@jingyi0605/codingns 0.1.0

package/dist/server/modules/auth/auth-service.js

@@ -0,0 +1,151 @@
+import { AppError } from "../../shared/errors/app-error.js";
+import { hashToken, verifyPassword } from "../../shared/utils/hash.js";
+import { createId } from "../../shared/utils/id.js";
+import { addSeconds, nowIso } from "../../shared/utils/time.js";
+import { createOpaqueToken } from "../../shared/utils/tokens.js";
+export class AuthService {
+    bootstrapStateRepository;
+    authUserRepository;
+    authTokenRepository;
+    config;
+    constructor(bootstrapStateRepository, authUserRepository, authTokenRepository, config) {
+        this.bootstrapStateRepository = bootstrapStateRepository;
+        this.authUserRepository = authUserRepository;
+        this.authTokenRepository = authTokenRepository;
+        this.config = config;
+    }
+    login(input) {
+        this.ensureInitialized();
+        const user = this.authUserRepository.findByUsername(input.username.trim());
+        if (!user || !verifyPassword(input.password, user.passwordHash)) {
+            throw new AppError({
+                statusCode: 401,
+                errorCode: "INVALID_CREDENTIALS",
+                detail: "用户名或密码错误"
+            });
+        }
+        return {
+            ...this.issueTokenPair(user.id),
+            user: {
+                userId: user.id,
+                username: user.username,
+                role: user.role
+            }
+        };
+    }
+    refresh(input) {
+        this.ensureInitialized();
+        const refreshTokenHash = hashToken(input.refreshToken);
+        const refreshRecord = this.authTokenRepository.findByHash(refreshTokenHash, "refresh");
+        if (!refreshRecord || refreshRecord.revokedAt) {
+            throw new AppError({
+                statusCode: 401,
+                errorCode: "TOKEN_INVALID",
+                detail: "refresh token 无效"
+            });
+        }
+        if (new Date(refreshRecord.expiresAt).getTime() <= Date.now()) {
+            throw new AppError({
+                statusCode: 401,
+                errorCode: "TOKEN_EXPIRED",
+                detail: "refresh token 已过期"
+            });
+        }
+        const user = this.authUserRepository.findById(refreshRecord.userId);
+        if (!user) {
+            throw new AppError({
+                statusCode: 401,
+                errorCode: "UNAUTHORIZED",
+                detail: "当前用户不存在"
+            });
+        }
+        // Note: Refresh token is not revoked to allow long-term sessions
+        // In a production environment, you may want to implement token rotation
+        // this.authTokenRepository.revokeByHash(refreshTokenHash, nowIso());
+        return {
+            ...this.issueTokenPair(user.id),
+            user: {
+                userId: user.id,
+                username: user.username,
+                role: user.role
+            }
+        };
+    }
+    logout(accessToken, input) {
+        const revokedAt = nowIso();
+        this.authTokenRepository.revokeByHash(hashToken(accessToken), revokedAt);
+        if (input?.refreshToken) {
+            this.authTokenRepository.revokeByHash(hashToken(input.refreshToken), revokedAt);
+        }
+        return { success: true };
+    }
+    authenticateAccessToken(accessToken) {
+        const accessRecord = this.authTokenRepository.findByHash(hashToken(accessToken), "access");
+        if (!accessRecord || accessRecord.revokedAt) {
+            throw new AppError({
+                statusCode: 401,
+                errorCode: "UNAUTHORIZED",
+                detail: "access token 无效"
+            });
+        }
+        if (new Date(accessRecord.expiresAt).getTime() <= Date.now()) {
+            throw new AppError({
+                statusCode: 401,
+                errorCode: "TOKEN_EXPIRED",
+                detail: "access token 已过期"
+            });
+        }
+        const user = this.authUserRepository.findById(accessRecord.userId);
+        if (!user) {
+            throw new AppError({
+                statusCode: 401,
+                errorCode: "UNAUTHORIZED",
+                detail: "当前用户不存在"
+            });
+        }
+        return {
+            userId: user.id,
+            username: user.username,
+            role: user.role
+        };
+    }
+    ensureInitialized() {
+        if (!this.bootstrapStateRepository.getState().initialized) {
+            throw new AppError({
+                statusCode: 403,
+                errorCode: "BOOTSTRAP_REQUIRED",
+                detail: "系统尚未初始化，请先完成 setup"
+            });
+        }
+    }
+    issueTokenPair(userId) {
+        const now = new Date();
+        const createdAt = nowIso(now);
+        const accessToken = createOpaqueToken();
+        const refreshToken = createOpaqueToken();
+        this.authTokenRepository.create({
+            id: createId(),
+            userId,
+            tokenType: "access",
+            tokenHash: hashToken(accessToken),
+            expiresAt: addSeconds(now, this.config.accessTokenTtlSeconds),
+            revokedAt: null,
+            createdAt
+        });
+        this.authTokenRepository.create({
+            id: createId(),
+            userId,
+            tokenType: "refresh",
+            tokenHash: hashToken(refreshToken),
+            expiresAt: addSeconds(now, this.config.refreshTokenTtlSeconds),
+            revokedAt: null,
+            createdAt
+        });
+        return {
+            accessToken,
+            refreshToken,
+            expiresIn: this.config.accessTokenTtlSeconds
+        };
+    }
+}
+//# sourceMappingURL=auth-service.js.map

