@jazzmind/busibox-app 3.0.18

package/dist/lib/deploy/app-permissions.js

@@ -0,0 +1,96 @@
+/**
+ * App-Specific Permission Checks
+ *
+ * Combines authz RBAC bindings with the app config store to determine
+ * whether a user can access a particular deployed app.
+ *
+ * These functions live here (not in authz/) because they depend on the
+ * deploy/app-config store for app metadata — they are not pure authz concepts.
+ */
+import { userCanAccessResource, getUserAccessibleResources, } from '@jazzmind/busibox-app';
+import { getAuthzOptions } from '../authz/next-client';
+import { getAppByIdFromStore, getAppConfigStoreContextForUser, listAppsFromStore } from './app-config';
+/**
+ * Get RBAC options with session JWT for self-service operations.
+ *
+ * Authz accepts session JWTs directly for self-service operations
+ * (user checking their own access, listing their own resources).
+ * No token exchange is required.
+ */
+function getRbacOptionsWithToken(sessionJwt) {
+    return {
+        accessToken: sessionJwt,
+        ...getAuthzOptions(),
+    };
+}
+/**
+ * Check if a user can access a specific app.
+ *
+ * Queries the authz service to check if the user has any role
+ * that is bound to the specified app.
+ *
+ * @param userId - User ID to check
+ * @param appId - App ID to check access for
+ * @param accessToken - Access token for authenticated check
+ * @returns true if user has permission, false otherwise
+ */
+export async function canAccessApp(userId, appId, accessToken) {
+    try {
+        if (!accessToken) {
+            return false;
+        }
+        const appStoreContext = await getAppConfigStoreContextForUser(userId, accessToken);
+        const app = await getAppByIdFromStore(appStoreContext.accessToken, appId);
+        if (!app || !app.isActive) {
+            return false;
+        }
+        const options = getRbacOptionsWithToken(accessToken);
+        return await userCanAccessResource(userId, 'app', appId, options);
+    }
+    catch (error) {
+        console.error('[APP-PERMISSIONS] Error checking app access:', error);
+        return false;
+    }
+}
+/**
+ * Get all apps a user can access.
+ *
+ * Queries the authz service for accessible app IDs, then fetches
+ * app details from the app config store.
+ *
+ * @param userId - User ID
+ * @param accessToken - Access token for authenticated check
+ * @returns Array of apps the user has permission to access
+ */
+export async function getUserApps(userId, accessToken) {
+    try {
+        if (!accessToken) {
+            return [];
+        }
+        const options = getRbacOptionsWithToken(accessToken);
+        const accessibleAppIds = await getUserAccessibleResources(userId, 'app', options);
+        if (accessibleAppIds.length === 0) {
+            return [];
+        }
+        const appStoreContext = await getAppConfigStoreContextForUser(userId, accessToken);
+        const accessibleSet = new Set(accessibleAppIds);
+        return (await listAppsFromStore(appStoreContext.accessToken))
+            .filter((app) => app.isActive && accessibleSet.has(app.id))
+            .map((app) => ({
+            id: app.id,
+            name: app.name,
+            description: app.description,
+            type: app.type,
+            url: app.url,
+            iconUrl: app.iconUrl,
+            selectedIcon: app.selectedIcon,
+            displayOrder: app.displayOrder,
+            isActive: app.isActive,
+        }));
+    }
+    catch (error) {
+        console.error('[APP-PERMISSIONS] Error getting user apps:', error);
+        return [];
+    }
+}
+//# sourceMappingURL=app-permissions.js.map

