botversion-sdk 1.1.6 → 2.0.0

package/interceptor.js

@@ -3,6 +3,29 @@
 
 const reportedEndpoints = new Set();
 
+function structureToJsonSchema(bodyStructure) {
+  if (!bodyStructure) return null;
+  return {
+    type: "object",
+    properties: Object.fromEntries(
+      Object.entries(bodyStructure).map(function ([key, typeOrObj]) {
+        if (typeOrObj && typeof typeOrObj === "object" && typeOrObj.type) {
+          return [key, typeOrObj];
+        }
+        return [
+          key,
+          {
+            type:
+              typeOrObj === "null" || typeOrObj === "[redacted]"
+                ? "string"
+                : typeOrObj,
+          },
+        ];
+      }),
+    ),
+  };
+}
+
 /**
  * Attaches a middleware to the Express app that
  * silently intercepts every request and reports
@@ -23,6 +46,39 @@ function attachInterceptor(app, client, options) {
 
   app.use(function botVersionInterceptor(req, res, next) {
     const path = req.path || req.url || "";
+
+    // ── Scan trigger from BotVersion dashboard ───────────────────────────
+    if (path === "/__botversion/scan" && req.method === "POST") {
+      const providedKey = req.headers["x-botversion-scan-key"] || "";
+      if (
+        options.scanSecret &&
+        providedKey === options.scanSecret &&
+        typeof options.onScanRequested === "function"
+      ) {
+        Promise.resolve(options.onScanRequested())
+          .then(function (result) {
+            res.statusCode = 200;
+            res.setHeader("Content-Type", "application/json");
+            res.end(JSON.stringify({ success: true, result: result || null }));
+          })
+          .catch(function (err) {
+            res.statusCode = 500;
+            res.setHeader("Content-Type", "application/json");
+            res.end(
+              JSON.stringify({
+                success: false,
+                error: String((err && err.message) || err),
+              }),
+            );
+          });
+      } else {
+        res.statusCode = 401;
+        res.setHeader("Content-Type", "application/json");
+        res.end(JSON.stringify({ success: false, error: "Unauthorized" }));
+      }
+      return;
+    }
+
     const shouldIgnore = ignorePaths.some(function (p) {
       return path.startsWith(p);
     });
@@ -50,24 +106,7 @@ function attachInterceptor(app, client, options) {
     if (!reportedEndpoints.has(bodyKey)) {
       reportedEndpoints.add(bodyKey);
 
-      const jsonSchema = bodyStructure
-        ? {
-            type: "object",
-            properties: Object.fromEntries(
-              Object.entries(bodyStructure).map(function ([key, type]) {
-                return [
-                  key,
-                  {
-                    type:
-                      type === "null" || type === "[redacted]"
-                        ? "string"
-                        : type,
-                  },
-                ];
-              }),
-            ),
-          }
-        : null;
+      const jsonSchema = structureToJsonSchema(bodyStructure);
 
       // Report async — never block the request
       setImmediate(function () {
@@ -126,6 +165,25 @@ function normalizePath(path) {
     .join("/");
 }
 
+/**
+ * Unwraps a single (non-batched) tRPC/superjson envelope.
+ * tRPC sends single calls as { json: {...realFields...} }
+ * or with superjson as { json: {...realFields...}, meta: {...} }
+ */
+function unwrapTrpcJsonEnvelope(obj) {
+  if (
+    obj &&
+    typeof obj === "object" &&
+    !Array.isArray(obj) &&
+    obj.json &&
+    typeof obj.json === "object" &&
+    !Array.isArray(obj.json)
+  ) {
+    return obj.json;
+  }
+  return obj;
+}
+
 /**
  * Extract just the structure of a request body
  * (keys and value types — never actual values for security)
@@ -133,6 +191,37 @@ function normalizePath(path) {
 function buildBodyStructure(body) {
   if (!body || typeof body !== "object") return null;
 
+  // Unwrap tRPC envelope
+  // Case A: single tRPC call — { json: { ...realFields... } } (optionally with a "meta" sibling)
+  // Case B: batched tRPC call — { "0": { json: {...} }, "1": { json: {...} } } or { "0": {...realFields...} }
+  // We detect whichever shape is present and flatten it to the real fields before processing
+  let keys = Object.keys(body);
+
+  const isTrpcEnvelope =
+    keys.length > 0 &&
+    keys.every(function (k) {
+      return (
+        /^\d+$/.test(k) &&
+        body[k] !== null &&
+        typeof body[k] === "object" &&
+        !Array.isArray(body[k])
+      );
+    });
+
+  if (isTrpcEnvelope) {
+    const unwrapped = {};
+    keys.forEach(function (k) {
+      // Each batched entry may itself be a { json: {...} } envelope
+      Object.assign(unwrapped, unwrapTrpcJsonEnvelope(body[k]));
+    });
+    body = unwrapped;
+  } else {
+    // Not a numeric batch — check for the single { json: {...} } shape
+    body = unwrapTrpcJsonEnvelope(body);
+  }
+
+  keys = Object.keys(body);
+
   const structure = {};
 
