ysk-server-core 1.0.0

package/dist/hosting/public-files.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Public File Server — Spec §4.5: sandboxed public root + nginx site.
+ * Always writes managed conf; system install needs root + YSK_EXECUTE.
+ */
+import type { HostExecutor } from '../host/executor.js';
+export interface PublicFilesApplyResult {
+    ok: boolean;
+    serverName: string;
+    publicRoot: string;
+    nginxPath: string;
+    systemConfPath?: string;
+    written: string[];
+    notes: string[];
+    nginxReloaded: boolean;
+    nginxTested: boolean;
+    requiresExecute: boolean;
+    requiresRoot: boolean;
+    /** Soft 404 risk: conf not live under /etc/nginx */
+    live: boolean;
+}
+export interface PublicFilesStatus {
+    publicRoot: string;
+    publicRootExists: boolean;
+    indexExists: boolean;
+    fileCount: number;
+    serverName?: string;
+    managedConf?: string;
+    managedConfExists: boolean;
+    systemConf?: string;
+    systemConfExists: boolean;
+    executeEnabled: boolean;
+    isRoot: boolean;
+    notes: string[];
+    /** Likely to serve HTTP for server_name when conf is in conf.d + nginx running */
+    likelyLive: boolean;
+}
+/**
+ * Ensure public root exists, write nginx static server + optional system reload.
+ */
+export declare function applyPublicFileServer(input: {
+    dataDir: string;
+    host: HostExecutor;
+    /** Server name e.g. files.example.com */
+    serverName: string;
+    quotaMb?: number;
+    reload?: boolean;
+}): Promise<PublicFilesApplyResult>;
+/** Status for Public Files page (honest live vs managed-only). */
+export declare function probePublicFileServer(input: {
+    dataDir: string;
+    host: HostExecutor;
+}): PublicFilesStatus;
+//# sourceMappingURL=public-files.d.ts.map

package/dist/hosting/public-files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-files.d.ts","sourceRoot":"","sources":["../../src/hosting/public-files.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAaH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAKxD,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,OAAO,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,aAAa,EAAE,OAAO,CAAC;IACvB,WAAW,EAAE,OAAO,CAAC;IACrB,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,EAAE,OAAO,CAAC;IACtB,oDAAoD;IACpD,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,cAAc,EAAE,OAAO,CAAC;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,kFAAkF;IAClF,UAAU,EAAE,OAAO,CAAC;CACrB;AAmGD;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;IACnB,yCAAyC;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAsLlC;AAED,kEAAkE;AAClE,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;CACpB,GAAG,iBAAiB,CAyFpB"}

