@rudderhq/server 0.1.0-canary.0

package/dist/agent-workspace-key.js

@@ -0,0 +1,49 @@
+import { createHash } from "node:crypto";
+import { normalizeAgentUrlKey } from "@rudderhq/shared";
+export const AGENT_WORKSPACE_SHORT_ID_MIN_LENGTH = 8;
+export const AGENT_WORKSPACE_SHORT_ID_STEP = 4;
+function normalizeAgentIdHex(agentId) {
+    return agentId.trim().toLowerCase().replace(/[^a-f0-9]/g, "");
+}
+function ensureAgentWorkspaceIdSeed(agentId) {
+    const normalized = normalizeAgentIdHex(agentId);
+    if (normalized.length >= AGENT_WORKSPACE_SHORT_ID_MIN_LENGTH) {
+        return normalized;
+    }
+    return createHash("sha1").update(agentId.trim()).digest("hex");
+}
+export function normalizeAgentWorkspaceSlug(value) {
+    return normalizeAgentUrlKey(value) ?? "agent";
+}
+export function extractAgentWorkspaceShortId(agentId, length = AGENT_WORKSPACE_SHORT_ID_MIN_LENGTH) {
+    const normalizedId = ensureAgentWorkspaceIdSeed(agentId);
+    const safeLength = Math.max(AGENT_WORKSPACE_SHORT_ID_MIN_LENGTH, Math.min(length, normalizedId.length));
+    return normalizedId.slice(0, safeLength);
+}
+export function buildAgentWorkspaceKey(name, agentId, shortIdLength = AGENT_WORKSPACE_SHORT_ID_MIN_LENGTH) {
+    const slug = normalizeAgentWorkspaceSlug(name);
+    const shortId = extractAgentWorkspaceShortId(agentId, shortIdLength);
+    return `${slug}--${shortId}`;
+}
+export function deriveUniqueAgentWorkspaceKey(input) {
+    const existingKeys = new Set(Array.from(input.existingKeys ?? [])
+        .map((value) => value.trim())
+        .filter((value) => value.length > 0));
+    const normalizedId = ensureAgentWorkspaceIdSeed(input.agentId);
+    for (let length = AGENT_WORKSPACE_SHORT_ID_MIN_LENGTH; length <= normalizedId.length; length = length === normalizedId.length ? normalizedId.length + 1 : Math.min(normalizedId.length, length + AGENT_WORKSPACE_SHORT_ID_STEP)) {
+        const candidate = buildAgentWorkspaceKey(input.name, input.agentId, length);
+        if (!existingKeys.has(candidate)) {
+            return candidate;
+        }
+        if (length === normalizedId.length)
+            break;
+    }
+    throw new Error(`Unable to allocate unique workspace key for agent "${input.agentId}".`);
+}
+export function resolveStoredOrDerivedAgentWorkspaceKey(agent) {
+    const stored = agent.workspaceKey?.trim();
+    if (stored)
+        return stored;
+    return buildAgentWorkspaceKey(agent.name, agent.id);
+}
+//# sourceMappingURL=agent-workspace-key.js.map

package/dist/agent-workspace-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-workspace-key.js","sourceRoot":"","sources":["../src/agent-workspace-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC;AACrD,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC;AAQ/C,SAAS,mBAAmB,CAAC,OAAe;IAC1C,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,0BAA0B,CAAC,OAAe;IACjD,MAAM,UAAU,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,UAAU,CAAC,MAAM,IAAI,mCAAmC,EAAE,CAAC;QAC7D,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAAgC;IAC1E,OAAO,oBAAoB,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,OAAe,EAAE,MAAM,GAAG,mCAAmC;IACxG,MAAM,YAAY,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CACzB,mCAAmC,EACnC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,CACtC,CAAC;IACF,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,IAA+B,EAC/B,OAAe,EACf,aAAa,GAAG,mCAAmC;IAEnD,MAAM,IAAI,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,4BAA4B,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACrE,OAAO,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAI7C;IACC,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC;SACjC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CACvC,CAAC;IACF,MAAM,YAAY,GAAG,0BAA0B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAE/D,KACE,IAAI,MAAM,GAAG,mCAAmC,EAChD,MAAM,IAAI,YAAY,CAAC,MAAM,EAC7B,MAAM,GAAG,MAAM,KAAK,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,6BAA6B,CAAC,EACzI,CAAC;QACD,MAAM,SAAS,GAAG,sBAAsB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5E,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,MAAM,KAAK,YAAY,CAAC,MAAM;YAAE,MAAM;IAC5C,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,sDAAsD,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,UAAU,uCAAuC,CAAC,KAA4B;IAClF,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,OAAO,sBAAsB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;AACtD,CAAC"}

