@1mcp/agent 0.34.4 → 0.35.0-beta.2

package/build/domains/admin/adminIdentityService.js

@@ -0,0 +1,321 @@
+import { createHash, randomBytes, randomUUID, scrypt as scryptCallback, scryptSync, timingSafeEqual, } from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { promisify } from 'node:util';
+const scrypt = promisify(scryptCallback);
+const ADMIN_STATE_DIR = 'admin';
+const ADMIN_STATE_VERSION = 1;
+const PASSWORD_KEY_LENGTH = 64;
+const PASSWORD_SALT_LENGTH = 16;
+const SESSION_TOKEN_BYTES = 32;
+const CSRF_TOKEN_BYTES = 32;
+const DEFAULT_SESSION_TTL_MS = 24 * 60 * 60 * 1000;
+export const ADMIN_SESSION_COOKIE_NAME = '1mcp_admin_session';
+export class AdminIdentityError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'AdminIdentityError';
+    }
+}
+export class AdminIdentityService {
+    runtimeScopeId;
+    storageDir;
+    now;
+    sessionTtlMs;
+    createId;
+    randomToken;
+    constructor(options) {
+        this.runtimeScopeId = options.runtimeScopeId;
+        this.storageDir = path.join(options.storageDir, ADMIN_STATE_DIR);
+        this.now = options.now ?? (() => new Date());
+        this.sessionTtlMs = options.sessionTtlMs ?? DEFAULT_SESSION_TTL_MS;
+        this.createId = options.createId ?? randomUUID;
+        this.randomToken = options.randomToken ?? ((byteLength) => randomBytes(byteLength).toString('base64url'));
+    }
+    hasAdminAccount() {
+        return this.readState().accounts.length > 0;
+    }
+    async bootstrapFirstAdmin(input) {
+        const state = this.readState();
+        if (state.accounts.length > 0) {
+            throw new AdminIdentityError('admin_account_exists', 'An admin account already exists');
+        }
+        const now = this.now().toISOString();
+        const username = this.normalizeUsername(input.username);
+        const passwordHash = await this.hashPassword(input.password);
+        const latestState = this.readState();
+        if (latestState.accounts.length > 0) {
+            throw new AdminIdentityError('admin_account_exists', 'An admin account already exists');
+        }
+        const account = {
+            id: `admin_acct_${this.createId()}`,
+            runtimeScopeId: this.runtimeScopeId,
+            username,
+            passwordHash,
+            role: 'full-admin',
+            disabled: false,
+            createdAt: now,
+            updatedAt: now,
+        };
+        this.writeState({ ...latestState, accounts: [account] });
+        return toPublicAccount(account);
+    }
+    bootstrapFirstAdminFromEnvironment(env = process.env) {
+        const username = env.ONE_MCP_ADMIN_USERNAME;
+        const password = env.ONE_MCP_ADMIN_PASSWORD;
+        if (!username && !password) {
+            return null;
+        }
+        if (!username || !password) {
+            throw new AdminIdentityError('admin_bootstrap_env_incomplete', 'Both ONE_MCP_ADMIN_USERNAME and ONE_MCP_ADMIN_PASSWORD are required for admin bootstrap');
+        }
+        const state = this.readState();
+        if (state.accounts.length > 0) {
+            return null;
+        }
+        const now = this.now().toISOString();
+        const account = {
+            id: `admin_acct_${this.createId()}`,
+            runtimeScopeId: this.runtimeScopeId,
+            username: this.normalizeUsername(username),
+            passwordHash: this.hashPasswordSync(password),
+            role: 'full-admin',
+            disabled: false,
+            createdAt: now,
+            updatedAt: now,
+        };
+        this.writeState({ ...state, accounts: [account] });
+        return toPublicAccount(account);
+    }
+    async login(input) {
+        const state = this.readState();
+        const username = this.normalizeUsername(input.username);
+        const account = state.accounts.find((candidate) => candidate.username === username && !candidate.disabled);
+        if (!account || !(await this.verifyPassword(input.password, account.passwordHash))) {
+            throw new AdminIdentityError('invalid_credentials', 'Invalid admin credentials');
+        }
+        const latestState = this.readState();
+        const latestAccount = latestState.accounts.find((candidate) => candidate.id === account.id &&
+            candidate.runtimeScopeId === this.runtimeScopeId &&
+            candidate.username === username &&
+            !candidate.disabled &&
+            candidate.passwordHash === account.passwordHash);
+        if (!latestAccount) {
+            throw new AdminIdentityError('invalid_credentials', 'Invalid admin credentials');
+        }
+        const sessionToken = `admin_sess_${this.randomToken(SESSION_TOKEN_BYTES)}`;
+        const csrfToken = `admin_csrf_${this.randomToken(CSRF_TOKEN_BYTES)}`;
+        const now = this.now();
+        const session = {
+            id: `admin_session_${this.createId()}`,
+            runtimeScopeId: this.runtimeScopeId,
+            accountId: latestAccount.id,
+            tokenHash: hashSecret(sessionToken),
+            csrfToken,
+            createdAt: now.toISOString(),
+            expiresAt: new Date(now.getTime() + this.sessionTtlMs).toISOString(),
+        };
+        this.writeState({ ...latestState, sessions: [...latestState.sessions, session] });
+        return {
