,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AACzD,MAAM,mBAAmB,GAAG;IAC1B,uBAAuB;IACvB,uBAAuB;CACxB,CAAC;AAEF,SAAS,WAAW,CAAC,KAAyB;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,GAAY;IAC5C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACjF,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;IACxC,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,6BAA6B,CAAC,GAAY;IACjD,MAAM,cAAc,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjD,IAAI,MAAM,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtD,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IACzD,IAAI,aAAa,IAAI,cAAc,CAAC,GAAG,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC/C,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC/B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,6EAA6E;QAC7E,sFAAsF;QACtF,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,gBAAgB,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAC9E,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/error-handler.d.ts

@@ -0,0 +1,17 @@
+import type { Request, Response, NextFunction } from "express";
+export interface ErrorContext {
+    error: {
+        message: string;
+        stack?: string;
+        name?: string;
+        details?: unknown;
+        raw?: unknown;
+    };
+    method: string;
+    url: string;
+    reqBody?: unknown;
+    reqParams?: unknown;
+    reqQuery?: unknown;
+}
+export declare function errorHandler(err: unknown, req: Request, res: Response, _next: NextFunction): void;
+//# sourceMappingURL=error-handler.d.ts.map

package/dist/middleware/error-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-handler.d.ts","sourceRoot":"","sources":["../../src/middleware/error-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAI/D,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,GAAG,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC5F,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAqBD,wBAAgB,YAAY,CAC1B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,KAAK,EAAE,YAAY,QAkCpB"}

package/dist/middleware/error-handler.js

@@ -0,0 +1,37 @@
+import { ZodError } from "zod";
+import { HttpError } from "../errors.js";
+function attachErrorContext(req, res, payload, rawError) {
+    res.__errorContext = {
+        error: payload,
+        method: req.method,
+        url: req.originalUrl,
+        reqBody: req.body,
+        reqParams: req.params,
+        reqQuery: req.query,
+    };
+    if (rawError) {
+        res.err = rawError;
+    }
+}
+export function errorHandler(err, req, res, _next) {
+    if (err instanceof HttpError) {
+        if (err.status >= 500) {
+            attachErrorContext(req, res, { message: err.message, stack: err.stack, name: err.name, details: err.details }, err);
+        }
+        res.status(err.status).json({
+            error: err.message,
+            ...(err.details ? { details: err.details } : {}),
+        });
+        return;
+    }
+    if (err instanceof ZodError) {
+        res.status(400).json({ error: "Validation error", details: err.errors });
+        return;
+    }
+    const rootError = err instanceof Error ? err : new Error(String(err));
+    attachErrorContext(req, res, err instanceof Error
+        ? { message: err.message, stack: err.stack, name: err.name }
+        : { message: String(err), raw: err, stack: rootError.stack, name: rootError.name }, rootError);
+    res.status(500).json({ error: "Internal server error" });
+}
+//# sourceMappingURL=error-handler.js.map

package/dist/middleware/error-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-handler.js","sourceRoot":"","sources":["../../src/middleware/error-handler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAWzC,SAAS,kBAAkB,CACzB,GAAY,EACZ,GAAa,EACb,OAA8B,EAC9B,QAAgB;IAEf,GAAW,CAAC,cAAc,GAAG;QAC5B,KAAK,EAAE,OAAO;QACd,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,GAAG,EAAE,GAAG,CAAC,WAAW;QACpB,OAAO,EAAE,GAAG,CAAC,IAAI;QACjB,SAAS,EAAE,GAAG,CAAC,MAAM;QACrB,QAAQ,EAAE,GAAG,CAAC,KAAK;KACG,CAAC;IACzB,IAAI,QAAQ,EAAE,CAAC;QACZ,GAAW,CAAC,GAAG,GAAG,QAAQ,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,GAAY,EACZ,GAAY,EACZ,GAAa,EACb,KAAmB;IAEnB,IAAI,GAAG,YAAY,SAAS,EAAE,CAAC;QAC7B,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YACtB,kBAAkB,CAChB,GAAG,EACH,GAAG,EACH,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAChF,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;YAC1B,KAAK,EAAE,GAAG,CAAC,OAAO;YAClB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;QAC5B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACzE,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACtE,kBAAkB,CAChB,GAAG,EACH,GAAG,EACH,GAAG,YAAY,KAAK;QAClB,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;QAC5D,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,EACpF,SAAS,CACV,CAAC;IAEF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;AAC3D,CAAC"}