package/dist/server/modules/auth/auth-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-service.js","sourceRoot":"","sources":["../../../../src/modules/auth/auth-service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAoCjE,MAAM,OAAO,WAAW;IAEH;IACA;IACA;IACA;IAJnB,YACmB,wBAAkD,EAClD,kBAAsC,EACtC,mBAAwC,EACxC,MAAkB;QAHlB,6BAAwB,GAAxB,wBAAwB,CAA0B;QAClD,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,WAAM,GAAN,MAAM,CAAY;IAClC,CAAC;IAEJ,KAAK,CAAC,KAAiB;QACrB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAE3E,IAAI,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,QAAQ,CAAC;gBACjB,UAAU,EAAE,GAAG;gBACf,SAAS,EAAE,qBAAqB;gBAChC,MAAM,EAAE,UAAU;aACnB,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,IAAI,EAAE;gBACJ,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB;SACF,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,KAAmB;QACzB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,MAAM,gBAAgB,GAAG,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACvD,MAAM,aAAa,GAAG,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;QAEvF,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,SAAS,EAAE,CAAC;YAC9C,MAAM,IAAI,QAAQ,CAAC;gBACjB,UAAU,EAAE,GAAG;gBACf,SAAS,EAAE,eAAe;gBAC1B,MAAM,EAAE,kBAAkB;aAC3B,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC9D,MAAM,IAAI,QAAQ,CAAC;gBACjB,UAAU,EAAE,GAAG;gBACf,SAAS,EAAE,eAAe;gBAC1B,MAAM,EAAE,mBAAmB;aAC5B,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAEpE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,QAAQ,CAAC;gBACjB,UAAU,EAAE,GAAG;gBACf,SAAS,EAAE,cAAc;gBACzB,MAAM,EAAE,SAAS;aAClB,CAAC,CAAC;QACL,CAAC;QAED,iEAAiE;QACjE,wEAAwE;QACxE,qEAAqE;QAErE,OAAO;YACL,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,IAAI,EAAE;gBACJ,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB;SACF,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,WAAmB,EAAE,KAAmB;QAC7C,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC;QAE3B,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC,CAAC;QAEzE,IAAI,KAAK,EAAE,YAAY,EAAE,CAAC;YACxB,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,SAAS,CAAC,CAAC;QAClF,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,uBAAuB,CAAC,WAAmB;QACzC,MAAM,YAAY,GAAG,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,CAAC;QAE3F,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC;YAC5C,MAAM,IAAI,QAAQ,CAAC;gBACjB,UAAU,EAAE,GAAG;gBACf,SAAS,EAAE,cAAc;gBACzB,MAAM,EAAE,iBAAiB;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC7D,MAAM,IAAI,QAAQ,CAAC;gBACjB,UAAU,EAAE,GAAG;gBACf,SAAS,EAAE,eAAe;gBAC1B,MAAM,EAAE,kBAAkB;aAC3B,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAEnE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,QAAQ,CAAC;gBACjB,UAAU,EAAE,GAAG;gBACf,SAAS,EAAE,cAAc;gBACzB,MAAM,EAAE,SAAS;aAClB,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;IACJ,CAAC;IAED,iBAAiB;QACf,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC;YAC1D,MAAM,IAAI,QAAQ,CAAC;gBACjB,UAAU,EAAE,GAAG;gBACf,SAAS,EAAE,oBAAoB;gBAC/B,MAAM,EAAE,oBAAoB;aAC7B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,MAAc;QACnC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,WAAW,GAAG,iBAAiB,EAAE,CAAC;QACxC,MAAM,YAAY,GAAG,iBAAiB,EAAE,CAAC;QAEzC,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC;YAC9B,EAAE,EAAE,QAAQ,EAAE;YACd,MAAM;YACN,SAAS,EAAE,QAAQ;YACnB,SAAS,EAAE,SAAS,CAAC,WAAW,CAAC;YACjC,SAAS,EAAE,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC;YAC7D,SAAS,EAAE,IAAI;YACf,SAAS;SACV,CAAC,CAAC;QAEH,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC;YAC9B,EAAE,EAAE,QAAQ,EAAE;YACd,MAAM;YACN,SAAS,EAAE,SAAS;YACpB,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC;YAClC,SAAS,EAAE,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC;YAC9D,SAAS,EAAE,IAAI;YACf,SAAS;SACV,CAAC,CAAC;QAEH,OAAO;YACL,WAAW;YACX,YAAY;YACZ,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,qBAAqB;SAC7C,CAAC;IACJ,CAAC;CACF"}

