ysk-omni 1.0.0

package/.env.example

@@ -0,0 +1,80 @@
+# development = pretty logs; production recommended for long-running service
+NODE_ENV=production
+# Unique default port for this project (override anytime; Admin PM2 page can change it)
+PORT=3850
+HOST=0.0.0.0
+
+# Optional: override data home (default ~/.ysk-omni when using global CLI)
+# OMNI_HOME=/path/to/home
+
+# SQLite — absolute file: path, or relative to prisma/ when developing in-repo
+DATABASE_URL="file:../data/gateway.db"
+
+# 32-byte key, base64-encoded (generate: openssl rand -base64 32)
+ENCRYPTION_KEY=
+
+# Optional: seed will create this admin key if set; otherwise generates a random one
+# ADMIN_BOOTSTRAP_KEY=omni_live_your_admin_key_here
+
+# Leftover GCTOAC policy knobs (no CLI spawn). Empty until a local model is pulled.
+OMNI_DEFAULT_MODEL=
+# Empty = <STORAGE_DIR>/workspaces/default (never the gateway repo / .env dir)
+OMNI_DEFAULT_CWD=
+# Comma-separated absolute paths allowed for --cwd (empty = only OMNI_DEFAULT_CWD)
+OMNI_CWD_ALLOWLIST=
+OMNI_TIMEOUT_MS=600000
+OMNI_MAX_CONCURRENT=4
+OMNI_ALWAYS_APPROVE=true
+# Force all API keys into safe mode (overrides per-key agent)
+OMNI_SAFE_MODE=false
+OMNI_SAFE_MAX_TURNS=4
+OMNI_SAFE_TIMEOUT_MS=120000
+ADMIN_PANEL_ENABLED=true
+# Local inference workers (omit = 501 engine_unconfigured)
+# OMNI_IMAGE_URL=http://127.0.0.1:7860
+# OMNI_TTS_URL=http://127.0.0.1:9880
+# OMNI_STT_URL=http://127.0.0.1:9881
+# OMNI_VIDEO_URL=http://127.0.0.1:8188
+# OMNI_LLAMA_SERVER=/usr/local/bin/llama-server
+# Offload all GGUF layers to GPU (-1). Set 0 for CPU-only.
+# OMNI_LLAMA_N_GPU_LAYERS=-1
+# OMNI_VLLM=/usr/local/bin/vllm
+# Force python -m vllm.entrypoints.openai.api_server instead of `vllm serve`
+# OMNI_VLLM_MODULE=1
+# Allow Admin UI to control PM2 (start/stop/restart for ysk-omni only)
+PM2_ADMIN_ENABLED=true
+
+CORS_ORIGINS=http://localhost:3850,http://127.0.0.1:3850
+# --- DDoS / rate limits: initial defaults only ---
+# After first boot, Admin → DDoS Center policy is authoritative (stored in DB).
+# Reset to these env values via Admin → DDoS → "Reset to env defaults".
+RATE_LIMIT_WINDOW_MS=60000
+RATE_LIMIT_MAX=120
+# Unauthenticated / IP-only cap (stricter than RATE_LIMIT_MAX)
+RATE_LIMIT_IP_MAX=60
+# Short burst window for chat (10s) — window also editable in Admin policy
+CHAT_BURST_MAX=20
+# Temporary IP block after repeated failed auth (auto-auth rule defaults)
+BLOCK_FAILED_AUTH_THRESHOLD=20
+BLOCK_FAILED_AUTH_WINDOW_MS=300000
+BLOCK_DURATION_MS=600000
+BODY_LIMIT=1mb
+# Max single upload size (bytes). Larger uploads are rejected before processing.
+UPLOAD_MAX_BYTES=10485760
+# Below this size → encrypted in SQLite; above → encrypted file under STORAGE_DIR
+DOCUMENT_DB_MAX_BYTES=1048576
+# Absolute or relative path for encrypted large documents (*.enc)
+STORAGE_DIR=./storage
+
+LOG_LEVEL=info
+# Reverse proxy / CDN client IP (nginx, Cloudflare, load balancer)
+# TRUST_PROXY hops: 0=off (socket only), 1=nginx or CF→app (default), 2=CF→nginx→app
+# Legacy: true→1, false→0. Can also be set in Admin → DDoS → Reverse proxy (runtime).
+TRUST_PROXY=1
+# auto | cloudflare | nginx | x-forwarded-for | socket
+PROXY_IP_SOURCE=auto
+
+# Durable chat work-queue backend (every conversation is enqueued then consumed)
+# sqlite = ChatJob table + in-process worker (default, production-ready)
+# redis / kafka = reserved for multi-node (not implemented yet)
+QUEUE_BACKEND=sqlite

