@undefineds.co/xpod 0.3.18 → 0.3.23

package/dist/terminal/TerminalSessionManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"TerminalSessionManager.js","sourceRoot":"","sources":["../../src/terminal/TerminalSessionManager.ts"],"names":[],"mappings":";;;AAAA,mCAAoC;AACpC,iEAAqD;AACrD,uDAAoD;AACpD,iEAA8D;AAE9D,mCAAyD;AAuBzD,MAAM,eAAe,GAAkC;IACrD,kBAAkB,EAAE,CAAC;IACrB,gBAAgB,EAAE,GAAG;IACrB,cAAc,EAAE,IAAI,EAAE,SAAS;IAC/B,UAAU,EAAE,KAAK,EAAE,WAAW;IAC9B,cAAc,EAAE,YAAY;IAC5B,iBAAiB,EAAE,IAAI;CACxB,CAAC;AAEF,MAAa,sBAAsB;IAQjC,YAAY,UAAkD,EAAE;QAP7C,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAE9B,aAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;QAC9C,iBAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;QAK7D,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,eAAe,EAAE,GAAG,OAAO,EAAE,CAAC;QAElD,wDAAwD;QACxD,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YAChC,IAAI,CAAC,UAAU,GAAG,IAAI,2CAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED;;OAEG;IACK,SAAS,CAAC,IAAY;QAC5B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YAC1D,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC;YACpD,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC1C,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;QAEhC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YAChD,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACnC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QAEzB,OAAO,OAAO,GAAG,YAAY,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB,CAAC,MAAc,EAAE,OAAe;QAC1D,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;YAC1E,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACnE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CACjB,MAAc,EACd,OAA6B,EAC7B,cAAiD;QAEjD,8BAA8B;QAC9B,IAAI,CAAC,IAAA,sBAAc,EAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CACb,sBAAsB,OAAO,CAAC,OAAO,cAAc,sBAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC/E,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;QAE/D,+BAA+B;QAC/B,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACzE,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,uDAAuD,OAAO,EAAE,CACjE,CAAC;QACJ,CAAC;QAED,eAAe;QACf,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;QAClE,IAAI,cAAc,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,CAAC,OAAO,CAAC,kBAAkB,GAAG,CAAC,CAAC;QAC5F,CAAC;QAED,gCAAgC;QAChC,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAChB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAC9B,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBACnB,CAAC;qBAAM,IAAI,cAAc,EAAE,CAAC;oBAC1B,IAAI,CAAC;wBACH,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;oBACzC,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC;oBACpE,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,uBAAuB;QACvB,MAAM,SAAS,GAAG,QAAQ,IAAA,mBAAU,GAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QACxE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CACtB,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,EAC9C,IAAI,CAAC,OAAO,CAAC,UAAU,CACxB,CAAC;QAEF,MAAM,MAAM,GAAkB;YAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE;YACxB,OAAO;YACP,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,EAAE;YACtB,OAAO;SACR,CAAC;QAEF,iBAAiB;QACjB,MAAM,OAAO,GAAG,IAAI,iCAAe,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QAEpE,gBAAgB;QAChB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAE9C,mBAAmB;QACnB,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YACtB,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,SAAS,aAAa,MAAM,OAAO,OAAO,EAAE,CAAC,CAAC;QAC3F,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,SAAiB;QAC1B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,MAAc;QAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;aAC1B,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;aAChC,MAAM,CAAC,CAAC,CAAC,EAAwB,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,SAAiB;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,SAAiB;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC7D,IAAI,cAAc,EAAE,CAAC;gBACnB,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACjC,IAAI,cAAc,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;oBAC9B,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC3C,CAAC;YACH,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,SAAS,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO;YACL,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;YACjC,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI;SACpC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,YAAY;QACV,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7C,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;CACF;AA1ND,wDA0NC","sourcesContent":["import { randomUUID } from 'crypto';\nimport { getLoggerFor } from 'global-logger-factory';\nimport { TerminalSession } from './TerminalSession';\nimport { AclPermissionService } from './AclPermissionService';\nimport type { SessionConfig, Session, EnvRef, CreateSessionRequest } from './types';\nimport { isTrustedAgent, TRUSTED_AGENTS } from './types';\n\nexport interface TerminalSessionManagerOptions {\n  /** Maximum sessions per user */\n  maxSessionsPerUser: number;\n  /** Maximum total sessions */\n  maxTotalSessions: number;\n  /** Default session timeout in seconds */\n  defaultTimeout: number;\n  /** Maximum session timeout in seconds */\n  maxTimeout: number;\n  /** Default working directory */\n  defaultWorkdir: string;\n  /** SPARQL endpoint for ACL queries */\n  sparqlEndpoint?: string;\n  /** Whether to require ACL Control permission (default: true) */\n  requireAclControl: boolean;\n  /** Base URL for mapping file paths to resource URLs */\n  baseUrl?: string;\n  /** File system root for mapping URLs to paths */\n  fileSystemRoot?: string;\n}\n\nconst DEFAULT_OPTIONS: TerminalSessionManagerOptions = {\n  maxSessionsPerUser: 5,\n  maxTotalSessions: 100,\n  defaultTimeout: 3600, // 1 hour\n  maxTimeout: 86400, // 24 hours\n  defaultWorkdir: '/workspace',\n  requireAclControl: true,\n};\n\nexport class TerminalSessionManager {\n  protected readonly logger = getLoggerFor(this);\n\n  private readonly sessions = new Map<string, TerminalSession>();\n  private readonly userSessions = new Map<string, Set<string>>();\n  private readonly options: TerminalSessionManagerOptions;\n  private readonly aclService?: AclPermissionService;\n\n  constructor(options: Partial<TerminalSessionManagerOptions> = {}) {\n    this.options = { ...DEFAULT_OPTIONS, ...options };\n\n    // Initialize ACL service if SPARQL endpoint is provided\n    if (this.options.sparqlEndpoint) {\n      this.aclService = new AclPermissionService(this.options.sparqlEndpoint);\n    }\n  }\n\n  /**\n   * Convert a file system path to a resource URL.\n   */\n  private pathToUrl(path: string): string | undefined {\n    if (!this.options.baseUrl || !this.options.fileSystemRoot) {\n      return undefined;\n    }\n\n    const root = this.options.fileSystemRoot.endsWith('/')\n      ? this.options.fileSystemRoot.slice(0, -1)\n      : this.options.fileSystemRoot;\n\n    if (!path.startsWith(root)) {\n      return undefined;\n    }\n\n    const relativePath = path.slice(root.length);\n    const baseUrl = this.options.baseUrl.endsWith('/')\n      ? this.options.baseUrl.slice(0, -1)\n      : this.options.baseUrl;\n\n    return baseUrl + relativePath;\n  }\n\n  /**\n   * Check if user has acl:Control permission for the working directory.