package/dist/server/modules/bootstrap/bootstrap-controller.d.ts

@@ -0,0 +1,10 @@
+import type { FastifyReply, FastifyRequest } from "fastify";
+import type { BootstrapService, SetupInput } from "./bootstrap-service.js";
+export declare class BootstrapController {
+    private readonly bootstrapService;
+    constructor(bootstrapService: BootstrapService);
+    readonly getStatus: (_request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+    readonly setup: (request: FastifyRequest<{
+        Body: SetupInput;
+    }>, reply: FastifyReply) => Promise<void>;
+}

package/dist/server/modules/bootstrap/bootstrap-controller.js

@@ -0,0 +1,13 @@
+export class BootstrapController {
+    bootstrapService;
+    constructor(bootstrapService) {
+        this.bootstrapService = bootstrapService;
+    }
+    getStatus = async (_request, reply) => {
+        reply.send(this.bootstrapService.getStatus());
+    };
+    setup = async (request, reply) => {
+        reply.status(201).send(this.bootstrapService.setup(request.body));
+    };
+}
+//# sourceMappingURL=bootstrap-controller.js.map

package/dist/server/modules/bootstrap/bootstrap-controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap-controller.js","sourceRoot":"","sources":["../../../../src/modules/bootstrap/bootstrap-controller.ts"],"names":[],"mappings":"AAIA,MAAM,OAAO,mBAAmB;IACD;IAA7B,YAA6B,gBAAkC;QAAlC,qBAAgB,GAAhB,gBAAgB,CAAkB;IAAG,CAAC;IAE1D,SAAS,GAAG,KAAK,EAAE,QAAwB,EAAE,KAAmB,EAAiB,EAAE;QAC1F,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC;IAEO,KAAK,GAAG,KAAK,EACpB,OAA6C,EAC7C,KAAmB,EACJ,EAAE;QACjB,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,CAAC,CAAC;CACH"}

package/dist/server/modules/bootstrap/bootstrap-service.d.ts

@@ -0,0 +1,20 @@
+import type Database from "better-sqlite3";
+import type { BootstrapStateRepository } from "../../storage/repositories/bootstrap-state-repository.js";
+import type { AuthUserRepository } from "../../storage/repositories/auth-user-repository.js";
+export interface SetupInput {
+    username: string;
+    password: string;
+}
+export declare class BootstrapService {
+    private readonly db;
+    private readonly bootstrapStateRepository;
+    private readonly authUserRepository;
+    constructor(db: Database.Database, bootstrapStateRepository: BootstrapStateRepository, authUserRepository: AuthUserRepository);
+    getStatus(): {
+        initialized: boolean;
+    };
+    setup(input: SetupInput): {
+        initialized: true;
+        userId: string;
+    };
+}

package/dist/server/modules/bootstrap/bootstrap-service.js

@@ -0,0 +1,71 @@
+import { AppError } from "../../shared/errors/app-error.js";
+import { hashPassword } from "../../shared/utils/hash.js";
+import { createId } from "../../shared/utils/id.js";
+import { nowIso } from "../../shared/utils/time.js";
+export class BootstrapService {
+    db;
+    bootstrapStateRepository;
+    authUserRepository;
+    constructor(db, bootstrapStateRepository, authUserRepository) {
+        this.db = db;
+        this.bootstrapStateRepository = bootstrapStateRepository;
+        this.authUserRepository = authUserRepository;
+    }
+    getStatus() {
+        return { initialized: this.bootstrapStateRepository.getState().initialized };
+    }
+    setup(input) {
+        const normalizedInput = validateSetupInput(input);
+        const state = this.bootstrapStateRepository.getState();
+        if (state.initialized || this.authUserRepository.count() > 0) {
+            throw new AppError({
+                statusCode: 409,
+                errorCode: "BOOTSTRAP_ALREADY_DONE",
+                detail: "系统已经初始化过了，不能重复执行 setup"
+            });
+        }
+        const userId = createId();
+        const timestamp = nowIso();
+        // 初始化只做两次短写入：建首个管理员，标记系统已初始化。
+        const transaction = this.db.transaction(() => {
+            this.authUserRepository.create({
+                id: userId,
+                username: normalizedInput.username,
+                passwordHash: hashPassword(normalizedInput.password),
+                role: "admin",
+                createdAt: timestamp,
+                updatedAt: timestamp
+            });
+            this.bootstrapStateRepository.markInitialized(timestamp, userId);
+        });
+        transaction();
+        return {
+            initialized: true,
+            userId
+        };
+    }
+}
+function validateSetupInput(input) {
+    const normalized = {
+        username: input.username.trim(),
+        password: input.password
+    };
+    if (normalized.username.length < 3 || normalized.username.length > 64) {
+        throw new AppError({
+            statusCode: 400,
+            errorCode: "INVALID_INPUT",
+            detail: "用户名长度必须在 3 到 64 个字符之间",
+            field: "username"
+        });
+    }
+    if (normalized.password.length < 8) {
+        throw new AppError({
+            statusCode: 400,
+            errorCode: "INVALID_INPUT",
+            detail: "密码长度至少为 8 位",
+            field: "password"
+        });
+    }
+    return normalized;
+}
+//# sourceMappingURL=bootstrap-service.js.map

