ysk-server-core 1.0.0

package/dist/net/network-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-types.d.ts","sourceRoot":"","sources":["../../src/net/network-types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,MAAM,UAAU,GAAG;IACvB,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,gCAAgC;IAChC,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,4EAA4E;IAC5E,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,sCAAsC;IACtC,IAAI,CAAC,EAAE,gBAAgB,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC5D,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,+CAA+C;IAC/C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,yCAAyC;IACzC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,8BAA8B;IAC9B,aAAa,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAC/B,8CAA8C;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,KAAK,EAAE,OAAO,CAAC;IACf,cAAc,EAAE,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;IAClD,QAAQ,EAAE,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;IAC5C,UAAU,EAAE,OAAO,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,YAAY,EAAE,CAAC;IAC3B,MAAM,EAAE,QAAQ,EAAE,CAAC;IACnB,GAAG,EAAE,UAAU,CAAC;IAChB,OAAO,EAAE,UAAU,CAAC;IACpB,IAAI,EAAE;QACJ,cAAc,EAAE,OAAO,CAAC;QACxB,MAAM,EAAE,OAAO,CAAC;QAChB,SAAS,EAAE,OAAO,CAAC;KACpB,CAAC;IACF,kCAAkC;IAClC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,0CAA0C;IAC1C,GAAG,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACzC,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC"}

package/dist/net/network-types.js

@@ -0,0 +1,5 @@
+/**
+ * Host network interface types (iproute2-shaped, honest).
+ */
+export {};
+//# sourceMappingURL=network-types.js.map

package/dist/net/network-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-types.js","sourceRoot":"","sources":["../../src/net/network-types.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/dist/net/ssrf.d.ts

@@ -0,0 +1,25 @@
+/**
+ * SSRF guards for server-side fetch (CDN health, LLM base URLs, etc.).
+ * Fail closed for private / link-local / metadata targets unless explicitly allowed.
+ */
+/** Cloud metadata + loopback — always dangerous for SSRF. */
+export declare function isMetadataOrLoopbackHost(host: string): boolean;
+/** RFC1918 + CGNAT + ULA (not loopback/IMDS). */
+export declare function isRfc1918Host(host: string): boolean;
+/**
+ * True if host should be blocked under policy:
+ * - strict: metadata + loopback + RFC1918
+ * - metadata (default for CDN): only metadata + loopback (fleet may use 10.x health)
+ */
+export declare function isBlockedSsrfHost(host: string, policy?: 'strict' | 'metadata'): boolean;
+/**
+ * Validate http(s) URL for outbound server fetch.
+ * Throws YskError on invalid scheme or blocked host.
+ */
+export declare function assertSafeOutboundUrl(raw: string, opts?: {
+    allowPrivate?: boolean;
+    /** strict = block RFC1918; metadata = allow 10.x (CDN fleet health) */
+    policy?: 'strict' | 'metadata';
+    field?: string;
+}): URL;
+//# sourceMappingURL=ssrf.d.ts.map

package/dist/net/ssrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf.d.ts","sourceRoot":"","sources":["../../src/net/ssrf.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAkBH,6DAA6D;AAC7D,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAiB9D;AAED,iDAAiD;AACjD,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAenD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,QAAQ,GAAG,UAAqB,GACvC,OAAO,CAST;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE;IACL,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,uEAAuE;IACvE,MAAM,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GACA,GAAG,CAqCL"}

