kastell 1.17.0 → 2.0.0

package/dist/core/audit/snapshot.d.ts

@@ -4,7 +4,211 @@
  * Schema v2 adds auditVersion to the audit envelope.
  * V1 snapshots are auto-migrated on load (auditVersion defaults to "1.0.0").
  */
+import { z } from "zod";
 import type { AuditResult, SnapshotFile, SnapshotListEntry } from "./types.js";
+export declare const auditCheckSchema: z.ZodObject<{
+    id: z.ZodString;
+    category: z.ZodString;
+    name: z.ZodString;
+    severity: z.ZodEnum<{
+        info: "info";
+        critical: "critical";
+        warning: "warning";
+    }>;
+    passed: z.ZodBoolean;
+    currentValue: z.ZodString;
+    expectedValue: z.ZodString;
+    fixCommand: z.ZodOptional<z.ZodString>;
+    explain: z.ZodOptional<z.ZodString>;
+    complianceRefs: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        framework: z.ZodString;
+        controlId: z.ZodString;
+        version: z.ZodString;
+        description: z.ZodString;
+        coverage: z.ZodEnum<{
+            full: "full";
+            partial: "partial";
+        }>;
+        level: z.ZodOptional<z.ZodEnum<{
+            L1: "L1";
+            L2: "L2";
+        }>>;
+    }, z.core.$strip>>>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    vpsIrrelevant: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const categorySchema: z.ZodObject<{
+    name: z.ZodString;
+    checks: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        category: z.ZodString;
+        name: z.ZodString;
+        severity: z.ZodEnum<{
+            info: "info";
+            critical: "critical";
+            warning: "warning";
+        }>;
+        passed: z.ZodBoolean;
+        currentValue: z.ZodString;
+        expectedValue: z.ZodString;
+        fixCommand: z.ZodOptional<z.ZodString>;
+        explain: z.ZodOptional<z.ZodString>;
+        complianceRefs: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            framework: z.ZodString;
+            controlId: z.ZodString;
+            version: z.ZodString;
+            description: z.ZodString;
+            coverage: z.ZodEnum<{
+                full: "full";
+                partial: "partial";
+            }>;
+            level: z.ZodOptional<z.ZodEnum<{
+                L1: "L1";
+                L2: "L2";
+            }>>;
+        }, z.core.$strip>>>;
+        tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        vpsIrrelevant: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    score: z.ZodNumber;
+    maxScore: z.ZodNumber;
+    connectionError: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const quickWinSchema: z.ZodObject<{
+    commands: z.ZodArray<z.ZodString>;
+    currentScore: z.ZodNumber;
+    projectedScore: z.ZodNumber;
+    description: z.ZodString;
+}, z.core.$strip>;
+/** Schema v1 — legacy format, no auditVersion field */
+export declare const snapshotFileV1Schema: z.ZodObject<{
+    audit: z.ZodObject<{
+        serverName: z.ZodString;
+        serverIp: z.ZodString;
+        platform: z.ZodEnum<{
+            coolify: "coolify";
+            dokploy: "dokploy";
+            bare: "bare";
+        }>;
+        timestamp: z.ZodString;
+        overallScore: z.ZodNumber;
+        categories: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            checks: z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                category: z.ZodString;
+                name: z.ZodString;
+                severity: z.ZodEnum<{
+                    info: "info";
+                    critical: "critical";
+                    warning: "warning";
+                }>;
+                passed: z.ZodBoolean;
+                currentValue: z.ZodString;
+                expectedValue: z.ZodString;
+                fixCommand: z.ZodOptional<z.ZodString>;
+                explain: z.ZodOptional<z.ZodString>;
+                complianceRefs: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    framework: z.ZodString;
+                    controlId: z.ZodString;
+                    version: z.ZodString;
+                    description: z.ZodString;
+                    coverage: z.ZodEnum<{
+                        full: "full";
+                        partial: "partial";
+                    }>;
+                    level: z.ZodOptional<z.ZodEnum<{
+                        L1: "L1";
+                        L2: "L2";
+                    }>>;
+                }, z.core.$strip>>>;
+                tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                vpsIrrelevant: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strip>>;
+            score: z.ZodNumber;
+            maxScore: z.ZodNumber;
+            connectionError: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strip>>;
+        quickWins: z.ZodArray<z.ZodObject<{
+            commands: z.ZodArray<z.ZodString>;
+            currentScore: z.ZodNumber;
+            projectedScore: z.ZodNumber;
+            description: z.ZodString;
+        }, z.core.$strip>>;
+        skippedCategories: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        vpsType: z.ZodOptional<z.ZodString>;
+        vpsAdjustedCount: z.ZodOptional<z.ZodNumber>;
+        warnings: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>;
+    name: z.ZodOptional<z.ZodString>;
+    savedAt: z.ZodString;
+    schemaVersion: z.ZodLiteral<1>;
+}, z.core.$strip>;
+/** Schema v2 — includes auditVersion in audit object */
+export declare const snapshotFileV2Schema: z.ZodObject<{
+    audit: z.ZodObject<{
+        serverName: z.ZodString;
+        serverIp: z.ZodString;
+        platform: z.ZodEnum<{
+            coolify: "coolify";
+            dokploy: "dokploy";
+            bare: "bare";
+        }>;
+        timestamp: z.ZodString;
+        overallScore: z.ZodNumber;
+        categories: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            checks: z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                category: z.ZodString;
+                name: z.ZodString;
+                severity: z.ZodEnum<{
+                    info: "info";
+                    critical: "critical";
+                    warning: "warning";
+                }>;
+                passed: z.ZodBoolean;
+                currentValue: z.ZodString;
+                expectedValue: z.ZodString;
+                fixCommand: z.ZodOptional<z.ZodString>;
+                explain: z.ZodOptional<z.ZodString>;
+                complianceRefs: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    framework: z.ZodString;
+                    controlId: z.ZodString;
+                    version: z.ZodString;
+                    description: z.ZodString;
+                    coverage: z.ZodEnum<{
+                        full: "full";
+                        partial: "partial";
+                    }>;
+                    level: z.ZodOptional<z.ZodEnum<{
+                        L1: "L1";
+                        L2: "L2";
+                    }>>;
+                }, z.core.$strip>>>;
+                tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                vpsIrrelevant: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strip>>;
+            score: z.ZodNumber;
+            maxScore: z.ZodNumber;
+            connectionError: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strip>>;
+        quickWins: z.ZodArray<z.ZodObject<{
+            commands: z.ZodArray<z.ZodString>;
+            currentScore: z.ZodNumber;
+            projectedScore: z.ZodNumber;
+            description: z.ZodString;
+        }, z.core.$strip>>;
+        skippedCategories: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        vpsType: z.ZodOptional<z.ZodString>;
+        vpsAdjustedCount: z.ZodOptional<z.ZodNumber>;
+        warnings: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        auditVersion: z.ZodString;
+    }, z.core.$strip>;
+    name: z.ZodOptional<z.ZodString>;
+    savedAt: z.ZodString;
+    schemaVersion: z.ZodLiteral<2>;
+}, z.core.$strip>;
 /**
  * Save an audit result as a snapshot.
  * Uses withFileLock + atomic write (tmp + rename) for safety.