package/dist/lib/deploy/app-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-permissions.js","sourceRoot":"","sources":["../../../src/lib/deploy/app-permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,qBAAqB,EACrB,0BAA0B,GAE3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,+BAA+B,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEvG;;;;;;GAMG;AACH,SAAS,uBAAuB,CAAC,UAAkB;IACjD,OAAO;QACL,WAAW,EAAE,UAAU;QACvB,GAAG,eAAe,EAAE;KACrB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,KAAa,EAAE,WAAoB;IACpF,IAAI,CAAC;QACH,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,+BAA+B,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACnF,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,eAAe,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAE1E,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,OAAO,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAC;QACrD,OAAO,MAAM,qBAAqB,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,8CAA8C,EAAE,KAAK,CAAC,CAAC;QACrE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAc,EAAE,WAAoB;IACpE,IAAI,CAAC;QACH,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,OAAO,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,gBAAgB,GAAG,MAAM,0BAA0B,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAElF,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,+BAA+B,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACnF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAChD,OAAO,CAAC,MAAM,iBAAiB,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;aAC1D,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;aAC1D,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACb,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,QAAQ,EAAE,GAAG,CAAC,QAAQ;SACvB,CAAC,CAAC,CAAC;IACR,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,4CAA4C,EAAE,KAAK,CAAC,CAAC;QACnE,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/lib/deploy/app-utils.d.ts

@@ -0,0 +1,22 @@
+/**
+ * App utility functions
+ */
+export declare const BUILT_IN_APPS: string[];
+/**
+ * Check if an app is a built-in app (Video Generator, AI Chat, Document Manager)
+ */
+export declare function isBuiltInApp(appName: string): boolean;
+/**
+ * Check if an app is a library app
+ */
+export declare function isLibraryApp(appName: string): boolean;
+/**
+ * Check if an app can connect to GitHub
+ * Built-in apps cannot connect to GitHub
+ */
+export declare function canConnectToGitHub(appName: string): boolean;
+/**
+ * Get display label for app type
+ */
+export declare function getAppTypeLabel(type: 'BUILT_IN' | 'LIBRARY' | 'EXTERNAL'): string;
+//# sourceMappingURL=app-utils.d.ts.map

package/dist/lib/deploy/app-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-utils.d.ts","sourceRoot":"","sources":["../../../src/lib/deploy/app-utils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,eAAO,MAAM,aAAa,UAAqD,CAAC;AAEhF;;GAEG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,MAAM,CAIjF"}

package/dist/lib/deploy/app-utils.js

@@ -0,0 +1,36 @@
+/**
+ * App utility functions
+ */
+import { APP_LIBRARY } from './app-library';
+// Built-in apps that cannot connect to GitHub or be modified in certain ways
+export const BUILT_IN_APPS = ['Video Generator', 'AI Chat', 'Document Manager'];
+/**
+ * Check if an app is a built-in app (Video Generator, AI Chat, Document Manager)
+ */
+export function isBuiltInApp(appName) {
+    return BUILT_IN_APPS.includes(appName);
+}
+/**
+ * Check if an app is a library app
+ */
+export function isLibraryApp(appName) {
+    return APP_LIBRARY.some(app => app.name === appName);
+}
+/**
+ * Check if an app can connect to GitHub
+ * Built-in apps cannot connect to GitHub
+ */
+export function canConnectToGitHub(appName) {
+    return !isBuiltInApp(appName);
+}
+/**
+ * Get display label for app type
+ */
+export function getAppTypeLabel(type) {
+    if (type === 'BUILT_IN')
+        return 'Built-in';
+    if (type === 'LIBRARY')
+        return 'Library';
+    return 'External';
+}
+//# sourceMappingURL=app-utils.js.map

package/dist/lib/deploy/app-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-utils.js","sourceRoot":"","sources":["../../../src/lib/deploy/app-utils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE5C,6EAA6E;AAC7E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,iBAAiB,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC;AAEhF;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACzC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,IAAyC;IACvE,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,UAAU,CAAC;IAC3C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/lib/deploy/client.d.ts

