@synoikia/core 0.1.0

package/dist/catalog/rules.js

@@ -0,0 +1,178 @@
+import { randomUUID } from 'node:crypto';
+import { and, asc, eq } from 'drizzle-orm';
+import { z } from 'zod';
+import { writeAudit } from '../audit.js';
+import { operations, preApprovalRules } from '../db/schema.js';
+import { ConflictError, NotFoundError, ValidationError } from '../errors.js';
+import { MatchSchema } from '../gate/match.js';
+import { resolveAccess } from './groups.js';
+/**
+ * Pre-approval rules (design §5.2, TN §3.5): picked from the synced catalog, never free text; a
+ * required reason; structured match; optional rate limit and expiry. Locked operations can never be
+ * referenced (409), enforced here regardless of what the UI offers.
+ */
+export const RuleInputSchema = z.object({
+    operationId: z.string().min(1),
+    match: MatchSchema.default([]),
+    rateLimit: z.number().int().min(1).max(100_000).nullable().optional(),
+    windowSeconds: z
+        .number()
+        .int()
+        .min(60)
+        .max(31 * 24 * 3600)
+        .nullable()
+        .optional(),
+    expiresAt: z.coerce.date().nullable().optional(),
+    reason: z.string().trim().min(3, 'A reason is required').max(500),
+    enabled: z.boolean().default(true),
+});
+function loadOperation(db, instanceId, operationId) {
+    const op = db
+        .select()
+        .from(operations)
+        .where(and(eq(operations.id, operationId), eq(operations.instanceId, instanceId)))
+        .get();
+    if (!op)
+        throw new NotFoundError('operation_not_found', 'No such operation on this endpoint');
+    return op;
+}
+/** Why a rule's match doesn't fit the operation's declared fields (design §8.3), or null if it does. */
+export function matchMisfit(manifest, op, match) {
+    if (match.every((c) => c.field !== '$targets' && 'op' in c && c.op === 'any'))
+        return null;
+    const profile = op.matchProfile ? manifest.matchProfiles[op.matchProfile] : undefined;
+    if (!profile)
+        return new ValidationError('no_match_profile', `${op.key} has no matchable fields; use an empty match`);
+    for (const c of match) {
+        // "Any value" can name any parameter: it only widens strict matching, never narrows a condition.
+        if (c.field !== '$targets' && 'op' in c && c.op === 'any')
+            continue;
+        const field = profile.find((f) => f.field === c.field);
+        if (!field)
+            return new ValidationError('unknown_match_field', `${c.field} is not a matchable field of ${op.key}`);
+        if (c.field !== '$targets' && 'op' in c && field.op !== c.op) {
+            return new ValidationError('wrong_match_op', `${c.field} must use the "${field.op}" operator`);
+        }
+    }
+    return null;
+}
+function checkMatchAgainstProfile(manifest, op, match) {
+    const misfit = matchMisfit(manifest, op, match);
+    if (misfit)
+        throw misfit;
+}
+function describe(db, instanceId, rule, op) {
+    const access = resolveAccess(db, instanceId, op.key);
+    return {
+        ...rule,
+        operation: { id: op.id, key: op.key, locked: op.locked, matchProfile: op.matchProfile },
+        /**
+         * Rules only apply at level `ask`: on an unreachable operation, or one at level `write`, a rule
+         * never fires; the UI flags it (design §5.2.1).
+         */
+        inert: !rule.enabled ? null : !access.reachable ? access.reason : access.level === 'write' ? 'level_write' : null,
+    };
+}
+export function listRules(db, instanceId) {
+    return db
+        .select({ rule: preApprovalRules, op: operations })
+        .from(preApprovalRules)
+        .innerJoin(operations, eq(preApprovalRules.operationId, operations.id))
+        .where(eq(preApprovalRules.instanceId, instanceId))
+        .orderBy(asc(operations.key), asc(preApprovalRules.createdAt))
+        .all()
+        .map(({ rule, op }) => describe(db, instanceId, rule, op));
+}
+export function createRule(db, manifest, instanceId, raw, actor = {}) {
+    const input = RuleInputSchema.parse(raw);
+    const op = loadOperation(db, instanceId, input.operationId);
+    if (op.locked)
+        throw new ConflictError('operation_locked', `${op.key} is locked and can never be pre-approved`);
+    checkMatchAgainstProfile(manifest, op, input.match);
+    const id = randomUUID();
+    db.transaction((tx) => {
+        tx.insert(preApprovalRules)
+            .values({
+            id,
+            instanceId,
+            operationId: op.id,
+            match: input.match,
+            rateLimit: input.rateLimit ?? null,
+            windowSeconds: input.rateLimit ? (input.windowSeconds ?? 3600) : null,
+            expiresAt: input.expiresAt ?? null,
+            reason: input.reason,
+            enabled: input.enabled,
+            createdBy: actor.userId ?? null,
+            createdAt: new Date(),
+        })
+            .run();
+        writeAudit(tx, {
+            kind: 'config',
+            instanceId,