package/dist/core/audit/snapshot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"snapshot.d.ts","sourceRoot":"","sources":["../../../src/core/audit/snapshot.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAcH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAgI/E;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,WAAW,EACnB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAsBf;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAS9B;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CA+BlF"}
+{"version":3,"file":"snapshot.d.ts","sourceRoot":"","sources":["../../../src/core/audit/snapshot.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAUH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAa/E,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAa3B,CAAC;AAEH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAMzB,CAAC;AAEH,eAAO,MAAM,cAAc;;;;;iBAKzB,CAAC;AAsBH,uDAAuD;AACvD,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAI/B,CAAC;AAEH,wDAAwD;AACxD,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAI/B,CAAC;AAqDH;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,WAAW,EACnB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAsBf;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAS9B;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CA+BlF"}

package/dist/core/audit/snapshot.js

@@ -4,10 +4,11 @@
  * Schema v2 adds auditVersion to the audit envelope.
  * V1 snapshots are auto-migrated on load (auditVersion defaults to "1.0.0").
  */
-import { readFileSync, writeFileSync, existsSync, mkdirSync, renameSync, readdirSync, } from "fs";
+import { readFileSync, existsSync, renameSync, readdirSync, } from "fs";
 import { join } from "path";
+import { secureMkdirSync, secureWriteFileSync } from "../../utils/secureWrite.js";
 import { z } from "zod";
-import { CONFIG_DIR } from "../../utils/config.js";
+import { KASTELL_DIR } from "../../utils/paths.js";
 import { withFileLock } from "../../utils/fileLock.js";
 const SCHEMA_VERSION = 2;
 const complianceRefSchema = z.object({
@@ -18,7 +19,7 @@ const complianceRefSchema = z.object({
     coverage: z.enum(["full", "partial"]),
     level: z.enum(["L1", "L2"]).optional(),
 });
-const auditCheckSchema = z.object({
+export const auditCheckSchema = z.object({
     id: z.string(),
     category: z.string(),
     name: z.string(),
@@ -32,14 +33,14 @@ const auditCheckSchema = z.object({
     tags: z.array(z.string()).optional(),
     vpsIrrelevant: z.boolean().optional(),
 });
-const categorySchema = z.object({
+export const categorySchema = z.object({
     name: z.string(),
     checks: z.array(auditCheckSchema),
     score: z.number(),
     maxScore: z.number(),
     connectionError: z.boolean().optional(),
 });
-const quickWinSchema = z.object({
+export const quickWinSchema = z.object({
     commands: z.array(z.string()),
     currentScore: z.number(),
     projectedScore: z.number(),
@@ -64,13 +65,13 @@ const snapshotEnvelopeBase = {
     savedAt: z.string(),
 };
 /** Schema v1 — legacy format, no auditVersion field */
-const snapshotFileV1Schema = z.object({
+export const snapshotFileV1Schema = z.object({
     schemaVersion: z.literal(1),
     ...snapshotEnvelopeBase,
     audit: baseAuditSchema,
 });
 /** Schema v2 — includes auditVersion in audit object */
-const snapshotFileV2Schema = z.object({
+export const snapshotFileV2Schema = z.object({
     schemaVersion: z.literal(2),
     ...snapshotEnvelopeBase,
     audit: baseAuditSchema.extend({ auditVersion: z.string() }),
@@ -78,7 +79,7 @@ const snapshotFileV2Schema = z.object({
 /** Get the snapshot directory for a server IP (dots replaced with hyphens) */
 function getSnapshotDir(serverIp) {
     const safeIp = serverIp.replace(/\./g, "-");
-    return join(CONFIG_DIR, "snapshots", safeIp);
+    return join(KASTELL_DIR, "snapshots", safeIp);
 }
 /** Sanitize a snapshot name: only [a-zA-Z0-9_-], max 64 chars */
 function sanitizeSnapshotName(name) {
@@ -133,7 +134,7 @@ export async function saveSnapshot(result, name) {
     const filename = buildFilename(result.timestamp, sanitizedName);
     const filePath = join(snapshotDir, filename);
     await withFileLock(filePath, () => {
-        mkdirSync(snapshotDir, { recursive: true, mode: 0o700 });
+        secureMkdirSync(snapshotDir, { recursive: true });
         const snapshotFile = {
             schemaVersion: SCHEMA_VERSION,
             savedAt: new Date().toISOString(),
@@ -143,7 +144,7 @@ export async function saveSnapshot(result, name) {
             snapshotFile.name = sanitizedName;
         }
         const tmpFile = filePath + ".tmp";
-        writeFileSync(tmpFile, JSON.stringify(snapshotFile, null, 2), "utf-8");
+        secureWriteFileSync(tmpFile, JSON.stringify(snapshotFile, null, 2), { encoding: "utf-8" });
         renameSync(tmpFile, filePath);
     });
 }