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 yanshekki
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README-ZH.md

@@ -0,0 +1,51 @@
+# YSK Omni
+
+[![CI](https://github.com/yanshekki/ysk-omni/actions/workflows/ci.yml/badge.svg)](https://github.com/yanshekki/ysk-omni/actions/workflows/ci.yml)
+[![npm](https://img.shields.io/npm/v/ysk-omni.svg)](https://www.npmjs.com/package/ysk-omni)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+[![Node.js](https://img.shields.io/badge/node-%3E%3D20-brightgreen)](https://nodejs.org/)
+
+**語言：** [English](./README.md) · 中文
+
+本機 Hugging Face 模型，前面一層 OpenAI 相容 HTTP 閘道。文字：llama-server／vLLM／echo。圖像、語音、轉錄、影片：獨立 worker。
+
+| | |
+|--|--|
+| **CLI** | `ysk-omni` · 短名 `ysko` |
+| **預設連接埠** | **3850** |
+| **文件** | [docs/zh](./docs/zh/README.md) |
+| **產品頁** | [ysk.hk/products/ysk-omni](https://ysk.hk/products/ysk-omni) |
+
+```bash
+npm install -g ysk-omni
+ysk-omni setup
+ysk-omni admin otp
+ysk-omni start
+```
+
+以一次性登入碼開啟 `http://127.0.0.1:3850/admin/`。在目錄拉取 GGUF、Load，然後：
+
+```bash
+curl -sS http://127.0.0.1:3850/v1/models \
+  -H "Authorization: Bearer omni_live_…"
+```
+
+完整 CLI、API、Admin、目錄、執行環境、金鑰與維運：**[文件](./docs/zh/README.md)**。
+
+## 授權
+
+MIT — 見 [LICENSE](./LICENSE)。
+
+## 作者
+
+**Ki (yanshekki)** — [YSK Limited](https://ysk.hk/)。[linktr.ee/yanshekki](https://linktr.ee/yanshekki)
+
+### 支援／贊助
+
+若 YSK Omni 對你有幫助，歡迎贊助開發。
+
+| 網絡 | 地址 |
+| --- | --- |
+| **EVM** (ETH/BSC/AVAX) | `yanshekki.eth` |
+| **NEAR** | `yanshekki.near` |
+| **ADA** (Cardano) | `$yanshekki` |

package/README.md

@@ -0,0 +1,41 @@
+# YSK Omni
+
+[![CI](https://github.com/yanshekki/ysk-omni/actions/workflows/ci.yml/badge.svg)](https://github.com/yanshekki/ysk-omni/actions/workflows/ci.yml)
+[![npm](https://img.shields.io/npm/v/ysk-omni.svg)](https://www.npmjs.com/package/ysk-omni)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+[![Node.js](https://img.shields.io/badge/node-%3E%3D20-brightgreen)](https://nodejs.org/)
+
+**Language:** English · [中文](./README-ZH.md)
+
+Local Hugging Face models behind an OpenAI-compatible HTTP gateway. Text: llama-server / vLLM / echo. Image, speech, transcription, and video: separate workers.
+
+| | |
+|--|--|
+| **CLI** | `ysk-omni` · alias `ysko` |
+| **Default port** | **3850** |
+| **Docs** | [docs/en](./docs/en/README.md) |
+| **Product** | [ysk.hk/products/ysk-omni](https://ysk.hk/products/ysk-omni) |
+
+```bash
+npm install -g ysk-omni
+ysk-omni setup
+ysk-omni admin otp
+ysk-omni start
+```
+
+Open `http://127.0.0.1:3850/admin/` with the one-time code. Pull a GGUF in Catalog, Load it, then:
+
+```bash
+curl -sS http://127.0.0.1:3850/v1/models \
+  -H "Authorization: Bearer omni_live_…"
+```
+
+Full CLI, API, Admin, Catalog, Runtimes, keys, and operations: **[Documentation](./docs/en/README.md)**.
+
+## License
+
+MIT — see [LICENSE](./LICENSE).
+
+## Author
+
+**Ki (yanshekki)** — [YSK Limited](https://ysk.hk/). [linktr.ee/yanshekki](https://linktr.ee/yanshekki)

package/dist/app.d.ts

@@ -0,0 +1,3 @@
+import './interfaces/express.interface';
+export declare function createApp(): import("express-serve-static-core").Express;
+//# sourceMappingURL=app.d.ts.map