package/dist/net/ssrf.js

@@ -0,0 +1,127 @@
+/**
+ * SSRF guards for server-side fetch (CDN health, LLM base URLs, etc.).
+ * Fail closed for private / link-local / metadata targets unless explicitly allowed.
+ */
+import { ErrorCodes, YskError, tl } from 'ysk-server-shared';
+import { isIP } from 'node:net';
+const BLOCKED_HOSTNAMES = new Set([
+    'localhost',
+    'localhost.localdomain',
+    'metadata.google.internal',
+    'metadata',
+]);
+function ipv4Parts(ip) {
+    const m = ip.match(/^(\d+)\.(\d+)\.(\d+)\.(\d+)$/);
+    if (!m)
+        return null;
+    return [Number(m[1]), Number(m[2]), Number(m[3]), Number(m[4])];
+}
+/** Cloud metadata + loopback — always dangerous for SSRF. */
+export function isMetadataOrLoopbackHost(host) {
+    const h = host.trim().toLowerCase().replace(/^\[|\]$/g, '');
+    if (!h)
+        return true;
+    if (BLOCKED_HOSTNAMES.has(h))
+        return true;
+    if (h.endsWith('.localhost'))
+        return true;
+    if (h === '::1')
+        return true;
+    const p = ipv4Parts(h);
+    if (p) {
+        const [a, b] = p;
+        if (a === 127 || a === 0)
+            return true;
+        if (a === 169 && b === 254)
+            return true; // link-local / IMDS
+    }
+    if (isIP(h) === 6) {
+        const s = h.toLowerCase();
+        if (s.startsWith('fe80'))
+            return true;
+    }
+    return false;
+}
+/** RFC1918 + CGNAT + ULA (not loopback/IMDS). */
+export function isRfc1918Host(host) {
+    const h = host.trim().toLowerCase().replace(/^\[|\]$/g, '');
+    const p = ipv4Parts(h);
+    if (p) {
+        const [a, b] = p;
+        if (a === 10)
+            return true;
+        if (a === 172 && b >= 16 && b <= 31)
+            return true;
+        if (a === 192 && b === 168)
+            return true;
+        if (a === 100 && b >= 64 && b <= 127)
+            return true;
+    }
+    if (isIP(h) === 6) {
+        const s = h.toLowerCase();
+        if (s.startsWith('fc') || s.startsWith('fd'))
+            return true;
+    }
+    return false;
+}
+/**
+ * True if host should be blocked under policy:
+ * - strict: metadata + loopback + RFC1918
+ * - metadata (default for CDN): only metadata + loopback (fleet may use 10.x health)
+ */
+export function isBlockedSsrfHost(host, policy = 'strict') {
+    const h = host.trim().toLowerCase().replace(/^\[|\]$/g, '');
+    if (!h)
+        return true;
+    if (isMetadataOrLoopbackHost(h))
+        return true;
+    if (policy === 'strict') {
+        if (h.endsWith('.local') || h.endsWith('.internal'))
+            return true;
+        if (isRfc1918Host(h))
+            return true;
+    }
+    return false;
+}
+/**
+ * Validate http(s) URL for outbound server fetch.
+ * Throws YskError on invalid scheme or blocked host.
+ */
+export function assertSafeOutboundUrl(raw, opts) {
+    let u;
+    try {
+        u = new URL(raw.trim());
+    }
+    catch {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n0303'), {
+            httpStatus: 400,
+            details: { field: opts?.field ?? 'url', value: raw.slice(0, 200) },
+        });
+    }
+    if (u.protocol !== 'http:' && u.protocol !== 'https:') {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n0303'), {
+            httpStatus: 400,
+            details: { field: opts?.field ?? 'url', reason: 'scheme' },
+        });
+    }
+    // Unit tests bind ephemeral loopback HTTP servers
+    const isTest = process.env.VITEST === 'true' || process.env.NODE_ENV === 'test';
+    if (isTest &&
+        (u.hostname === '127.0.0.1' || u.hostname === 'localhost' || u.hostname === '::1')) {
+        return u;
+    }
+    const policy = opts?.policy ?? 'strict';
+    if (!opts?.allowPrivate && isBlockedSsrfHost(u.hostname, policy)) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n0303'), {
+            httpStatus: 400,
+            details: {
+                field: opts?.field ?? 'url',
+                reason: 'ssrf_blocked_host',
+                host: u.hostname,
+                policy,
+            },
+        });
+    }
+    return u;
+}
+//# sourceMappingURL=ssrf.js.map