package/dist/core/audit/snapshot.js.map

@@ -1 +1 @@
-{"version":3,"file":"snapshot.js","sourceRoot":"","sources":["../../../src/core/audit/snapshot.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,YAAY,EACZ,aAAa,EACb,UAAU,EACV,SAAS,EACT,UAAU,EACV,WAAW,GACZ,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAGvD,MAAM,cAAc,GAAG,CAAC,CAAC;AAEzB,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACrC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACnB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE;IACvD,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpC,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;CACxB,CAAC,CAAC;AAEH,iDAAiD;AACjD,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;IACnC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;IAClC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACjD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG;IAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC;AAEF,uDAAuD;AACvD,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,GAAG,oBAAoB;IACvB,KAAK,EAAE,eAAe;CACvB,CAAC,CAAC;AAEH,wDAAwD;AACxD,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,GAAG,oBAAoB;IACvB,KAAK,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;CAC5D,CAAC,CAAC;AAEH,8EAA8E;AAC9E,SAAS,cAAc,CAAC,QAAgB;IACtC,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED,iEAAiE;AACjE,SAAS,oBAAoB,CAAC,IAAY;IACxC,OAAO,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,+EAA+E;AAC/E,SAAS,aAAa,CAAC,SAAiB,EAAE,IAAa;IACrD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC/C,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,GAAG,MAAM,IAAI,IAAI,OAAO,CAAC;IAClC,CAAC;IACD,OAAO,GAAG,MAAM,OAAO,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,GAAW;IACpC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,IAAI,GAAG,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,oBAAoB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAClD,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAE,EAAE,CAAC,IAAqB,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,CAAC;IACD,IAAI,GAAG,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,oBAAoB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;YACf,OAAO;gBACL,GAAG,EAAE,CAAC,IAAI;gBACV,aAAa,EAAE,CAAC;gBAChB,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE;aACnC,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAmB,EACnB,IAAa;IAEb,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,aAAa,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClF,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAE7C,MAAM,YAAY,CAAC,QAAQ,EAAE,GAAG,EAAE;QAChC,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAEzD,MAAM,YAAY,GAAiB;YACjC,aAAa,EAAE,cAAc;YAC7B,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACjC,KAAK,EAAE,MAAM;SACd,CAAC;QACF,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,YAAY,CAAC,IAAI,GAAG,aAAa,CAAC;QACpC,CAAC;QAED,MAAM,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;QAClC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACvE,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,QAAgB;IAEhB,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;IAE1D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5C,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAgB;IAClD,MAAM,WAAW,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAE7C,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAE3D,MAAM,OAAO,GAAwB,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QAC9D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;YAC/D,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACnE,CAAC;YACD,OAAO;gBACL,QAAQ;gBACR,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY;gBACrC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxD,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACnE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAE3D,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"snapshot.js","sourceRoot":"","sources":["../../../src/core/audit/snapshot.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,YAAY,EACZ,UAAU,EACV,UAAU,EACV,WAAW,GACZ,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAGvD,MAAM,cAAc,GAAG,CAAC,CAAC;AAEzB,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACrC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACnB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE;IACvD,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpC,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;CACxB,CAAC,CAAC;AAEH,iDAAiD;AACjD,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;IACnC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;IAClC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACjD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG;IAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC;AAEF,uDAAuD;AACvD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,GAAG,oBAAoB;IACvB,KAAK,EAAE,eAAe;CACvB,CAAC,CAAC;AAEH,wDAAwD;AACxD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,GAAG,oBAAoB;IACvB,KAAK,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;CAC5D,CAAC,CAAC;AAEH,8EAA8E;AAC9E,SAAS,cAAc,CAAC,QAAgB;IACtC,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,iEAAiE;AACjE,SAAS,oBAAoB,CAAC,IAAY;IACxC,OAAO,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,+EAA+E;AAC/E,SAAS,aAAa,CAAC,SAAiB,EAAE,IAAa;IACrD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC/C,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,GAAG,MAAM,IAAI,IAAI,OAAO,CAAC;IAClC,CAAC;IACD,OAAO,GAAG,MAAM,OAAO,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,GAAW;IACpC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,IAAI,GAAG,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,oBAAoB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAClD,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAE,EAAE,CAAC,IAAqB,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,CAAC;IACD,IAAI,GAAG,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,oBAAoB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;YACf,OAAO;gBACL,GAAG,EAAE,CAAC,IAAI;gBACV,aAAa,EAAE,CAAC;gBAChB,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE;aACnC,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAmB,EACnB,IAAa;IAEb,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,aAAa,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClF,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAE7C,MAAM,YAAY,CAAC,QAAQ,EAAE,GAAG,EAAE;QAChC,eAAe,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAElD,MAAM,YAAY,GAAiB;YACjC,aAAa,EAAE,cAAc;YAC7B,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACjC,KAAK,EAAE,MAAM;SACd,CAAC;QACF,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,YAAY,CAAC,IAAI,GAAG,aAAa,CAAC;QACpC,CAAC;QAED,MAAM,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;QAClC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3F,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,QAAgB;IAEhB,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;IAE1D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5C,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAgB;IAClD,MAAM,WAAW,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAE7C,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAE3D,MAAM,OAAO,GAAwB,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QAC9D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;YAC/D,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACnE,CAAC;YACD,OAAO;gBACL,QAAQ;gBACR,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY;gBACrC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxD,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACnE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAE3D,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/core/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/core/auth.ts"],"names":[],"mappings":"AA+CA,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAiBjE;AAED,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAM7D;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAWrD;AAED,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CAS9C;AAED,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/core/auth.ts"],"names":[],"mappings":"AAgDA,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAiBjE;AAED,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAM7D;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAWrD;AAED,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CAS9C;AAED,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C"}