   Object.keys(body).forEach(function (key) {
@@ -163,6 +252,17 @@ function buildBodyStructure(body) {
       structure[key] = "array";
     } else if (val === null) {
       structure[key] = "null";
+    } else if (typeof val === "object") {
+      const nestedProps = {};
+      Object.keys(val).forEach(function (nk) {
+        nestedProps[nk] = {
+          type: val[nk] === null ? "string" : typeof val[nk],
+        };
+      });
+      structure[key] =
+        Object.keys(nestedProps).length > 0
+          ? { type: "object", properties: nestedProps }
+          : "object";
     } else {
       structure[key] = typeof val;
     }
@@ -181,6 +281,40 @@ function attachNextJsInterceptor(client, options) {
         const path = req.url ? req.url.split("?")[0] : "";
         const method = req.method ? req.method.toUpperCase() : "";
 
+        // ── Scan trigger from BotVersion dashboard ───────────────────────
+        if (path === "/__botversion/scan" && method === "POST") {
+          const providedKey = req.headers["x-botversion-scan-key"] || "";
+          if (
+            options.scanSecret &&
+            providedKey === options.scanSecret &&
+            typeof options.onScanRequested === "function"
+          ) {
+            Promise.resolve(options.onScanRequested())
+              .then(function (result) {
+                res.statusCode = 200;
+                res.setHeader("Content-Type", "application/json");
+                res.end(
+                  JSON.stringify({ success: true, result: result || null }),
+                );
+              })
+              .catch(function (err) {
+                res.statusCode = 500;
+                res.setHeader("Content-Type", "application/json");
+                res.end(
+                  JSON.stringify({
+                    success: false,
+                    error: String((err && err.message) || err),
+                  }),
+                );
+              });
+          } else {
+            res.statusCode = 401;
+            res.setHeader("Content-Type", "application/json");
+            res.end(JSON.stringify({ success: false, error: "Unauthorized" }));
+          }
+          return; // handled directly — don't pass through to the app
+        }
+
         const shouldIgnore = (options.exclude || [])
           .concat([
             "/health",
@@ -220,24 +354,91 @@ function attachNextJsInterceptor(client, options) {
             // Helper to send body structure to platform
             function reportBody(bodyObj) {
               try {
-                let parsedBody = null;
-                const structure = buildBodyStructure(bodyObj);
-                if (structure) {
-                  parsedBody = {
-                    type: "object",
-                    properties: Object.fromEntries(
-                      Object.entries(structure).map(([key, type]) => [
-                        key,
-                        {
-                          type:
-                            type === "null" || type === "[redacted]"
-                              ? "string"
-                              : type,
-                        },
-                      ]),
-                    ),
-                  };
+                // ── tRPC GET input extraction ──────────────────────────────────────
+                // tRPC GET requests send their input as a URL-encoded JSON query
+                // parameter called "input". The body is always empty for GET requests.
+                // We only attempt this extraction when:
+                //   1. The body is empty (GET requests have no body)
+                //   2. The URL contains an "input" query parameter
+                //   3. The path looks like a tRPC endpoint (/trpc/)
+                // This prevents accidentally treating regular REST query params
+                // (e.g. ?filter=active&limit=10) as a body schema.
+                const isTrpcPath = path.includes("/trpc/");
+                const hasInputParam = req.url && req.url.includes("input=");
+
+                if (
+                  isTrpcPath &&
+                  hasInputParam &&
+                  (!bodyObj || Object.keys(bodyObj).length === 0)
+                ) {
+                  try {
+                    // Use URL constructor to safely parse query params
+                    const urlObj = new URL(req.url, "http://localhost");
+                    const inputParam = urlObj.searchParams.get("input");
+
+                    if (inputParam) {
+                      let decoded;
+                      try {
+                        decoded = JSON.parse(decodeURIComponent(inputParam));
+                      } catch (e) {
+                        // input param exists but is not valid JSON — skip
+                        decoded = null;
+                      }
+
+                      if (
+                        decoded &&
+                        typeof decoded === "object" &&
+                        !Array.isArray(decoded)
+                      ) {
+                        const keys = Object.keys(decoded);
+
+                        // Format 1 — batched: { "0": { json: {...} }, "1": { json: {...} } }
+                        // All keys are numeric strings
+                        const isBatch =
+                          keys.length > 0 && keys.every((k) => /^\d+$/.test(k));
+
+                        if (isBatch) {
+                          // Merge all batch entries into one flat object
+                          // so we capture the full schema across all procedures
+                          const merged = {};
+                          keys.forEach((k) => {
+                            const entry = decoded[k];
+                            if (entry && typeof entry === "object") {
+                              // Unwrap { json: {...} } envelope if present
+                              const unwrapped =
+                                entry.json && typeof entry.json === "object"
+                                  ? entry.json
+                                  : entry;
+                              Object.assign(merged, unwrapped);
+                            }
+                          });
+                          if (Object.keys(merged).length > 0) {
+                            bodyObj = merged;
+                          }
+                        }
+                        // Format 2 — single with superjson: { json: {...}, meta: {...} }
+                        else if (
+                          decoded.json &&
+                          typeof decoded.json === "object"
+                        ) {
+                          bodyObj = decoded.json;
+                        }
+                        // Format 3 — already unwrapped: { group: {...}, limit: 10 }
+                        // Only use this if it doesn't look like a tRPC envelope
+                        else if (!decoded.meta && !decoded.json) {
+                          bodyObj = decoded;
+                        }
+                      }
+                    }
+                  } catch (e) {
+                    // URL parsing failed — fall through to normal body handling
+                  }
                 }
+
+                // ── Normal body processing (unchanged) ────────────────────────────
+                const parsedBody = structureToJsonSchema(
+                  buildBodyStructure(bodyObj),
+                );
                 client
                   .updateEndpoint({
                     method: method,
@@ -330,6 +531,29 @@ function attachFastifyInterceptor(fastify, client, options) {
     const path = request.url ? request.url.split("?")[0] : "";
     const method = request.method ? request.method.toUpperCase() : "";
 
