@slaw-ai/server 2026.611.0

package/dist/middleware/auth.js

@@ -0,0 +1,302 @@
+import { createHash, timingSafeEqual } from "node:crypto";
+import { and, eq, isNull } from "drizzle-orm";
+import { agentApiKeys, agents, authUsers, squads, squadMemberships, instanceUserRoles } from "@slaw-ai/db";
+import { verifyLocalAgentJwt } from "../agent-auth-jwt.js";
+import { logger } from "./logger.js";
+import { operatorAuthService } from "../services/operator-auth.js";
+function hashToken(token) {
+    return createHash("sha256").update(token).digest("hex");
+}
+export function actorMiddleware(db, opts) {
+    const operatorAuth = operatorAuthService(db);
+    return async (req, _res, next) => {
+        req.actor =
+            opts.deploymentMode === "local_trusted"
+                ? {
+                    type: "operator",
+                    userId: "local-operator",
+                    userName: "Local Operator",
+                    userEmail: null,
+                    isInstanceAdmin: true,
+                    source: "local_implicit",
+                }
+                : { type: "none", source: "none" };
+        const runIdHeader = req.header("x-slaw-run-id");
+        const authHeader = req.header("authorization");
+        if (!authHeader?.toLowerCase().startsWith("bearer ")) {
+            if (opts.deploymentMode === "authenticated" && opts.resolveSession) {
+                const cloudTenantActor = await resolveCloudTenantActor(db, req);
+                if (cloudTenantActor) {
+                    req.actor = {
+                        ...cloudTenantActor,
+                        runId: runIdHeader ?? undefined,
+                    };
+                    next();
+                    return;
+                }
+                let session = null;
+                try {
+                    session = await opts.resolveSession(req);
+                }
+                catch (err) {
+                    logger.warn({ err, method: req.method, url: req.originalUrl }, "Failed to resolve auth session from request headers");
+                }
+                if (session?.user?.id) {
+                    const userId = session.user.id;
+                    const [roleRow, memberships] = await Promise.all([
+                        db
+                            .select({ id: instanceUserRoles.id })
+                            .from(instanceUserRoles)
+                            .where(and(eq(instanceUserRoles.userId, userId), eq(instanceUserRoles.role, "instance_admin")))
+                            .then((rows) => rows[0] ?? null),
+                        db
+                            .select({
+                            squadId: squadMemberships.squadId,
+                            membershipRole: squadMemberships.membershipRole,
+                            status: squadMemberships.status,
+                        })
+                            .from(squadMemberships)
+                            .where(and(eq(squadMemberships.principalType, "user"), eq(squadMemberships.principalId, userId), eq(squadMemberships.status, "active"))),
+                    ]);
+                    req.actor = {
+                        type: "operator",
+                        userId,
+                        userName: session.user.name ?? null,
+                        userEmail: session.user.email ?? null,
+                        squadIds: memberships.map((row) => row.squadId),
+                        memberships,
+                        isInstanceAdmin: Boolean(roleRow),
+                        runId: runIdHeader ?? undefined,
+                        source: "session",
+                    };
+                    next();
+                    return;
+                }
+            }
+            if (runIdHeader)
+                req.actor.runId = runIdHeader;
+            next();
+            return;
+        }
+        const token = authHeader.slice("bearer ".length).trim();
+        if (!token) {
+            next();
+            return;
+        }
+        const operatorKey = await operatorAuth.findOperatorApiKeyByToken(token);
+        if (operatorKey) {
+            const access = await operatorAuth.resolveOperatorAccess(operatorKey.userId);
+            if (access.user) {
+                await operatorAuth.touchOperatorApiKey(operatorKey.id);
+                req.actor = {
+                    type: "operator",
+                    userId: operatorKey.userId,
+                    userName: access.user?.name ?? null,
+                    userEmail: access.user?.email ?? null,
+                    squadIds: access.squadIds,
+                    memberships: access.memberships,
+                    isInstanceAdmin: access.isInstanceAdmin,
+                    keyId: operatorKey.id,
+                    runId: runIdHeader || undefined,
+                    source: "operator_key",
+                };
+                next();
+                return;
+            }
+        }
+        const tokenHash = hashToken(token);
+        const key = await db
+            .select()
+            .from(agentApiKeys)
+            .where(and(eq(agentApiKeys.keyHash, tokenHash), isNull(agentApiKeys.revokedAt)))
+            .then((rows) => rows[0] ?? null);
+        if (!key) {
+            const claims = verifyLocalAgentJwt(token);
+            if (!claims) {
+                next();
+                return;
+            }
+            const agentRecord = await db
+                .select()
+                .from(agents)
+                .where(eq(agents.id, claims.sub))
+                .then((rows) => rows[0] ?? null);
+            if (!agentRecord || agentRecord.squadId !== claims.squad_id) {
+                next();
+                return;
+            }