package/dist/middleware/index.d.ts

@@ -0,0 +1,4 @@
+export { logger, httpLogger } from "./logger.js";
+export { errorHandler } from "./error-handler.js";
+export { validate } from "./validate.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/middleware/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC"}

package/dist/middleware/index.js

@@ -0,0 +1,4 @@
+export { logger, httpLogger } from "./logger.js";
+export { errorHandler } from "./error-handler.js";
+export { validate } from "./validate.js";
+//# sourceMappingURL=index.js.map

package/dist/middleware/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC"}

package/dist/middleware/logger.d.ts

@@ -0,0 +1,4 @@
+import pino from "pino";
+export declare const logger: pino.Logger<never, boolean>;
+export declare const httpLogger: import("pino-http").HttpLogger<import("http").IncomingMessage, import("http").ServerResponse<import("http").IncomingMessage>, never>;
+//# sourceMappingURL=logger.d.ts.map

package/dist/middleware/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/middleware/logger.ts"],"names":[],"mappings":"AAGA,OAAO,IAAI,MAAM,MAAM,CAAC;AAyFxB,eAAO,MAAM,MAAM,6BAKhB,CAAC;AAEJ,eAAO,MAAM,UAAU,sIA4CrB,CAAC"}

package/dist/middleware/logger.js

@@ -0,0 +1,133 @@
+import path from "node:path";
+import fs from "node:fs";
+import { Writable } from "node:stream";
+import pino from "pino";
+import { pinoHttp } from "pino-http";
+import pretty from "pino-pretty";
+import { readConfigFile } from "../config-file.js";
+import { resolveDefaultLogsDir, resolveHomeAwarePath } from "../home-paths.js";
+function resolveServerLogDir() {
+    const envOverride = process.env.RUDDER_LOG_DIR?.trim();
+    if (envOverride)
+        return resolveHomeAwarePath(envOverride);
+    const fileLogDir = readConfigFile()?.logging.logDir?.trim();
+    if (fileLogDir)
+        return resolveHomeAwarePath(fileLogDir);
+    return resolveDefaultLogsDir();
+}
+const logDir = resolveServerLogDir();
+fs.mkdirSync(logDir, { recursive: true });
+function formatLocalDateKey(date) {
+    const year = date.getFullYear();
+    const month = String(date.getMonth() + 1).padStart(2, "0");
+    const day = String(date.getDate()).padStart(2, "0");
+    return `${year}-${month}-${day}`;
+}
+function resolveDailyLogFilePath(baseDir, date) {
+    return path.join(baseDir, `server-${formatLocalDateKey(date)}.log`);
+}
+class DailyFileStream extends Writable {
+    baseDir;
+    currentDateKey = null;
+    currentStream = null;
+    constructor(baseDir) {
+        super();
+        this.baseDir = baseDir;
+    }
+    ensureStream(date) {
+        const dateKey = formatLocalDateKey(date);
+        if (this.currentStream && this.currentDateKey === dateKey) {
+            return this.currentStream;
+        }
+        if (this.currentStream) {
+            this.currentStream.end();
+            this.currentStream = null;
+        }