+            operationKey: op.key,
+            decision: 'rule_created',
+            actorKind: 'user',
+            actorId: actor.userId,
+            detail: { ruleId: id, ...input },
+        });
+    });
+    return listRules(db, instanceId).find((r) => r.id === id);
+}
+export function updateRule(db, manifest, instanceId, ruleId, raw, actor = {}) {
+    const before = db
+        .select()
+        .from(preApprovalRules)
+        .where(and(eq(preApprovalRules.id, ruleId), eq(preApprovalRules.instanceId, instanceId)))
+        .get();
+    if (!before)
+        throw new NotFoundError('rule_not_found', 'No such rule');
+    const input = RuleInputSchema.parse({ ...before, ...raw });
+    const op = loadOperation(db, instanceId, input.operationId);
+    if (op.locked)
+        throw new ConflictError('operation_locked', `${op.key} is locked and can never be pre-approved`);
+    checkMatchAgainstProfile(manifest, op, input.match);
+    const set = {
+        operationId: op.id,
+        match: input.match,
+        rateLimit: input.rateLimit ?? null,
+        windowSeconds: input.rateLimit ? (input.windowSeconds ?? 3600) : null,
+        expiresAt: input.expiresAt ?? null,
+        reason: input.reason,
+        enabled: input.enabled,
+        updatedAt: new Date(),
+    };
+    db.transaction((tx) => {
+        tx.update(preApprovalRules).set(set).where(eq(preApprovalRules.id, ruleId)).run();
+        writeAudit(tx, {
+            kind: 'config',
+            instanceId,
+            operationKey: op.key,
+            decision: 'rule_updated',
+            actorKind: 'user',
+            actorId: actor.userId,
+            detail: { ruleId, before, after: set },
+        });
+    });
+    return listRules(db, instanceId).find((r) => r.id === ruleId);
+}
+export function deleteRule(db, instanceId, ruleId, actor = {}) {
+    const before = db
+        .select()
+        .from(preApprovalRules)
+        .where(and(eq(preApprovalRules.id, ruleId), eq(preApprovalRules.instanceId, instanceId)))
+        .get();
+    if (!before)
+        throw new NotFoundError('rule_not_found', 'No such rule');
+    db.transaction((tx) => {
+        tx.delete(preApprovalRules).where(eq(preApprovalRules.id, ruleId)).run();
+        writeAudit(tx, {
+            kind: 'config',
+            instanceId,
+            decision: 'rule_deleted',
+            actorKind: 'user',
+            actorId: actor.userId,
+            detail: { rule: before },
+        });
+    });
+}
+//# sourceMappingURL=rules.js.map

package/dist/catalog/rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../src/catalog/rules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C;;;;GAIG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACrE,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,EAAE,CAAC;SACP,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;SACnB,QAAQ,EAAE;SACV,QAAQ,EAAE;IACb,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAChD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACjE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACnC,CAAC,CAAC;AAMH,SAAS,aAAa,CAAC,EAAM,EAAE,UAAkB,EAAE,WAAmB;IACpE,MAAM,EAAE,GAAG,EAAE;SACV,MAAM,EAAE;SACR,IAAI,CAAC,UAAU,CAAC;SAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;SACjF,GAAG,EAAE,CAAC;IACT,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,aAAa,CAAC,qBAAqB,EAAE,oCAAoC,CAAC,CAAC;IAC9F,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,WAAW,CACzB,QAAyC,EACzC,EAA8C,EAC9C,KAAyB;IAEzB,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,UAAU,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3F,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtF,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,eAAe,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,GAAG,8CAA8C,CAAC,CAAC;IACtH,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,iGAAiG;QACjG,IAAI,CAAC,CAAC,KAAK,KAAK,UAAU,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,KAAK;YAAE,SAAS;QACpE,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,eAAe,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC,KAAK,gCAAgC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;QAClH,IAAI,CAAC,CAAC,KAAK,KAAK,UAAU,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAC7D,OAAO,IAAI,eAAe,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,KAAK,kBAAkB,KAAK,CAAC,EAAE,YAAY,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,wBAAwB,CAAC,QAAkB,EAAE,EAAgB,EAAE,KAAyB;IAC/F,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IAChD,IAAI,MAAM;QAAE,MAAM,MAAM,CAAC;AAC3B,CAAC;AAED,SAAS,QAAQ,CAAC,EAAM,EAAE,UAAkB,EAAE,IAAa,EAAE,EAAgB;IAC3E,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;IACrD,OAAO;QACL,GAAG,IAAI;QACP,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,YAAY,EAAE;QACvF;;;WAGG;QACH,KAAK,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;KAClH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,EAAM,EAAE,UAAkB;IAClD,OAAO,EAAE;SACN,MAAM,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC;SAClD,IAAI,