package/dist/app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AA4BA,OAAO,gCAAgC,CAAC;AAkDxC,wBAAgB,SAAS,gDAmMxB"}

package/dist/app.js

@@ -0,0 +1,277 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createApp = createApp;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const express_1 = __importDefault(require("express"));
+const cors_1 = __importDefault(require("cors"));
+const helmet_1 = __importDefault(require("helmet"));
+const pino_http_1 = __importDefault(require("pino-http"));
+const env_1 = require("./config/env");
+const cors_2 = require("./config/cors");
+const routes_1 = __importDefault(require("./routes"));
+const admin_routes_1 = __importDefault(require("./routes/admin.routes"));
+const request_id_middleware_1 = require("./middlewares/request-id.middleware");
+const rate_limit_middleware_1 = require("./middlewares/rate-limit.middleware");
+const client_ip_middleware_1 = require("./middlewares/client-ip.middleware");
+const connection_tracker_middleware_1 = require("./middlewares/connection-tracker.middleware");
+const error_middleware_1 = require("./middlewares/error.middleware");
+const logger_1 = require("./utils/logger");
+const ip_blacklist_service_1 = require("./services/ip-blacklist.service");
+const settings_service_1 = require("./services/settings.service");
+const client_ip_1 = require("./utils/client-ip");
+require("./interfaces/express.interface");
+/** Bust browser cache when any production admin SPA asset changes */
+function adminAssetVersion(adminDir) {
+    try {
+        // Production still serves full app.js via boot.js until TS migration is complete.
+        const files = [
+            'boot.js',
+            'app.js',
+            'i18n.js',
+            'styles.css',
+            'index.html',
+            'allowed-extensions.js',
+        ];
+        let max = 0;
+        let size = 0;
+        for (const f of files) {
+            try {
+                const st = node_fs_1.default.statSync(node_path_1.default.join(adminDir, f));
+                max = Math.max(max, st.mtimeMs);
+                size += st.size;
+            }
+            catch {
+                /* ignore */
+            }
+        }
+        return `${Math.floor(max) || Date.now()}-${size}`;
+    }
+    catch {
+        return String(Date.now());
+    }
+}
+function renderAdminIndex(adminDir) {
+    const raw = node_fs_1.default.readFileSync(node_path_1.default.join(adminDir, 'index.html'), 'utf8');
+    const v = adminAssetVersion(adminDir);
+    // Only replace the explicit token — never regex-match app.js paths
+    // (that would corrupt template literals like `/admin/app.js?v=${V}`).
+    return raw.replaceAll('__ADMIN_ASSET_V__', v);
+}
+async function isAdminPanelOpen() {
+    if (!env_1.env.ADMIN_PANEL_ENABLED)
+        return false;
+    try {
+        const s = await settings_service_1.settingsService.getAll();
+        return s.adminPanelEnabled;
+    }
+    catch {
+        // DB down: fall back to env only
+        return env_1.env.ADMIN_PANEL_ENABLED;
+    }
+}
+function createApp() {
+    // Seed proxy IP config from env; bootstrap + policy load override with DB policy
+    (0, client_ip_1.setProxyIpConfig)({
+        trustHops: env_1.env.trustProxyHops,
+        source: env_1.env.PROXY_IP_SOURCE,
+    });
+    // Prefer already-loaded state from bootstrap; still safe if called early (tests)
+    void ip_blacklist_service_1.ipBlacklistService.ensureLoaded().catch(() => undefined);
+    const app = (0, express_1.default)();
+    // Initial trust-proxy from env (policy rebuild updates hops at runtime)
+    app.set('trust proxy', (0, client_ip_1.expressTrustProxySetting)(env_1.env.trustProxyHops));
+    void Promise.resolve().then(() => __importStar(require('./services/ddos-policy.service'))).then(({ ddosPolicyService }) => {
+        ddosPolicyService.onRebuild(() => (0, client_ip_middleware_1.applyExpressTrustProxy)(app));
+        // load() is idempotent; bootstrap usually already loaded
+        return ddosPolicyService.load();
+    })
+        .then(() => (0, client_ip_middleware_1.applyExpressTrustProxy)(app))
+        .catch(() => undefined);
+    app.disable('x-powered-by');
+    app.use((0, helmet_1.default)({
+        // Admin SPA: same-origin JS + Google Fonts. No inline scripts (boot.js loads app.js).
+        contentSecurityPolicy: {
+            useDefaults: true,
+            directives: {
+                'default-src': ["'self'"],
+                'script-src': ["'self'"],
+                'style-src': ["'self'", "'unsafe-inline'", 'https://fonts.googleapis.com'],
+                'style-src-elem': [
+                    "'self'",
+                    "'unsafe-inline'",
+                    'https://fonts.googleapis.com',
+                ],
+                'font-src': ["'self'", 'data:', 'https://fonts.gstatic.com'],
+                'img-src': ["'self'", 'data:', 'blob:'],
+                // Media library lightbox uses blob: object URLs for <video>/<audio>
+                'media-src': ["'self'", 'blob:'],
+                // PDF preview iframe also uses blob:
+                'frame-src': ["'self'", 'blob:'],
+                'connect-src': ["'self'"],
