sdlc-agent-4-enterprise-server 1.0.0

package/dist/admin/services/kb-admin.service.js

@@ -0,0 +1,74 @@
+// KSA-286: KB Admin Service
+import { AdminErrorCode } from '../types/admin.types.js';
+export class KBAdminService {
+    db;
+    kbEngine;
+    constructor(db, kbEngine) {
+        this.db = db;
+        this.kbEngine = kbEngine;
+    }
+    listEntries(filters, pagination) {
+        // Delegate to KB engine with pagination
+        const result = this.kbEngine?.listEntries?.({ ...filters, page: pagination.page, size: pagination.size });
+        if (result)
+            return result;
+        return { items: [], pagination: { page: pagination.page, size: pagination.size, total: 0, totalPages: 0, hasNext: false, hasPrev: false } };
+    }
+    createLink(sourceId, targetId, linkType = 'related') {
+        // BR-10: Circular link detection (BFS)
+        if (this.hasCircularLink(sourceId, targetId))
+            throw { code: AdminErrorCode.CIRCULAR_LINK };
+        this.kbEngine?.createLink?.(sourceId, targetId, linkType);
+    }
+    removeLink(sourceId, targetId) { this.kbEngine?.removeLink?.(sourceId, targetId); }
+    updateTags(entryId, tags) {
+        // BR-06: validate tag format, BR-07: max 20
+        for (const tag of tags) {
+            if (!/^[a-z0-9-]{1,50}$/.test(tag))
+                throw { code: AdminErrorCode.VALIDATION_ERROR, message: `Invalid tag: ${tag}` };
+        }
+        if (tags.length > 20)
+            throw { code: AdminErrorCode.VALIDATION_ERROR, message: 'Max 20 tags' };
+        this.kbEngine?.updateTags?.(entryId, tags);
+    }
+    reviewPromotion(data, reviewerId) {
+        if (data.comment.length < 10)
+            throw { code: AdminErrorCode.COMMENT_TOO_SHORT };
+        const promo = this.db.prepare('SELECT * FROM kb_promotion_queue WHERE entry_id = ? AND status = ?').get(data.entryId, 'PENDING');
+        if (!promo)
+            throw { code: AdminErrorCode.PROMOTION_NOT_PENDING };
+        if (data.decision === 'APPROVE') {
+            this.db.prepare('UPDATE kb_promotion_queue SET status = ?, review_comment = ?, reviewed_by = ?, reviewed_at = datetime("now") WHERE promotion_id = ?').run('APPROVED', data.comment, reviewerId, promo.promotion_id);
+            this.kbEngine?.promoteEntry?.(data.entryId, data.targetTier || promo.target_tier);
+        }
+        else {
+            const cooldown = new Date(Date.now() + 7 * 24 * 60 * 60 * 1000).toISOString();
+            this.db.prepare('UPDATE kb_promotion_queue SET status = ?, review_comment = ?, reviewed_by = ?, reviewed_at = datetime("now"), cooldown_until = ? WHERE promotion_id = ?').run('REJECTED', data.comment, reviewerId, cooldown, promo.promotion_id);
+        }
+    }
+    listPromotions() {
+        return this.db.prepare('SELECT * FROM kb_promotion_queue WHERE status = ? ORDER BY created_at DESC').all('PENDING').map((r) => ({ promotionId: r.promotion_id, entryId: r.entry_id, sourceTier: r.source_tier, targetTier: r.target_tier, reason: r.reason, status: r.status, createdAt: r.created_at }));
+    }
+    getGraphData(filters) {
+        return this.kbEngine?.getGraphData?.(filters) || { nodes: [], edges: [], clusters: [], totalCount: 0 };
+    }
+    hasCircularLink(sourceId, targetId) {
+        const visited = new Set();
+        const queue = [targetId];
+        while (queue.length > 0) {
+            const current = queue.shift();
+            if (current === sourceId)
+                return true;
+            if (visited.has(current))
+                continue;
+            visited.add(current);
+            const linked = this.kbEngine?.getLinkedEntries?.(current) || [];
+            for (const entry of linked) {
+                if (!visited.has(entry.id))
+                    queue.push(entry.id);
+            }
+        }
+        return false;
+    }
+}
+//# sourceMappingURL=kb-admin.service.js.map