CAAC,gBAAgB,CAAC;SACtB,SAAS,CAAC,UAAU,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;SACtE,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;SAC7D,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,EAAM,EACN,QAAkB,EAClB,UAAkB,EAClB,GAAY,EACZ,QAA6B,EAAE;IAE/B,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,EAAE,GAAG,aAAa,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAC5D,IAAI,EAAE,CAAC,MAAM;QAAE,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,GAAG,0CAA0C,CAAC,CAAC;IAChH,wBAAwB,CAAC,QAAQ,EAAE,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;QACpB,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC;aACxB,MAAM,CAAC;YACN,EAAE;YACF,UAAU;YACV,WAAW,EAAE,EAAE,CAAC,EAAE;YAClB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;YACrE,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;YAC/B,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;aACD,GAAG,EAAE,CAAC;QACT,UAAU,CAAC,EAAE,EAAE;YACb,IAAI,EAAE,QAAQ;YACd,UAAU;YACV,YAAY,EAAE,EAAE,CAAC,GAAG;YACpB,QAAQ,EAAE,cAAc;YACxB,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,KAAK,CAAC,MAAM;YACrB,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE;SACjC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO,SAAS,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAE,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,EAAM,EACN,QAAkB,EAClB,UAAkB,EAClB,MAAc,EACd,GAAY,EACZ,QAA6B,EAAE;IAE/B,MAAM,MAAM,GAAG,EAAE;SACd,MAAM,EAAE;SACR,IAAI,CAAC,gBAAgB,CAAC;SACtB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;SACxF,GAAG,EAAE,CAAC;IACT,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,EAAE,GAAG,MAAM,EAAE,GAAI,GAAc,EAAE,CAAC,CAAC;IACvE,MAAM,EAAE,GAAG,aAAa,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAC5D,IAAI,EAAE,CAAC,MAAM;QAAE,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,GAAG,0CAA0C,CAAC,CAAC;IAChH,wBAAwB,CAAC,QAAQ,EAAE,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG;QACV,WAAW,EAAE,EAAE,CAAC,EAAE;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;QAClC,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;QACrE,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;QAClC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,IAAI,IAAI,EAAE;KACtB,CAAC;IACF,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;QACpB,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAClF,UAAU,CAAC,EAAE,EAAE;YACb,IAAI,EAAE,QAAQ;YACd,UAAU;YACV,YAAY,EAAE,EAAE,CAAC,GAAG;YACpB,QAAQ,EAAE,cAAc;YACxB,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,KAAK,CAAC,MAAM;YACrB,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE;SACvC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO,SAAS,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAE,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,EAAM,EAAE,UAAkB,EAAE,MAAc,EAAE,QAA6B,EAAE;IACpG,MAAM,MAAM,GAAG,EAAE;SACd,MAAM,EAAE;SACR,IAAI,CAAC,gBAAgB,CAAC;SACtB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;SACxF,GAAG,EAAE,CAAC;IACT,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;IACvE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;QACpB,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACzE,UAAU,CAAC,EAAE,EAAE;YACb,IAAI,EAAE,QAAQ;YACd,UAAU;YACV,QAAQ,EAAE,cAAc;YACxB,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,KAAK,CAAC,MAAM;YACrB,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;SACzB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/catalog/sync.d.ts

@@ -0,0 +1,29 @@
+import type { Manifest } from '@synoikia/plugin-sdk';
+import type { Db } from '../db/index.js';
+export interface SyncSummary {
+    added: number;
+    updated: number;
+    staled: number;
+    restored: number;
+    newGroups: string[];
+    /** Writes (new, reclassified read → write, changed, or back from stale) now waiting for acknowledgement. */
+    pendingReview: string[];
+    /** Operations that became locked in this sync; their pre-approval rules were disabled. */
+    newlyLocked: string[];
+    /** Rules disabled because their operation became locked or their match no longer fits it. */
+    rulesDisabled: number;
+}
+/**
+ * Applies a plugin's `syncCatalog` result to an instance (design §5.2.1, §10). Plugin output is
+ * untrusted and re-validated here. Runs in one transaction: either the whole catalog lands or none.
+ *
+ * - Operations missing from the result are marked `stale`, never deleted (history is kept).
+ * - `locked` always follows the plugin seed; admin overrides survive unless the op becomes locked.
+ * - New writes, and reads reclassified to writes, arrive unacknowledged (quarantined). So does an
+ *   acknowledged write whose parameters, kind, match profile or lock changed, or that returns from
+ *   stale: the admin acknowledged what it was, not what it became.
+ * - Enabled pre-approval rules are re-checked against the new catalog (and the plugin's match
+ *   profiles, when given); rules that no longer fit are disabled and audited.
+ * - Plugin groups are mapped through admin aliases; missing groups are created at `read`.
