@taskforcehq/taskforce 0.3.168

package/dist/server/auth.d.ts

@@ -0,0 +1,51 @@
+import type { IncomingMessage } from 'http';
+import type { RuntimeMode } from './runtimeMode.js';
+export type TaskforceRole = 'owner' | 'admin' | 'member' | 'read-only';
+export type TaskforceSystemRole = 'system_admin' | 'user';
+export interface TaskforceAuthConfig {
+    runtimeMode: RuntimeMode;
+    enabled: boolean;
+    requiredForApi: boolean;
+    excludedPaths: string[];
+    defaultRole: TaskforceRole;
+    defaultWorkspaceId: string;
+    sessionCookieName: string;
+    sessionSecret: string;
+    sessionTtlSeconds: number;
+    sessionCookieSameSite: 'Lax' | 'Strict' | 'None';
+    sessionCookieSecure: boolean;
+    sessionCookieDomain?: string;
+}
+export declare function resolveAuthConfigFromEnv(runtimeMode: RuntimeMode, env?: NodeJS.ProcessEnv): TaskforceAuthConfig;
+interface SessionCookieOverrides {
+    secure?: boolean;
+    sameSite?: 'Lax' | 'Strict' | 'None';
+}
+interface SessionCookieAttributes {
+    secure: boolean;
+    sameSite: 'Lax' | 'Strict' | 'None';
+}
+export declare function resolveSessionCookieAttributesForRequest(req: IncomingMessage, config: TaskforceAuthConfig): SessionCookieAttributes;
+export declare function createSessionTokenCookie(sessionId: string, config: TaskforceAuthConfig, options?: {
+    role?: TaskforceRole;
+    workspaceId?: string;
+    userId?: string;
+    secure?: boolean;
+    sameSite?: 'Lax' | 'Strict' | 'None';
+}): string;
+export declare function createClearSessionCookie(config: TaskforceAuthConfig, options?: SessionCookieOverrides): string;
+export declare function hasValidSession(req: IncomingMessage, config: TaskforceAuthConfig): boolean;
+export interface RequestAccessContext {
+    authenticated: boolean;
+    sessionId: string | null;
+    role: TaskforceRole;
+    systemRole: TaskforceSystemRole;
+    workspaceId: string;
+    userId: string;
+}
+export declare function resolveRequestAccess(req: IncomingMessage, config: TaskforceAuthConfig): RequestAccessContext;
+export declare function isRequestAuthorized(req: IncomingMessage, config: TaskforceAuthConfig): {
+    allowed: boolean;
+    reason?: string;
+};
+export {};