package/dist/app.d.ts

@@ -0,0 +1,14 @@
+import type { Db } from "@rudderhq/db";
+import type express from "express";
+import type { RudderAppOptions } from "./bootstrap/types.js";
+export { resolveViteHmrPort } from "./bootstrap/create-http-app.js";
+export interface RudderAppHandle {
+    app: express.Express;
+    close(): Promise<void>;
+}
+export declare function createRudderApp(db: Db, opts: RudderAppOptions): Promise<{
+    app: import("express-serve-static-core").Express;
+    close(): Promise<void>;
+}>;
+export declare function createApp(db: Db, opts: Parameters<typeof createRudderApp>[1]): Promise<import("express-serve-static-core").Express>;
+//# sourceMappingURL=app.d.ts.map

package/dist/app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAEpE,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC;IACrB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,wBAAsB,eAAe,CACnC,EAAE,EAAE,EAAE,EACN,IAAI,EAAE,gBAAgB;;aAQL,OAAO,CAAC,IAAI,CAAC;GAI/B;AAED,wBAAsB,SAAS,CAC7B,EAAE,EAAE,EAAE,EACN,IAAI,EAAE,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC,wDAI5C"}

package/dist/app.js

@@ -0,0 +1,19 @@
+import { createHttpApp } from "./bootstrap/create-http-app.js";
+import { createPluginHostRuntime } from "./bootstrap/plugin-host-runtime.js";
+export { resolveViteHmrPort } from "./bootstrap/create-http-app.js";
+export async function createRudderApp(db, opts) {
+    const pluginRuntime = createPluginHostRuntime(db, opts);
+    const app = await createHttpApp(db, opts, pluginRuntime);
+    await pluginRuntime.start();
+    return {
+        app,
+        async close() {
+            await pluginRuntime.close();
+        },
+    };
+}
+export async function createApp(db, opts) {
+    const handle = await createRudderApp(db, opts);
+    return handle.app;
+}
+//# sourceMappingURL=app.js.map

package/dist/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAE7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAOpE,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAM,EACN,IAAsB;IAEtB,MAAM,aAAa,GAAG,uBAAuB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;IACzD,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC;IAE5B,OAAO;QACL,GAAG;QACH,KAAK,CAAC,KAAK;YACT,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,EAAM,EACN,IAA2C;IAE3C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC,GAAG,CAAC;AACpB,CAAC"}

package/dist/attachment-types.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Shared attachment content-type configuration.
+ *
+ * By default only image types are allowed.  Set the
+ * `RUDDER_ALLOWED_ATTACHMENT_TYPES` environment variable to a
+ * comma-separated list of MIME types or wildcard patterns to expand the
+ * allowed set.
+ *
+ * Examples:
+ *   RUDDER_ALLOWED_ATTACHMENT_TYPES=image/*,application/pdf
+ *   RUDDER_ALLOWED_ATTACHMENT_TYPES=image/*,application/pdf,text/*
+ *
+ * Supported pattern syntax:
+ *   - Exact types:   "application/pdf"
+ *   - Wildcards:     "image/*"  or  "application/vnd.openxmlformats-officedocument.*"
+ */
+export declare const DEFAULT_ALLOWED_TYPES: readonly string[];
+/**
+ * Parse a comma-separated list of MIME type patterns into a normalised array.
+ * Returns the default image-only list when the input is empty or undefined.
+ */
+export declare function parseAllowedTypes(raw: string | undefined): string[];
+/**
+ * Check whether `contentType` matches any entry in `allowedPatterns`.
+ *
+ * Supports exact matches ("application/pdf") and wildcard / prefix
+ * patterns ("image/*", "application/vnd.openxmlformats-officedocument.*").
+ */
+export declare function matchesContentType(contentType: string, allowedPatterns: string[]): boolean;
+/** Convenience wrapper using the process-level allowed list. */
+export declare function isAllowedContentType(contentType: string): boolean;
+export declare const MAX_ATTACHMENT_BYTES: number;
+//# sourceMappingURL=attachment-types.d.ts.map

package/dist/attachment-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachment-types.d.ts","sourceRoot":"","sources":["../src/attachment-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAYlD,CAAC;AAEF;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAOnE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,OAAO,CAS1F;AAQD,gEAAgE;AAChE,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAEjE;AAED,eAAO,MAAM,oBAAoB,QACoC,CAAC"}