+            if (agentRecord.status === "terminated" || agentRecord.status === "pending_approval") {
+                next();
+                return;
+            }
+            req.actor = {
+                type: "agent",
+                agentId: claims.sub,
+                squadId: claims.squad_id,
+                keyId: undefined,
+                runId: runIdHeader || claims.run_id || undefined,
+                source: "agent_jwt",
+            };
+            next();
+            return;
+        }
+        await db
+            .update(agentApiKeys)
+            .set({ lastUsedAt: new Date() })
+            .where(eq(agentApiKeys.id, key.id));
+        const agentRecord = await db
+            .select()
+            .from(agents)
+            .where(eq(agents.id, key.agentId))
+            .then((rows) => rows[0] ?? null);
+        if (!agentRecord || agentRecord.status === "terminated" || agentRecord.status === "pending_approval") {
+            next();
+            return;
+        }
+        req.actor = {
+            type: "agent",
+            agentId: key.agentId,
+            squadId: key.squadId,
+            keyId: key.id,
+            runId: runIdHeader || undefined,
+            source: "agent_key",
+        };
+        next();
+    };
+}
+async function resolveCloudTenantActor(db, req) {
+    const expectedToken = process.env.SLAW_CLOUD_TENANT_SERVER_TOKEN?.trim();
+    if (!expectedToken)
+        return null;
+    const token = req.header("x-slaw-cloud-tenant-token")?.trim();
+    if (!token || !constantTimeStringEqual(token, expectedToken))
+        return null;
+    const userId = requiredCloudHeader(req, "x-slaw-cloud-user-id");
+    const userEmail = requiredCloudHeader(req, "x-slaw-cloud-user-email").toLowerCase();
+    const stackId = requiredCloudHeader(req, "x-slaw-cloud-stack-id");
+    const stackRole = stackMembershipRole(req.header("x-slaw-cloud-stack-role"));
+    const userName = req.header("x-slaw-cloud-user-name")?.trim() || userEmail;
+    const slawSquadId = req.header("x-slaw-cloud-slaw-squad-id")?.trim();
+    const squadId = cloudTenantSquadId(stackId);
+    const squadName = slawSquadId || `${stackId} Slaw`;
+    const now = new Date();
+    await db
+        .insert(authUsers)
+        .values({
+        id: userId,
+        name: userName,
+        email: userEmail,
+        emailVerified: true,
+        image: null,
+        createdAt: now,
+        updatedAt: now,
+    })
+        .onConflictDoUpdate({
+        target: authUsers.id,
+        set: {
+            name: userName,
+            email: userEmail,
+            emailVerified: true,
+            updatedAt: now,
+        },
+    });
+    await db
+        .insert(instanceUserRoles)
+        .values({
+        userId,
+        role: "instance_admin",
+        updatedAt: now,
+    })
+        .onConflictDoNothing({
+        target: [instanceUserRoles.userId, instanceUserRoles.role],
+    });
+    await db
+        .insert(squads)
+        .values({
+        id: squadId,
+        name: squadName,
+        description: `Provisioned by Slaw Cloud for stack ${stackId}.`,
+        status: "active",
+        issuePrefix: issuePrefixForCloudStack(stackId),
+        updatedAt: now,
+    })
+        .onConflictDoNothing({
+        target: squads.id,
+    });
+    const membershipRole = stackRole === "owner" || stackRole === "admin" ? "owner" : stackRole;
+    const membership = await db
+        .insert(squadMemberships)
+        .values({
+        squadId,
+        principalType: "user",
+        principalId: userId,
+        status: "active",
+        membershipRole,
+        updatedAt: now,
+    })
+        .onConflictDoUpdate({
+        target: [
+            squadMemberships.squadId,
+            squadMemberships.principalType,
+            squadMemberships.principalId,
+        ],
+        set: {
+            status: "active",
+            membershipRole,
+            updatedAt: now,
+        },
+    })
+        .returning()
+        .then((rows) => rows[0] ?? {
+        squadId,
+        membershipRole,
+        status: "active",
+    });
+    return {
+        type: "operator",
+        userId,
+        userName,
+        userEmail,
+        squadIds: [squadId],
+        memberships: [{
+                squadId,
+                membershipRole: membership.membershipRole,
+                status: membership.status,
+            }],
+        isInstanceAdmin: true,
+        source: "cloud_tenant",
+    };
+}
+function requiredCloudHeader(req, name) {
+    const value = req.header(name)?.trim();
+    if (!value) {
+        throw new Error(`Missing trusted Cloud tenant header ${name}`);
+    }
+    return value;
+}
+function stackMembershipRole(value) {
+    if (value === "owner" || value === "admin" || value === "member" || value === "support") {
+        return value;
+    }
+    throw new Error("Invalid trusted Cloud tenant stack role");
+}
+function constantTimeStringEqual(left, right) {
+    const leftBuffer = Buffer.from(left);
+    const rightBuffer = Buffer.from(right);
+    return leftBuffer.length === rightBuffer.length && timingSafeEqual(leftBuffer, rightBuffer);
+}
+function cloudTenantSquadId(stackId) {
+    const bytes = createHash("sha256").update(`slaw-cloud-tenant-squad:${stackId}`).digest();
+    bytes[6] = (bytes[6] & 0x0f) | 0x50;
+    bytes[8] = (bytes[8] & 0x3f) | 0x80;
+    const hex = bytes.subarray(0, 16).toString("hex");
+    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
+}
+function issuePrefixForCloudStack(stackId) {
+    const hash = createHash("sha256").update(stackId).digest("hex").slice(0, 4).toUpperCase();
+    return `PC${hash}`;
+}
+export function requireOperator(req) {
+    return req.actor.type === "operator";
+}
+//# sourceMappingURL=auth.js.map

