lucifer-gate 0.1.0-alpha.1

package/dist/server/domains/command-gateway/repository/database.js

@@ -0,0 +1,59 @@
+import Database from 'better-sqlite3';
+import { mkdirSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { createChildLogger } from '../../../lib/logger.js';
+const log = createChildLogger('database');
+let db = null;
+export function getDatabase(dataDir) {
+    if (db)
+        return db;
+    const dbPath = resolve(dataDir, 'lucifer.db');
+    mkdirSync(dirname(dbPath), { recursive: true });
+    log.info({ dbPath }, 'Opening SQLite database');
+    db = new Database(dbPath, { fileMustExist: false });
+    db.pragma('journal_mode = WAL');
+    db.pragma('busy_timeout = 5000');
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS approvals (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      command TEXT NOT NULL,
+      match_type TEXT NOT NULL CHECK (match_type IN ('exact', 'prefix')),
+      duration TEXT NOT NULL,
+      approved_at TEXT NOT NULL,
+      expires_at TEXT,
+      approved_by TEXT NOT NULL
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_approvals_command ON approvals (command);
+    CREATE INDEX IF NOT EXISTS idx_approvals_expires ON approvals (expires_at);
+
+    CREATE TABLE IF NOT EXISTS audit_log (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      ts TEXT NOT NULL,
+      type TEXT NOT NULL,
+      request_id TEXT NOT NULL,
+      command TEXT,
+      api_key_name TEXT,
+      ip TEXT,
+      rule_action TEXT,
+      duration TEXT,
+      approved_by TEXT,
+      exit_code INTEGER,
+      duration_ms INTEGER,
+      error TEXT
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_audit_request_id ON audit_log (request_id);
+    CREATE INDEX IF NOT EXISTS idx_audit_ts ON audit_log (ts);
+  `);
+    log.info('Database schema initialized');
+    return db;
+}
+export function closeDatabase() {
+    if (db) {
+        db.close();
+        db = null;
+        log.info('Database closed');
+    }
+}
+//# sourceMappingURL=database.js.map

package/dist/server/domains/command-gateway/repository/database.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database.js","sourceRoot":"","sources":["../../../../../server/src/domains/command-gateway/repository/database.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,MAAM,GAAG,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;AAE1C,IAAI,EAAE,GAA6B,IAAI,CAAC;AAExC,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC;IAElB,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC9C,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEhD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC;IAChD,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAChC,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAEjC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCP,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IACxC,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,IAAI,EAAE,EAAE,CAAC;QACP,EAAE,CAAC,KAAK,EAAE,CAAC;QACX,EAAE,GAAG,IAAI,CAAC;QACV,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC"}

package/dist/server/domains/command-gateway/repository/pending_request_store.js

@@ -0,0 +1,61 @@
+import { createChildLogger } from '../../../lib/logger.js';
+const log = createChildLogger('pending-requests');
+export function createPendingRequestStore() {
+    const store = new Map();
+    return {
+        add(request) {
+            store.set(request.requestId, request);
+            log.debug({ requestId: request.requestId, command: request.command }, 'Pending request added');
+        },
+        resolve(requestId, decision) {
+            const pending = store.get(requestId);
+            if (!pending) {
+                log.debug({ requestId }, 'Resolve called for unknown/expired request');
+                return false;
+            }
+            pending.resolve(decision);
+            store.delete(requestId);
+            log.info({ requestId, decision }, 'Pending request resolved');
+            return true;
+        },
+        get(requestId) {
+            return store.get(requestId);
+        },
+        remove(requestId) {
+            const pending = store.get(requestId);
+            if (pending) {
+                pending.abortController.abort();
+                store.delete(requestId);
+            }
+        },
+        findByCommand(command, apiKeyName) {
+            for (const pending of store.values()) {
+                if (pending.command === command && pending.apiKeyName === apiKeyName) {
+                    return pending;
+                }
+            }
+            return undefined;
+        },
+        cleanup(maxAgeMs) {
+            const now = Date.now();
+            let removed = 0;
+            for (const [id, pending] of store.entries()) {
+                const age = now - new Date(pending.createdAt).getTime();
+                if (age > maxAgeMs) {
+                    pending.reject(new Error('Approval timed out'));
+                    pending.abortController.abort();
+                    store.delete(id);
+                    removed++;
+                }
+            }
+            if (removed > 0) {
+                log.info({ removed }, 'Stale pending requests cleaned up');
+            }
+            return removed;
+        },
+        size() {
+            return store.size;
+        },
+    };
+}
+//# sourceMappingURL=pending_request_store.js.map