package/dist/admin/services/kb-admin.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kb-admin.service.js","sourceRoot":"","sources":["../../../src/admin/services/kb-admin.service.ts"],"names":[],"mappings":"AAAA,4BAA4B;AAC5B,OAAO,EAAuD,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAE9G,MAAM,OAAO,cAAc;IACL;IAAiB;IAArC,YAAoB,EAAO,EAAU,QAAa;QAA9B,OAAE,GAAF,EAAE,CAAK;QAAU,aAAQ,GAAR,QAAQ,CAAK;IAAG,CAAC;IAEtD,WAAW,CAAC,OAA0D,EAAE,UAA4B;QAClG,wCAAwC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1G,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC;IAC9I,CAAC;IAED,UAAU,CAAC,QAAgB,EAAE,QAAgB,EAAE,QAAQ,GAAG,SAAS;QACjE,uCAAuC;QACvC,IAAI,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC;YAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,aAAa,EAAE,CAAC;QAC3F,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC5D,CAAC;IAED,UAAU,CAAC,QAAgB,EAAE,QAAgB,IAAU,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IAEzG,UAAU,CAAC,OAAe,EAAE,IAAc;QACxC,4CAA4C;QAC5C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,GAAG,EAAE,EAAE,CAAC;QAAC,CAAC;QAChJ,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE;YAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,gBAAgB,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;QAC9F,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,eAAe,CAAC,IAA+F,EAAE,UAAkB;QACjI,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE;YAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,iBAAiB,EAAE,CAAC;QAC/E,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,oEAAoE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACjI,IAAI,CAAC,KAAK;YAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,qBAAqB,EAAE,CAAC;QAEjE,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,qIAAqI,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;YACrN,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC;QACpF,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YAC9E,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,yJAAyJ,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACrP,CAAC;IACH,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,4EAA4E,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACjT,CAAC;IAED,YAAY,CAAC,OAA+D;QAC1E,OAAO,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;IACzG,CAAC;IAEO,eAAe,CAAC,QAAgB,EAAE,QAAgB;QACxD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,EAAG,CAAC;YAC/B,IAAI,OAAO,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACtC,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,SAAS;YACnC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACrB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,gBAAgB,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAChE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAAC,CAAC;QACnF,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/admin/services/mcp-admin.service.d.ts

@@ -0,0 +1,13 @@
+import { MCPServerInfo } from '../types/admin.types.js';
+export declare class MCPAdminService {
+    private mcpOrchestrator;
+    constructor(mcpOrchestrator: any);
+    listServers(): MCPServerInfo[];
+    getServer(serverId: string): MCPServerInfo | null;
+    restart(serverId: string): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    toggleTool(serverId: string, toolName: string, enabled: boolean): void;
+    getLogs(serverId: string, lines?: number): string[];
+}

package/dist/admin/services/mcp-admin.service.js

@@ -0,0 +1,40 @@
+// KSA-286: MCP Admin Service
+import { AdminErrorCode } from '../types/admin.types.js';
+export class MCPAdminService {
+    mcpOrchestrator;
+    constructor(mcpOrchestrator) {
+        this.mcpOrchestrator = mcpOrchestrator;
+    }
+    listServers() {
+        const servers = this.mcpOrchestrator?.getServers?.() || [];
+        return servers.map((s) => ({
+            serverId: s.id || s.serverId,
+            serverName: s.name || s.serverName || s.id,
+            status: s.status || 'STOPPED',
+            tools: (s.tools || []).map((t) => ({ name: t.name, enabled: t.enabled !== false, lastCall: t.lastCall })),
+            lastHeartbeat: s.lastHeartbeat,
+            uptimeSeconds: s.uptimeSeconds || 0,
+            restartCount: s.restartCount || 0,
+        }));
+    }
+    getServer(serverId) {
+        const servers = this.listServers();
+        return servers.find(s => s.serverId === serverId) || null;
+    }
+    async restart(serverId) {
+        try {
+            await this.mcpOrchestrator?.restartServer?.(serverId);
+            return { success: true, message: `Server ${serverId} restarted` };
+        }
+        catch (e) {
+            throw { code: AdminErrorCode.RESTART_FAILED, message: e.message || 'Restart failed' };
+        }
+    }
+    toggleTool(serverId, toolName, enabled) {
+        this.mcpOrchestrator?.toggleTool?.(serverId, toolName, enabled);
+    }
+    getLogs(serverId, lines = 200) {
+        return this.mcpOrchestrator?.getServerLogs?.(serverId, lines) || [];
+    }
+}
+//# sourceMappingURL=mcp-admin.service.js.map

package/dist/admin/services/mcp-admin.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-admin.service.js","sourceRoot":"","sources":["../../../src/admin/services/mcp-admin.service.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,OAAO,EAAiB,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAExE,MAAM,OAAO,eAAe;IACN;IAApB,YAAoB,eAAoB;QAApB,oBAAe,GAAf,eAAe,CAAK;IAAG,CAAC;IAE5C,WAAW;QACT,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC;QAC3D,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;YAC9B,QAAQ,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ;YAC5B,UAAU,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,EAAE;YAC1C,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,SAAS;YAC7B,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC9G,aAAa,EAAE,CAAC,CAAC,aAAa;YAC9B,aAAa,EAAE,CAAC,CAAC,aAAa,IAAI,CAAC;YACnC,YAAY,EAAE,CAAC,CAAC,YAAY,IAAI,CAAC;SAClC,CAAC,CAAC,CAAC;IACN,CAAC;IAED,SAAS,CAAC,QAAgB;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACnC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,IAAI,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAAgB;QAC5B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,eAAe,EAAE,aAAa,EAAE,CAAC,QAAQ,CAAC,CAAC;YACtD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,QAAQ,YAAY,EAAE,CAAC;QACpE,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACxF,CAAC;IACH,CAAC;IAED,UAAU,CAAC,QAAgB,EAAE,QAAgB,EAAE,OAAgB;QAC7D,IAAI,CAAC,eAAe,EAAE,UAAU,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,CAAC,QAAgB,EAAE,KAAK,GAAG,GAAG;QACnC,OAAO,IAAI,CAAC,eAAe,EAAE,aAAa,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;IACtE,CAAC;CACF"}