package/dist/hosting/public-files.js

@@ -0,0 +1,324 @@
+/**
+ * Public File Server — Spec §4.5: sandboxed public root + nginx site.
+ * Always writes managed conf; system install needs root + YSK_EXECUTE.
+ */
+import { mkdirSync, writeFileSync, existsSync, readdirSync, statSync, chmodSync, readFileSync, } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { ErrorCodes, YskError, tl } from 'ysk-server-shared';
+import { planPublicFileServer } from './extras.js';
+import { writeManagedNginxConf, syncNginxConfigs } from './nginx-sync.js';
+import { publicFilesRoot } from '../files/manager.js';
+function confFileName(serverName) {
+    return `public-files-${serverName.replace(/\./g, '-')}.conf`;
+}
+function ensureNginxReadable(publicRoot, dataDir, notes) {
+    // Nginx (www-data) must traverse parents and read files — 750 on dataDir breaks public files.
+    try {
+        let cur = publicRoot;
+        const stop = dirname(dataDir);
+        while (cur && cur !== stop && cur !== '/' && cur.startsWith(dataDir)) {
+            try {
+                chmodSync(cur, 0o755);
+            }
+            catch {
+                /* */
+            }
+            const parent = dirname(cur);
+            if (parent === cur)
+                break;
+            cur = parent;
+        }
+        // dataDir itself: keep group-friendly but allow traverse for others (o+x)
+        try {
+            const st = statSync(dataDir);
+            const mode = st.mode & 0o777;
+            // ensure at least 751 so others can traverse into files/public
+            chmodSync(dataDir, mode | 0o001 | 0o011);
+        }
+        catch {
+            /* */
+        }
+        notes.push(tl('publicFiles.notes.permsFixed', {
+            defaultValue: `permissions adjusted for nginx read under ${publicRoot}`,
+        }));
+    }
+    catch (e) {
+        notes.push(`chmod for nginx readability failed: ${e instanceof Error ? e.message : String(e)}`);
+    }
+}
+function buildPublicFilesNginxConf(input) {
+    const { serverName, publicRoot, sslCert, sslKey } = input;
+    const hasSsl = Boolean(sslCert && sslKey && existsSync(sslCert) && existsSync(sslKey));
+    const common = `
+  root ${publicRoot};
+  index index.html index.htm;
+
+  charset utf-8;
+  autoindex on;
+  autoindex_exact_size off;
+  autoindex_localtime on;
+
+  # Cloudflare-friendly (ranges applied system-wide when Real IP is enabled)
+  real_ip_header CF-Connecting-IP;
+
+  location / {
+    try_files $uri $uri/ =404;
+  }
+
+  location ~ /\\. {
+    deny all;
+  }
+`;
+    if (!hasSsl) {
+        return `# YSK public files — ${serverName}
+# root must be readable by nginx worker (www-data)
+server {
+  listen 80;
+  listen [::]:80;
+  server_name ${serverName};
+${common}}
+`;
+    }
+    return `# YSK public files — ${serverName} (HTTP + HTTPS)
+server {
+  listen 80;
+  listen [::]:80;
+  server_name ${serverName};
+  return 301 https://$host$request_uri;
+}
+
+server {
+  listen 443 ssl http2;
+  listen [::]:443 ssl http2;
+  server_name ${serverName};
+  ssl_certificate ${sslCert};
+  ssl_certificate_key ${sslKey};
+${common}}
+`;
+}
+/**
+ * Ensure public root exists, write nginx static server + optional system reload.
+ */
+export async function applyPublicFileServer(input) {
+    const serverName = input.serverName.trim().toLowerCase();
+    if (!serverName || serverName.includes('..')) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n1387'), { httpStatus: 400 });
+    }
+    const plan = planPublicFileServer({
+        root: publicFilesRoot(input.dataDir),
+        quotaMb: input.quotaMb,
+    });
+    const publicRoot = plan.publicRoot;
+    mkdirSync(publicRoot, { recursive: true });
+    const index = join(publicRoot, 'index.html');
+    if (!existsSync(index)) {
+        writeFileSync(index, `<!doctype html><html><head><meta charset="utf-8"><title>YSK Files</title></head>
+<body><h1>YSK Public File Server</h1><p>Upload via Web Files UI (sandbox: files/public).</p></body></html>\n`, 'utf8');
+    }
+    const readme = join(publicRoot, 'README.txt');
+    writeFileSync(readme, [
+        'YSK managed public file root',
+        `Path: ${publicRoot}`,
+        `API: ${plan.apiPrefix}?root=public`,
+        `Quota soft target: ${plan.quotaMb} MiB`,
+        '',
+    ].join('\n'), 'utf8');
+    const notes = [
+        `Public root: ${publicRoot}`,
+        `API prefix: ${plan.apiPrefix}?root=public`,
+    ];
+    // nginx (www-data) must read this tree
+    ensureNginxReadable(publicRoot, input.dataDir, notes);
+    const leCert = `/etc/letsencrypt/live/${serverName}/fullchain.pem`;
+    const leKey = `/etc/letsencrypt/live/${serverName}/privkey.pem`;
+    const conf = buildPublicFilesNginxConf({
+        serverName,
+        publicRoot,
+        sslCert: existsSync(leCert) ? leCert : undefined,
+        sslKey: existsSync(leKey) ? leKey : undefined,
+    });
+    if (existsSync(leCert) && existsSync(leKey)) {
+        notes.push(`TLS: using Let's Encrypt cert for ${serverName}`);
+    }
+    else {
+        notes.push(tl('publicFiles.notes.httpOnly', {
+            defaultValue: 'HTTP only (port 80). No LE cert found — open http:// not https://, or issue SSL first.',
+        }));
+    }
+    const confName = confFileName(serverName);
+    const nginxPath = writeManagedNginxConf(input.dataDir, confName, conf);
+    notes.push(`Nginx conf (managed): ${nginxPath}`);
+    const written = [publicRoot, index, readme, nginxPath];
+    let nginxReloaded = false;
+    let nginxTested = false;
+    let systemConfPath;
+    let live = false;
+    const wantReload = input.reload === true ||
+        (input.reload !== false && input.host.executeEnabled() && input.host.isRoot());
+    if (wantReload && input.host.executeEnabled() && input.host.isRoot()) {
+        const sync = await syncNginxConfigs({
+            dataDir: input.dataDir,
+            systemConfDir: '/etc/nginx/conf.d',