package/dist/server/domains/command-gateway/repository/pending_request_store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending_request_store.js","sourceRoot":"","sources":["../../../../../server/src/domains/command-gateway/repository/pending_request_store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,MAAM,GAAG,GAAG,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;AAYlD,MAAM,UAAU,yBAAyB;IACvC,MAAM,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;IAEhD,OAAO;QACL,GAAG,CAAC,OAAuB;YACzB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACtC,GAAG,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,uBAAuB,CAAC,CAAC;QACjG,CAAC;QAED,OAAO,CAAC,SAAiB,EAAE,QAA0B;YACnD,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACrC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,GAAG,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,EAAE,4CAA4C,CAAC,CAAC;gBACvE,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC1B,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,0BAA0B,CAAC,CAAC;YAC9D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,GAAG,CAAC,SAAiB;YACnB,OAAO,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9B,CAAC;QAED,MAAM,CAAC,SAAiB;YACtB,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACrC,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;gBAChC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,aAAa,CAAC,OAAe,EAAE,UAAkB;YAC/C,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBACrC,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;oBACrE,OAAO,OAAO,CAAC;gBACjB,CAAC;YACH,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,CAAC,QAAgB;YACtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC5C,MAAM,GAAG,GAAG,GAAG,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;gBACxD,IAAI,GAAG,GAAG,QAAQ,EAAE,CAAC;oBACnB,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;oBAChD,OAAO,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;oBAChC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBACjB,OAAO,EAAE,CAAC;gBACZ,CAAC;YACH,CAAC;YACD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;gBAChB,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,mCAAmC,CAAC,CAAC;YAC7D,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,IAAI;YACF,OAAO,KAAK,CAAC,IAAI,CAAC;QACpB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/server/domains/command-gateway/service/analyze_command_risk.js

@@ -0,0 +1,44 @@
+const DANGER_PATTERNS = [
+    { pattern: /\|/, warning: 'Pipe (|) detected: output is passed to another command' },
+    { pattern: /&&/, warning: 'Chained command (&&): runs a second command on success' },
+    { pattern: /;/, warning: 'Semicolon (;): runs multiple commands sequentially' },
+    { pattern: /`[^`]*`/, warning: 'Backtick command substitution detected' },
+    { pattern: /\$\(/, warning: 'Command substitution $() detected' },
+    { pattern: />>?\s/, warning: 'Output redirect (>) detected: writes to file' },
+    { pattern: /<\s/, warning: 'Input redirect (<) detected' },
+    { pattern: /\brm\s+-r/, warning: 'Recursive delete (rm -r) detected' },
+    { pattern: /\bsudo\b/, warning: 'sudo: runs with elevated privileges' },
+    { pattern: /\bcurl\b.*\|\s*\b(bash|sh|zsh)\b/, warning: 'curl piped to shell: remote code execution' },
+    { pattern: /\beval\b/, warning: 'eval: executes dynamically constructed commands' },
+];
+const WARNING_PATTERNS = [
+    { pattern: /\bdd\b/, warning: 'dd: disk/device operations' },
+    { pattern: /\bchmod\b/, warning: 'chmod: changes file permissions' },
+    { pattern: /\bchown\b/, warning: 'chown: changes file ownership' },
+    { pattern: /\bmkfs\b/, warning: 'mkfs: formats filesystem' },
+    { pattern: /\bkill\b/, warning: 'kill: terminates processes' },
+];
+export function analyzeCommandRisk(command) {
+    const warnings = [];
+    let hasDanger = false;
+    for (const { pattern, warning } of DANGER_PATTERNS) {
+        if (pattern.test(command)) {
+            warnings.push(warning);
+            hasDanger = true;
+        }
+    }
+    for (const { pattern, warning } of WARNING_PATTERNS) {
+        if (pattern.test(command)) {
+            warnings.push(warning);
+        }
+    }
+    let level = 'safe';
+    if (hasDanger) {
+        level = 'danger';
+    }
+    else if (warnings.length > 0) {
+        level = 'warning';
+    }
+    return { level, warnings };
+}
+//# sourceMappingURL=analyze_command_risk.js.map

package/dist/server/domains/command-gateway/service/analyze_command_risk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyze_command_risk.js","sourceRoot":"","sources":["../../../../../server/src/domains/command-gateway/service/analyze_command_risk.ts"],"names":[],"mappings":"AAEA,MAAM,eAAe,GAAgD;IACnE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,wDAAwD,EAAE;IACpF,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,wDAAwD,EAAE;IACpF,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,oDAAoD,EAAE;IAC/E,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,wCAAwC,EAAE;IACzE,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,mCAAmC,EAAE;IACjE,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,8CAA8C,EAAE;IAC7E,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,6BAA6B,EAAE;IAC1D,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,mCAAmC,EAAE;IACtE,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,qCAAqC,EAAE;IACvE,EAAE,OAAO,EAAE,kCAAkC,EAAE,OAAO,EAAE,4CAA4C,EAAE;IACtG,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,iDAAiD,EAAE;CACpF,CAAC;AAEF,MAAM,gBAAgB,GAAgD;IACpE,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,4BAA4B,EAAE;IAC5D,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,iCAAiC,EAAE;IACpE,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,+BAA+B,EAAE;IAClE,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,0BAA0B,EAAE;IAC5D,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,4BAA4B,EAAE;CAC/D,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,KAAK,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,eAAe,EAAE,CAAC;QACnD,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;IACH,CAAC;IAED,KAAK,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,gBAAgB,EAAE,CAAC;QACpD,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,IAAI,KAAK,GAA+B,MAAM,CAAC;IAC/C,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,GAAG,QAAQ,CAAC;IACnB,CAAC;SAAM,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,KAAK,GAAG,SAAS,CAAC;IACpB,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC7B,CAAC"}

