4runr-os 2.10.85 → 2.10.86

package/apps/os-server/dist/apps/os-server/src/ai-providers/redis-credentials-store.js

@@ -0,0 +1,181 @@
+import Redis from 'ioredis';
+import crypto from 'crypto';
+const CREDENTIALS_KEY_PREFIX = 'ai:provider:creds:';
+const DEFAULT_DEV_KEY = 'default-dev-key-change-in-production';
+function resolveEncryptionKey() {
+    const k = process.env['ENCRYPTION_KEY'];
+    if (process.env['NODE_ENV'] === 'production') {
+        if (!k || k.length < 16 || k === DEFAULT_DEV_KEY) {
+            throw new Error('ENCRYPTION_KEY must be set to a strong value (not the default) in production for Redis credential storage');
+        }
+        return k;
+    }
+    return k && k.length >= 8 ? k : DEFAULT_DEV_KEY;
+}
+export class RedisCredentialsStore {
+    redis;
+    constructor(redisUrl) {
+        const url = redisUrl || process.env['REDIS_URL'] || 'redis://localhost:6379';
+        this.redis = new Redis(url, {
+            maxRetriesPerRequest: null,
+            retryStrategy(times) {
+                if (times > 3) {
+                    console.error('[RedisCredentialsStore] Max retries reached, giving up on Redis connection');
+                    return null;
+                }
+                const delay = Math.min(times * 50, 2000);
+                return delay;
+            },
+            connectTimeout: 3000,
+            lazyConnect: true,
+        });
+        this.redis.on('error', (err) => {
+            if (!this.redis.status || this.redis.status === 'connecting') {
+                console.error('[RedisCredentialsStore] Redis connection error:', err);
+            }
+        });
+        this.redis.on('connect', () => {
+            console.log('[RedisCredentialsStore] Connected to Redis');
+        });
+    }
+    encrypt(text) {
+        const keyMaterial = resolveEncryptionKey();
+        const iv = crypto.randomBytes(16);
+        const key = crypto.createHash('sha256').update(keyMaterial).digest();
+        const cipher = crypto.createCipheriv('aes-256-cbc', key, iv);
+        let encrypted = cipher.update(text, 'utf8', 'hex');
+        encrypted += cipher.final('hex');
+        return iv.toString('hex') + ':' + encrypted;
+    }
+    decrypt(encryptedText) {
+        const keyMaterial = resolveEncryptionKey();
+        const parts = encryptedText.split(':');
+        if (parts.length !== 2 || !parts[0] || !parts[1]) {
+            throw new Error('Invalid encrypted text format');
+        }
+        const iv = Buffer.from(parts[0], 'hex');
+        const encrypted = parts[1];
+        const key = crypto.createHash('sha256').update(keyMaterial).digest();
+        const decipher = crypto.createDecipheriv('aes-256-cbc', key, iv);
+        let decrypted = decipher.update(encrypted, 'hex', 'utf8');
+        decrypted += decipher.final('utf8');
+        return decrypted;
+    }
+    async setCredential(provider, apiKey) {
+        try {
+            const encrypted = this.encrypt(apiKey);
+            const key = `${CREDENTIALS_KEY_PREFIX}${provider}`;
+            await this.redis.set(key, encrypted);
+            const stored = await this.redis.get(key);
+            if (!stored) {
+                throw new Error('Failed to verify credential storage in Redis');
+            }
+            process.env[`${provider.toUpperCase()}_API_KEY`] = apiKey;
+            console.log(`[RedisCredentialsStore] Credential stored and verified for: ${provider}`);
+        }
+        catch (error) {
+            console.error(`[RedisCredentialsStore] Error storing credential for ${provider}:`, error);
+            throw error;
+        }
+    }
+    async getCredential(provider) {
+        try {
+            const key = `${CREDENTIALS_KEY_PREFIX}${provider}`;
+            const encrypted = await this.redis.get(key);