+            host: input.host,
+            dryRun: false,
+        });
+        written.push(...sync.copied);
+        notes.push(...sync.notes);
+        nginxTested = Boolean(sync.tested);
+        systemConfPath = join('/etc/nginx/conf.d', `ysk-${confName}`);
+        if (existsSync(systemConfPath)) {
+            live = true;
+            notes.push(`System conf: ${systemConfPath}`);
+        }
+        else {
+            notes.push(tl('publicFiles.notes.systemConfMissing', {
+                defaultValue: `Expected system conf missing: ${systemConfPath}`,
+            }));
+        }
+        if (sync.tested) {
+            const rel = await input.host.runCommand(['systemctl', 'reload', 'nginx'], {
+                timeoutMs: 15_000,
+            });
+            nginxReloaded = rel.exitCode === 0;
+            notes.push(nginxReloaded
+                ? tl('notes.nginx.reloaded')
+                : tl('notes.nginx.reloadExit', { code: rel.exitCode }));
+        }
+        else {
+            notes.push(tl('publicFiles.notes.nginxTestFailed', {
+                defaultValue: 'nginx -t failed — conf copied but not reloaded; fix nginx -t first',
+            }));
+        }
+    }
+    else if (wantReload) {
+        notes.push(tl('ops.blocked.nginxReload'));
+        notes.push(tl('publicFiles.notes.needRootExecute', {
+            defaultValue: 'Managed conf written only. Need root + YSK_EXECUTE to install under /etc/nginx/conf.d and reload — otherwise domain returns default nginx 404.',
+        }));
+    }
+    else {
+        notes.push(tl('publicFiles.notes.noReload', {
+            defaultValue: 'reload=false: conf only under dataDir/nginx/conf.d (not active on public HTTP).',
+        }));
+    }
+    // Persist last server name for status UI
+    try {
+        const metaPath = join(input.dataDir, 'files', 'public-files-meta.json');
+        writeFileSync(metaPath, JSON.stringify({
+            serverName,
+            publicRoot,
+            nginxPath,
+            systemConfPath: systemConfPath ?? null,
+            updatedAt: new Date().toISOString(),
+        }, null, 2), 'utf8');
+        written.push(metaPath);
+    }
+    catch {
+        /* */
+    }
+    const ok = existsSync(nginxPath) &&
+        existsSync(publicRoot) &&
+        (!wantReload ||
+            !input.host.executeEnabled() ||
+            !input.host.isRoot() ||
+            (nginxTested && nginxReloaded));
+    if (wantReload && input.host.executeEnabled() && input.host.isRoot() && !nginxReloaded) {
+        notes.push(tl('publicFiles.notes.applyIncomplete', {
+            defaultValue: 'Apply incomplete: public site may still 404 until nginx conf is live and reloaded.',
+        }));
+    }
+    return {
+        ok,
+        serverName,
+        publicRoot,
+        nginxPath,
+        systemConfPath,
+        written,
+        notes,
+        nginxReloaded,
+        nginxTested,
+        requiresExecute: !input.host.executeEnabled(),
+        requiresRoot: !input.host.isRoot(),
+        live,
+    };
+}
+/** Status for Public Files page (honest live vs managed-only). */
+export function probePublicFileServer(input) {
+    const publicRoot = publicFilesRoot(input.dataDir);
+    const notes = [];
+    let serverName;
+    let managedConf;
+    let systemConf;
+    const metaPath = join(input.dataDir, 'files', 'public-files-meta.json');
+    if (existsSync(metaPath)) {
+        try {
+            const meta = JSON.parse(readFileSync(metaPath, 'utf8'));
+            serverName = meta.serverName;
+            managedConf = meta.nginxPath;
+            systemConf = meta.systemConfPath ?? undefined;
+        }
+        catch {
+            notes.push('public-files-meta.json unreadable');
+        }
+    }
+    // Discover managed confs if meta missing
+    const confDir = join(input.dataDir, 'nginx', 'conf.d');
+    if (!managedConf && existsSync(confDir)) {
+        const found = readdirSync(confDir).filter((f) => f.startsWith('public-files-') && f.endsWith('.conf'));
+        if (found[0]) {
+            managedConf = join(confDir, found[0]);
+            if (!serverName) {
+                const m = /^public-files-(.+)\.conf$/.exec(found[0]);
+                if (m)
+                    serverName = m[1].replace(/-/g, '.');
+            }
+        }
+    }
+    if (managedConf && !systemConf) {
+        systemConf = join('/etc/nginx/conf.d', `ysk-${managedConf.split('/').pop()}`);
+    }
+    let fileCount = 0;
+    try {
+        if (existsSync(publicRoot)) {
+            fileCount = readdirSync(publicRoot).length;
+        }
+    }
+    catch {
+        /* */
+    }
+    const managedConfExists = Boolean(managedConf && existsSync(managedConf));
+    const systemConfExists = Boolean(systemConf && existsSync(systemConf));
+    const indexExists = existsSync(join(publicRoot, 'index.html'));
+    const executeEnabled = input.host.executeEnabled();
+    const isRoot = input.host.isRoot();
+    if (!managedConfExists) {
+        notes.push(tl('publicFiles.notes.noManagedConf', {
+            defaultValue: 'No managed nginx conf yet — click Apply',
+        }));
+    }
+    if (managedConfExists && !systemConfExists) {
+        notes.push(tl('publicFiles.notes.notSynced', {
+            defaultValue: 'Managed conf exists but not under /etc/nginx/conf.d — need root + EXECUTE apply with reload',
+        }));
+    }
+    if (systemConfExists) {
+        notes.push(`Live system conf: ${systemConf}`);
+    }
+    notes.push(`Public root: ${publicRoot}`);
+    return {
+        publicRoot,
+        publicRootExists: existsSync(publicRoot),
+        indexExists,
+        fileCount,
+        serverName,
+        managedConf,
+        managedConfExists,
+        systemConf,
+        systemConfExists,
+        executeEnabled,
+        isRoot,
+        notes,
+        likelyLive: systemConfExists && indexExists,
+    };
+}
+//# sourceMappingURL=public-files.js.map