package/dist/admin/services/rbac.service.d.ts

@@ -0,0 +1,16 @@
+import { AccessGroupWithPermissions, GroupPermission } from '../types/admin.types.js';
+export declare class RBACService {
+    private db;
+    constructor(db: any);
+    private rolesTableExists;
+    private hasRolesTable;
+    listGroups(): AccessGroupWithPermissions[];
+    createGroup(name: string, permissions: GroupPermission[]): AccessGroupWithPermissions;
+    updateGroup(groupId: string, name: string, permissions: GroupPermission[]): void;
+    deleteGroup(groupId: string): void;
+    listPermissions(): any[];
+    listRoles(groupId: string, permissionId: string): any[];
+    createRole(groupId: string, permissionId: string, roleName: string, roleData: any): any;
+    updateRole(roleId: string, roleName: string, roleData: any): void;
+    deleteRole(roleId: string): void;
+}

package/dist/admin/services/rbac.service.js

@@ -0,0 +1,104 @@
+// KSA-286: RBAC Service
+import { AdminErrorCode } from '../types/admin.types.js';
+import { invalidateRBACCache } from '../middleware/rbac.middleware.js';
+export class RBACService {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    rolesTableExists = null;
+    hasRolesTable() {
+        if (this.rolesTableExists === null) {
+            const result = this.db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='roles'").get();
+            this.rolesTableExists = !!result;
+        }
+        return this.rolesTableExists;
+    }
+    listGroups() {
+        const groups = this.db.prepare('SELECT * FROM access_groups ORDER BY access_group_name').all();
+        const hasRoles = this.hasRolesTable();
+        return groups.map((g) => {
+            const perms = this.db.prepare('SELECT permission_id, role_data FROM group_permissions WHERE access_group_id = ?').all(g.access_group_id);
+            const userCount = this.db.prepare('SELECT COUNT(*) as cnt FROM users WHERE access_group_id = ?').get(g.access_group_id)?.cnt || 0;
+            const permissionsWithRoles = perms.map((p) => {
+                let roles = [];
+                if (hasRoles) {
+                    try {
+                        roles = this.db.prepare('SELECT role_id, role_name, role_data FROM roles WHERE access_group_id = ? AND permission_id = ?').all(g.access_group_id, p.permission_id);
+                    }
+                    catch { /* ignore */ }
+                }
+                return { permissionId: p.permission_id, roleData: JSON.parse(p.role_data || '{}'), roles: roles.map((r) => ({ roleId: r.role_id, roleName: r.role_name, roleData: JSON.parse(r.role_data || '{}') })) };
+            });
+            return { accessGroupId: g.access_group_id, accessGroupName: g.access_group_name, isSystemGroup: !!g.is_system_group, createdAt: g.created_at, updatedAt: g.updated_at, permissions: permissionsWithRoles, userCount };
+        });
+    }
+    createGroup(name, permissions) {
+        if (this.db.prepare('SELECT 1 FROM access_groups WHERE access_group_name = ?').get(name))
+            throw { code: AdminErrorCode.VALIDATION_ERROR, message: 'Group name exists' };
+        const id = 'grp-' + crypto.randomUUID().slice(0, 8);
+        this.db.transaction(() => {
+            this.db.prepare('INSERT INTO access_groups (access_group_id, access_group_name) VALUES (?, ?)').run(id, name);
+            for (const p of permissions) {
+                this.db.prepare('INSERT INTO group_permissions (access_group_id, permission_id, role_data) VALUES (?, ?, ?)').run(id, p.permissionId, JSON.stringify(p.roleData || {}));
+            }
+        })();
+        invalidateRBACCache();
+        return { accessGroupId: id, accessGroupName: name, isSystemGroup: false, createdAt: new Date().toISOString(), updatedAt: new Date().toISOString(), permissions };
+    }
+    updateGroup(groupId, name, permissions) {
+        const group = this.db.prepare('SELECT * FROM access_groups WHERE access_group_id = ?').get(groupId);
+        if (!group)
+            throw { code: AdminErrorCode.ENTRY_NOT_FOUND };
+        this.db.transaction(() => {
+            this.db.prepare("UPDATE access_groups SET access_group_name = ?, updated_at = datetime('now') WHERE access_group_id = ?").run(name, groupId);
+            this.db.prepare('DELETE FROM group_permissions WHERE access_group_id = ?').run(groupId);
+            for (const p of permissions) {
+                this.db.prepare('INSERT INTO group_permissions (access_group_id, permission_id, role_data) VALUES (?, ?, ?)').run(groupId, p.permissionId, JSON.stringify(p.roleData || {}));
+            }
+        })();
+        invalidateRBACCache();
+    }
+    deleteGroup(groupId) {
+        const group = this.db.prepare('SELECT * FROM access_groups WHERE access_group_id = ?').get(groupId);
+        if (!group)
+            throw { code: AdminErrorCode.ENTRY_NOT_FOUND };
+        if (group.is_system_group)
+            throw { code: AdminErrorCode.LAST_SYSTEM_OWNER, message: 'Cannot delete System Owner group' };
+        const users = this.db.prepare('SELECT COUNT(*) as cnt FROM users WHERE access_group_id = ?').get(groupId)?.cnt || 0;
+        if (users > 0)
+            throw { code: AdminErrorCode.GROUP_HAS_USERS, message: `Group has ${users} users` };
+        this.db.prepare('DELETE FROM access_groups WHERE access_group_id = ?').run(groupId);
+        invalidateRBACCache();
+    }
+    listPermissions() { return this.db.prepare('SELECT * FROM permissions ORDER BY permission_id').all(); }
+    // --- Role CRUD ---
+    listRoles(groupId, permissionId) {
+        return this.db.prepare('SELECT role_id, role_name, role_data, created_at FROM roles WHERE access_group_id = ? AND permission_id = ?').all(groupId, permissionId)
+            .map((r) => ({ roleId: r.role_id, roleName: r.role_name, roleData: JSON.parse(r.role_data || '{}'), createdAt: r.created_at }));
+    }
+    createRole(groupId, permissionId, roleName, roleData) {
+        const gp = this.db.prepare('SELECT 1 FROM group_permissions WHERE access_group_id = ? AND permission_id = ?').get(groupId, permissionId);
+        if (!gp)
+            throw { code: AdminErrorCode.ENTRY_NOT_FOUND, message: 'Group does not have this permission' };
+        const roleId = 'role-' + crypto.randomUUID().slice(0, 8);
+        this.db.prepare('INSERT INTO roles (role_id, access_group_id, permission_id, role_name, role_data) VALUES (?, ?, ?, ?, ?)').run(roleId, groupId, permissionId, roleName, JSON.stringify(roleData || {}));
+        invalidateRBACCache();
+        return { roleId, roleName, roleData: roleData || {}, createdAt: new Date().toISOString() };
+    }
+    updateRole(roleId, roleName, roleData) {
+        const role = this.db.prepare('SELECT 1 FROM roles WHERE role_id = ?').get(roleId);
+        if (!role)
+            throw { code: AdminErrorCode.ENTRY_NOT_FOUND, message: 'Role not found' };
+        this.db.prepare('UPDATE roles SET role_name = ?, role_data = ? WHERE role_id = ?').run(roleName, JSON.stringify(roleData || {}), roleId);
+        invalidateRBACCache();
+    }
+    deleteRole(roleId) {
+        const role = this.db.prepare('SELECT 1 FROM roles WHERE role_id = ?').get(roleId);
+        if (!role)
+            throw { code: AdminErrorCode.ENTRY_NOT_FOUND, message: 'Role not found' };
+        this.db.prepare('DELETE FROM roles WHERE role_id = ?').run(roleId);
+        invalidateRBACCache();
+    }
+}
+//# sourceMappingURL=rbac.service.js.map