package/dist/middleware/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC3G,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAG3D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAEnE,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAOD,MAAM,UAAU,eAAe,CAAC,EAAM,EAAE,IAA4B;IAClE,MAAM,YAAY,GAAG,mBAAmB,CAAC,EAAE,CAAC,CAAC;IAC7C,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QAC/B,GAAG,CAAC,KAAK;YACP,IAAI,CAAC,cAAc,KAAK,eAAe;gBACrC,CAAC,CAAC;oBACE,IAAI,EAAE,UAAU;oBAChB,MAAM,EAAE,gBAAgB;oBACxB,QAAQ,EAAE,gBAAgB;oBAC1B,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,IAAI;oBACrB,MAAM,EAAE,gBAAgB;iBACzB;gBACH,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAEvC,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAEhD,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACrD,IAAI,IAAI,CAAC,cAAc,KAAK,eAAe,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBACnE,MAAM,gBAAgB,GAAG,MAAM,uBAAuB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;gBAChE,IAAI,gBAAgB,EAAE,CAAC;oBACrB,GAAG,CAAC,KAAK,GAAG;wBACV,GAAG,gBAAgB;wBACnB,KAAK,EAAE,WAAW,IAAI,SAAS;qBAChC,CAAC;oBACF,IAAI,EAAE,CAAC;oBACP,OAAO;gBACT,CAAC;gBAED,IAAI,OAAO,GAAmC,IAAI,CAAC;gBACnD,IAAI,CAAC;oBACH,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;gBAC3C,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,CAAC,IAAI,CACT,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE,EACjD,qDAAqD,CACtD,CAAC;gBACJ,CAAC;gBACD,IAAI,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;oBACtB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/B,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;wBAC/C,EAAE;6BACC,MAAM,CAAC,EAAE,EAAE,EAAE,iBAAiB,CAAC,EAAE,EAAE,CAAC;6BACpC,IAAI,CAAC,iBAAiB,CAAC;6BACvB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC;6BAC9F,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;wBAClC,EAAE;6BACC,MAAM,CAAC;4BACN,OAAO,EAAE,gBAAgB,CAAC,OAAO;4BACjC,cAAc,EAAE,gBAAgB,CAAC,cAAc;4BAC/C,MAAM,EAAE,gBAAgB,CAAC,MAAM;yBAChC,CAAC;6BACD,IAAI,CAAC,gBAAgB,CAAC;6BACtB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,gBAAgB,CAAC,aAAa,EAAE,MAAM,CAAC,EAC1C,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,MAAM,CAAC,EACxC,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,CACtC,CACF;qBACJ,CAAC,CAAC;oBACH,GAAG,CAAC,KAAK,GAAG;wBACV,IAAI,EAAE,UAAU;wBAChB,MAAM;wBACN,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI;wBACnC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI;wBACrC,QAAQ,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC;wBAC/C,WAAW;wBACX,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC;wBACjC,KAAK,EAAE,WAAW,IAAI,SAAS;wBAC/B,MAAM,EAAE,SAAS;qBAClB,CAAC;oBACF,IAAI,EAAE,CAAC;oBACP,OAAO;gBACT,CAAC;YACH,CAAC;YACD,IAAI,WAAW;gBAAE,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,WAAW,CAAC;YAC/C,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC;QACxE,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,qBAAqB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC5E,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAChB,MAAM,YAAY,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;gBACvD,GAAG,CAAC,KAAK,GAAG;oBACV,IAAI,EAAE,UAAU;oBAChB,MAAM,EAAE,WAAW,CAAC,MAAM;oBAC1B,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,IAAI;oBACnC,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI;oBACrC,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,eAAe,EAAE,MAAM,CAAC,eAAe;oBACvC,KAAK,EAAE,WAAW,CAAC,EAAE;oBACrB,KAAK,EAAE,WAAW,IAAI,SAAS;oBAC/B,MAAM,EAAE,cAAc;iBACvB,CAAC;gBACF,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,MAAM,EAAE;aACjB,MAAM,EAAE;aACR,IAAI,CAAC,YAAY,CAAC;aAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;aAC/E,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;QAEnC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,EAAE;iBACzB,MAAM,EAAE;iBACR,IAAI,CAAC,MAAM,CAAC;iBACZ,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;iBAChC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YAEnC,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,OAAO,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAC5D,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YAED,IAAI,WAAW,CAAC,MAAM,KAAK,YAAY,IAAI,WAAW,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;gBACrF,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YAED,GAAG,CAAC,KAAK,GAAG;gBACV,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,MAAM,CAAC,GAAG;gBACnB,OAAO,EAAE,MAAM,CAAC,QAAQ;gBACxB,KAAK,EAAE,SAAS;gBAChB,KAAK,EAAE,WAAW,IAAI,MAAM,CAAC,MAAM,IAAI,SAAS;gBAChD,MAAM,EAAE,WAAW;aACpB,CAAC;YACF,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,EAAE;aACL,MAAM,CAAC,YAAY,CAAC;aACpB,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC/B,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAEtC,MAAM,WAAW,GAAG,MAAM,EAAE;aACzB,MAAM,EAAE;aACR,IAAI,CAAC,MAAM,CAAC;aACZ,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;aACjC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;QAEnC,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,YAAY,IAAI,WAAW,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;YACrG,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,GAAG,CAAC,KAAK,GAAG;YACV,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,KAAK,EAAE,GAAG,CAAC,EAAE;YACb,KAAK,EAAE,WAAW,IAAI,SAAS;YAC/B,MAAM,EAAE,WAAW;SACpB,CAAC;QAEF,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,EAAM,EAAE,GAAY;IACzD,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,IAAI,EAAE,CAAC;IACzE,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAEhC,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,2BAA2B,CAAC,EAAE,IAAI,EAAE,CAAC;IAC9D,IAAI,CAAC,KAAK,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1E,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,mBAAmB,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC,WAAW,EAAE,CAAC;IACpF,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,wBAAwB,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAC3E,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,4BAA4B,CAAC,EAAE,IAAI,EAAE,CAAC;IACrE,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,WAAW,IAAI,GAAG,OAAO,OAAO,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,MAAM,EAAE;SACL,MAAM,CAAC,SAAS,CAAC;SACjB,MAAM,CAAC;QACN,EAAE,EAAE,MAAM;QACV,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,SAAS;QAChB,aAAa,EAAE,IAAI;QACnB,KAAK,EAAE,IAAI;QACX,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;KACf,CAAC;SACD,kBAAkB,CAAC;QAClB,MAAM,EAAE,SAAS,CAAC,EAAE;QACpB,GAAG,EAAE;YACH,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,SAAS;YAChB,aAAa,EAAE,IAAI;YACnB,SAAS,EAAE,GAAG;SACf;KACF,CAAC,CAAC;IAEL,MAAM,EAAE;SACL,MAAM,CAAC,iBAAiB,CAAC;SACzB,MAAM,CAAC;QACN,MAAM;QACN,IAAI,EAAE,gBAAgB;QACtB,SAAS,EAAE,GAAG;KACf,CAAC;SACD,mBAAmB,CAAC;QACnB,MAAM,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,CAAC,IAAI,CAAC;KAC3D,CAAC,CAAC;IAEL,MAAM,EAAE;SACL,MAAM,CAAC,MAAM,CAAC;SACd,MAAM,CAAC;QACN,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,uCAAuC,OAAO,GAAG;QAC9D,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,wBAAwB,CAAC,OAAO,CAAC;QAC9C,SAAS,EAAE,GAAG;KACf,CAAC;SACD,mBAAmB,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC,EAAE;KAClB,CAAC,CAAC;IAEL,MAAM,cAAc,GAAG,SAAS,KAAK,OAAO,IAAI,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,MAAM,UAAU,GAAG,MAAM,EAAE;SACxB,MAAM,CAAC,gBAAgB,CAAC;SACxB,MAAM,CAAC;QACN,OAAO;QACP,aAAa,EAAE,MAAM;QACrB,WAAW,EAAE,MAAM;QACnB,MAAM,EAAE,QAAQ;QAChB,cAAc;QACd,SAAS,EAAE,GAAG;KACf,CAAC;SACD,kBAAkB,CAAC;QAClB,MAAM,EAAE;YACN,gBAAgB,CAAC,OAAO;YACxB,gBAAgB,CAAC,aAAa;YAC9B,gBAAgB,CAAC,WAAW;SAC7B;QACD,GAAG,EAAE;YACH,MAAM,EAAE,QAAQ;YAChB,cAAc;YACd,SAAS,EAAE,GAAG;SACf;KACF,CAAC;SACD,SAAS,EAAE;SACX,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;QACzB,OAAO;QACP,cAAc;QACd,MAAM,EAAE,QAAQ;KACjB,CAAC,CAAC;IAEL,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,MAAM;QACN,QAAQ;QACR,SAAS;QACT,QAAQ,EAAE,CAAC,OAAO,CAAC;QACnB,WAAW,EAAE,CAAC;gBACZ,OAAO;gBACP,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC;QACF,eAAe,EAAE,IAAI;QACrB,MAAM,EAAE,cAAc;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAY,EAAE,IAAY;IACrD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,uCAAuC,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAyB;IACpD,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAY,EAAE,KAAa;IAC1D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,UAAU,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,2BAA2B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACzF,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IACpC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IACpC,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClD,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;AACjH,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAe;IAC/C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1F,OAAO,KAAK,IAAI,EAAE,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAoB;IAClD,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC;AACvC,CAAC"}

