ysk-server-core 1.0.0

package/dist/hosting/service-exposure/geo-countries.js

@@ -0,0 +1,245 @@
+/**
+ * L2: country allowlist for service exposure (ipset best-effort).
+ * Zone files: dataDir/geoip/country-zones/{cc}.zone (ipdeny-style one CIDR per line).
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { tl } from 'ysk-server-shared';
+import { sanitizeSvcToken } from 'ysk-server-shared';
+const MAX_COUNTRIES = 32;
+const MAX_CIDRS_PER_COUNTRY = 4000;
+const MAX_TOTAL_CIDRS = 12_000;
+export function normalizeCountries(list) {
+    if (!Array.isArray(list))
+        return [];
+    const out = [];
+    const seen = new Set();
+    for (const item of list) {
+        const cc = String(item ?? '')
+            .trim()
+            .toUpperCase();
+        if (!/^[A-Z]{2}$/.test(cc) || seen.has(cc))
+            continue;
+        seen.add(cc);
+        out.push(cc);
+        if (out.length >= MAX_COUNTRIES)
+            break;
+    }
+    return out;
+}
+export function countryZonesDir(dataDir) {
+    return join(dataDir, 'geoip', 'country-zones');
+}
+export function countryZonePath(dataDir, cc) {
+    return join(countryZonesDir(dataDir), `${cc.toLowerCase()}.zone`);
+}
+/** Read CIDRs from a zone file (skip comments/empty). */
+export function readCountryZoneCidrs(dataDir, cc) {
+    const path = countryZonePath(dataDir, cc);
+    if (!existsSync(path))
+        return [];
+    try {
+        const body = readFileSync(path, 'utf8');
+        const out = [];
+        for (const line of body.split('\n')) {
+            const t = line.trim();
+            if (!t || t.startsWith('#'))
+                continue;
+            // basic IPv4/IPv6 CIDR or bare IP
+            if (!/^[\da-fA-F:.\/]+$/.test(t))
+                continue;
+            out.push(t);
+            if (out.length >= MAX_CIDRS_PER_COUNTRY)
+                break;
+        }
+        return out;
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Best-effort download of a country zone (ipdeny aggregate).
+ * Fail-soft: returns notes, never throws.
+ */
+export async function ensureCountryZoneFile(dataDir, cc, fetchImpl = fetch) {
+    const notes = [];
+    const code = cc.toLowerCase();
+    if (!/^[a-z]{2}$/.test(code)) {
+        return { ok: false, notes: [tl('notes.serviceExposure.badCountry', { cc })], cidrCount: 0 };
+    }
+    const dir = countryZonesDir(dataDir);
+    mkdirSync(dir, { recursive: true });
+    const path = countryZonePath(dataDir, code);
+    const existing = readCountryZoneCidrs(dataDir, code);
+    if (existing.length > 0) {
+        return { ok: true, path, notes: [], cidrCount: existing.length };
+    }
+    const url = `https://www.ipdeny.com/ipblocks/data/aggregated/${code}-aggregated.zone`;
+    try {
+        const ac = new AbortController();
+        const timer = setTimeout(() => ac.abort(), 25_000);
+        const res = await fetchImpl(url, { signal: ac.signal });
+        clearTimeout(timer);
+        if (!res.ok) {
+            notes.push(tl('notes.serviceExposure.zoneDownloadFail', {
+                cc: code.toUpperCase(),
+                detail: String(res.status),
+            }));
+            return { ok: false, notes, cidrCount: 0 };
+        }
+        const text = await res.text();
+        const lines = text
+            .split('\n')
+            .map((l) => l.trim())
+            .filter((l) => l && !l.startsWith('#') && /^[\da-fA-F:.\/]+$/.test(l))
+            .slice(0, MAX_CIDRS_PER_COUNTRY);
+        if (!lines.length) {
+            notes.push(tl('notes.serviceExposure.zoneEmpty', { cc: code.toUpperCase() }));
+            return { ok: false, notes, cidrCount: 0 };
+        }
+        writeFileSync(path, `# ysk country zone ${code}\n${lines.join('\n')}\n`, 'utf8');
+        notes.push(tl('notes.serviceExposure.zoneDownloaded', {
+            cc: code.toUpperCase(),
+            n: lines.length,
+        }));
+        return { ok: true, path, notes, cidrCount: lines.length };
+    }
+    catch (e) {
+        notes.push(tl('notes.serviceExposure.zoneDownloadFail', {
+            cc: code.toUpperCase(),
+            detail: e instanceof Error ? e.message.slice(0, 120) : 'fetch failed',
+        }));
+        return { ok: false, notes, cidrCount: 0 };
+    }
+}
+export function ipsetNameForService(serviceId) {
+    const id = sanitizeSvcToken(serviceId).replace(/[^a-z0-9_-]/g, '').slice(0, 20);
+    return `yskgeo_${id || 'svc'}`;
+}
+/**
+ * Rebuild ipset for service country allowlist and install INPUT accept for listed ports.