package/dist/attachment-types.js

@@ -0,0 +1,67 @@
+/**
+ * Shared attachment content-type configuration.
+ *
+ * By default only image types are allowed.  Set the
+ * `RUDDER_ALLOWED_ATTACHMENT_TYPES` environment variable to a
+ * comma-separated list of MIME types or wildcard patterns to expand the
+ * allowed set.
+ *
+ * Examples:
+ *   RUDDER_ALLOWED_ATTACHMENT_TYPES=image/*,application/pdf
+ *   RUDDER_ALLOWED_ATTACHMENT_TYPES=image/*,application/pdf,text/*
+ *
+ * Supported pattern syntax:
+ *   - Exact types:   "application/pdf"
+ *   - Wildcards:     "image/*"  or  "application/vnd.openxmlformats-officedocument.*"
+ */
+export const DEFAULT_ALLOWED_TYPES = [
+    "image/png",
+    "image/jpeg",
+    "image/jpg",
+    "image/webp",
+    "image/gif",
+    "application/pdf",
+    "text/markdown",
+    "text/plain",
+    "application/json",
+    "text/csv",
+    "text/html",
+];
+/**
+ * Parse a comma-separated list of MIME type patterns into a normalised array.
+ * Returns the default image-only list when the input is empty or undefined.
+ */
+export function parseAllowedTypes(raw) {
+    if (!raw)
+        return [...DEFAULT_ALLOWED_TYPES];
+    const parsed = raw
+        .split(",")
+        .map((s) => s.trim().toLowerCase())
+        .filter((s) => s.length > 0);
+    return parsed.length > 0 ? parsed : [...DEFAULT_ALLOWED_TYPES];
+}
+/**
+ * Check whether `contentType` matches any entry in `allowedPatterns`.
+ *
+ * Supports exact matches ("application/pdf") and wildcard / prefix
+ * patterns ("image/*", "application/vnd.openxmlformats-officedocument.*").
+ */
+export function matchesContentType(contentType, allowedPatterns) {
+    const ct = contentType.toLowerCase();
+    return allowedPatterns.some((pattern) => {
+        if (pattern === "*")
+            return true;
+        if (pattern.endsWith("/*") || pattern.endsWith(".*")) {
+            return ct.startsWith(pattern.slice(0, -1));
+        }
+        return ct === pattern;
+    });
+}
+// ---------- Module-level singletons read once at startup ----------
+const allowedPatterns = parseAllowedTypes(process.env.RUDDER_ALLOWED_ATTACHMENT_TYPES);
+/** Convenience wrapper using the process-level allowed list. */
+export function isAllowedContentType(contentType) {
+    return matchesContentType(contentType, allowedPatterns);
+}
+export const MAX_ATTACHMENT_BYTES = Number(process.env.RUDDER_ATTACHMENT_MAX_BYTES) || 10 * 1024 * 1024;
+//# sourceMappingURL=attachment-types.js.map

package/dist/attachment-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachment-types.js","sourceRoot":"","sources":["../src/attachment-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,WAAW;IACX,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,WAAW;IACX,iBAAiB;IACjB,eAAe;IACf,YAAY;IACZ,kBAAkB;IAClB,UAAU;IACV,WAAW;CACZ,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAuB;IACvD,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,GAAG,qBAAqB,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,GAAG;SACf,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAClC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,qBAAqB,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAmB,EAAE,eAAyB;IAC/E,MAAM,EAAE,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;IACrC,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QACtC,IAAI,OAAO,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACjC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,EAAE,KAAK,OAAO,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,qEAAqE;AAErE,MAAM,eAAe,GAAa,iBAAiB,CACjD,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAC5C,CAAC;AAEF,gEAAgE;AAChE,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,OAAO,kBAAkB,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAC/B,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC"}

package/dist/auth/better-auth.d.ts

@@ -0,0 +1,24 @@
+import type { Request, RequestHandler } from "express";
+import { betterAuth } from "better-auth";
+import type { Db } from "@rudderhq/db";
+import type { Config } from "../config.js";
+export type BetterAuthSessionUser = {
+    id: string;
+    email?: string | null;
+    name?: string | null;
+};
+export type BetterAuthSessionResult = {
+    session: {
+        id: string;
+        userId: string;
+    } | null;
+    user: BetterAuthSessionUser | null;
+};
+type BetterAuthInstance = ReturnType<typeof betterAuth>;
+export declare function deriveAuthTrustedOrigins(config: Config): string[];
+export declare function createBetterAuthInstance(db: Db, config: Config, trustedOrigins?: string[]): BetterAuthInstance;
+export declare function createBetterAuthHandler(auth: BetterAuthInstance): RequestHandler;
+export declare function resolveBetterAuthSessionFromHeaders(auth: BetterAuthInstance, headers: Headers): Promise<BetterAuthSessionResult | null>;
+export declare function resolveBetterAuthSession(auth: BetterAuthInstance, req: Request): Promise<BetterAuthSessionResult | null>;
+export {};
+//# sourceMappingURL=better-auth.d.ts.map

package/dist/auth/better-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"better-auth.d.ts","sourceRoot":"","sources":["../../src/auth/better-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEvD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,cAAc,CAAC;AAOvC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,MAAM,MAAM,qBAAqB,GAAG;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC/C,IAAI,EAAE,qBAAqB,GAAG,IAAI,CAAC;CACpC,CAAC;AAEF,KAAK,kBAAkB,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;AAmBxD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAqBjE;AAED,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,kBAAkB,CAkC9G;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,kBAAkB,GAAG,cAAc,CAKhF;AAED,wBAAsB,mCAAmC,CACvD,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CA0BzC;AAED,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,kBAAkB,EACxB,GAAG,EAAE,OAAO,GACX,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAEzC"}