package/dist/server/auth.js

@@ -0,0 +1,266 @@
+import { createHmac, timingSafeEqual } from 'crypto';
+function parseBoolean(raw, fallback) {
+    if (raw === undefined)
+        return fallback;
+    const normalized = String(raw).trim().toLowerCase();
+    if (['1', 'true', 'yes', 'on'].includes(normalized))
+        return true;
+    if (['0', 'false', 'no', 'off'].includes(normalized))
+        return false;
+    return fallback;
+}
+function normalizeRole(raw, fallback = 'member') {
+    const value = String(raw || '').trim().toLowerCase();
+    if (value === 'owner' || value === 'admin' || value === 'member' || value === 'read-only')
+        return value;
+    if (value === 'readonly')
+        return 'read-only';
+    return fallback;
+}
+function parsePositiveInt(raw, fallback) {
+    const value = Number.parseInt(String(raw || ''), 10);
+    if (!Number.isFinite(value) || value <= 0)
+        return fallback;
+    return value;
+}
+function normalizeSameSite(raw, fallback) {
+    const value = String(raw || '').trim().toLowerCase();
+    if (value === 'lax')
+        return 'Lax';
+    if (value === 'strict')
+        return 'Strict';
+    if (value === 'none')
+        return 'None';
+    return fallback;
+}
+function toBase64Url(input) {
+    return Buffer.from(input, 'utf8').toString('base64url');
+}
+function fromBase64Url(input) {
+    try {
+        return Buffer.from(input, 'base64url').toString('utf8');
+    }
+    catch {
+        return null;
+    }
+}
+function signPayload(payload, secret) {
+    return createHmac('sha256', secret).update(payload).digest('base64url');
+}
+function parseCookieHeader(raw) {
+    if (!raw)
+        return {};
+    const pairs = raw.split(';');
+    const result = {};
+    for (const pair of pairs) {
+        const trimmed = pair.trim();
+        if (!trimmed)
+            continue;
+        const idx = trimmed.indexOf('=');
+        if (idx <= 0)
+            continue;
+        const key = trimmed.slice(0, idx).trim();
+        const value = trimmed.slice(idx + 1).trim();
+        if (key)
+            result[key] = value;
+    }
+    return result;
+}
+export function resolveAuthConfigFromEnv(runtimeMode, env = process.env) {
+    const explicitEnabled = env.TASKFORCE_AUTH_ENABLED;
+    const enabled = explicitEnabled !== undefined
+        ? parseBoolean(explicitEnabled, false)
+        : (runtimeMode === 'cloud');
+    const requiredForApi = parseBoolean(env.TASKFORCE_AUTH_REQUIRED_FOR_API, runtimeMode === 'cloud');
+    const excludedPathsRaw = env.TASKFORCE_AUTH_EXCLUDED_PATHS || '/api/taskforce/health,/api/taskforce/version,/api/taskforce/auth';
+    const excludedPaths = excludedPathsRaw
+        .split(',')
+        .map(v => v.trim())
+        .filter(Boolean);
+    const sessionCookieName = (env.TASKFORCE_AUTH_SESSION_COOKIE || 'taskforce_session').trim();
+    const sessionSecret = (env.TASKFORCE_AUTH_SESSION_SECRET || '').trim();
+    const sessionTtlSeconds = parsePositiveInt(env.TASKFORCE_AUTH_SESSION_TTL_SECONDS, 60 * 60 * 24 * 30);
+    const sessionCookieSameSite = normalizeSameSite(env.TASKFORCE_AUTH_SESSION_SAMESITE, runtimeMode === 'cloud' ? 'None' : 'Lax');
+    const sessionCookieSecure = parseBoolean(env.TASKFORCE_AUTH_SESSION_SECURE, runtimeMode === 'cloud');
+    const sessionCookieDomain = String(env.TASKFORCE_AUTH_SESSION_DOMAIN || '').trim() || undefined;
+    const defaultRole = normalizeRole(env.TASKFORCE_AUTH_DEFAULT_ROLE, 'member');
+    // No env-configured default workspace. Workspace selection must come from
+    // explicit header/session resolution and user setup flows.
+    const defaultWorkspaceId = '';
+    return {
+        runtimeMode,
+        enabled,
+        requiredForApi,
+        excludedPaths,
+        defaultRole,