package/dist/middleware/error-handler.d.ts

@@ -0,0 +1,17 @@
+import type { Request, Response, NextFunction } from "express";
+export interface ErrorContext {
+    error: {
+        message: string;
+        stack?: string;
+        name?: string;
+        details?: unknown;
+        raw?: unknown;
+    };
+    method: string;
+    url: string;
+    reqBody?: unknown;
+    reqParams?: unknown;
+    reqQuery?: unknown;
+}
+export declare function errorHandler(err: unknown, req: Request, res: Response, _next: NextFunction): void;
+//# sourceMappingURL=error-handler.d.ts.map

package/dist/middleware/error-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-handler.d.ts","sourceRoot":"","sources":["../../src/middleware/error-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAK/D,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,GAAG,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC5F,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAqBD,wBAAgB,YAAY,CAC1B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,KAAK,EAAE,YAAY,QAqCpB"}

package/dist/middleware/error-handler.js

@@ -0,0 +1,46 @@
+import { ZodError } from "zod";
+import { HttpError } from "../errors.js";
+import { SQUAD_IMPORT_API_PATH } from "../routes/squad-import-paths.js";
+function attachErrorContext(req, res, payload, rawError) {
+    res.__errorContext = {
+        error: payload,
+        method: req.method,
+        url: req.originalUrl,
+        reqBody: req.body,
+        reqParams: req.params,
+        reqQuery: req.query,
+    };
+    if (rawError) {
+        res.err = rawError;
+    }
+}
+export function errorHandler(err, req, res, _next) {
+    if (err instanceof HttpError) {
+        if (err.status >= 500) {
+            attachErrorContext(req, res, { message: err.message, stack: err.stack, name: err.name, details: err.details }, err);
+        }
+        res.status(err.status).json({
+            error: err.message,
+            ...(err.details ? { details: err.details } : {}),
+        });
+        return;
+    }
+    if (err instanceof ZodError) {
+        res.status(400).json({ error: "Validation error", details: err.errors });
+        return;
+    }
+    const rootError = err instanceof Error ? err : new Error(String(err));
+    attachErrorContext(req, res, err instanceof Error
+        ? { message: err.message, stack: err.stack, name: err.name }
+        : { message: String(err), raw: err, stack: rootError.stack, name: rootError.name }, rootError);
+    res.status(500).json({
+        error: "Internal server error",
+        ...(shouldExposeTrustedCloudTenantImportError(req) ? { message: rootError.message } : {}),
+    });
+}
+function shouldExposeTrustedCloudTenantImportError(req) {
+    return req.actor?.source === "cloud_tenant"
+        && req.method === "POST"
+        && req.originalUrl.split("?")[0] === SQUAD_IMPORT_API_PATH;
+}
+//# sourceMappingURL=error-handler.js.map