package/dist/hosting/public-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-files.js","sourceRoot":"","sources":["../../src/hosting/public-files.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,SAAS,EACT,aAAa,EACb,UAAU,EACV,WAAW,EACX,QAAQ,EACR,SAAS,EACT,YAAY,GACb,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAE7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAmCtD,SAAS,YAAY,CAAC,UAAkB;IACtC,OAAO,gBAAgB,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC;AAC/D,CAAC;AAED,SAAS,mBAAmB,CAAC,UAAkB,EAAE,OAAe,EAAE,KAAe;IAC/E,8FAA8F;IAC9F,IAAI,CAAC;QACH,IAAI,GAAG,GAAG,UAAU,CAAC;QACrB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9B,OAAO,GAAG,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACrE,IAAI,CAAC;gBACH,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,KAAK;YACP,CAAC;YACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,MAAM,KAAK,GAAG;gBAAE,MAAM;YAC1B,GAAG,GAAG,MAAM,CAAC;QACf,CAAC;QACD,0EAA0E;QAC1E,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC7B,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC;YAC7B,+DAA+D;YAC/D,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,KAAK;QACP,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,8BAA8B,EAAE;YAC5C,YAAY,EAAE,6CAA6C,UAAU,EAAE;SACxE,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,KAAK,CAAC,IAAI,CACR,uCAAuC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CACpF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,KAKlC;IACC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAC1D,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAEvF,MAAM,MAAM,GAAG;SACR,UAAU;;;;;;;;;;;;;;;;;;CAkBlB,CAAC;IAEA,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,wBAAwB,UAAU;;;;;gBAK7B,UAAU;EACxB,MAAM;CACP,CAAC;IACA,CAAC;IAED,OAAO,wBAAwB,UAAU;;;;gBAI3B,UAAU;;;;;;;gBAOV,UAAU;oBACN,OAAO;wBACH,MAAM;EAC5B,MAAM;CACP,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAO3C;IACC,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzD,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,IAAI,GAAG,oBAAoB,CAAC;QAChC,IAAI,EAAE,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACnC,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC7C,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,aAAa,CACX,KAAK,EACL;6GACuG,EACvG,MAAM,CACP,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC9C,aAAa,CACX,MAAM,EACN;QACE,8BAA8B;QAC9B,SAAS,UAAU,EAAE;QACrB,QAAQ,IAAI,CAAC,SAAS,cAAc;QACpC,sBAAsB,IAAI,CAAC,OAAO,MAAM;QACxC,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,MAAM,CACP,CAAC;IAEF,MAAM,KAAK,GAAa;QACtB,gBAAgB,UAAU,EAAE;QAC5B,eAAe,IAAI,CAAC,SAAS,cAAc;KAC5C,CAAC;IAEF,uCAAuC;IACvC,mBAAmB,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAEtD,MAAM,MAAM,GAAG,yBAAyB,UAAU,gBAAgB,CAAC;IACnE,MAAM,KAAK,GAAG,yBAAyB,UAAU,cAAc,CAAC;IAChE,MAAM,IAAI,GAAG,yBAAyB,CAAC;QACrC,UAAU;QACV,UAAU;QACV,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAChD,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;KAC9C,CAAC,CAAC;IACH,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,KAAK,CAAC,IAAI,CAAC,qCAAqC,UAAU,EAAE,CAAC,CAAC;IAChE,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,4BAA4B,EAAE;YAC/B,YAAY,EACV,wFAAwF;SAC3F,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACvE,KAAK,CAAC,IAAI,CAAC,yBAAyB,SAAS,EAAE,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IACvD,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,cAAkC,CAAC;IACvC,IAAI,IAAI,GAAG,KAAK,CAAC;IAEjB,MAAM,UAAU,GACd,KAAK,CAAC,MAAM,KAAK,IAAI;QACrB,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAEjF,IAAI,UAAU,IAAI,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QACrE,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC;YAClC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,aAAa,EAAE,mBAAmB;YAClC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnC,cAAc,GAAG,IAAI,CAAC,mBAAmB,EAAE,OAAO,QAAQ,EAAE,CAAC,CAAC;QAC9D,IAAI,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAC/B,IAAI,GAAG,IAAI,CAAC;YACZ,KAAK,CAAC,IAAI,CAAC,gBAAgB,cAAc,EAAE,CAAC,CAAC;QAC/C,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,qCAAqC,EAAE;gBACxC,YAAY,EAAE,iCAAiC,cAAc,EAAE;aAChE,CAAC,CACH,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE;gBACxE,SAAS,EAAE,MAAM;aAClB,CAAC,CAAC;YACH,aAAa,GAAG,GAAG,CAAC,QAAQ,KAAK,CAAC,CAAC;YACnC,KAAK,CAAC,IAAI,CACR,aAAa;gBACX,CAAC,CAAC,EAAE,CAAC,sBAAsB,CAAC;gBAC5B,CAAC,CAAC,EAAE,CAAC,wBAAwB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CACzD,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,mCAAmC,EAAE;gBACtC,YAAY,EAAE,oEAAoE;aACnF,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,IAAI,UAAU,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,yBAAyB,CAAC,CAAC,CAAC;QAC1C,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,mCAAmC,EAAE;YACtC,YAAY,EACV,gJAAgJ;SACnJ,CAAC,CACH,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,4BAA4B,EAAE;YAC/B,YAAY,EACV,iFAAiF;SACpF,CAAC,CACH,CAAC;IACJ,CAAC;IAED,yCAAyC;IACzC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,wBAAwB,CAAC,CAAC;QACxE,aAAa,CACX,QAAQ,EACR,IAAI,CAAC,SAAS,CACZ;YACE,UAAU;YACV,UAAU;YACV,SAAS;YACT,cAAc,EAAE,cAAc,IAAI,IAAI;YACtC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,EACD,IAAI,EACJ,CAAC,CACF,EACD,MAAM,CACP,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,KAAK;IACP,CAAC;IAED,MAAM,EAAE,GACN,UAAU,CAAC,SAAS,CAAC;QACrB,UAAU,CAAC,UAAU,CAAC;QACtB,CAAC,CAAC,UAAU;YACV,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE;YAC5B,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE;YACpB,CAAC,WAAW,IAAI,aAAa,CAAC,CAAC,CAAC;IAEpC,IAAI,UAAU,IAAI,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;QACvF,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,mCAAmC,EAAE;YACtC,YAAY,EACV,oFAAoF;SACvF,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE;QACF,UAAU;QACV,UAAU;QACV,SAAS;QACT,cAAc;QACd,OAAO;QACP,KAAK;QACL,aAAa;QACb,WAAW;QACX,eAAe,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE;QAC7C,YAAY,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE;QAClC,IAAI;KACL,CAAC;AACJ,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,qBAAqB,CAAC,KAGrC;IACC,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,UAA8B,CAAC;IACnC,IAAI,WAA+B,CAAC;IACpC,IAAI,UAA8B,CAAC;IAEnC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,wBAAwB,CAAC,CAAC;IACxE,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAIrD,CAAC;YACF,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;YAC7B,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC;YAC7B,UAAU,GAAG,IAAI,CAAC,cAAc,IAAI,SAAS,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,yCAAyC;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACvD,IAAI,CAAC,WAAW,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACvG,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACb,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACtC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,CAAC,GAAG,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBACrD,IAAI,CAAC;oBAAE,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,WAAW,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/B,UAAU,GAAG,IAAI,CAAC,mBAAmB,EAAE,OAAO,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3B,SAAS,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;QAC7C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,KAAK;IACP,CAAC;IAED,MAAM,iBAAiB,GAAG,OAAO,CAAC,WAAW,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1E,MAAM,gBAAgB,GAAG,OAAO,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IACvE,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;IAC/D,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;IACnD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IAEnC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,iCAAiC,EAAE;YACpC,YAAY,EAAE,yCAAyC;SACxD,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,iBAAiB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC3C,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,6BAA6B,EAAE;YAChC,YAAY,EACV,6FAA6F;SAChG,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,gBAAgB,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,qBAAqB,UAAU,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,gBAAgB,UAAU,EAAE,CAAC,CAAC;IAEzC,OAAO;QACL,UAAU;QACV,gBAAgB,EAAE,UAAU,CAAC,UAAU,CAAC;QACxC,WAAW;QACX,SAAS;QACT,UAAU;QACV,WAAW;QACX,iBAAiB;QACjB,UAAU;QACV,gBAAgB;QAChB,cAAc;QACd,MAAM;QACN,KAAK;QACL,UAAU,EAAE,gBAAgB,IAAI,WAAW;KAC5C,CAAC;AACJ,CAAC"}