+        fs.mkdirSync(this.baseDir, { recursive: true });
+        const nextStream = fs.createWriteStream(resolveDailyLogFilePath(this.baseDir, date), { flags: "a" });
+        this.currentDateKey = dateKey;
+        this.currentStream = nextStream;
+        return nextStream;
+    }
+    _write(chunk, encoding, callback) {
+        const stream = this.ensureStream(new Date());
+        stream.write(chunk, encoding, callback);
+    }
+    _final(callback) {
+        if (!this.currentStream) {
+            callback();
+            return;
+        }
+        this.currentStream.end(() => callback());
+    }
+}
+const sharedOpts = {
+    translateTime: "HH:MM:ss",
+    ignore: "pid,hostname",
+    singleLine: true,
+};
+const consolePrettyStream = pretty({
+    ...sharedOpts,
+    ignore: "pid,hostname,req,res,responseTime",
+    colorize: true,
+    destination: 1,
+});
+const filePrettyStream = pretty({
+    ...sharedOpts,
+    colorize: false,
+    destination: new DailyFileStream(logDir),
+});
+export const logger = pino({
+    level: "debug",
+}, pino.multistream([
+    { stream: consolePrettyStream, level: "info" },
+    { stream: filePrettyStream, level: "debug" },
+]));
+export const httpLogger = pinoHttp({
+    logger,
+    customLogLevel(_req, res, err) {
+        if (err || res.statusCode >= 500)
+            return "error";
+        if (res.statusCode >= 400)
+            return "warn";
+        return "info";
+    },
+    customSuccessMessage(req, res) {
+        return `${req.method} ${req.url} ${res.statusCode}`;
+    },
+    customErrorMessage(req, res, err) {
+        const ctx = res.__errorContext;
+        const errMsg = ctx?.error?.message || err?.message || res.err?.message || "unknown error";
+        return `${req.method} ${req.url} ${res.statusCode} — ${errMsg}`;
+    },
+    customProps(req, res) {
+        if (res.statusCode >= 400) {
+            const ctx = res.__errorContext;
+            if (ctx) {
+                return {
+                    errorContext: ctx.error,
+                    reqBody: ctx.reqBody,
+                    reqParams: ctx.reqParams,
+                    reqQuery: ctx.reqQuery,
+                };
+            }
+            const props = {};
+            const { body, params, query } = req;
+            if (body && typeof body === "object" && Object.keys(body).length > 0) {
+                props.reqBody = body;
+            }
+            if (params && typeof params === "object" && Object.keys(params).length > 0) {
+                props.reqParams = params;
+            }
+            if (query && typeof query === "object" && Object.keys(query).length > 0) {
+                props.reqQuery = query;
+            }
+            if (req.route?.path) {
+                props.routePath = req.route.path;
+            }
+            return props;
+        }
+        return {};
+    },
+});
+//# sourceMappingURL=logger.js.map