package/dist/server/domains/command-gateway/service/authenticate_request.js

@@ -0,0 +1,71 @@
+import { createChildLogger } from '../../../lib/logger.js';
+const log = createChildLogger('auth');
+export function createRateLimiter(maxPerMinute) {
+    return { counts: new Map(), maxPerMinute };
+}
+export function checkRateLimit(state, keyName) {
+    const now = Date.now();
+    const windowMs = 60_000;
+    const entry = state.counts.get(keyName);
+    if (!entry || now - entry.windowStart > windowMs) {
+        state.counts.set(keyName, { count: 1, windowStart: now });
+        return true;
+    }
+    entry.count++;
+    return entry.count <= state.maxPerMinute;
+}
+export function authenticateRequest(apiKeyStore, rateLimiter, rawKey, ip) {
+    if (!rawKey) {
+        log.warn({ ip }, 'Missing API key');
+        return {
+            ok: false,
+            statusCode: 401,
+            error: { code: 'MISSING_API_KEY', message: 'x-api-key header is required', retryable: false },
+        };
+    }
+    const keyConfig = apiKeyStore.findByKey(rawKey);
+    if (!keyConfig) {
+        log.warn({ ip }, 'Invalid API key');
+        return {
+            ok: false,
+            statusCode: 401,
+            error: { code: 'INVALID_API_KEY', message: 'Invalid API key', retryable: false },
+        };
+    }
+    if (keyConfig.allowedIps && keyConfig.allowedIps.length > 0) {
+        const allowed = keyConfig.allowedIps.some(allowedIp => {
+            if (allowedIp.includes('/')) {
+                return ipInCidr(ip, allowedIp);
+            }
+            return ip === allowedIp;
+        });
+        if (!allowed) {
+            log.warn({ ip, keyName: keyConfig.name }, 'IP not in allowlist');
+            return {
+                ok: false,
+                statusCode: 403,
+                error: { code: 'IP_NOT_ALLOWED', message: 'IP address not in allowlist', retryable: false },
+            };
+        }
+    }
+    if (!checkRateLimit(rateLimiter, keyConfig.name)) {
+        log.warn({ keyName: keyConfig.name, ip }, 'Rate limit exceeded');
+        return {
+            ok: false,
+            statusCode: 429,
+            error: { code: 'RATE_LIMITED', message: 'Rate limit exceeded. Try again later.', retryable: true },
+        };
+    }
+    return { ok: true, keyConfig };
+}
+function ipInCidr(ip, cidr) {
+    const [network, bits] = cidr.split('/');
+    const mask = ~(2 ** (32 - Number(bits)) - 1);
+    const ipNum = ipToInt(ip);
+    const netNum = ipToInt(network);
+    return (ipNum & mask) === (netNum & mask);
+}
+function ipToInt(ip) {
+    return ip.split('.').reduce((acc, octet) => (acc << 8) + Number(octet), 0) >>> 0;
+}
+//# sourceMappingURL=authenticate_request.js.map

package/dist/server/domains/command-gateway/service/authenticate_request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticate_request.js","sourceRoot":"","sources":["../../../../../server/src/domains/command-gateway/service/authenticate_request.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;AAOtC,MAAM,UAAU,iBAAiB,CAAC,YAAoB;IACpD,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,YAAY,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAqB,EAAE,OAAe;IACnE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,QAAQ,GAAG,MAAM,CAAC;IACxB,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAExC,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,WAAW,GAAG,QAAQ,EAAE,CAAC;QACjD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,OAAO,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,YAAY,CAAC;AAC3C,CAAC;AAWD,MAAM,UAAU,mBAAmB,CACjC,WAAwB,EACxB,WAA2B,EAC3B,MAA0B,EAC1B,EAAU;IAEV,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC;QACpC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,UAAU,EAAE,GAAG;YACf,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,8BAA8B,EAAE,SAAS,EAAE,KAAK,EAAE;SAC9F,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC;QACpC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,UAAU,EAAE,GAAG;YACf,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,KAAK,EAAE;SACjF,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,CAAC,UAAU,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE;YACpD,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,OAAO,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YACjC,CAAC;YACD,OAAO,EAAE,KAAK,SAAS,CAAC;QAC1B,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,EAAE,EAAE,qBAAqB,CAAC,CAAC;YACjE,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,GAAG;gBACf,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,6BAA6B,EAAE,SAAS,EAAE,KAAK,EAAE;aAC5F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,qBAAqB,CAAC,CAAC;QACjE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,UAAU,EAAE,GAAG;YACf,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,uCAAuC,EAAE,SAAS,EAAE,IAAI,EAAE;SACnG,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,QAAQ,CAAC,EAAU,EAAE,IAAY;IACxC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,OAAO,CAAC,EAAU;IACzB,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;AACnF,CAAC"}