package/dist/auth/better-auth.js

@@ -0,0 +1,108 @@
+import { betterAuth } from "better-auth";
+import { drizzleAdapter } from "better-auth/adapters/drizzle";
+import { toNodeHandler } from "better-auth/node";
+import { authAccounts, authSessions, authUsers, authVerifications, } from "@rudderhq/db";
+function headersFromNodeHeaders(rawHeaders) {
+    const headers = new Headers();
+    for (const [key, raw] of Object.entries(rawHeaders)) {
+        if (!raw)
+            continue;
+        if (Array.isArray(raw)) {
+            for (const value of raw)
+                headers.append(key, value);
+            continue;
+        }
+        headers.set(key, raw);
+    }
+    return headers;
+}
+function headersFromExpressRequest(req) {
+    return headersFromNodeHeaders(req.headers);
+}
+export function deriveAuthTrustedOrigins(config) {
+    const baseUrl = config.authBaseUrlMode === "explicit" ? config.authPublicBaseUrl : undefined;
+    const trustedOrigins = new Set();
+    if (baseUrl) {
+        try {
+            trustedOrigins.add(new URL(baseUrl).origin);
+        }
+        catch {
+            // Better Auth will surface invalid base URL separately.
+        }
+    }
+    if (config.deploymentMode === "authenticated") {
+        for (const hostname of config.allowedHostnames) {
+            const trimmed = hostname.trim().toLowerCase();
+            if (!trimmed)
+                continue;
+            trustedOrigins.add(`https://${trimmed}`);
+            trustedOrigins.add(`http://${trimmed}`);
+        }
+    }
+    return Array.from(trustedOrigins);
+}
+export function createBetterAuthInstance(db, config, trustedOrigins) {
+    const baseUrl = config.authBaseUrlMode === "explicit" ? config.authPublicBaseUrl : undefined;
+    const secret = process.env.BETTER_AUTH_SECRET ?? process.env.RUDDER_AGENT_JWT_SECRET ?? "rudder-dev-secret";
+    const effectiveTrustedOrigins = trustedOrigins ?? deriveAuthTrustedOrigins(config);
+    const publicUrl = process.env.RUDDER_PUBLIC_URL ?? baseUrl;
+    const isHttpOnly = publicUrl ? publicUrl.startsWith("http://") : false;
+    const authConfig = {
+        baseURL: baseUrl,
+        secret,
+        trustedOrigins: effectiveTrustedOrigins,
+        database: drizzleAdapter(db, {
+            provider: "pg",
+            schema: {
+                user: authUsers,
+                session: authSessions,
+                account: authAccounts,
+                verification: authVerifications,
+            },
+        }),
+        emailAndPassword: {
+            enabled: true,
+            requireEmailVerification: false,
+            disableSignUp: config.authDisableSignUp,
+        },
+        ...(isHttpOnly ? { advanced: { useSecureCookies: false } } : {}),
+    };
+    if (!baseUrl) {
+        delete authConfig.baseURL;
+    }
+    return betterAuth(authConfig);
+}
+export function createBetterAuthHandler(auth) {
+    const handler = toNodeHandler(auth);
+    return (req, res, next) => {
+        void Promise.resolve(handler(req, res)).catch(next);
+    };
+}
+export async function resolveBetterAuthSessionFromHeaders(auth, headers) {
+    const api = auth.api;
+    if (!api?.getSession)
+        return null;
+    const sessionValue = await api.getSession({
+        headers,
+    });
+    if (!sessionValue || typeof sessionValue !== "object")
+        return null;
+    const value = sessionValue;
+    const session = value.session?.id && value.session.userId
+        ? { id: value.session.id, userId: value.session.userId }
+        : null;
+    const user = value.user?.id
+        ? {
+            id: value.user.id,
+            email: value.user.email ?? null,
+            name: value.user.name ?? null,
+        }
+        : null;
+    if (!session || !user)
+        return null;
+    return { session, user };
+}
+export async function resolveBetterAuthSession(auth, req) {
+    return resolveBetterAuthSessionFromHeaders(auth, headersFromExpressRequest(req));
+}
+//# sourceMappingURL=better-auth.js.map