package/dist/admin/services/rbac.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.service.js","sourceRoot":"","sources":["../../../src/admin/services/rbac.service.ts"],"names":[],"mappings":"AAAA,wBAAwB;AACxB,OAAO,EAA+C,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACtG,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAEvE,MAAM,OAAO,WAAW;IACF;IAApB,YAAoB,EAAO;QAAP,OAAE,GAAF,EAAE,CAAK;IAAG,CAAC;IAEvB,gBAAgB,GAAmB,IAAI,CAAC;IAExC,aAAa;QACnB,IAAI,IAAI,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,oEAAoE,CAAC,CAAC,GAAG,EAAE,CAAC;YAC3G,IAAI,CAAC,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAED,UAAU;QACR,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,wDAAwD,CAAC,CAAC,GAAG,EAAE,CAAC;QAC/F,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE;YAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,kFAAkF,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;YACzI,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,6DAA6D,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;YAClI,MAAM,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE;gBAChD,IAAI,KAAK,GAAU,EAAE,CAAC;gBACtB,IAAI,QAAQ,EAAE,CAAC;oBACb,IAAI,CAAC;wBAAC,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,iGAAiG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;gBACpM,CAAC;gBACD,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,aAAa,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAC/M,CAAC,CAAC,CAAC;YACH,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,eAAe,EAAE,eAAe,EAAE,CAAC,CAAC,iBAAiB,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,oBAAoB,EAAE,SAAS,EAAE,CAAC;QACxN,CAAC,CAAC,CAAC;IACL,CAAC;IAED,WAAW,CAAC,IAAY,EAAE,WAA8B;QACtD,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,yDAAyD,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,gBAAgB,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;QACxK,MAAM,EAAE,GAAG,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACpD,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;YACvB,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,8EAA8E,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAC9G,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;gBAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,4FAA4F,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;QAC3M,CAAC,CAAC,EAAE,CAAC;QACL,mBAAmB,EAAE,CAAC;QACtB,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,WAAW,EAAE,CAAC;IACnK,CAAC;IAED,WAAW,CAAC,OAAe,EAAE,IAAY,EAAE,WAA8B;QACvE,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,uDAAuD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACpG,IAAI,CAAC,KAAK;YAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,eAAe,EAAE,CAAC;QAC3D,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;YACvB,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,wGAAwG,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC7I,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,yDAAyD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACxF,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;gBAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,4FAA4F,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;QAChN,CAAC,CAAC,EAAE,CAAC;QACL,mBAAmB,EAAE,CAAC;IACxB,CAAC;IAED,WAAW,CAAC,OAAe;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,uDAAuD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACpG,IAAI,CAAC,KAAK;YAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,eAAe,EAAE,CAAC;QAC3D,IAAI,KAAK,CAAC,eAAe;YAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,iBAAiB,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC;QACzH,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,6DAA6D,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;QACpH,IAAI,KAAK,GAAG,CAAC;YAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,eAAe,EAAE,OAAO,EAAE,aAAa,KAAK,QAAQ,EAAE,CAAC;QACnG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,qDAAqD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACpF,mBAAmB,EAAE,CAAC;IACxB,CAAC;IAED,eAAe,KAAY,OAAO,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,kDAAkD,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAE9G,oBAAoB;IAEpB,SAAS,CAAC,OAAe,EAAE,YAAoB;QAC7C,OAAO,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,6GAA6G,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC;aAC7J,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACzI,CAAC;IAED,UAAU,CAAC,OAAe,EAAE,YAAoB,EAAE,QAAgB,EAAE,QAAa;QAC/E,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,iFAAiF,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACzI,IAAI,CAAC,EAAE;YAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,eAAe,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC;QACxG,MAAM,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACzD,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,0GAA0G,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;QACzM,mBAAmB,EAAE,CAAC;QACtB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IAC7F,CAAC;IAED,UAAU,CAAC,MAAc,EAAE,QAAgB,EAAE,QAAa;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClF,IAAI,CAAC,IAAI;YAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,eAAe,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;QACrF,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,iEAAiE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QACzI,mBAAmB,EAAE,CAAC;IACxB,CAAC;IAED,UAAU,CAAC,MAAc;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClF,IAAI,CAAC,IAAI;YAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,eAAe,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;QACrF,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnE,mBAAmB,EAAE,CAAC;IACxB,CAAC;CACF"}