\n   */\n  async checkWorkdirPermission(userId: string, workdir: string): Promise<boolean> {\n    if (!this.options.requireAclControl) {\n      return true;\n    }\n\n    if (!this.aclService) {\n      this.logger.warn('ACL service not configured, skipping permission check');\n      return true;\n    }\n\n    const resourceUrl = this.pathToUrl(workdir);\n    if (!resourceUrl) {\n      this.logger.warn(`Cannot map workdir to URL: ${workdir}`);\n      return false;\n    }\n\n    return this.aclService.hasControlPermission(userId, resourceUrl);\n  }\n\n  /**\n   * Create a new terminal session\n   */\n  async createSession(\n    userId: string,\n    request: CreateSessionRequest,\n    secretResolver?: (ref: EnvRef) => Promise<string>,\n  ): Promise<TerminalSession> {\n    // Validate command is trusted\n    if (!isTrustedAgent(request.command)) {\n      throw new Error(\n        `Untrusted command: ${request.command}. Allowed: ${TRUSTED_AGENTS.join(', ')}`\n      );\n    }\n\n    const workdir = request.workdir ?? this.options.defaultWorkdir;\n\n    // Check ACL Control permission\n    const hasPermission = await this.checkWorkdirPermission(userId, workdir);\n    if (!hasPermission) {\n      throw new Error(\n        `Permission denied: acl:Control required for workdir ${workdir}`\n      );\n    }\n\n    // Check limits\n    if (this.sessions.size >= this.options.maxTotalSessions) {\n      throw new Error('Maximum total sessions reached');\n    }\n\n    const userSessionIds = this.userSessions.get(userId) ?? new Set();\n    if (userSessionIds.size >= this.options.maxSessionsPerUser) {\n      throw new Error(`Maximum sessions per user reached (${this.options.maxSessionsPerUser})`);\n    }\n\n    // Resolve environment variables\n    const env: Record<string, string> = {};\n    if (request.env) {\n      for (const [key, value] of Object.entries(request.env)) {\n        if (typeof value === 'string') {\n          env[key] = value;\n        } else if (secretResolver) {\n          try {\n            env[key] = await secretResolver(value);\n          } catch (error) {\n            this.logger.warn(`Failed to resolve secret for ${key}: ${error}`);\n          }\n        }\n      }\n    }\n\n    // Build session config\n    const sessionId = `sess_${randomUUID().replace(/-/g, '').slice(0, 12)}`;\n    const timeout = Math.min(\n      request.timeout ?? this.options.defaultTimeout,\n      this.options.maxTimeout\n    );\n\n    const config: SessionConfig = {\n      command: request.command,\n      args: request.args ?? [],\n      workdir,\n      env: request.env ?? {},\n      timeout,\n    };\n\n    // Create session\n    const session = new TerminalSession(sessionId, userId, config, env);\n\n    // Track session\n    this.sessions.set(sessionId, session);\n    if (!this.userSessions.has(userId)) {\n      this.userSessions.set(userId, new Set());\n    }\n    this.userSessions.get(userId)!.add(sessionId);\n\n    // Clean up on exit\n    session.on('exit', () => {\n      this.removeSession(sessionId);\n    });\n\n    this.logger.info(`Created terminal session ${sessionId} for user ${userId} in ${workdir}`);\n    return session;\n  }\n\n  /**\n   * Get a session by ID\n   */\n  getSession(sessionId: string): TerminalSession | undefined {\n    return this.sessions.get(sessionId);\n  }\n\n  /**\n   * Get all sessions for a user\n   */\n  getUserSessions(userId: string): TerminalSession[] {\n    const sessionIds = this.userSessions.get(userId);\n    if (!sessionIds) {\n      return [];\n    }\n    return Array.from(sessionIds)\n      .map(id => this.sessions.get(id))\n      .filter((s): s is TerminalSession => s !== undefined);\n  }\n\n  /**\n   * Terminate a session\n   */\n  terminateSession(sessionId: string): boolean {\n    const session = this.sessions.get(sessionId);\n    if (!session) {\n      return false;\n    }\n    session.terminate();\n    return true;\n  }\n\n  /**\n   * Remove a session from tracking\n   */\n  private removeSession(sessionId: string): void {\n    const session = this.sessions.get(sessionId);\n    if (session) {\n      this.sessions.delete(sessionId);\n      const userSessionIds = this.userSessions.get(session.userId);\n      if (userSessionIds) {\n        userSessionIds.delete(sessionId);\n        if (userSessionIds.size === 0) {\n          this.userSessions.delete(session.userId);\n        }\n      }\n      this.logger.debug(`Removed terminal session ${sessionId}`);\n    }\n  }\n\n  /**\n   * Get session statistics\n   */\n  getStats(): { totalSessions: number; activeUsers: number } {\n    return {\n      totalSessions: this.sessions.size,\n      activeUsers: this.userSessions.size,\n    };\n  }\n\n  /**\n   * Terminate all sessions (for shutdown)\n   */\n  terminateAll(): void {\n    for (const session of this.sessions.values()) {\n      session.terminate();\n    }\n    this.sessions.clear();\n    this.userSessions.clear();\n  }\n}\n"]}