@@ -0,0 +1,141 @@
+/**
+ * Deploy-API Client
+ *
+ * Server-side client for calling the deploy-api's deployment management endpoints.
+ * Handles token exchange and typed HTTP requests.
+ */
+/**
+ * Get a deploy-api scoped token via Zero Trust exchange.
+ */
+export declare function getDeployApiToken(userId: string, sessionJwt: string): Promise<string>;
+export declare function getGitHubAuthUrl(token: string): Promise<{
+    auth_url: string;
+}>;
+export declare function submitGitHubCallback(token: string, code: string, state?: string): Promise<{
+    success: boolean;
+    connection: any;
+}>;
+export declare function getGitHubStatus(token: string): Promise<{
+    connected: boolean;
+    expired?: boolean;
+    username?: string;
+    scopes?: string[];
+    connectedAt?: string;
+}>;
+export declare function disconnectGitHub(token: string): Promise<{
+    success: boolean;
+}>;
+export declare function reconnectGitHub(token: string): Promise<{
+    success: boolean;
+    message: string;
+    authUrl: string;
+}>;
+export declare function verifyGitHubRepo(token: string, githubRepoOwner: string, githubRepoName: string): Promise<{
+    verified: boolean;
+    repository?: any;
+    error?: string;
+}>;
+export declare function listDeploymentConfigs(token: string): Promise<{
+    configs: any[];
+}>;
+export declare function createDeploymentConfig(token: string, data: {
+    app_id: string;
+    github_repo_owner: string;
+    github_repo_name: string;
+    github_branch?: string;
+    deploy_path: string;
+    port: number;
+    health_endpoint?: string;
+    build_command?: string;
+    start_command?: string;
+    auto_deploy_enabled?: boolean;
+    staging_enabled?: boolean;
+    staging_port?: number;
+    staging_path?: string;
+}): Promise<{
+    config: any;
+}>;
+export declare function getDeploymentConfig(token: string, configId: string): Promise<{
+    config: any;
+}>;
+export declare function updateDeploymentConfig(token: string, configId: string, data: Record<string, any>): Promise<{
+    config: any;
+}>;
+export declare function deleteDeploymentConfig(token: string, configId: string): Promise<{
+    success: boolean;
+}>;
+export declare function getNextPort(token: string): Promise<{
+    port: number;
+}>;
+export declare function createDeployment(token: string, data: {
+    deployment_config_id: string;
+    deployed_by: string;
+    environment?: string;
+    deployment_type?: string;
+    release_tag?: string;
+    release_id?: string;
+    commit_sha?: string;
+    previous_deployment_id?: string;
+    is_rollback?: boolean;
+}): Promise<{
+    deployment: any;
+}>;
+export declare function getDeployment(token: string, deploymentId: string): Promise<{
+    deployment: any;
+}>;
+export declare function updateDeployment(token: string, deploymentId: string, data: Record<string, any>): Promise<{
+    deployment: any;
+}>;
+export declare function rollbackDeployment(token: string, deploymentId: string): Promise<{
+    deployment: any;
+}>;
+export declare function listSecrets(token: string, configId: string): Promise<{
+    secrets: any[];
+}>;
+export declare function upsertSecret(token: string, configId: string, data: {
+    key: string;
+    value: string;
+    type?: string;
+    description?: string;
+}): Promise<{
+    secret: any;
+}>;
+export declare function deleteSecret(token: string, secretId: string): Promise<{
+    success: boolean;
+}>;
+export declare function listReleases(token: string, configId: string): Promise<{
+    releases: any[];
+}>;
+export declare function syncReleases(token: string, configId: string): Promise<{
+    success: boolean;
+    count: number;
+    releases: any[];
+}>;
+export { type ConfigValue, type ConfigSetRequest, type ConfigListResponse, listConfigs, getConfig, getConfigRaw, setConfig, deleteConfig, bulkSetConfigs, loadConfigCategoryRaw, } from '../config/client';
+/**
+ * Trigger a bridge service restart via deploy-api.
+ *
+ * Docker: reads SMTP config from the config store, exports as compose env
+ * vars, and recreates the bridge-api container via `docker compose up -d`.
+ *
+ * Proxmox: SSHs to the host and runs `make bridge` which re-renders
+ * bridge.env.j2 from vault values and restarts the systemd service.
+ */
+export declare function triggerBridgeRestart(token: string): Promise<{
+    success: boolean;
+    message: string;
+}>;
+export declare function getAppDatabase(token: string, configId: string): Promise<{
+    database: any;
+}>;
+export declare function provisionAppDatabase(token: string, configId: string, data: {
+    database_name: string;
+    database_user: string;
+    password: string;
+}): Promise<{
+    database: any;
+}>;
+export declare function deleteAppDatabase(token: string, configId: string): Promise<{
+    success: boolean;
+}>;
+//# sourceMappingURL=client.d.ts.map