+        defaultWorkspaceId,
+        sessionCookieName,
+        sessionSecret,
+        sessionTtlSeconds,
+        sessionCookieSameSite,
+        sessionCookieSecure,
+        sessionCookieDomain
+    };
+}
+function resolveSessionCookieAttributes(config, overrides) {
+    const secure = typeof overrides?.secure === 'boolean'
+        ? overrides.secure
+        : config.sessionCookieSecure;
+    const preferredSameSite = overrides?.sameSite || config.sessionCookieSameSite;
+    // Browsers reject SameSite=None cookies unless Secure is present.
+    const sameSite = (!secure && preferredSameSite === 'None')
+        ? 'Lax'
+        : preferredSameSite;
+    return { secure, sameSite };
+}
+function firstHeaderValue(value) {
+    if (Array.isArray(value))
+        return String(value[0] || '');
+    return String(value || '');
+}
+function isLoopbackHost(host) {
+    const normalized = String(host || '').trim().toLowerCase();
+    return normalized === 'localhost' || normalized === '127.0.0.1' || normalized === '::1';
+}
+export function resolveSessionCookieAttributesForRequest(req, config) {
+    const forwardedProto = firstHeaderValue(req.headers['x-forwarded-proto'])
+        .split(',')[0]
+        .trim()
+        .toLowerCase();
+    const forwardedSsl = firstHeaderValue(req.headers['x-forwarded-ssl']).trim().toLowerCase();
+    const forwardedScheme = firstHeaderValue(req.headers['x-forwarded-scheme']).trim().toLowerCase();
+    const hostHeader = firstHeaderValue(req.headers.host).split(',')[0].trim();
+    const host = hostHeader.includes(':') ? hostHeader.slice(0, hostHeader.indexOf(':')) : hostHeader;
+    const encryptedSocket = Boolean(req.socket?.encrypted);
+    let requestIsHttps;
+    if (forwardedProto) {
+        requestIsHttps = forwardedProto === 'https';
+    }
+    else if (forwardedScheme) {
+        requestIsHttps = forwardedScheme === 'https';
+    }
+    else if (forwardedSsl) {
+        requestIsHttps = forwardedSsl === 'on' || forwardedSsl === '1' || forwardedSsl === 'true';
+    }
+    else if (encryptedSocket) {
+        requestIsHttps = true;
+    }
+    else {
+        // Many production deployments terminate TLS at a proxy and may not forward
+        // proto headers consistently. Default to secure for non-loopback hosts.
+        requestIsHttps = !isLoopbackHost(host);
+    }
+    const secure = config.sessionCookieSecure && requestIsHttps;
+    return resolveSessionCookieAttributes(config, { secure });
+}
+export function createSessionTokenCookie(sessionId, config, options) {
+    if (!config.sessionSecret) {
+        throw new Error('Session secret is not configured.');
+    }
+    const attrs = resolveSessionCookieAttributes(config, options);
+    const exp = Date.now() + (config.sessionTtlSeconds * 1000);
+    const payload = toBase64Url(JSON.stringify({
+        sessionId,
+        exp,
+        role: options?.role,
+        workspaceId: options?.workspaceId,
+        userId: options?.userId
+    }));
+    const sig = signPayload(payload, config.sessionSecret);
+    const value = `${payload}.${sig}`;
+    const domainPart = config.sessionCookieDomain ? `; Domain=${config.sessionCookieDomain}` : '';
+    const securePart = attrs.secure ? '; Secure' : '';
+    return `${config.sessionCookieName}=${value}; Path=/; HttpOnly; SameSite=${attrs.sameSite}; Max-Age=${config.sessionTtlSeconds}${securePart}${domainPart}`;
+}
+export function createClearSessionCookie(config, options) {
+    const attrs = resolveSessionCookieAttributes(config, options);
+    const domainPart = config.sessionCookieDomain ? `; Domain=${config.sessionCookieDomain}` : '';
+    const securePart = attrs.secure ? '; Secure' : '';
+    return `${config.sessionCookieName}=; Path=/; HttpOnly; SameSite=${attrs.sameSite}; Max-Age=0${securePart}${domainPart}`;