+            if (!encrypted) {
+                return null;
+            }
+            const decrypted = this.decrypt(encrypted);
+            process.env[`${provider.toUpperCase()}_API_KEY`] = decrypted;
+            return decrypted;
+        }
+        catch (error) {
+            console.error(`[RedisCredentialsStore] Error retrieving credential for ${provider}:`, error);
+            throw error;
+        }
+    }
+    async hasCredential(provider) {
+        try {
+            const key = `${CREDENTIALS_KEY_PREFIX}${provider}`;
+            const exists = await this.redis.exists(key);
+            return exists === 1;
+        }
+        catch (error) {
+            console.error(`[RedisCredentialsStore] Error checking credential for ${provider}:`, error);
+            return false;
+        }
+    }
+    async deleteCredential(provider) {
+        try {
+            const key = `${CREDENTIALS_KEY_PREFIX}${provider}`;
+            await this.redis.del(key);
+            delete process.env[`${provider.toUpperCase()}_API_KEY`];
+            console.log(`[RedisCredentialsStore] Credential deleted for: ${provider}`);
+        }
+        catch (error) {
+            console.error(`[RedisCredentialsStore] Error deleting credential for ${provider}:`, error);
+            throw error;
+        }
+    }
+    async listProviders() {
+        try {
+            const pattern = `${CREDENTIALS_KEY_PREFIX}*`;
+            const providers = [];
+            let cursor = '0';
+            do {
+                const [nextCursor, keys] = await this.redis.scan(cursor, 'MATCH', pattern, 'COUNT', 128);
+                cursor = nextCursor;
+                for (const redisKey of keys) {
+                    providers.push(redisKey.replace(CREDENTIALS_KEY_PREFIX, ''));
+                }
+            } while (cursor !== '0');
+            return providers;
+        }
+        catch (error) {
+            console.error('[RedisCredentialsStore] Error listing providers:', error);
+            return [];
+        }
+    }
+    async loadAllToEnv() {
+        try {
+            const providers = await this.listProviders();
+            if (providers.length === 0) {
+                console.log('[RedisCredentialsStore] No credentials found in Redis');
+                return;
+            }
+            console.log(`[RedisCredentialsStore] Found ${providers.length} credential(s) in Redis: ${providers.join(', ')}`);
+            let loadedCount = 0;
+            for (const provider of providers) {
+                try {
+                    const credential = await this.getCredential(provider);
+                    if (credential) {
+                        loadedCount++;
+                        console.log(`[RedisCredentialsStore] ✓ Loaded credential for: ${provider}`);
+                    }
+                    else {
+                        console.warn(`[RedisCredentialsStore] ⚠ Credential for ${provider} exists but could not be decrypted`);
+                    }
+                }
+                catch (error) {
+                    console.error(`[RedisCredentialsStore] ✗ Failed to load credential for ${provider}:`, error);
+                }
+            }
+            console.log(`[RedisCredentialsStore] Successfully loaded ${loadedCount}/${providers.length} credentials to environment`);
+        }
+        catch (error) {
+            console.error('[RedisCredentialsStore] Error loading credentials:', error);
+            throw error;
+        }
+    }
+    async close() {
+        await this.redis.quit();
+    }
+}
+let storeInstance = null;
+export function getCredentialsStore() {
+    if (!storeInstance) {
+        storeInstance = new RedisCredentialsStore();
+    }
+    return storeInstance;
+}
+//# sourceMappingURL=redis-credentials-store.js.map