package/dist/middleware/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/middleware/logger.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAE/E,SAAS,mBAAmB;IAC1B,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IACvD,IAAI,WAAW;QAAE,OAAO,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAE1D,MAAM,UAAU,GAAG,cAAc,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IAC5D,IAAI,UAAU;QAAE,OAAO,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAExD,OAAO,qBAAqB,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;AACrC,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAE1C,SAAS,kBAAkB,CAAC,IAAU;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpD,OAAO,GAAG,IAAI,IAAI,KAAK,IAAI,GAAG,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAe,EAAE,IAAU;IAC1D,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,eAAgB,SAAQ,QAAQ;IACnB,OAAO,CAAS;IACzB,cAAc,GAAkB,IAAI,CAAC;IACrC,aAAa,GAA0B,IAAI,CAAC;IAEpD,YAAY,OAAe;QACzB,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAEO,YAAY,CAAC,IAAU;QAC7B,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,cAAc,KAAK,OAAO,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC,aAAa,CAAC;QAC5B,CAAC;QACD,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC;YACzB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,UAAU,GAAG,EAAE,CAAC,iBAAiB,CAAC,uBAAuB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACrG,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC;QAC9B,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC;QAChC,OAAO,UAAU,CAAC;IACpB,CAAC;IAEQ,MAAM,CAAC,KAAsB,EAAE,QAAwB,EAAE,QAAwC;QACxG,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAEQ,MAAM,CAAC,QAAwC;QACtD,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,QAAQ,EAAE,CAAC;YACX,OAAO;QACT,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3C,CAAC;CACF;AAED,MAAM,UAAU,GAAG;IACjB,aAAa,EAAE,UAAU;IACzB,MAAM,EAAE,cAAc;IACtB,UAAU,EAAE,IAAI;CACjB,CAAC;AAEF,MAAM,mBAAmB,GAAG,MAAM,CAAC;IACjC,GAAG,UAAU;IACb,MAAM,EAAE,mCAAmC;IAC3C,QAAQ,EAAE,IAAI;IACd,WAAW,EAAE,CAAC;CACf,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,MAAM,CAAC;IAC9B,GAAG,UAAU;IACb,QAAQ,EAAE,KAAK;IACf,WAAW,EAAE,IAAI,eAAe,CAAC,MAAM,CAAC;CACzC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,OAAO;CACf,EAAE,IAAI,CAAC,WAAW,CAAC;IAClB,EAAE,MAAM,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,EAAE;IAC9C,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE;CAC7C,CAAC,CAAC,CAAC;AAEJ,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAC;IACjC,MAAM;IACN,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG;QAC3B,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG;YAAE,OAAO,OAAO,CAAC;QACjD,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG;YAAE,OAAO,MAAM,CAAC;QACzC,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,oBAAoB,CAAC,GAAG,EAAE,GAAG;QAC3B,OAAO,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;IACtD,CAAC;IACD,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG;QAC9B,MAAM,GAAG,GAAI,GAAW,CAAC,cAAc,CAAC;QACxC,MAAM,MAAM,GAAG,GAAG,EAAE,KAAK,EAAE,OAAO,IAAI,GAAG,EAAE,OAAO,IAAK,GAAW,CAAC,GAAG,EAAE,OAAO,IAAI,eAAe,CAAC;QACnG,OAAO,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,MAAM,MAAM,EAAE,CAAC;IAClE,CAAC;IACD,WAAW,CAAC,GAAG,EAAE,GAAG;QAClB,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAI,GAAW,CAAC,cAAc,CAAC;YACxC,IAAI,GAAG,EAAE,CAAC;gBACR,OAAO;oBACL,YAAY,EAAE,GAAG,CAAC,KAAK;oBACvB,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;iBACvB,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAA4B,EAAE,CAAC;YAC1C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,GAAU,CAAC;YAC3C,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrE,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;YACvB,CAAC;YACD,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3E,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC;YAC3B,CAAC;YACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxE,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC;YACzB,CAAC;YACD,IAAK,GAAW,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;gBAC7B,KAAK,CAAC,SAAS,GAAI,GAAW,CAAC,KAAK,CAAC,IAAI,CAAC;YAC5C,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;CACF,CAAC,CAAC"}

package/dist/middleware/private-hostname-guard.d.ts

@@ -0,0 +1,11 @@
+import type { RequestHandler } from "express";
+export declare function resolvePrivateHostnameAllowSet(opts: {
+    allowedHostnames: string[];
+    bindHost: string;
+}): Set<string>;
+export declare function privateHostnameGuard(opts: {
+    enabled: boolean;
+    allowedHostnames: string[];
+    bindHost: string;
+}): RequestHandler;
+//# sourceMappingURL=private-hostname-guard.d.ts.map

package/dist/middleware/private-hostname-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-hostname-guard.d.ts","sourceRoot":"","sources":["../../src/middleware/private-hostname-guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,cAAc,EAAE,MAAM,SAAS,CAAC;AA8BvD,wBAAgB,8BAA8B,CAAC,IAAI,EAAE;IAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAYlH;AASD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,cAAc,CAoCjB"}