+}
+function readSessionClaimsFromRequest(req, config) {
+    if (!config.sessionSecret || !config.sessionCookieName)
+        return null;
+    const cookies = parseCookieHeader(typeof req.headers.cookie === 'string' ? req.headers.cookie : undefined);
+    const rawValue = cookies[config.sessionCookieName];
+    if (!rawValue)
+        return null;
+    const splitIndex = rawValue.lastIndexOf('.');
+    if (splitIndex <= 0)
+        return null;
+    const payload = rawValue.slice(0, splitIndex);
+    const sig = rawValue.slice(splitIndex + 1);
+    const expectedSig = signPayload(payload, config.sessionSecret);
+    const sigBuf = Buffer.from(sig);
+    const expectedBuf = Buffer.from(expectedSig);
+    if (sigBuf.length !== expectedBuf.length || !timingSafeEqual(sigBuf, expectedBuf))
+        return null;
+    const decoded = fromBase64Url(payload);
+    if (!decoded)
+        return null;
+    try {
+        const parsed = JSON.parse(decoded);
+        if (!parsed?.sessionId || typeof parsed.sessionId !== 'string')
+            return null;
+        if (!parsed?.exp || typeof parsed.exp !== 'number' || parsed.exp < Date.now())
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+export function hasValidSession(req, config) {
+    return Boolean(readSessionClaimsFromRequest(req, config));
+}
+export function resolveRequestAccess(req, config) {
+    const fallbackUserId = 'anonymous';
+    const requestedWorkspaceHeader = Array.isArray(req.headers['x-taskforce-workspace-id'])
+        ? req.headers['x-taskforce-workspace-id'][0]
+        : req.headers['x-taskforce-workspace-id'];
+    const requestedWorkspaceId = String(requestedWorkspaceHeader || '').trim();
+    const fallbackWorkspaceId = (requestedWorkspaceId
+        && requestedWorkspaceId.length <= 120
+        && !/\s/.test(requestedWorkspaceId)) ? requestedWorkspaceId : config.defaultWorkspaceId;
+    const base = {
+        authenticated: false,
+        sessionId: null,
+        role: config.defaultRole,
+        systemRole: 'user',
+        workspaceId: fallbackWorkspaceId,
+        userId: fallbackUserId
+    };
+    const sessionClaims = readSessionClaimsFromRequest(req, config);
+    if (sessionClaims?.sessionId) {
+        const role = normalizeRole(sessionClaims.role, config.defaultRole);
+        return {
+            authenticated: true,
+            sessionId: sessionClaims.sessionId,
+            role,
+            systemRole: 'user',
+            workspaceId: String(sessionClaims.workspaceId || config.defaultWorkspaceId).trim() || config.defaultWorkspaceId,
+            userId: String(sessionClaims.userId || fallbackUserId).trim() || fallbackUserId
+        };
+    }
+    return base;
+}
+function pathMatchesExcluded(pathname, excludedPaths) {
+    return excludedPaths.some((path) => pathname === path || pathname.startsWith(`${path}/`));
+}
+export function isRequestAuthorized(req, config) {
+    if (!config.enabled || !config.requiredForApi)
+        return { allowed: true };
+    const pathname = (req.url || '/').split('?')[0] || '/';
+    if (!pathname.startsWith('/api/'))
+        return { allowed: true };
+    if (pathMatchesExcluded(pathname, config.excludedPaths))
+        return { allowed: true };
+    if (!config.sessionSecret)
+        return { allowed: false, reason: 'Auth enabled but session secret is not configured.' };
+    if (hasValidSession(req, config))
+        return { allowed: true };
+    const tokenMissing = !parseCookieHeader(typeof req.headers.cookie === 'string' ? req.headers.cookie : undefined)[config.sessionCookieName];
+    if (tokenMissing)
+        return { allowed: false, reason: 'Missing auth session.' };
+    return { allowed: false, reason: 'Invalid auth session.' };
+}