+                'object-src': ["'none'"],
+                'base-uri': ["'self'"],
+                'frame-ancestors': ["'none'"],
+                'form-action': ["'self'"],
+            },
+        },
+    }));
+    app.use((0, cors_1.default)(cors_2.corsOptions));
+    app.use(request_id_middleware_1.requestIdMiddleware);
+    app.use(client_ip_middleware_1.clientIpMiddleware);
+    app.use(connection_tracker_middleware_1.connectionTrackerMiddleware);
+    app.use(rate_limit_middleware_1.ipBlockMiddleware);
+    app.use((0, pino_http_1.default)({
+        logger: logger_1.logger,
+        genReqId: (req) => req.requestId,
+        customProps: (req) => ({
+            requestId: req.requestId,
+        }),
+        autoLogging: {
+            ignore: (req) => req.url === '/health' ||
+                req.url === '/ready' ||
+                (req.url?.startsWith('/admin') && !req.url.startsWith('/admin/api')),
+        },
+    }));
+    app.use(express_1.default.json({ limit: env_1.env.BODY_LIMIT }));
+    app.use(express_1.default.urlencoded({ extended: false, limit: env_1.env.BODY_LIMIT }));
+    app.use(rate_limit_middleware_1.globalRateLimiter);
+    // Admin JSON API (self-gates with ensureAdminPanel)
+    app.use('/admin/api', admin_routes_1.default);
+    const adminDir = node_path_1.default.join(process.cwd(), 'public', 'admin');
+    const disabledPage = node_path_1.default.join(adminDir, 'disabled.html');
+    // Gate SPA when panel is off — only serve disabled page (+ logo for branding)
+    app.use('/admin', async (req, res, next) => {
+        if (req.path.startsWith('/api')) {
+            next();
+            return;
+        }
+        const open = await isAdminPanelOpen();
+        if (open) {
+            next();
+            return;
+        }
+        res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate');
+        // Allow logo for disabled page
+        if (req.path === '/assets/logo.svg') {
+            res.sendFile(node_path_1.default.join(adminDir, 'assets', 'logo.svg'), (err) => {
+                if (err)
+                    next();
+            });
+            return;
+        }
+        res.status(503).sendFile(disabledPage, (err) => {
+            if (err) {
+                res
+                    .status(503)
+                    .type('html')
+                    .send('<!doctype html><meta charset="utf-8"><title>Admin off</title><body style="font-family:system-ui;padding:2rem"><h1>Admin panel disabled</h1><p>Run: <code>ysk-omni admin on</code></p></body>');
+            }
+        });
+    });
+    const sendRenderedAdminIndex = (res) => {
+        const html = renderAdminIndex(adminDir);
+        res.status(200);
+        res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate');
+        res.setHeader('Pragma', 'no-cache');
+        res.setHeader('Expires', '0');
+        res.setHeader('Content-Type', 'text/html; charset=utf-8');
+        res.setHeader('Content-Length', String(Buffer.byteLength(html)));
+        res.removeHeader('ETag');
+        res.end(html);
+    };
+    const handleAdminIndex = async (_req, res, next) => {
+        try {
+            const open = await isAdminPanelOpen();
+            if (!open) {
+                res.setHeader('Cache-Control', 'no-store');
+                res.status(503).sendFile(disabledPage, (err) => {
+                    if (err)
+                        next();
+                });
+                return;
+            }
+            sendRenderedAdminIndex(res);
+        }
+        catch (e) {
+            next(e);
+        }
+    };
+    // Static must not emit the raw index.html (unreplaced __ADMIN_ASSET_V__).
+    app.use('/admin', (req, res, next) => {
+        if (req.method === 'GET' && req.path === '/index.html') {
+            void handleAdminIndex(req, res, next);
+            return;
+        }
+        next();
+    });
+    // Admin SPA static files (only reached when panel open)
+    // no-store for JS/CSS/HTML so i18n updates always reach the browser
+    app.use('/admin', express_1.default.static(adminDir, {
+        index: false, // always use dynamic index below
+        etag: false,
+        lastModified: false,
+        maxAge: 0,
+        setHeaders(res, filePath) {
+            if (/\.(js|css|html|svg)$/i.test(filePath)) {
+                res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate');
+                res.setHeader('Pragma', 'no-cache');
+                res.setHeader('Expires', '0');
+            }
+        },
+    }));
+    app.get(['/admin', '/admin/', '/admin/index.html'], handleAdminIndex);
+    app.get(['/admin/*'], async (req, res, next) => {
+        if (req.path.startsWith('/admin/api') || req.path.startsWith('/api')) {
+            next();
+            return;
+        }
+        // SPA fallback only for non-file routes
+        if (node_path_1.default.extname(req.path)) {
+            next();
+            return;
+        }
+        await handleAdminIndex(req, res, next);
+    });
+    app.use(routes_1.default);
+    app.use(error_middleware_1.notFoundHandler);
+    app.use(error_middleware_1.errorMiddleware);
+    return app;
+}
+//# sourceMappingURL=app.js.map