+            account: toPublicAccount(latestAccount),
+            sessionToken,
+            csrfToken,
+            expiresAt: session.expiresAt,
+        };
+    }
+    validateSession(sessionToken) {
+        if (!sessionToken) {
+            return null;
+        }
+        const state = this.readState();
+        const session = this.findValidSession(state, sessionToken);
+        if (!session) {
+            return null;
+        }
+        const account = state.accounts.find((candidate) => candidate.id === session.accountId && candidate.runtimeScopeId === this.runtimeScopeId);
+        if (!account || account.disabled) {
+            return null;
+        }
+        return {
+            account: toPublicAccount(account),
+            csrfToken: session.csrfToken,
+            expiresAt: session.expiresAt,
+        };
+    }
+    validateCsrf(sessionToken, csrfToken) {
+        if (!sessionToken || !csrfToken || Array.isArray(csrfToken)) {
+            return false;
+        }
+        const state = this.readState();
+        const session = this.findValidSession(state, sessionToken);
+        if (!session) {
+            return false;
+        }
+        return safeEqual(csrfToken, session.csrfToken);
+    }
+    revokeSession(sessionToken) {
+        if (!sessionToken) {
+            return;
+        }
+        const state = this.readState();
+        const tokenHash = hashSecret(sessionToken);
+        const revokedAt = this.now().toISOString();
+        this.writeState({
+            ...state,
+            sessions: state.sessions.map((session) => safeEqual(session.tokenHash, tokenHash) && !session.revokedAt ? { ...session, revokedAt } : session),
+        });
+    }
+    revokeAllSessions() {
+        const state = this.readState();
+        const revokedAt = this.now().toISOString();
+        this.writeState({
+            ...state,
+            sessions: state.sessions.map((session) => (session.revokedAt ? session : { ...session, revokedAt })),
+        });
+    }
+    async changePassword(accountId, password) {
+        const state = this.readState();
+        const account = this.requireAccount(state, accountId);
+        const passwordHash = await this.hashPassword(password);
+        const latestState = this.readState();
+        const latestAccount = this.requireAccount(latestState, account.id);
+        const updatedAccount = {
+            ...latestAccount,
+            passwordHash,
+            updatedAt: this.now().toISOString(),
+        };
+        this.writeState({
+            ...latestState,
+            accounts: latestState.accounts.map((candidate) => (candidate.id === account.id ? updatedAccount : candidate)),
+            sessions: this.revokeSessionsForAccount(latestState.sessions, account.id),
+        });
+        return toPublicAccount(updatedAccount);
+    }
+    disableAccount(accountId) {
+        const state = this.readState();
+        const account = this.requireAccount(state, accountId);
+        const updatedAccount = {
+            ...account,
+            disabled: true,
+            updatedAt: this.now().toISOString(),
+        };
+        this.writeState({
+            ...state,
+            accounts: state.accounts.map((candidate) => (candidate.id === account.id ? updatedAccount : candidate)),
+            sessions: this.revokeSessionsForAccount(state.sessions, account.id),
+        });
+        return toPublicAccount(updatedAccount);
+    }
+    deleteAccount(accountId) {
+        const state = this.readState();
+        const account = this.requireAccount(state, accountId);
+        this.writeState({
+            ...state,
+            accounts: state.accounts.filter((candidate) => candidate.id !== account.id),
+            sessions: this.revokeSessionsForAccount(state.sessions, account.id),
+        });
+    }
+    findValidSession(state, sessionToken) {
+        const tokenHash = hashSecret(sessionToken);
+        const session = state.sessions.find((candidate) => candidate.runtimeScopeId === this.runtimeScopeId &&
+            !candidate.revokedAt &&
+            new Date(candidate.expiresAt).getTime() > this.now().getTime() &&
+            safeEqual(candidate.tokenHash, tokenHash));
+        return session ?? null;
+    }
+    requireAccount(state, accountId) {
+        const account = state.accounts.find((candidate) => candidate.id === accountId && candidate.runtimeScopeId === this.runtimeScopeId);
+        if (!account) {
+            throw new AdminIdentityError('admin_account_not_found', 'Admin account not found');
+        }
+        return account;
+    }
+    revokeSessionsForAccount(sessions, accountId) {
+        const revokedAt = this.now().toISOString();
+        return sessions.map((session) => session.accountId === accountId && !session.revokedAt ? { ...session, revokedAt } : session);
+    }
+    normalizeUsername(username) {
+        const normalized = username.trim();
+        if (!normalized) {
+            throw new AdminIdentityError('invalid_username', 'Admin username is required');
+        }
+        return normalized;
+    }
+    async hashPassword(password) {
+        this.validatePassword(password);
+        const salt = randomBytes(PASSWORD_SALT_LENGTH).toString('base64url');