package/dist/server/auth.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/auth.test.js

@@ -0,0 +1,111 @@
+import { describe, expect, it } from 'vitest';
+import { createClearSessionCookie, createSessionTokenCookie, hasValidSession, isRequestAuthorized, resolveAuthConfigFromEnv, resolveRequestAccess, resolveSessionCookieAttributesForRequest } from './auth';
+function mockReq(url, headers = {}) {
+    return {
+        url,
+        headers,
+        socket: { encrypted: false }
+    };
+}
+describe('server/auth', () => {
+    it('defaults to disabled auth when no explicit config in local mode', () => {
+        const config = resolveAuthConfigFromEnv('local', {});
+        expect(config.enabled).toBe(false);
+        expect(config.requiredForApi).toBe(false);
+        expect(config.sessionCookieSecure).toBe(false);
+        expect(config.excludedPaths).toEqual(['/api/taskforce/health', '/api/taskforce/version', '/api/taskforce/auth']);
+    });
+    it('defaults to auth-required in cloud mode', () => {
+        const config = resolveAuthConfigFromEnv('cloud', {});
+        expect(config.enabled).toBe(true);
+        expect(config.requiredForApi).toBe(true);
+        expect(config.sessionCookieSecure).toBe(true);
+    });
+    it('allows excluded health path without session', () => {
+        const config = resolveAuthConfigFromEnv('cloud', {
+            TASKFORCE_AUTH_ENABLED: 'true',
+            TASKFORCE_AUTH_SESSION_SECRET: 'secret'
+        });
+        const result = isRequestAuthorized(mockReq('/api/taskforce/health'), config);
+        expect(result.allowed).toBe(true);
+    });
+    it('denies protected api path without session', () => {
+        const config = resolveAuthConfigFromEnv('cloud', {
+            TASKFORCE_AUTH_ENABLED: 'true',
+            TASKFORCE_AUTH_SESSION_SECRET: 'secret'
+        });
+        const result = isRequestAuthorized(mockReq('/api/taskforce/tasks'), config);
+        expect(result.allowed).toBe(false);
+        expect(result.reason).toContain('Missing auth session');
+    });
+    it('allows protected api path with valid signed session cookie', () => {
+        const config = resolveAuthConfigFromEnv('cloud', {
+            TASKFORCE_AUTH_ENABLED: 'true',
+            TASKFORCE_AUTH_SESSION_SECRET: 'session-secret'
+        });
+        const cookieHeader = createSessionTokenCookie('session-1', config);
+        const cookieValue = cookieHeader.split(';')[0];
+        const result = isRequestAuthorized(mockReq('/api/taskforce/tasks', { cookie: cookieValue }), config);
+        expect(result.allowed).toBe(true);
+        expect(hasValidSession(mockReq('/api/taskforce/tasks', { cookie: cookieValue }), config)).toBe(true);
+    });
+    it('resolves role/workspace/user from session claims', () => {
+        const config = resolveAuthConfigFromEnv('cloud', {
+            TASKFORCE_AUTH_ENABLED: 'true',
+            TASKFORCE_AUTH_SESSION_SECRET: 'session-secret'
+        });
+        const cookieHeader = createSessionTokenCookie('session-2', config, {