package/dist/lib/deploy/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/lib/deploy/client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CAYjB;AA2CD,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM;cACd,MAAM;GAC3C;AAED,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM;aACjD,OAAO;gBAAc,GAAG;GAG5D;AAED,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM;eAEpC,OAAO;cACR,OAAO;eACN,MAAM;aACR,MAAM,EAAE;kBACH,MAAM;GAEvB;AAED,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM;aACf,OAAO;GAC3C;AAED,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM;aACd,OAAO;aAAW,MAAM;aAAW,MAAM;GAG7E;AAED,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,MAAM,EACb,eAAe,EAAE,MAAM,EACvB,cAAc,EAAE,MAAM;cAGV,OAAO;iBACJ,GAAG;YACR,MAAM;GAKjB;AAMD,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,MAAM;aACpB,GAAG,EAAE;GACzC;AAED,wBAAsB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;YACmC,GAAG;GACtC;AAED,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;YACrC,GAAG;GACtC;AAED,wBAAsB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;YACnE,GAAG;GACtC;AAED,wBAAsB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;aACvC,OAAO;GAC3C;AAED,wBAAsB,WAAW,CAAC,KAAK,EAAE,MAAM;UACb,MAAM;GACvC;AAMD,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE;IAC1D,oBAAoB,EAAE,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;gBACuC,GAAG;GAC1C;AAED,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM;gBAC/B,GAAG;GAC1C;AAED,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;gBAC7D,GAAG;GAC1C;AAED,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM;gBACpC,GAAG;GAC1C;AAMD,wBAAsB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;aAC5B,GAAG,EAAE;GACzC;AAED,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE;IACxE,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;YACmC,GAAG;GACtC;AAED,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;aAC7B,OAAO;GAC3C;AAMD,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;cAC5B,GAAG,EAAE;GAC1C;AAED,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;aAC7B,OAAO;WAAS,MAAM;cAAY,GAAG,EAAE;GAG3E;AAQD,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,WAAW,EACX,SAAS,EACT,YAAY,EACZ,SAAS,EACT,YAAY,EACZ,cAAc,EACd,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAM1B;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,MAAM;aACnB,OAAO;aAAW,MAAM;GAG5D;AAMD,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;cAC9B,GAAG;GACxC;AAED,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE;IAChF,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;CAClB;cACqC,GAAG;GACxC;AAED,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;aAClC,OAAO;GAC3C"}