+ * Best-effort: requires root + EXECUTE + ipset binary.
+ */
+export async function applyCountryIpsetAllow(input) {
+    const notes = [];
+    const countries = normalizeCountries(input.countries);
+    if (!countries.length) {
+        return { ok: true, notes: [] };
+    }
+    if (!input.host.executeEnabled()) {
+        return {
+            ok: false,
+            blocked: true,
+            notes: [tl('notes.serviceExposure.geoNeedExecute')],
+        };
+    }
+    if (!input.host.isRoot()) {
+        return {
+            ok: false,
+            blocked: true,
+            notes: [tl('notes.serviceExposure.geoNeedRoot')],
+        };
+    }
+    // Collect CIDRs
+    let allCidrs = [];
+    for (const cc of countries) {
+        if (input.fetchZones !== false) {
+            const dl = await ensureCountryZoneFile(input.dataDir, cc);
+            notes.push(...dl.notes.slice(0, 2));
+        }
+        const cidrs = readCountryZoneCidrs(input.dataDir, cc);
+        if (!cidrs.length) {
+            notes.push(tl('notes.serviceExposure.zoneMissing', { cc }));
+            continue;
+        }
+        allCidrs = allCidrs.concat(cidrs);
+        if (allCidrs.length >= MAX_TOTAL_CIDRS) {
+            allCidrs = allCidrs.slice(0, MAX_TOTAL_CIDRS);
+            notes.push(tl('notes.serviceExposure.zoneCidrCap', { n: MAX_TOTAL_CIDRS }));
+            break;
+        }
+    }
+    if (!allCidrs.length) {
+        notes.push(tl('notes.serviceExposure.geoNoCidrs'));
+        return { ok: false, notes };
+    }
+    const setName = ipsetNameForService(input.serviceId);
+    // Check ipset
+    const has = await input.host.runCommand(['bash', '-c', 'command -v ipset'], {
+        timeoutMs: 5_000,
+    });
+    if (has.exitCode !== 0) {
+        notes.push(tl('notes.serviceExposure.ipsetMissing'));
+        notes.push(tl('notes.serviceExposure.geoBestEffort'));
+        return { ok: false, notes, setName };
+    }
+    // Write members file under dataDir for bulk restore
+    const membersPath = join(countryZonesDir(input.dataDir), `_set_${sanitizeSvcToken(input.serviceId)}.txt`);
+    mkdirSync(countryZonesDir(input.dataDir), { recursive: true });
+    writeFileSync(membersPath, allCidrs.join('\n') + '\n', 'utf8');
+    const script = [
+        'set -e',
+        `ipset destroy ${setName} 2>/dev/null || true`,
+        `ipset create ${setName} hash:net family inet maxelem ${Math.max(allCidrs.length + 64, 65536)}`,
+        // also try inet6 set name
+        `while read -r c; do [ -n "$c" ] && ipset add ${setName} "$c" 2>/dev/null || true; done < ${JSON.stringify(membersPath)}`,
+        // Remove previous ysk-geo comment rules for this set (best-effort by comment match in iptables - not UFW)
+        // Insert accept for each port from set
+        ...input.ports.flatMap((p) => {
+            const port = String(p.port).includes(':')
+                ? String(p.port).replace(':', ':')
+                : String(p.port);
+            // multiport ranges: use multiport if needed; single/range with :
+            if (port.includes(':')) {
+                const [a, b] = port.split(':');
+                return [
+                    `iptables -C INPUT -p ${p.proto} -m multiport --dports ${a}:${b} -m set --match-set ${setName} src -j ACCEPT -m comment --comment 'ysk-geo:${setName}' 2>/dev/null || iptables -I INPUT 1 -p ${p.proto} -m multiport --dports ${a}:${b} -m set --match-set ${setName} src -j ACCEPT -m comment --comment 'ysk-geo:${setName}'`,
+                ];
+            }
+            return [
+                `iptables -C INPUT -p ${p.proto} --dport ${port} -m set --match-set ${setName} src -j ACCEPT -m comment --comment 'ysk-geo:${setName}' 2>/dev/null || iptables -I INPUT 1 -p ${p.proto} --dport ${port} -m set --match-set ${setName} src -j ACCEPT -m comment --comment 'ysk-geo:${setName}'`,
+            ];
+        }),
+        'true',
+    ].join('\n');
+    const r = await input.host.runCommand(['bash', '-c', script], { timeoutMs: 120_000 });
+    if (r.exitCode !== 0) {
+        notes.push(tl('notes.serviceExposure.ipsetApplyFail', {
+            detail: (r.stderr || r.stdout || '').slice(0, 240),
+        }));
+        return { ok: false, notes, setName };
+    }
+    notes.push(tl('notes.serviceExposure.ipsetApplied', {
+        set: setName,
+        countries: countries.join(','),
+        n: allCidrs.length,
+    }));