package/dist/core/auth.js

@@ -1,6 +1,7 @@
 import { platform } from "os";
 import { join } from "path";
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";
+import { readFileSync, existsSync } from "fs";
+import { secureMkdirSync, secureWriteFileSync } from "../utils/secureWrite.js";
 import { SUPPORTED_PROVIDERS, PROVIDER_ENV_KEYS } from "../constants.js";
 import { IS_ANDROID, loadKeyring, isKeychainAvailable as _isKeychainAvailable, getKeychainEntry as _getKeychainEntry } from "../utils/keyring.js";
 import { encryptData, decryptData, getMachineKey, isEncryptedPayload } from "../utils/encryption.js";
@@ -27,10 +28,9 @@ function readTokensFile() {
 }
 function writeTokensFile(data) {
     try {
-        if (!existsSync(KASTELL_DIR))
-            mkdirSync(KASTELL_DIR, { recursive: true });
+        secureMkdirSync(KASTELL_DIR);
         const payload = encryptData(JSON.stringify(data), getMachineKey());
-        writeFileSync(TOKENS_FILE, JSON.stringify(payload, null, 2), { mode: 0o600 });
+        secureWriteFileSync(TOKENS_FILE, JSON.stringify(payload, null, 2));
         return true;
     }
     catch {

package/dist/core/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/core/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AAC9B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,mBAAmB,IAAI,oBAAoB,EAAE,gBAAgB,IAAI,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAClJ,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACrG,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,MAAM,YAAY,GAAG,SAAS,CAAC;AAC/B,IAAI,gBAAgB,GAAG,KAAK,CAAC;AAE7B,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;AAErD,SAAS,cAAc;IACrB,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;QAC1D,CAAC;QACD,oDAAoD;QACpD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,gFAAgF,CACjF,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAA4B;IACnD,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC;QACnE,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AAC3B,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAA6B,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,iBAAiB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,QAAgB,EAAE,KAAa;IACtD,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,QAA6B,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/E,IAAI,UAAU,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACjC,IAAI,QAAQ,EAAE,KAAK,OAAO,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAChD,gBAAgB,GAAG,IAAI,CAAC;YACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,qFAAqF,CACtF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;QACvB,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAC9C,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,QAAgB;IACvC,IAAI,UAAU,IAAI,CAAC,WAAW,EAAE;QAAE,OAAO,cAAc,EAAE,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC;IACjF,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,CAAC;QAAC,OAAO,KAAK,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC;IAAC,CAAC;IAChD,MAAM,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,QAA6B,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/E,IAAI,UAAU,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtB,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAC5C,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,QAAQ,IAAI,mBAAmB,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACjC,IAAI,KAAK;gBAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO,oBAAoB,CAAC,YAAY,CAAC,CAAC;AAC5C,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/core/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AAC9B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,mBAAmB,IAAI,oBAAoB,EAAE,gBAAgB,IAAI,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAClJ,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACrG,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,MAAM,YAAY,GAAG,SAAS,CAAC;AAC/B,IAAI,gBAAgB,GAAG,KAAK,CAAC;AAE7B,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;AAErD,SAAS,cAAc;IACrB,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;QAC1D,CAAC;QACD,oDAAoD;QACpD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,gFAAgF,CACjF,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAA4B;IACnD,IAAI,CAAC;QACH,eAAe,CAAC,WAAW,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC;QACnE,mBAAmB,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AAC3B,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAA6B,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,iBAAiB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,QAAgB,EAAE,KAAa;IACtD,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,QAA6B,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/E,IAAI,UAAU,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACjC,IAAI,QAAQ,EAAE,KAAK,OAAO,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAChD,gBAAgB,GAAG,IAAI,CAAC;YACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,qFAAqF,CACtF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;QACvB,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAC9C,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,QAAgB;IACvC,IAAI,UAAU,IAAI,CAAC,WAAW,EAAE;QAAE,OAAO,cAAc,EAAE,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC;IACjF,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,CAAC;QAAC,OAAO,KAAK,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC;IAAC,CAAC;IAChD,MAAM,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,QAA6B,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/E,IAAI,UAAU,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtB,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAC5C,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,QAAQ,IAAI,mBAAmB,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACjC,IAAI,KAAK;gBAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO,oBAAoB,CAAC,YAAY,CAAC,CAAC;AAC5C,CAAC"}