package/apps/os-server/dist/apps/os-server/src/ai-providers/redis-credentials-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-credentials-store.js","sourceRoot":"","sources":["../../../../../src/ai-providers/redis-credentials-store.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,MAAM,SAAS,CAAC;AAC5B,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AACpD,MAAM,eAAe,GAAG,sCAAsC,CAAC;AAE/D,SAAS,oBAAoB;IAC3B,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACxC,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY,EAAE,CAAC;QAC7C,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,KAAK,eAAe,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CACb,2GAA2G,CAC5G,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;AAClD,CAAC;AAED,MAAM,OAAO,qBAAqB;IACxB,KAAK,CAAQ;IAErB,YAAY,QAAiB;QAC3B,MAAM,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,wBAAwB,CAAC;QAC7E,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,GAAG,EAAE;YAC1B,oBAAoB,EAAE,IAAI;YAC1B,aAAa,CAAC,KAAK;gBAEjB,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;oBACd,OAAO,CAAC,KAAK,CAAC,4EAA4E,CAAC,CAAC;oBAC5F,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;gBACzC,OAAO,KAAK,CAAC;YACf,CAAC;YAED,cAAc,EAAE,IAAI;YACpB,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YAE7B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;gBAC7D,OAAO,CAAC,KAAK,CAAC,iDAAiD,EAAE,GAAG,CAAC,CAAC;YACxE,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YAC5B,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,OAAO,CAAC,IAAY;QAC1B,MAAM,WAAW,GAAG,oBAAoB,EAAE,CAAC;QAC3C,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAClC,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC;QACrE,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAE7D,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACnD,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEjC,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,SAAS,CAAC;IAC9C,CAAC;IAEO,OAAO,CAAC,aAAqB;QACnC,MAAM,WAAW,GAAG,oBAAoB,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAE3B,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC;QACrE,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAEjE,IAAI,SAAS,GAAW,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAClE,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,QAAgB,EAAE,MAAc;QAClD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACvC,MAAM,GAAG,GAAG,GAAG,sBAAsB,GAAG,QAAQ,EAAE,CAAC;YACnD,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAErC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAClE,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,UAAU,CAAC,GAAG,MAAM,CAAC;YAE1D,OAAO,CAAC,GAAG,CAAC,+DAA+D,QAAQ,EAAE,CAAC,CAAC;QACzF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,wDAAwD,QAAQ,GAAG,EAAE,KAAK,CAAC,CAAC;YAC1F,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,QAAgB;QAClC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,GAAG,sBAAsB,GAAG,QAAQ,EAAE,CAAC;YACnD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAE5C,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAE1C,OAAO,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,UAAU,CAAC,GAAG,SAAS,CAAC;YAE7D,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,2DAA2D,QAAQ,GAAG,EAAE,KAAK,CAAC,CAAC;YAC7F,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,QAAgB;QAClC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,GAAG,sBAAsB,GAAG,QAAQ,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5C,OAAO,MAAM,KAAK,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,yDAAyD,QAAQ,GAAG,EAAE,KAAK,CAAC,CAAC;YAC3F,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,QAAgB;QACrC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,GAAG,sBAAsB,GAAG,QAAQ,EAAE,CAAC;YACnD,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAE1B,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;YAExD,OAAO,CAAC,GAAG,CAAC,mDAAmD,QAAQ,EAAE,CAAC,CAAC;QAC7E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,yDAAyD,QAAQ,GAAG,EAAE,KAAK,CAAC,CAAC;YAC3F,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAKD,KAAK,CAAC,aAAa;QACjB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,sBAAsB,GAAG,CAAC;YAC7C,MAAM,SAAS,GAAa,EAAE,CAAC;YAC/B,IAAI,MAAM,GAAG,GAAG,CAAC;YAEjB,GAAG,CAAC;gBACF,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;gBACzF,MAAM,GAAG,UAAU,CAAC;gBACpB,KAAK,MAAM,QAAQ,IAAI,IAAI,EAAE,CAAC;oBAC5B,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC/D,CAAC;YACH,CAAC,QAAQ,MAAM,KAAK,GAAG,EAAE;YAEzB,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,kDAAkD,EAAE,KAAK,CAAC,CAAC;YACzE,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;YAE7C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC;gBACrE,OAAO;YACT,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,iCAAiC,SAAS,CAAC,MAAM,4BAA4B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAEjH,IAAI,WAAW,GAAG,CAAC,CAAC;YACpB,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBACjC,IAAI,CAAC;oBACH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;oBACtD,IAAI,UAAU,EAAE,CAAC;wBACf,WAAW,EAAE,CAAC;wBACd,OAAO,CAAC,GAAG,CAAC,oDAAoD,QAAQ,EAAE,CAAC,CAAC;oBAC9E,CAAC;yBAAM,CAAC;wBACN,OAAO,CAAC,IAAI,CAAC,4CAA4C,QAAQ,oCAAoC,CAAC,CAAC;oBACzG,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO,CAAC,KAAK,CAAC,2DAA2D,QAAQ,GAAG,EAAE,KAAK,CAAC,CAAC;gBAC/F,CAAC;YACH,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,+CAA+C,WAAW,IAAI,SAAS,CAAC,MAAM,6BAA6B,CAAC,CAAC;QAC3H,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,oDAAoD,EAAE,KAAK,CAAC,CAAC;YAC3E,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;CACF;AAED,IAAI,aAAa,GAAiC,IAAI,CAAC;AAEvD,MAAM,UAAU,mBAAmB;IACjC,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,aAAa,GAAG,IAAI,qBAAqB,EAAE,CAAC;IAC9C,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC"}