+        const key = (await scrypt(password, salt, PASSWORD_KEY_LENGTH));
+        return `scrypt:v1:${salt}:${key.toString('base64url')}`;
+    }
+    hashPasswordSync(password) {
+        this.validatePassword(password);
+        const salt = randomBytes(PASSWORD_SALT_LENGTH).toString('base64url');
+        const key = scryptSync(password, salt, PASSWORD_KEY_LENGTH);
+        return `scrypt:v1:${salt}:${key.toString('base64url')}`;
+    }
+    async verifyPassword(password, passwordHash) {
+        const [algorithm, version, salt, encodedHash] = passwordHash.split(':');
+        if (algorithm !== 'scrypt' || version !== 'v1' || !salt || !encodedHash) {
+            return false;
+        }
+        const expected = Buffer.from(encodedHash, 'base64url');
+        const actual = (await scrypt(password, salt, expected.length));
+        return expected.length === actual.length && timingSafeEqual(expected, actual);
+    }
+    validatePassword(password) {
+        if (password.length < 12) {
+            throw new AdminIdentityError('weak_password', 'Admin password must be at least 12 characters');
+        }
+    }
+    readState() {
+        const filePath = this.stateFilePath();
+        if (!fs.existsSync(filePath)) {
+            return this.emptyState();
+        }
+        const parsed = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+        if (parsed.runtimeScopeId !== this.runtimeScopeId) {
+            throw new AdminIdentityError('runtime_scope_mismatch', 'Admin state belongs to a different runtime scope');
+        }
+        return parsed;
+    }
+    writeState(state) {
+        fs.mkdirSync(this.storageDir, { recursive: true });
+        const filePath = this.stateFilePath();
+        const tempPath = `${filePath}.${process.pid}.tmp`;
+        fs.writeFileSync(tempPath, JSON.stringify(state, null, 2), { encoding: 'utf8', mode: 0o600 });
+        fs.renameSync(tempPath, filePath);
+    }
+    emptyState() {
+        return {
+            schemaVersion: ADMIN_STATE_VERSION,
+            runtimeScopeId: this.runtimeScopeId,
+            accounts: [],
+            sessions: [],
+        };
+    }
+    stateFilePath() {
+        return path.join(this.storageDir, `admin-state-${hashSecret(this.runtimeScopeId).slice(0, 24)}.json`);
+    }
+}
+function toPublicAccount(account) {
+    return {
+        id: account.id,
+        runtimeScopeId: account.runtimeScopeId,
+        username: account.username,
+        role: account.role,
+        disabled: account.disabled,
+        createdAt: account.createdAt,
+        updatedAt: account.updatedAt,
+    };
+}
+function hashSecret(secret) {
+    return createHash('sha256').update(secret).digest('base64url');
+}
+function safeEqual(a, b) {
+    const left = Buffer.from(a);
+    const right = Buffer.from(b);
+    return left.length === right.length && timingSafeEqual(left, right);
+}
+//# sourceMappingURL=adminIdentityService.js.map

package/build/domains/admin/adminIdentityService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adminIdentityService.js","sourceRoot":"","sources":["../../../src/domains/admin/adminIdentityService.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,WAAW,EACX,UAAU,EACV,MAAM,IAAI,cAAc,EACxB,UAAU,EACV,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,MAAM,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC;AAEzC,MAAM,eAAe,GAAG,OAAO,CAAC;AAChC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAChC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnD,MAAM,CAAC,MAAM,yBAAyB,GAAG,oBAAoB,CAAC;AAkE9D,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAEzB;IADlB,YACkB,IAAY,EAC5B,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,SAAI,GAAJ,IAAI,CAAQ;QAI5B,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,OAAO,oBAAoB;IACd,cAAc,CAAS;IACvB,UAAU,CAAS;IACnB,GAAG,CAAa;IAChB,YAAY,CAAS;IACrB,QAAQ,CAAe;IACvB,WAAW,CAAiC;IAE7D,YAAY,OAAoC;QAC9C,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAC7C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QACjE,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,sBAAsB,CAAC;QACnE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,UAAU,CAAC;QAC/C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5G,CAAC;IAED,eAAe;QACb,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,KAA+B;QACvD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,kBAAkB,CAAC,sBAAsB,EAAE,iCAAiC,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,kBAAkB,CAAC,sBAAsB,EAAE,iCAAiC,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,OAAO,GAAuB;YAClC,EAAE,EAAE,cAAc,IAAI,CAAC,QAAQ,EAAE,EAAE;YACnC,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,QAAQ;YACR,YAAY;YACZ,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;SACf,CAAC;QAEF,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,WAAW,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzD,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED,kCAAkC,CAChC,MAA0C,OAAO,CAAC,GAAyC;QAE3F,MAAM,QAAQ,GAAG,GAAG,CAAC,sBAAsB,CAAC;QAC5C,MAAM,QAAQ,GAAG,GAAG,CAAC,sBAAsB,CAAC;QAE5C,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,kBAAkB,CAC1B,gCAAgC,EAChC,yFAAyF,CAC1F,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,OAAO,GAAuB;YAClC,EAAE,EAAE,cAAc,IAAI,CAAC,QAAQ,EAAE,EAAE;YACnC,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC;YAC1C,YAAY,EAAE,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC;YAC7C,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;SACf,CAAC;QAEF,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnD,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAE3G,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;YACnF,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,2BAA2B,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,aAAa,GAAG,WAAW,CAAC,QAAQ,CAAC,IAAI,CAC7C,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE;YAC3B,SAAS,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc;YAChD,SAAS,CAAC,QAAQ,KAAK,QAAQ;YAC/B,CAAC,SAAS,CAAC,QAAQ;YACnB,SAAS,CAAC,YAAY,KAAK,OAAO,CAAC,YAAY,CAClD,CAAC;QACF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,2BAA2B,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,YAAY,GAAG,cAAc,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC3E,MAAM,SAAS,GAAG,cAAc,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACrE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,OAAO,GAAuB;YAClC,EAAE,EAAE,iBAAiB,IAAI,CAAC,QAAQ,EAAE,EAAE;YACtC,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,aAAa,CAAC,EAAE;YAC3B,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC;YACnC,SAAS;YACT,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;YAC5B,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE;SACrE,CAAC;QAEF,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,WAAW,EAAE,QAAQ,EAAE,CAAC,GAAG,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAElF,OAAO;YACL,OAAO,EAAE,eAAe,CAAC,aAAa,CAAC;YACvC,YAAY;YACZ,SAAS;YACT,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC;IACJ,CAAC;IAED,eAAe,CAAC,YAAgC;QAC9C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QAC3D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CACjC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,OAAO,CAAC,SAAS,IAAI,SAAS,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc,CACtG,CAAC;QACF,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO;YACL,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC;YACjC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC;IACJ,CAAC;IAED,YAAY,CAAC,YAAgC,EAAE,SAAwC;QACrF,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QAC3D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC;IAED,aAAa,CAAC,YAAgC;QAC5C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,IAAI,CAAC,UAAU,CAAC;YACd,GAAG,KAAK;YACR,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CACvC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,OAAO,CACpG;SACF,CAAC,CAAC;IACL,CAAC;IAED,iBAAiB;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,IAAI,CAAC,UAAU,CAAC;YACd,GAAG,KAAK;YACR,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;SACrG,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,SAAiB,EAAE,QAAgB;QACtD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QACtD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QACnE,MAAM,cAAc,GAAG;YACrB,GAAG,aAAa;YAChB,YAAY;YACZ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QAEF,IAAI,CAAC,UAAU,CAAC;YACd,GAAG,WAAW;YACd,QAAQ,EAAE,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC7G,QAAQ,EAAE,IAAI,CAAC,wBAAwB,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;SAC1E,CAAC,CAAC;QAEH,OAAO,eAAe,CAAC,cAAc,CAAC,CAAC;IACzC,CAAC;IAED,cAAc,CAAC,SAAiB;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QACtD,MAAM,cAAc,GAAG;YACrB,GAAG,OAAO;YACV,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QAEF,IAAI,CAAC,UAAU,CAAC;YACd,GAAG,KAAK;YACR,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACvG,QAAQ,EAAE,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;SACpE,CAAC,CAAC;QAEH,OAAO,eAAe,CAAC,cAAc,CAAC,CAAC;IACzC,CAAC;IAED,aAAa,CAAC,SAAiB;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QACtD,IAAI,CAAC,UAAU,CAAC;YACd,GAAG,KAAK;YACR,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC;YAC3E,QAAQ,EAAE,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;SACpE,CAAC,CAAC;IACL,CAAC;IAEO,gBAAgB,CAAC,KAAiB,EAAE,YAAoB;QAC9D,MAAM,SAAS,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CACjC,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc;YAChD,CAAC,SAAS,CAAC,SAAS;YACpB,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE;YAC9D,SAAS,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAC5C,CAAC;QACF,OAAO,OAAO,IAAI,IAAI,CAAC;IACzB,CAAC;IAEO,cAAc,CAAC,KAAiB,EAAE,SAAiB;QACzD,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CACjC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,SAAS,IAAI,SAAS,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc,CAC9F,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,kBAAkB,CAAC,yBAAyB,EAAE,yBAAyB,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,wBAAwB,CAAC,QAA8B,EAAE,SAAiB;QAChF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAC9B,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,OAAO,CAC5F,CAAC;IACJ,CAAC;IAEO,iBAAiB,CAAC,QAAgB;QACxC,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,EAAE,4BAA4B,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,QAAgB;QACzC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,WAAW,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrE,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,mBAAmB,CAAC,CAAW,CAAC;QAC1E,OAAO,aAAa,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;IAC1D,CAAC;IAEO,gBAAgB,CAAC,QAAgB;QACvC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,WAAW,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrE,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,mBAAmB,CAAC,CAAC;QAC5D,OAAO,aAAa,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;IAC1D,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,YAAoB;QACjE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxE,IAAI,SAAS,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACxE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAW,CAAC;QACzE,OAAO,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChF,CAAC;IAEO,gBAAgB,CAAC,QAAgB;QACvC,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACzB,MAAM,IAAI,kBAAkB,CAAC,eAAe,EAAE,+CAA+C,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;IAEO,SAAS;QACf,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACtC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;QAC3B,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAe,CAAC;QAC3E,IAAI,MAAM,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc,EAAE,CAAC;YAClD,MAAM,IAAI,kBAAkB,CAAC,wBAAwB,EAAE,kDAAkD,CAAC,CAAC;QAC7G,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,UAAU,CAAC,KAAiB;QAClC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;QAClD,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9F,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACpC,CAAC;IAEO,UAAU;QAChB,OAAO;YACL,aAAa,EAAE,mBAAmB;YAClC,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IAEO,aAAa;QACnB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,eAAe,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;IACxG,CAAC;CACF;AAED,SAAS,eAAe,CAAC,OAA2B;IAClD,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,SAAS,CAAC,CAAS,EAAE,CAAS;IACrC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACtE,CAAC"}

package/build/domains/admin/adminOAuthService.d.ts

@@ -0,0 +1,26 @@
+import type { OAuthAuthorizationFlow } from '../../auth/oauthAuthorizationFlow.js';
+import type { AdminOperationContext, AdminOperationResult, AdminOperationService } from './adminOperationService.js';
+interface AdminOAuthServiceOptions {
+    operationService: AdminOperationService;
+    oauthFlow: OAuthAuthorizationFlow;
+}
+interface AdminOAuthOperationInput {
+    context: AdminOperationContext;
+    serviceId: string;
+}
+export interface AdminOAuthRedirectResult {
+    serviceId: string;
+    redirectUrl: string;
+}
+export interface AdminOAuthOperations {
+    authorizeService(input: AdminOAuthOperationInput): Promise<AdminOperationResult<AdminOAuthRedirectResult>>;
+    restartService(input: AdminOAuthOperationInput): Promise<AdminOperationResult<AdminOAuthRedirectResult>>;
+}
+export declare class AdminOAuthService implements AdminOAuthOperations {
+    private readonly options;
+    constructor(options: AdminOAuthServiceOptions);
+    authorizeService(input: AdminOAuthOperationInput): Promise<AdminOperationResult<AdminOAuthRedirectResult>>;
+    restartService(input: AdminOAuthOperationInput): Promise<AdminOperationResult<AdminOAuthRedirectResult>>;
+}
+export {};
+//# sourceMappingURL=adminOAuthService.d.ts.map

package/build/domains/admin/adminOAuthService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adminOAuthService.d.ts","sourceRoot":"","sources":["../../../src/domains/admin/adminOAuthService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAElF,OAAO,KAAK,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAErH,UAAU,wBAAwB;IAChC,gBAAgB,EAAE,qBAAqB,CAAC;IACxC,SAAS,EAAE,sBAAsB,CAAC;CACnC;AAED,UAAU,wBAAwB;IAChC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,gBAAgB,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,oBAAoB,CAAC,wBAAwB,CAAC,CAAC,CAAC;IAC3G,cAAc,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,oBAAoB,CAAC,wBAAwB,CAAC,CAAC,CAAC;CAC1G;AAED,qBAAa,iBAAkB,YAAW,oBAAoB;IAChD,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,wBAAwB;IAExD,gBAAgB,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,oBAAoB,CAAC,wBAAwB,CAAC,CAAC;IAkC1G,cAAc,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,oBAAoB,CAAC,wBAAwB,CAAC,CAAC;CAiC/G"}

package/build/domains/admin/adminOAuthService.js

@@ -0,0 +1,71 @@
+export class AdminOAuthService {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    async authorizeService(input) {
+        const context = {
+            ...input.context,
+            target: { type: 'backend_oauth_service', id: input.serviceId },
+        };
+        return this.options.operationService.executeMutation({
+            context,
+            operationName: 'authorizeBackendOAuth',
+            run: async () => {
+                let result;
+                try {
+                    result = await this.options.oauthFlow.startBackendOAuth({ serverName: input.serviceId });
+                }
+                catch {
+                    throw new Error('backend_oauth_authorization_start_failed');
+                }
+                if (result.status === 'service_not_found') {
+                    throw new Error('backend_oauth_service_not_found');
+                }
+                if (result.status === 'runtime_unavailable') {
+                    throw new Error('backend_oauth_runtime_unavailable');
+                }
+                if (result.status !== 'redirect') {
