botversion-sdk 1.1.7 → 2.1.0

package/interceptor.js

@@ -46,6 +46,39 @@ function attachInterceptor(app, client, options) {
 
   app.use(function botVersionInterceptor(req, res, next) {
     const path = req.path || req.url || "";
+
+    // ── Scan trigger from BotVersion dashboard ───────────────────────────
+    if (path === "/__botversion/scan" && req.method === "POST") {
+      const providedKey = req.headers["x-botversion-scan-key"] || "";
+      if (
+        options.scanSecret &&
+        providedKey === options.scanSecret &&
+        typeof options.onScanRequested === "function"
+      ) {
+        Promise.resolve(options.onScanRequested())
+          .then(function (result) {
+            res.statusCode = 200;
+            res.setHeader("Content-Type", "application/json");
+            res.end(JSON.stringify({ success: true, result: result || null }));
+          })
+          .catch(function (err) {
+            res.statusCode = 500;
+            res.setHeader("Content-Type", "application/json");
+            res.end(
+              JSON.stringify({
+                success: false,
+                error: String((err && err.message) || err),
+              }),
+            );
+          });
+      } else {
+        res.statusCode = 401;
+        res.setHeader("Content-Type", "application/json");
+        res.end(JSON.stringify({ success: false, error: "Unauthorized" }));
+      }
+      return;
+    }
+
     const shouldIgnore = ignorePaths.some(function (p) {
       return path.startsWith(p);
     });
@@ -248,18 +281,70 @@ function attachNextJsInterceptor(client, options) {
         const path = req.url ? req.url.split("?")[0] : "";
         const method = req.method ? req.method.toUpperCase() : "";
 
-        const shouldIgnore = (options.exclude || [])
-          .concat([
-            "/health",
-            "/favicon.ico",
-            "/_next",
-            "/static",
-            "/public",
-            "/admin",
-          ])
-          .some(function (p) {
-            return path.startsWith(p);
-          });
+        // ── Scan trigger from BotVersion dashboard ───────────────────────
+        if (path === "/__botversion/scan" && method === "POST") {
+          const providedKey = req.headers["x-botversion-scan-key"] || "";
+          if (
+            options.scanSecret &&
+            providedKey === options.scanSecret &&
+            typeof options.onScanRequested === "function"
+          ) {
+            Promise.resolve(options.onScanRequested())
+              .then(function (result) {
+                res.statusCode = 200;
+                res.setHeader("Content-Type", "application/json");
+                res.end(
+                  JSON.stringify({ success: true, result: result || null }),
+                );
+              })
+              .catch(function (err) {
+                res.statusCode = 500;
+                res.setHeader("Content-Type", "application/json");
+                res.end(
+                  JSON.stringify({
+                    success: false,
+                    error: String((err && err.message) || err),
+                  }),
+                );
+              });
+          } else {
+            res.statusCode = 401;
+            res.setHeader("Content-Type", "application/json");
+            res.end(JSON.stringify({ success: false, error: "Unauthorized" }));
+          }
+          return; // handled directly — don't pass through to the app
+        }
+
+        const DEV_ASSET_MARKERS = [
+          "/node_modules",
+          "/.svelte-kit",
+          "/@fs",
+          "/@vite",
+          "/@id",
+          "/debug-cors",
+          "/src/lib",
+          "/src/routes",
+        ];
+        const STATIC_ASSET_EXT =
+          /\.(svelte|vue|css|scss|map|woff2?|ttf|eot|ico|png|jpe?g|gif|svg|webp|mjs)(\?.*)?$/i;
+
+        const shouldIgnore =
+          (options.exclude || [])
+            .concat([
+              "/health",
+              "/favicon.ico",
+              "/_next",
+              "/static",
+              "/public",
+              "/admin",
+            ])
+            .some(function (p) {
+              return path.startsWith(p);
+            }) ||
+          DEV_ASSET_MARKERS.some(function (m) {
+            return path.includes(m);
+          }) ||
+          STATIC_ASSET_EXT.test(path);
 
         const isApiPath = path.startsWith(options.apiPrefix || "/api");
 
@@ -464,6 +549,29 @@ function attachFastifyInterceptor(fastify, client, options) {
     const path = request.url ? request.url.split("?")[0] : "";
     const method = request.method ? request.method.toUpperCase() : "";
 
