ysk-omni 1.0.0

package/dist/services/ddos-policy.service.js

@@ -0,0 +1,263 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ddosPolicyService = exports.DdosPolicyService = void 0;
+exports.defaultDdosPolicyFromEnv = defaultDdosPolicyFromEnv;
+exports.ddosPreset = ddosPreset;
+exports.policyClientIp = policyClientIp;
+const database_1 = require("../config/database");
+const env_1 = require("../config/env");
+const constants_1 = require("../config/constants");
+const ddos_dto_1 = require("../dto/ddos.dto");
+const ip_match_1 = require("../utils/ip-match");
+const client_ip_1 = require("../utils/client-ip");
+function envProxySource() {
+    const s = env_1.env.PROXY_IP_SOURCE;
+    if (s === 'cloudflare' ||
+        s === 'nginx' ||
+        s === 'x-forwarded-for' ||
+        s === 'socket' ||
+        s === 'auto') {
+        return s;
+    }
+    return 'auto';
+}
+/** Env-backed balanced defaults (first boot / reset). */
+function defaultDdosPolicyFromEnv() {
+    return {
+        autoBanEnabled: true,
+        rateLimitWindowMs: env_1.env.RATE_LIMIT_WINDOW_MS,
+        rateLimitMax: env_1.env.RATE_LIMIT_MAX,
+        rateLimitIpMax: env_1.env.RATE_LIMIT_IP_MAX,
+        chatBurstWindowMs: 10_000,
+        chatBurstMax: env_1.env.CHAT_BURST_MAX,
+        autoAuthEnabled: true,
+        failedAuthThreshold: env_1.env.BLOCK_FAILED_AUTH_THRESHOLD,
+        failedAuthWindowMs: env_1.env.BLOCK_FAILED_AUTH_WINDOW_MS,
+        authBanDurationMs: env_1.env.BLOCK_DURATION_MS,
+        autoRateEnabled: true,
+        rateHitThreshold: 30,
+        rateHitWindowMs: 60_000,
+        rateBanDurationMs: 900_000,
+        autoConnEnabled: true,
+        maxConcurrentPerIp: 20,
+        connBanDurationMs: env_1.env.BLOCK_DURATION_MS,
+        autoVelocityEnabled: true,
+        velocityMaxRequests: 200,
+        velocityWindowMs: 60_000,
+        velocityBanDurationMs: env_1.env.BLOCK_DURATION_MS,
+        escalateEnabled: true,
+        escalateAfterBans: 3,
+        escalateDurationMs: 24 * 60 * 60 * 1000,
+        whitelist: ['127.0.0.1', '::1'],
+        proxyTrustHops: env_1.env.trustProxyHops,
+        proxyIpSource: envProxySource(),
+        // Only loopback by default — remote nginx/CF edge must be listed explicitly
+        trustedProxies: [...client_ip_1.DEFAULT_TRUSTED_PROXIES],
+    };
+}
+function applyProxyRuntime(policy) {
+    (0, client_ip_1.setProxyIpConfig)({
+        trustHops: policy.proxyTrustHops,
+        source: policy.proxyIpSource,
+        trustedProxies: policy.trustedProxies?.length
+            ? policy.trustedProxies
+            : [...client_ip_1.DEFAULT_TRUSTED_PROXIES],
+    });
+}
+function ddosPreset(name) {
+    const base = defaultDdosPolicyFromEnv();
+    if (name === 'relaxed') {
+        return {
+            ...base,
+            rateLimitMax: Math.max(base.rateLimitMax, 300),
+            rateLimitIpMax: Math.max(base.rateLimitIpMax, 150),
+            chatBurstMax: Math.max(base.chatBurstMax, 40),
+            failedAuthThreshold: 50,
+            authBanDurationMs: 5 * 60_000,
+            rateHitThreshold: 80,
+            rateBanDurationMs: 10 * 60_000,
+            maxConcurrentPerIp: 50,
+            connBanDurationMs: 5 * 60_000,
+            velocityMaxRequests: 500,
+            velocityBanDurationMs: 5 * 60_000,
+            escalateEnabled: false,
+            escalateAfterBans: 5,
+        };
+    }
+    if (name === 'strict') {
+        return {
+            ...base,
+            rateLimitMax: Math.min(base.rateLimitMax, 60),