+{"version":3,"file":"TerminalSessionManager.js","sourceRoot":"","sources":["../../src/terminal/TerminalSessionManager.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,mCAAoC;AACpC,iEAAqD;AACrD,uDAAoD;AAGpD,mCAAyD;AAuBzD,MAAM,eAAe,GAAkC;IACrD,kBAAkB,EAAE,CAAC;IACrB,gBAAgB,EAAE,GAAG;IACrB,cAAc,EAAE,IAAI,EAAE,SAAS;IAC/B,UAAU,EAAE,KAAK,EAAE,WAAW;IAC9B,cAAc,EAAE,YAAY;IAC5B,iBAAiB,EAAE,IAAI;CACxB,CAAC;AAEF,MAAa,sBAAsB;IAQjC,YAAY,UAAkD,EAAE;QAP7C,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAE9B,aAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;QAC9C,iBAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;QAK7D,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,eAAe,EAAE,GAAG,OAAO,EAAE,CAAC;QAElD,wDAAwD;QACxD,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YAChC,IAAI,CAAC,UAAU,GAAG,kDAAO,wBAAwB,IAC9C,IAAI,CAAC,CAAC,EAAE,oBAAoB,EAAE,EAAE,EAAE,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IAED;;OAEG;IACK,SAAS,CAAC,IAAY;QAC5B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YAC1D,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC;YACpD,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC1C,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;QAEhC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YAChD,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACnC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QAEzB,OAAO,OAAO,GAAG,YAAY,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB,CAAC,MAAc,EAAE,OAAe;QAC1D,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;YAC1E,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,oBAAoB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC3E,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CACjB,MAAc,EACd,OAA6B,EAC7B,cAAiD;QAEjD,8BAA8B;QAC9B,IAAI,CAAC,IAAA,sBAAc,EAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CACb,sBAAsB,OAAO,CAAC,OAAO,cAAc,sBAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC/E,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;QAE/D,+BAA+B;QAC/B,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACzE,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,uDAAuD,OAAO,EAAE,CACjE,CAAC;QACJ,CAAC;QAED,eAAe;QACf,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;QAClE,IAAI,cAAc,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,CAAC,OAAO,CAAC,kBAAkB,GAAG,CAAC,CAAC;QAC5F,CAAC;QAED,gCAAgC;QAChC,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAChB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAC9B,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBACnB,CAAC;qBAAM,IAAI,cAAc,EAAE,CAAC;oBAC1B,IAAI,CAAC;wBACH,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;oBACzC,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC;oBACpE,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,uBAAuB;QACvB,MAAM,SAAS,GAAG,QAAQ,IAAA,mBAAU,GAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QACxE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CACtB,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,EAC9C,IAAI,CAAC,OAAO,CAAC,UAAU,CACxB,CAAC;QAEF,MAAM,MAAM,GAAkB;YAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE;YACxB,OAAO;YACP,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,EAAE;YACtB,OAAO;SACR,CAAC;QAEF,iBAAiB;QACjB,MAAM,OAAO,GAAG,IAAI,iCAAe,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QAEpE,gBAAgB;QAChB