package/dist/admin/services/search.service.d.ts

@@ -0,0 +1,23 @@
+import { AdminModuleDependencies } from '../index.js';
+export interface SearchRequest {
+    query: string;
+    tier?: string;
+    tags?: string[];
+    limit?: number;
+    includeScoreBreakdown?: boolean;
+}
+export declare function createSearchService(deps: AdminModuleDependencies): {
+    search(request: SearchRequest): {
+        query: string;
+        results: any;
+        total: any;
+        searchTimeMs: number;
+        error?: undefined;
+    } | {
+        query: string;
+        results: never[];
+        total: number;
+        searchTimeMs: number;
+        error: any;
+    };
+};

package/dist/admin/services/search.service.js

@@ -0,0 +1,36 @@
+// KSA-286: Search Service — Execute search with score breakdown
+export function createSearchService(deps) {
+    const { kbEngine } = deps;
+    return {
+        search(request) {
+            try {
+                const results = kbEngine?.search?.({
+                    query: request.query,
+                    tier: request.tier,
+                    tags: request.tags,
+                    limit: request.limit || 20,
+                    includeScoreBreakdown: request.includeScoreBreakdown !== false,
+                }) || [];
+                return {
+                    query: request.query,
+                    results: results.map((r) => ({
+                        entryId: r.entryId || r.id,
+                        title: r.title,
+                        content: r.content?.substring(0, 500),
+                        tier: r.tier,
+                        tags: r.tags || [],
+                        score: r.score || 0,
+                        scoreBreakdown: r.scoreBreakdown || undefined,
+                        createdAt: r.createdAt,
+                    })),
+                    total: results.length,
+                    searchTimeMs: 0,
+                };
+            }
+            catch (e) {
+                return { query: request.query, results: [], total: 0, searchTimeMs: 0, error: e?.message };
+            }
+        },
+    };
+}
+//# sourceMappingURL=search.service.js.map

package/dist/admin/services/search.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"search.service.js","sourceRoot":"","sources":["../../../src/admin/services/search.service.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAYhE,MAAM,UAAU,mBAAmB,CAAC,IAA6B;IAC/D,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAE1B,OAAO;QACL,MAAM,CAAC,OAAsB;YAC3B,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,QAAQ,EAAE,MAAM,EAAE,CAAC;oBACjC,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;oBAC1B,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,KAAK,KAAK;iBAC/D,CAAC,IAAI,EAAE,CAAC;gBAET,OAAO;oBACL,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;wBAChC,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,EAAE;wBAC1B,KAAK,EAAE,CAAC,CAAC,KAAK;wBACd,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;wBACrC,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;wBAClB,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;wBACnB,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,SAAS;wBAC7C,SAAS,EAAE,CAAC,CAAC,SAAS;qBACvB,CAAC,CAAC;oBACH,KAAK,EAAE,OAAO,CAAC,MAAM;oBACrB,YAAY,EAAE,CAAC;iBAChB,CAAC;YACJ,CAAC;YAAC,OAAO,CAAM,EAAE,CAAC;gBAChB,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;YAC7F,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/admin/services/sse.manager.d.ts

@@ -0,0 +1,12 @@
+import { Response } from 'express';
+export declare class SSEManager {
+    private clients;
+    private heartbeatInterval;
+    constructor();
+    addClient(userId: string, res: Response): void;
+    broadcast(event: string, data: any): void;
+    sendToUser(userId: string, event: string, data: any): void;
+    private heartbeat;
+    getClientCount(): number;
+    destroy(): void;
+}