package/dist/middleware/error-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-handler.js","sourceRoot":"","sources":["../../src/middleware/error-handler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAWxE,SAAS,kBAAkB,CACzB,GAAY,EACZ,GAAa,EACb,OAA8B,EAC9B,QAAgB;IAEf,GAAW,CAAC,cAAc,GAAG;QAC5B,KAAK,EAAE,OAAO;QACd,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,GAAG,EAAE,GAAG,CAAC,WAAW;QACpB,OAAO,EAAE,GAAG,CAAC,IAAI;QACjB,SAAS,EAAE,GAAG,CAAC,MAAM;QACrB,QAAQ,EAAE,GAAG,CAAC,KAAK;KACG,CAAC;IACzB,IAAI,QAAQ,EAAE,CAAC;QACZ,GAAW,CAAC,GAAG,GAAG,QAAQ,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,GAAY,EACZ,GAAY,EACZ,GAAa,EACb,KAAmB;IAEnB,IAAI,GAAG,YAAY,SAAS,EAAE,CAAC;QAC7B,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YACtB,kBAAkB,CAChB,GAAG,EACH,GAAG,EACH,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAChF,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;YAC1B,KAAK,EAAE,GAAG,CAAC,OAAO;YAClB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;QAC5B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACzE,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACtE,kBAAkB,CAChB,GAAG,EACH,GAAG,EACH,GAAG,YAAY,KAAK;QAClB,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;QAC5D,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,EACpF,SAAS,CACV,CAAC;IAEF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QACnB,KAAK,EAAE,uBAAuB;QAC9B,GAAG,CAAC,yCAAyC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1F,CAAC,CAAC;AACL,CAAC;AAED,SAAS,yCAAyC,CAAC,GAAY;IAC7D,OAAO,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,cAAc;WACtC,GAAG,CAAC,MAAM,KAAK,MAAM;WACrB,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,qBAAqB,CAAC;AAC/D,CAAC"}

package/dist/middleware/http-log-policy.d.ts

@@ -0,0 +1,2 @@
+export declare function shouldSilenceHttpSuccessLog(method: string | undefined, url: string | undefined, statusCode: number): boolean;
+//# sourceMappingURL=http-log-policy.d.ts.map

package/dist/middleware/http-log-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-log-policy.d.ts","sourceRoot":"","sources":["../../src/middleware/http-log-policy.ts"],"names":[],"mappings":"AAuCA,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAU5H"}

package/dist/middleware/http-log-policy.js

@@ -0,0 +1,52 @@
+const SILENCED_SUCCESS_METHODS = new Set(["GET", "HEAD"]);
+const SILENCED_SUCCESS_API_PATHS = [
+    /^\/api\/health(?:\/|$)/,
+    /^\/api\/squads\/[^/]+\/activity(?:\/|$)/,
+    /^\/api\/squads\/[^/]+\/dashboard(?:\/|$)/,
+    /^\/api\/squads\/[^/]+\/heartbeat-runs(?:\/|$)/,
+    /^\/api\/squads\/[^/]+\/issues(?:\/|$)/,
+    /^\/api\/squads\/[^/]+\/live-runs(?:\/|$)/,
+    /^\/api\/squads\/[^/]+\/sidebar-badges(?:\/|$)/,
+    /^\/api\/heartbeat-runs\/[^/]+\/log(?:\/|$)/,
+];
+const SILENCED_SUCCESS_STATIC_PREFIXES = [
+    "/@fs/",
+    "/@id/",
+    "/@react-refresh",
+    "/@vite/",
+    "/_plugins/",
+    "/assets/",
+    "/node_modules/",
+    "/src/",
+];
+const SILENCED_SUCCESS_STATIC_PATHS = new Set([
+    "/",
+    "/index.html",
+    "/favicon.ico",
+    "/site.webmanifest",
+    "/sw.js",
+]);
+function normalizePath(url) {
+    const trimmed = url.trim();
+    if (trimmed.length === 0)
+        return "/";
+    const pathname = trimmed.split("?")[0]?.trim() ?? "/";
+    return pathname.length > 0 ? pathname : "/";
+}
+export function shouldSilenceHttpSuccessLog(method, url, statusCode) {
+    if (statusCode >= 400)
+        return false;
+    if (statusCode === 304)
+        return true;
+    if (!method || !url)
+        return false;
+    if (!SILENCED_SUCCESS_METHODS.has(method.toUpperCase()))
+        return false;
+    const pathname = normalizePath(url);
+    if (SILENCED_SUCCESS_STATIC_PATHS.has(pathname))
+        return true;
+    if (SILENCED_SUCCESS_STATIC_PREFIXES.some((prefix) => pathname.startsWith(prefix)))
+        return true;
+    return SILENCED_SUCCESS_API_PATHS.some((pattern) => pattern.test(pathname));
+}
+//# sourceMappingURL=http-log-policy.js.map