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAE9C,mBAAmB;QACnB,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YACtB,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,SAAS,aAAa,MAAM,OAAO,OAAO,EAAE,CAAC,CAAC;QAC3F,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,SAAiB;QAC1B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,MAAc;QAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;aAC1B,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;aAChC,MAAM,CAAC,CAAC,CAAC,EAAwB,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,SAAiB;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,SAAiB;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC7D,IAAI,cAAc,EAAE,CAAC;gBACnB,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACjC,IAAI,cAAc,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;oBAC9B,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC3C,CAAC;YACH,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,SAAS,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO;YACL,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;YACjC,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI;SACpC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,YAAY;QACV,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7C,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;CACF;AA3ND,wDA2NC","sourcesContent":["import { randomUUID } from 'crypto';\nimport { getLoggerFor } from 'global-logger-factory';\nimport { TerminalSession } from './TerminalSession';\nimport type { AclPermissionService } from './AclPermissionService';\nimport type { SessionConfig, Session, EnvRef, CreateSessionRequest } from './types';\nimport { isTrustedAgent, TRUSTED_AGENTS } from './types';\n\nexport interface TerminalSessionManagerOptions {\n  /** Maximum sessions per user */\n  maxSessionsPerUser: number;\n  /** Maximum total sessions */\n  maxTotalSessions: number;\n  /** Default session timeout in seconds */\n  defaultTimeout: number;\n  /** Maximum session timeout in seconds */\n  maxTimeout: number;\n  /** Default working directory */\n  defaultWorkdir: string;\n  /** SPARQL endpoint for ACL queries */\n  sparqlEndpoint?: string;\n  /** Whether to require ACL Control permission (default: true) */\n  requireAclControl: boolean;\n  /** Base URL for mapping file paths to resource URLs */\n  baseUrl?: string;\n  /** File system root for mapping URLs to paths */\n  fileSystemRoot?: string;\n}\n\nconst DEFAULT_OPTIONS: TerminalSessionManagerOptions = {\n  maxSessionsPerUser: 5,\n  maxTotalSessions: 100,\n  defaultTimeout: 3600, // 1 hour\n  maxTimeout: 86400, // 24 hours\n  defaultWorkdir: '/workspace',\n  requireAclControl: true,\n};\n\nexport class TerminalSessionManager {\n  protected readonly logger = getLoggerFor(this);\n\n  private readonly sessions = new Map<string, TerminalSession>();\n  private readonly userSessions = new Map<string, Set<string>>();\n  private readonly options: TerminalSessionManagerOptions;\n  private readonly aclService?: Promise<AclPermissionService>;\n\n  constructor(options: Partial<TerminalSessionManagerOptions> = {}) {\n    this.options = { ...DEFAULT_OPTIONS, ...options };\n\n    // Initialize ACL service if SPARQL endpoint is provided\n    if (this.options.sparqlEndpoint) {\n      this.aclService = import('./AclPermissionService')\n        .then(({ AclPermissionService }) => new AclPermissionService(this.options.sparqlEndpoint));\n    }\n  }\n\n  /**\n   * Convert a file system path to a resource URL.\n   */\n  private pathToUrl(path: string): string | undefined {\n    if (!this.options.baseUrl || !this.options.fileSystemRoot) {\n      return undefined;\n    }\n\n    const root = this.options.fileSystemRoot.endsWith('/')\n      ? this.options.fileSystemRoot.slice(0, -1)\n      : this.options.fileSystemRoot;\n\n    if (!path.startsWith(root)) {\n      return undefined;\n    }\n\n    const relativePath = path.slice(root.length);\n    const baseUrl = this.options.baseUrl.endsWith('/')\n      ? this.options.baseUrl.slice(0, -1)\n      : this.options.baseUrl;\n\n    return baseUrl + relativePath;\n  }\n\n  /**\n   * Check if user has acl:Control permission for the working directory.