package/dist/admin/services/sse.manager.js

@@ -0,0 +1,55 @@
+export class SSEManager {
+    clients = new Map();
+    heartbeatInterval;
+    constructor() { this.heartbeatInterval = setInterval(() => this.heartbeat(), 15000); }
+    addClient(userId, res) {
+        // Close existing connection for this user (1 per user limit)
+        const existing = this.clients.get(userId);
+        if (existing) {
+            try {
+                existing.res.end();
+            }
+            catch { }
+        }
+        res.writeHead(200, { 'Content-Type': 'text/event-stream', 'Cache-Control': 'no-cache', 'Connection': 'keep-alive', 'X-Accel-Buffering': 'no' });
+        res.write('retry: 30000\n\n');
+        this.clients.set(userId, { userId, res, connectedAt: Date.now() });
+        res.on('close', () => { this.clients.delete(userId); });
+    }
+    broadcast(event, data) {
+        const msg = `event: ${event}\ndata: ${JSON.stringify(data)}\n\n`;
+        for (const client of this.clients.values()) {
+            try {
+                client.res.write(msg);
+            }
+            catch { }
+        }
+    }
+    sendToUser(userId, event, data) {
+        const client = this.clients.get(userId);
+        if (client) {
+            try {
+                client.res.write(`event: ${event}\ndata: ${JSON.stringify(data)}\n\n`);
+            }
+            catch { }
+        }
+    }
+    heartbeat() {
+        for (const client of this.clients.values()) {
+            try {
+                client.res.write(': keepalive\n\n');
+            }
+            catch {
+                this.clients.delete(client.userId);
+            }
+        }
+    }
+    getClientCount() { return this.clients.size; }
+    destroy() { clearInterval(this.heartbeatInterval); for (const c of this.clients.values()) {
+        try {
+            c.res.end();
+        }
+        catch { }
+    } this.clients.clear(); }
+}
+//# sourceMappingURL=sse.manager.js.map

package/dist/admin/services/sse.manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse.manager.js","sourceRoot":"","sources":["../../../src/admin/services/sse.manager.ts"],"names":[],"mappings":"AAKA,MAAM,OAAO,UAAU;IACb,OAAO,GAAG,IAAI,GAAG,EAAqB,CAAC;IACvC,iBAAiB,CAAiB;IAE1C,gBAAgB,IAAI,CAAC,iBAAiB,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAEtF,SAAS,CAAC,MAAc,EAAE,GAAa;QACrC,6DAA6D;QAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,QAAQ,EAAE,CAAC;YAAC,IAAI,CAAC;gBAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QAAC,CAAC;QAEtD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,mBAAmB,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;QAChJ,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAC9B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAEnE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,SAAS,CAAC,KAAa,EAAE,IAAS;QAChC,MAAM,GAAG,GAAG,UAAU,KAAK,WAAW,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC;QACjE,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAAC,IAAI,CAAC;gBAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QAAC,CAAC;IACzF,CAAC;IAED,UAAU,CAAC,MAAc,EAAE,KAAa,EAAE,IAAS;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM,EAAE,CAAC;YAAC,IAAI,CAAC;gBAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,WAAW,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QAAC,CAAC;IAC1G,CAAC;IAEO,SAAS;QACf,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAAC,IAAI,CAAC;gBAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAAC,CAAC;QAAC,CAAC;IAC5I,CAAC;IAED,cAAc,KAAa,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAEtD,OAAO,KAAW,aAAa,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAAC,IAAI,CAAC;YAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;CAC1J"}

package/dist/admin/services/user.service.d.ts

@@ -0,0 +1,25 @@
+import { AdminUser, PaginatedResult, PaginationParams } from '../types/admin.types.js';
+export declare class UserService {
+    private db;
+    constructor(db: any);
+    list(filters: {
+        status?: string;
+        search?: string;
+    }, pagination: PaginationParams): PaginatedResult<AdminUser>;
+    create(data: {
+        username: string;
+        email: string;
+        password: string;
+        accessGroupId: string;
+    }): Promise<AdminUser>;
+    updateStatus(userId: string, status: 'ACTIVE' | 'DISABLED'): {
+        sessionsTerminated: number;
+    };
+    delete(userId: string): void;
+    forceLogout(userId: string, sessionId?: string): {
+        terminated: number;
+    };
+    resetPassword(userId: string): Promise<{
+        temporaryPassword: string;
+    }>;
+}