+ */
+export declare function applyCatalogSync(db: Db, instanceId: string, rawResult: unknown, now?: Date, manifest?: Pick<Manifest, 'matchProfiles'>): SyncSummary;

package/dist/catalog/sync.js

@@ -0,0 +1,222 @@
+import { randomUUID } from 'node:crypto';
+import { SyncCatalogResultSchema } from '@synoikia/plugin-sdk';
+import { and, eq, inArray } from 'drizzle-orm';
+import { writeAudit } from '../audit.js';
+import { operationGroupAliases, operationGroups, operations, pluginInstances, preApprovalRules } from '../db/schema.js';
+import { ValidationError } from '../errors.js';
+import { MatchSchema } from '../gate/match.js';
+import { matchMisfit } from './rules.js';
+/** What an acknowledgement covers: a change to any of these makes the write ask again. */
+const fingerprint = (op) => JSON.stringify([op.kind, op.paramsSchema ?? null, op.matchProfile ?? null, op.locked]);
+const isEffectiveWrite = (op) => op.locked || op.classification === 'write';
+/**
+ * Applies a plugin's `syncCatalog` result to an instance (design §5.2.1, §10). Plugin output is
+ * untrusted and re-validated here. Runs in one transaction: either the whole catalog lands or none.
+ *
+ * - Operations missing from the result are marked `stale`, never deleted (history is kept).
+ * - `locked` always follows the plugin seed; admin overrides survive unless the op becomes locked.
+ * - New writes, and reads reclassified to writes, arrive unacknowledged (quarantined). So does an
+ *   acknowledged write whose parameters, kind, match profile or lock changed, or that returns from
+ *   stale: the admin acknowledged what it was, not what it became.
+ * - Enabled pre-approval rules are re-checked against the new catalog (and the plugin's match
+ *   profiles, when given); rules that no longer fit are disabled and audited.
+ * - Plugin groups are mapped through admin aliases; missing groups are created at `read`.
+ */
+export function applyCatalogSync(db, instanceId, rawResult, now = new Date(), manifest) {
+    const result = SyncCatalogResultSchema.parse(rawResult);
+    const seen = new Set();
+    for (const d of result.operations) {
+        if (seen.has(d.key))
+            throw new ValidationError('duplicate_operation', `Duplicate operation key: ${d.key}`);
+        seen.add(d.key);
+    }
+    return db.transaction((tx) => {
+        const aliases = new Map(tx
+            .select()
+            .from(operationGroupAliases)
+            .where(eq(operationGroupAliases.instanceId, instanceId))
+            .all()
+            .map((a) => [a.pluginGroup, a.groupKey]));
+        const groups = new Map(tx
+            .select()
+            .from(operationGroups)
+            .where(eq(operationGroups.instanceId, instanceId))
+            .all()
+            .map((g) => [g.key, g]));
+        const existing = new Map(tx
+            .select()
+            .from(operations)
+            .where(eq(operations.instanceId, instanceId))
+            .all()
+            .map((o) => [o.key, o]));
+        const summary = {
+            added: 0,
+            updated: 0,
+            staled: 0,
+            restored: 0,
+            newGroups: [],
+            pendingReview: [],
+            newlyLocked: [],
+            rulesDisabled: 0,
+        };
+        const groupIdFor = (pluginGroup, label) => {
+            const key = aliases.get(pluginGroup) ?? pluginGroup;
+            const found = groups.get(key);
+            if (found)
+                return found.id;
+            const row = { id: randomUUID(), instanceId, key, label: label ?? key, level: 'read', firstSeenAt: now };
+            tx.insert(operationGroups).values(row).run();
+            groups.set(key, { ...row, levelChangedAt: null, levelChangedBy: null, stale: false });
+            summary.newGroups.push(key);
+            return row.id;
+        };
+        for (const d of result.operations) {
+            const prev = existing.get(d.key);
+            const locked = d.locked;
+            const override = !locked && prev?.classificationSource === 'override';
+            const classification = locked ? 'write' : override ? prev.classification : d.classification;
+            const classificationSource = locked ? 'locked' : override ? 'override' : 'inferred';
+            const fields = {
+                displayName: d.displayName ?? null,
+                kind: d.kind,
+                pluginGroup: d.group,
+                groupId: groupIdFor(d.group, d.groupLabel),
+                tag: d.tag ?? null,
+                classification,
+                classificationSource,
+                inferredClassification: d.classification,
+                inferredReason: d.classificationReason,
+                locked,
+                // A locked operation always needs the typed confirmation, whatever the plugin says.
+                typedConfirmation: locked || (d.typedConfirmation ?? false),
+                needsReview: d.needsReview,
+                matchProfile: d.matchProfile ?? null,
+                paramsSchema: d.paramsSchema ?? null,
+                docs: d.docs ?? null,
+                lastSeenAt: now,
+                stale: false,
+            };
+            const nowWrite = isEffectiveWrite({ classification, locked });
+            if (!prev) {
+                tx.insert(operations)
+                    .values({
+                    id: randomUUID(),
+                    instanceId,
+                    key: d.key,
+                    ...fields,
+                    attestationRequired: d.attestationRequired,
+                    firstSeenAt: now,
+                })
+                    .run();
+                summary.added++;
+                if (nowWrite)
+                    summary.pendingReview.push(d.key);
+                continue;
+            }
+            const becameLocked = locked && !prev.locked;
+            const changed = fingerprint(prev) !== fingerprint(fields) || prev.stale;
+            const becameWrite = nowWrite && (!isEffectiveWrite(prev) || (prev.writeAcknowledged && changed));
+            tx.update(operations)
+                .set({
+                ...fields,
+                // The plugin can add the attestation requirement; only an admin can remove it (and then it stays off).