package/dist/auth/better-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"better-auth.js","sourceRoot":"","sources":["../../src/auth/better-auth.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,iBAAiB,GAClB,MAAM,cAAc,CAAC;AAgBtB,SAAS,sBAAsB,CAAC,UAA+B;IAC7D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,KAAK,MAAM,KAAK,IAAI,GAAG;gBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpD,SAAS;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,yBAAyB,CAAC,GAAY;IAC7C,OAAO,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAc;IACrD,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IAEzC,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,cAAc,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,KAAK,eAAe,EAAE,CAAC;QAC9C,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC/C,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC9C,IAAI,CAAC,OAAO;gBAAE,SAAS;YACvB,cAAc,CAAC,GAAG,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC;YACzC,cAAc,CAAC,GAAG,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,EAAM,EAAE,MAAc,EAAE,cAAyB;IACxF,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,mBAAmB,CAAC;IAC5G,MAAM,uBAAuB,GAAG,cAAc,IAAI,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAEnF,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC;IAC3D,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAEvE,MAAM,UAAU,GAAG;QACjB,OAAO,EAAE,OAAO;QAChB,MAAM;QACN,cAAc,EAAE,uBAAuB;QACvC,QAAQ,EAAE,cAAc,CAAC,EAAE,EAAE;YAC3B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE;gBACN,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,YAAY;gBACrB,OAAO,EAAE,YAAY;gBACrB,YAAY,EAAE,iBAAiB;aAChC;SACF,CAAC;QACF,gBAAgB,EAAE;YAChB,OAAO,EAAE,IAAI;YACb,wBAAwB,EAAE,KAAK;YAC/B,aAAa,EAAE,MAAM,CAAC,iBAAiB;SACxC;QACD,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE,CAAC;IAEF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAQ,UAAmC,CAAC,OAAO,CAAC;IACtD,CAAC;IAED,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAwB;IAC9D,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,KAAK,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,IAAwB,EACxB,OAAgB;IAEhB,MAAM,GAAG,GAAI,IAAmF,CAAC,GAAG,CAAC;IACrG,IAAI,CAAC,GAAG,EAAE,UAAU;QAAE,OAAO,IAAI,CAAC;IAElC,MAAM,YAAY,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC;QACxC,OAAO;KACR,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEnE,MAAM,KAAK,GAAG,YAGb,CAAC;IACF,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM;QACvD,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE;QACxD,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,EAAE;QACzB,CAAC,CAAC;YACE,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE;YACjB,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI;YAC/B,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI;SAC9B;QACH,CAAC,CAAC,IAAI,CAAC;IAET,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAwB,EACxB,GAAY;IAEZ,OAAO,mCAAmC,CAAC,IAAI,EAAE,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC;AACnF,CAAC"}

package/dist/board-claim.d.ts

@@ -0,0 +1,23 @@
+import type { Db } from "@rudderhq/db";
+import type { DeploymentMode } from "@rudderhq/shared";
+type ChallengeStatus = "available" | "claimed" | "expired" | "invalid";
+export declare function initializeBoardClaimChallenge(db: Db, opts: {
+    deploymentMode: DeploymentMode;
+}): Promise<void>;
+export declare function getBoardClaimWarningUrl(host: string, port: number): string | null;
+export declare function inspectBoardClaimChallenge(token: string, code: string | undefined): {
+    status: ChallengeStatus;
+    requiresSignIn: boolean;
+    expiresAt: string | null;
+    claimedByUserId: string | null;
+};
+export declare function claimBoardOwnership(db: Db, opts: {
+    token: string;
+    code: string | undefined;
+    userId: string;
+}): Promise<{
+    status: ChallengeStatus;
+    claimedByUserId?: string;
+}>;
+export {};
+//# sourceMappingURL=board-claim.d.ts.map

package/dist/board-claim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"board-claim.d.ts","sourceRoot":"","sources":["../src/board-claim.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,cAAc,CAAC;AAEvC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAKvD,KAAK,eAAe,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAiCvE,wBAAsB,6BAA6B,CACjD,EAAE,EAAE,EAAE,EACN,IAAI,EAAE;IAAE,cAAc,EAAE,cAAc,CAAA;CAAE,GACvC,OAAO,CAAC,IAAI,CAAC,CAoBf;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKjF;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS;;;;;EAQjF;AAED,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,EAAE,EACN,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAChE,OAAO,CAAC;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA6DhE"}