package/dist/lib/deploy/client.js

@@ -0,0 +1,170 @@
+/**
+ * Deploy-API Client
+ *
+ * Server-side client for calling the deploy-api's deployment management endpoints.
+ * Handles token exchange and typed HTTP requests.
+ */
+import { exchangeWithSubjectToken } from '../authz/next-client';
+import { getDeployApiUrl } from '../next/api-url';
+// ============================================================================
+// Token exchange
+// ============================================================================
+/**
+ * Get a deploy-api scoped token via Zero Trust exchange.
+ */
+export async function getDeployApiToken(userId, sessionJwt) {
+    const result = await exchangeWithSubjectToken({
+        sessionJwt,
+        userId,
+        audience: 'deploy-api',
+        scopes: ['admin', 'deploy:write'],
+        purpose: 'deploy-api-management',
+    });
+    if (!result.accessToken) {
+        throw new Error('Failed to obtain deploy-api token');
+    }
+    return result.accessToken;
+}
+// ============================================================================
+// Generic request helper
+// ============================================================================
+async function deployApiRequest(token, method, path, body) {
+    const url = `${getDeployApiUrl()}${path}`;
+    const headers = {
+        Authorization: `Bearer ${token}`,
+        'Content-Type': 'application/json',
+    };
+    const resp = await fetch(url, {
+        method,
+        headers,
+        body: body ? JSON.stringify(body) : undefined,
+    });
+    if (!resp.ok) {
+        const text = await resp.text().catch(() => '');
+        let detail = text;
+        try {
+            const json = JSON.parse(text);
+            detail = json.detail || json.error || text;
+        }
+        catch { /* use raw text */ }
+        const err = new Error(`deploy-api ${method} ${path} failed: ${resp.status} ${detail}`);
+        err.status = resp.status;
+        throw err;
+    }
+    return resp.json();
+}
+// ============================================================================
+// GitHub connection endpoints
+// ============================================================================
+export async function getGitHubAuthUrl(token) {
+    return deployApiRequest(token, 'GET', '/api/v1/github/auth-url');
+}
+export async function submitGitHubCallback(token, code, state) {
+    return deployApiRequest(token, 'POST', '/api/v1/github/callback', { code, state });
+}
+export async function getGitHubStatus(token) {
+    return deployApiRequest(token, 'GET', '/api/v1/github/status');
+}
+export async function disconnectGitHub(token) {
+    return deployApiRequest(token, 'DELETE', '/api/v1/github/disconnect');
+}
+export async function reconnectGitHub(token) {
+    return deployApiRequest(token, 'POST', '/api/v1/github/reconnect');
+}
+export async function verifyGitHubRepo(token, githubRepoOwner, githubRepoName) {
+    return deployApiRequest(token, 'POST', '/api/v1/github/verify-repo', {
+        github_repo_owner: githubRepoOwner,
+        github_repo_name: githubRepoName,
+    });
+}
+// ============================================================================
+// Deployment config endpoints
+// ============================================================================
+export async function listDeploymentConfigs(token) {
+    return deployApiRequest(token, 'GET', '/api/v1/deployment-configs');
+}
+export async function createDeploymentConfig(token, data) {
+    return deployApiRequest(token, 'POST', '/api/v1/deployment-configs', data);
+}
+export async function getDeploymentConfig(token, configId) {
+    return deployApiRequest(token, 'GET', `/api/v1/deployment-configs/${configId}`);
+}
+export async function updateDeploymentConfig(token, configId, data) {
+    return deployApiRequest(token, 'PATCH', `/api/v1/deployment-configs/${configId}`, data);
+}
+export async function deleteDeploymentConfig(token, configId) {
+    return deployApiRequest(token, 'DELETE', `/api/v1/deployment-configs/${configId}`);
+}
+export async function getNextPort(token) {
+    return deployApiRequest(token, 'GET', '/api/v1/deployment-configs/helpers/next-port');
+}
+// ============================================================================
+// Deployment history endpoints
+// ============================================================================
+export async function createDeployment(token, data) {
+    return deployApiRequest(token, 'POST', '/api/v1/deployments', data);
+}
+export async function getDeployment(token, deploymentId) {
+    return deployApiRequest(token, 'GET', `/api/v1/deployments/${deploymentId}`);
+}
+export async function updateDeployment(token, deploymentId, data) {
+    return deployApiRequest(token, 'PATCH', `/api/v1/deployments/${deploymentId}`, data);
+}
+export async function rollbackDeployment(token, deploymentId) {
+    return deployApiRequest(token, 'POST', `/api/v1/deployments/${deploymentId}/rollback`);
+}
+// ============================================================================
+// Secrets endpoints
+// ============================================================================
+export async function listSecrets(token, configId) {
+    return deployApiRequest(token, 'GET', `/api/v1/deployment-configs/${configId}/secrets`);
+}
+export async function upsertSecret(token, configId, data) {
+    return deployApiRequest(token, 'POST', `/api/v1/deployment-configs/${configId}/secrets`, data);
+}
+export async function deleteSecret(token, secretId) {
+    return deployApiRequest(token, 'DELETE', `/api/v1/secrets/${secretId}`);
+}
+// ============================================================================
+// Release endpoints
+// ============================================================================
+export async function listReleases(token, configId) {
+    return deployApiRequest(token, 'GET', `/api/v1/deployment-configs/${configId}/releases`);
+}
+export async function syncReleases(token, configId) {
+    return deployApiRequest(token, 'POST', `/api/v1/deployment-configs/${configId}/releases/sync`);
+}
+// ============================================================================
+// Config store — re-exported from config-api client
+// ============================================================================
+// Config operations have moved to the dedicated config-api service.
+// These re-exports maintain backward compatibility for existing callers.
+export { listConfigs, getConfig, getConfigRaw, setConfig, deleteConfig, bulkSetConfigs, loadConfigCategoryRaw, } from '../config/client';
+// ============================================================================
+// Service management (restart / apply config)
+// ============================================================================
+/**
+ * Trigger a bridge service restart via deploy-api.
+ *
+ * Docker: reads SMTP config from the config store, exports as compose env
+ * vars, and recreates the bridge-api container via `docker compose up -d`.
+ *
+ * Proxmox: SSHs to the host and runs `make bridge` which re-renders
+ * bridge.env.j2 from vault values and restarts the systemd service.
+ */
+export async function triggerBridgeRestart(token) {
+    return deployApiRequest(token, 'POST', '/api/v1/config/apply/bridge');
+}
+// ============================================================================
+// App database endpoints
+// ============================================================================
+export async function getAppDatabase(token, configId) {
+    return deployApiRequest(token, 'GET', `/api/v1/deployment-configs/${configId}/database`);
+}
+export async function provisionAppDatabase(token, configId, data) {
+    return deployApiRequest(token, 'POST', `/api/v1/deployment-configs/${configId}/database`, data);
+}
+export async function deleteAppDatabase(token, configId) {
+    return deployApiRequest(token, 'DELETE', `/api/v1/deployment-configs/${configId}/database`);
+}
+//# sourceMappingURL=client.js.map