package/dist/server/modules/bootstrap/bootstrap-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap-service.js","sourceRoot":"","sources":["../../../../src/modules/bootstrap/bootstrap-service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AASpD,MAAM,OAAO,gBAAgB;IAER;IACA;IACA;IAHnB,YACmB,EAAqB,EACrB,wBAAkD,EAClD,kBAAsC;QAFtC,OAAE,GAAF,EAAE,CAAmB;QACrB,6BAAwB,GAAxB,wBAAwB,CAA0B;QAClD,uBAAkB,GAAlB,kBAAkB,CAAoB;IACtD,CAAC;IAEJ,SAAS;QACP,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,wBAAwB,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,KAAiB;QACrB,MAAM,eAAe,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,wBAAwB,CAAC,QAAQ,EAAE,CAAC;QAEvD,IAAI,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,QAAQ,CAAC;gBACjB,UAAU,EAAE,GAAG;gBACf,SAAS,EAAE,wBAAwB;gBACnC,MAAM,EAAE,wBAAwB;aACjC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC;QAE3B,8BAA8B;QAC9B,MAAM,WAAW,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;YAC3C,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC;gBAC7B,EAAE,EAAE,MAAM;gBACV,QAAQ,EAAE,eAAe,CAAC,QAAQ;gBAClC,YAAY,EAAE,YAAY,CAAC,eAAe,CAAC,QAAQ,CAAC;gBACpD,IAAI,EAAE,OAAO;gBACb,SAAS,EAAE,SAAS;gBACpB,SAAS,EAAE,SAAS;aACrB,CAAC,CAAC;YAEH,IAAI,CAAC,wBAAwB,CAAC,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;QAEH,WAAW,EAAE,CAAC;QAEd,OAAO;YACL,WAAW,EAAE,IAAI;YACjB,MAAM;SACP,CAAC;IACJ,CAAC;CACF;AAED,SAAS,kBAAkB,CAAC,KAAiB;IAC3C,MAAM,UAAU,GAAG;QACjB,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE;QAC/B,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;IAEF,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACtE,MAAM,IAAI,QAAQ,CAAC;YACjB,UAAU,EAAE,GAAG;YACf,SAAS,EAAE,eAAe;YAC1B,MAAM,EAAE,uBAAuB;YAC/B,KAAK,EAAE,UAAU;SAClB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,QAAQ,CAAC;YACjB,UAAU,EAAE,GAAG;YACf,SAAS,EAAE,eAAe;YAC1B,MAAM,EAAE,aAAa;YACrB,KAAK,EAAE,UAAU;SAClB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/server/modules/client/client-controller.d.ts

@@ -0,0 +1,9 @@
+import type { FastifyReply, FastifyRequest } from "fastify";
+import type { ClientService } from "./client-service.js";
+export declare class ClientController {
+    private readonly clientService;
+    constructor(clientService: ClientService);
+    readonly getRuntimeConfig: (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+    readonly getReleaseManifest: (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+    readonly getServiceUpdate: (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+}