+                attestationRequired: prev.attestationRequired || (d.attestationRequired && !prev.attestationWaived),
+                ...(becameWrite ? { writeAcknowledged: false, acknowledgedAt: null, acknowledgedBy: null } : {}),
+                // A newly locked op starts closed again: it needs its own `ask` level to be callable.
+                ...(becameLocked ? { levelOverride: null } : {}),
+            })
+                .where(eq(operations.id, prev.id))
+                .run();
+            summary.updated++;
+            if (prev.stale)
+                summary.restored++;
+            if (becameWrite)
+                summary.pendingReview.push(d.key);
+            if (becameLocked)
+                summary.newlyLocked.push(prev.id);
+        }
+        const missing = [...existing.values()].filter((o) => !seen.has(o.key) && !o.stale).map((o) => o.id);
+        if (missing.length > 0) {
+            tx.update(operations).set({ stale: true }).where(inArray(operations.id, missing)).run();
+            summary.staled = missing.length;
+        }
+        if (summary.newlyLocked.length > 0) {
+            summary.rulesDisabled = tx
+                .update(preApprovalRules)
+                .set({ enabled: false, updatedAt: now })
+                .where(and(inArray(preApprovalRules.operationId, summary.newlyLocked), eq(preApprovalRules.enabled, true)))
+                .run().changes;
+        }
+        // Rules name fields of the operation's match profile; a plugin update can remove or retype them.
+        const misfits = [];
+        if (manifest) {
+            const enabled = tx
+                .select({ rule: preApprovalRules, op: operations })
+                .from(preApprovalRules)
+                .innerJoin(operations, eq(preApprovalRules.operationId, operations.id))
+                .where(and(eq(preApprovalRules.instanceId, instanceId), eq(preApprovalRules.enabled, true)))
+                .all();
+            for (const { rule, op } of enabled) {
+                const match = MatchSchema.safeParse(rule.match);
+                const misfit = match.success ? matchMisfit(manifest, op, match.data) : match.error;
+                if (!misfit)
+                    continue;
+                tx.update(preApprovalRules)
+                    .set({ enabled: false, updatedAt: now })
+                    .where(eq(preApprovalRules.id, rule.id))
+                    .run();
+                misfits.push({ ruleId: rule.id, operationKey: op.key, reason: misfit.message });
+            }
+            summary.rulesDisabled += misfits.length;
+        }
+        // A group is stale when none of its operations are live; its level is kept in case they return.
+        const liveGroupIds = new Set(tx
+            .select({ groupId: operations.groupId })
+            .from(operations)
+            .where(and(eq(operations.instanceId, instanceId), eq(operations.stale, false)))
+            .all()
+            .map((r) => r.groupId));
+        for (const g of groups.values()) {
+            const stale = !liveGroupIds.has(g.id);
+            if (stale !== g.stale)
+                tx.update(operationGroups).set({ stale }).where(eq(operationGroups.id, g.id)).run();
+        }
+        tx.update(pluginInstances)
+            .set({
+            upstreamVersion: result.upstreamVersion,
+            sourceRef: result.sourceRef ?? null,
+            lastSyncedAt: now,
+            lastSyncStatus: 'ok',
+        })
+            .where(eq(pluginInstances.id, instanceId))
+            .run();
+        const newlyLockedKeys = [...existing.values()].filter((o) => summary.newlyLocked.includes(o.id)).map((o) => o.key);
+        writeAudit(tx, {
+            kind: 'plugin',
+            instanceId,
+            decision: 'catalog_synced',
+            actorKind: 'system',
+            detail: { ...summary, newlyLocked: newlyLockedKeys, upstreamVersion: result.upstreamVersion },
+        }, now);
+        if (misfits.length > 0) {
+            writeAudit(tx, {
+                kind: 'config',
+                instanceId,
+                decision: 'rules_disabled_operation_changed',
+                actorKind: 'system',
+                detail: { rules: misfits },
+            }, now);
+        }
+        if (summary.newlyLocked.length > 0 && summary.rulesDisabled > misfits.length) {
+            writeAudit(tx, {
+                kind: 'config',
+                instanceId,
+                decision: 'rules_disabled_operation_locked',
+                actorKind: 'system',
+                detail: { operations: newlyLockedKeys, rulesDisabled: summary.rulesDisabled - misfits.length },
+            }, now);
+        }
+        return { ...summary, newlyLocked: newlyLockedKeys };
+    });
+}
+//# sourceMappingURL=sync.js.map