package/dist/lib/deploy/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/lib/deploy/client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,wBAAwB,EAAsB,MAAM,sBAAsB,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,+EAA+E;AAC/E,iBAAiB;AACjB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAc,EACd,UAAkB;IAElB,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC;QAC5C,UAAU;QACV,MAAM;QACN,QAAQ,EAAE,YAA6B;QACvC,MAAM,EAAE,CAAC,OAAO,EAAE,cAAc,CAAC;QACjC,OAAO,EAAE,uBAAuB;KACjC,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CAAC;AAC5B,CAAC;AAED,+EAA+E;AAC/E,yBAAyB;AACzB,+EAA+E;AAE/E,KAAK,UAAU,gBAAgB,CAC7B,KAAa,EACb,MAAc,EACd,IAAY,EACZ,IAAc;IAEd,MAAM,GAAG,GAAG,GAAG,eAAe,EAAE,GAAG,IAAI,EAAE,CAAC;IAC1C,MAAM,OAAO,GAA2B;QACtC,aAAa,EAAE,UAAU,KAAK,EAAE;QAChC,cAAc,EAAE,kBAAkB;KACnC,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC5B,MAAM;QACN,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;KAC9C,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/C,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC9B,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,cAAc,MAAM,IAAI,IAAI,YAAY,IAAI,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC,CAAC;QACtF,GAAW,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAClC,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;AACrB,CAAC;AAED,+EAA+E;AAC/E,8BAA8B;AAC9B,+EAA+E;AAE/E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAa;IAClD,OAAO,gBAAgB,CAAuB,KAAK,EAAE,KAAK,EAAE,yBAAyB,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAAa,EAAE,IAAY,EAAE,KAAc;IACpF,OAAO,gBAAgB,CACrB,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAC1D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa;IACjD,OAAO,gBAAgB,CAMpB,KAAK,EAAE,KAAK,EAAE,uBAAuB,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAa;IAClD,OAAO,gBAAgB,CAAuB,KAAK,EAAE,QAAQ,EAAE,2BAA2B,CAAC,CAAC;AAC9F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa;IACjD,OAAO,gBAAgB,CACrB,KAAK,EAAE,MAAM,EAAE,0BAA0B,CAC1C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAa,EACb,eAAuB,EACvB,cAAsB;IAEtB,OAAO,gBAAgB,CAIpB,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE;QAC9C,iBAAiB,EAAE,eAAe;QAClC,gBAAgB,EAAE,cAAc;KACjC,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAC/E,8BAA8B;AAC9B,+EAA+E;AAE/E,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAAa;IACvD,OAAO,gBAAgB,CAAqB,KAAK,EAAE,KAAK,EAAE,4BAA4B,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAAa,EAAE,IAc3D;IACC,OAAO,gBAAgB,CAAkB,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,IAAI,CAAC,CAAC;AAC9F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAa,EAAE,QAAgB;IACvE,OAAO,gBAAgB,CAAkB,KAAK,EAAE,KAAK,EAAE,8BAA8B,QAAQ,EAAE,CAAC,CAAC;AACnG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAAa,EAAE,QAAgB,EAAE,IAAyB;IACrG,OAAO,gBAAgB,CAAkB,KAAK,EAAE,OAAO,EAAE,8BAA8B,QAAQ,EAAE,EAAE,IAAI,CAAC,CAAC;AAC3G,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAAa,EAAE,QAAgB;IAC1E,OAAO,gBAAgB,CAAuB,KAAK,EAAE,QAAQ,EAAE,8BAA8B,QAAQ,EAAE,CAAC,CAAC;AAC3G,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAa;IAC7C,OAAO,gBAAgB,CAAmB,KAAK,EAAE,KAAK,EAAE,8CAA8C,CAAC,CAAC;AAC1G,CAAC;AAED,+EAA+E;AAC/E,+BAA+B;AAC/B,+EAA+E;AAE/E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAa,EAAE,IAUrD;IACC,OAAO,gBAAgB,CAAsB,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,IAAI,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAa,EAAE,YAAoB;IACrE,OAAO,gBAAgB,CAAsB,KAAK,EAAE,KAAK,EAAE,uBAAuB,YAAY,EAAE,CAAC,CAAC;AACpG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAa,EAAE,YAAoB,EAAE,IAAyB;IACnG,OAAO,gBAAgB,CAAsB,KAAK,EAAE,OAAO,EAAE,uBAAuB,YAAY,EAAE,EAAE,IAAI,CAAC,CAAC;AAC5G,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAa,EAAE,YAAoB;IAC1E,OAAO,gBAAgB,CAAsB,KAAK,EAAE,MAAM,EAAE,uBAAuB,YAAY,WAAW,CAAC,CAAC;AAC9G,CAAC;AAED,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAa,EAAE,QAAgB;IAC/D,OAAO,gBAAgB,CAAqB,KAAK,EAAE,KAAK,EAAE,8BAA8B,QAAQ,UAAU,CAAC,CAAC;AAC9G,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAa,EAAE,QAAgB,EAAE,IAKnE;IACC,OAAO,gBAAgB,CAAkB,KAAK,EAAE,MAAM,EAAE,8BAA8B,QAAQ,UAAU,EAAE,IAAI,CAAC,CAAC;AAClH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAa,EAAE,QAAgB;IAChE,OAAO,gBAAgB,CAAuB,KAAK,EAAE,QAAQ,EAAE,mBAAmB,QAAQ,EAAE,CAAC,CAAC;AAChG,CAAC;AAED,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAa,EAAE,QAAgB;IAChE,OAAO,gBAAgB,CAAsB,KAAK,EAAE,KAAK,EAAE,8BAA8B,QAAQ,WAAW,CAAC,CAAC;AAChH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAa,EAAE,QAAgB;IAChE,OAAO,gBAAgB,CACrB,KAAK,EAAE,MAAM,EAAE,8BAA8B,QAAQ,gBAAgB,CACtE,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,oDAAoD;AACpD,+EAA+E;AAC/E,oEAAoE;AACpE,yEAAyE;AAEzE,OAAO,EAIL,WAAW,EACX,SAAS,EACT,YAAY,EACZ,SAAS,EACT,YAAY,EACZ,cAAc,EACd,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAE1B,+EAA+E;AAC/E,8CAA8C;AAC9C,+EAA+E;AAE/E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAAa;IACtD,OAAO,gBAAgB,CACrB,KAAK,EAAE,MAAM,EAAE,6BAA6B,CAC7C,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,yBAAyB;AACzB,+EAA+E;AAE/E,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAa,EAAE,QAAgB;IAClE,OAAO,gBAAgB,CAAoB,KAAK,EAAE,KAAK,EAAE,8BAA8B,QAAQ,WAAW,CAAC,CAAC;AAC9G,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAAa,EAAE,QAAgB,EAAE,IAI3E;IACC,OAAO,gBAAgB,CAAoB,KAAK,EAAE,MAAM,EAAE,8BAA8B,QAAQ,WAAW,EAAE,IAAI,CAAC,CAAC;AACrH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAa,EAAE,QAAgB;IACrE,OAAO,gBAAgB,CAAuB,KAAK,EAAE,QAAQ,EAAE,8BAA8B,QAAQ,WAAW,CAAC,CAAC;AACpH,CAAC"}