+            rateLimitIpMax: Math.min(base.rateLimitIpMax, 30),
+            chatBurstMax: Math.min(base.chatBurstMax, 8),
+            failedAuthThreshold: 8,
+            failedAuthWindowMs: 10 * 60_000,
+            authBanDurationMs: 60 * 60_000,
+            rateHitThreshold: 10,
+            rateHitWindowMs: 60_000,
+            rateBanDurationMs: 2 * 60 * 60_000,
+            maxConcurrentPerIp: 8,
+            connBanDurationMs: 60 * 60_000,
+            velocityMaxRequests: 80,
+            velocityWindowMs: 60_000,
+            velocityBanDurationMs: 60 * 60_000,
+            escalateEnabled: true,
+            escalateAfterBans: 2,
+            escalateDurationMs: 7 * 24 * 60 * 60_000,
+        };
+    }
+    return base;
+}
+function sanitizeWhitelist(list) {
+    if (!list)
+        return [];
+    return (0, ip_match_1.parseIpList)(list);
+}
+function mergePolicy(raw, fallback) {
+    if (!raw || typeof raw !== 'object')
+        return fallback;
+    const merged = { ...fallback, ...raw };
+    if (Array.isArray(raw.whitelist)) {
+        merged.whitelist = sanitizeWhitelist(raw.whitelist);
+    }
+    if (Array.isArray(raw.trustedProxies)) {
+        merged.trustedProxies = sanitizeWhitelist(raw.trustedProxies);
+        if (!merged.trustedProxies.length) {
+            merged.trustedProxies = [...client_ip_1.DEFAULT_TRUSTED_PROXIES];
+        }
+    }
+    // Older saved policies without trustedProxies keep fallback (loopback)
+    if (!Array.isArray(merged.trustedProxies)) {
+        merged.trustedProxies = [...client_ip_1.DEFAULT_TRUSTED_PROXIES];
+    }
+    const parsed = ddos_dto_1.ddosPolicySchema.safeParse(merged);
+    return parsed.success ? parsed.data : fallback;
+}
+/** CLI may write policy to DB; reload so live gateway picks it up without restart. */
+const POLICY_TTL_MS = 2_000;
+class DdosPolicyService {
+    cache = null;
+    loaded = false;
+    loadedAt = 0;
+    rebuildHooks = [];
+    onRebuild(hook) {
+        this.rebuildHooks.push(hook);
+    }
+    fireRebuild() {
+        if (this.cache)
+            applyProxyRuntime(this.cache);
+        for (const h of this.rebuildHooks) {
+            try {
+                h();
+            }
+            catch {
+                /* ignore */
+            }
+        }
+    }
+    /** Sync snapshot (env defaults until load completes). */
+    getSync() {
+        return this.cache ?? defaultDdosPolicyFromEnv();
+    }
+    async load() {
+        const fallback = defaultDdosPolicyFromEnv();
+        try {
+            const row = await database_1.prisma.setting.findUnique({
+                where: { key: constants_1.SETTING_KEYS.DDOS_POLICY },
+            });
+            if (row?.value) {
+                try {
+                    this.cache = mergePolicy(JSON.parse(row.value), fallback);
+                }
+                catch {
+                    this.cache = fallback;
+                }
+            }
+            else {
+                this.cache = fallback;
+            }
+        }
+        catch {
+            this.cache = fallback;
+        }
+        this.loaded = true;
+        this.loadedAt = Date.now();
+        applyProxyRuntime(this.cache);
+        this.fireRebuild();
+        return this.cache;
+    }
+    async get() {
+        if (!this.loaded || !this.cache || Date.now() - this.loadedAt > POLICY_TTL_MS) {
+            return this.load();
+        }
+        return this.cache;
+    }
+    async update(partial) {
+        const current = await this.get();
+        let trustedProxies = current.trustedProxies;