package/dist/catalog/sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.js","sourceRoot":"","sources":["../../src/catalog/sync.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,UAAU,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxH,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAkBzC,0FAA0F;AAC1F,MAAM,WAAW,GAAG,CAAC,EAA2E,EAAE,EAAE,CAClG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,IAAI,IAAI,EAAE,EAAE,CAAC,YAAY,IAAI,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;AAEzF,MAAM,gBAAgB,GAAG,CAAC,EAAmD,EAAE,EAAE,CAC/E,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,cAAc,KAAK,OAAO,CAAC;AAE7C;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAC9B,EAAM,EACN,UAAkB,EAClB,SAAkB,EAClB,GAAG,GAAG,IAAI,IAAI,EAAE,EAChB,QAA0C;IAE1C,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,4BAA4B,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3G,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;QAC3B,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,EAAE;aACC,MAAM,EAAE;aACR,IAAI,CAAC,qBAAqB,CAAC;aAC3B,KAAK,CAAC,EAAE,CAAC,qBAAqB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;aACvD,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAC3C,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,EAAE;aACC,MAAM,EAAE;aACR,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;aACjD,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAC1B,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,EAAE;aACC,MAAM,EAAE;aACR,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;aAC5C,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAC1B,CAAC;QAEF,MAAM,OAAO,GAAgB;YAC3B,KAAK,EAAE,CAAC;YACR,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,CAAC;YACT,QAAQ,EAAE,CAAC;YACX,SAAS,EAAE,EAAE;YACb,aAAa,EAAE,EAAE;YACjB,WAAW,EAAE,EAAE;YACf,aAAa,EAAE,CAAC;SACjB,CAAC;QAEF,MAAM,UAAU,GAAG,CAAC,WAAmB,EAAE,KAAyB,EAAU,EAAE;YAC5E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC;YACpD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,IAAI,GAAG,EAAE,KAAK,EAAE,MAAe,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;YACjH,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YAC7C,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACtF,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC5B,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,CAAC,CAAC;QAEF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;YACxB,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,oBAAoB,KAAK,UAAU,CAAC;YACtE,MAAM,cAAc,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;YAC7F,MAAM,oBAAoB,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;YACpF,MAAM,MAAM,GAAG;gBACb,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;gBAClC,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,WAAW,EAAE,CAAC,CAAC,KAAK;gBACpB,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,UAAU,CAAC;gBAC1C,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,IAAI;gBAClB,cAAc;gBACd,oBAAoB;gBACpB,sBAAsB,EAAE,CAAC,CAAC,cAAc;gBACxC,cAAc,EAAE,CAAC,CAAC,oBAAoB;gBACtC,MAAM;gBACN,oFAAoF;gBACpF,iBAAiB,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC,iBAAiB,IAAI,KAAK,CAAC;gBAC3D,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,YAAY,EAAE,CAAC,CAAC,YAAY,IAAI,IAAI;gBACpC,YAAY,EAAE,CAAC,CAAC,YAAY,IAAI,IAAI;gBACpC,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI;gBACpB,UAAU,EAAE,GAAG;gBACf,KAAK,EAAE,KAAK;aACJ,CAAC;YACX,MAAM,QAAQ,GAAG,gBAAgB,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC;YAE9D,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC;qBAClB,MAAM,CAAC;oBACN,EAAE,EAAE,UAAU,EAAE;oBAChB,UAAU;oBACV,GAAG,EAAE,CAAC,CAAC,GAAG;oBACV,GAAG,MAAM;oBACT,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;oBAC1C,WAAW,EAAE,GAAG;iBACjB,CAAC;qBACD,GAAG,EAAE,CAAC;gBACT,OAAO,CAAC,KAAK,EAAE,CAAC;gBAChB,IAAI,QAAQ;oBAAE,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAChD,SAAS;YACX,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YAC5C,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,WAAW,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC;YACxE,MAAM,WAAW,GAAG,QAAQ,IAAI,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,OAAO,CAAC,CAAC,CAAC;YACjG,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC;iBAClB,GAAG,CAAC;gBACH,GAAG,MAAM;gBACT,uGAAuG;gBACvG,mBAAmB,EAAE,IAAI,CAAC,mBAAmB,IAAI,CAAC,CAAC,CAAC,mBAAmB,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC;gBACnG,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChG,sFAAsF;gBACtF,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjD,CAAC;iBACD,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;iBACjC,GAAG,EAAE,CAAC;YACT,OAAO,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,IAAI,CAAC,KAAK;gBAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;YACnC,IAAI,WAAW;gBAAE,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACnD,IAAI,YAAY;gBAAE,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpG,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACxF,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAClC,CAAC;QAED,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,aAAa,GAAG,EAAE;iBACvB,MAAM,CAAC,gBAAgB,CAAC;iBACxB,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;iBACvC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;iBAC1G,GAAG,EAAE,CAAC,OAAO,CAAC;QACnB,CAAC;QAED,iGAAiG;QACjG,MAAM,OAAO,GAA+D,EAAE,CAAC;QAC/E,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,EAAE;iBACf,MAAM,