package/dist/net/ssrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf.js","sourceRoot":"","sources":["../../src/net/ssrf.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,WAAW;IACX,uBAAuB;IACvB,0BAA0B;IAC1B,UAAU;CACX,CAAC,CAAC;AAEH,SAAS,SAAS,CAAC,EAAU;IAC3B,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACnD,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,CAAC,EAAE,CAAC;QACN,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACjB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,oBAAoB;IAC/D,CAAC;IACD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QAClB,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1B,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;IACxC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC5D,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,CAAC,EAAE,CAAC;QACN,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACjB,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;QACjD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;YAAE,OAAO,IAAI,CAAC;IACpD,CAAC;IACD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QAClB,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1B,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IAC5D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,SAAgC,QAAQ;IAExC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,wBAAwB,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QACjE,IAAI,aAAa,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACpC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAW,EACX,IAKC;IAED,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE;YAChE,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;SACnE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACtD,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE;YAChE,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE;SAC3D,CAAC,CAAC;IACL,CAAC;IACD,kDAAkD;IAClD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC;IAChF,IACE,MAAM;QACN,CAAC,CAAC,CAAC,QAAQ,KAAK,WAAW,IAAI,CAAC,CAAC,QAAQ,KAAK,WAAW,IAAI,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,EAClF,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,IAAI,QAAQ,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,YAAY,IAAI,iBAAiB,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE;YAChE,UAAU,EAAE,GAAG;YACf,OAAO,EAAE;gBACP,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,KAAK;gBAC3B,MAAM,EAAE,mBAAmB;gBAC3B,IAAI,EAAE,CAAC,CAAC,QAAQ;gBAChB,MAAM;aACP;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/repositories/approval-repo.d.ts

@@ -0,0 +1,13 @@
+import type { ApprovalStatus } from 'ysk-server-shared';
+import type { YskDatabase } from '../db/database.js';
+import type { StoreApproval } from '../db/store.js';
+export type ApprovalRow = StoreApproval;
+export declare class ApprovalRepository {
+    private readonly db;
+    constructor(db: YskDatabase);
+    insert(row: ApprovalRow): void;
+    find(id: string): ApprovalRow | undefined;
+    list(status?: ApprovalStatus): ApprovalRow[];
+    updateStatus(id: string, status: ApprovalStatus, decidedBy?: string): void;
+}
+//# sourceMappingURL=approval-repo.d.ts.map

package/dist/repositories/approval-repo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-repo.d.ts","sourceRoot":"","sources":["../../src/repositories/approval-repo.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpD,MAAM,MAAM,WAAW,GAAG,aAAa,CAAC;AAExC,qBAAa,kBAAkB;IACjB,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,WAAW;IAE5C,MAAM,CAAC,GAAG,EAAE,WAAW,GAAG,IAAI;IAK9B,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS;IAKzC,IAAI,CAAC,MAAM,CAAC,EAAE,cAAc,GAAG,WAAW,EAAE;IAK5C,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;CAQ3E"}

package/dist/repositories/approval-repo.js

@@ -0,0 +1,29 @@
+export class ApprovalRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    insert(row) {
+        this.db.snapshot.approvals.unshift({ ...row });
+        this.db.persist();
+    }
+    find(id) {
+        const r = this.db.snapshot.approvals.find((a) => a.id === id);
+        return r ? { ...r } : undefined;
+    }
+    list(status) {
+        const all = this.db.snapshot.approvals;
+        return (status ? all.filter((a) => a.status === status) : all).map((a) => ({ ...a }));
+    }
+    updateStatus(id, status, decidedBy) {
+        const r = this.db.snapshot.approvals.find((a) => a.id === id);
+        if (!r)
+            return;
+        r.status = status;
+        r.decided_at = new Date().toISOString();
+        if (decidedBy)
+            r.decided_by = decidedBy;
+        this.db.persist();
+    }
+}
+//# sourceMappingURL=approval-repo.js.map

package/dist/repositories/approval-repo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-repo.js","sourceRoot":"","sources":["../../src/repositories/approval-repo.ts"],"names":[],"mappings":"AAMA,MAAM,OAAO,kBAAkB;IACA;IAA7B,YAA6B,EAAe;QAAf,OAAE,GAAF,EAAE,CAAa;IAAG,CAAC;IAEhD,MAAM,CAAC,GAAgB;QACrB,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;IACpB,CAAC;IAED,IAAI,CAAC,EAAU;QACb,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAClC,CAAC;IAED,IAAI,CAAC,MAAuB;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;QACvC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACxF,CAAC;IAED,YAAY,CAAC,EAAU,EAAE,MAAsB,EAAE,SAAkB;QACjE,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC,CAAC;YAAE,OAAO;QACf,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC;QAClB,CAAC,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxC,IAAI,SAAS;YAAE,CAAC,CAAC,UAAU,GAAG,SAAS,CAAC;QACxC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;IACpB,CAAC;CACF"}