+                    throw new Error('backend_oauth_authorization_start_failed');
+                }
+                return {
+                    serviceId: input.serviceId,
+                    redirectUrl: result.redirectUrl,
+                };
+            },
+        });
+    }
+    async restartService(input) {
+        const context = {
+            ...input.context,
+            target: { type: 'backend_oauth_service', id: input.serviceId },
+        };
+        return this.options.operationService.executeMutation({
+            context,
+            operationName: 'restartBackendOAuth',
+            run: async () => {
+                let result;
+                try {
+                    result = await this.options.oauthFlow.restartBackendOAuth({ serverName: input.serviceId });
+                }
+                catch {
+                    throw new Error('backend_oauth_authorization_start_failed');
+                }
+                if (result.status === 'service_not_found') {
+                    throw new Error('backend_oauth_service_not_found');
+                }
+                if (result.status === 'runtime_unavailable') {
+                    throw new Error('backend_oauth_runtime_unavailable');
+                }
+                if (result.status !== 'restarted' || !result.redirectUrl) {
+                    throw new Error('backend_oauth_authorization_start_failed');
+                }
+                return {
+                    serviceId: input.serviceId,
+                    redirectUrl: result.redirectUrl,
+                };
+            },
+        });
+    }
+}
+//# sourceMappingURL=adminOAuthService.js.map

package/build/domains/admin/adminOAuthService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adminOAuthService.js","sourceRoot":"","sources":["../../../src/domains/admin/adminOAuthService.ts"],"names":[],"mappings":"AAwBA,MAAM,OAAO,iBAAiB;IACC;IAA7B,YAA6B,OAAiC;QAAjC,YAAO,GAAP,OAAO,CAA0B;IAAG,CAAC;IAElE,KAAK,CAAC,gBAAgB,CAAC,KAA+B;QACpD,MAAM,OAAO,GAAG;YACd,GAAG,KAAK,CAAC,OAAO;YAChB,MAAM,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE;SAC/D,CAAC;QAEF,OAAO,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,eAAe,CAAC;YACnD,OAAO;YACP,aAAa,EAAE,uBAAuB;YACtC,GAAG,EAAE,KAAK,IAAI,EAAE;gBACd,IAAI,MAAM,CAAC;gBACX,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;gBAC3F,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;gBAC9D,CAAC;gBACD,IAAI,MAAM,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;oBAC1C,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;gBACrD,CAAC;gBACD,IAAI,MAAM,CAAC,MAAM,KAAK,qBAAqB,EAAE,CAAC;oBAC5C,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;gBACvD,CAAC;gBACD,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;oBACjC,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;gBAC9D,CAAC;gBAED,OAAO;oBACL,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,WAAW,EAAE,MAAM,CAAC,WAAW;iBAChC,CAAC;YACJ,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAA+B;QAClD,MAAM,OAAO,GAAG;YACd,GAAG,KAAK,CAAC,OAAO;YAChB,MAAM,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE;SAC/D,CAAC;QAEF,OAAO,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,eAAe,CAAC;YACnD,OAAO;YACP,aAAa,EAAE,qBAAqB;YACpC,GAAG,EAAE,KAAK,IAAI,EAAE;gBACd,IAAI,MAAM,CAAC;gBACX,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,mBAAmB,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;gBAC7F,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;gBAC9D,CAAC;gBACD,IAAI,MAAM,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;oBAC1C,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;gBACrD,CAAC;gBACD,IAAI,MAAM,CAAC,MAAM,KAAK,qBAAqB,EAAE,CAAC;oBAC5C,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;gBACvD,CAAC;gBACD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;oBACzD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;gBAC9D,CAAC;gBAED,OAAO;oBACL,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,WAAW,EAAE,MAAM,CAAC,WAAW;iBAChC,CAAC;YACJ,CAAC;SACF,CAAC,CAAC;IACL,CAAC;CACF"}

package/build/domains/admin/adminOperationService.d.ts

@@ -0,0 +1,203 @@
+import type { AdminMutationAvailability } from './runtimeScopeAdminLock.js';
+type AdminOperationOrigin = 'browser' | 'cli';
+export interface AdminOperationContext {
+    actor: {
+        type: 'admin_account' | 'admin_session';
+        accountId: string;
+        sessionId?: string;
+    };
+    origin: AdminOperationOrigin;
+    target: AdminOperationTarget;
+    runtimeIdentity: {
+        runtimeScopeId: string;
+        runtimeVersion?: string;
+    };
+    request: {
+        requestId: string;
+        jsonMode?: boolean;
+    };
+    idempotencyKey?: string;
+    requestFingerprint?: string;
+    deadline?: string;
+    confirmationFacts?: Record<string, unknown>;
+}
+export interface AdminOperationTarget {
+    type: string;
+    id?: string;
+}
+export interface AdminConfirmationRequirement {
+    code: string;
+    expected?: string | boolean | number;
+    target?: AdminOperationTarget;
+}
+export interface AdminAuditFact {
+    timestamp: string;
+    operationId: string;
+    operationName: string;
+    result: 'completed' | 'failed';
+    actor: {
+        type: 'admin_account' | 'admin_session';
+        accountIdHash: string;