+    // ── Scan trigger from BotVersion dashboard ───────────────────────────
+    if (path === "/__botversion/scan" && method === "POST") {
+      const providedKey = request.headers["x-botversion-scan-key"] || "";
+      if (
+        options.scanSecret &&
+        providedKey === options.scanSecret &&
+        typeof options.onScanRequested === "function"
+      ) {
+        try {
+          const result = await options.onScanRequested();
+          reply.code(200).send({ success: true, result: result || null });
+        } catch (err) {
+          reply.code(500).send({
+            success: false,
+            error: String((err && err.message) || err),
+          });
+        }
+      } else {
+        reply.code(401).send({ success: false, error: "Unauthorized" });
+      }
+      return reply;
+    }
+
     const shouldIgnore = ignorePaths.some(function (p) {
       return path.startsWith(p);
     });
@@ -373,19 +597,7 @@ function attachFastifyInterceptor(fastify, client, options) {
     const bodyStructure = buildBodyStructure(body);
     if (!bodyStructure) return;
 
-    const jsonSchema = {
-      type: "object",
-      properties: Object.fromEntries(
-        Object.entries(bodyStructure).map(function ([key, type]) {
-          return [
-            key,
-            {
-              type: type === "null" || type === "[redacted]" ? "string" : type,
-            },
-          ];
-        }),
-      ),
-    };
+    const jsonSchema = structureToJsonSchema(bodyStructure);
 
     setImmediate(function () {
       client
@@ -419,11 +631,37 @@ function attachKoaInterceptor(app, client, options) {
   // IMPORTANT: This interceptor must be added AFTER koa-bodyparser middleware
   // so that ctx.request.body is already populated when we read it.
   app.use(async function botVersionKoaInterceptor(ctx, next) {
-    await next();
-
     const path = ctx.path || "";
     const method = ctx.method ? ctx.method.toUpperCase() : "";
 
+    // ── Scan trigger from BotVersion dashboard ───────────────────────────
+    if (path === "/__botversion/scan" && method === "POST") {
+      const providedKey = ctx.headers["x-botversion-scan-key"] || "";
+      if (
+        options.scanSecret &&
+        providedKey === options.scanSecret &&
+        typeof options.onScanRequested === "function"
+      ) {
+        try {
+          const result = await options.onScanRequested();
+          ctx.status = 200;
+          ctx.body = { success: true, result: result || null };
+        } catch (err) {
+          ctx.status = 500;
+          ctx.body = {
+            success: false,
+            error: String((err && err.message) || err),
+          };
+        }
+      } else {
+        ctx.status = 401;
+        ctx.body = { success: false, error: "Unauthorized" };
+      }
+      return; // handled directly — don't call next()
+    }
+
+    await next();
+
     const shouldIgnore = ignorePaths.some(function (p) {
       return path.startsWith(p);
     });
@@ -447,24 +685,7 @@ function attachKoaInterceptor(app, client, options) {
     if (!reportedEndpoints.has(bodyKey)) {
       reportedEndpoints.add(bodyKey);
 