+    notes.push(tl('notes.serviceExposure.geoBestEffort'));
+    return { ok: true, notes, setName };
+}
+/** Destroy ipset + try remove iptables comments for service. */
+export async function clearCountryIpset(input) {
+    const notes = [];
+    if (!input.host.executeEnabled() || !input.host.isRoot()) {
+        return { notes };
+    }
+    const setName = ipsetNameForService(input.serviceId);
+    const r = await input.host.runCommand([
+        'bash',
+        '-c',
+        [
+            // delete rules with our comment (loop)
+            `while iptables -L INPUT --line-numbers 2>/dev/null | grep -q "ysk-geo:${setName}"; do`,
+            `  n=$(iptables -L INPUT --line-numbers 2>/dev/null | grep "ysk-geo:${setName}" | head -1 | awk '{print $1}');`,
+            `  [ -n "$n" ] && iptables -D INPUT "$n" || break;`,
+            `done`,
+            `ipset destroy ${setName} 2>/dev/null || true`,
+        ].join('\n'),
+    ], { timeoutMs: 30_000 });
+    if (r.exitCode === 0) {
+        notes.push(tl('notes.serviceExposure.ipsetCleared', { set: setName }));
+    }
+    return { notes };
+}
+//# sourceMappingURL=geo-countries.js.map

package/dist/hosting/service-exposure/geo-countries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"geo-countries.js","sourceRoot":"","sources":["../../../src/hosting/service-exposure/geo-countries.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAEvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,qBAAqB,GAAG,IAAI,CAAC;AACnC,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B,MAAM,UAAU,kBAAkB,CAAC,IAAa;IAC9C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;aAC1B,IAAI,EAAE;aACN,WAAW,EAAE,CAAC;QACjB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QACrD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACb,IAAI,GAAG,CAAC,MAAM,IAAI,aAAa;YAAE,MAAM;IACzC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,OAAO,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,EAAU;IACzD,OAAO,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AACpE,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,EAAU;IAC9D,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxC,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACtB,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YACtC,kCAAkC;YAClC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,SAAS;YAC3C,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,GAAG,CAAC,MAAM,IAAI,qBAAqB;gBAAE,MAAM;QACjD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAe,EACf,EAAU,EACV,YAA0B,KAAK;IAE/B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9B,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,kCAAkC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IAC9F,CAAC;IACD,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACrC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACrD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACnE,CAAC;IACD,MAAM,GAAG,GAAG,mDAAmD,IAAI,kBAAkB,CAAC;IACtF,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;QACxD,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,wCAAwC,EAAE;gBAC3C,EAAE,EAAE,IAAI,CAAC,WAAW,EAAE;gBACtB,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;aAC3B,CAAC,CACH,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QAC5C,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAI;aACf,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;aACrE,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,iCAAiC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;YAC9E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QAC5C,CAAC;QACD,aAAa,CAAC,IAAI,EAAE,sBAAsB,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACjF,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,sCAAsC,EAAE;YACzC,EAAE,EAAE,IAAI,CAAC,WAAW,EAAE;YACtB,CAAC,EAAE,KAAK,CAAC,MAAM;SAChB,CAAC,CACH,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IAC5D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,wCAAwC,EAAE;YAC3C,EAAE,EAAE,IAAI,CAAC,WAAW,EAAE;YACtB,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc;SACtE,CAAC,CACH,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,SAAiB;IACnD,MAAM,EAAE,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChF,OAAO,UAAU,EAAE,IAAI,KAAK,EAAE,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAS5C;IACC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QACjC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,CAAC,EAAE,CAAC,sCAAsC,CAAC,CAAC;SACpD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QACzB