package/dist/core/backup-commands.d.ts

@@ -0,0 +1,15 @@
+/** Pure functions returning SshCommand values — no I/O. */
+import { type SshCommand } from "../utils/sshCommand.js";
+export declare function buildPgDumpCommand(): SshCommand;
+export declare function buildConfigTarCommand(): SshCommand;
+export declare function buildCleanupCommand(): SshCommand;
+export declare function buildCoolifyVersionCommand(): SshCommand;
+export declare function buildStopCoolifyCommand(): SshCommand;
+export declare function buildStartCoolifyCommand(): SshCommand;
+export declare function buildStartDbCommand(): SshCommand;
+export declare function buildRestoreDbCommand(): SshCommand;
+export declare function buildRestoreConfigCommand(): SshCommand;
+export declare function buildBareConfigTarCommand(): SshCommand;
+export declare function buildBareRestoreConfigCommand(): SshCommand;
+export declare function buildBareCleanupCommand(): SshCommand;
+//# sourceMappingURL=backup-commands.d.ts.map

package/dist/core/backup-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-commands.d.ts","sourceRoot":"","sources":["../../src/core/backup-commands.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAE3D,OAAO,EAAO,KAAK,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAM9D,wBAAgB,kBAAkB,IAAI,UAAU,CAE/C;AAED,wBAAgB,qBAAqB,IAAI,UAAU,CAElD;AAED,wBAAgB,mBAAmB,IAAI,UAAU,CAEhD;AAED,wBAAgB,0BAA0B,IAAI,UAAU,CAEvD;AAID,wBAAgB,uBAAuB,IAAI,UAAU,CAEpD;AAED,wBAAgB,wBAAwB,IAAI,UAAU,CAErD;AAED,wBAAgB,mBAAmB,IAAI,UAAU,CAEhD;AAED,wBAAgB,qBAAqB,IAAI,UAAU,CAElD;AAED,wBAAgB,yBAAyB,IAAI,UAAU,CAEtD;AAKD,wBAAgB,yBAAyB,IAAI,UAAU,CAYtD;AAED,wBAAgB,6BAA6B,IAAI,UAAU,CAE1D;AAED,wBAAgB,uBAAuB,IAAI,UAAU,CAEpD"}