package/dist/server/domains/command-gateway/service/auto_approve_channel.js

@@ -0,0 +1,24 @@
+import { createChildLogger } from '../../../lib/logger.js';
+const log = createChildLogger('auto-approve');
+export function createAutoApproveChannel() {
+    return {
+        async requestApproval(command, apiKeyName, ip, requestId, riskAnalysis) {
+            log.info({ requestId, command, apiKeyName, ip, risk: riskAnalysis.level }, 'AUTO-APPROVE: Command approved without Telegram');
+            if (riskAnalysis.warnings.length > 0) {
+                log.warn({ requestId, warnings: riskAnalysis.warnings }, 'Risk warnings (auto-approved)');
+            }
+            const decision = 'approved';
+            const matchType = 'exact';
+            const duration = '2';
+            return { decision, matchType, duration };
+        },
+        async start() {
+            log.warn('Running in AUTO-APPROVE mode. All commands will be approved without Telegram confirmation.');
+            log.warn('This mode is for development only. Do not use in production.');
+        },
+        async stop() {
+            // nothing to clean up
+        },
+    };
+}
+//# sourceMappingURL=auto_approve_channel.js.map

package/dist/server/domains/command-gateway/service/auto_approve_channel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto_approve_channel.js","sourceRoot":"","sources":["../../../../../server/src/domains/command-gateway/service/auto_approve_channel.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,MAAM,GAAG,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAC;AAE9C,MAAM,UAAU,wBAAwB;IACtC,OAAO;QACL,KAAK,CAAC,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,YAAY;YACpE,GAAG,CAAC,IAAI,CACN,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,EAAE,EAChE,iDAAiD,CAClD,CAAC;YACF,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,EAAE,+BAA+B,CAAC,CAAC;YAC5F,CAAC;YACD,MAAM,QAAQ,GAAqB,UAAU,CAAC;YAC9C,MAAM,SAAS,GAAsB,OAAO,CAAC;YAC7C,MAAM,QAAQ,GAAG,GAAG,CAAC;YACrB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAC3C,CAAC;QAED,KAAK,CAAC,KAAK;YACT,GAAG,CAAC,IAAI,CAAC,4FAA4F,CAAC,CAAC;YACvG,GAAG,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;QAC3E,CAAC;QAED,KAAK,CAAC,IAAI;YACR,sBAAsB;QACxB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/server/domains/command-gateway/service/execute_command.js

@@ -0,0 +1,139 @@
+import { spawn } from 'node:child_process';
+import { createChildLogger } from '../../../lib/logger.js';
+const log = createChildLogger('executor');
+let activeExecutions = 0;
+export async function executeCommand(options) {
+    const { command, requestId, cwd, timeoutMs, maxOutputBytes, maxConcurrent, abortSignal } = options;
+    if (activeExecutions >= maxConcurrent) {
+        log.warn({ requestId, active: activeExecutions, max: maxConcurrent }, 'Max concurrent executions reached');
+        return {
+            requestId,
+            status: 'failed',
+            error: 'Too many concurrent commands. Try again later.',
+        };
+    }
+    activeExecutions++;
+    const startTime = Date.now();
+    log.info({ requestId, command, cwd }, 'Executing command');
+    try {
+        return await new Promise((resolve) => {
+            const child = spawn(command, { shell: true, cwd: cwd ?? process.cwd(), detached: true });
+            let stdout = '';
+            let stderr = '';
+            let outputBytes = 0;
+            let killed = false;
+            const timer = setTimeout(() => {
+                killed = true;
+                try {
+                    process.kill(-child.pid, 'SIGKILL');
+                }
+                catch {
+                    child.kill('SIGKILL');
+                }
+                log.warn({ requestId, timeoutMs }, 'Command timed out');
+            }, timeoutMs);
+            const onAbort = () => {
+                killed = true;
+                try {
+                    process.kill(-child.pid, 'SIGKILL');
+                }
+                catch {
+                    child.kill('SIGKILL');
+                }
+                clearTimeout(timer);
+                log.info({ requestId }, 'Command aborted (client disconnected)');
+            };
+            if (abortSignal) {
+                if (abortSignal.aborted) {
+                    try {
+                        process.kill(-child.pid, 'SIGKILL');
+                    }
+                    catch {
+                        child.kill('SIGKILL');
+                    }
+                    clearTimeout(timer);
+                    resolve({ requestId, status: 'failed', error: 'Request aborted' });
+                    return;
+                }
+                abortSignal.addEventListener('abort', onAbort, { once: true });
+            }
+            child.stdout.on('data', (chunk) => {
+                outputBytes += chunk.length;
+                if (outputBytes <= maxOutputBytes) {
+                    stdout += chunk.toString();
+                }
+                else if (!killed) {
+                    killed = true;
+                    try {
+                        process.kill(-child.pid, 'SIGKILL');
+                    }
+                    catch {
+                        child.kill('SIGKILL');
+                    }
+                    clearTimeout(timer);
+                    log.warn({ requestId, outputBytes, maxOutputBytes }, 'Output buffer exceeded');
+                }
+            });
+            child.stderr.on('data', (chunk) => {
+                outputBytes += chunk.length;
+                if (outputBytes <= maxOutputBytes) {
+                    stderr += chunk.toString();
+                }
+            });
+            child.on('close', (code) => {
+                clearTimeout(timer);
+                if (abortSignal) {
+                    abortSignal.removeEventListener('abort', onAbort);
+                }
+                const durationMs = Date.now() - startTime;
+                if (killed && outputBytes > maxOutputBytes) {
+                    resolve({
+                        requestId,
+                        status: 'failed',
+                        stdout: stdout.slice(0, maxOutputBytes),
+                        stderr,
+                        durationMs,
+                        error: `Output exceeded ${maxOutputBytes} bytes limit`,
+                    });
+                    return;
+                }
+                if (killed) {
+                    resolve({
+                        requestId,
+                        status: 'timed_out',
+                        stdout,
+                        stderr,
+                        durationMs,
+                        error: `Command timed out after ${timeoutMs}ms`,
+                    });
+                    return;
+                }
+                resolve({
+                    requestId,
+                    status: code === 0 ? 'completed' : 'failed',
+                    exitCode: code ?? undefined,
+                    stdout,
+                    stderr,
+                    durationMs,
+                });
+                log.info({ requestId, exitCode: code, durationMs }, 'Command completed');
+            });
+            child.on('error', (err) => {
+                clearTimeout(timer);
+                if (abortSignal) {
+                    abortSignal.removeEventListener('abort', onAbort);
+                }
+                resolve({
+                    requestId,
+                    status: 'failed',
+                    error: `Failed to execute: ${err.message}`,
+                    durationMs: Date.now() - startTime,
+                });
+            });
+        });
+    }
+    finally {
+        activeExecutions--;
+    }
+}
+//# sourceMappingURL=execute_command.js.map