package/dist/repositories/audit-repo.d.ts

@@ -0,0 +1,21 @@
+import type { YskDatabase } from '../db/database.js';
+import type { StoreAudit } from '../db/store.js';
+export type AuditEvent = StoreAudit;
+export declare class AuditRepository {
+    private readonly db;
+    constructor(db: YskDatabase);
+    append(input: {
+        actor: string;
+        action: string;
+        resource?: string;
+        detail: unknown;
+        ok: boolean;
+    }): AuditEvent;
+    listRecent(limit?: number): AuditEvent[];
+    /** Filter by resource id and optional action prefix (e.g. project.deploy). */
+    listForResource(resourceId: string, opts?: {
+        actionPrefix?: string;
+        limit?: number;
+    }): AuditEvent[];
+}
+//# sourceMappingURL=audit-repo.d.ts.map

package/dist/repositories/audit-repo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-repo.d.ts","sourceRoot":"","sources":["../../src/repositories/audit-repo.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,MAAM,MAAM,UAAU,GAAG,UAAU,CAAC;AAEpC,qBAAa,eAAe;IACd,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,WAAW;IAE5C,MAAM,CAAC,KAAK,EAAE;QACZ,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,OAAO,CAAC;QAChB,EAAE,EAAE,OAAO,CAAC;KACb,GAAG,UAAU;IAmBd,UAAU,CAAC,KAAK,SAAK,GAAG,UAAU,EAAE;IAIpC,8EAA8E;IAC9E,eAAe,CACb,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/C,UAAU,EAAE;CAShB"}

package/dist/repositories/audit-repo.js

@@ -0,0 +1,39 @@
+import { randomUUID } from 'node:crypto';
+export class AuditRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    append(input) {
+        const event = {
+            id: randomUUID(),
+            actor: input.actor,
+            action: input.action,
+            resource: input.resource,
+            detail: input.detail,
+            ok: input.ok,
+            created_at: new Date().toISOString(),
+        };
+        this.db.snapshot.audit_events.unshift(event);
+        // cap
+        if (this.db.snapshot.audit_events.length > 5000) {
+            this.db.snapshot.audit_events.length = 5000;
+        }
+        this.db.persist();
+        return event;
+    }
+    listRecent(limit = 50) {
+        return this.db.snapshot.audit_events.slice(0, limit).map((e) => ({ ...e }));
+    }
+    /** Filter by resource id and optional action prefix (e.g. project.deploy). */
+    listForResource(resourceId, opts) {
+        const limit = opts?.limit ?? 30;
+        const prefix = opts?.actionPrefix;
+        return this.db.snapshot.audit_events
+            .filter((e) => e.resource === resourceId)
+            .filter((e) => (prefix ? e.action.startsWith(prefix) : true))
+            .slice(0, limit)
+            .map((e) => ({ ...e }));
+    }
+}
+//# sourceMappingURL=audit-repo.js.map

package/dist/repositories/audit-repo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-repo.js","sourceRoot":"","sources":["../../src/repositories/audit-repo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAMzC,MAAM,OAAO,eAAe;IACG;IAA7B,YAA6B,EAAe;QAAf,OAAE,GAAF,EAAE,CAAa;IAAG,CAAC;IAEhD,MAAM,CAAC,KAMN;QACC,MAAM,KAAK,GAAe;YACxB,EAAE,EAAE,UAAU,EAAE;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACrC,CAAC;QACF,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM;QACN,IAAI,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;YAChD,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,GAAG,IAAI,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,UAAU,CAAC,KAAK,GAAG,EAAE;QACnB,OAAO,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9E,CAAC;IAED,8EAA8E;IAC9E,eAAe,CACb,UAAkB,EAClB,IAAgD;QAEhD,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,EAAE,YAAY,CAAC;QAClC,OAAO,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,YAAY;aACjC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC;aACxC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;aAC5D,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;aACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5B,CAAC;CACF"}