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC;iBAClD,IAAI,CAAC,gBAAgB,CAAC;iBACtB,SAAS,CAAC,UAAU,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;iBACtE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;iBAC3F,GAAG,EAAE,CAAC;YACT,KAAK,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC;gBACnC,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAChD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;gBACnF,IAAI,CAAC,MAAM;oBAAE,SAAS;gBACtB,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC;qBACxB,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;qBACvC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;qBACvC,GAAG,EAAE,CAAC;gBACT,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,YAAY,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YAClF,CAAC;YACD,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC;QAC1C,CAAC;QAED,gGAAgG;QAChG,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,EAAE;aACC,MAAM,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC;aACvC,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;aAC9E,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CACzB,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACtC,IAAI,KAAK,KAAK,CAAC,CAAC,KAAK;gBAAE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAC7G,CAAC;QAED,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC;aACvB,GAAG,CAAC;YACH,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;YACnC,YAAY,EAAE,GAAG;YACjB,cAAc,EAAE,IAAI;SACrB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;aACzC,GAAG,EAAE,CAAC;QAET,MAAM,eAAe,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACnH,UAAU,CACR,EAAE,EACF;YACE,IAAI,EAAE,QAAQ;YACd,UAAU;YACV,QAAQ,EAAE,gBAAgB;YAC1B,SAAS,EAAE,QAAQ;YACnB,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE;SAC9F,EACD,GAAG,CACJ,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,UAAU,CACR,EAAE,EACF;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU;gBACV,QAAQ,EAAE,kCAAkC;gBAC5C,SAAS,EAAE,QAAQ;gBACnB,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;aAC3B,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,aAAa,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YAC7E,UAAU,CACR,EAAE,EACF;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU;gBACV,QAAQ,EAAE,iCAAiC;gBAC3C,SAAS,EAAE,QAAQ;gBACnB,MAAM,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,GAAG,OAAO,CAAC,MAAM,EAAE;aAC/F,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+export declare function rotateMasterKeyCommand(env: NodeJS.ProcessEnv, log?: (line: string) => void, opts?: {
+    force?: boolean;
+}): import("./crypto/rotate.js").RotationResult;

package/dist/cli.js

@@ -0,0 +1,83 @@
+import { randomBytes } from 'node:crypto';
+import { existsSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { loadConfig } from './config/env.js';
+import { loadMasterKey, MASTER_KEY_FILENAME, SecretBox } from './crypto/index.js';
+import { rotateSecrets } from './crypto/rotate.js';
+import { openDatabase } from './db/index.js';
+import { assertServerStopped } from './lock.js';
+/**
+ * Operator commands, run with the server stopped:
+ *
+ *   node dist/cli.js rotate-master-key [--force]
+ *
+ * With `MASTER_KEY` set, the new key must be supplied as `NEW_MASTER_KEY` (so it exists before any
+ * data depends on it); update `MASTER_KEY` to it afterwards. With a key file, a new key is generated,
+ * written next to it as `master.key.new` before the database changes, then moved into place.
+ */
+const USAGE = 'Usage: cli.js rotate-master-key [--force]   (stop the server first; --force skips the running-server check)';
+export function rotateMasterKeyCommand(env, log = console.log, opts = {}) {
+    const config = loadConfig(env);
+    assertServerStopped(config.DATA_DIR, opts);
+    const keyFile = path.join(config.DATA_DIR, MASTER_KEY_FILENAME);
+    if (!config.MASTER_KEY && !existsSync(keyFile))
+        throw new Error(`No master key: MASTER_KEY is unset and ${keyFile} does not exist`);
+    const current = loadMasterKey({ envKey: config.MASTER_KEY, dataDir: config.DATA_DIR });
+    let next;
+    if (env.NEW_MASTER_KEY) {
+        next = Buffer.from(env.NEW_MASTER_KEY.trim(), 'base64');
+        if (next.length !== 32)
+            throw new Error('NEW_MASTER_KEY must be 32 bytes of base64 (e.g. `openssl rand -base64 32`)');
+    }
+    else if (current.source === 'env') {
+        throw new Error('MASTER_KEY comes from the environment: set NEW_MASTER_KEY to the replacement key');
+    }
+    else {
+        next = randomBytes(32);
+    }
+    if (next.equals(current.key))
+        throw new Error('The new key is the same as the current key');
+    const db = openDatabase({ dataDir: config.DATA_DIR });
+    const pending = `${keyFile}.new`;
+    let committed = false;
+    try {
+        if (current.source === 'file')
+            writeFileSync(pending, `${next.toString('base64')}\n`, { mode: 0o600 });
+        const result = rotateSecrets(db, SecretBox.fromKey(current.key), SecretBox.fromKey(next));
+        committed = true;
+        // If this rename fails, master.key.new holds the only key that opens the database now.