+            role: 'admin',
+            workspaceId: 'workspace-123',
+            userId: 'user-abc'
+        });
+        const cookieValue = cookieHeader.split(';')[0];
+        const access = resolveRequestAccess(mockReq('/api/taskforce/tasks', { cookie: cookieValue }), config);
+        expect(access.authenticated).toBe(true);
+        expect(access.role).toBe('admin');
+        expect(access.workspaceId).toBe('workspace-123');
+        expect(access.userId).toBe('user-abc');
+    });
+    it('uses requested workspace header for unauthenticated access context', () => {
+        const config = resolveAuthConfigFromEnv('local', {});
+        const access = resolveRequestAccess(mockReq('/api/taskforce/tasks', { 'x-taskforce-workspace-id': 'project-acme' }), config);
+        expect(access.authenticated).toBe(false);
+        expect(access.workspaceId).toBe('project-acme');
+    });
+    it('downgrades SameSite=None to Lax when request is HTTP and secure cookies are unavailable', () => {
+        const config = resolveAuthConfigFromEnv('cloud', {
+            TASKFORCE_AUTH_ENABLED: 'true',
+            TASKFORCE_AUTH_SESSION_SECRET: 'session-secret'
+        });
+        const attrs = resolveSessionCookieAttributesForRequest(mockReq('/api/taskforce/auth/login', { 'x-forwarded-proto': 'http' }), config);
+        expect(attrs.secure).toBe(false);
+        expect(attrs.sameSite).toBe('Lax');
+        const cookie = createSessionTokenCookie('session-http', config, attrs);
+        expect(cookie).toContain('SameSite=Lax');
+        expect(cookie).not.toContain('; Secure');
+        const clearCookie = createClearSessionCookie(config, attrs);
+        expect(clearCookie).toContain('SameSite=Lax');
+        expect(clearCookie).not.toContain('; Secure');
+    });
+    it('keeps secure cookie attributes for non-loopback hosts when TLS is terminated upstream', () => {
+        const config = resolveAuthConfigFromEnv('cloud', {
+            TASKFORCE_AUTH_ENABLED: 'true',
+            TASKFORCE_AUTH_SESSION_SECRET: 'session-secret'
+        });
+        const attrs = resolveSessionCookieAttributesForRequest(mockReq('/api/taskforce/auth/login', { host: 'app.taskforcehq.ai' }), config);
+        expect(attrs.secure).toBe(true);
+        expect(attrs.sameSite).toBe('None');
+        const cookie = createSessionTokenCookie('session-proxy', config, attrs);
+        expect(cookie).toContain('SameSite=None');
+        expect(cookie).toContain('; Secure');
+    });
+    it('uses non-secure cookie attributes on loopback hosts without https forwarding headers', () => {
+        const config = resolveAuthConfigFromEnv('cloud', {
+            TASKFORCE_AUTH_ENABLED: 'true',
+            TASKFORCE_AUTH_SESSION_SECRET: 'session-secret'
+        });
+        const attrs = resolveSessionCookieAttributesForRequest(mockReq('/api/taskforce/auth/login', { host: 'localhost:3000' }), config);
+        expect(attrs.secure).toBe(false);
+        expect(attrs.sameSite).toBe('Lax');
+    });
+});