package/dist/server/modules/client/client-controller.js

@@ -0,0 +1,65 @@
+import { AppError } from "../../shared/errors/app-error.js";
+export class ClientController {
+    clientService;
+    constructor(clientService) {
+        this.clientService = clientService;
+    }
+    getRuntimeConfig = async (request, reply) => {
+        if (!request.auth?.user.userId) {
+            throw new AppError({
+                statusCode: 401,
+                errorCode: "UNAUTHORIZED",
+                detail: "当前请求缺少有效登录态"
+            });
+        }
+        const platform = normalizePlatform(request.query);
+        reply.send(this.clientService.getRuntimeConfig(platform, {
+            protocol: readRequestProtocol(request),
+            host: request.headers.host ?? null
+        }));
+    };
+    getReleaseManifest = async (request, reply) => {
+        if (!request.auth?.user.userId) {
+            throw new AppError({
+                statusCode: 401,
+                errorCode: "UNAUTHORIZED",
+                detail: "当前请求缺少有效登录态"
+            });
+        }
+        const query = request.query;
+        if (!query.platform) {
+            throw new AppError({
+                statusCode: 400,
+                errorCode: "INVALID_PLATFORM",
+                detail: "缺少桌面平台标识",
+                field: "platform"
+            });
+        }
+        const channel = query.channel === "beta" ? "beta" : "stable";
+        reply.send(this.clientService.getReleaseManifest(channel, query.platform));
+    };
+    getServiceUpdate = async (request, reply) => {
+        if (!request.auth?.user.userId) {
+            throw new AppError({
+                statusCode: 401,
+                errorCode: "UNAUTHORIZED",
+                detail: "当前请求缺少有效登录态"
+            });
+        }
+        const query = request.query;
+        const channel = query.channel === "beta" ? "beta" : "stable";
+        reply.send(await this.clientService.getServiceUpdate(channel));
+    };
+}
+function readRequestProtocol(request) {
+    const forwarded = request.headers["x-forwarded-proto"];
+    if (typeof forwarded === "string" && forwarded.trim().length > 0) {
+        return forwarded.split(",")[0]?.trim() || "http";
+    }
+    return request.protocol;
+}
+function normalizePlatform(query) {
+    const platform = query?.platform;
+    return platform === "desktop" ? "desktop" : "web";
+}
+//# sourceMappingURL=client-controller.js.map

package/dist/server/modules/client/client-controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-controller.js","sourceRoot":"","sources":["../../../../src/modules/client/client-controller.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAG5D,MAAM,OAAO,gBAAgB;IACE;IAA7B,YAA6B,aAA4B;QAA5B,kBAAa,GAAb,aAAa,CAAe;IAAG,CAAC;IAEpD,gBAAgB,GAAG,KAAK,EAC/B,OAAuB,EACvB,KAAmB,EACJ,EAAE;QACjB,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YAC/B,MAAM,IAAI,QAAQ,CAAC;gBACjB,UAAU,EAAE,GAAG;gBACf,SAAS,EAAE,cAAc;gBACzB,MAAM,EAAE,aAAa;aACtB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,QAAQ,EAAE;YACvD,QAAQ,EAAE,mBAAmB,CAAC,OAAO,CAAC;YACtC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI;SACnC,CAAC,CAAC,CAAC;IACN,CAAC,CAAC;IAEO,kBAAkB,GAAG,KAAK,EACjC,OAAuB,EACvB,KAAmB,EACJ,EAAE;QACjB,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YAC/B,MAAM,IAAI,QAAQ,CAAC;gBACjB,UAAU,EAAE,GAAG;gBACf,SAAS,EAAE,cAAc;gBACzB,MAAM,EAAE,aAAa;aACtB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAGrB,CAAC;QAEF,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YACpB,MAAM,IAAI,QAAQ,CAAC;gBACjB,UAAU,EAAE,GAAG;gBACf,SAAS,EAAE,kBAAkB;gBAC7B,MAAM,EAAE,UAAU;gBAClB,KAAK,EAAE,UAAU;aAClB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC7D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7E,CAAC,CAAC;IAEO,gBAAgB,GAAG,KAAK,EAC/B,OAAuB,EACvB,KAAmB,EACJ,EAAE;QACjB,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YAC/B,MAAM,IAAI,QAAQ,CAAC;gBACjB,UAAU,EAAE,GAAG;gBACf,SAAS,EAAE,cAAc;gBACzB,MAAM,EAAE,aAAa;aACtB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAErB,CAAC;QAEF,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC7D,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;IACjE,CAAC,CAAC;CACH;AAED,SAAS,mBAAmB,CAAC,OAAuB;IAClD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAEvD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC;IACnD,CAAC;IAED,OAAO,OAAO,CAAC,QAAQ,CAAC;AAC1B,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,MAAM,QAAQ,GAAI,KAA2C,EAAE,QAAQ,CAAC;IACxE,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AACpD,CAAC"}