+    // ── Scan trigger from BotVersion dashboard ───────────────────────────
+    if (path === "/__botversion/scan" && method === "POST") {
+      const providedKey = request.headers["x-botversion-scan-key"] || "";
+      if (
+        options.scanSecret &&
+        providedKey === options.scanSecret &&
+        typeof options.onScanRequested === "function"
+      ) {
+        try {
+          const result = await options.onScanRequested();
+          reply.code(200).send({ success: true, result: result || null });
+        } catch (err) {
+          reply.code(500).send({
+            success: false,
+            error: String((err && err.message) || err),
+          });
+        }
+      } else {
+        reply.code(401).send({ success: false, error: "Unauthorized" });
+      }
+      return reply;
+    }
+
     const shouldIgnore = ignorePaths.some(function (p) {
       return path.startsWith(p);
     });
@@ -541,11 +649,37 @@ function attachKoaInterceptor(app, client, options) {
   // IMPORTANT: This interceptor must be added AFTER koa-bodyparser middleware
   // so that ctx.request.body is already populated when we read it.
   app.use(async function botVersionKoaInterceptor(ctx, next) {
-    await next();
-
     const path = ctx.path || "";
     const method = ctx.method ? ctx.method.toUpperCase() : "";
 
+    // ── Scan trigger from BotVersion dashboard ───────────────────────────
+    if (path === "/__botversion/scan" && method === "POST") {
+      const providedKey = ctx.headers["x-botversion-scan-key"] || "";
+      if (
+        options.scanSecret &&
+        providedKey === options.scanSecret &&
+        typeof options.onScanRequested === "function"
+      ) {
+        try {
+          const result = await options.onScanRequested();
+          ctx.status = 200;
+          ctx.body = { success: true, result: result || null };
+        } catch (err) {
+          ctx.status = 500;
+          ctx.body = {
+            success: false,
+            error: String((err && err.message) || err),
+          };
+        }
+      } else {
+        ctx.status = 401;
+        ctx.body = { success: false, error: "Unauthorized" };
+      }
+      return; // handled directly — don't call next()
+    }
+
+    await next();
+
     const shouldIgnore = ignorePaths.some(function (p) {
       return path.startsWith(p);
     });
@@ -605,6 +739,38 @@ function attachHapiInterceptor(server, client, options) {
     const path = request.path || "";
     const method = request.method ? request.method.toUpperCase() : "";
 
+    // ── Scan trigger from BotVersion dashboard ───────────────────────────
+    if (path === "/__botversion/scan" && method === "POST") {
+      const providedKey =
+        (request.headers && request.headers["x-botversion-scan-key"]) || "";
+      if (
+        options.scanSecret &&
+        providedKey === options.scanSecret &&
+        typeof options.onScanRequested === "function"
+      ) {
+        return Promise.resolve(options.onScanRequested())
+          .then(function (result) {
+            return h
+              .response({ success: true, result: result || null })
+              .code(200)
+              .takeover();
+          })
+          .catch(function (err) {
+            return h
+              .response({
+                success: false,
+                error: String((err && err.message) || err),
+              })
+              .code(500)
+              .takeover();
+          });
+      }
+      return h
+        .response({ success: false, error: "Unauthorized" })
+        .code(401)
+        .takeover();
+    }
+
     const shouldIgnore = ignorePaths.some(function (p) {
       return path.startsWith(p);
     });
@@ -659,6 +825,8 @@ function attachNestJsInterceptor(client, options) {
     exclude: (options || {}).exclude || [],
     apiPrefix: (options || {}).apiPrefix || "/",
     debug: (options || {}).debug || false,
+    scanSecret: (options || {}).scanSecret,
+    onScanRequested: (options || {}).onScanRequested,
   });
 }
 
@@ -671,6 +839,8 @@ function attachSvelteKitInterceptor(client, options) {
     exclude: (options || {}).exclude || [],
     apiPrefix: (options || {}).apiPrefix || "/",
     debug: (options || {}).debug || false,
+    scanSecret: (options || {}).scanSecret,
+    onScanRequested: (options || {}).onScanRequested,
   });
 }
 
@@ -679,6 +849,8 @@ function attachNuxtInterceptor(client, options) {
     exclude: (options || {}).exclude || [],
     apiPrefix: (options || {}).apiPrefix || "/api",
     debug: (options || {}).debug || false,
+    scanSecret: (options || {}).scanSecret,
+    onScanRequested: (options || {}).onScanRequested,
   });
 }
 
@@ -687,6 +859,8 @@ function attachRemixInterceptor(client, options) {
     exclude: (options || {}).exclude || [],
     apiPrefix: (options || {}).apiPrefix || "/",
     debug: (options || {}).debug || false,
+    scanSecret: (options || {}).scanSecret,
+    onScanRequested: (options || {}).onScanRequested,
   });
 }
 
@@ -695,6 +869,8 @@ function attachAdonisInterceptor(client, options) {
     exclude: (options || {}).exclude || [],
     apiPrefix: (options || {}).apiPrefix || "/",
     debug: (options || {}).debug || false,
+    scanSecret: (options || {}).scanSecret,
+    onScanRequested: (options || {}).onScanRequested,
   });
 }
 