package/dist/lib/deploy/default-apps.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Seeded app defaults used when App table is unavailable.
+ *
+ * This mirrors the bootstrap entries from prisma/seed.ts so admin routes can
+ * still operate in environments where Prisma app tables are intentionally absent.
+ */
+export type SeededAppType = 'BUILT_IN' | 'LIBRARY' | 'EXTERNAL';
+export type SeededAppRecord = {
+    id: string;
+    name: string;
+    description: string | null;
+    type: SeededAppType;
+    url: string | null;
+    deployedPath: string | null;
+    iconUrl: string | null;
+    selectedIcon: string | null;
+    displayOrder: number;
+    isActive: boolean;
+    healthEndpoint: string | null;
+    createdAt: Date;
+    updatedAt: Date;
+    lastDeploymentStatus: string | null;
+    lastDeploymentEndedAt: Date | null;
+    deployedVersion: string | null;
+    latestVersion: string | null;
+    updateAvailable: boolean;
+    devMode: boolean;
+};
+export declare function getSeededApps(): SeededAppRecord[];
+export declare function getSeededAppIds(): string[];
+//# sourceMappingURL=default-apps.d.ts.map

package/dist/lib/deploy/default-apps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-apps.d.ts","sourceRoot":"","sources":["../../../src/lib/deploy/default-apps.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,CAAC;AAEhE,MAAM,MAAM,eAAe,GAAG;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,IAAI,EAAE,aAAa,CAAC;IACpB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,OAAO,CAAC;IAClB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,qBAAqB,EAAE,IAAI,GAAG,IAAI,CAAC;IACnC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,eAAe,EAAE,OAAO,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAqIF,wBAAgB,aAAa,IAAI,eAAe,EAAE,CAEjD;AAED,wBAAgB,eAAe,IAAI,MAAM,EAAE,CAE1C"}