package/dist/board-claim.js

@@ -0,0 +1,115 @@
+import { randomBytes } from "node:crypto";
+import { and, eq } from "drizzle-orm";
+import { organizations, organizationMemberships, instanceUserRoles } from "@rudderhq/db";
+const LOCAL_BOARD_USER_ID = "local-board";
+const CLAIM_TTL_MS = 1000 * 60 * 60 * 24;
+let activeChallenge = null;
+function createChallenge(now = new Date()) {
+    return {
+        token: randomBytes(24).toString("hex"),
+        code: randomBytes(12).toString("hex"),
+        createdAt: now,
+        expiresAt: new Date(now.getTime() + CLAIM_TTL_MS),
+        claimedAt: null,
+        claimedByUserId: null,
+    };
+}
+function getChallengeStatus(token, code) {
+    if (!activeChallenge)
+        return "invalid";
+    if (activeChallenge.token !== token)
+        return "invalid";
+    if (activeChallenge.code !== (code ?? ""))
+        return "invalid";
+    if (activeChallenge.claimedAt)
+        return "claimed";
+    if (activeChallenge.expiresAt.getTime() <= Date.now())
+        return "expired";
+    return "available";
+}
+export async function initializeBoardClaimChallenge(db, opts) {
+    if (opts.deploymentMode !== "authenticated") {
+        activeChallenge = null;
+        return;
+    }
+    const admins = await db
+        .select({ userId: instanceUserRoles.userId })
+        .from(instanceUserRoles)
+        .where(eq(instanceUserRoles.role, "instance_admin"));
+    const onlyLocalBoardAdmin = admins.length === 1 && admins[0]?.userId === LOCAL_BOARD_USER_ID;
+    if (!onlyLocalBoardAdmin) {
+        activeChallenge = null;
+        return;
+    }
+    if (!activeChallenge || activeChallenge.expiresAt.getTime() <= Date.now() || activeChallenge.claimedAt) {
+        activeChallenge = createChallenge();
+    }
+}
+export function getBoardClaimWarningUrl(host, port) {
+    if (!activeChallenge)
+        return null;
+    if (activeChallenge.claimedAt || activeChallenge.expiresAt.getTime() <= Date.now())
+        return null;
+    const visibleHost = host === "0.0.0.0" ? "localhost" : host;
+    return `http://${visibleHost}:${port}/board-claim/${activeChallenge.token}?code=${activeChallenge.code}`;
+}
+export function inspectBoardClaimChallenge(token, code) {
+    const status = getChallengeStatus(token, code);
+    return {
+        status,
+        requiresSignIn: true,
+        expiresAt: activeChallenge?.expiresAt?.toISOString() ?? null,
+        claimedByUserId: activeChallenge?.claimedByUserId ?? null,
+    };
+}
+export async function claimBoardOwnership(db, opts) {
+    const status = getChallengeStatus(opts.token, opts.code);
+    if (status !== "available")
+        return { status };
+    await db.transaction(async (tx) => {
+        const existingTargetAdmin = await tx
+            .select({ id: instanceUserRoles.id })
+            .from(instanceUserRoles)
+            .where(and(eq(instanceUserRoles.userId, opts.userId), eq(instanceUserRoles.role, "instance_admin")))
+            .then((rows) => rows[0] ?? null);
+        if (!existingTargetAdmin) {
+            await tx.insert(instanceUserRoles).values({
+                userId: opts.userId,
+                role: "instance_admin",
+            });
+        }
+        await tx
+            .delete(instanceUserRoles)
+            .where(and(eq(instanceUserRoles.userId, LOCAL_BOARD_USER_ID), eq(instanceUserRoles.role, "instance_admin")));
+        const allCompanies = await tx.select({ id: organizations.id }).from(organizations);
+        for (const organization of allCompanies) {
+            const existing = await tx
+                .select({ id: organizationMemberships.id, status: organizationMemberships.status })
+                .from(organizationMemberships)
+                .where(and(eq(organizationMemberships.orgId, organization.id), eq(organizationMemberships.principalType, "user"), eq(organizationMemberships.principalId, opts.userId)))
+                .then((rows) => rows[0] ?? null);
+            if (!existing) {
+                await tx.insert(organizationMemberships).values({
+                    orgId: organization.id,
+                    principalType: "user",
+                    principalId: opts.userId,
+                    status: "active",
+                    membershipRole: "owner",
+                });
+                continue;
+            }
+            if (existing.status !== "active") {
+                await tx
+                    .update(organizationMemberships)
+                    .set({ status: "active", membershipRole: "owner", updatedAt: new Date() })
+                    .where(eq(organizationMemberships.id, existing.id));
+            }
+        }
+    });
+    if (activeChallenge && activeChallenge.token === opts.token) {
+        activeChallenge.claimedAt = new Date();
+        activeChallenge.claimedByUserId = opts.userId;
+    }
+    return { status: "claimed", claimedByUserId: opts.userId };
+}
+//# sourceMappingURL=board-claim.js.map