+        if (partial.trustedProxies !== undefined) {
+            trustedProxies = sanitizeWhitelist(partial.trustedProxies);
+            if (!trustedProxies.length) {
+                trustedProxies = [...client_ip_1.DEFAULT_TRUSTED_PROXIES];
+            }
+        }
+        const nextRaw = {
+            ...current,
+            ...partial,
+            whitelist: partial.whitelist !== undefined
+                ? sanitizeWhitelist(partial.whitelist)
+                : current.whitelist,
+            trustedProxies,
+        };
+        const parsed = ddos_dto_1.ddosPolicySchema.parse(nextRaw);
+        await database_1.prisma.setting.upsert({
+            where: { key: constants_1.SETTING_KEYS.DDOS_POLICY },
+            create: {
+                key: constants_1.SETTING_KEYS.DDOS_POLICY,
+                value: JSON.stringify(parsed),
+            },
+            update: { value: JSON.stringify(parsed) },
+        });
+        this.cache = parsed;
+        this.loaded = true;
+        this.loadedAt = Date.now();
+        this.fireRebuild();
+        return parsed;
+    }
+    async resetToEnvDefaults() {
+        return this.update(defaultDdosPolicyFromEnv());
+    }
+    isWhitelisted(ip) {
+        const policy = this.getSync();
+        const list = policy.whitelist || [];
+        if (!list.length)
+            return false;
+        // ipAllowed treats empty as allow-all; we want empty = nobody special
+        return (0, ip_match_1.ipAllowed)(ip, list);
+    }
+    summary(policy) {
+        const p = policy ?? this.getSync();
+        return {
+            autoBanEnabled: p.autoBanEnabled,
+            autoAuthEnabled: p.autoAuthEnabled,
+            autoRateEnabled: p.autoRateEnabled,
+            autoConnEnabled: p.autoConnEnabled,
+            autoVelocityEnabled: p.autoVelocityEnabled,
+            escalateEnabled: p.escalateEnabled,
+            whitelistCount: p.whitelist?.length ?? 0,
+            rateLimitMax: p.rateLimitMax,
+            rateLimitIpMax: p.rateLimitIpMax,
+            maxConcurrentPerIp: p.maxConcurrentPerIp,
+            velocityMaxRequests: p.velocityMaxRequests,
+            proxyTrustHops: p.proxyTrustHops,
+            proxyIpSource: p.proxyIpSource,
+        };
+    }
+}
+exports.DdosPolicyService = DdosPolicyService;
+exports.ddosPolicyService = new DdosPolicyService();
+/** Normalize client IP for policy checks. */
+function policyClientIp(ip) {
+    return (0, ip_match_1.normalizeIp)(ip || 'unknown');
+}
+//# sourceMappingURL=ddos-policy.service.js.map

package/dist/services/ddos-policy.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ddos-policy.service.js","sourceRoot":"","sources":["../../src/services/ddos-policy.service.ts"],"names":[],"mappings":";;;AAgCA,4DAwCC;AAYD,gCA2CC;AAmKD,wCAEC;AApSD,iDAA4C;AAC5C,uCAAoC;AACpC,mDAAmD;AACnD,8CAIyB;AACzB,gDAAwE;AACxE,kDAI4B;AAI5B,SAAS,cAAc;IACrB,MAAM,CAAC,GAAG,SAAG,CAAC,eAAe,CAAC;IAC9B,IACE,CAAC,KAAK,YAAY;QAClB,CAAC,KAAK,OAAO;QACb,CAAC,KAAK,iBAAiB;QACvB,CAAC,KAAK,QAAQ;QACd,CAAC,KAAK,MAAM,EACZ,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,yDAAyD;AACzD,SAAgB,wBAAwB;IACtC,OAAO;QACL,cAAc,EAAE,IAAI;QAEpB,iBAAiB,EAAE,SAAG,CAAC,oBAAoB;QAC3C,YAAY,EAAE,SAAG,CAAC,cAAc;QAChC,cAAc,EAAE,SAAG,CAAC,iBAAiB;QACrC,iBAAiB,EAAE,MAAM;QACzB,YAAY,EAAE,SAAG,CAAC,cAAc;QAEhC,eAAe,EAAE,IAAI;QACrB,mBAAmB,EAAE,SAAG,CAAC,2BAA2B;QACpD,kBAAkB,EAAE,SAAG,CAAC,2BAA2B;QACnD,iBAAiB,EAAE,SAAG,CAAC,iBAAiB;QAExC,eAAe,EAAE,IAAI;QACrB,gBAAgB,EAAE,EAAE;QACpB,eAAe,EAAE,MAAM;QACvB,iBAAiB,EAAE,OAAO;QAE