\n   */\n  async checkWorkdirPermission(userId: string, workdir: string): Promise<boolean> {\n    if (!this.options.requireAclControl) {\n      return true;\n    }\n\n    if (!this.aclService) {\n      this.logger.warn('ACL service not configured, skipping permission check');\n      return true;\n    }\n\n    const resourceUrl = this.pathToUrl(workdir);\n    if (!resourceUrl) {\n      this.logger.warn(`Cannot map workdir to URL: ${workdir}`);\n      return false;\n    }\n\n    return (await this.aclService).hasControlPermission(userId, resourceUrl);\n  }\n\n  /**\n   * Create a new terminal session\n   */\n  async createSession(\n    userId: string,\n    request: CreateSessionRequest,\n    secretResolver?: (ref: EnvRef) => Promise<string>,\n  ): Promise<TerminalSession> {\n    // Validate command is trusted\n    if (!isTrustedAgent(request.command)) {\n      throw new Error(\n        `Untrusted command: ${request.command}. Allowed: ${TRUSTED_AGENTS.join(', ')}`\n      );\n    }\n\n    const workdir = request.workdir ?? this.options.defaultWorkdir;\n\n    // Check ACL Control permission\n    const hasPermission = await this.checkWorkdirPermission(userId, workdir);\n    if (!hasPermission) {\n      throw new Error(\n        `Permission denied: acl:Control required for workdir ${workdir}`\n      );\n    }\n\n    // Check limits\n    if (this.sessions.size >= this.options.maxTotalSessions) {\n      throw new Error('Maximum total sessions reached');\n    }\n\n    const userSessionIds = this.userSessions.get(userId) ?? new Set();\n    if (userSessionIds.size >= this.options.maxSessionsPerUser) {\n      throw new Error(`Maximum sessions per user reached (${this.options.maxSessionsPerUser})`);\n    }\n\n    // Resolve environment variables\n    const env: Record<string, string> = {};\n    if (request.env) {\n      for (const [key, value] of Object.entries(request.env)) {\n        if (typeof value === 'string') {\n          env[key] = value;\n        } else if (secretResolver) {\n          try {\n            env[key] = await secretResolver(value);\n          } catch (error) {\n            this.logger.warn(`Failed to resolve secret for ${key}: ${error}`);\n          }\n        }\n      }\n    }\n\n    // Build session config\n    const sessionId = `sess_${randomUUID().replace(/-/g, '').slice(0, 12)}`;\n    const timeout = Math.min(\n      request.timeout ?? this.options.defaultTimeout,\n      this.options.maxTimeout\n    );\n\n    const config: SessionConfig = {\n      command: request.command,\n      args: request.args ?? [],\n      workdir,\n      env: request.env ?? {},\n      timeout,\n    };\n\n    // Create session\n    const session = new TerminalSession(sessionId, userId, config, env);\n\n    // Track session\n    this.sessions.set(sessionId, session);\n    if (!this.userSessions.has(userId)) {\n      this.userSessions.set(userId, new Set());\n    }\n    this.userSessions.get(userId)!.add(sessionId);\n\n    // Clean up on exit\n    session.on('exit', () => {\n      this.removeSession(sessionId);\n    });\n\n    this.logger.info(`Created terminal session ${sessionId} for user ${userId} in ${workdir}`);\n    return session;\n  }\n\n  /**\n   * Get a session by ID\n   */\n  getSession(sessionId: string): TerminalSession | undefined {\n    return this.sessions.get(sessionId);\n  }\n\n  /**\n   * Get all sessions for a user\n   */\n  getUserSessions(userId: string): TerminalSession[] {\n    const sessionIds = this.userSessions.get(userId);\n    if (!sessionIds) {\n      return [];\n    }\n    return Array.from(sessionIds)\n      .map(id => this.sessions.get(id))\n      .filter((s): s is TerminalSession => s !