package/dist/server/domains/command-gateway/service/execute_command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execute_command.js","sourceRoot":"","sources":["../../../../../server/src/domains/command-gateway/service/execute_command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,MAAM,GAAG,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;AAE1C,IAAI,gBAAgB,GAAG,CAAC,CAAC;AAYzB,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAuB;IAC1D,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAEnG,IAAI,gBAAgB,IAAI,aAAa,EAAE,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,mCAAmC,CAAC,CAAC;QAC3G,OAAO;YACL,SAAS;YACT,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,gDAAgD;SACxD,CAAC;IACJ,CAAC;IAED,gBAAgB,EAAE,CAAC;IACnB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,mBAAmB,CAAC,CAAC;IAE3D,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,OAAO,CAAkB,CAAC,OAAO,EAAE,EAAE;YACpD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAEzF,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,WAAW,GAAG,CAAC,CAAC;YACpB,IAAI,MAAM,GAAG,KAAK,CAAC;YAEnB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,MAAM,GAAG,IAAI,CAAC;gBACd,IAAI,CAAC;oBAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAI,EAAE,SAAS,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAAC,CAAC;gBAC9E,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,mBAAmB,CAAC,CAAC;YAC1D,CAAC,EAAE,SAAS,CAAC,CAAC;YAEd,MAAM,OAAO,GAAG,GAAG,EAAE;gBACnB,MAAM,GAAG,IAAI,CAAC;gBACd,IAAI,CAAC;oBAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAI,EAAE,SAAS,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAAC,CAAC;gBAC9E,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,uCAAuC,CAAC,CAAC;YACnE,CAAC,CAAC;YAEF,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;oBACxB,IAAI,CAAC;wBAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAI,EAAE,SAAS,CAAC,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC;wBAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBAAC,CAAC;oBAC9E,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;oBACnE,OAAO;gBACT,CAAC;gBACD,WAAW,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACjE,CAAC;YAED,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBACxC,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC;gBAC5B,IAAI,WAAW,IAAI,cAAc,EAAE,CAAC;oBAClC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAC7B,CAAC;qBAAM,IAAI,CAAC,MAAM,EAAE,CAAC;oBACnB,MAAM,GAAG,IAAI,CAAC;oBACd,IAAI,CAAC;wBAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAI,EAAE,SAAS,CAAC,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC;wBAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBAAC,CAAC;oBAC9E,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE,wBAAwB,CAAC,CAAC;gBACjF,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBACxC,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC;gBAC5B,IAAI,WAAW,IAAI,cAAc,EAAE,CAAC;oBAClC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAC7B,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,IAAI,WAAW,EAAE,CAAC;oBAChB,WAAW,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACpD,CAAC;gBAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;gBAE1C,IAAI,MAAM,IAAI,WAAW,GAAG,cAAc,EAAE,CAAC;oBAC3C,OAAO,CAAC;wBACN,SAAS;wBACT,MAAM,EAAE,QAAQ;wBAChB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC;wBACvC,MAAM;wBACN,UAAU;wBACV,KAAK,EAAE,mBAAmB,cAAc,cAAc;qBACvD,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBAED,IAAI,MAAM,EAAE,CAAC;oBACX,OAAO,CAAC;wBACN,SAAS;wBACT,MAAM,EAAE,WAAW;wBACnB,MAAM;wBACN,MAAM;wBACN,UAAU;wBACV,KAAK,EAAE,2BAA2B,SAAS,IAAI;qBAChD,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBAED,OAAO,CAAC;oBACN,SAAS;oBACT,MAAM,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ;oBAC3C,QAAQ,EAAE,IAAI,IAAI,SAAS;oBAC3B,MAAM;oBACN,MAAM;oBACN,UAAU;iBACX,CAAC,CAAC;gBAEH,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,mBAAmB,CAAC,CAAC;YAC3E,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACxB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,IAAI,WAAW,EAAE,CAAC;oBAChB,WAAW,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACpD,CAAC;gBACD,OAAO,CAAC;oBACN,SAAS;oBACT,MAAM,EAAE,QAAQ;oBAChB,KAAK,EAAE,sBAAsB,GAAG,CAAC,OAAO,EAAE;oBAC1C,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACnC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,gBAAgB,EAAE,CAAC;IACrB,CAAC;AACH,CAAC"}