+        if (current.source === 'file')
+            renameSync(pending, keyFile);
+        log(`Re-encrypted ${result.instances} endpoint connection(s), ${result.notifiers} notifier(s), ` +
+            `${result.users} TOTP secret(s) and ${result.oidc} OIDC secret(s); signed out ${result.sessionsCleared} session(s).`);
+        log(current.source === 'file'
+            ? `New key written to ${keyFile}.`
+            : 'Now set MASTER_KEY to the value of NEW_MASTER_KEY.');
+        return result;
+    }
+    catch (err) {
+        if (current.source === 'file' && !committed)
+            rmSync(pending, { force: true });
+        throw err;
+    }
+    finally {
+        db.$client.close();
+    }
+}
+if (import.meta.url === pathToFileURL(process.argv[1] ?? '').href) {
+    const [command, ...flags] = process.argv.slice(2);
+    try {
+        if (command === 'rotate-master-key' && flags.every((f) => f === '--force'))
+            rotateMasterKeyCommand(process.env, console.log, { force: flags.includes('--force') });
+        else {
+            console.error(USAGE);
+            process.exitCode = 2;
+        }
+    }
+    catch (err) {
+        console.error(`Error: ${err instanceof Error ? err.message : err}`);
+        process.exitCode = 1;
+    }
+}
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAClF,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEhD;;;;;;;;GAQG;AAEH,MAAM,KAAK,GACT,6GAA6G,CAAC;AAEhH,MAAM,UAAU,sBAAsB,CACpC,GAAsB,EACtB,MAA8B,OAAO,CAAC,GAAG,EACzC,OAA4B,EAAE;IAE9B,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,mBAAmB,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,0CAA0C,OAAO,iBAAiB,CAAC,CAAC;IACtF,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAEvF,IAAI,IAAY,CAAC;IACjB,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;QACvB,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;QACxD,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE;YACpB,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAClG,CAAC;SAAM,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;IACtG,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAE5F,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,GAAG,OAAO,MAAM,CAAC;IACjC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;YAAE,aAAa,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvG,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,EAAE,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1F,SAAS,GAAG,IAAI,CAAC;QACjB,uFAAuF;QACvF,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;YAAE,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC5D,GAAG,CACD,gBAAgB,MAAM,CAAC,SAAS,4BAA4B,MAAM,CAAC,SAAS,gBAAgB;YAC1F,GAAG,MAAM,CAAC,KAAK,uBAAuB,MAAM,CAAC,IAAI,+BAA+B,MAAM,CAAC,eAAe,cAAc,CACvH,CAAC;QACF,GAAG,CACD,OAAO,CAAC,MAAM,KAAK,MAAM;YACvB,CAAC,CAAC,sBAAsB,OAAO,GAAG;YAClC,CAAC,CAAC,oDAAoD,CACzD,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,SAAS;YAAE,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;AACH,CAAC;AAED,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,MAAM,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,IAAI,OAAO,KAAK,mBAAmB,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;YACxE,sBAAsB,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;aACpF,CAAC;YACJ,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACrB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACpE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/config/env.d.ts

@@ -0,0 +1,40 @@
+import { z } from 'zod';
+declare const EnvSchema: z.ZodObject<{
+    DATA_DIR: z.ZodDefault<z.ZodString>;
+    MASTER_KEY: z.ZodOptional<z.ZodString>;
+    MCP_HOST: z.ZodDefault<z.ZodString>;
+    MCP_PORT: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    ADMIN_HOST: z.ZodDefault<z.ZodString>;
+    ADMIN_PORT: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    PUBLIC_MCP_URL: z.ZodPipe<z.ZodPipe<z.ZodOptional<z.ZodString>, z.ZodTransform<string | undefined, string | undefined>>, z.ZodOptional<z.ZodURL>>;
+    PUBLIC_ADMIN_URL: z.ZodPipe<z.ZodPipe<z.ZodOptional<z.ZodString>, z.ZodTransform<string | undefined, string | undefined>>, z.ZodOptional<z.ZodURL>>;
+    TRUST_PROXY: z.ZodPipe<z.ZodOptional<z.ZodString>, z.ZodTransform<number, string | undefined>>;
+    MCP_ALLOWED_HOSTS: z.ZodPipe<z.ZodOptional<z.ZodString>, z.ZodTransform<string[], string | undefined>>;
+    CORE_PLUGINS_AUTOENABLE: z.ZodPipe<z.ZodOptional<z.ZodEnum<{
+        "": "";
+        0: "0";
+        1: "1";
+        true: "true";
+        false: "false";
+    }>>, z.ZodTransform<boolean, "" | "0" | "1" | "true" | "false" | undefined>>;
+    CORE_PLUGINS_DIR: z.ZodDefault<z.ZodString>;
+    ADMIN_UI_DIR: z.ZodDefault<z.ZodString>;
+    ADMIN_BOOTSTRAP_USERNAME: z.ZodOptional<z.ZodString>;
+    ADMIN_BOOTSTRAP_PASSWORD: z.ZodOptional<z.ZodString>;
+    ADMIN_FORCE_LOCAL_LOGIN: z.ZodPipe<z.ZodOptional<z.ZodEnum<{
+        "": "";
+        0: "0";
+        1: "1";
+        true: "true";
+        false: "false";
+    }>>, z.ZodTransform<boolean, "" | "0" | "1" | "true" | "false" | undefined>>;
+    LOG_LEVEL: z.ZodDefault<z.ZodEnum<{
+        error: "error";
+        debug: "debug";
+        info: "info";
+        warn: "warn";
+    }>>;
+}, z.core.$strip>;
+export type Config = z.infer<typeof EnvSchema>;
+export declare function loadConfig(env?: NodeJS.ProcessEnv): Config;
+export {};