package/dist/server/modules/client/client-service.d.ts

@@ -0,0 +1,37 @@
+import type { HostConfig } from "../../config/env.js";
+export interface ClientRuntimeConfigDto {
+    platform: "desktop" | "web";
+    hostBaseUrl: string;
+    releaseChannel: "stable" | "beta";
+    autoReconnect: boolean;
+    autoCheckUpdate: boolean;
+}
+export interface ReleaseManifestDto {
+    channel: "stable" | "beta";
+    platform: string;
+    version: string;
+    notes: string;
+    packageUrl: string;
+    signature: string;
+    publishedAt: string;
+}
+export interface ServiceUpdateDto {
+    channel: "stable" | "beta";
+    packageName: string;
+    registryUrl: string;
+    packagePageUrl: string;
+    currentVersion: string;
+    latestVersion: string | null;
+    hasUpdate: boolean;
+    updateCommand: string;
+}
+export declare class ClientService {
+    private readonly config;
+    constructor(config: HostConfig);
+    getRuntimeConfig(platform: "desktop" | "web", requestContext?: {
+        readonly protocol?: string | null;
+        readonly host?: string | null;
+    }): ClientRuntimeConfigDto;
+    getReleaseManifest(channel: "stable" | "beta", platform: string): ReleaseManifestDto;
+    getServiceUpdate(channel: "stable" | "beta"): Promise<ServiceUpdateDto>;
+}

package/dist/server/modules/client/client-service.js

@@ -0,0 +1,186 @@
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { AppError } from "../../shared/errors/app-error.js";
+export class ClientService {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    getRuntimeConfig(platform, requestContext) {
+        return {
+            platform,
+            hostBaseUrl: resolveClientHostBaseUrl(this.config, platform, requestContext),
+            releaseChannel: this.config.releaseChannel,
+            autoReconnect: true,
+            autoCheckUpdate: platform === "desktop"
+        };
+    }
+    getReleaseManifest(channel, platform) {
+        const manifestPath = path.resolve(this.config.releaseManifestRoot, channel, `${platform}.json`);
+        if (!fs.existsSync(manifestPath)) {
+            throw new AppError({
+                statusCode: 404,
+                errorCode: "MANIFEST_NOT_FOUND",
+                detail: `未找到 ${channel}/${platform} 的桌面发布清单`
+            });
+        }
+        const raw = fs.readFileSync(manifestPath, "utf8");
+        try {
+            const parsed = JSON.parse(raw);
+            if (!parsed.channel ||
+                !parsed.platform ||
+                !parsed.version ||
+                !parsed.packageUrl ||
+                !parsed.signature ||
+                !parsed.publishedAt) {
+                throw new Error("manifest incomplete");
+            }
+            return {
+                channel: parsed.channel,
+                platform: parsed.platform,
+                version: parsed.version,
+                notes: parsed.notes ?? "",
+                packageUrl: parsed.packageUrl,
+                signature: parsed.signature,
+                publishedAt: parsed.publishedAt
+            };
+        }
+        catch {
+            throw new AppError({
+                statusCode: 500,
+                errorCode: "MANIFEST_INVALID",
+                detail: `桌面发布清单 ${manifestPath} 格式无效`
+            });
+        }
+    }
+    async getServiceUpdate(channel) {
+        const packageName = this.config.serverUpdatePackageName;
+        const currentVersion = readHostPackageVersion();
+        const packagePageUrl = `https://www.npmjs.com/package/${packageName}`;
+        const registryUrl = buildRegistryPackageUrl(this.config.npmRegistryBaseUrl, packageName);
+        try {
+            const response = await fetch(registryUrl, {
+                headers: {
+                    Accept: "application/json"
+                }
+            });
+            if (!response.ok) {
+                throw new Error(`HTTP ${response.status}`);
+            }
+            const raw = (await response.json());
+            const latestVersion = pickServiceTargetVersion(raw, channel);