package/apps/os-server/dist/apps/os-server/src/ai-providers/types.d.ts

@@ -0,0 +1,54 @@
+export interface AIMessage {
+    role: 'system' | 'user' | 'assistant';
+    content: string;
+}
+export interface AICompletionParams {
+    model: string;
+    messages: AIMessage[];
+    temperature?: number;
+    maxTokens?: number;
+    topP?: number;
+    frequencyPenalty?: number;
+    presencePenalty?: number;
+    stopSequences?: string[];
+}
+export interface AICompletionResponse {
+    content: string;
+    model: string;
+    usage: {
+        promptTokens: number;
+        completionTokens: number;
+        totalTokens: number;
+    };
+    finishReason: 'stop' | 'length' | 'tool_use' | 'error';
+    raw?: any;
+}
+export interface AIProviderCredentials {
+    apiKey?: string;
+    apiUrl?: string;
+    organizationId?: string;
+    projectId?: string;
+    [key: string]: any;
+}
+export interface AIProvider {
+    name: string;
+    type: 'openai' | 'anthropic' | 'google' | 'local' | 'custom';
+    isConfigured(): Promise<boolean>;
+    getAvailableModels(): Promise<string[]>;
+    complete(params: AICompletionParams): Promise<AICompletionResponse>;
+    estimateCost(params: AICompletionParams): Promise<number>;
+    testConnection(): Promise<boolean>;
+}
+export interface AIProviderConfig {
+    name: string;
+    type: 'openai' | 'anthropic' | 'google' | 'local' | 'custom';
+    enabled: boolean;
+    credentialId?: string;
+    defaultModel?: string;
+    rateLimits?: {
+        requestsPerMinute?: number;
+        tokensPerMinute?: number;
+    };
+    metadata?: Record<string, any>;
+}
+//# sourceMappingURL=types.d.ts.map

package/apps/os-server/dist/apps/os-server/src/ai-providers/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/ai-providers/types.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,WAAW,CAAA;IACrC,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,SAAS,EAAE,CAAA;IACrB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;CACzB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE;QACL,YAAY,EAAE,MAAM,CAAA;QACpB,gBAAgB,EAAE,MAAM,CAAA;QACxB,WAAW,EAAE,MAAM,CAAA;KACpB,CAAA;IACD,YAAY,EAAE,MAAM,GAAG,QAAQ,GAAG,UAAU,GAAG,OAAO,CAAA;IACtD,GAAG,CAAC,EAAE,GAAG,CAAA;CACV;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,QAAQ,GAAG,WAAW,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAA;IAG5D,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;IAGhC,kBAAkB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IAGvC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAGnE,YAAY,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAGzD,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;CACnC;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,QAAQ,GAAG,WAAW,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAA;IAC5D,OAAO,EAAE,OAAO,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,UAAU,CAAC,EAAE;QACX,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B,eAAe,CAAC,EAAE,MAAM,CAAA;KACzB,CAAA;IACD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAC/B"}

package/apps/os-server/dist/apps/os-server/src/ai-providers/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/apps/os-server/dist/apps/os-server/src/ai-providers/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../../src/ai-providers/types.ts"],"names":[],"mappings":""}

package/apps/os-server/dist/apps/os-server/src/config/persistence.d.ts

@@ -0,0 +1,5 @@
+export type PersistenceMode = 'memory' | 'postgres';
+export declare function getPersistenceMode(): PersistenceMode;
+export declare function isMemoryMode(): boolean;
+export declare function isPostgresMode(): boolean;
+//# sourceMappingURL=persistence.d.ts.map

package/apps/os-server/dist/apps/os-server/src/config/persistence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"persistence.d.ts","sourceRoot":"","sources":["../../../../../src/config/persistence.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,UAAU,CAAC;AAOpD,wBAAgB,kBAAkB,IAAI,eAAe,CAUpD;AAKD,wBAAgB,YAAY,IAAI,OAAO,CAEtC;AAKD,wBAAgB,cAAc,IAAI,OAAO,CAExC"}

package/apps/os-server/dist/apps/os-server/src/config/persistence.js

@@ -0,0 +1,14 @@
+export function getPersistenceMode() {
+    const mode = process.env['GATEWAY_PERSISTENCE'];
+    if (mode === 'persistent' || mode === 'postgres') {
+        return 'postgres';
+    }
+    return mode === 'memory' ? 'memory' : 'postgres';
+}
+export function isMemoryMode() {
+    return getPersistenceMode() === 'memory';
+}
+export function isPostgresMode() {
+    return getPersistenceMode() === 'postgres';
+}
+//# sourceMappingURL=persistence.js.map