package/dist/core/backup-commands.js

@@ -0,0 +1,51 @@
+/** Pure functions returning SshCommand values — no I/O. */
+import { raw } from "../utils/sshCommand.js";
+const COOLIFY_COMPOSE = "cd /data/coolify/source && docker compose -f docker-compose.yml -f docker-compose.prod.yml";
+// ─── Coolify Backup Commands ─────────────────────────────────────────────────
+export function buildPgDumpCommand() {
+    return raw("set -o pipefail && docker exec coolify-db pg_dump -U coolify -d coolify | gzip > /tmp/coolify-backup.sql.gz");
+}
+export function buildConfigTarCommand() {
+    return raw("tar czf /tmp/coolify-config.tar.gz -C /data/coolify/source .env docker-compose.yml docker-compose.prod.yml 2>/dev/null || tar czf /tmp/coolify-config.tar.gz -C /data/coolify/source .env docker-compose.yml");
+}
+export function buildCleanupCommand() {
+    return raw("rm -f /tmp/coolify-backup.sql.gz /tmp/coolify-config.tar.gz");
+}
+export function buildCoolifyVersionCommand() {
+    return raw("docker inspect coolify --format '{{.Config.Image}}' 2>/dev/null | sed 's/.*://' || echo unknown");
+}
+// ─── Coolify Restore Commands ────────────────────────────────────────────────
+export function buildStopCoolifyCommand() {
+    return raw(`${COOLIFY_COMPOSE} stop`);
+}
+export function buildStartCoolifyCommand() {
+    return raw(`${COOLIFY_COMPOSE} up -d`);
+}
+export function buildStartDbCommand() {
+    return raw(`${COOLIFY_COMPOSE} up -d postgres && sleep 3`);
+}
+export function buildRestoreDbCommand() {
+    return raw("gunzip -c /tmp/coolify-backup.sql.gz | docker exec -i coolify-db psql -U coolify -d coolify");
+}
+export function buildRestoreConfigCommand() {
+    return raw("tar xzf /tmp/coolify-config.tar.gz -C /data/coolify/source");
+}
+// ─── Bare Server Backup Commands ─────────────────────────────────────────────
+export function buildBareConfigTarCommand() {
+    return raw("tar czf /tmp/bare-config.tar.gz --ignore-failed-read " +
+        "-C / " +
+        "etc/nginx " +
+        "etc/ssh/sshd_config " +
+        "etc/ufw " +
+        "etc/fail2ban " +
+        "etc/crontab " +
+        "etc/apt/apt.conf.d/50unattended-upgrades " +
+        "2>/dev/null || tar czf /tmp/bare-config.tar.gz --ignore-failed-read -C / etc/ssh/sshd_config");
+}
+export function buildBareRestoreConfigCommand() {
+    return raw("tar xzf /tmp/bare-config.tar.gz -C /");
+}
+export function buildBareCleanupCommand() {
+    return raw("rm -f /tmp/bare-config.tar.gz");
+}
+//# sourceMappingURL=backup-commands.js.map

package/dist/core/backup-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-commands.js","sourceRoot":"","sources":["../../src/core/backup-commands.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAE3D,OAAO,EAAE,GAAG,EAAmB,MAAM,wBAAwB,CAAC;AAE9D,MAAM,eAAe,GAAG,4FAA4F,CAAC;AAErH,gFAAgF;AAEhF,MAAM,UAAU,kBAAkB;IAChC,OAAO,GAAG,CAAC,6GAA6G,CAAC,CAAC;AAC5H,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,OAAO,GAAG,CAAC,8MAA8M,CAAC,CAAC;AAC7N,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO,GAAG,CAAC,6DAA6D,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,OAAO,GAAG,CAAC,iGAAiG,CAAC,CAAC;AAChH,CAAC;AAED,gFAAgF;AAEhF,MAAM,UAAU,uBAAuB;IACrC,OAAO,GAAG,CAAC,GAAG,eAAe,OAAO,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,OAAO,GAAG,CAAC,GAAG,eAAe,QAAQ,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO,GAAG,CAAC,GAAG,eAAe,4BAA4B,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,OAAO,GAAG,CAAC,6FAA6F,CAAC,CAAC;AAC5G,CAAC;AAED,MAAM,UAAU,yBAAyB;IACvC,OAAO,GAAG,CAAC,4DAA4D,CAAC,CAAC;AAC3E,CAAC;AAGD,gFAAgF;AAEhF,MAAM,UAAU,yBAAyB;IACvC,OAAO,GAAG,CACR,uDAAuD;QACvD,OAAO;QACP,YAAY;QACZ,sBAAsB;QACtB,UAAU;QACV,eAAe;QACf,cAAc;QACd,2CAA2C;QAC3C,8FAA8F,CAC/F,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B;IAC3C,OAAO,GAAG,CAAC,sCAAsC,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,OAAO,GAAG,CAAC,+BAA+B,CAAC,CAAC;AAC9C,CAAC"}

package/dist/core/backup.d.ts

@@ -1,29 +1,7 @@
-import { type SshCommand } from "../utils/sshCommand.js";
 import type { BackupManifest, Platform, ServerRecord } from "../types/index.js";
+export * from "./backup-commands.js";
 export { formatTimestamp, getBackupDir } from "../utils/backupPath.js";
 export { scpDownload, scpUpload, assertSafePath } from "../utils/scp.js";
-export declare function buildPgDumpCommand(): SshCommand;
-export declare function buildConfigTarCommand(): SshCommand;
-export declare function buildCleanupCommand(): SshCommand;
-export declare function buildCoolifyVersionCommand(): SshCommand;
-export declare function buildStopCoolifyCommand(): SshCommand;
-export declare function buildStartCoolifyCommand(): SshCommand;
-export declare function buildStartDbCommand(): SshCommand;
-export declare function buildRestoreDbCommand(): SshCommand;
-export declare function buildRestoreConfigCommand(): SshCommand;
-export declare function listBackups(serverName: string): string[];
-export declare function loadManifest(backupPath: string): BackupManifest | undefined;
-export declare function listOrphanBackups(activeServerNames: string[]): string[];
-export declare function cleanupServerBackups(serverName: string): {
-    removed: boolean;
-    path: string;
-};
-export declare function buildBareConfigTarCommand(): SshCommand;
-export declare function buildBareRestoreConfigCommand(): SshCommand;
-export declare function buildBareCleanupCommand(): SshCommand;
-export declare function createBareBackup(ip: string, serverName: string, provider: string): Promise<BackupResult>;
-export declare function restoreBareBackup(ip: string, serverName: string, backupId: string): Promise<RestoreResult>;
-export declare function tryRestartCoolify(ip: string): Promise<void>;
 export interface BackupResult {
     success: boolean;
     backupPath?: string;
@@ -41,6 +19,16 @@ export interface RestoreResult {
     error?: string;
     hint?: string;
 }
+export declare function listBackups(serverName: string): string[];
+export declare function loadManifest(backupPath: string): BackupManifest | undefined;
+export declare function listOrphanBackups(activeServerNames: string[]): string[];
+export declare function cleanupServerBackups(serverName: string): {
+    removed: boolean;
+    path: string;
+};
+export declare function createBareBackup(ip: string, serverName: string, provider: string): Promise<BackupResult>;
+export declare function restoreBareBackup(ip: string, serverName: string, backupId: string): Promise<RestoreResult>;
+export declare function tryRestartCoolify(ip: string): Promise<void>;
 export declare function createBackup(ip: string, serverName: string, provider: string, platform?: Platform): Promise<BackupResult>;
 /**
  * Single entry point for backing up any server (bare or managed).