package/dist/hosting/quota.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Project disk quota: metadata + real du measurement.
+ */
+import type { HostExecutor } from '../host/executor.js';
+export interface QuotaStatus {
+    projectId: string;
+    homeDir: string;
+    quotaMb: number | null;
+    usedBytes: number;
+    usedMb: number;
+    withinQuota: boolean | null;
+    notes: string[];
+}
+/**
+ * Measure directory size via `du -sb` (fallback 0 if unavailable).
+ */
+export declare function measureDirBytes(host: HostExecutor, dir: string): Promise<{
+    bytes: number;
+    notes: string[];
+}>;
+export declare function checkProjectQuota(input: {
+    host: HostExecutor;
+    projectId: string;
+    homeDir: string;
+    quotaMb?: number | null;
+}): Promise<QuotaStatus>;
+export declare function assertQuotaMb(quotaMb: number): void;
+/** Throw if project is over soft disk quota (hard enforce before deploy/write). */
+export declare function assertWithinQuota(input: {
+    host: HostExecutor;
+    projectId: string;
+    homeDir: string;
+    quotaMb?: number | null;
+    action?: string;
+}): Promise<void>;
+//# sourceMappingURL=quota.d.ts.map

package/dist/hosting/quota.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quota.d.ts","sourceRoot":"","sources":["../../src/hosting/quota.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGxD,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,OAAO,GAAG,IAAI,CAAC;IAC5B,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;GAEG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,YAAY,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAqB7C;AAED,wBAAsB,iBAAiB,CAAC,KAAK,EAAE;IAC7C,IAAI,EAAE,YAAY,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,GAAG,OAAO,CAAC,WAAW,CAAC,CAkBvB;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAInD;AAED,mFAAmF;AACnF,wBAAsB,iBAAiB,CAAC,KAAK,EAAE;IAC7C,IAAI,EAAE,YAAY,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAehB"}