package/apps/os-server/dist/apps/os-server/src/config/persistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"persistence.js","sourceRoot":"","sources":["../../../../../src/config/persistence.ts"],"names":[],"mappings":"AAYA,MAAM,UAAU,kBAAkB;IAChC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAGhD,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACjD,OAAO,UAAU,CAAC;IACpB,CAAC;IAGD,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;AACnD,CAAC;AAKD,MAAM,UAAU,YAAY;IAC1B,OAAO,kBAAkB,EAAE,KAAK,QAAQ,CAAC;AAC3C,CAAC;AAKD,MAAM,UAAU,cAAc;IAC5B,OAAO,kBAAkB,EAAE,KAAK,UAAU,CAAC;AAC7C,CAAC"}

package/apps/os-server/dist/apps/os-server/src/crypto/envelope.d.ts

@@ -0,0 +1,28 @@
+export interface EnvelopeResult {
+    encryptedData: Buffer;
+    encryptedKey: Buffer;
+    iv: Buffer;
+    wrapIv?: Buffer;
+    wrapTag?: Buffer;
+    tag: Buffer;
+}
+export interface EnvelopeDecryptResult {
+    decryptedData: Buffer;
+    dek: Buffer;
+}
+export declare function generateDEK(): Buffer;
+export declare function wrapDEK(dek: Buffer, kek: Buffer): {
+    wrappedKey: Buffer;
+    iv: Buffer;
+    tag: Buffer;
+};
+export declare function unwrapDEK(wrappedKey: Buffer, iv: Buffer, tag: Buffer, kek: Buffer): Buffer;
+export declare function encryptWithEnvelope(data: Buffer, kek: Buffer): EnvelopeResult;
+export declare function decryptWithEnvelope(envelope: EnvelopeResult, kek: Buffer): EnvelopeDecryptResult;
+export declare function serializeEnvelope(envelope: EnvelopeResult): string;
+export declare function deserializeEnvelope(serialized: string): EnvelopeResult;
+export declare function encryptString(data: string, kek: Buffer): string;
+export declare function decryptString(encryptedData: string, kek: Buffer): string;
+export declare function encryptObject(obj: any, kek: Buffer): string;
+export declare function decryptObject(encryptedData: string, kek: Buffer): any;
+//# sourceMappingURL=envelope.d.ts.map

package/apps/os-server/dist/apps/os-server/src/crypto/envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.d.ts","sourceRoot":"","sources":["../../../../../src/crypto/envelope.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAA;IACrB,YAAY,EAAE,MAAM,CAAA;IACpB,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,GAAG,EAAE,MAAM,CAAA;CACZ;AAGD,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,MAAM,CAAA;IACrB,GAAG,EAAE,MAAM,CAAA;CACZ;AAGD,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAGD,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAajG;AAGD,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAQ1F;AAGD,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,GACV,cAAc,CAyBhB;AAGD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,cAAc,EACxB,GAAG,EAAE,MAAM,GACV,qBAAqB,CA8BvB;AAGD,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,cAAc,GAAG,MAAM,CAiBlE;AAGD,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,cAAc,CAmBtE;AAGD,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAI/D;AAGD,wBAAgB,aAAa,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAIxE;AAGD,wBAAgB,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAG3D;AAGD,wBAAgB,aAAa,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,GAAG,CAGrE"}