package/dist/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8EA,8BAmMC;AAjRD,sDAAyB;AACzB,0DAA6B;AAC7B,sDAA8B;AAC9B,gDAAwB;AACxB,oDAA4B;AAC5B,0DAAiC;AACjC,sCAAmC;AACnC,wCAA4C;AAC5C,sDAA8B;AAC9B,yEAAgD;AAChD,+EAA0E;AAC1E,+EAG6C;AAC7C,6EAG4C;AAC5C,+FAA0F;AAC1F,qEAAkF;AAClF,2CAAwC;AACxC,0EAAqE;AACrE,kEAA8D;AAC9D,iDAG2B;AAC3B,0CAAwC;AAExC,qEAAqE;AACrE,SAAS,iBAAiB,CAAC,QAAgB;IACzC,IAAI,CAAC;QACH,kFAAkF;QAClF,MAAM,KAAK,GAAG;YACZ,SAAS;YACT,QAAQ;YACR,SAAS;YACT,YAAY;YACZ,YAAY;YACZ,uBAAuB;SACxB,CAAC;QACF,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,iBAAE,CAAC,QAAQ,CAAC,mBAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC/C,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;gBAChC,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;QACH,CAAC;QACD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,MAAM,GAAG,GAAG,iBAAE,CAAC,YAAY,CAAC,mBAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;IACvE,MAAM,CAAC,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACtC,mEAAmE;IACnE,sEAAsE;IACtE,OAAO,GAAG,CAAC,UAAU,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,gBAAgB;IAC7B,IAAI,CAAC,SAAG,CAAC,mBAAmB;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,kCAAe,CAAC,MAAM,EAAE,CAAC;QACzC,OAAO,CAAC,CAAC,iBAAiB,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,iCAAiC;QACjC,OAAO,SAAG,CAAC,mBAAmB,CAAC;IACjC,CAAC;AACH,CAAC;AAED,SAAgB,SAAS;IACvB,iFAAiF;IACjF,IAAA,4BAAgB,EAAC;QACf,SAAS,EAAE,SAAG,CAAC,cAAc;QAC7B,MAAM,EAAE,SAAG,CAAC,eAAe;KAC5B,CAAC,CAAC;IAEH,iFAAiF;IACjF,KAAK,yCAAkB,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAE9D,MAAM,GAAG,GAAG,IAAA,iBAAO,GAAE,CAAC;IAEtB,wEAAwE;IACxE,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,IAAA,oCAAwB,EAAC,SAAG,CAAC,cAAc,CAAC,CAAC,CAAC;IAErE,KAAK,kDAAO,gCAAgC,IACzC,IAAI,CAAC,CAAC,EAAE,iBAAiB,EAAE,EAAE,EAAE;QAC9B,iBAAiB,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,IAAA,6CAAsB,EAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,yDAAyD;QACzD,OAAO,iBAAiB,CAAC,IAAI,EAAE,CAAC;IAClC,CAAC,CAAC;SACD,IAAI,CAAC,GAAG,EAAE,CAAC,IAAA,6CAAsB,EAAC,GAAG,CAAC,CAAC;SACvC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAE1B,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAE5B,GAAG,CAAC,GAAG,CACL,IAAA,gBAAM,EAAC;QACL,sFAAsF;QACtF,qBAAqB,EAAE;YACrB,WAAW,EAAE,IAAI;YACjB,UAAU,EAAE;gBACV,aAAa,EAAE,CAAC,QAAQ,CAAC;gBACzB,YAAY,EAAE,CAAC,QAAQ,CAAC;gBACxB,WAAW,EAAE,CAAC,QAAQ,EAAE,iBAAiB,EAAE,8BAA8B,CAAC;gBAC1E,gBAAgB,EAAE;oBAChB,QAAQ;oBACR,iBAAiB;oBACjB,8BAA8B;iBAC/B;gBACD,UAAU,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,2BAA2B,CAAC;gBAC5D,SAAS,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC;gBACvC,oEAAoE;gBACpE,WAAW,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;gBAChC,qCAAqC;gBACrC,WAAW,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;gBAChC,aAAa,EAAE,CAAC,QAAQ,CAAC;gBACzB,YAAY,EAAE,CAAC,QAAQ,CAAC;gBACxB,UAAU,EAAE,CAAC,QAAQ,CAAC;gBACtB,iBAAiB,EAAE,CAAC,QAAQ,CAAC;gBAC7B,aAAa,EAAE,CAAC,QAAQ,CAAC;aAC1B;SACF;KACF,CAAC,CACH,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,IAAA,cAAI,EAAC,kBAAW,CAAC,CAAC,CAAC;IAC3B,GAAG,CAAC,GAAG,CAAC,2CAAmB,CAAC,CAAC;IAC7B,GAAG,CAAC,GAAG,CAAC,yCAAkB,CAAC,CAAC;IAC5B,GAAG,CAAC,GAAG,CAAC,2DAA2B,CAAC,CAAC;IACrC,GAAG,CAAC,GAAG,CAAC,yCAAiB,CAAC,CAAC;IAC3B,GAAG,CAAC,GAAG,CACL,IAAA,mBAAQ,EAAC;QACP,MAAM,EAAN,eAAM;QACN,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAE,GAAuB,CAAC,SAAS;QACrD,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACrB,SAAS,EAAG,GAAuB,CAAC,SAAS;SAC9C,CAAC;QACF,WAAW,EAAE;YACX,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CACd,GAAG,CAAC,GAAG,KAAK,SAAS;gBACrB,GAAG,CAAC,GAAG,KAAK,QAAQ;gBACpB,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;SACvE;KACF,CAAC,CACH,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,iBAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACjD,GAAG,CAAC,GAAG,CAAC,iBAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,SAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACxE,GAAG,CAAC,GAAG,CAAC,yCAAiB,CAAC,CAAC;IAE3B,oDAAoD;IACpD,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,sBAAW,CAAC,CAAC;IAEnC,MAAM,QAAQ,GAAG,mBAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC7D,MAAM,YAAY,GAAG,mBAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAE1D,8EAA8E;IAC9E,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzC,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACtC,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,qCAAqC,CAAC,CAAC;QACtE,+BAA+B;QAC/B,IAAI,GAAG,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YACpC,GAAG,CAAC,QAAQ,CAAC,mBAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC9D,IAAI,GAAG;oBAAE,IAAI,EAAE,CAAC;YAClB,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE;YAC7C,IAAI,GAAG,EAAE,CAAC;gBACR,GAAG;qBACA,MAAM,CAAC,GAAG,CAAC;qBACX,IAAI,CAAC,MAAM,CAAC;qBACZ,IAAI,CACH,8LAA8L,CAC/L,CAAC;YACN,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,sBAAsB,GAAG,CAAC,GAAqB,EAAE,EAAE;QACvD,MAAM,IAAI,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChB,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,qCAAqC,CAAC,CAAC;QACtE,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACpC,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC9B,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;QAC1D,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjE,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACzB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC,CAAC;IAEF,MAAM,gBAAgB,GAAG,KAAK,EAC5B,IAAqB,EACrB,GAAqB,EACrB,IAA0B,EAC1B,EAAE;QACF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;YACtC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;gBAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE;oBAC7C,IAAI,GAAG;wBAAE,IAAI,EAAE,CAAC;gBAClB,CAAC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,CAAC,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CAAC;IAEF,0EAA0E;IAC1E,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACnC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACvD,KAAK,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,wDAAwD;IACxD,oEAAoE;IACpE,GAAG,CAAC,GAAG,CACL,QAAQ,EACR,iBAAO,CAAC,MAAM,CAAC,QAAQ,EAAE;QACvB,KAAK,EAAE,KAAK,EAAE,iCAAiC;QAC/C,IAAI,EAAE,KAAK;QACX,YAAY,EAAE,KAAK;QACnB,MAAM,EAAE,CAAC;QACT,UAAU,CAAC,GAAG,EAAE,QAAQ;YACtB,IAAI,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC3C,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,qCAAqC,CAAC,CAAC;gBACtE,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;gBACpC,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;KACF,CAAC,CACH,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,mBAAmB,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACtE,GAAG,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC7C,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACrE,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,wCAAwC;QACxC,IAAI,mBAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,MAAM,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,gBAAM,CAAC,CAAC;IAEhB,GAAG,CAAC,GAAG,CAAC,kCAAe,CAAC,CAAC;IACzB,GAAG,CAAC,GAAG,CAAC,kCAAe,CAAC,CAAC;IAEzB,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/catalog/curated.d.ts