package/dist/admin/services/user.service.js

@@ -0,0 +1,69 @@
+// KSA-286: User Service
+import { AdminErrorCode } from '../types/admin.types.js';
+export class UserService {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    list(filters, pagination) {
+        let where = '1=1';
+        const params = [];
+        if (filters.status) {
+            where += ' AND status = ?';
+            params.push(filters.status);
+        }
+        if (filters.search) {
+            where += ' AND (username LIKE ? OR email LIKE ?)';
+            params.push('%' + filters.search + '%', '%' + filters.search + '%');
+        }
+        const total = this.db.prepare(`SELECT COUNT(*) as cnt FROM users WHERE ${where}`).get(...params)?.cnt || 0;
+        const offset = (pagination.page - 1) * pagination.size;
+        const rows = this.db.prepare(`SELECT * FROM users WHERE ${where} ORDER BY created_at DESC LIMIT ? OFFSET ?`).all(...params, pagination.size, offset);
+        return { items: rows.map((r) => ({ userId: r.user_id, username: r.username, email: r.email, status: r.status, accessGroupId: r.access_group_id, forcePasswordChange: !!r.force_password_change, createdAt: r.created_at, lastLogin: r.last_login })), pagination: { page: pagination.page, size: pagination.size, total, totalPages: Math.ceil(total / pagination.size), hasNext: offset + pagination.size < total, hasPrev: pagination.page > 1 } };
+    }
+    async create(data) {
+        if (this.db.prepare('SELECT 1 FROM users WHERE username = ?').get(data.username))
+            throw { code: AdminErrorCode.DUPLICATE_USERNAME };
+        if (this.db.prepare('SELECT 1 FROM users WHERE email = ?').get(data.email))
+            throw { code: AdminErrorCode.DUPLICATE_EMAIL };
+        if (!/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d).{8,}$/.test(data.password))
+            throw { code: AdminErrorCode.WEAK_PASSWORD };
+        const bcrypt = require('bcrypt');
+        const userId = crypto.randomUUID();
+        const hash = await bcrypt.hash(data.password, 10);
+        this.db.prepare('INSERT INTO users (user_id, username, email, password_hash, access_group_id) VALUES (?, ?, ?, ?, ?)').run(userId, data.username, data.email, hash, data.accessGroupId);
+        return { userId, username: data.username, email: data.email, status: 'ACTIVE', accessGroupId: data.accessGroupId, forcePasswordChange: false, createdAt: new Date().toISOString() };
+    }
+    updateStatus(userId, status) {
+        this.db.prepare('UPDATE users SET status = ? WHERE user_id = ?').run(status, userId);
+        if (status === 'DISABLED') {
+            const r = this.db.prepare('UPDATE sessions SET is_active = 0 WHERE user_id = ? AND is_active = 1').run(userId);
+            return { sessionsTerminated: r.changes };
+        }
+        return { sessionsTerminated: 0 };
+    }
+    delete(userId) {
+        const user = this.db.prepare('SELECT access_group_id FROM users WHERE user_id = ?').get(userId);
+        if (!user)
+            throw { code: AdminErrorCode.ENTRY_NOT_FOUND };
+        const group = this.db.prepare('SELECT is_system_group FROM access_groups WHERE access_group_id = ?').get(user.access_group_id);
+        if (group?.is_system_group) {
+            const cnt = this.db.prepare('SELECT COUNT(*) as c FROM users WHERE access_group_id = ?').get(user.access_group_id)?.c;
+            if (cnt <= 1)
+                throw { code: AdminErrorCode.LAST_SYSTEM_OWNER };
+        }
+        this.db.prepare('DELETE FROM users WHERE user_id = ?').run(userId);
+    }
+    forceLogout(userId, sessionId) {
+        const r = sessionId ? this.db.prepare('UPDATE sessions SET is_active = 0 WHERE session_id = ? AND user_id = ?').run(sessionId, userId) : this.db.prepare('UPDATE sessions SET is_active = 0 WHERE user_id = ? AND is_active = 1').run(userId);
+        return { terminated: r.changes };
+    }
+    async resetPassword(userId) {
+        const bcrypt = require('bcrypt');
+        const temp = crypto.randomUUID().replace(/-/g, '').slice(0, 16);
+        const hash = await bcrypt.hash(temp, 10);
+        this.db.prepare('UPDATE users SET password_hash = ?, force_password_change = 1 WHERE user_id = ?').run(hash, userId);
+        return { temporaryPassword: temp };
+    }
+}
+//# sourceMappingURL=user.service.js.map

package/dist/admin/services/user.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.service.js","sourceRoot":"","sources":["../../../src/admin/services/user.service.ts"],"names":[],"mappings":"AAAA,wBAAwB;AACxB,OAAO,EAAa,cAAc,EAAqC,MAAM,yBAAyB,CAAC;AAEvG,MAAM,OAAO,WAAW;IACF;IAApB,YAAoB,EAAO;QAAP,OAAE,GAAF,EAAE,CAAK;IAAG,CAAC;IAE/B,IAAI,CAAC,OAA6C,EAAE,UAA4B;QAC9E,IAAI,KAAK,GAAG,KAAK,CAAC;QAAC,MAAM,MAAM,GAAU,EAAE,CAAC;QAC5C,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YAAC,KAAK,IAAI,iBAAiB,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QAChF,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YAAC,KAAK,IAAI,wCAAwC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,GAAG,GAAC,OAAO,CAAC,MAAM,GAAC,GAAG,EAAE,GAAG,GAAC,OAAO,CAAC,MAAM,GAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QACvI,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,2CAA2C,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;QAC3G,MAAM,MAAM,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,6BAA6B,KAAK,4CAA4C,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrJ,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC,eAAe,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,CAAC,qBAAqB,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC,IAAI,GAAG,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;IAC5b,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAkF;QAC7F,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,kBAAkB,EAAE,CAAC;QACpI,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,eAAe,EAAE,CAAC;QAC3H,IAAI,CAAC,uCAAuC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,aAAa,EAAE,CAAC;QAC/G,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,qGAAqG,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QACxL,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,mBAAmB,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IACtL,CAAC;IAED,YAAY,CAAC,MAAc,EAAE,MAA6B;QACxD,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,+CAA+C,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACrF,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YAAC,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,uEAAuE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAAC,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QAAC,CAAC;QACxL,OAAO,EAAE,kBAAkB,EAAE,CAAC,EAAE,CAAC;IACnC,CAAC;IAED,MAAM,CAAC,MAAc;QACnB,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,qDAAqD,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChG,IAAI,CAAC,IAAI;YAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,eAAe,EAAE,CAAC;QAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,qEAAqE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC/H,IAAI,KAAK,EAAE,eAAe,EAAE,CAAC;YAAC,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,2DAA2D,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;YAAC,IAAI,GAAG,IAAI,CAAC;gBAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,iBAAiB,EAAE,CAAC;QAAC,CAAC;QACtN,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACrE,CAAC;IAED,WAAW,CAAC,MAAc,EAAE,SAAkB;QAC5C,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,wEAAwE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,uEAAuE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9O,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAAc;QAChC,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,iFAAiF,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrH,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;IACrC,CAAC;CACF"}

package/dist/admin/standalone-server.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/admin/standalone-server.js