package/dist/middleware/http-log-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-log-policy.js","sourceRoot":"","sources":["../../src/middleware/http-log-policy.ts"],"names":[],"mappings":"AAAA,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAE1D,MAAM,0BAA0B,GAAG;IACjC,wBAAwB;IACxB,yCAAyC;IACzC,0CAA0C;IAC1C,+CAA+C;IAC/C,uCAAuC;IACvC,0CAA0C;IAC1C,+CAA+C;IAC/C,4CAA4C;CAC7C,CAAC;AAEF,MAAM,gCAAgC,GAAG;IACvC,OAAO;IACP,OAAO;IACP,iBAAiB;IACjB,SAAS;IACT,YAAY;IACZ,UAAU;IACV,gBAAgB;IAChB,OAAO;CACR,CAAC;AAEF,MAAM,6BAA6B,GAAG,IAAI,GAAG,CAAC;IAC5C,GAAG;IACH,aAAa;IACb,cAAc;IACd,mBAAmB;IACnB,QAAQ;CACT,CAAC,CAAC;AAEH,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC;IACtD,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAA0B,EAAE,GAAuB,EAAE,UAAkB;IACjH,IAAI,UAAU,IAAI,GAAG;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,UAAU,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAClC,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAEtE,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,6BAA6B,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,gCAAgC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChG,OAAO,0BAA0B,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC9E,CAAC"}

package/dist/middleware/index.d.ts

@@ -0,0 +1,4 @@
+export { logger, httpLogger } from "./logger.js";
+export { errorHandler } from "./error-handler.js";
+export { validate } from "./validate.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/middleware/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC"}

package/dist/middleware/index.js

@@ -0,0 +1,4 @@
+export { logger, httpLogger } from "./logger.js";
+export { errorHandler } from "./error-handler.js";
+export { validate } from "./validate.js";
+//# sourceMappingURL=index.js.map

package/dist/middleware/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC"}

package/dist/middleware/logger.d.ts

@@ -0,0 +1,4 @@
+import pino from "pino";
+export declare const logger: pino.Logger<never, boolean>;
+export declare const httpLogger: import("pino-http").HttpLogger<import("http").IncomingMessage, import("http").ServerResponse<import("http").IncomingMessage>, never>;
+//# sourceMappingURL=logger.d.ts.map

package/dist/middleware/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/middleware/logger.ts"],"names":[],"mappings":"AAEA,OAAO,IAAI,MAAM,MAAM,CAAC;AA2BxB,eAAO,MAAM,MAAM,6BAgBhB,CAAC;AAEJ,eAAO,MAAM,UAAU,sIA+CrB,CAAC"}

package/dist/middleware/logger.js

@@ -0,0 +1,92 @@
+import path from "node:path";
+import fs from "node:fs";
+import pino from "pino";
+import { pinoHttp } from "pino-http";
+import { readConfigFile } from "../config-file.js";
+import { resolveDefaultLogsDir, resolveHomeAwarePath } from "../home-paths.js";
+import { shouldSilenceHttpSuccessLog } from "./http-log-policy.js";
+function resolveServerLogDir() {
+    const envOverride = process.env.SLAW_LOG_DIR?.trim();
+    if (envOverride)
+        return resolveHomeAwarePath(envOverride);
+    const fileLogDir = readConfigFile()?.logging.logDir?.trim();
+    if (fileLogDir)
+        return resolveHomeAwarePath(fileLogDir);
+    return resolveDefaultLogsDir();
+}
+const logDir = resolveServerLogDir();
+fs.mkdirSync(logDir, { recursive: true });
+const logFile = path.join(logDir, "server.log");
+const sharedOpts = {
+    translateTime: "SYS:HH:MM:ss",
+    ignore: "pid,hostname",
+    singleLine: true,
+};
+export const logger = pino({
+    level: "debug",
+    redact: ["req.headers.authorization"],
+}, pino.transport({
+    targets: [
+        {
+            target: "pino-pretty",
+            options: { ...sharedOpts, ignore: "pid,hostname,req,res,responseTime", colorize: true, destination: 1 },
+            level: "info",
+        },
+        {
+            target: "pino-pretty",
+            options: { ...sharedOpts, colorize: false, destination: logFile, mkdir: true },
+            level: "debug",
+        },
+    ],
+}));
+export const httpLogger = pinoHttp({
+    logger,
+    customLogLevel(_req, res, err) {
+        if (shouldSilenceHttpSuccessLog(_req.method, _req.url, res.statusCode)) {
+            return "silent";
+        }
+        if (err || res.statusCode >= 500)
+            return "error";
+        if (res.statusCode >= 400)
+            return "warn";
+        return "info";
+    },
+    customSuccessMessage(req, res) {
+        return `${req.method} ${req.url} ${res.statusCode}`;
+    },
+    customErrorMessage(req, res, err) {
+        const ctx = res.__errorContext;
+        const errMsg = ctx?.error?.message || err?.message || res.err?.message || "unknown error";
+        return `${req.method} ${req.url} ${res.statusCode} — ${errMsg}`;
+    },
+    customProps(req, res) {
+        if (res.statusCode >= 400) {
+            const ctx = res.__errorContext;
+            if (ctx) {
+                return {
+                    errorContext: ctx.error,
+                    reqBody: ctx.reqBody,
+                    reqParams: ctx.reqParams,
+                    reqQuery: ctx.reqQuery,
+                };
+            }
+            const props = {};
+            const { body, params, query } = req;
+            if (body && typeof body === "object" && Object.keys(body).length > 0) {
+                props.reqBody = body;
+            }
+            if (params && typeof params === "object" && Object.keys(params).length > 0) {
+                props.reqParams = params;
+            }
+            if (query && typeof query === "object" && Object.keys(query).length > 0) {
+                props.reqQuery = query;
+            }
+            if (req.route?.path) {
+                props.routePath = req.route.path;
+            }
+            return props;
+        }
+        return {};
+    },
+});
+//# sourceMappingURL=logger.js.map