package/apps/os-server/dist/apps/os-server/src/crypto/envelope.js

@@ -0,0 +1,111 @@
+import * as crypto from 'crypto';
+export function generateDEK() {
+    return crypto.randomBytes(32);
+}
+export function wrapDEK(dek, kek) {
+    const iv = crypto.randomBytes(16);
+    const cipher = crypto.createCipheriv('aes-256-gcm', kek, iv);
+    let wrappedKey = cipher.update(dek);
+    wrappedKey = Buffer.concat([wrappedKey, cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return {
+        wrappedKey,
+        iv,
+        tag
+    };
+}
+export function unwrapDEK(wrappedKey, iv, tag, kek) {
+    const decipher = crypto.createDecipheriv('aes-256-gcm', kek, iv);
+    decipher.setAuthTag(tag);
+    let dek = decipher.update(wrappedKey);
+    dek = Buffer.concat([dek, decipher.final()]);
+    return dek;
+}
+export function encryptWithEnvelope(data, kek) {
+    const dek = generateDEK();
+    const dataIv = crypto.randomBytes(16);
+    const cipher = crypto.createCipheriv('aes-256-gcm', dek, dataIv);
+    let encryptedData = cipher.update(data);
+    encryptedData = Buffer.concat([encryptedData, cipher.final()]);
+    const tag = cipher.getAuthTag();
+    const { wrappedKey, iv: wrapIv, tag: wrapTag } = wrapDEK(dek, kek);
+    return {
+        encryptedData,
+        encryptedKey: wrappedKey,
+        iv: dataIv,
+        wrapIv: wrapIv,
+        wrapTag: wrapTag,
+        tag
+    };
+}
+export function decryptWithEnvelope(envelope, kek) {
+    let wrapIv;
+    let dataIv;
+    if (envelope.wrapIv && envelope.wrapTag) {
+        wrapIv = envelope.wrapIv;
+        const wrapTag = envelope.wrapTag;
+        dataIv = envelope.iv;
+        var dek = unwrapDEK(envelope.encryptedKey, wrapIv, wrapTag, kek);
+    }
+    else {
+        throw new Error('Legacy encrypted data detected. Data encrypted with old format cannot be decrypted. Please re-encrypt with new format.');
+    }
+    const decipher = crypto.createDecipheriv('aes-256-gcm', dek, dataIv);
+    decipher.setAuthTag(envelope.tag);
+    let decryptedData = decipher.update(envelope.encryptedData);
+    decryptedData = Buffer.concat([decryptedData, decipher.final()]);
+    return {
+        decryptedData,
+        dek
+    };
+}
+export function serializeEnvelope(envelope) {
+    const serialized = {
+        encryptedData: envelope.encryptedData.toString('base64'),
+        encryptedKey: envelope.encryptedKey.toString('base64'),
+        iv: envelope.iv.toString('base64'),
+        tag: envelope.tag.toString('base64')
+    };
+    if (envelope.wrapIv) {
+        serialized.wrapIv = envelope.wrapIv.toString('base64');
+    }
+    if (envelope.wrapTag) {
+        serialized.wrapTag = envelope.wrapTag.toString('base64');
+    }
+    return JSON.stringify(serialized);
+}
+export function deserializeEnvelope(serialized) {
+    const parsed = JSON.parse(serialized);
+    const result = {
+        encryptedData: Buffer.from(parsed.encryptedData, 'base64'),
+        encryptedKey: Buffer.from(parsed.encryptedKey, 'base64'),
+        iv: Buffer.from(parsed.iv, 'base64'),
+        tag: Buffer.from(parsed.tag, 'base64')
+    };
+    if (parsed.wrapIv) {
+        result.wrapIv = Buffer.from(parsed.wrapIv, 'base64');
+    }
+    if (parsed.wrapTag) {
+        result.wrapTag = Buffer.from(parsed.wrapTag, 'base64');
+    }
+    return result;
+}
+export function encryptString(data, kek) {
+    const dataBuffer = Buffer.from(data, 'utf-8');
+    const envelope = encryptWithEnvelope(dataBuffer, kek);
+    return serializeEnvelope(envelope);
+}
+export function decryptString(encryptedData, kek) {
+    const envelope = deserializeEnvelope(encryptedData);
+    const result = decryptWithEnvelope(envelope, kek);
+    return result.decryptedData.toString('utf-8');
+}
+export function encryptObject(obj, kek) {
+    const jsonString = JSON.stringify(obj);
+    return encryptString(jsonString, kek);
+}
+export function decryptObject(encryptedData, kek) {
+    const jsonString = decryptString(encryptedData, kek);
+    return JSON.parse(jsonString);
+}
+//# sourceMappingURL=envelope.js.map