package/dist/core/backup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"backup.d.ts","sourceRoot":"","sources":["../../src/core/backup.ts"],"names":[],"mappings":"AAKA,OAAO,EAAO,KAAK,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAQhF,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEzE,wBAAgB,kBAAkB,IAAI,UAAU,CAE/C;AAED,wBAAgB,qBAAqB,IAAI,UAAU,CAElD;AAED,wBAAgB,mBAAmB,IAAI,UAAU,CAEhD;AAED,wBAAgB,0BAA0B,IAAI,UAAU,CAEvD;AAID,wBAAgB,uBAAuB,IAAI,UAAU,CAEpD;AAED,wBAAgB,wBAAwB,IAAI,UAAU,CAErD;AAED,wBAAgB,mBAAmB,IAAI,UAAU,CAEhD;AAED,wBAAgB,qBAAqB,IAAI,UAAU,CAElD;AAED,wBAAgB,yBAAyB,IAAI,UAAU,CAEtD;AAID,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAWxD;AAED,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAQ3E;AAED,wBAAgB,iBAAiB,CAAC,iBAAiB,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAavE;AAED,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAS3F;AAKD,wBAAgB,yBAAyB,IAAI,UAAU,CAYtD;AAED,wBAAgB,6BAA6B,IAAI,UAAU,CAE1D;AAED,wBAAgB,uBAAuB,IAAI,UAAU,CAEpD;AAID,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,YAAY,CAAC,CAkDvB;AAED,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,aAAa,CAAC,CAwDxB;AAID,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMjE;AAID,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAID,wBAAsB,YAAY,CAChC,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,QAAQ,GAAE,QAAoB,GAC7B,OAAO,CAAC,YAAY,CAAC,CAGvB;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAc9E;AAED,wBAAsB,aAAa,CACjC,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,aAAa,CAAC,CA6CxB"}
+{"version":3,"file":"backup.d.ts","sourceRoot":"","sources":["../../src/core/backup.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAYhF,cAAc,sBAAsB,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAGzE,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAQD,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAWxD;AAED,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAQ3E;AAED,wBAAgB,iBAAiB,CAAC,iBAAiB,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAavE;AAED,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAS3F;AAID,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,YAAY,CAAC,CAkDvB;AAED,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,aAAa,CAAC,CAsDxB;AAID,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMjE;AAID,wBAAsB,YAAY,CAChC,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,QAAQ,GAAE,QAAoB,GAC7B,OAAO,CAAC,YAAY,CAAC,CAGvB;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAc9E;AAED,wBAAsB,aAAa,CACjC,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,aAAa,CAAC,CA2CxB"}