== undefined);\n  }\n\n  /**\n   * Terminate a session\n   */\n  terminateSession(sessionId: string): boolean {\n    const session = this.sessions.get(sessionId);\n    if (!session) {\n      return false;\n    }\n    session.terminate();\n    return true;\n  }\n\n  /**\n   * Remove a session from tracking\n   */\n  private removeSession(sessionId: string): void {\n    const session = this.sessions.get(sessionId);\n    if (session) {\n      this.sessions.delete(sessionId);\n      const userSessionIds = this.userSessions.get(session.userId);\n      if (userSessionIds) {\n        userSessionIds.delete(sessionId);\n        if (userSessionIds.size === 0) {\n          this.userSessions.delete(session.userId);\n        }\n      }\n      this.logger.debug(`Removed terminal session ${sessionId}`);\n    }\n  }\n\n  /**\n   * Get session statistics\n   */\n  getStats(): { totalSessions: number; activeUsers: number } {\n    return {\n      totalSessions: this.sessions.size,\n      activeUsers: this.userSessions.size,\n    };\n  }\n\n  /**\n   * Terminate all sessions (for shutdown)\n   */\n  terminateAll(): void {\n    for (const session of this.sessions.values()) {\n      session.terminate();\n    }\n    this.sessions.clear();\n    this.userSessions.clear();\n  }\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@undefineds.co/xpod",
-  "version": "0.3.18",
+  "version": "0.3.23",
   "description": "Xpod is an extended Community Solid Server, offering rich-feature, production-level Solid Pod and identity management.",
   "repository": "https://github.com/undefinedsco/xpod",
   "author": "developer@undefineds.co",

package/dist/storage/rdf/Rdf3xTripleIndex.d.ts

@@ -1,55 +0,0 @@
-import type { Rdf3xCardinalityEstimate, Rdf3xIndexStats, Rdf3xJoinOptions, Rdf3xJoinScanResult, Rdf3xRebuildResult, Rdf3xTripleIndexOptions, Rdf3xTriplePattern, Rdf3xTripleScanOptions, Rdf3xTripleScanResult, RdfIndexSpaceObject, RdfQuadJoinPattern } from './types';
-export declare class Rdf3xTripleIndex {
-    private readonly options;
-    private readonly sqliteRuntime;
-    private db;
-    private dictionary;
-    constructor(options: Rdf3xTripleIndexOptions);
-    open(): void;
-    close(): void;
-    clear(): void;
-    rebuildFromCurrentQuads(): Rdf3xRebuildResult;
-    scan(pattern: Rdf3xTriplePattern, options?: Rdf3xTripleScanOptions): Rdf3xTripleScanResult;
-    joinPatterns(patterns: RdfQuadJoinPattern[], options?: Rdf3xJoinOptions): Rdf3xJoinScanResult;
-    estimateCardinality(pattern: Rdf3xTriplePattern): Rdf3xCardinalityEstimate;
-    stats(): Rdf3xIndexStats;
-    collectSpaceObjects(): RdfIndexSpaceObject[];
-    private initializeSchema;
-    private clearRdf3xTables;
-    private rebuildPairProjection;
-    private rebuildTermProjection;
-    private compileScanSql;
-    private compileJoinPatterns;
-    private joinSourceSql;
-    private buildJoinOrderClause;
-    private buildOrderClause;
-    private chooseJoinStart;
-    private compareJoinSources;
-    private estimateResolvedCardinality;
-    private resolveJoinPattern;
-    private joinMetrics;
-    private joinRowsToBindings;
-    private buildPagination;
-    private estimateExactTriple;
-    private estimatePairProjection;
-    private estimateTermProjection;
-    private estimateMembershipCardinality;
-    private estimateResolvedMembershipCardinality;
-    private buildMembershipWhere;
-    private pairProjectionFor;
-    private resolvePattern;
-    private estimateNumericObjectRangeCardinality;
-    private resolveNumericObjectRange;
-    private numericValueForPattern;
-    private choosePermutation;
-    private permutation;
-    private rowsToQuads;
-    private rowCount;
-    private collectPageCount;
-    private estimateDatabaseBytes;
-    private estimateSpaceObjectsFromSchema;
-    private estimatePageSize;
-    private metrics;
-    private requireDb;
-    private requireDictionary;
-}