package/dist/repositories/index.d.ts

@@ -0,0 +1,7 @@
+export * from './user-repo.js';
+export * from './session-repo.js';
+export * from './audit-repo.js';
+export * from './project-repo.js';
+export * from './approval-repo.js';
+export * from './settings-repo.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/repositories/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/repositories/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC"}

package/dist/repositories/index.js

@@ -0,0 +1,7 @@
+export * from './user-repo.js';
+export * from './session-repo.js';
+export * from './audit-repo.js';
+export * from './project-repo.js';
+export * from './approval-repo.js';
+export * from './settings-repo.js';
+//# sourceMappingURL=index.js.map

package/dist/repositories/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/repositories/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC"}

package/dist/repositories/project-repo.d.ts

@@ -0,0 +1,19 @@
+import type { YskDatabase } from '../db/database.js';
+import type { StoreProject } from '../db/store.js';
+export type ProjectRow = StoreProject;
+export declare class ProjectRepository {
+    private readonly db;
+    constructor(db: YskDatabase);
+    insert(p: ProjectRow): void;
+    list(): ProjectRow[];
+    findById(id: string): ProjectRow | undefined;
+    delete(id: string): boolean;
+    updateNginxPath(id: string, path: string): void;
+    setOsProvisioned(id: string, ok: boolean): void;
+    updateMeta(id: string, patch: Partial<Pick<ProjectRow, 'runtime' | 'runtime_version' | 'domain' | 'domain_aliases' | 'name' | 'force_https' | 'hsts' | 'site_redirect_url' | 'http_auth_user' | 'http_auth_pass' | 'doc_root' | 'bind_ip' | 'real_ip_provider' | 'preferred_port' | 'status' | 'home_dir' | 'linux_user' | 'linux_group' | 'log_extra_dirs'>>): void;
+    /**
+     * Patch runtime / deploy fields after real process ops.
+     */
+    updateRuntimeState(id: string, patch: Partial<Pick<ProjectRow, 'port' | 'pid' | 'pidfile' | 'process_status' | 'status' | 'nginx_config_path' | 'last_health' | 'last_deploy_at' | 'git_url' | 'git_branch' | 'git_commit' | 'env_vars' | 'last_backup_path' | 'last_backup_at' | 'quota_mb' | 'memory_max' | 'cpu_quota_percent' | 'tasks_max' | 'limit_nofile' | 'shell' | 'account_locked' | 'deploy_entry' | 'last_deploy_notes'>>): void;
+}
+//# sourceMappingURL=project-repo.d.ts.map

package/dist/repositories/project-repo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-repo.d.ts","sourceRoot":"","sources":["../../src/repositories/project-repo.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnD,MAAM,MAAM,UAAU,GAAG,YAAY,CAAC;AAEtC,qBAAa,iBAAiB;IAChB,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,WAAW;IAE5C,MAAM,CAAC,CAAC,EAAE,UAAU,GAAG,IAAI;IAK3B,IAAI,IAAI,UAAU,EAAE;IAIpB,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAK5C,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAO3B,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAQ/C,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,GAAG,IAAI;IAS/C,UAAU,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,OAAO,CACZ,IAAI,CACF,UAAU,EACR,SAAS,GACT,iBAAiB,GACjB,QAAQ,GACR,gBAAgB,GAChB,MAAM,GACN,aAAa,GACb,MAAM,GACN,mBAAmB,GACnB,gBAAgB,GAChB,gBAAgB,GAChB,UAAU,GACV,SAAS,GACT,kBAAkB,GAClB,gBAAgB,GAChB,QAAQ,GACR,UAAU,GACV,YAAY,GACZ,aAAa,GACb,gBAAgB,CACnB,CACF,GACA,IAAI;IA0BP;;OAEG;IACH,kBAAkB,CAChB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,OAAO,CACZ,IAAI,CACF,UAAU,EACR,MAAM,GACN,KAAK,GACL,SAAS,GACT,gBAAgB,GAChB,QAAQ,GACR,mBAAmB,GACnB,aAAa,GACb,gBAAgB,GAChB,SAAS,GACT,YAAY,GACZ,YAAY,GACZ,UAAU,GACV,kBAAkB,GAClB,gBAAgB,GAChB,UAAU,GACV,YAAY,GACZ,mBAAmB,GACnB,WAAW,GACX,cAAc,GACd,OAAO,GACP,gBAAgB,GAChB,cAAc,GACd,mBAAmB,CACtB,CACF,GACA,IAAI;CA6BR"}