package/dist/board-claim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"board-claim.js","sourceRoot":"","sources":["../src/board-claim.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtC,OAAO,EAAE,aAAa,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAGzF,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAC1C,MAAM,YAAY,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAazC,IAAI,eAAe,GAA0B,IAAI,CAAC;AAElD,SAAS,eAAe,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE;IACvC,OAAO;QACL,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QACtC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QACrC,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,YAAY,CAAC;QACjD,SAAS,EAAE,IAAI;QACf,eAAe,EAAE,IAAI;KACtB,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa,EAAE,IAAwB;IACjE,IAAI,CAAC,eAAe;QAAE,OAAO,SAAS,CAAC;IACvC,IAAI,eAAe,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IACtD,IAAI,eAAe,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,eAAe,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IAChD,IAAI,eAAe,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,SAAS,CAAC;IACxE,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,EAAM,EACN,IAAwC;IAExC,IAAI,IAAI,CAAC,cAAc,KAAK,eAAe,EAAE,CAAC;QAC5C,eAAe,GAAG,IAAI,CAAC;QACvB,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC,EAAE,MAAM,EAAE,iBAAiB,CAAC,MAAM,EAAE,CAAC;SAC5C,IAAI,CAAC,iBAAiB,CAAC;SACvB,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAEvD,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,mBAAmB,CAAC;IAC7F,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,eAAe,GAAG,IAAI,CAAC;QACvB,OAAO;IACT,CAAC;IAED,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC,SAAS,EAAE,CAAC;QACvG,eAAe,GAAG,eAAe,EAAE,CAAC;IACtC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAY,EAAE,IAAY;IAChE,IAAI,CAAC,eAAe;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,eAAe,CAAC,SAAS,IAAI,eAAe,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IAChG,MAAM,WAAW,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,OAAO,UAAU,WAAW,IAAI,IAAI,gBAAgB,eAAe,CAAC,KAAK,SAAS,eAAe,CAAC,IAAI,EAAE,CAAC;AAC3G,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAa,EAAE,IAAwB;IAChF,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC/C,OAAO;QACL,MAAM;QACN,cAAc,EAAE,IAAI;QACpB,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,IAAI;QAC5D,eAAe,EAAE,eAAe,EAAE,eAAe,IAAI,IAAI;KAC1D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAM,EACN,IAAiE;IAEjE,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,MAAM,KAAK,WAAW;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAE9C,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QAChC,MAAM,mBAAmB,GAAG,MAAM,EAAE;aACjC,MAAM,CAAC,EAAE,EAAE,EAAE,iBAAiB,CAAC,EAAE,EAAE,CAAC;aACpC,IAAI,CAAC,iBAAiB,CAAC;aACvB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC;aACnG,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,MAAM,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC;gBACxC,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,IAAI,EAAE,gBAAgB;aACvB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE;aACL,MAAM,CAAC,iBAAiB,CAAC;aACzB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,mBAAmB,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;QAE/G,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,aAAa,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACnF,KAAK,MAAM,YAAY,IAAI,YAAY,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,MAAM,EAAE;iBACtB,MAAM,CAAC,EAAE,EAAE,EAAE,uBAAuB,CAAC,EAAE,EAAE,MAAM,EAAE,uBAAuB,CAAC,MAAM,EAAE,CAAC;iBAClF,IAAI,CAAC,uBAAuB,CAAC;iBAC7B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,uBAAuB,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC,EAClD,EAAE,CAAC,uBAAuB,CAAC,aAAa,EAAE,MAAM,CAAC,EACjD,EAAE,CAAC,uBAAuB,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,CACrD,CACF;iBACA,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YAEnC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,EAAE,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,MAAM,CAAC;oBAC9C,KAAK,EAAE,YAAY,CAAC,EAAE;oBACtB,aAAa,EAAE,MAAM;oBACrB,WAAW,EAAE,IAAI,CAAC,MAAM;oBACxB,MAAM,EAAE,QAAQ;oBAChB,cAAc,EAAE,OAAO;iBACxB,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACjC,MAAM,EAAE;qBACL,MAAM,CAAC,uBAAuB,CAAC;qBAC/B,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;qBACzE,KAAK,CAAC,EAAE,CAAC,uBAAuB,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,eAAe,IAAI,eAAe,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QAC5D,eAAe,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QACvC,eAAe,CAAC,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC;IAChD,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;AAC7D,CAAC"}

package/dist/bootstrap/create-http-app.d.ts

@@ -0,0 +1,6 @@
+import type { Db } from "@rudderhq/db";
+import type { PluginHostRuntime } from "./plugin-host-runtime.js";
+import type { RudderAppOptions } from "./types.js";
+export declare function resolveViteHmrPort(serverPort: number): number;
+export declare function createHttpApp(db: Db, opts: RudderAppOptions, pluginRuntime: PluginHostRuntime): Promise<import("express-serve-static-core").Express>;
+//# sourceMappingURL=create-http-app.d.ts.map

package/dist/bootstrap/create-http-app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-http-app.d.ts","sourceRoot":"","sources":["../../src/bootstrap/create-http-app.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,cAAc,CAAC;AASvC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAK7D;AAED,wBAAsB,aAAa,CACjC,EAAE,EAAE,EAAE,EACN,IAAI,EAAE,gBAAgB,EACtB,aAAa,EAAE,iBAAiB,wDA+GjC"}