package/dist/hosting/quota.js

@@ -0,0 +1,70 @@
+/**
+ * Project disk quota: metadata + real du measurement.
+ */
+import { existsSync } from 'node:fs';
+import { ErrorCodes, YskError, tl } from 'ysk-server-shared';
+/**
+ * Measure directory size via `du -sb` (fallback 0 if unavailable).
+ */
+export async function measureDirBytes(host, dir) {
+    if (!existsSync(dir)) {
+        return { bytes: 0, notes: [`missing ${dir}`] };
+    }
+    const r = await host.runCommand(['du', '-sb', dir], { timeoutMs: 60_000 });
+    if (r.exitCode !== 0) {
+        // busybox / mac-like fallback
+        const r2 = await host.runCommand(['bash', '-c', `du -sk "${dir}" | cut -f1`], {
+            timeoutMs: 60_000,
+        });
+        const kb = Number(r2.stdout.trim());
+        if (Number.isFinite(kb)) {
+            return { bytes: kb * 1024, notes: ['used du -sk fallback'] };
+        }
+        return { bytes: 0, notes: [`du failed: ${r.stderr}`] };
+    }
+    const bytes = Number(r.stdout.trim().split(/\s+/)[0]);
+    return {
+        bytes: Number.isFinite(bytes) ? bytes : 0,
+        notes: [],
+    };
+}
+export async function checkProjectQuota(input) {
+    const { bytes, notes } = await measureDirBytes(input.host, input.homeDir);
+    const usedMb = Math.round((bytes / (1024 * 1024)) * 100) / 100;
+    const quotaMb = input.quotaMb ?? null;
+    let withinQuota = null;
+    if (quotaMb != null && quotaMb > 0) {
+        withinQuota = usedMb <= quotaMb;
+        if (!withinQuota)
+            notes.push(tl('notes.auto.t0367', { v0: (usedMb), v1: (quotaMb) }));
+    }
+    return {
+        projectId: input.projectId,
+        homeDir: input.homeDir,
+        quotaMb,
+        usedBytes: bytes,
+        usedMb,
+        withinQuota,
+        notes,
+    };
+}
+export function assertQuotaMb(quotaMb) {
+    if (!Number.isFinite(quotaMb) || quotaMb < 1 || quotaMb > 1_000_000) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n1510'), { httpStatus: 400 });
+    }
+}
+/** Throw if project is over soft disk quota (hard enforce before deploy/write). */
+export async function assertWithinQuota(input) {
+    if (input.quotaMb == null || input.quotaMb <= 0)
+        return;
+    const st = await checkProjectQuota({
+        host: input.host,
+        projectId: input.projectId,
+        homeDir: input.homeDir,
+        quotaMb: input.quotaMb,
+    });
+    if (st.withinQuota === false) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.t0368', { v0: (st.usedMb), v1: (st.quotaMb), v2: (input.action ?? tl('notes.tpl.continueOp')) }), { httpStatus: 403 });
+    }
+}
+//# sourceMappingURL=quota.js.map