package/dist/repositories/project-repo.js

@@ -0,0 +1,142 @@
+export class ProjectRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    insert(p) {
+        this.db.snapshot.projects.unshift({ ...p });
+        this.db.persist();
+    }
+    list() {
+        return this.db.snapshot.projects.map((p) => ({ ...p }));
+    }
+    findById(id) {
+        const p = this.db.snapshot.projects.find((x) => x.id === id);
+        return p ? { ...p } : undefined;
+    }
+    delete(id) {
+        const before = this.db.snapshot.projects.length;
+        this.db.snapshot.projects = this.db.snapshot.projects.filter((p) => p.id !== id);
+        this.db.persist();
+        return this.db.snapshot.projects.length < before;
+    }
+    updateNginxPath(id, path) {
+        const p = this.db.snapshot.projects.find((x) => x.id === id);
+        if (!p)
+            return;
+        p.nginx_config_path = path;
+        p.updated_at = new Date().toISOString();
+        this.db.persist();
+    }
+    setOsProvisioned(id, ok) {
+        const p = this.db.snapshot.projects.find((x) => x.id === id);
+        if (!p)
+            return;
+        p.os_provisioned = ok;
+        p.status = ok ? 'active' : 'active_pending_os';
+        p.updated_at = new Date().toISOString();
+        this.db.persist();
+    }
+    updateMeta(id, patch) {
+        const p = this.db.snapshot.projects.find((x) => x.id === id);
+        if (!p)
+            return;
+        if (patch.runtime !== undefined)
+            p.runtime = patch.runtime;
+        if (patch.runtime_version !== undefined)
+            p.runtime_version = patch.runtime_version;
+        if (patch.domain !== undefined)
+            p.domain = patch.domain;
+        if (patch.domain_aliases !== undefined)
+            p.domain_aliases = patch.domain_aliases;
+        if (patch.name !== undefined)
+            p.name = patch.name;
+        if (patch.force_https !== undefined)
+            p.force_https = patch.force_https;
+        if (patch.hsts !== undefined)
+            p.hsts = patch.hsts;
+        if ('site_redirect_url' in patch)
+            p.site_redirect_url = patch.site_redirect_url;
+        if ('http_auth_user' in patch)
+            p.http_auth_user = patch.http_auth_user;
+        if ('http_auth_pass' in patch)
+            p.http_auth_pass = patch.http_auth_pass;
+        if ('doc_root' in patch)
+            p.doc_root = patch.doc_root;
+        if ('bind_ip' in patch)
+            p.bind_ip = patch.bind_ip;
+        if ('real_ip_provider' in patch)
+            p.real_ip_provider = patch.real_ip_provider;
+        if ('preferred_port' in patch)
+            p.preferred_port = patch.preferred_port;
+        if (patch.status !== undefined)
+            p.status = patch.status;
+        if (patch.home_dir !== undefined)
+            p.home_dir = patch.home_dir;
+        if (patch.linux_user !== undefined)
+            p.linux_user = patch.linux_user;
+        if (patch.linux_group !== undefined)
+            p.linux_group = patch.linux_group;
+        if ('log_extra_dirs' in patch)
+            p.log_extra_dirs = patch.log_extra_dirs;
+        p.updated_at = new Date().toISOString();
+        this.db.persist();
+    }
+    /**
+     * Patch runtime / deploy fields after real process ops.
+     */
+    updateRuntimeState(id, patch) {
+        const p = this.db.snapshot.projects.find((x) => x.id === id);
+        if (!p)
+            return;
+        if (patch.port !== undefined)
+            p.port = patch.port;
+        if ('pid' in patch)
+            p.pid = patch.pid;
+        if (patch.pidfile !== undefined)
+            p.pidfile = patch.pidfile;
+        if (patch.process_status !== undefined)
+            p.process_status = patch.process_status;
+        if (patch.status !== undefined)
+            p.status = patch.status;
+        if (patch.nginx_config_path !== undefined)
+            p.nginx_config_path = patch.nginx_config_path;
+        if (patch.last_health !== undefined)
+            p.last_health = patch.last_health;
+        if (patch.last_deploy_at !== undefined)
+            p.last_deploy_at = patch.last_deploy_at;
+        if (patch.git_url !== undefined)
+            p.git_url = patch.git_url;
+        if (patch.git_branch !== undefined)
+            p.git_branch = patch.git_branch;
+        if (patch.git_commit !== undefined)
+            p.git_commit = patch.git_commit;
+        if (patch.env_vars !== undefined)
+            p.env_vars = patch.env_vars;
+        if (patch.last_backup_path !== undefined)
+            p.last_backup_path = patch.last_backup_path;
+        if (patch.last_backup_at !== undefined)
+            p.last_backup_at = patch.last_backup_at;
+        if (patch.quota_mb !== undefined)
+            p.quota_mb = patch.quota_mb;
+        if (patch.memory_max !== undefined)
+            p.memory_max = patch.memory_max;
+        if (patch.cpu_quota_percent !== undefined)
+            p.cpu_quota_percent = patch.cpu_quota_percent;
+        if (patch.tasks_max !== undefined)
+            p.tasks_max = patch.tasks_max;
+        if (patch.limit_nofile !== undefined)
+            p.limit_nofile = patch.limit_nofile;
+        if (patch.shell !== undefined)
+            p.shell = patch.shell;
+        if (patch.account_locked !== undefined)
+            p.account_locked = patch.account_locked;
+        if ('deploy_entry' in patch)
+            p.deploy_entry = patch.deploy_entry;
+        if (patch.last_deploy_notes !== undefined)
+            p.last_deploy_notes = patch.last_deploy_notes;
+        p.updated_at = new Date().toISOString();
+        this.db.persist();
+    }
+}
+//# sourceMappingURL=project-repo.js.map