package/dist/server/domains/command-gateway/service/request_telegram_approval.js

@@ -0,0 +1,126 @@
+import { Telegraf, Markup } from 'telegraf';
+import { createChildLogger } from '../../../lib/logger.js';
+const log = createChildLogger('telegram');
+export function createTelegramApprovalChannel(token, chatId, pendingStore, approvalStore, auditLog) {
+    const bot = new Telegraf(token);
+    bot.on('callback_query', async (ctx) => {
+        const data = 'data' in ctx.callbackQuery ? ctx.callbackQuery.data : undefined;
+        if (!data)
+            return;
+        // Validate chat ID to prevent unauthorized approvals
+        const callbackChatId = ctx.callbackQuery.message?.chat?.id?.toString();
+        if (callbackChatId !== chatId) {
+            log.warn({ callbackChatId, expectedChatId: chatId }, 'Callback from unauthorized chat');
+            await ctx.answerCbQuery('Unauthorized');
+            return;
+        }
+        // Parse callback data: "action:requestId:matchType:duration"
+        const parts = data.split(':');
+        if (parts.length !== 4)
+            return;
+        const [action, requestId, matchType, duration] = parts;
+        const pending = pendingStore.get(requestId);
+        if (!pending) {
+            await ctx.answerCbQuery('Request expired or already decided');
+            await ctx.editMessageReplyMarkup(undefined);
+            return;
+        }
+        const decision = action === 'approve' ? 'approved' : 'denied';
+        if (decision === 'approved') {
+            const approvalCommand = matchType === 'prefix'
+                ? pending.command.split(/\s+/).slice(0, 2).join(' ')
+                : pending.command;
+            approvalStore.addApproval(approvalCommand, matchType, duration, `telegram:${ctx.callbackQuery.from.id}`);
+        }
+        auditLog.append({
+            ts: new Date().toISOString(),
+            type: decision === 'approved' ? 'approved' : 'denied',
+            requestId,
+            command: pending.command,
+            duration: decision === 'approved' ? duration : undefined,
+            approvedBy: `telegram:${ctx.callbackQuery.from.id}`,
+        });
+        pendingStore.resolve(requestId, decision);
+        const emoji = decision === 'approved' ? '\u2705' : '\u274c';
+        const label = decision === 'approved' ? `Approved (${matchType} ${duration}h)` : 'Denied';
+        await ctx.answerCbQuery(label);
+        await ctx.editMessageText(`${emoji} ${label}\n\n${pending.command}`);
+    });
+    return {
+        async requestApproval(command, apiKeyName, ip, requestId, riskAnalysis) {
+            let text = `\u{1f6a8} **Command Request**\n\n`;
+            text += `From: \`${apiKeyName}\` (${ip})\n`;
+            text += `ID: \`${requestId}\`\n\n`;
+            text += `\`\`\`\n${command}\n\`\`\``;
+            if (riskAnalysis.warnings.length > 0) {
+                const icon = riskAnalysis.level === 'danger' ? '\u{26a0}\ufe0f DANGER' : '\u{26a0}\ufe0f WARNING';
+                text += `\n\n${icon}:\n`;
+                text += riskAnalysis.warnings.map(w => `• ${w}`).join('\n');
+            }
+            const prefix = command.split(/\s+/).slice(0, 2).join(' ');
+            const keyboard = Markup.inlineKeyboard([
+                [
+                    Markup.button.callback('Exact 2h', `approve:${requestId}:exact:2`),
+                    Markup.button.callback('Exact 8h', `approve:${requestId}:exact:8`),
+                    Markup.button.callback('Exact \u221e', `approve:${requestId}:exact:permanent`),
+                ],
+                [
+                    Markup.button.callback(`"${prefix}" 2h`, `approve:${requestId}:prefix:2`),
+                    Markup.button.callback(`"${prefix}" 8h`, `approve:${requestId}:prefix:8`),
+                ],
+                [
+                    Markup.button.callback('\u274c Deny', `deny:${requestId}:exact:0`),
+                ],
+            ]);
+            await bot.telegram.sendMessage(chatId, text, {
+                parse_mode: 'Markdown',
+                ...keyboard,
+            });
+            auditLog.append({
+                ts: new Date().toISOString(),
+                type: 'telegram_sent',
+                requestId,
+                command,
+                apiKeyName,
+                ip,
+            });
+            log.info({ requestId, command, chatId }, 'Telegram approval request sent');
+            return new Promise((resolve, reject) => {
+                const pending = pendingStore.get(requestId);
+                if (!pending) {
+                    reject(new Error('Request not found in pending store'));
+                    return;
+                }
+                const originalResolve = pending.resolve;
+                const originalReject = pending.reject;
+                pending.resolve = (decision) => {
+                    const matchType = 'exact';
+                    const duration = 'unknown';
+                    originalResolve(decision);
+                    resolve({ decision, matchType, duration });
+                };
+                pending.reject = (reason) => {
+                    originalReject(reason);
+                    reject(reason);
+                };
+            });
+        },
+        async start() {
+            await bot.launch();
+            log.info('Telegram bot started');
+            // Startup health check
+            try {
+                await bot.telegram.sendMessage(chatId, '\u{1f7e2} Lucifer started. Approval channel active.');
+                log.info({ chatId }, 'Telegram health check passed');
+            }
+            catch (err) {
+                log.error({ chatId, err }, 'Failed to send startup message. Check LUCIFER_TELEGRAM_CHAT_ID.');
+            }
+        },
+        async stop() {
+            bot.stop('Shutdown');
+            log.info('Telegram bot stopped');
+        },
+    };
+}
+//# sourceMappingURL=request_telegram_approval.js.map