package/dist/hosting/quota.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quota.js","sourceRoot":"","sources":["../../src/hosting/quota.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAC,MAAM,mBAAmB,CAAC;AAY5D;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAkB,EAClB,GAAW;IAEX,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,WAAW,GAAG,EAAE,CAAC,EAAE,CAAC;IACjD,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3E,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACrB,8BAA8B;QAC9B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,aAAa,CAAC,EAAE;YAC5E,SAAS,EAAE,MAAM;SAClB,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACpC,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC/D,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;IACzD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACzC,KAAK,EAAE,EAAE;KACV,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAKvC;IACC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;IAC/D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC;IACtC,IAAI,WAAW,GAAmB,IAAI,CAAC;IACvC,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QACnC,WAAW,GAAG,MAAM,IAAI,OAAO,CAAC;QAChC,IAAI,CAAC,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IACxF,CAAC;IACD,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO;QACP,SAAS,EAAE,KAAK;QAChB,MAAM;QACN,WAAW;QACX,KAAK;KACN,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,SAAS,EAAE,CAAC;QACpE,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IACzF,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAMvC;IACC,IAAI,KAAK,CAAC,OAAO,IAAI,IAAI,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC;QAAE,OAAO;IACxD,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC;QACjC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IACH,IAAI,EAAE,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;QAC7B,MAAM,IAAI,QAAQ,CAChB,UAAU,CAAC,UAAU,EACrB,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,EAC/G,EAAE,UAAU,EAAE,GAAG,EAAE,CACpB,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/hosting/real-ip/apply.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Write Apache RemoteIP + managed nginx real-ip include; optional system apply.
+ */
+import type { HostExecutor } from '../../host/executor.js';
+import type { RealIpHostConfig } from './types.js';
+export declare function applyRealIpArtifacts(input: {
+    dataDir: string;
+    host?: HostExecutor;
+    /** Also enable Apache remoteip module on system */
+    enableApacheRemoteIp?: boolean;
+}): Promise<{
+    ok: boolean;
+    written: string[];
+    notes: string[];
+    config: RealIpHostConfig;
+}>;
+//# sourceMappingURL=apply.d.ts.map

package/dist/hosting/real-ip/apply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.d.ts","sourceRoot":"","sources":["../../../src/hosting/real-ip/apply.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAG3D,OAAO,KAAK,EAAE,gBAAgB,EAAoB,MAAM,YAAY,CAAC;AAErE,wBAAsB,oBAAoB,CAAC,KAAK,EAAE;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,mDAAmD;IACnD,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC,GAAG,OAAO,CAAC;IACV,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,gBAAgB,CAAC;CAC1B,CAAC,CAwDD"}

package/dist/hosting/real-ip/apply.js

@@ -0,0 +1,62 @@
+/**
+ * Write Apache RemoteIP + managed nginx real-ip include; optional system apply.
+ */
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { renderApacheRemoteIpConf, renderNginxRealIpBlock } from './render.js';
+import { loadRealIpConfig } from './store.js';
+export async function applyRealIpArtifacts(input) {
+    const notes = [];
+    const written = [];
+    const config = loadRealIpConfig(input.dataDir);
+    // Per-provider nginx snippets under dataDir
+    const nginxInc = join(input.dataDir, 'nginx', 'real-ip');
+    mkdirSync(nginxInc, { recursive: true });
+    for (const id of [
+        'none',
+        'cloudflare',
+        'fastly',
+        'bunny',
+        'cloudfront',
+        'azure_frontdoor',
+        'gcore',
+        'custom',
+    ]) {
+        const body = renderNginxRealIpBlock({ provider: id, host: config });
+        const path = join(nginxInc, `${id}.conf`);
+        writeFileSync(path, body ? body + '\n' : '# real_ip disabled\n', 'utf8');
+        written.push(path);
+    }
+    // Active default
+    const active = renderNginxRealIpBlock({
+        provider: config.defaultProvider,
+        host: config,
+    });
+    const activePath = join(nginxInc, 'active.conf');
+    writeFileSync(activePath, active ? active + '\n' : '# real_ip disabled\n', 'utf8');
+    written.push(activePath);
+    notes.push(`nginx real-ip snippets → ${nginxInc}`);
+    // Apache RemoteIP for PHP backend
+    const apacheDir = join(input.dataDir, 'apache', 'conf-available');
+    mkdirSync(apacheDir, { recursive: true });
+    const apachePath = join(apacheDir, 'ysk-remoteip.conf');
+    writeFileSync(apachePath, renderApacheRemoteIpConf(), 'utf8');
+    written.push(apachePath);
+    notes.push(`apache RemoteIP → ${apachePath}`);
+    if (input.enableApacheRemoteIp && input.host?.executeEnabled() && input.host.isRoot()) {
+        const dest = '/etc/apache2/conf-available/ysk-remoteip.conf';
+        const cp = await input.host.runCommand(['cp', apachePath, dest], { timeoutMs: 10_000 });
+        notes.push(`cp RemoteIP exit=${cp.exitCode}`);
+        await input.host.runCommand(['a2enmod', 'remoteip'], { timeoutMs: 10_000 });
+        await input.host.runCommand(['a2enconf', 'ysk-remoteip'], { timeoutMs: 10_000 });
+        const rel = await input.host.runCommand(['systemctl', 'reload', 'apache2'], {
+            timeoutMs: 15_000,
+        });
+        notes.push(`apache2 reload exit=${rel.exitCode}`);
+    }
+    else if (input.enableApacheRemoteIp) {
+        notes.push('Apache RemoteIP system install skipped (need root + YSK_EXECUTE)');
+    }
+    return { ok: true, written, notes, config };
+}
+//# sourceMappingURL=apply.js.map