+        sessionIdHash?: string;
+    };
+    origin: AdminOperationOrigin;
+    target: AdminOperationTarget;
+    request: {
+        requestId: string;
+    };
+    confirmationFacts?: Record<string, unknown>;
+}
+interface AdminOperationServiceOptions {
+    runtimeScopeId: string;
+    storageDir: string;
+    mutationAvailability?: AdminMutationAvailability;
+    now?: () => Date;
+    completedRetentionMs?: number;
+    auditRetentionMs?: number;
+    inFlightWaitMs?: number;
+    createOperationId?: () => string;
+}
+interface ExecuteMutationBase {
+    context: AdminOperationContext;
+    operationName: string;
+}
+interface PreparedMutation<T> {
+    confirmationRequirements?: AdminConfirmationRequirement[];
+    run: (context: AdminOperationContext) => Promise<T>;
+}
+type ExecuteMutationInput<T> = ExecuteMutationBase & (PreparedMutation<T> | {
+    prepare: () => Promise<PreparedMutation<T>>;
+});
+interface ExecuteReadOnlyInput<T> {
+    context: AdminOperationContext;
+    operationName: string;
+    run: (context: AdminOperationContext) => Promise<T>;
+}
+interface ExecuteDryRunInput<T> {
+    context: AdminOperationContext;
+    operationName: string;
+    run: (context: AdminOperationContext) => Promise<T>;
+}
+interface RecentAuditOptions {
+    limit?: number;
+}
+export type AdminOperationResult<T = unknown> = {
+    ok: true;
+    status: 'completed';
+    operationId: string;
+    operationName: string;
+    result: T;
+    replayed: boolean;
+} | AdminOperationRecoveryResult;
+export type AdminOperationRecoveryResult = {
+    ok: false;
+    status: 'idempotency_key_required';
+    code: 'idempotency_key_required';
+    retryable: false;
+    operationName: string;
+} | {
+    ok: false;
+    status: 'idempotency_conflict';
+    code: 'idempotency_conflict';
+    retryable: false;
+    operationName: string;
+} | {
+    ok: false;
+    status: 'operation_in_progress';
+    code: 'operation_in_progress';
+    retryable: true;
+    operationName: string;
+    retryAfterMs: number;
+} | {
+    ok: false;
+    status: 'operation_state_unknown';
+    code: 'operation_state_unknown';
+    retryable: false;
+    operationName: string;
+    target: AdminOperationTarget;
+    reservedAt: string;
+    recovery: 'inspect_current_state_and_retry_with_new_idempotency_key';
+} | {
+    ok: false;
+    status: 'mutation_confirmation_required';
+    code: 'mutation_confirmation_required';
+    retryable: false;
+    operationName: string;
+    confirmationRequirements: AdminConfirmationRequirement[];
+} | {
+    ok: false;
+    status: 'mutation_failed';
+    code: 'mutation_failed';
+    retryable: false;
+    operationName: string;
+    error: string;
+} | {
+    ok: false;
+    status: 'admin_operation_journal_unavailable';
+    code: 'admin_operation_journal_unavailable';
+    retryable: false;
+    operationName: string;
+} | {
+    ok: false;
+    status: 'runtime_scope_mismatch';
+    code: 'runtime_scope_mismatch';
+    retryable: false;
+    operationName: string;
+} | {
+    ok: false;
+    status: 'runtime_scope_locked';
+    code: 'runtime_scope_locked';
+    retryable: true;
+    operationName: string;
+    reason: 'writer_lock_unavailable';
+};
+export declare class AdminOperationService {
+    private readonly runtimeScopeId;
+    private readonly storageDir;
+    private readonly now;
+    private readonly completedRetentionMs;
+    private readonly auditRetentionMs;
+    private readonly inFlightWaitMs;
+    private readonly createOperationId;
+    private readonly mutationAvailability;
+    private readonly idempotency;
+    private readonly recentAuditFacts;
+    private readonly mutationState;
+    constructor(options: AdminOperationServiceOptions);
+    executeReadOnly<T>(input: ExecuteReadOnlyInput<T>): Promise<AdminOperationResult<T>>;
+    executeDryRun<T>(input: ExecuteDryRunInput<T>): Promise<AdminOperationResult<T>>;
+    getRecentAuditFacts(options?: RecentAuditOptions): AdminAuditFact[];
+    executeMutation<T>(input: ExecuteMutationInput<T>): Promise<AdminOperationResult<T>>;
+    private prepareAndExecuteMutation;
+    private waitForActivePreparation;
+    private validateMutationAdmission;
+    private validateRuntimeScope;
+    private runReservedMutation;
+    private recordMutationFailure;
+    private enqueueMutation;
+    private waitForActiveMutation;
+    private retryWaitMs;
+    private operationInProgress;
+    private journalUnavailableResult;
+    private validateConfirmations;
+    private replayJournal;
+    private applyJournalRecord;
+    private entryFromRecord;
+    private markStateUnknown;
+    private markStateUnknownResult;
+    private stateUnknownResult;
+    private reservedRecord;
+    private appendAuditRecord;
+    private appendJournalRecord;
+    private scopedKeyHash;
+    private legacyScopedKeyHash;
+    private isExpired;
+    private isAuditExpired;
+    private isExpiredTerminal;
+    private compactJournal;
+    private shouldRetainJournalRecord;
+    private readJournalRecords;
+    private journalFilePath;
+}
+export {};
+//# sourceMappingURL=adminOperationService.d.ts.map