package/dist/repositories/project-repo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-repo.js","sourceRoot":"","sources":["../../src/repositories/project-repo.ts"],"names":[],"mappings":"AAKA,MAAM,OAAO,iBAAiB;IACC;IAA7B,YAA6B,EAAe;QAAf,OAAE,GAAF,EAAE,CAAa;IAAG,CAAC;IAEhD,MAAM,CAAC,CAAa;QAClB,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;IACpB,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,QAAQ,CAAC,EAAU;QACjB,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAClC,CAAC;IAED,MAAM,CAAC,EAAU;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QAChD,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACjF,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC;IACnD,CAAC;IAED,eAAe,CAAC,EAAU,EAAE,IAAY;QACtC,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,CAAC;YAAE,OAAO;QACf,CAAC,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAC3B,CAAC,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;IACpB,CAAC;IAED,gBAAgB,CAAC,EAAU,EAAE,EAAW;QACtC,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,CAAC;YAAE,OAAO;QACf,CAAC,CAAC,cAAc,GAAG,EAAE,CAAC;QACtB,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC;QAC/C,CAAC,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;IACpB,CAAC;IAED,UAAU,CACR,EAAU,EACV,KAuBC;QAED,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,CAAC;YAAE,OAAO;QACf,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;YAAE,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC3D,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS;YAAE,CAAC,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;QACnF,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,CAAC,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QACxD,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS;YAAE,CAAC,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;QAChF,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;YAAE,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QAClD,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;YAAE,CAAC,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;QACvE,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;YAAE,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QAClD,IAAI,mBAAmB,IAAI,KAAK;YAAE,CAAC,CAAC,iBAAiB,GAAG,KAAK,CAAC,iBAAiB,CAAC;QAChF,IAAI,gBAAgB,IAAI,KAAK;YAAE,CAAC,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;QACvE,IAAI,gBAAgB,IAAI,KAAK;YAAE,CAAC,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;QACvE,IAAI,UAAU,IAAI,KAAK;YAAE,CAAC,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QACrD,IAAI,SAAS,IAAI,KAAK;YAAE,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAClD,IAAI,kBAAkB,IAAI,KAAK;YAAE,CAAC,CAAC,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAC;QAC7E,IAAI,gBAAgB,IAAI,KAAK;YAAE,CAAC,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;QACvE,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,CAAC,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QACxD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;YAAE,CAAC,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QAC9D,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;YAAE,CAAC,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QACpE,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;YAAE,CAAC,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;QACvE,IAAI,gBAAgB,IAAI,KAAK;YAAE,CAAC,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;QACvE,CAAC,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;IACpB,CAAC;IAED;;OAEG;IACH,kBAAkB,CAChB,EAAU,EACV,KA2BC;QAED,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,CAAC;YAAE,OAAO;QACf,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;YAAE,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QAClD,IAAI,KAAK,IAAI,KAAK;YAAE,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;QACtC,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;YAAE,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC3D,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS;YAAE,CAAC,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;QAChF,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,CAAC,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QACxD,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS;YAAE,CAAC,CAAC,iBAAiB,GAAG,KAAK,CAAC,iBAAiB,CAAC;QACzF,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;YAAE,CAAC,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;QACvE,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS;YAAE,CAAC,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;QAChF,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;YAAE,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC3D,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;YAAE,CAAC,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QACpE,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;YAAE,CAAC,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QACpE,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;YAAE,CAAC,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QAC9D,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS;YAAE,CAAC,CAAC,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAC;QACtF,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS;YAAE,CAAC,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;QAChF,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;YAAE,CAAC,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QAC9D,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;YAAE,CAAC,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QACpE,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS;YAAE,CAAC,CAAC,iBAAiB,GAAG,KAAK,CAAC,iBAAiB,CAAC;QACzF,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;YAAE,CAAC,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QACjE,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;YAAE,CAAC,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;QAC1E,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;YAAE,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QACrD,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS;YAAE,CAAC,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;QAChF,IAAI,cAAc,IAAI,KAAK;YAAE,CAAC,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;QACjE,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS;YAAE,CAAC,CAAC,iBAAiB,GAAG,KAAK,CAAC,iBAAiB,CAAC;QACzF,CAAC,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;IACpB,CAAC;CACF"}