package/dist/middleware/private-hostname-guard.js

@@ -0,0 +1,78 @@
+function isLoopbackHostname(hostname) {
+    const normalized = hostname.trim().toLowerCase();
+    return normalized === "localhost" || normalized === "127.0.0.1" || normalized === "::1";
+}
+function extractHostname(req) {
+    const forwardedHost = req.header("x-forwarded-host")?.split(",")[0]?.trim();
+    const hostHeader = req.header("host")?.trim();
+    const raw = forwardedHost || hostHeader;
+    if (!raw)
+        return null;
+    try {
+        return new URL(`http://${raw}`).hostname.trim().toLowerCase();
+    }
+    catch {
+        return raw.trim().toLowerCase();
+    }
+}
+function normalizeAllowedHostnames(values) {
+    const unique = new Set();
+    for (const value of values) {
+        const trimmed = value.trim().toLowerCase();
+        if (!trimmed)
+            continue;
+        unique.add(trimmed);
+    }
+    return Array.from(unique);
+}
+export function resolvePrivateHostnameAllowSet(opts) {
+    const configuredAllow = normalizeAllowedHostnames(opts.allowedHostnames);
+    const bindHost = opts.bindHost.trim().toLowerCase();
+    const allowSet = new Set(configuredAllow);
+    if (bindHost && bindHost !== "0.0.0.0") {
+        allowSet.add(bindHost);
+    }
+    allowSet.add("localhost");
+    allowSet.add("127.0.0.1");
+    allowSet.add("::1");
+    return allowSet;
+}
+function blockedHostnameMessage(hostname) {
+    return (`Hostname '${hostname}' is not allowed for this Rudder instance. ` +
+        `If you want to allow this hostname, please run pnpm rudder allowed-hostname ${hostname}`);
+}
+export function privateHostnameGuard(opts) {
+    if (!opts.enabled) {
+        return (_req, _res, next) => next();
+    }
+    const allowSet = resolvePrivateHostnameAllowSet({
+        allowedHostnames: opts.allowedHostnames,
+        bindHost: opts.bindHost,
+    });
+    return (req, res, next) => {
+        const hostname = extractHostname(req);
+        const wantsJson = req.path.startsWith("/api") || req.accepts(["json", "html", "text"]) === "json";
+        if (!hostname) {
+            const error = "Missing Host header. If you want to allow a hostname, run pnpm rudder allowed-hostname <host>.";
+            if (wantsJson) {
+                res.status(403).json({ error });
+            }
+            else {
+                res.status(403).type("text/plain").send(error);
+            }
+            return;
+        }
+        if (isLoopbackHostname(hostname) || allowSet.has(hostname)) {
+            next();
+            return;
+        }
+        const error = blockedHostnameMessage(hostname);
+        if (wantsJson) {
+            res.status(403).json({ error });
+        }
+        else {
+            res.status(403).type("text/plain").send(error);
+        }
+    };
+}
+//# sourceMappingURL=private-hostname-guard.js.map

package/dist/middleware/private-hostname-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-hostname-guard.js","sourceRoot":"","sources":["../../src/middleware/private-hostname-guard.ts"],"names":[],"mappings":"AAEA,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjD,OAAO,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,KAAK,CAAC;AAC1F,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACnC,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAC5E,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;IAC9C,MAAM,GAAG,GAAG,aAAa,IAAI,UAAU,CAAC;IACxC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClC,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,MAAgB;IACjD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,IAAsD;IACnG,MAAM,eAAe,GAAG,yBAAyB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,eAAe,CAAC,CAAC;IAElD,IAAI,QAAQ,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACvC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC1B,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC1B,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,OAAO,CACL,aAAa,QAAQ,6CAA6C;QAClE,+EAA+E,QAAQ,EAAE,CAC1F,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAIpC;IACC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IACtC,CAAC;IAED,MAAM,QAAQ,GAAG,8BAA8B,CAAC;QAC9C,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,MAAM,CAAC;QAElG,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,gGAAgG,CAAC;YAC/G,IAAI,SAAS,EAAE,CAAC;gBACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAClC,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjD,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,kBAAkB,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3D,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,SAAS,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/validate.d.ts

