ysk-server-core 1.0.0

package/dist/repositories/session-repo.js

@@ -0,0 +1,141 @@
+import { createHash, timingSafeEqual } from 'node:crypto';
+export function hashSessionToken(token) {
+    return createHash('sha256').update(token).digest('hex');
+}
+function publicIdFromPlain(token) {
+    return token.slice(0, 12);
+}
+function publicIdOf(s) {
+    if (s.token_prefix)
+        return s.token_prefix;
+    if (s.token)
+        return s.token.slice(0, 12);
+    if (s.token_hash)
+        return s.token_hash.slice(0, 12);
+    return 'unknown';
+}
+function hashEquals(aHex, bHex) {
+    try {
+        const a = Buffer.from(aHex, 'hex');
+        const b = Buffer.from(bHex, 'hex');
+        return a.length === b.length && timingSafeEqual(a, b);
+    }
+    catch {
+        return false;
+    }
+}
+export class SessionRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    /**
+     * Insert session. Prefer storing only hash + prefix (plaintext never persisted).
+     * Callers pass the plaintext token once; we hash it.
+     */
+    insert(session) {
+        const plain = session.token;
+        const token_hash = session.token_hash ?? hashSessionToken(plain);
+        const token_prefix = session.token_prefix ?? publicIdFromPlain(plain);
+        const row = {
+            user_id: session.user_id,
+            expires_at: session.expires_at,
+            created_at: session.created_at,
+            last_seen_at: session.last_seen_at,
+            user_agent: session.user_agent,
+            ip: session.ip,
+            label: session.label,
+            token_hash,
+            token_prefix,
+            // Do not persist plaintext token
+        };
+        this.db.snapshot.sessions.push(row);
+        this.db.persist();
+    }
+    find(token) {
+        if (!token)
+            return undefined;
+        const h = hashSessionToken(token);
+        for (const s of this.db.snapshot.sessions) {
+            if (s.token_hash && hashEquals(s.token_hash, h)) {
+                return { ...s };
+            }
+            // Legacy plaintext sessions: match then migrate to hash
+            if (s.token && s.token === token) {
+                s.token_hash = h;
+                s.token_prefix = publicIdFromPlain(token);
+                delete s.token;
+                this.db.persist();
+                return { ...s };
+            }
+        }
+        return undefined;
+    }
+    /** Prefix id for revoke without exposing full token */
+    idOf(token) {
+        return publicIdFromPlain(token);
+    }
+    findByIdPrefix(userId, idPrefix) {
+        return this.db.snapshot.sessions.find((s) => s.user_id === userId && publicIdOf(s).startsWith(idPrefix));
+    }
+    listByUser(userId) {
+        return this.db.snapshot.sessions
+            .filter((s) => s.user_id === userId)
+            .map((s) => ({ ...s }));
+    }
+    listPublic(userId, currentToken) {
+        const currentHash = currentToken ? hashSessionToken(currentToken) : undefined;
+        return this.listByUser(userId).map((s) => ({
+            id: publicIdOf(s),
+            created_at: s.created_at,
+            expires_at: s.expires_at,
+            last_seen_at: s.last_seen_at ?? s.created_at,
+            user_agent: s.user_agent,
+            ip: s.ip,
+            current: currentHash
+                ? Boolean(s.token_hash && hashEquals(s.token_hash, currentHash))
+                : false,
+        }));
+    }
+    touch(token, nowIso) {
+        const h = hashSessionToken(token);
+        const s = this.db.snapshot.sessions.find((row) => (row.token_hash && hashEquals(row.token_hash, h)) ||
+            (row.token && row.token === token));
+        if (!s)
+            return;
+        s.last_seen_at = nowIso;
+        this.db.persist();
+    }
+    delete(token) {
+        const h = hashSessionToken(token);
+        this.db.snapshot.sessions = this.db.snapshot.sessions.filter((s) => !(s.token_hash && hashEquals(s.token_hash, h)) &&
+            !(s.token && s.token === token));
+        this.db.persist();
+    }
+    deleteByIdPrefix(userId, idPrefix) {
+        const before = this.db.snapshot.sessions.length;
+        this.db.snapshot.sessions = this.db.snapshot.sessions.filter((s) => !(s.user_id === userId && publicIdOf(s).startsWith(idPrefix)));
+        this.db.persist();
+        return this.db.snapshot.sessions.length < before;
+    }
+    deleteOthers(userId, keepToken) {
+        const keepHash = hashSessionToken(keepToken);
+        const before = this.db.snapshot.sessions.length;
+        this.db.snapshot.sessions = this.db.snapshot.sessions.filter((s) => {
+            if (s.user_id !== userId)
+                return true;
+            if (s.token_hash && hashEquals(s.token_hash, keepHash))
+                return true;
+            if (s.token && s.token === keepToken)
+                return true;
+            return false;
+        });
+        this.db.persist();
+        return before - this.db.snapshot.sessions.length;
+    }
+    deleteExpired(nowIso) {
+        this.db.snapshot.sessions = this.db.snapshot.sessions.filter((s) => s.expires_at >= nowIso);
+        this.db.persist();
+    }
+}
+//# sourceMappingURL=session-repo.js.map