@@ -0,0 +1,14 @@
+import type { ModelModality, ModelRuntime } from '../services/hf/registry';
+export type CuratedPack = {
+    id: string;
+    repoId: string;
+    modality: ModelModality;
+    runtime: ModelRuntime;
+    quants: string[];
+    vramMb: number;
+    flag?: string;
+};
+export declare function curatedCatalogPath(): string;
+export declare function loadCuratedPacks(): CuratedPack[];
+export declare function findCuratedPack(specId: string): CuratedPack | undefined;
+//# sourceMappingURL=curated.d.ts.map

package/dist/catalog/curated.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"curated.d.ts","sourceRoot":"","sources":["../../src/catalog/curated.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAE3E,MAAM,MAAM,WAAW,GAAG;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,aAAa,CAAC;IACxB,OAAO,EAAE,YAAY,CAAC;IACtB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAMF,wBAAgB,kBAAkB,IAAI,MAAM,CAI3C;AAED,wBAAgB,gBAAgB,IAAI,WAAW,EAAE,CAMhD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAKvE"}

package/dist/catalog/curated.js

@@ -0,0 +1,30 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.curatedCatalogPath = curatedCatalogPath;
+exports.loadCuratedPacks = loadCuratedPacks;
+exports.findCuratedPack = findCuratedPack;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+let cached = null;
+function curatedCatalogPath() {
+    const nextToJs = node_path_1.default.resolve(__dirname, 'curated.json');
+    if (node_fs_1.default.existsSync(nextToJs))
+        return nextToJs;
+    return node_path_1.default.resolve(__dirname, '..', '..', 'src', 'catalog', 'curated.json');
+}
+function loadCuratedPacks() {
+    if (cached)
+        return cached;
+    const raw = node_fs_1.default.readFileSync(curatedCatalogPath(), 'utf8');
+    const parsed = JSON.parse(raw);
+    cached = Array.isArray(parsed.packs) ? parsed.packs : [];
+    return cached;
+}
+function findCuratedPack(specId) {
+    const packs = loadCuratedPacks();
+    return packs.find((p) => p.id === specId || p.repoId === specId || specId.startsWith(`${p.repoId}:`));
+}
+//# sourceMappingURL=curated.js.map

package/dist/catalog/curated.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"curated.js","sourceRoot":"","sources":["../../src/catalog/curated.ts"],"names":[],"mappings":";;;;;AAkBA,gDAIC;AAED,4CAMC;AAED,0CAKC;AArCD,sDAAyB;AACzB,0DAA6B;AAe7B,IAAI,MAAM,GAAyB,IAAI,CAAC;AAExC,SAAgB,kBAAkB;IAChC,MAAM,QAAQ,GAAG,mBAAI,CAAC,OAAO,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACzD,IAAI,iBAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7C,OAAO,mBAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;AAC/E,CAAC;AAED,SAAgB,gBAAgB;IAC9B,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,GAAG,GAAG,iBAAE,CAAC,YAAY,CAAC,kBAAkB,EAAE,EAAE,MAAM,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAC;IAC9C,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,eAAe,CAAC,MAAc;IAC5C,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,OAAO,KAAK,CAAC,IAAI,CACf,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CACnF,CAAC;AACJ,CAAC"}

package/dist/cli/commands/admin-otp.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Generate a one-time Admin panel login code (CLI only).
+ * Requires the gateway process to share the same DATABASE_URL.
+ */
+export declare function cmdAdminOtp(opts: {
+    home?: string;
+    forceHome?: boolean;
+    port?: number;
+}): Promise<void>;
+//# sourceMappingURL=admin-otp.d.ts.map