+            return {
+                channel,
+                packageName,
+                registryUrl,
+                packagePageUrl,
+                currentVersion,
+                latestVersion,
+                hasUpdate: latestVersion !== null && compareSemver(latestVersion, currentVersion) > 0,
+                updateCommand: `npm install ${packageName}@${channel === "beta" ? "beta" : "latest"}`
+            };
+        }
+        catch {
+            return {
+                channel,
+                packageName,
+                registryUrl,
+                packagePageUrl,
+                currentVersion,
+                latestVersion: null,
+                hasUpdate: false,
+                updateCommand: `npm install ${packageName}@${channel === "beta" ? "beta" : "latest"}`
+            };
+        }
+    }
+}
+function resolveClientHostBaseUrl(config, platform, requestContext) {
+    if (platform === "web") {
+        const requestHost = requestContext?.host?.trim();
+        const requestProtocol = normalizeHttpProtocol(requestContext?.protocol);
+        if (requestHost) {
+            return `${requestProtocol}://${requestHost}`;
+        }
+    }
+    return `http://${resolveAccessibleHost(config.host)}:${config.port}`;
+}
+function normalizeHttpProtocol(value) {
+    return value?.toLowerCase() === "https" ? "https" : "http";
+}
+function resolveAccessibleHost(host) {
+    if (host === "0.0.0.0" || host === "::" || host === "::0") {
+        return "127.0.0.1";
+    }
+    return host;
+}
+function readHostPackageVersion() {
+    const packageJsonPath = findNearestPackageJson(fileURLToPath(import.meta.url));
+    if (!packageJsonPath) {
+        return "0.0.0";
+    }
+    const raw = fs.readFileSync(packageJsonPath, "utf8");
+    const parsed = JSON.parse(raw);
+    return typeof parsed.version === "string" && parsed.version.trim().length > 0
+        ? parsed.version
+        : "0.0.0";
+}
+function buildRegistryPackageUrl(baseUrl, packageName) {
+    const normalizedBaseUrl = baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`;
+    return new URL(encodeURIComponent(packageName), normalizedBaseUrl).toString();
+}
+function pickServiceTargetVersion(payload, channel) {
+    const distTags = payload["dist-tags"] ?? {};
+    if (channel === "beta") {
+        return distTags.beta ?? distTags.latest ?? null;
+    }
+    return distTags.latest ?? null;
+}
+function compareSemver(left, right) {
+    const leftMeta = parseSemver(left);
+    const rightMeta = parseSemver(right);
+    for (let index = 0; index < 3; index += 1) {
+        const diff = (leftMeta.numbers[index] ?? 0) - (rightMeta.numbers[index] ?? 0);
+        if (diff !== 0) {
+            return diff;
+        }
+    }
+    if (leftMeta.prerelease === rightMeta.prerelease) {
+        return 0;
+    }
+    if (!leftMeta.prerelease) {
+        return 1;
+    }
+    if (!rightMeta.prerelease) {
+        return -1;
+    }
+    return leftMeta.prerelease.localeCompare(rightMeta.prerelease);
+}
+function parseSemver(input) {
+    const normalized = input.trim().replace(/^v/i, "");
+    const [versionPart, prerelease = ""] = normalized.split("-", 2);
+    const rawNumbers = versionPart.split(".");
+    return {
+        numbers: [
+            Number.parseInt(rawNumbers[0] ?? "0", 10) || 0,
+            Number.parseInt(rawNumbers[1] ?? "0", 10) || 0,
+            Number.parseInt(rawNumbers[2] ?? "0", 10) || 0
+        ],
+        prerelease
+    };
+}
+function findNearestPackageJson(fromFilePath) {
+    let currentDir = path.dirname(fromFilePath);
+    while (true) {
+        const candidate = path.join(currentDir, "package.json");
+        if (fs.existsSync(candidate)) {
+            return candidate;
+        }
+        const parentDir = path.dirname(currentDir);
+        if (parentDir === currentDir) {
+            return null;
+        }
+        currentDir = parentDir;
+    }
+}
+//# sourceMappingURL=client-service.js.map