package/dist/core/backup.js

@@ -1,44 +1,20 @@
-import { mkdirSync, existsSync, writeFileSync, readFileSync, readdirSync, rmSync } from "fs";
+import { existsSync, readFileSync, readdirSync, rmSync } from "fs";
 import { join, resolve } from "path";
 import { sshExec, assertValidIp } from "../utils/ssh.js";
-import { BACKUPS_DIR } from "../utils/config.js";
+import { BACKUPS_DIR } from "../utils/paths.js";
 import { getErrorMessage, mapSshError, sanitizeStderr } from "../utils/errorMapper.js";
-import { raw } from "../utils/sshCommand.js";
 import { getAdapter, resolvePlatform } from "../adapters/factory.js";
 import { isBareServer } from "../utils/modeGuard.js";
 import { debugLog } from "../utils/logger.js";
 import { formatTimestamp, getBackupDir } from "../utils/backupPath.js";
 import { scpDownload, scpUpload } from "../utils/scp.js";
-// Re-export from utils for backward compatibility
+import { secureMkdirSync, secureWriteFileSync } from "../utils/secureWrite.js";
+import { buildBareConfigTarCommand, buildBareRestoreConfigCommand, buildBareCleanupCommand, buildStartCoolifyCommand, } from "./backup-commands.js";
+export * from "./backup-commands.js";
 export { formatTimestamp, getBackupDir } from "../utils/backupPath.js";
 export { scpDownload, scpUpload, assertSafePath } from "../utils/scp.js";
-export function buildPgDumpCommand() {
-    return raw("docker exec coolify-db pg_dump -U coolify -d coolify | gzip > /tmp/coolify-backup.sql.gz");
-}
-export function buildConfigTarCommand() {
-    return raw("tar czf /tmp/coolify-config.tar.gz -C /data/coolify/source .env docker-compose.yml docker-compose.prod.yml 2>/dev/null || tar czf /tmp/coolify-config.tar.gz -C /data/coolify/source .env docker-compose.yml");
-}
-export function buildCleanupCommand() {
-    return raw("rm -f /tmp/coolify-backup.sql.gz /tmp/coolify-config.tar.gz");
-}
-export function buildCoolifyVersionCommand() {
-    return raw("docker inspect coolify --format '{{.Config.Image}}' 2>/dev/null | sed 's/.*://' || echo unknown");
-}
-// ─── Pure Functions (Restore) ────────────────────────────────────────────────
-export function buildStopCoolifyCommand() {
-    return raw("cd /data/coolify/source && docker compose -f docker-compose.yml -f docker-compose.prod.yml stop");
-}
-export function buildStartCoolifyCommand() {
-    return raw("cd /data/coolify/source && docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d");
-}
-export function buildStartDbCommand() {
-    return raw("cd /data/coolify/source && docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d postgres && sleep 3");
-}
-export function buildRestoreDbCommand() {
-    return raw("gunzip -c /tmp/coolify-backup.sql.gz | docker exec -i coolify-db psql -U coolify -d coolify");
-}
-export function buildRestoreConfigCommand() {
-    return raw("tar xzf /tmp/coolify-config.tar.gz -C /data/coolify/source");
+function isPathTraversal(backupPath, baseDir) {
+    return !resolve(backupPath).startsWith(resolve(baseDir));
 }
 // ─── Semi-Pure Functions (FS Read) ───────────────────────────────────────────
 export function listBackups(serverName) {
@@ -94,24 +70,6 @@ export function cleanupServerBackups(serverName) {
         return { removed: false, path: dir };
     }
 }
-// ─── Pure Functions (Bare Backup) ────────────────────────────────────────────
-export function buildBareConfigTarCommand() {
-    return raw("tar czf /tmp/bare-config.tar.gz --ignore-failed-read " +
-        "-C / " +
-        "etc/nginx " +
-        "etc/ssh/sshd_config " +
-        "etc/ufw " +
-        "etc/fail2ban " +
-        "etc/crontab " +
-        "etc/apt/apt.conf.d/50unattended-upgrades " +
-        "2>/dev/null || tar czf /tmp/bare-config.tar.gz --ignore-failed-read -C / etc/ssh/sshd_config");
-}
-export function buildBareRestoreConfigCommand() {
-    return raw("tar xzf /tmp/bare-config.tar.gz -C /");
-}
-export function buildBareCleanupCommand() {
-    return raw("rm -f /tmp/bare-config.tar.gz");
-}
 // ─── Async Wrappers (Bare) ────────────────────────────────────────────────────
 export async function createBareBackup(ip, serverName, provider) {
     assertValidIp(ip);
@@ -128,7 +86,7 @@ export async function createBareBackup(ip, serverName, provider) {
         // Step 2: Download
         const timestamp = formatTimestamp(new Date());
         const backupPath = join(getBackupDir(serverName), timestamp);
-        mkdirSync(backupPath, { recursive: true, mode: 0o700 });
+        secureMkdirSync(backupPath);
         const dl = await scpDownload(ip, "/tmp/bare-config.tar.gz", join(backupPath, "bare-config.tar.gz"));
         if (dl.code !== 0) {
             return {
@@ -146,7 +104,7 @@ export async function createBareBackup(ip, serverName, provider) {
             files: ["bare-config.tar.gz"],
             mode: "bare",
         };
-        writeFileSync(join(backupPath, "manifest.json"), JSON.stringify(manifest, null, 2), { mode: 0o600 });
+        secureWriteFileSync(join(backupPath, "manifest.json"), JSON.stringify(manifest, null, 2));
         // Step 4: Cleanup remote
         await sshExec(ip, buildBareCleanupCommand()).catch((e) => debugLog?.("bare backup cleanup failed:", e));
         return { success: true, backupPath, manifest };
@@ -164,8 +122,7 @@ export async function restoreBareBackup(ip, serverName, backupId) {
     assertValidIp(ip);
     const baseDir = getBackupDir(serverName);
     const backupPath = join(baseDir, backupId);
-    // Path traversal guard
-    if (!resolve(backupPath).startsWith(resolve(baseDir))) {
+    if (isPathTraversal(backupPath, baseDir)) {
         return { success: false, steps: [], error: "Invalid backupId: path traversal detected" };
     }
     const steps = [];
@@ -251,8 +208,7 @@ export async function restoreBackup(ip, serverName, backupId) {
     assertValidIp(ip);
     const baseDir = getBackupDir(serverName);
     const backupPath = join(baseDir, backupId);
-    // Path traversal guard
-    if (!resolve(backupPath).startsWith(resolve(baseDir))) {
+    if (isPathTraversal(backupPath, baseDir)) {
         return { success: false, steps: [], error: "Invalid backupId: path traversal detected" };
     }
     // Validate manifest