package/apps/os-server/dist/apps/os-server/src/crypto/envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../../../../../src/crypto/envelope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAA;AAmBhC,MAAM,UAAU,WAAW;IACzB,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;AAC/B,CAAC;AAGD,MAAM,UAAU,OAAO,CAAC,GAAW,EAAE,GAAW;IAC9C,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;IACjC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;IAE5D,IAAI,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IACnC,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IACxD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;IAE/B,OAAO;QACL,UAAU;QACV,EAAE;QACF,GAAG;KACJ,CAAA;AACH,CAAC;AAGD,MAAM,UAAU,SAAS,CAAC,UAAkB,EAAE,EAAU,EAAE,GAAW,EAAE,GAAW;IAChF,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;IAChE,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;IAExB,IAAI,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACrC,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IAE5C,OAAO,GAAG,CAAA;AACZ,CAAC;AAGD,MAAM,UAAU,mBAAmB,CACjC,IAAY,EACZ,GAAW;IAGX,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;IAGzB,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;IACrC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;IAEhE,IAAI,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACvC,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IAG9D,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;IAG/B,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAElE,OAAO;QACL,aAAa;QACb,YAAY,EAAE,UAAU;QACxB,EAAE,EAAE,MAAM;QACV,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,OAAO;QAChB,GAAG;KACJ,CAAA;AACH,CAAC;AAGD,MAAM,UAAU,mBAAmB,CACjC,QAAwB,EACxB,GAAW;IAIX,IAAI,MAAc,CAAA;IAClB,IAAI,MAAc,CAAA;IAElB,IAAI,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QAExC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAA;QACxB,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAA;QAChC,MAAM,GAAG,QAAQ,CAAC,EAAE,CAAA;QAEpB,IAAI,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;IAClE,CAAC;SAAM,CAAC;QAGN,MAAM,IAAI,KAAK,CAAC,wHAAwH,CAAC,CAAA;IAC3I,CAAC;IAGD,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;IACpE,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IAEjC,IAAI,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAA;IAC3D,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IAEhE,OAAO;QACL,aAAa;QACb,GAAG;KACJ,CAAA;AACH,CAAC;AAGD,MAAM,UAAU,iBAAiB,CAAC,QAAwB;IACxD,MAAM,UAAU,GAAQ;QACtB,aAAa,EAAE,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACxD,YAAY,EAAE,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACtD,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;KACrC,CAAA;IAGD,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpB,UAAU,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACxD,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrB,UAAU,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAC1D,CAAC;IAED,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;AACnC,CAAC;AAGD,MAAM,UAAU,mBAAmB,CAAC,UAAkB;IACpD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAErC,MAAM,MAAM,GAAmB;QAC7B,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC;QAC1D,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC;QACxD,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC;QACpC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC;KACvC,CAAA;IAGD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACtD,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;IACxD,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAGD,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,GAAW;IACrD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAC7C,MAAM,QAAQ,GAAG,mBAAmB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;IACrD,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAA;AACpC,CAAC;AAGD,MAAM,UAAU,aAAa,CAAC,aAAqB,EAAE,GAAW;IAC9D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,aAAa,CAAC,CAAA;IACnD,MAAM,MAAM,GAAG,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IACjD,OAAO,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;AAC/C,CAAC;AAGD,MAAM,UAAU,aAAa,CAAC,GAAQ,EAAE,GAAW;IACjD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;IACtC,OAAO,aAAa,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;AACvC,CAAC;AAGD,MAAM,UAAU,aAAa,CAAC,aAAqB,EAAE,GAAW;IAC9D,MAAM,UAAU,GAAG,aAAa,CAAC,aAAa,EAAE,GAAG,CAAC,CAAA;IACpD,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;AAC/B,CAAC"}

package/apps/os-server/dist/apps/os-server/src/crypto/mfa-storage.d.ts

@@ -0,0 +1,6 @@
+export declare function loadMfaKek(): Buffer | null;
+export declare function sealMfaSecret(plain: string): string;
+export declare function openMfaSecret(stored: string | null): string | null;
+export declare function sealBackupCodes(codes: string[]): string[];
+export declare function openBackupCodes(stored: string[]): string[];
+//# sourceMappingURL=mfa-storage.d.ts.map

package/apps/os-server/dist/apps/os-server/src/crypto/mfa-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-storage.d.ts","sourceRoot":"","sources":["../../../../../src/crypto/mfa-storage.ts"],"names":[],"mappings":"AAOA,wBAAgB,UAAU,IAAI,MAAM,GAAG,IAAI,CAI1C;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CASnD;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CASlE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CASzD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAe1D"}