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,CAAC,EAAE,CAAC,mCAAmC,CAAC,CAAC;SACjD,CAAC;IACJ,CAAC;IAED,gBAAgB;IAChB,IAAI,QAAQ,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;YAC/B,MAAM,EAAE,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC1D,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,KAAK,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,mCAAmC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;YAC5D,SAAS;QACX,CAAC;QACD,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,QAAQ,CAAC,MAAM,IAAI,eAAe,EAAE,CAAC;YACvC,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,mCAAmC,EAAE,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;YAC5E,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kCAAkC,CAAC,CAAC,CAAC;QACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACrD,cAAc;IACd,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,kBAAkB,CAAC,EAAE;QAC1E,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,oCAAoC,CAAC,CAAC,CAAC;QACrD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,qCAAqC,CAAC,CAAC,CAAC;QACtD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACvC,CAAC;IAED,oDAAoD;IACpD,MAAM,WAAW,GAAG,IAAI,CACtB,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,EAC9B,QAAQ,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAChD,CAAC;IACF,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/D,aAAa,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IAE/D,MAAM,MAAM,GAAG;QACb,QAAQ;QACR,iBAAiB,OAAO,sBAAsB;QAC9C,gBAAgB,OAAO,iCAAiC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,KAAK,CAAC,EAAE;QAC/F,0BAA0B;QAC1B,gDAAgD,OAAO,qCAAqC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE;QACzH,0GAA0G;QAC1G,uCAAuC;QACvC,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;YAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;gBACvC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC;gBAClC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACnB,iEAAiE;YACjE,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC/B,OAAO;oBACL,wBAAwB,CAAC,CAAC,KAAK,0BAA0B,CAAC,IAAI,CAAC,uBAAuB,OAAO,gDAAgD,OAAO,2CAA2C,CAAC,CAAC,KAAK,0BAA0B,CAAC,IAAI,CAAC,uBAAuB,OAAO,gDAAgD,OAAO,GAAG;iBAC/T,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,wBAAwB,CAAC,CAAC,KAAK,YAAY,IAAI,uBAAuB,OAAO,gDAAgD,OAAO,2CAA2C,CAAC,CAAC,KAAK,YAAY,IAAI,uBAAuB,OAAO,gDAAgD,OAAO,GAAG;aAC/R,CAAC;QACJ,CAAC,CAAC;QACF,MAAM;KACP,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;IACtF,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,sCAAsC,EAAE;YACzC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SACnD,CAAC,CACH,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACvC,CAAC;IACD,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,oCAAoC,EAAE;QACvC,GAAG,EAAE,OAAO;QACZ,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC;QAC9B,CAAC,EAAE,QAAQ,CAAC,MAAM;KACnB,CAAC,CACH,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,qCAAqC,CAAC,CAAC,CAAC;IACtD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACtC,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAGvC;IACC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QACzD,OAAO,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CACnC;QACE,MAAM;QACN,IAAI;QACJ;YACE,uCAAuC;YACvC,yEAAyE,OAAO,OAAO;YACvF,sEAAsE,OAAO,kCAAkC;YAC/G,mDAAmD;YACnD,MAAM;YACN,iBAAiB,OAAO,sBAAsB;SAC/C,CAAC,IAAI,CAAC,IAAI,CAAC;KACb,EACD,EAAE,SAAS,EAAE,MAAM,EAAE,CACtB,CAAC;IACF,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,oCAAoC,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC"}

package/dist/hosting/service-exposure/index.d.ts

@@ -0,0 +1,5 @@
+export * from './store.js';
+export * from './sync.js';
+export * from './ports.js';
+export * from './geo-countries.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/hosting/service-exposure/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/hosting/service-exposure/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC"}

package/dist/hosting/service-exposure/index.js

@@ -0,0 +1,5 @@
+export * from './store.js';
+export * from './sync.js';
+export * from './ports.js';
+export * from './geo-countries.js';
+//# sourceMappingURL=index.js.map

package/dist/hosting/service-exposure/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/hosting/service-exposure/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC"}

package/dist/hosting/service-exposure/ports.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Resolve ServicePortBinding lists for managed services.