@@ -0,0 +1,4 @@
+import type { Request, Response, NextFunction } from "express";
+import type { ZodSchema } from "zod";
+export declare function validate(schema: ZodSchema): (req: Request, _res: Response, next: NextFunction) => void;
+//# sourceMappingURL=validate.d.ts.map

package/dist/middleware/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/middleware/validate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,KAAK,CAAC;AAErC,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,IAChC,KAAK,OAAO,EAAE,MAAM,QAAQ,EAAE,MAAM,YAAY,UAIzD"}

package/dist/middleware/validate.js

@@ -0,0 +1,7 @@
+export function validate(schema) {
+    return (req, _res, next) => {
+        req.body = schema.parse(req.body);
+        next();
+    };
+}
+//# sourceMappingURL=validate.js.map

package/dist/middleware/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/middleware/validate.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,QAAQ,CAAC,MAAiB;IACxC,OAAO,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB,EAAE,EAAE;QAC1D,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/onboarding-assets/ceo/AGENTS.md

@@ -0,0 +1,33 @@
+You are the CEO.
+
+Your home directory is $AGENT_HOME. Everything personal to you -- life, memory, knowledge -- lives there. Other agents may have their own folders and you may update them when necessary.
+
+Use these paths consistently:
+
+- Personal instructions live under `$AGENT_HOME/instructions`.
+- Personal memory lives under `$AGENT_HOME/memory`.
+- Personal skills live under `$AGENT_HOME/skills`.
+- Shared organization workspace root lives under `$RUDDER_ORG_WORKSPACE_ROOT`.
+- Shared organization skills live under `$RUDDER_ORG_SKILLS_DIR`.
+- Shared organization plans live under `$RUDDER_ORG_PLANS_DIR`.
+- Durable shared work output should prefer these managed workspace paths instead of ad-hoc top-level `projects/` folders.
+
+When you write issue comments or chat replies, match the language of the user's or board's most recent substantive message unless they explicitly ask for a different language.
+
+## Memory and Planning
+
+You MUST use the `para-memory-files` skill for all memory operations: storing facts, writing daily notes, creating entities, running weekly synthesis, recalling past context, and managing plans. The skill defines your three-layer memory system (knowledge graph, daily notes, tacit knowledge), the PARA folder structure, atomic fact schemas, memory decay rules, and recall/planning conventions.
+
+Invoke it whenever you need to remember, retrieve, or organize anything.
+
+## Safety Considerations
+
+- Never exfiltrate secrets or private data.
+- Do not perform any destructive commands unless explicitly requested by the board.
+
+## References
+
+Use them when you need a refresh, when the task context changes, or when you are editing the system itself.
+
+- `./instructions/SOUL.md` -- who you are and how you should act. Persona, tone, and boundaries.
+- `./instructions/TOOLS.md` -- Notes about your local tools and conventions. Does not control tool availability; it is only guidance.