package/build/domains/admin/adminOperationService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adminOperationService.d.ts","sourceRoot":"","sources":["../../../src/domains/admin/adminOperationService.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAQ5E,KAAK,oBAAoB,GAAG,SAAS,GAAG,KAAK,CAAC;AAE9C,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE;QACL,IAAI,EAAE,eAAe,GAAG,eAAe,CAAC;QACxC,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,MAAM,EAAE,oBAAoB,CAAC;IAC7B,MAAM,EAAE,oBAAoB,CAAC;IAC7B,eAAe,EAAE;QACf,cAAc,EAAE,MAAM,CAAC;QACvB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;IACF,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC;IACF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;IACrC,MAAM,CAAC,EAAE,oBAAoB,CAAC;CAC/B;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,WAAW,GAAG,QAAQ,CAAC;IAC/B,KAAK,EAAE;QAAE,IAAI,EAAE,eAAe,GAAG,eAAe,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAClG,MAAM,EAAE,oBAAoB,CAAC;IAC7B,MAAM,EAAE,oBAAoB,CAAC;IAC7B,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/B,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC7C;AAED,UAAU,4BAA4B;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,oBAAoB,CAAC,EAAE,yBAAyB,CAAC;IACjD,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,MAAM,CAAC;CAClC;AAED,UAAU,mBAAmB;IAC3B,OAAO,EAAE,qBAAqB,CAAC;IAC/B,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,UAAU,gBAAgB,CAAC,CAAC;IAC1B,wBAAwB,CAAC,EAAE,4BAA4B,EAAE,CAAC;IAC1D,GAAG,EAAE,CAAC,OAAO,EAAE,qBAAqB,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;CACrD;AAED,KAAK,oBAAoB,CAAC,CAAC,IAAI,mBAAmB,GAChD,CACI,gBAAgB,CAAC,CAAC,CAAC,GACnB;IACE,OAAO,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;CAC7C,CACJ,CAAC;AAIJ,UAAU,oBAAoB,CAAC,CAAC;IAC9B,OAAO,EAAE,qBAAqB,CAAC;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,CAAC,OAAO,EAAE,qBAAqB,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;CACrD;AAED,UAAU,kBAAkB,CAAC,CAAC;IAC5B,OAAO,EAAE,qBAAqB,CAAC;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,CAAC,OAAO,EAAE,qBAAqB,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;CACrD;AAED,UAAU,kBAAkB;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,oBAAoB,CAAC,CAAC,GAAG,OAAO,IACxC;IACE,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,WAAW,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,CAAC,CAAC;IACV,QAAQ,EAAE,OAAO,CAAC;CACnB,GACD,4BAA4B,CAAC;AAEjC,MAAM,MAAM,4BAA4B,GACpC;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,0BAA0B,CAAC;IACnC,IAAI,EAAE,0BAA0B,CAAC;IACjC,SAAS,EAAE,KAAK,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACvB,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,sBAAsB,CAAC;IAC/B,IAAI,EAAE,sBAAsB,CAAC;IAC7B,SAAS,EAAE,KAAK,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACvB,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,uBAAuB,CAAC;IAChC,IAAI,EAAE,uBAAuB,CAAC;IAC9B,SAAS,EAAE,IAAI,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,yBAAyB,CAAC;IAClC,IAAI,EAAE,yBAAyB,CAAC;IAChC,SAAS,EAAE,KAAK,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,oBAAoB,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,0DAA0D,CAAC;CACtE,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,gCAAgC,CAAC;IACzC,IAAI,EAAE,gCAAgC,CAAC;IACvC,SAAS,EAAE,KAAK,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,wBAAwB,EAAE,4BAA4B,EAAE,CAAC;CAC1D,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,iBAAiB,CAAC;IAC1B,IAAI,EAAE,iBAAiB,CAAC;IACxB,SAAS,EAAE,KAAK,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;CACf,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,qCAAqC,CAAC;IAC9C,IAAI,EAAE,qCAAqC,CAAC;IAC5C,SAAS,EAAE,KAAK,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACvB,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,wBAAwB,CAAC;IACjC,IAAI,EAAE,wBAAwB,CAAC;IAC/B,SAAS,EAAE,KAAK,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACvB,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,sBAAsB,CAAC;IAC/B,IAAI,EAAE,sBAAsB,CAAC;IAC7B,SAAS,EAAE,IAAI,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,yBAAyB,CAAC;CACnC,CAAC;AAsGN,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAS;IAC9C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAe;IACjD,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA4B;IACjE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAgC;IAC5D,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAmB;IACpD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA4B;gBAE9C,OAAO,EAAE,4BAA4B;IAgB3C,eAAe,CAAC,CAAC,EAAE,KAAK,EAAE,oBAAoB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;IAYpF,aAAa,CAAC,CAAC,EAAE,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;IA4BtF,mBAAmB,CAAC,OAAO,GAAE,kBAAuB,GAAG,cAAc,EAAE;IAcjE,eAAe,CAAC,CAAC,EAAE,KAAK,EAAE,oBAAoB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;YA+G5E,yBAAyB;YAgDzB,wBAAwB;IAWtC,OAAO,CAAC,yBAAyB;IAqBjC,OAAO,CAAC,oBAAoB;YAed,mBAAmB;IA6CjC,OAAO,CAAC,qBAAqB;IAwC7B,OAAO,CAAC,eAAe;YAST,qBAAqB;IAcnC,OAAO,CAAC,WAAW;IAInB,OAAO,CAAC,mBAAmB;IAW3B,OAAO,CAAC,wBAAwB;IAUhC,OAAO,CAAC,qBAAqB;IAyB7B,OAAO,CAAC,aAAa;IAmCrB,OAAO,CAAC,kBAAkB;IAuE1B,OAAO,CAAC,eAAe;IAcvB,OAAO,CAAC,gBAAgB;IAqBxB,OAAO,CAAC,sBAAsB;IAa9B,OAAO,CAAC,kBAAkB;IAa1B,OAAO,CAAC,cAAc;IAsBtB,OAAO,CAAC,iBAAiB;IAmCzB,OAAO,CAAC,mBAAmB;IAa3B,OAAO,CAAC,aAAa;IAcrB,OAAO,CAAC,mBAAmB;IAa3B,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,iBAAiB;IAMzB,OAAO,CAAC,cAAc;IAmBtB,OAAO,CAAC,yBAAyB;IAejC,OAAO,CAAC,kBAAkB;IAQ1B,OAAO,CAAC,eAAe;CAMxB"}