package/dist/server/domains/command-gateway/service/request_telegram_approval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request_telegram_approval.js","sourceRoot":"","sources":["../../../../../server/src/domains/command-gateway/service/request_telegram_approval.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAK5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,MAAM,GAAG,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;AAE1C,MAAM,UAAU,6BAA6B,CAC3C,KAAa,EACb,MAAc,EACd,YAAiC,EACjC,aAA4B,EAC5B,QAAkB;IAElB,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEhC,GAAG,CAAC,EAAE,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,MAAM,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9E,IAAI,CAAC,IAAI;YAAE,OAAO;QAElB,qDAAqD;QACrD,MAAM,cAAc,GAAG,GAAG,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;QACvE,IAAI,cAAc,KAAK,MAAM,EAAE,CAAC;YAC9B,GAAG,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,iCAAiC,CAAC,CAAC;YACxF,MAAM,GAAG,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QAED,6DAA6D;QAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC/B,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC;QAEvD,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,GAAG,CAAC,aAAa,CAAC,oCAAoC,CAAC,CAAC;YAC9D,MAAM,GAAG,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC;YAC5C,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAqB,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;QAEhF,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC5B,MAAM,eAAe,GAAG,SAAS,KAAK,QAAQ;gBAC5C,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBACpD,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;YAEpB,aAAa,CAAC,WAAW,CACvB,eAAe,EACf,SAA8B,EAC9B,QAAQ,EACR,YAAY,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,CACxC,CAAC;QACJ,CAAC;QAED,QAAQ,CAAC,MAAM,CAAC;YACd,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,IAAI,EAAE,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;YACrD,SAAS;YACT,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,QAAQ,EAAE,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;YACxD,UAAU,EAAE,YAAY,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE;SACpD,CAAC,CAAC;QAEH,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAE1C,MAAM,KAAK,GAAG,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC5D,MAAM,KAAK,GAAG,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,aAAa,SAAS,IAAI,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC1F,MAAM,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,GAAG,CAAC,eAAe,CACvB,GAAG,KAAK,IAAI,KAAK,OAAO,OAAO,CAAC,OAAO,EAAE,CAC1C,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,CAAC,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,YAAY;YACpE,IAAI,IAAI,GAAG,mCAAmC,CAAC;YAC/C,IAAI,IAAI,WAAW,UAAU,OAAO,EAAE,KAAK,CAAC;YAC5C,IAAI,IAAI,SAAS,SAAS,QAAQ,CAAC;YACnC,IAAI,IAAI,WAAW,OAAO,UAAU,CAAC;YAErC,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,wBAAwB,CAAC;gBAClG,IAAI,IAAI,OAAO,IAAI,KAAK,CAAC;gBACzB,IAAI,IAAI,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9D,CAAC;YAED,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1D,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,CAAC;gBACrC;oBACE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,WAAW,SAAS,UAAU,CAAC;oBAClE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,WAAW,SAAS,UAAU,CAAC;oBAClE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,WAAW,SAAS,kBAAkB,CAAC;iBAC/E;gBACD;oBACE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,MAAM,EAAE,WAAW,SAAS,WAAW,CAAC;oBACzE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,MAAM,EAAE,WAAW,SAAS,WAAW,CAAC;iBAC1E;gBACD;oBACE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,EAAE,QAAQ,SAAS,UAAU,CAAC;iBACnE;aACF,CAAC,CAAC;YAEH,MAAM,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,EAAE;gBAC3C,UAAU,EAAE,UAAU;gBACtB,GAAG,QAAQ;aACZ,CAAC,CAAC;YAEH,QAAQ,CAAC,MAAM,CAAC;gBACd,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC5B,IAAI,EAAE,eAAe;gBACrB,SAAS;gBACT,OAAO;gBACP,UAAU;gBACV,EAAE;aACH,CAAC,CAAC;YAEH,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,gCAAgC,CAAC,CAAC;YAE3E,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACrC,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC;oBACxD,OAAO;gBACT,CAAC;gBAED,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;gBACxC,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC;gBAEtC,OAAO,CAAC,OAAO,GAAG,CAAC,QAA0B,EAAE,EAAE;oBAC/C,MAAM,SAAS,GAAsB,OAAO,CAAC;oBAC7C,MAAM,QAAQ,GAAG,SAAS,CAAC;oBAC3B,eAAe,CAAC,QAAQ,CAAC,CAAC;oBAC1B,OAAO,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAC7C,CAAC,CAAC;gBAEF,OAAO,CAAC,MAAM,GAAG,CAAC,MAAa,EAAE,EAAE;oBACjC,cAAc,CAAC,MAAM,CAAC,CAAC;oBACvB,MAAM,CAAC,MAAM,CAAC,CAAC;gBACjB,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,KAAK;YACT,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;YACnB,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;YAEjC,uBAAuB;YACvB,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,qDAAqD,CAAC,CAAC;gBAC9F,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,8BAA8B,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,iEAAiE,CAAC,CAAC;YAChG,CAAC;QACH,CAAC;QAED,KAAK,CAAC,IAAI;YACR,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACrB,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACnC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/server/domains/command-gateway/types/command_types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=command_types.js.map