@@ -0,0 +1,94 @@
+// KSA-286: Standalone Admin Portal Server
+// Run: npx tsx admin/standalone-server.ts
+import express from 'express';
+import Database from 'better-sqlite3';
+import * as fs from 'fs';
+import * as path from 'path';
+import { fileURLToPath } from 'url';
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const PORT = parseInt(process.env.ADMIN_PORT || '48722', 10);
+// SQLite setup
+const dbPath = path.join(__dirname, '../data/admin-test.db');
+if (!fs.existsSync(path.dirname(dbPath)))
+    fs.mkdirSync(path.dirname(dbPath), { recursive: true });
+const db = new Database(dbPath);
+db.pragma('journal_mode = WAL');
+// Migration + seed
+db.exec(fs.readFileSync(path.join(__dirname, 'db/migrations/001-admin-portal.sql'), 'utf-8'));
+db.exec(fs.readFileSync(path.join(__dirname, 'db/migrations/002-rbac-roles.sql'), 'utf-8'));
+db.exec(fs.readFileSync(path.join(__dirname, 'db/seed/permissions.sql'), 'utf-8'));
+console.log('[Admin] DB ready');
+// JWT mock
+const jwtService = { validate: (token) => token === 'admin-token' ? { sub: 'user-admin-001', username: 'admin' } : null };
+// MCP Orchestrator — combine live status from backend + tool mapping from config
+const mcpBackendUrl = 'http://127.0.0.1:9181/mcp';
+let _mcpServersCache = [];
+(async () => {
+    // Load orchestration.json for tool-to-server mapping
+    const orchPath = path.join(__dirname, '../../.code-intel/orchestration.json');
+    let orchConfig = {};
+    if (fs.existsSync(orchPath)) {
+        orchConfig = JSON.parse(fs.readFileSync(orchPath, 'utf-8'));
+    }
+    try {
+        // Get live server status from backend
+        const statusBody = JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/call', params: { name: 'orchestration_status', arguments: {} } });
+        const statusResp = await fetch(mcpBackendUrl, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: statusBody });
+        const statusJson = await statusResp.json();
+        const statusContent = JSON.parse(statusJson?.result?.content?.[0]?.text || '{}');
+        const liveServers = statusContent.servers || [];
+        // Merge: live status + config tools
+        _mcpServersCache = liveServers.map((s) => {
+            const cfg = orchConfig.mcpServers?.[s.name] || {};
+            const knownTools = cfg.tools || cfg.autoApprove || [];
+            return {
+                id: s.name, name: s.name,
+                status: s.state === 'ACTIVE' ? 'RUNNING' : 'STOPPED',
+                tools: knownTools.map((t) => ({ name: t, enabled: true })),
+                toolCount: s.toolCount || knownTools.length,
+                toolsDiscovered: knownTools.length > 0,
+            };
+        });
+        // Add code-intelligence (self) — always running since we're querying it
+        const selfCfg = orchConfig.mcpServers?.['code-intelligence'];
+        if (selfCfg) {
+            const selfTools = selfCfg.tools || [];
+            _mcpServersCache.unshift({
+                id: 'code-intelligence', name: 'code-intelligence',
+                status: 'RUNNING',
+                tools: selfTools.map((t) => ({ name: t, enabled: true })),
+                toolCount: selfTools.length,
+                toolsDiscovered: true,
+            });
+        }
+        console.log(`[Admin] MCP: ${_mcpServersCache.length} servers loaded (live status + config tools)`);
+    }
+    catch (e) {
+        console.log('[Admin] MCP backend unavailable, using config only');
+        _mcpServersCache = Object.entries(orchConfig.mcpServers || {}).map(([id, cfg]) => ({
+            id, name: id, status: cfg.disabled ? 'STOPPED' : 'RUNNING',
+            tools: (cfg.tools || cfg.autoApprove || []).map((t) => ({ name: t, enabled: true })),
+            toolsDiscovered: (cfg.tools || cfg.autoApprove || []).length > 0,
+        }));
+    }
+})();
+const mcpOrchestrator = {
+    getServers: () => _mcpServersCache,
+    restartServer: async () => { },
+    toggleTool: () => { },
+    getServerLogs: () => [],
+};
+const app = express();
+// SPA FIRST (before admin API which has catch-all)
+const spaFile = path.join(__dirname, '../viewer/admin/index.html');
+console.log('[Admin] SPA:', spaFile, fs.existsSync(spaFile) ? 'OK' : 'MISSING');
+app.get('/admin', (_req, res) => res.sendFile(spaFile));
+app.get('/admin/', (_req, res) => res.sendFile(spaFile));
+// Admin API module
+import { registerAdminModule } from './index.js';
+registerAdminModule(app, { db, jwtService, kbEngine: null, mcpOrchestrator });
+app.listen(PORT, () => {
+    console.log(`\n[Admin Portal] http://localhost:${PORT}/admin/`);
+    console.log(`[Admin API]    http://localhost:${PORT}/api/admin/me`);
+});
+//# sourceMappingURL=standalone-server.js.map