package/dist/server/modules/client/client-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-service.js","sourceRoot":"","sources":["../../../../src/modules/client/client-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,OAAO,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AA+B5D,MAAM,OAAO,aAAa;IACK;IAA7B,YAA6B,MAAkB;QAAlB,WAAM,GAAN,MAAM,CAAY;IAAG,CAAC;IAEnD,gBAAgB,CACd,QAA2B,EAC3B,cAGC;QAED,OAAO;YACL,QAAQ;YACR,WAAW,EAAE,wBAAwB,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,cAAc,CAAC;YAC5E,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;YAC1C,aAAa,EAAE,IAAI;YACnB,eAAe,EAAE,QAAQ,KAAK,SAAS;SACxC,CAAC;IACJ,CAAC;IAED,kBAAkB,CAChB,OAA0B,EAC1B,QAAgB;QAEhB,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,OAAO,EAAE,GAAG,QAAQ,OAAO,CAAC,CAAC;QAEhG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,QAAQ,CAAC;gBACjB,UAAU,EAAE,GAAG;gBACf,SAAS,EAAE,oBAAoB;gBAC/B,MAAM,EAAE,OAAO,OAAO,IAAI,QAAQ,UAAU;aAC7C,CAAC,CAAC;QACL,CAAC;QAED,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAElD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgC,CAAC;YAE9D,IACE,CAAC,MAAM,CAAC,OAAO;gBACf,CAAC,MAAM,CAAC,QAAQ;gBAChB,CAAC,MAAM,CAAC,OAAO;gBACf,CAAC,MAAM,CAAC,UAAU;gBAClB,CAAC,MAAM,CAAC,SAAS;gBACjB,CAAC,MAAM,CAAC,WAAW,EACnB,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACzC,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE;gBACzB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;aAChC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,QAAQ,CAAC;gBACjB,UAAU,EAAE,GAAG;gBACf,SAAS,EAAE,kBAAkB;gBAC7B,MAAM,EAAE,UAAU,YAAY,OAAO;aACtC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,OAA0B;QAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC;QACxD,MAAM,cAAc,GAAG,sBAAsB,EAAE,CAAC;QAChD,MAAM,cAAc,GAAG,iCAAiC,WAAW,EAAE,CAAC;QACtE,MAAM,WAAW,GAAG,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,WAAW,CAAC,CAAC;QAEzF,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE;gBACxC,OAAO,EAAE;oBACP,MAAM,EAAE,kBAAkB;iBAC3B;aACF,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7C,CAAC;YAED,MAAM,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA+B,CAAC;YAClE,MAAM,aAAa,GAAG,wBAAwB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAE7D,OAAO;gBACL,OAAO;gBACP,WAAW;gBACX,WAAW;gBACX,cAAc;gBACd,cAAc;gBACd,aAAa;gBACb,SAAS,EACP,aAAa,KAAK,IAAI,IAAI,aAAa,CAAC,aAAa,EAAE,cAAc,CAAC,GAAG,CAAC;gBAC5E,aAAa,EAAE,eAAe,WAAW,IAAI,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;aACtF,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,OAAO;gBACP,WAAW;gBACX,WAAW;gBACX,cAAc;gBACd,cAAc;gBACd,aAAa,EAAE,IAAI;gBACnB,SAAS,EAAE,KAAK;gBAChB,aAAa,EAAE,eAAe,WAAW,IAAI,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;aACtF,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAED,SAAS,wBAAwB,CAC/B,MAAkB,EAClB,QAA2B,EAC3B,cAGC;IAED,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACjD,MAAM,eAAe,GAAG,qBAAqB,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;QAExE,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,GAAG,eAAe,MAAM,WAAW,EAAE,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,OAAO,UAAU,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;AACvE,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAgC;IAC7D,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAC7D,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY;IACzC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QAC1D,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAMD,SAAS,sBAAsB;IAC7B,MAAM,eAAe,GAAG,sBAAsB,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAE/E,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC;IACvD,OAAO,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAC3E,CAAC,CAAC,MAAM,CAAC,OAAO;QAChB,CAAC,CAAC,OAAO,CAAC;AACd,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAe,EAAE,WAAmB;IACnE,MAAM,iBAAiB,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,GAAG,CAAC;IAC1E,OAAO,IAAI,GAAG,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE,iBAAiB,CAAC,CAAC,QAAQ,EAAE,CAAC;AAChF,CAAC;AAED,SAAS,wBAAwB,CAC/B,OAAmC,EACnC,OAA0B;IAE1B,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IAE5C,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC;IAClD,CAAC;IAED,OAAO,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC;AACjC,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,KAAa;IAChD,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAErC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAE9E,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,CAAC,UAAU,EAAE,CAAC;QACjD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QACzB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;QAC1B,OAAO,CAAC,CAAC,CAAC;IACZ,CAAC;IAED,OAAO,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAIhC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,CAAC,WAAW,EAAE,UAAU,GAAG,EAAE,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE1C,OAAO;QACL,OAAO,EAAE;YACP,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC;YAC9C,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC;YAC9C,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC;SAC/C;QACD,UAAU;KACX,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,YAAoB;IAClD,IAAI,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAE5C,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;QAExD,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAE3C,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,UAAU,GAAG,SAAS,CAAC;IACzB,CAAC;AACH,CAAC"}

package/dist/server/modules/file/file-access-guard.d.ts

@@ -0,0 +1,27 @@
+import fs from "node:fs";
+import type { Workspace } from "../../types/domain.js";
+import type { WorkspaceService } from "../workspace/workspace-service.js";
+interface FileAccessLogger {
+    warn(bindings: Record<string, unknown>, message: string): void;
+}
+interface ResolvePathOptions {
+    allowRoot?: boolean;
+    mustExist?: boolean;
+    kind?: "file" | "directory" | "any";
+}
+export interface ResolvedWorkspacePath {
+    workspace: Workspace;
+    workspaceRealPath: string;
+    relativePath: string;
+    absolutePath: string;
+    exists: boolean;
+    stats: fs.Stats | null;
+}
+export declare class FileAccessGuard {
+    private readonly workspaceService;
+    private readonly logger;
+    constructor(workspaceService: WorkspaceService, logger: FileAccessLogger);
+    resolvePath(workspaceId: string, requestedPath: string | undefined, options?: ResolvePathOptions): ResolvedWorkspacePath;
+    private ensureInsideWorkspace;
+}
+export {};