package/dist/bootstrap/create-http-app.js

@@ -0,0 +1,122 @@
+import express from "express";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { actorMiddleware } from "../middleware/auth.js";
+import { errorHandler, httpLogger } from "../middleware/index.js";
+import { privateHostnameGuard, resolvePrivateHostnameAllowSet } from "../middleware/private-hostname-guard.js";
+import { llmRoutes } from "../routes/llms.js";
+import { pluginUiStaticRoutes } from "../routes/plugin-ui-static.js";
+import { applyUiBranding } from "../ui-branding.js";
+import { DEFAULT_LOCAL_PLUGIN_DIR } from "../services/plugin-loader.js";
+import { registerApiRoutes } from "./register-api-routes.js";
+export function resolveViteHmrPort(serverPort) {
+    if (serverPort <= 55_535) {
+        return serverPort + 10_000;
+    }
+    return Math.max(1_024, serverPort - 10_000);
+}
+export async function createHttpApp(db, opts, pluginRuntime) {
+    const app = express();
+    const privateHostnameGateEnabled = opts.deploymentMode === "authenticated" && opts.deploymentExposure === "private";
+    const privateHostnameAllowSet = resolvePrivateHostnameAllowSet({
+        allowedHostnames: opts.allowedHostnames,
+        bindHost: opts.bindHost,
+    });
+    app.use(express.json({
+        // Organization import/export payloads can inline full portable packages.
+        limit: "10mb",
+        verify: (req, _res, buf) => {
+            req.rawBody = buf;
+        },
+    }));
+    app.use(httpLogger);
+    app.use(privateHostnameGuard({
+        enabled: privateHostnameGateEnabled,
+        allowedHostnames: opts.allowedHostnames,
+        bindHost: opts.bindHost,
+    }));
+    app.use(actorMiddleware(db, {
+        deploymentMode: opts.deploymentMode,
+        resolveSession: opts.resolveSession,
+    }));
+    app.get("/api/auth/get-session", (req, res) => {
+        if (req.actor.type !== "board" || !req.actor.userId) {
+            res.status(401).json({ error: "Unauthorized" });
+            return;
+        }
+        res.json({
+            session: {
+                id: `rudder:${req.actor.source}:${req.actor.userId}`,
+                userId: req.actor.userId,
+            },
+            user: {
+                id: req.actor.userId,
+                email: null,
+                name: req.actor.source === "local_implicit" ? "Local Board" : null,
+            },
+        });
+    });
+    if (opts.betterAuthHandler) {
+        app.all("/api/auth/*authPath", opts.betterAuthHandler);
+    }
+    app.use(llmRoutes(db));
+    app.use("/api", registerApiRoutes(db, opts, pluginRuntime));
+    app.use("/api", (_req, res) => {
+        res.status(404).json({ error: "API route not found" });
+    });
+    app.use(pluginUiStaticRoutes(db, {
+        localPluginDir: opts.localPluginDir ?? DEFAULT_LOCAL_PLUGIN_DIR,
+    }));
+    const __dirname = path.dirname(fileURLToPath(import.meta.url));
+    if (opts.uiMode === "static") {
+        const candidates = [
+            path.resolve(__dirname, "../../ui-dist"),
+            path.resolve(__dirname, "../../../ui/dist"),
+        ];
+        const uiDist = candidates.find((candidate) => fs.existsSync(path.join(candidate, "index.html")));
+        if (uiDist) {
+            const indexHtml = applyUiBranding(fs.readFileSync(path.join(uiDist, "index.html"), "utf-8"));
+            app.use(express.static(uiDist));
+            app.get(/.*/, (_req, res) => {
+                res.status(200).set("Content-Type", "text/html").end(indexHtml);
+            });
+        }
+        else {
+            console.warn("[rudder] UI dist not found; running in API-only mode");
+        }
+    }
+    if (opts.uiMode === "vite-dev") {
+        const uiRoot = path.resolve(__dirname, "../../../ui");
+        const hmrPort = resolveViteHmrPort(opts.serverPort);
+        const { createServer: createViteServer } = await import("vite");
+        const vite = await createViteServer({
+            root: uiRoot,
+            appType: "custom",
+            server: {
+                middlewareMode: true,
+                hmr: {
+                    host: opts.bindHost,
+                    port: hmrPort,
+                    clientPort: hmrPort,
+                },
+                allowedHosts: privateHostnameGateEnabled ? Array.from(privateHostnameAllowSet) : undefined,
+            },
+        });
+        app.use(vite.middlewares);
+        app.get(/.*/, async (req, res, next) => {
+            try {
+                const templatePath = path.resolve(uiRoot, "index.html");
+                const template = fs.readFileSync(templatePath, "utf-8");
+                const html = applyUiBranding(await vite.transformIndexHtml(req.originalUrl, template));
+                res.status(200).set({ "Content-Type": "text/html" }).end(html);
+            }
+            catch (err) {
+                next(err);
+            }
+        });
+    }
+    app.use(errorHandler);
+    return app;
+}
+//# sourceMappingURL=create-http-app.js.map