package/dist/repositories/session-repo.d.ts

@@ -0,0 +1,37 @@
+import type { YskDatabase } from '../db/database.js';
+import type { StoreSession } from '../db/store.js';
+export type SessionRow = StoreSession;
+/** Public view — never return full token after create */
+export type SessionPublic = {
+    id: string;
+    created_at: string;
+    expires_at: string;
+    last_seen_at?: string;
+    user_agent?: string;
+    ip?: string;
+    current?: boolean;
+};
+export declare function hashSessionToken(token: string): string;
+export declare class SessionRepository {
+    private readonly db;
+    constructor(db: YskDatabase);
+    /**
+     * Insert session. Prefer storing only hash + prefix (plaintext never persisted).
+     * Callers pass the plaintext token once; we hash it.
+     */
+    insert(session: SessionRow & {
+        token: string;
+    }): void;
+    find(token: string): SessionRow | undefined;
+    /** Prefix id for revoke without exposing full token */
+    idOf(token: string): string;
+    findByIdPrefix(userId: string, idPrefix: string): SessionRow | undefined;
+    listByUser(userId: string): SessionRow[];
+    listPublic(userId: string, currentToken?: string): SessionPublic[];
+    touch(token: string, nowIso: string): void;
+    delete(token: string): void;
+    deleteByIdPrefix(userId: string, idPrefix: string): boolean;
+    deleteOthers(userId: string, keepToken: string): number;
+    deleteExpired(nowIso: string): void;
+}
+//# sourceMappingURL=session-repo.d.ts.map

package/dist/repositories/session-repo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-repo.d.ts","sourceRoot":"","sources":["../../src/repositories/session-repo.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnD,MAAM,MAAM,UAAU,GAAG,YAAY,CAAC;AAEtC,yDAAyD;AACzD,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEtD;AAuBD,qBAAa,iBAAiB;IAChB,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,WAAW;IAE5C;;;OAGG;IACH,MAAM,CAAC,OAAO,EAAE,UAAU,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAoBrD,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAmB3C,uDAAuD;IACvD,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAI3B,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAMxE,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,EAAE;IAMxC,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,aAAa,EAAE;IAelE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAY1C,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAU3B,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO;IAS3D,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;IAavD,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;CAIpC"}