package/dist/onboarding-assets/ceo/HEARTBEAT.md

@@ -0,0 +1,77 @@
+# HEARTBEAT.md -- CEO Heartbeat Checklist
+
+Run this checklist on every heartbeat. This covers both your local planning/memory work and your organizational coordination via the Rudder skill.
+
+## 1. Identity and Context
+
+- `rudder agent me --json` -- confirm your id, role, budget, `chainOfCommand`.
+- Check wake context: `RUDDER_TASK_ID`, `RUDDER_WAKE_REASON`, `RUDDER_WAKE_COMMENT_ID`.
+- If `rudder agent me --json` returns `Agent authentication required`, stop treating the run as a normal heartbeat. Report the missing or invalid injected auth. Do not ask for `RUDDER_API_KEY` inside the run and do not continue with file-based manual workarounds.
+
+## 2. Local Planning Check
+
+1. Read today's plan from `./memory/YYYY-MM-DD.md` under "## Today's Plan".
+2. Review each planned item: what's completed, what's blocked, and what up next.
+3. For any blockers, resolve them yourself or escalate to the board.
+4. If you're ahead, start on the next highest priority.
+5. Record progress updates in the daily notes.
+
+## 3. Approval Follow-Up
+
+If `RUDDER_APPROVAL_ID` is set:
+
+- Review the approval and its linked issues with `rudder approval get "$RUDDER_APPROVAL_ID" --json` and `rudder approval issues "$RUDDER_APPROVAL_ID" --json`.
+- Close resolved issues or comment on what remains open.
+
+## 4. Get Assignments
+
+- `rudder agent inbox --json`
+- Prioritize: `in_progress` first, then `todo`. Skip `blocked` unless you can unblock it.
+- If there is already an active run on an `in_progress` task, just move on to the next thing.
+- If `RUDDER_TASK_ID` is set and assigned to you, prioritize that task.
+
+## 5. Checkout and Work
+
+- Always checkout before working: `rudder issue checkout "<issue-id-or-identifier>" --json`.
+- Never retry a 409 -- that task belongs to someone else.
+- Use `rudder issue context "<issue-id-or-identifier>" --json` to load compact context.
+- Do the work. Use `rudder issue comment`, `rudder issue done`, or `rudder issue block` to communicate outcome.
+- If `RUDDER_WAKE_REASON=issue_passive_followup`, treat the wake as close-out governance, not a fresh assignment: inspect state and leave a progress comment, completion, blocker, or explicit handoff.
+
+## 6. Delegation
+
+- Create subtasks with `rudder issue create --org-id "$RUDDER_ORG_ID" ... --json`. Always set `parentId` and `goalId`.
+- Use `rudder-create-agent` skill when hiring new agents.
+- Assign work to the right agent for the job.
+- For hire/create-agent tasks, invoke `rudder-create-agent` immediately after identity succeeds. Do not browse local agent directories or instruction files first unless the API results show you need one concrete config example.
+
+## 7. Fact Extraction
+
+1. Check for new conversations since last extraction.
+2. Extract durable facts to the relevant entity in `$AGENT_HOME/life/` (PARA).
+3. Update `./memory/YYYY-MM-DD.md` with timeline entries.
+4. Update access metadata (timestamp, access_count) for any referenced facts.
+
+## 8. Exit
+
+- Comment on any in_progress work before exiting.
+- A successful `todo` or `in_progress` issue run without a close-out signal can trigger a same-agent passive follow-up.
+- If no assignments and no valid mention-handoff, exit cleanly.
+
+---
+
+## CEO Responsibilities
+
+- Strategic direction: Set goals and priorities aligned with the organization mission.
+- Hiring: Spin up new agents when capacity is needed.
+- Unblocking: Escalate or resolve blockers for reports.
+- Budget awareness: Above 80% spend, focus only on critical tasks.
+- Never look for unassigned work -- only work on what is assigned to you.
+- Never cancel cross-team tasks -- reassign to the relevant manager with a comment.
+
+## Rules
+
+- Always use the Rudder skill for coordination.
+- Mutating `rudder` CLI commands attach `RUDDER_RUN_ID` automatically when it is available.
+- Comment in concise markdown: status line + bullets + links.
+- Self-assign via checkout only when explicitly @-mentioned.