-      const jsonSchema = bodyStructure
-        ? {
-            type: "object",
-            properties: Object.fromEntries(
-              Object.entries(bodyStructure).map(function ([key, type]) {
-                return [
-                  key,
-                  {
-                    type:
-                      type === "null" || type === "[redacted]"
-                        ? "string"
-                        : type,
-                  },
-                ];
-              }),
-            ),
-          }
-        : null;
+      const jsonSchema = structureToJsonSchema(bodyStructure);
 
       setImmediate(function () {
         client
@@ -500,6 +721,38 @@ function attachHapiInterceptor(server, client, options) {
     const path = request.path || "";
     const method = request.method ? request.method.toUpperCase() : "";
 
+    // ── Scan trigger from BotVersion dashboard ───────────────────────────
+    if (path === "/__botversion/scan" && method === "POST") {
+      const providedKey =
+        (request.headers && request.headers["x-botversion-scan-key"]) || "";
+      if (
+        options.scanSecret &&
+        providedKey === options.scanSecret &&
+        typeof options.onScanRequested === "function"
+      ) {
+        return Promise.resolve(options.onScanRequested())
+          .then(function (result) {
+            return h
+              .response({ success: true, result: result || null })
+              .code(200)
+              .takeover();
+          })
+          .catch(function (err) {
+            return h
+              .response({
+                success: false,
+                error: String((err && err.message) || err),
+              })
+              .code(500)
+              .takeover();
+          });
+      }
+      return h
+        .response({ success: false, error: "Unauthorized" })
+        .code(401)
+        .takeover();
+    }
+
     const shouldIgnore = ignorePaths.some(function (p) {
       return path.startsWith(p);
     });
@@ -524,24 +777,7 @@ function attachHapiInterceptor(server, client, options) {
     if (!reportedEndpoints.has(bodyKey)) {
       reportedEndpoints.add(bodyKey);
 
-      const jsonSchema = bodyStructure
-        ? {
-            type: "object",
-            properties: Object.fromEntries(
-              Object.entries(bodyStructure).map(function ([key, type]) {
-                return [
-                  key,
-                  {
-                    type:
-                      type === "null" || type === "[redacted]"
-                        ? "string"
-                        : type,
-                  },
-                ];
-              }),
-            ),
-          }
-        : null;
+      const jsonSchema = structureToJsonSchema(bodyStructure);
 
       setImmediate(function () {
         client
@@ -571,6 +807,8 @@ function attachNestJsInterceptor(client, options) {
     exclude: (options || {}).exclude || [],
     apiPrefix: (options || {}).apiPrefix || "/",
     debug: (options || {}).debug || false,
+    scanSecret: (options || {}).scanSecret,
+    onScanRequested: (options || {}).onScanRequested,
   });
 }
 
@@ -583,6 +821,8 @@ function attachSvelteKitInterceptor(client, options) {
     exclude: (options || {}).exclude || [],
     apiPrefix: (options || {}).apiPrefix || "/",
     debug: (options || {}).debug || false,
+    scanSecret: (options || {}).scanSecret,
+    onScanRequested: (options || {}).onScanRequested,
   });
 }
 
@@ -591,6 +831,8 @@ function attachNuxtInterceptor(client, options) {
     exclude: (options || {}).exclude || [],
     apiPrefix: (options || {}).apiPrefix || "/api",
     debug: (options || {}).debug || false,
+    scanSecret: (options || {}).scanSecret,
+    onScanRequested: (options || {}).onScanRequested,
   });
 }
 
@@ -599,6 +841,8 @@ function attachRemixInterceptor(client, options) {
     exclude: (options || {}).exclude || [],
     apiPrefix: (options || {}).apiPrefix || "/",
     debug: (options || {}).debug || false,
+    scanSecret: (options || {}).scanSecret,
+    onScanRequested: (options || {}).onScanRequested,
   });
 }
 
@@ -607,6 +851,8 @@ function attachAdonisInterceptor(client, options) {
     exclude: (options || {}).exclude || [],
     apiPrefix: (options || {}).apiPrefix || "/",
     debug: (options || {}).debug || false,
+    scanSecret: (options || {}).scanSecret,
+    onScanRequested: (options || {}).onScanRequested,
   });
 }
 