+ */
+import type { ServicePortBinding } from 'ysk-server-shared';
+/** DB console engine → YSK service id (catalog / comments). */
+export declare function engineToServiceId(engine: string): string;
+export declare function ftpsPortBindings(settings: {
+    listenPort?: number;
+    pasvMin?: number;
+    pasvMax?: number;
+}): ServicePortBinding[];
+export declare function vpnPortBindings(listenPort: number, proto?: 'tcp' | 'udp' | 'both'): ServicePortBinding[];
+export declare function dnsPortBindings(): ServicePortBinding[];
+/** Postfix public mail ports. */
+export declare function postfixPortBindings(): ServicePortBinding[];
+/** Dovecot IMAP/POP public ports. */
+export declare function dovecotPortBindings(): ServicePortBinding[];
+/** Sync both MTA + MDA after email stack apply. */
+export declare function syncMailServiceExposure(input: {
+    host: import('../../host/executor.js').HostExecutor;
+    dataDir: string;
+    reason?: 'start' | 'apply' | 'port-change' | 'manual' | 'stop';
+}): Promise<{
+    notes: string[];
+    ok: boolean;
+    blocked?: boolean;
+}>;
+/** Port from console apply changes if present, else catalog defaults. */
+export declare function dbPortBindings(engine: string, changes?: Record<string, string>, livePort?: string): ServicePortBinding[];
+/**
+ * Map systemd unit → exposure serviceId (+ optional ports).
+ * Used when Services page starts/stops units so ysk-svc rules follow lifecycle.
+ */
+export declare function unitToExposureService(unit: string): {
+    serviceId: string;
+    ports?: ServicePortBinding[];
+} | null;
+//# sourceMappingURL=ports.d.ts.map

package/dist/hosting/service-exposure/ports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.d.ts","sourceRoot":"","sources":["../../../src/hosting/service-exposure/ports.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAG5D,+DAA+D;AAC/D,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAOxD;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE;IACzC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,kBAAkB,EAAE,CAkBvB;AAED,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,KAAK,GAAG,KAAK,GAAG,MAAc,GACpC,kBAAkB,EAAE,CAItB;AAED,wBAAgB,eAAe,IAAI,kBAAkB,EAAE,CAKtD;AAED,iCAAiC;AACjC,wBAAgB,mBAAmB,IAAI,kBAAkB,EAAE,CAS1D;AAED,qCAAqC;AACrC,wBAAgB,mBAAmB,IAAI,kBAAkB,EAAE,CAU1D;AAED,mDAAmD;AACnD,wBAAsB,uBAAuB,CAAC,KAAK,EAAE;IACnD,IAAI,EAAE,OAAO,wBAAwB,EAAE,YAAY,CAAC;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,aAAa,GAAG,QAAQ,GAAG,MAAM,CAAC;CAChE,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,EAAE,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAuB/D;AAED,yEAAyE;AACzE,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAChC,QAAQ,CAAC,EAAE,MAAM,GAChB,kBAAkB,EAAE,CAUtB;AAQD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,kBAAkB,EAAE,CAAC;CAC9B,GAAG,IAAI,CAkDP"}

package/dist/hosting/service-exposure/ports.js

@@ -0,0 +1,175 @@
+import { defaultPortsForService } from 'ysk-server-shared';
+/** DB console engine → YSK service id (catalog / comments). */
+export function engineToServiceId(engine) {
+    const e = String(engine ?? '').trim().toLowerCase();
+    if (e === 'postgres' || e === 'postgresql')
+        return 'postgresql';
+    if (e === 'mariadb')
+        return 'mariadb';
+    if (e === 'mysql')
+        return 'mysql';
+    if (e === 'redis')
+        return 'redis';
+    return e;
+}
+export function ftpsPortBindings(settings) {
+    const listen = Number(settings.listenPort) || 21;
+    const min = Number(settings.pasvMin) || 30000;