1B,eAAe,EAAE,IAAI;QACrB,kBAAkB,EAAE,EAAE;QACtB,iBAAiB,EAAE,SAAG,CAAC,iBAAiB;QAExC,mBAAmB,EAAE,IAAI;QACzB,mBAAmB,EAAE,GAAG;QACxB,gBAAgB,EAAE,MAAM;QACxB,qBAAqB,EAAE,SAAG,CAAC,iBAAiB;QAE5C,eAAe,EAAE,IAAI;QACrB,iBAAiB,EAAE,CAAC;QACpB,kBAAkB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;QAEvC,SAAS,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC;QAE/B,cAAc,EAAE,SAAG,CAAC,cAAc;QAClC,aAAa,EAAE,cAAc,EAAE;QAC/B,4EAA4E;QAC5E,cAAc,EAAE,CAAC,GAAG,mCAAuB,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAkB;IAC3C,IAAA,4BAAgB,EAAC;QACf,SAAS,EAAE,MAAM,CAAC,cAAc;QAChC,MAAM,EAAE,MAAM,CAAC,aAAa;QAC5B,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM;YAC3C,CAAC,CAAC,MAAM,CAAC,cAAc;YACvB,CAAC,CAAC,CAAC,GAAG,mCAAuB,CAAC;KACjC,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,UAAU,CAAC,IAAuC;IAChE,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAC;IACxC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO;YACL,GAAG,IAAI;YACP,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC;YAC9C,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC;YAClD,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;YAC7C,mBAAmB,EAAE,EAAE;YACvB,iBAAiB,EAAE,CAAC,GAAG,MAAM;YAC7B,gBAAgB,EAAE,EAAE;YACpB,iBAAiB,EAAE,EAAE,GAAG,MAAM;YAC9B,kBAAkB,EAAE,EAAE;YACtB,iBAAiB,EAAE,CAAC,GAAG,MAAM;YAC7B,mBAAmB,EAAE,GAAG;YACxB,qBAAqB,EAAE,CAAC,GAAG,MAAM;YACjC,eAAe,EAAE,KAAK;YACtB,iBAAiB,EAAE,CAAC;SACrB,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO;YACL,GAAG,IAAI;YACP,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;YAC7C,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YACjD,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;YAC5C,mBAAmB,EAAE,CAAC;YACtB,kBAAkB,EAAE,EAAE,GAAG,MAAM;YAC/B,iBAAiB,EAAE,EAAE,GAAG,MAAM;YAC9B,gBAAgB,EAAE,EAAE;YACpB,eAAe,EAAE,MAAM;YACvB,iBAAiB,EAAE,CAAC,GAAG,EAAE,GAAG,MAAM;YAClC,kBAAkB,EAAE,CAAC;YACrB,iBAAiB,EAAE,EAAE,GAAG,MAAM;YAC9B,mBAAmB,EAAE,EAAE;YACvB,gBAAgB,EAAE,MAAM;YACxB,qBAAqB,EAAE,EAAE,GAAG,MAAM;YAClC,eAAe,EAAE,IAAI;YACrB,iBAAiB,EAAE,CAAC;YACpB,kBAAkB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM;SACzC,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,IAA0B;IACnD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,OAAO,IAAA,sBAAW,EAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,WAAW,CAAC,GAAY,EAAE,QAAoB;IACrD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACrD,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAI,GAA+B,EAAE,CAAC;IACpE,IAAI,KAAK,CAAC,OAAO,CAAE,GAA+B,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9D,MAAM,CAAC,SAAS,GAAG,iBAAiB,CACjC,GAA+B,CAAC,SAAS,CAC3C,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAE,GAAoC,CAAC,cAAc,CAAC,EAAE,CAAC;QACxE,MAAM,CAAC,cAAc,GAAG,iBAAiB,CACtC,GAAoC,CAAC,cAAc,CACrD,CAAC;QACF,IAAI,CAAE,MAAM,CAAC,cAA2B,CAAC,MAAM,EAAE,CAAC;YAChD,MAAM,CAAC,cAAc,GAAG,CAAC,GAAG,mCAAuB,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IACD,uEAAuE;IACvE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QAC1C,MAAM,CAAC,cAAc,GAAG,CAAC,GAAG,mCAAuB,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,MAAM,GAAG,2BAAgB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;AACjD,CAAC;AAID,sFAAsF;AACtF,MAAM,aAAa,GAAG,KAAK,CAAC;AAE5B,MAAa,iBAAiB;IACpB,KAAK,GAAsB,IAAI,CAAC;IAChC,MAAM,GAAG,KAAK,CAAC;IACf,QAAQ,GAAG,CAAC,CAAC;IACb,YAAY,GAAkB,EAAE,CAAC;IAEzC,SAAS,CAAC,IAAiB;QACzB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAEO,WAAW;QACjB,IAAI,IAAI,CAAC,KAAK;YAAE,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,CAAC,EAAE,CAAC;YACN,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAED,yDAAyD;IACzD,OAAO;QACL,OAAO,IAAI,CAAC,KAAK,IAAI,wBAAwB,EAAE,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,iBAAM,CAAC,OAAO,CAAC,UAAU,CAAC;gBAC1C,KAAK,EAAE,EAAE,GAAG,EAAE,wBAAY,CAAC,WAAW,EAAE;aACzC,CAAC,CAAC;YACH,IAAI,GAAG,EAAE,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;gBAC5D,CAAC;gBAAC,MAAM,CAAC;oBACP,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC;gBACxB,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC;YACxB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,GAAG;QACP,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,GAAG,aAAa,EAAE,CAAC;YAC9E,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;QACrB,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAA4B;QACvC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;QACjC,IAAI,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAC5C,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACzC,cAAc,GAAG,iBAAiB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YAC3D,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC;gBAC3B,cAAc,GAAG,CAAC,GAAG,mCAAuB,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG;YACd,GAAG,OAAO;YACV,GAAG,OAAO;YACV,SAAS,EACP,OAAO,CAAC,SAAS,KAAK,SAAS;gBAC7B,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,SAAS,CAAC;gBACtC,CAAC,CAAC,OAAO,CAAC,SAAS;YACvB,cAAc;SACf,CAAC;QACF,MAAM,MAAM,GAAG,2BAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,iBAAM,CAAC,OAAO,CAAC,MAAM,CAAC;YAC1B,KAAK,EAAE,EAAE,GAAG,EAAE,wBAAY,CAAC,WAAW,EAAE;YACxC,MAAM,EAAE;gBACN,GAAG,EAAE,wBAAY,CAAC,WAAW;gBAC7B,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;aAC9B;YACD,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;SAC1C,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;QACpB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,kBAAkB;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,wBAAwB,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,aAAa,CAAC,EAAU;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC/B,sEAAsE;QACtE,OAAO,IAAA,oBAAS,EAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO,CAAC,MAAmB;QACzB,MAAM,CAAC,GAAG,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACnC,OAAO;YACL,cAAc,EAAE,CAAC,CAAC,cAAc;YAChC,eAAe,EAAE,CAAC,CAAC,eAAe;YAClC,eAAe,EAAE,CAAC,CAAC,eAAe;YAClC,eAAe,EAAE,CAAC,CAAC,eAAe;YAClC,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;YAC1C,eAAe,EAAE,CAAC,CAAC,eAAe;YAClC,cAAc,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,IAAI,CAAC;YACxC,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,cAAc,EAAE,CAAC,CAAC,cAAc;YAChC,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;YACxC,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;YAC1C,cAAc,EAAE,CAAC,CAAC,cAAc;YAChC,aAAa,EAAE,CAAC,CAAC,aAAa;SAC/B,CAAC;IACJ,CAAC;CACF;AA1HD,8CA0HC;AAEY,QAAA,iBAAiB,GAAG,IAAI,iBAAiB,EAAE,CAAC;AAEzD,6CAA6C;AAC7C,SAAgB,cAAc,CAAC,EAAsB;IACnD,OAAO,IAAA,sBAAW,EAAC,EAAE,IAAI,SAAS,CAAC,CAAC;AACtC,CAAC"}

package/dist/services/document.service.d.ts

@@ -0,0 +1,62 @@
+import type { DocumentPublicEntity } from '../entities/document-public.entity';
+import type { DocumentContextResult } from '../interfaces/document-context-result.interface';
+import type { MaterializedDocument } from '../interfaces/materialized-document.interface';
+export declare class DocumentService {
+    ensureStorageDir(): Promise<void>;
+    upload(input: {
+        apiKeyId: string;
+        originalName: string;
+        mimeType: string;
+        buffer: Buffer;
+        ip?: string;
+    }): Promise<DocumentPublicEntity>;
+    /**
+     * Resolve ownership id for Document.apiKeyId (required FK).