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "botversion-sdk",
-  "version": "1.1.6",
+  "version": "2.0.0",
   "description": "BotVersion SDK — auto-detect and register your API endpoints",
   "main": "index.js",
   "bin": {
-    "botversion-sdk": "bin/init.js"
+    "botversion-scan-frontend": "./bin/scan-frontend.js"
   },
   "keywords": [
     "botversion",

package/scanner.js

@@ -1146,112 +1146,13 @@ function findAllFrontendDirs(cwd) {
     }
   }
 
-  // ── Step 2: Walk up exactly 1 level to find sibling folders ─────────
-  // Handles the case where SDK is installed in backend/ but
-  // frontend/ is a sibling folder at the same level
-  const parentDir = path.dirname(cwd);
-  if (parentDir !== cwd) {
-    const UNSAFE_PARENTS = new Set([
-      "Desktop",
-      "Documents",
-      "Downloads",
-      "Pictures",
-      "Videos",
-      "Music",
-      "home",
-      "users",
-      "Users",
-      "var",
-      "www",
-      "srv",
-      "opt",
-      "tmp",
-      "workspace",
-      "Workspace",
-      "projects",
-      "Projects",
-      "code",
-      "Code",
-      "sites",
-      "Sites",
-      "dev",
-      "Dev",
-      "work",
-      "Work",
-    ]);
-
-    if (UNSAFE_PARENTS.has(path.basename(parentDir))) {
-      if (found.length === 0) found.push(cwd);
-      return found;
-    }
-    // Safety check — only scan siblings if the parent folder
-    // looks like a project root (has package.json OR common project folders)
-    // This prevents scanning unrelated projects on the Desktop
-    const parentHasPackageJson = fs.existsSync(
-      path.join(parentDir, "package.json"),
-    );
-    const parentHasCommonProjectFiles =
-      fs.existsSync(path.join(parentDir, "docker-compose.yml")) ||
-      fs.existsSync(path.join(parentDir, "docker-compose.yaml")) ||
-      fs.existsSync(path.join(parentDir, ".env")) ||
-      fs.existsSync(path.join(parentDir, "turbo.json")) ||
-      fs.existsSync(path.join(parentDir, "pnpm-workspace.yaml"));
-
-    // If parent has no signs of being a project root, skip sibling scanning
-    if (!parentHasPackageJson && !parentHasCommonProjectFiles) {
-      // skip — parent is probably just a random folder like Desktop
-    } else {
-      let parentEntries;
-      try {
-        parentEntries = fs.readdirSync(parentDir);
-      } catch {
-        parentEntries = [];
-      }
-
-      for (const entry of parentEntries) {
-        if (SKIP_DIRS.has(entry)) continue;
-
-        const sibling = path.join(parentDir, entry);
-        if (sibling === cwd) continue; // skip cwd itself
-
-        let stat;
-        try {
-          stat = fs.statSync(sibling);
-        } catch {
-          continue;
-        }
-        if (!stat.isDirectory()) continue;
-
-        // Only add if it actually looks like a frontend project
-        if (isFrontendDir(sibling) && !found.includes(sibling)) {
-          found.push(sibling);
-        }
-
-        // Also check one level inside the sibling
-        let siblingEntries;
-        try {
-          siblingEntries = fs.readdirSync(sibling);
-        } catch {
-          continue;
-        }
-
-        for (const siblingEntry of siblingEntries) {
-          if (SKIP_DIRS.has(siblingEntry)) continue;
-          const siblingChild = path.join(sibling, siblingEntry);
-          let siblingChildStat;
-          try {
-            siblingChildStat = fs.statSync(siblingChild);
-          } catch {
-            continue;
-          }
-          if (!siblingChildStat.isDirectory()) continue;
-          if (isFrontendDir(siblingChild) && !found.includes(siblingChild)) {
-            found.push(siblingChild);
-          }
-        }
-      }
-    }
-  }
+  // Note: we intentionally do NOT walk up to sibling folders (e.g. a
+  // separate frontend/ folder next to backend/) anymore. That only worked
+  // in local dev monorepos where both folders live on the same disk. In
+  // production, frontend and backend are frequently on completely separate
+  // servers, so there is nothing to find outside cwd. If this install has
+  // no frontend, classification (in index.js) reports that to the
+  // dashboard instead of guessing at a folder that may not exist here.
 
   // If nothing found, fall back to cwd
   if (found.length === 0) {