+    const max = Number(settings.pasvMax) || 30100;
+    const lo = Math.min(min, max);
+    const hi = Math.max(min, max);
+    const out = [
+        { role: 'ftp', port: String(listen), proto: 'tcp' },
+        {
+            role: 'ftps-pasv',
+            port: lo === hi ? String(lo) : `${lo}:${hi}`,
+            proto: 'tcp',
+        },
+    ];
+    if (listen !== 990) {
+        out.push({ role: 'ftps-implicit', port: '990', proto: 'tcp' });
+    }
+    return out;
+}
+export function vpnPortBindings(listenPort, proto = 'udp') {
+    const p = Number(listenPort);
+    if (!Number.isInteger(p) || p < 1 || p > 65535)
+        return [];
+    return [{ role: 'listen', port: String(p), proto }];
+}
+export function dnsPortBindings() {
+    return [
+        { role: 'dns-udp', port: '53', proto: 'udp' },
+        { role: 'dns-tcp', port: '53', proto: 'tcp' },
+    ];
+}
+/** Postfix public mail ports. */
+export function postfixPortBindings() {
+    const defaults = defaultPortsForService('postfix');
+    return defaults.length
+        ? defaults
+        : [
+            { role: 'smtp', port: '25', proto: 'tcp' },
+            { role: 'smtps', port: '465', proto: 'tcp' },
+            { role: 'submission', port: '587', proto: 'tcp' },
+        ];
+}
+/** Dovecot IMAP/POP public ports. */
+export function dovecotPortBindings() {
+    const defaults = defaultPortsForService('dovecot');
+    return defaults.length
+        ? defaults
+        : [
+            { role: 'imap', port: '143', proto: 'tcp' },
+            { role: 'imaps', port: '993', proto: 'tcp' },
+            { role: 'pop3', port: '110', proto: 'tcp' },
+            { role: 'pop3s', port: '995', proto: 'tcp' },
+        ];
+}
+/** Sync both MTA + MDA after email stack apply. */
+export async function syncMailServiceExposure(input) {
+    const { syncServiceExposure } = await import('./sync.js');
+    const reason = input.reason ?? 'apply';
+    const notes = [];
+    let ok = true;
+    let blocked = false;
+    for (const [serviceId, ports] of [
+        ['postfix', postfixPortBindings()],
+        ['dovecot', dovecotPortBindings()],
+    ]) {
+        const exp = await syncServiceExposure({
+            host: input.host,
+            dataDir: input.dataDir,
+            serviceId,
+            ports: [...ports],
+            reason,
+            requireDecision: false,
+        });
+        notes.push(...exp.notes.slice(0, 3));
+        if (!exp.ok)
+            ok = false;
+        if (exp.blocked)
+            blocked = true;
+    }
+    return { notes, ok, blocked };
+}
+/** Port from console apply changes if present, else catalog defaults. */
+export function dbPortBindings(engine, changes, livePort) {
+    const serviceId = engineToServiceId(engine);
+    const portKey = Object.keys(changes ?? {}).find((k) => /port/i.test(k));
+    const fromChange = portKey ? String(changes[portKey] ?? '').trim() : '';
+    const port = fromChange || String(livePort ?? '').trim();
+    if (port && /^\d{1,5}$/.test(port)) {
+        return [{ role: 'listen', port, proto: 'tcp' }];
+    }
+    const defaults = defaultPortsForService(serviceId);
+    return defaults.length ? defaults : [{ role: 'listen', port: fallbackPort(serviceId), proto: 'tcp' }];
+}
+function fallbackPort(serviceId) {
+    if (serviceId === 'postgresql')
+        return '5432';
+    if (serviceId === 'redis')
+        return '6379';
+    return '3306';
+}
+/**
+ * Map systemd unit → exposure serviceId (+ optional ports).