package/dist/server/domains/command-gateway/types/command_types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command_types.js","sourceRoot":"","sources":["../../../../../server/src/domains/command-gateway/types/command_types.ts"],"names":[],"mappings":""}

package/dist/server/domains/command-gateway/types/store_interfaces.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=store_interfaces.js.map

package/dist/server/domains/command-gateway/types/store_interfaces.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store_interfaces.js","sourceRoot":"","sources":["../../../../../server/src/domains/command-gateway/types/store_interfaces.ts"],"names":[],"mappings":""}

package/dist/server/domains/platform-api/api/register_health_routes.js

@@ -0,0 +1,6 @@
+export function registerHealthRoutes(app, getHealthReport) {
+    app.get('/api/health', (_request, response) => {
+        response.json(getHealthReport());
+    });
+}
+//# sourceMappingURL=register_health_routes.js.map

package/dist/server/domains/platform-api/api/register_health_routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register_health_routes.js","sourceRoot":"","sources":["../../../../../server/src/domains/platform-api/api/register_health_routes.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,oBAAoB,CAClC,GAAY,EACZ,eAAoC;IAEpC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,QAAiB,EAAE,QAAkB,EAAE,EAAE;QAC/D,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/server/domains/platform-api/config/server_config.js

@@ -0,0 +1,17 @@
+import path from 'node:path';
+function parsePort(value) {
+    const parsedPort = Number.parseInt(value ?? '3001', 10);
+    if (Number.isInteger(parsedPort) && parsedPort >= 1 && parsedPort <= 65535) {
+        return parsedPort;
+    }
+    return 3001;
+}
+export function getServerConfig() {
+    return {
+        appName: 'lucifer',
+        clientDistPath: path.resolve(process.cwd(), 'dist/client'),
+        environment: process.env.NODE_ENV ?? 'development',
+        port: parsePort(process.env.PORT),
+    };
+}
+//# sourceMappingURL=server_config.js.map

package/dist/server/domains/platform-api/config/server_config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server_config.js","sourceRoot":"","sources":["../../../../../server/src/domains/platform-api/config/server_config.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAA;AAS5B,SAAS,SAAS,CAAC,KAAyB;IAC1C,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,IAAI,MAAM,EAAE,EAAE,CAAC,CAAA;IAEvD,IAAI,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC,IAAI,UAAU,IAAI,KAAK,EAAE,CAAC;QAC3E,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO;QACL,OAAO,EAAE,SAAS;QAClB,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,CAAC;QAC1D,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,aAAa;QAClD,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;KAClC,CAAA;AACH,CAAC"}

package/dist/server/domains/platform-api/repository/runtime_metadata_repository.js

@@ -0,0 +1,7 @@
+export function createRuntimeMetadataRepository() {
+    return {
+        getCurrentTimestamp: () => new Date().toISOString(),
+        getNodeVersion: () => process.version,
+    };
+}
+//# sourceMappingURL=runtime_metadata_repository.js.map

package/dist/server/domains/platform-api/repository/runtime_metadata_repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime_metadata_repository.js","sourceRoot":"","sources":["../../../../../server/src/domains/platform-api/repository/runtime_metadata_repository.ts"],"names":[],"mappings":"AAKA,MAAM,UAAU,+BAA+B;IAC7C,OAAO;QACL,mBAAmB,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnD,cAAc,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO;KACtC,CAAA;AACH,CAAC"}