package/dist/cli/commands/admin-otp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-otp.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/admin-otp.ts"],"names":[],"mappings":"AAOA;;;GAGG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE;IACtC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,IAAI,CAAC,CAqChB"}

package/dist/cli/commands/admin-otp.js

@@ -0,0 +1,82 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cmdAdminOtp = cmdAdminOtp;
+const paths_1 = require("../lib/paths");
+const env_file_1 = require("../lib/env-file");
+const print_1 = require("../lib/print");
+/**
+ * Generate a one-time Admin panel login code (CLI only).
+ * Requires the gateway process to share the same DATABASE_URL.
+ */
+async function cmdAdminOtp(opts) {
+    const paths = (0, paths_1.resolveRuntimePaths)({
+        home: opts.home,
+        forceHome: opts.forceHome ?? Boolean(opts.home),
+    });
+    const envMap = (0, env_file_1.ensureEnvFile)(paths);
+    (0, env_file_1.loadEnvIntoProcess)(paths.envFile);
+    // Point Prisma at the same DB as the running gateway
+    if (envMap.DATABASE_URL) {
+        process.env.DATABASE_URL = envMap.DATABASE_URL;
+    }
+    else {
+        process.env.DATABASE_URL = paths.databaseUrl;
+    }
+    // Lazy import after env is set
+    const { adminAuthService } = await Promise.resolve().then(() => __importStar(require('../../services/admin-auth.service')));
+    const { disconnectDatabase } = await Promise.resolve().then(() => __importStar(require('../../config/database')));
+    try {
+        const { code, expiresAt } = await adminAuthService.createOtp();
+        const port = opts.port || Number(envMap.PORT || paths_1.DEFAULT_PORT);
+        (0, print_1.ok)('One-time Admin login code (valid 5 minutes, single use):');
+        (0, print_1.info)('');
+        (0, print_1.info)(`  ${code}`);
+        (0, print_1.info)('');
+        (0, print_1.info)(`Expires: ${expiresAt.toISOString()}`);
+        (0, print_1.info)(`Admin:   http://127.0.0.1:${port}/admin/`);
+        (0, print_1.info)('');
+        (0, print_1.info)('Paste the code on the Admin login page. Do not share it.');
+        (0, print_1.warn)('A new code is required for every login.');
+    }
+    catch (e) {
+        (0, print_1.fail)(e instanceof Error ? e.message : String(e));
+        process.exitCode = 1;
+    }
+    finally {
+        await disconnectDatabase().catch(() => undefined);
+    }
+}
+//# sourceMappingURL=admin-otp.js.map

package/dist/cli/commands/admin-otp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-otp.js","sourceRoot":"","sources":["../../../src/cli/commands/admin-otp.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWA,kCAyCC;AApDD,wCAGsB;AACtB,8CAAoE;AACpE,wCAAoD;AAEpD;;;GAGG;AACI,KAAK,UAAU,WAAW,CAAC,IAIjC;IACC,MAAM,KAAK,GAAG,IAAA,2BAAmB,EAAC;QAChC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;KAChD,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAA,wBAAa,EAAC,KAAK,CAAC,CAAC;IACpC,IAAA,6BAAkB,EAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAElC,qDAAqD;IACrD,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;IACjD,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,KAAK,CAAC,WAAW,CAAC;IAC/C,CAAC;IAED,+BAA+B;IAC/B,MAAM,EAAE,gBAAgB,EAAE,GAAG,wDAAa,mCAAmC,GAAC,CAAC;IAC/E,MAAM,EAAE,kBAAkB,EAAE,GAAG,wDAAa,uBAAuB,GAAC,CAAC;IAErE,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,MAAM,gBAAgB,CAAC,SAAS,EAAE,CAAC;QAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,oBAAY,CAAC,CAAC;QAC9D,IAAA,UAAE,EAAC,0DAA0D,CAAC,CAAC;QAC/D,IAAA,YAAI,EAAC,EAAE,CAAC,CAAC;QACT,IAAA,YAAI,EAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAClB,IAAA,YAAI,EAAC,EAAE,CAAC,CAAC;QACT,IAAA,YAAI,EAAC,YAAY,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC5C,IAAA,YAAI,EAAC,6BAA6B,IAAI,SAAS,CAAC,CAAC;QACjD,IAAA,YAAI,EAAC,EAAE,CAAC,CAAC;QACT,IAAA,YAAI,EAAC,0DAA0D,CAAC,CAAC;QACjE,IAAA,YAAI,EAAC,yCAAyC,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAA,YAAI,EAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;YAAS,CAAC;QACT,MAAM,kBAAkB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;AACH,CAAC"}