package/dist/repositories/session-repo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-repo.js","sourceRoot":"","sources":["../../src/repositories/session-repo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAiB1D,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,UAAU,CAAC,CAAe;IACjC,IAAI,CAAC,CAAC,YAAY;QAAE,OAAO,CAAC,CAAC,YAAY,CAAC;IAC1C,IAAI,CAAC,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzC,IAAI,CAAC,CAAC,UAAU;QAAE,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,IAAY;IAC5C,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACnC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,OAAO,iBAAiB;IACC;IAA7B,YAA6B,EAAe;QAAf,OAAE,GAAF,EAAE,CAAa;IAAG,CAAC;IAEhD;;;OAGG;IACH,MAAM,CAAC,OAAuC;QAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACjE,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,GAAG,GAAiB;YACxB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,UAAU;YACV,YAAY;YACZ,iCAAiC;SAClC,CAAC;QACF,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;IACpB,CAAC;IAED,IAAI,CAAC,KAAa;QAChB,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAClC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAC1C,IAAI,CAAC,CAAC,UAAU,IAAI,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC;gBAChD,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;YAClB,CAAC;YACD,wDAAwD;YACxD,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;gBACjC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC;gBACjB,CAAC,CAAC,YAAY,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;gBAC1C,OAAQ,CAAwB,CAAC,KAAK,CAAC;gBACvC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;gBAClB,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;YAClB,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,uDAAuD;IACvD,IAAI,CAAC,KAAa;QAChB,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IAED,cAAc,CAAC,MAAc,EAAE,QAAgB;QAC7C,OAAO,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CACnC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAClE,CAAC;IACJ,CAAC;IAED,UAAU,CAAC,MAAc;QACvB,OAAO,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ;aAC7B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC;aACnC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5B,CAAC;IAED,UAAU,CAAC,MAAc,EAAE,YAAqB;QAC9C,MAAM,WAAW,GAAG,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9E,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACzC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;YACjB,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,YAAY,EAAE,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,UAAU;YAC5C,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,OAAO,EAAE,WAAW;gBAClB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,IAAI,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;gBAChE,CAAC,CAAC,KAAK;SACV,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,KAAa,EAAE,MAAc;QACjC,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CACtC,CAAC,GAAG,EAAE,EAAE,CACN,CAAC,GAAG,CAAC,UAAU,IAAI,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;YACjD,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,CACrC,CAAC;QACF,IAAI,CAAC,CAAC;YAAE,OAAO;QACf,CAAC,CAAC,YAAY,GAAG,MAAM,CAAC;QACxB,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;IACpB,CAAC;IAED,MAAM,CAAC,KAAa;QAClB,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAC1D,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAClC,CAAC;QACF,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;IACpB,CAAC;IAED,gBAAgB,CAAC,MAAc,EAAE,QAAgB;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QAChD,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAC1D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CACrE,CAAC;QACF,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC;IACnD,CAAC;IAED,YAAY,CAAC,MAAc,EAAE,SAAiB;QAC5C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QAChD,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACjE,IAAI,CAAC,CAAC,OAAO,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAC;YACtC,IAAI,CAAC,CAAC,UAAU,IAAI,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpE,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YAClD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;IACnD,CAAC;IAED,aAAa,CAAC,MAAc;QAC1B,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,MAAM,CAAC,CAAC;QAC5F,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;IACpB,CAAC;CACF"}