package/dist/middleware/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/middleware/logger.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AAEnE,SAAS,mBAAmB;IAC1B,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;IACrD,IAAI,WAAW;QAAE,OAAO,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAE1D,MAAM,UAAU,GAAG,cAAc,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IAC5D,IAAI,UAAU;QAAE,OAAO,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAExD,OAAO,qBAAqB,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;AACrC,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAE1C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AAEhD,MAAM,UAAU,GAAG;IACjB,aAAa,EAAE,cAAc;IAC7B,MAAM,EAAE,cAAc;IACtB,UAAU,EAAE,IAAI;CACjB,CAAC;AAEF,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,CAAC,2BAA2B,CAAC;CACtC,EAAE,IAAI,CAAC,SAAS,CAAC;IAChB,OAAO,EAAE;QACP;YACE,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,mCAAmC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;YACvG,KAAK,EAAE,MAAM;SACd;QACD;YACE,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE;YAC9E,KAAK,EAAE,OAAO;SACf;KACF;CACF,CAAC,CAAC,CAAC;AAEJ,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAC;IACjC,MAAM;IACN,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG;QAC3B,IAAI,2BAA2B,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACvE,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG;YAAE,OAAO,OAAO,CAAC;QACjD,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG;YAAE,OAAO,MAAM,CAAC;QACzC,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,oBAAoB,CAAC,GAAG,EAAE,GAAG;QAC3B,OAAO,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;IACtD,CAAC;IACD,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG;QAC9B,MAAM,GAAG,GAAI,GAAW,CAAC,cAAc,CAAC;QACxC,MAAM,MAAM,GAAG,GAAG,EAAE,KAAK,EAAE,OAAO,IAAI,GAAG,EAAE,OAAO,IAAK,GAAW,CAAC,GAAG,EAAE,OAAO,IAAI,eAAe,CAAC;QACnG,OAAO,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,MAAM,MAAM,EAAE,CAAC;IAClE,CAAC;IACD,WAAW,CAAC,GAAG,EAAE,GAAG;QAClB,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAI,GAAW,CAAC,cAAc,CAAC;YACxC,IAAI,GAAG,EAAE,CAAC;gBACR,OAAO;oBACL,YAAY,EAAE,GAAG,CAAC,KAAK;oBACvB,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;iBACvB,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAA4B,EAAE,CAAC;YAC1C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,GAAU,CAAC;YAC3C,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrE,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;YACvB,CAAC;YACD,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3E,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC;YAC3B,CAAC;YACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxE,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC;YACzB,CAAC;YACD,IAAK,GAAW,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;gBAC7B,KAAK,CAAC,SAAS,GAAI,GAAW,CAAC,KAAK,CAAC,IAAI,CAAC;YAC5C,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;CACF,CAAC,CAAC"}

package/dist/middleware/operator-mutation-guard.d.ts

@@ -0,0 +1,3 @@
+import type { RequestHandler } from "express";
+export declare function operatorMutationGuard(): RequestHandler;
+//# sourceMappingURL=operator-mutation-guard.d.ts.map

package/dist/middleware/operator-mutation-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operator-mutation-guard.d.ts","sourceRoot":"","sources":["../../src/middleware/operator-mutation-guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,cAAc,EAAE,MAAM,SAAS,CAAC;AA8CvD,wBAAgB,qBAAqB,IAAI,cAAc,CA+BtD"}