package/dist/server/buildInfo.d.ts

@@ -0,0 +1,7 @@
+export interface TaskforceBuildInfo {
+    version: string;
+    gitSha: string | null;
+    buildTime: string | null;
+    deployId: string | null;
+}
+export declare function resolveBuildInfo(env?: NodeJS.ProcessEnv): TaskforceBuildInfo;

package/dist/server/buildInfo.js

@@ -0,0 +1,100 @@
+import * as fs from 'fs';
+import * as path from 'path';
+let cachedPackageVersion = null;
+function readPackageVersion() {
+    if (cachedPackageVersion)
+        return cachedPackageVersion;
+    try {
+        const packagePath = path.resolve(process.cwd(), 'package.json');
+        const raw = fs.readFileSync(packagePath, 'utf-8');
+        const parsed = JSON.parse(raw);
+        const version = String(parsed?.version || '').trim();
+        cachedPackageVersion = version || '0.0.0-dev';
+        return cachedPackageVersion;
+    }
+    catch {
+        cachedPackageVersion = '0.0.0-dev';
+        return cachedPackageVersion;
+    }
+}
+function resolveFirstNonEmpty(candidates) {
+    for (const candidate of candidates) {
+        const value = String(candidate || '').trim();
+        if (value)
+            return value;
+    }
+    return null;
+}
+function normalizeGitSha(raw) {
+    if (!raw)
+        return null;
+    return raw.slice(0, 12);
+}
+function normalizeBuildToken(raw, maxLength = 40) {
+    const input = String(raw || '').trim();
+    if (!input)
+        return null;
+    const normalized = input
+        .replace(/[^0-9A-Za-z-]+/g, '-')
+        .replace(/-+/g, '-')
+        .replace(/^-|-$/g, '')
+        .slice(0, maxLength);
+    return normalized || null;
+}
+function buildTimeToken(raw) {
+    if (!raw)
+        return null;
+    const timestamp = Date.parse(raw);
+    if (!Number.isFinite(timestamp))
+        return null;
+    const iso = new Date(timestamp).toISOString();
+    // Compact UTC marker: 2026-02-20T12:34:56.000Z -> 20260220123456
+    return iso.slice(0, 19).replace(/[-:T]/g, '');
+}
+function appendBuildMetadata(version, parts) {
+    const cleanVersion = String(version || '').trim() || '0.0.0-dev';
+    if (cleanVersion.includes('+'))
+        return cleanVersion;
+    const metadata = parts
+        .map(part => normalizeBuildToken(part))
+        .filter((part) => Boolean(part))
+        .filter((part, index, all) => all.indexOf(part) === index);
+    if (metadata.length === 0)
+        return cleanVersion;
+    return `${cleanVersion}+${metadata.join('.')}`;
+}
+export function resolveBuildInfo(env = process.env) {
+    const explicitVersion = resolveFirstNonEmpty([
+        env.TASKFORCE_BUILD_VERSION,
+        env.APP_VERSION
+    ]);
+    const packageVersion = resolveFirstNonEmpty([env.npm_package_version]) || readPackageVersion();
+    const gitSha = normalizeGitSha(resolveFirstNonEmpty([
+        env.TASKFORCE_BUILD_GIT_SHA,
+        env.GIT_SHA,
+        env.RAILWAY_GIT_COMMIT_SHA,
+        env.CF_PAGES_COMMIT_SHA,
+        env.GITHUB_SHA
+    ]));
+    const buildTime = resolveFirstNonEmpty([
+        env.TASKFORCE_BUILD_TIME,
+        env.BUILD_TIME,
+        env.CF_PAGES_COMMIT_TIMESTAMP
+    ]);
+    const deployId = resolveFirstNonEmpty([
+        env.TASKFORCE_BUILD_DEPLOY_ID,
+        env.DEPLOY_ID,
+        env.RAILWAY_DEPLOYMENT_ID,
+        env.CF_PAGES_URL,
+        env.GITHUB_RUN_ID
+    ]);
+    const version = explicitVersion
+        ? explicitVersion
+        : appendBuildMetadata(packageVersion, [deployId, gitSha, buildTimeToken(buildTime)]);
+    return {
+        version,
+        gitSha,
+        buildTime,
+        deployId
+    };
+}

package/dist/server/buildInfo.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/buildInfo.test.js

@@ -0,0 +1,29 @@
+import { describe, expect, it } from 'vitest';
+import { resolveBuildInfo } from './buildInfo.js';
+describe('resolveBuildInfo', () => {
+    it('uses explicit TASKFORCE_BUILD_VERSION without appending metadata', () => {
+        const info = resolveBuildInfo({
+            TASKFORCE_BUILD_VERSION: '1.2.3-custom',
+            TASKFORCE_BUILD_DEPLOY_ID: 'railway-9999',
+            TASKFORCE_BUILD_GIT_SHA: 'abcdef1234567890',
+            TASKFORCE_BUILD_TIME: '2026-02-20T12:34:56Z',
+            npm_package_version: '0.3.13-beta.2'
+        });
+        expect(info.version).toBe('1.2.3-custom');
+    });
+    it('appends deploy metadata when version is sourced from package version', () => {
+        const info = resolveBuildInfo({
+            npm_package_version: '0.3.13-beta.2',
+            TASKFORCE_BUILD_DEPLOY_ID: 'railway-123456',
+            TASKFORCE_BUILD_GIT_SHA: 'a1b2c3d4e5f67890',
+            TASKFORCE_BUILD_TIME: '2026-02-20T12:34:56Z'
+        });
+        expect(info.version).toBe('0.3.13-beta.2+railway-123456.a1b2c3d4e5f6.20260220123456');
+    });
+    it('leaves package version unchanged when no deploy metadata is available', () => {
+        const info = resolveBuildInfo({
+            npm_package_version: '0.3.13-beta.2'
+        });
+        expect(info.version).toBe('0.3.13-beta.2');
+    });
+});