package/dist/repositories/settings-repo.d.ts

@@ -0,0 +1,10 @@
+import type { YskDatabase } from '../db/database.js';
+export declare class SettingsRepository {
+    private readonly db;
+    constructor(db: YskDatabase);
+    get(key: string): string | undefined;
+    getJson<T>(key: string): T | undefined;
+    set(key: string, value: string): void;
+    setJson(key: string, value: unknown): void;
+}
+//# sourceMappingURL=settings-repo.d.ts.map

package/dist/repositories/settings-repo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings-repo.d.ts","sourceRoot":"","sources":["../../src/repositories/settings-repo.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,qBAAa,kBAAkB;IACjB,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,WAAW;IAE5C,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIpC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS;IAMtC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAKrC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI;CAG3C"}

package/dist/repositories/settings-repo.js

@@ -0,0 +1,23 @@
+export class SettingsRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    get(key) {
+        return this.db.snapshot.settings[key];
+    }
+    getJson(key) {
+        const v = this.get(key);
+        if (v === undefined)
+            return undefined;
+        return JSON.parse(v);
+    }
+    set(key, value) {
+        this.db.snapshot.settings[key] = value;
+        this.db.persist();
+    }
+    setJson(key, value) {
+        this.set(key, JSON.stringify(value));
+    }
+}
+//# sourceMappingURL=settings-repo.js.map

package/dist/repositories/settings-repo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings-repo.js","sourceRoot":"","sources":["../../src/repositories/settings-repo.ts"],"names":[],"mappings":"AAEA,MAAM,OAAO,kBAAkB;IACA;IAA7B,YAA6B,EAAe;QAAf,OAAE,GAAF,EAAE,CAAa;IAAG,CAAC;IAEhD,GAAG,CAAC,GAAW;QACb,OAAO,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,CAAI,GAAW;QACpB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACtC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAM,CAAC;IAC5B,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,KAAa;QAC5B,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACvC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;IACpB,CAAC;IAED,OAAO,CAAC,GAAW,EAAE,KAAc;QACjC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IACvC,CAAC;CACF"}

package/dist/repositories/user-repo.d.ts

@@ -0,0 +1,21 @@
+import type { YskDatabase } from '../db/database.js';
+import type { StoreUser } from '../db/store.js';
+export type UserRow = StoreUser;
+export declare class UserRepository {
+    private readonly db;
+    constructor(db: YskDatabase);
+    findByUsername(username: string): UserRow | undefined;
+    findById(id: string): UserRow | undefined;
+    insert(user: UserRow): void;
+    list(): UserRow[];
+    count(): number;
+    update(id: string, patch: Partial<Pick<UserRow, 'username' | 'roles' | 'locale' | 'package_id' | 'suspended' | 'password_hash' | 'password_salt' | 'must_change_password' | 'capability_grants' | 'capability_revokes'>>): UserRow | undefined;
+    delete(id: string): boolean;
+    updateTotp(id: string, patch: {
+        totp_secret?: string | null;
+        totp_enabled?: boolean;
+        totp_last_step?: number | null;
+        totp_recovery_hashes?: string[] | null;
+    }): UserRow | undefined;
+}
+//# sourceMappingURL=user-repo.d.ts.map

package/dist/repositories/user-repo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-repo.d.ts","sourceRoot":"","sources":["../../src/repositories/user-repo.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,MAAM,MAAM,OAAO,GAAG,SAAS,CAAC;AAEhC,qBAAa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,WAAW;IAE5C,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS;IAIrD,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS;IAIzC,MAAM,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;IAQ3B,IAAI,IAAI,OAAO,EAAE;IAIjB,KAAK,IAAI,MAAM;IAIf,MAAM,CACJ,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,OAAO,CACZ,IAAI,CACF,OAAO,EACL,UAAU,GACV,OAAO,GACP,QAAQ,GACR,YAAY,GACZ,WAAW,GACX,eAAe,GACf,eAAe,GACf,sBAAsB,GACtB,mBAAmB,GACnB,oBAAoB,CACvB,CACF,GACA,OAAO,GAAG,SAAS;IAiCtB,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAO3B,UAAU,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QACL,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,oBAAoB,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;KACxC,GACA,OAAO,GAAG,SAAS;CAuBvB"}