+     * OTP sessions use synthetic ids — map to a real admin/key row so upload
+     * and later getOwned/chat attachment paths agree.
+     */
+    private ownerId;
+    list(apiKeyId: string, limit?: number, offset?: number): Promise<{
+        items: DocumentPublicEntity[];
+        total: number;
+    }>;
+    getOwned(apiKeyId: string, documentId: string): Promise<{
+        id: string;
+        createdAt: Date;
+        apiKeyId: string;
+        originalName: string;
+        mimeType: string;
+        sizeBytes: number;
+        storageType: string;
+        contentCiphertext: Uint8Array | null;
+        contentIv: Uint8Array | null;
+        contentTag: Uint8Array | null;
+        storagePath: string | null;
+        checksumSha256: string;
+        deletedAt: Date | null;
+    }>;
+    getPublic(apiKeyId: string, documentId: string): Promise<DocumentPublicEntity>;
+    readDecryptedContent(apiKeyId: string, documentId: string): Promise<Buffer>;
+    softDelete(apiKeyId: string, documentId: string, ip?: string): Promise<void>;
+    /**
+     * Decrypt owned documents into `targetDir` so local engine (safe sandbox tools)
+     * can `read_file` / open them by absolute path.
+     */
+    materializeDocuments(apiKeyId: string, documentIds: string[], targetDir: string): Promise<MaterializedDocument[]>;
+    /**
+     * Build prompt context from documents. Optionally materialize files into
+     * `materializeDir`. Prefer `pathPrefix` (relative to cwd) in the prompt
+     * so tools never need absolute host paths.
+     */
+    buildContextFromDocuments(apiKeyId: string, documentIds: string[], maxChars: number, options?: {
+        materializeDir?: string;
+        pathPrefix?: string;
+    }): Promise<DocumentContextResult>;
+    /** Convert file bytes to prompt-safe text (PDF extract, textual decode, or placeholder). */
+    private bufferToContextText;
+    /** Best-effort PDF text via poppler `pdftotext` when installed. */
+    private extractPdfText;
+    private toPublic;
+}
+export declare const documentService: DocumentService;
+//# sourceMappingURL=document.service.d.ts.map

package/dist/services/document.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"document.service.d.ts","sourceRoot":"","sources":["../../src/services/document.service.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iDAAiD,CAAC;AAC7F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+CAA+C,CAAC;AAoB1F,qBAAa,eAAe;IACpB,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IAIjC,MAAM,CAAC,KAAK,EAAE;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,EAAE,CAAC,EAAE,MAAM,CAAC;KACb,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAgFjC;;;;OAIG;YACW,OAAO;IAIf,IAAI,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,SAAK,EACV,MAAM,SAAI,GACT,OAAO,CAAC;QAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAetD,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM;;;;;;;;;;;;;;;IA2B7C,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAK9E,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA4B3E,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuBlF;;;OAGG;IACG,oBAAoB,CACxB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EAAE,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,oBAAoB,EAAE,CAAC;IA+BlC;;;;OAIG;IACG,yBAAyB,CAC7B,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EAAE,EACrB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GACzD,OAAO,CAAC,qBAAqB,CAAC;IAuEjC,4FAA4F;YAC9E,mBAAmB;IA4BjC,mEAAmE;YACrD,cAAc;IAyB5B,OAAO,CAAC,QAAQ;CAiBjB;AAED,eAAO,MAAM,eAAe,iBAAwB,CAAC"}