package/dist/server/cors.d.ts

@@ -0,0 +1,7 @@
+import type { IncomingMessage, ServerResponse } from 'http';
+export declare function getAllowedOriginsFromEnv(envValue?: string): Set<string>;
+export declare function resolveAllowedOrigin(originHeader: unknown, allowedOrigins: Set<string>): string | null;
+export declare function applyCorsHeaders(req: IncomingMessage, res: ServerResponse, allowedOrigins: Set<string>): {
+    allowed: boolean;
+    resolvedOrigin: string | null;
+};

package/dist/server/cors.js

@@ -0,0 +1,76 @@
+const DEFAULT_ALLOWED_ORIGINS = [
+    'https://taskforcehq.ai',
+    'https://www.taskforcehq.ai',
+    'https://app.taskforcehq.ai',
+    'https://admin.taskforcehq.ai',
+    // Allow local development and packaged desktop webviews out of the box.
+    '__loopback__',
+    '__null__',
+    'tauri://localhost',
+    'capacitor://localhost',
+    'ionic://localhost',
+    'app://.'
+];
+const CORS_ALLOW_METHODS = 'GET, POST, PUT, PATCH, DELETE, OPTIONS';
+const CORS_ALLOW_HEADERS = 'Content-Type';
+export function getAllowedOriginsFromEnv(envValue) {
+    const raw = typeof envValue === 'string' ? envValue.trim() : '';
+    if (!raw)
+        return new Set(DEFAULT_ALLOWED_ORIGINS);
+    return new Set(raw
+        .split(',')
+        .map(v => v.trim())
+        .filter(Boolean));
+}
+export function resolveAllowedOrigin(originHeader, allowedOrigins) {
+    const origin = typeof originHeader === 'string' ? originHeader.trim() : '';
+    if (!origin)
+        return null;
+    if (origin === 'null' && allowedOrigins.has('__null__'))
+        return 'null';
+    if (allowedOrigins.has(origin))
+        return origin;
+    if (allowedOrigins.has('__loopback__') && isLoopbackOrigin(origin))
+        return origin;
+    for (const entry of allowedOrigins) {
+        if (!entry.includes('*'))
+            continue;
+        const prefix = entry.replace(/\*+$/g, '');
+        if (prefix && origin.startsWith(prefix))
+            return origin;
+    }
+    return null;
+}
+function isLoopbackOrigin(origin) {
+    try {
+        const parsed = new URL(origin);
+        const protocol = parsed.protocol.toLowerCase();
+        if (protocol !== 'http:' && protocol !== 'https:')
+            return false;
+        const hostname = parsed.hostname.toLowerCase();
+        return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]';
+    }
+    catch {
+        return false;
+    }
+}
+export function applyCorsHeaders(req, res, allowedOrigins) {
+    const resolvedOrigin = resolveAllowedOrigin(req.headers.origin, allowedOrigins);
+    res.setHeader('Access-Control-Allow-Methods', CORS_ALLOW_METHODS);
+    const requestedHeaders = req.headers['access-control-request-headers'];
+    if (requestedHeaders) {
+        res.setHeader('Access-Control-Allow-Headers', requestedHeaders);
+    }
+    else {
+        res.setHeader('Access-Control-Allow-Headers', CORS_ALLOW_HEADERS);
+    }
+    res.setHeader('Vary', 'Origin');
+    if (resolvedOrigin) {
+        res.setHeader('Access-Control-Allow-Origin', resolvedOrigin);
+        res.setHeader('Access-Control-Allow-Credentials', 'true');
+    }
+    // Requests without Origin are considered non-CORS (allowed).
+    const hasOriginHeader = typeof req.headers.origin === 'string' && req.headers.origin.trim().length > 0;
+    const allowed = !hasOriginHeader || !!resolvedOrigin;
+    return { allowed, resolvedOrigin };
+}

package/dist/server/cors.test.d.ts

@@ -0,0 +1 @@
+export {};