package/dist/repositories/user-repo.js

@@ -0,0 +1,104 @@
+export class UserRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    findByUsername(username) {
+        return this.db.snapshot.users.find((u) => u.username === username);
+    }
+    findById(id) {
+        return this.db.snapshot.users.find((u) => u.id === id);
+    }
+    insert(user) {
+        this.db.snapshot.users.push({
+            ...user,
+            roles: [...user.roles],
+        });
+        this.db.persist();
+    }
+    list() {
+        return this.db.snapshot.users.map((u) => ({ ...u }));
+    }
+    count() {
+        return this.db.snapshot.users.length;
+    }
+    update(id, patch) {
+        const u = this.db.snapshot.users.find((x) => x.id === id);
+        if (!u)
+            return undefined;
+        if (patch.username !== undefined)
+            u.username = patch.username;
+        if (patch.roles !== undefined)
+            u.roles = [...patch.roles];
+        if (patch.locale !== undefined)
+            u.locale = patch.locale;
+        if ('package_id' in patch)
+            u.package_id = patch.package_id;
+        if (patch.suspended !== undefined)
+            u.suspended = patch.suspended;
+        if (patch.password_hash !== undefined)
+            u.password_hash = patch.password_hash;
+        if (patch.password_salt !== undefined)
+            u.password_salt = patch.password_salt;
+        if (patch.must_change_password !== undefined) {
+            if (patch.must_change_password)
+                u.must_change_password = true;
+            else
+                delete u.must_change_password;
+        }
+        if ('capability_grants' in patch) {
+            if (!patch.capability_grants?.length) {
+                delete u.capability_grants;
+            }
+            else {
+                u.capability_grants = [...patch.capability_grants];
+            }
+        }
+        if ('capability_revokes' in patch) {
+            if (!patch.capability_revokes?.length) {
+                delete u.capability_revokes;
+            }
+            else {
+                u.capability_revokes = [...patch.capability_revokes];
+            }
+        }
+        u.updated_at = new Date().toISOString();
+        this.db.persist();
+        return { ...u };
+    }
+    delete(id) {
+        const before = this.db.snapshot.users.length;
+        this.db.snapshot.users = this.db.snapshot.users.filter((u) => u.id !== id);
+        this.db.persist();
+        return this.db.snapshot.users.length < before;
+    }
+    updateTotp(id, patch) {
+        const u = this.db.snapshot.users.find((x) => x.id === id);
+        if (!u)
+            return undefined;
+        if (patch.totp_secret === null) {
+            delete u.totp_secret;
+        }
+        else if (patch.totp_secret !== undefined) {
+            u.totp_secret = patch.totp_secret;
+        }
+        if (patch.totp_enabled !== undefined)
+            u.totp_enabled = patch.totp_enabled;
+        if (patch.totp_last_step === null) {
+            delete u.totp_last_step;
+        }
+        else if (patch.totp_last_step !== undefined) {
+            u.totp_last_step = patch.totp_last_step;
+        }
+        if (patch.totp_recovery_hashes === null) {
+            delete u.totp_recovery_hashes;
+        }
+        else if (patch.totp_recovery_hashes !== undefined) {
+            u.totp_recovery_hashes = [...patch.totp_recovery_hashes];
+        }
+        u.updated_at = new Date().toISOString();
+        this.db.persist();
+        return { ...u };
+    }
+}
+//# sourceMappingURL=user-repo.js.map