package/dist/onboarding-assets/ceo/SOUL.md

@@ -0,0 +1,33 @@
+# SOUL.md -- CEO Persona
+
+You are the CEO.
+
+## Strategic Posture
+
+- You own the P&L. Every decision rolls up to revenue, margin, and cash; if you miss the economics, no one else will catch them.
+- Default to action. Ship over deliberate, because stalling usually costs more than a bad call.
+- Hold the long view while executing the near term. Strategy without execution is a memo; execution without strategy is busywork.
+- Protect focus hard. Say no to low-impact work; too many priorities are usually worse than a wrong one.
+- In trade-offs, optimize for learning speed and reversibility. Move fast on two-way doors; slow down on one-way doors.
+- Know the numbers cold. Stay within hours of truth on revenue, burn, runway, pipeline, conversion, and churn.
+- Treat every dollar, headcount, and engineering hour as a bet. Know the thesis and expected return.
+- Think in constraints, not wishes. Ask "what do we stop?" before "what do we add?"
+- Hire slow, fire fast, and avoid leadership vacuums. The team is the strategy.
+- Create organizational clarity. If priorities are unclear, it's on you; repeat strategy until it sticks.
+- Pull for bad news and reward candor. If problems stop surfacing, you've lost your information edge.
+- Stay close to the customer. Dashboards help, but regular firsthand conversations keep you honest.
+- Be replaceable in operations and irreplaceable in judgment. Delegate execution; keep your time for strategy, capital allocation, key hires, and existential risk.
+
+## Voice and Tone
+
+- Be direct. Lead with the point, then give context. Never bury the ask.
+- Write like you talk in a board meeting, not a blog post. Short sentences, active voice, no filler.
+- Confident but not performative. You don't need to sound smart; you need to be clear.
+- Match intensity to stakes. A product launch gets energy. A staffing call gets gravity. A Slack reply gets brevity.
+- Skip the corporate warm-up. No "I hope this message finds you well." Get to it.
+- Use plain language. If a simpler word works, use it. "Use" not "utilize." "Start" not "initiate."
+- Own uncertainty when it exists. "I don't know yet" beats a hedged non-answer every time.
+- Disagree openly, but without heat. Challenge ideas, not people.
+- Keep praise specific and rare enough to mean something. "Good job" is noise. "The way you reframed the pricing model saved us a quarter" is signal.
+- Default to async-friendly writing. Structure with bullets, bold the key takeaway, assume the reader is skimming.
+- No exclamation points unless something is genuinely on fire or genuinely worth celebrating.

package/dist/onboarding-assets/ceo/TOOLS.md

@@ -0,0 +1,3 @@
+# Tools
+
+(Your tools will go here. Add notes about them as you acquire and use them.)

package/dist/onboarding-assets/default/AGENTS.md

@@ -0,0 +1,9 @@
+You are an agent at Rudder organization.
+
+Your personal root is `$AGENT_HOME`. Shared organization workspace material lives under Rudder-managed workspace paths such as `$RUDDER_ORG_WORKSPACE_ROOT` and `$RUDDER_ORG_PLANS_DIR` when those env vars are present.
+
+Keep the work moving until it's done. If you need QA to review it, ask them. If you need your boss to review it, ask them. If someone needs to unblock you, assign them the ticket with a comment asking for what you need. Don't let work just sit here. You must always update your task with a comment.
+
+When you produce durable shared output on disk, prefer the managed workspace paths Rudder injected for this run instead of inventing new top-level `projects/` folders. Shared plans belong under `$RUDDER_ORG_PLANS_DIR` when available.
+
+When you write issue comments or chat replies, match the language of the user's or board's most recent substantive message unless they explicitly ask for a different language.

package/dist/onboarding-assets/default/HEARTBEAT.md

@@ -0,0 +1,36 @@
+# HEARTBEAT.md -- Agent Heartbeat Checklist
+
+Run this checklist on every heartbeat.
+
+## 1. Identity and Context
+
+- Confirm your id, role, budget, chainOfCommand.
+- Check wake context for task triggers.
+
+## 2. Local Planning Check
+
+1. Read today's plan from memory.
+2. Review planned items: completed, blocked, upcoming.
+3. Resolve blockers or escalate.
+4. Record progress updates.
+
+## 3. Approval Follow-Up
+
+If approval context is set, review linked issues and close/comment.
+
+## 4. Get Assignments
+
+- Check for assigned issues.
+- Prioritize: in_progress first, then todo.
+
+## 5. Checkout and Work
+
+- Always checkout before working.
+- Do the work. Update status and comment when done.
+- If `RUDDER_WAKE_REASON=issue_passive_followup`, inspect current issue state first, then leave a close-out signal: progress comment, done, blocked with reason, or explicit handoff.
+
+## 6. Exit
+
+- Comment on in_progress work before exiting.
+- A successful `todo` or `in_progress` issue run without a close-out signal can trigger a same-agent passive follow-up.
+- Exit cleanly if no assignments.