package/apps/os-server/dist/apps/os-server/src/crypto/mfa-storage.js

@@ -0,0 +1,61 @@
+import { encryptString, decryptString } from './envelope.js';
+export function loadMfaKek() {
+    const b64 = process.env['KEK_BASE64'];
+    if (!b64)
+        return null;
+    return Buffer.from(b64, 'base64');
+}
+export function sealMfaSecret(plain) {
+    const kek = loadMfaKek();
+    if (!kek) {
+        if (process.env['NODE_ENV'] === 'production') {
+            throw new Error('KEK_BASE64 is required for MFA in production');
+        }
+        return plain;
+    }
+    return encryptString(plain, kek);
+}
+export function openMfaSecret(stored) {
+    if (!stored)
+        return null;
+    const kek = loadMfaKek();
+    if (!kek)
+        return stored;
+    try {
+        return decryptString(stored, kek);
+    }
+    catch {
+        return stored;
+    }
+}
+export function sealBackupCodes(codes) {
+    const kek = loadMfaKek();
+    if (!kek) {
+        if (process.env['NODE_ENV'] === 'production') {
+            throw new Error('KEK_BASE64 is required for MFA backup codes in production');
+        }
+        return codes;
+    }
+    return [encryptString(JSON.stringify(codes), kek)];
+}
+export function openBackupCodes(stored) {
+    if (!stored.length)
+        return [];
+    const kek = loadMfaKek();
+    if (!kek)
+        return stored;
+    if (stored.length === 1) {
+        const first = stored[0];
+        if (first === undefined)
+            return stored;
+        try {
+            const json = decryptString(first, kek);
+            return JSON.parse(json);
+        }
+        catch {
+            return stored;
+        }
+    }
+    return stored;
+}
+//# sourceMappingURL=mfa-storage.js.map

package/apps/os-server/dist/apps/os-server/src/crypto/mfa-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-storage.js","sourceRoot":"","sources":["../../../../../src/crypto/mfa-storage.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE7D,MAAM,UAAU,UAAU;IACxB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAqB;IACjD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,IAAI,CAAC,GAAG;QAAE,OAAO,MAAM,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAe;IAC7C,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAgB;IAC9C,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,IAAI,CAAC,GAAG;QAAE,OAAO,MAAM,CAAC;IACxB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACvC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAa,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/apps/os-server/dist/apps/os-server/src/db/docker-manager.d.ts

@@ -0,0 +1,21 @@
+export declare const FOURRUNR_DB_CONTAINERS: readonly ["4runr-postgres", "4runr-redis"];
+export declare function isDockerAvailable(): Promise<boolean>;
+export declare function isDockerRunning(): Promise<boolean>;
+export declare function isContainerRunning(containerName: string): boolean;
+export declare function areContainersRunning(): Promise<boolean>;
+export declare function startStoppedContainers(): Promise<void>;
+export declare function startDockerCompose(composeFilePath: string): Promise<void>;
+export declare function ensure4RunrStackRunning(composeFilePath: string): Promise<void>;
+export declare function stopDockerCompose(composeFilePath: string): Promise<void>;
+export declare function stop4RunrContainers(): Promise<void>;
+export declare function waitForHealthy(containerName: string, timeoutMs?: number): Promise<void>;
+export declare function isPortInUse(port: number): Promise<boolean>;
+export declare function getContainerLogs(containerName: string, lines?: number): string;
+export interface DockerStatus {
+    available: boolean;
+    running: boolean;
+    containersRunning: boolean;
+    error?: string;
+}
+export declare function getDockerStatus(): Promise<DockerStatus>;
+//# sourceMappingURL=docker-manager.d.ts.map

package/apps/os-server/dist/apps/os-server/src/db/docker-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-manager.d.ts","sourceRoot":"","sources":["../../../../../src/db/docker-manager.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,sBAAsB,4CAA6C,CAAC;AAqBjF,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO1D;AAKD,wBAAsB,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC,CAOxD;AAKD,wBAAgB,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAUjE;AAKD,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC,CAE7D;AAKD,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CAW5D;AAMD,wBAAsB,kBAAkB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO/E;AAKD,wBAAsB,uBAAuB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CASpF;AAMD,wBAAsB,iBAAiB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAM9E;AAKD,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC,CAkBzD;AAOD,wBAAsB,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,GAAE,MAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAqCpG;AAMD,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOhE;AAOD,wBAAgB,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,GAAE,MAAW,GAAG,MAAM,CAMlF;AAYD,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAKD,wBAAsB,eAAe,IAAI,OAAO,CAAC,YAAY,CAAC,CA0B7D"}