+ * Used when Services page starts/stops units so ysk-svc rules follow lifecycle.
+ */
+export function unitToExposureService(unit) {
+    const base = String(unit ?? '')
+        .trim()
+        .replace(/\.service$/i, '')
+        .toLowerCase();
+    if (!base)
+        return null;
+    if (base === 'vsftpd')
+        return { serviceId: 'vsftpd', ports: ftpsPortBindings({}) };
+    if (base === 'nginx') {
+        return {
+            serviceId: 'nginx',
+            ports: [
+                { role: 'http', port: '80', proto: 'tcp' },
+                { role: 'https', port: '443', proto: 'tcp' },
+            ],
+        };
+    }
+    if (base === 'apache2' || base === 'httpd') {
+        return {
+            serviceId: 'apache',
+            ports: [
+                { role: 'http', port: '80', proto: 'tcp' },
+                { role: 'https', port: '443', proto: 'tcp' },
+            ],
+        };
+    }
+    if (base === 'postfix')
+        return { serviceId: 'postfix', ports: postfixPortBindings() };
+    if (base === 'dovecot')
+        return { serviceId: 'dovecot', ports: dovecotPortBindings() };
+    if (base === 'pdns' || base === 'pdns-recursor') {
+        return { serviceId: 'pdns', ports: dnsPortBindings() };
+    }
+    if (base === 'mysql' || base === 'mysqld') {
+        return { serviceId: 'mysql', ports: dbPortBindings('mysql') };
+    }
+    if (base === 'mariadb')
+        return { serviceId: 'mariadb', ports: dbPortBindings('mariadb') };
+    if (base === 'postgresql' || base.startsWith('postgresql@')) {
+        return { serviceId: 'postgresql', ports: dbPortBindings('postgres') };
+    }
+    if (base === 'redis' || base === 'redis-server') {
+        return { serviceId: 'redis', ports: dbPortBindings('redis') };
+    }
+    if (base === 'sshd' || base === 'ssh') {
+        return { serviceId: 'sshd', ports: [{ role: 'ssh', port: '22', proto: 'tcp' }] };
+    }
+    if (base === 'wg-quick' || base.startsWith('wg-quick@') || base === 'wireguard') {
+        return { serviceId: 'wireguard' };
+    }
+    if (base === 'openvpn' || base.startsWith('openvpn@')) {
+        return { serviceId: 'openvpn' };
+    }
+    return null;
+}
+//# sourceMappingURL=ports.js.map

package/dist/hosting/service-exposure/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../../../src/hosting/service-exposure/ports.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,+DAA+D;AAC/D,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpD,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,YAAY;QAAE,OAAO,YAAY,CAAC;IAChE,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IAClC,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IAClC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAIhC;IACC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IACjD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC;IAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC;IAC9C,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9B,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAyB;QAChC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE;QACnD;YACE,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;YAC5C,KAAK,EAAE,KAAK;SACb;KACF,CAAC;IACF,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,UAAkB,EAClB,QAAgC,KAAK;IAErC,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK;QAAE,OAAO,EAAE,CAAC;IAC1D,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO;QACL,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE;QAC7C,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE;KAC9C,CAAC;AACJ,CAAC;AAED,iCAAiC;AACjC,MAAM,UAAU,mBAAmB;IACjC,MAAM,QAAQ,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;IACnD,OAAO,QAAQ,CAAC,MAAM;QACpB,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC;YACE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE;YAC1C,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE;YAC5C,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE;SAClD,CAAC;AACR,CAAC;AAED,qCAAqC;AACrC,MAAM,UAAU,mBAAmB;IACjC,MAAM,QAAQ,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;IACnD,OAAO,QAAQ,CAAC,MAAM;QACpB,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC;YACE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE;YAC3C,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE;YAC5C,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE;YAC3C,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE;SAC7C,CAAC;AACR,CAAC;AAED,mDAAmD;AACnD,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAI7C;IACC,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC;IACvC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,EAAE,GAAG,IAAI,CAAC;IACd,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI;QAC/B,CAAC,SAAS,EAAE,mBAAmB,EAAE,CAAU;QAC3C,CAAC,SAAS,EAAE,mBAAmB,EAAE,CAAU;KAC5C,EAAE,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC;YACpC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS;YACT,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC;YACjB,MAAM;YACN,eAAe,EAAE,KAAK;SACvB,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,EAAE,GAAG,KAAK,CAAC;QACxB,IAAI,GAAG,CAAC,OAAO;YAAE,OAAO,GAAG,IAAI,CAAC;IAClC,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;AAChC,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,cAAc,CAC5B,MAAc,EACd,OAAgC,EAChC,QAAiB;IAEjB,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,MAAM,IAAI,GAAG,UAAU,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACzD,IAAI,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;IACnD,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AACxG,CAAC;AAED,SAAS,YAAY,CAAC,SAAiB;IACrC,IAAI,SAAS,KAAK,YAAY;QAAE,OAAO,MAAM,CAAC;IAC9C,IAAI,SAAS,KAAK,OAAO;QAAE,OAAO,MAAM,CAAC;IACzC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAIhD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;SAC5B,IAAI,EAAE;SACN,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC;SAC1B,WAAW,EAAE,CAAC;IACjB,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,gBAAgB,CAAC,EAAE,CAAC,EAAE,CAAC;IACnF,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,OAAO;YACL,SAAS,EAAE,OAAO;YAClB,KAAK,EAAE;gBACL,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE;gBAC1C,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE;aAC7C;SACF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3C,OAAO;YACL,SAAS,EAAE,QAAQ;YACnB,KAAK,EAAE;gBACL,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE;gBAC1C,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE;aAC7C;SACF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,CAAC;IACtF,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,CAAC;IACtF,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;QAChD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;IAChE,CAAC;IACD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;IAC1F,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5D,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC;IACxE,CAAC;IACD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAChD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;IAChE,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACtC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QAChF,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/hosting/service-exposure/store.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Persist desired service network exposure under dataDir.
+ */
+import { type ServiceExposureDesired, type ServiceExposureStore, type ServicePortBinding } from 'ysk-server-shared';
+export declare function emptyExposureStore(): ServiceExposureStore;
+export declare function loadExposureStore(dataDir: string): ServiceExposureStore;
+export declare function saveExposureStore(dataDir: string, store: ServiceExposureStore): string;
+export declare function normalizeAllowFrom(list: unknown): string[];
+export declare function normalizeExposureDesired(raw: Partial<ServiceExposureDesired> & {
+    serviceId: string;
+}): ServiceExposureDesired;
+export declare function normalizeExposureStore(raw: Partial<ServiceExposureStore>): ServiceExposureStore;
+/** Ensure a desired record exists (catalog defaults). Does not persist. */
+export declare function ensureDesired(store: ServiceExposureStore, serviceId: string, ports?: ServicePortBinding[]): ServiceExposureDesired;
+export declare function upsertDesired(dataDir: string, serviceId: string, patch: Partial<ServiceExposureDesired>): ServiceExposureDesired;
+export declare function listDesired(dataDir: string): ServiceExposureDesired[];
+export declare function getDesired(dataDir: string, serviceId: string): ServiceExposureDesired | null;
+//# sourceMappingURL=store.d.ts.map

package/dist/hosting/service-exposure/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/hosting/service-exposure/store.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,EAOL,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAO3B,wBAAgB,kBAAkB,IAAI,oBAAoB,CAEzD;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,oBAAoB,CASvE;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB,GAAG,MAAM,CAMtF;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,EAAE,CAY1D;AAED,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAC3D,sBAAsB,CA6BxB;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,oBAAoB,CAa/F;AAED,2EAA2E;AAC3E,wBAAgB,aAAa,CAC3B,KAAK,EAAE,oBAAoB,EAC3B,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE,kBAAkB,EAAE,GAC3B,sBAAsB,CAsBxB;AAED,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,OAAO,CAAC,sBAAsB,CAAC,GACrC,sBAAsB,CA6BxB;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,sBAAsB,EAAE,CAKrE;AAED,wBAAgB,UAAU,CACxB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAChB,sBAAsB,GAAG,IAAI,CAG/B"}