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "botversion-sdk",
-  "version": "1.1.7",
+  "version": "2.1.0",
   "description": "BotVersion SDK — auto-detect and register your API endpoints",
   "main": "index.js",
   "bin": {
-    "botversion-sdk": "bin/init.js"
+    "botversion-scan-frontend-routes": "bin/scan-frontend.js",
+    "botversion-scan-endpoints": "bin/scan-backend.js"
   },
   "keywords": [
     "botversion",
@@ -18,6 +19,7 @@
   "dependencies": {
     "@babel/parser": "^7.29.3",
     "@babel/traverse": "^7.29.0",
+    "dotenv": "^16.4.5",
     "express": "^4.18.2"
   }
 }

package/scanner.js

@@ -1146,112 +1146,13 @@ function findAllFrontendDirs(cwd) {
     }
   }
 
-  // ── Step 2: Walk up exactly 1 level to find sibling folders ─────────
-  // Handles the case where SDK is installed in backend/ but
-  // frontend/ is a sibling folder at the same level
-  const parentDir = path.dirname(cwd);
-  if (parentDir !== cwd) {
-    const UNSAFE_PARENTS = new Set([
-      "Desktop",
-      "Documents",
-      "Downloads",
-      "Pictures",
-      "Videos",
-      "Music",
-      "home",
-      "users",
-      "Users",
-      "var",
-      "www",
-      "srv",
-      "opt",
-      "tmp",
-      "workspace",
-      "Workspace",
-      "projects",
-      "Projects",
-      "code",
-      "Code",
-      "sites",
-      "Sites",
-      "dev",
-      "Dev",
-      "work",
-      "Work",
-    ]);
-
-    if (UNSAFE_PARENTS.has(path.basename(parentDir))) {
-      if (found.length === 0) found.push(cwd);
-      return found;
-    }
-    // Safety check — only scan siblings if the parent folder
-    // looks like a project root (has package.json OR common project folders)
-    // This prevents scanning unrelated projects on the Desktop
-    const parentHasPackageJson = fs.existsSync(
-      path.join(parentDir, "package.json"),
-    );
-    const parentHasCommonProjectFiles =
-      fs.existsSync(path.join(parentDir, "docker-compose.yml")) ||
-      fs.existsSync(path.join(parentDir, "docker-compose.yaml")) ||
-      fs.existsSync(path.join(parentDir, ".env")) ||
-      fs.existsSync(path.join(parentDir, "turbo.json")) ||
-      fs.existsSync(path.join(parentDir, "pnpm-workspace.yaml"));
-
-    // If parent has no signs of being a project root, skip sibling scanning
-    if (!parentHasPackageJson && !parentHasCommonProjectFiles) {
-      // skip — parent is probably just a random folder like Desktop
-    } else {
-      let parentEntries;
-      try {
-        parentEntries = fs.readdirSync(parentDir);
-      } catch {
-        parentEntries = [];
-      }
-
-      for (const entry of parentEntries) {
-        if (SKIP_DIRS.has(entry)) continue;
-
-        const sibling = path.join(parentDir, entry);
-        if (sibling === cwd) continue; // skip cwd itself
-
-        let stat;
-        try {
-          stat = fs.statSync(sibling);
-        } catch {
-          continue;
-        }
-        if (!stat.isDirectory()) continue;
-
-        // Only add if it actually looks like a frontend project
-        if (isFrontendDir(sibling) && !found.includes(sibling)) {
-          found.push(sibling);
-        }
-
-        // Also check one level inside the sibling
-        let siblingEntries;
-        try {
-          siblingEntries = fs.readdirSync(sibling);
-        } catch {
-          continue;
-        }
-
-        for (const siblingEntry of siblingEntries) {
-          if (SKIP_DIRS.has(siblingEntry)) continue;
-          const siblingChild = path.join(sibling, siblingEntry);
-          let siblingChildStat;
-          try {
-            siblingChildStat = fs.statSync(siblingChild);
-          } catch {
-            continue;
-          }
-          if (!siblingChildStat.isDirectory()) continue;
-          if (isFrontendDir(siblingChild) && !found.includes(siblingChild)) {
-            found.push(siblingChild);
-          }
-        }
-      }
-    }
-  }
+  // Note: we intentionally do NOT walk up to sibling folders (e.g. a
+  // separate frontend/ folder next to backend/) anymore. That only worked
+  // in local dev monorepos where both folders live on the same disk. In
+  // production, frontend and backend are frequently on completely separate
+  // servers, so there is nothing to find outside cwd. If this install has
+  // no frontend, classification (in index.js) reports that to the
+  // dashboard instead of guessing at a folder that may not exist here.
 
   // If nothing found, fall back to cwd
   if (found.length === 0) {