package/dist/hosting/real-ip/apply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.js","sourceRoot":"","sources":["../../../src/hosting/real-ip/apply.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAG9C,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAK1C;IAMC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAE/C,4CAA4C;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACzD,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,KAAK,MAAM,EAAE,IAAI;QACf,MAAM;QACN,YAAY;QACZ,QAAQ;QACR,OAAO;QACP,YAAY;QACZ,iBAAiB;QACjB,OAAO;QACP,QAAQ;KACa,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,sBAAsB,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC1C,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;QACzE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IACD,iBAAiB;IACjB,MAAM,MAAM,GAAG,sBAAsB,CAAC;QACpC,QAAQ,EAAE,MAAM,CAAC,eAAe;QAChC,IAAI,EAAE,MAAM;KACb,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACjD,aAAa,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;IACnF,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzB,KAAK,CAAC,IAAI,CAAC,4BAA4B,QAAQ,EAAE,CAAC,CAAC;IAEnD,kCAAkC;IAClC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IAClE,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACxD,aAAa,CAAC,UAAU,EAAE,wBAAwB,EAAE,EAAE,MAAM,CAAC,CAAC;IAC9D,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzB,KAAK,CAAC,IAAI,CAAC,qBAAqB,UAAU,EAAE,CAAC,CAAC;IAE9C,IAAI,KAAK,CAAC,oBAAoB,IAAI,KAAK,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QACtF,MAAM,IAAI,GAAG,+CAA+C,CAAC;QAC7D,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QACxF,KAAK,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9C,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5E,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QACjF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE;YAC1E,SAAS,EAAE,MAAM;SAClB,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,uBAAuB,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACpD,CAAC;SAAM,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;IACjF,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC9C,CAAC"}

package/dist/hosting/real-ip/index.d.ts

@@ -0,0 +1,7 @@
+export * from './types.js';
+export * from './providers.js';
+export * from './store.js';
+export * from './render.js';
+export * from './refresh.js';
+export * from './apply.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/hosting/real-ip/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/hosting/real-ip/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}

package/dist/hosting/real-ip/index.js

@@ -0,0 +1,7 @@
+export * from './types.js';
+export * from './providers.js';
+export * from './store.js';
+export * from './render.js';
+export * from './refresh.js';
+export * from './apply.js';
+//# sourceMappingURL=index.js.map

package/dist/hosting/real-ip/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/hosting/real-ip/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}

package/dist/hosting/real-ip/providers.d.ts

@@ -0,0 +1,12 @@
+/**
+ * CDN / edge provider catalog + bundled CIDR snapshots.
+ * Snapshots are best-effort; use refresh() for up-to-date lists.
+ */
+import type { RealIpProviderDef, RealIpProviderId } from './types.js';
+export declare const REAL_IP_PROVIDERS: RealIpProviderDef[];
+export declare function getRealIpProvider(id: RealIpProviderId): RealIpProviderDef;
+export declare function listRealIpProviders(): RealIpProviderDef[];
+/** Loose CIDR / IP validation for config input. */
+export declare function isValidCidrOrIp(s: string): boolean;
+export declare function normalizeCidrList(list: string[]): string[];
+//# sourceMappingURL=providers.d.ts.map

package/dist/hosting/real-ip/providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../../src/hosting/real-ip/providers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAwItE,eAAO,MAAM,iBAAiB,EAAE,iBAAiB,EAmEhD,CAAC;AAEF,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,gBAAgB,GAAG,iBAAiB,CAEzE;AAED,wBAAgB,mBAAmB,IAAI,iBAAiB,EAAE,CAEzD;AAED,mDAAmD;AACnD,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAQlD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAc1D"}