package/dist/repositories/user-repo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-repo.js","sourceRoot":"","sources":["../../src/repositories/user-repo.ts"],"names":[],"mappings":"AAMA,MAAM,OAAO,cAAc;IACI;IAA7B,YAA6B,EAAe;QAAf,OAAE,GAAF,EAAE,CAAa;IAAG,CAAC;IAEhD,cAAc,CAAC,QAAgB;QAC7B,OAAO,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IACrE,CAAC;IAED,QAAQ,CAAC,EAAU;QACjB,OAAO,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,CAAC,IAAa;QAClB,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;YAC1B,GAAG,IAAI;YACP,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAiB;SACvC,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;IACpB,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IACvC,CAAC;IAED,MAAM,CACJ,EAAU,EACV,KAcC;QAED,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QACzB,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;YAAE,CAAC,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QAC9D,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;YAAE,CAAC,CAAC,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAiB,CAAC;QAC1E,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,CAAC,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QACxD,IAAI,YAAY,IAAI,KAAK;YAAE,CAAC,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QAC3D,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;YAAE,CAAC,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QACjE,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS;YAAE,CAAC,CAAC,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;QAC7E,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS;YAAE,CAAC,CAAC,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;QAC7E,IAAI,KAAK,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;YAC7C,IAAI,KAAK,CAAC,oBAAoB;gBAAE,CAAC,CAAC,oBAAoB,GAAG,IAAI,CAAC;;gBACzD,OAAO,CAAC,CAAC,oBAAoB,CAAC;QACrC,CAAC;QACD,IAAI,mBAAmB,IAAI,KAAK,EAAE,CAAC;YACjC,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;gBACrC,OAAO,CAAC,CAAC,iBAAiB,CAAC;YAC7B,CAAC;iBAAM,CAAC;gBACN,CAAC,CAAC,iBAAiB,GAAG,CAAC,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QACD,IAAI,oBAAoB,IAAI,KAAK,EAAE,CAAC;YAClC,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,MAAM,EAAE,CAAC;gBACtC,OAAO,CAAC,CAAC,kBAAkB,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACN,CAAC,CAAC,kBAAkB,GAAG,CAAC,GAAG,KAAK,CAAC,kBAAkB,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;QACD,CAAC,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;IAClB,CAAC;IAED,MAAM,CAAC,EAAU;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;QAC7C,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;IAChD,CAAC;IAED,UAAU,CACR,EAAU,EACV,KAKC;QAED,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QACzB,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAC/B,OAAO,CAAC,CAAC,WAAW,CAAC;QACvB,CAAC;aAAM,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAC3C,CAAC,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;QACpC,CAAC;QACD,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;YAAE,CAAC,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;QAC1E,IAAI,KAAK,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YAClC,OAAO,CAAC,CAAC,cAAc,CAAC;QAC1B,CAAC;aAAM,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAC9C,CAAC,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;QAC1C,CAAC;QACD,IAAI,KAAK,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;YACxC,OAAO,CAAC,CAAC,oBAAoB,CAAC;QAChC,CAAC;aAAM,IAAI,KAAK,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACpD,CAAC,CAAC,oBAAoB,GAAG,CAAC,GAAG,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAC3D,CAAC;QACD,CAAC,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;IAClB,CAAC;CACF"}

package/dist/security/allowlist.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Hard code-level Allowlist — LLM and agents cannot bypass this.
+ * Default posture: read-only; destructive tools require explicit listing + approval.
+ */
+import type { RiskTier } from 'ysk-server-shared';
+export interface AllowlistEntry {
+    tool: string;
+    /** Whether the tool may run at all */
+    allowed: boolean;
+    risk: RiskTier;
+    /** High-risk tools always require human approval before execute */
+    requiresApproval: boolean;
+    description: string;
+    /** Optional arg schema hints for dry-run / discovery */
+    argsSchema?: Record<string, string>;
+}
+export declare class Allowlist {
+    private readonly byTool;
+    constructor(entries?: AllowlistEntry[]);
+    /** Return a copy of all known tool entries (schema discovery). */
+    list(): AllowlistEntry[];
+    get(tool: string): AllowlistEntry | undefined;
+    /**
+     * Evaluate whether a tool invocation is allowed to proceed.
+     * Non-listed tools are denied (fail closed).
+     */
+    evaluate(tool: string): {
+        allowed: boolean;
+        requiresApproval: boolean;
+        risk: RiskTier;
+        reason?: string;
+        entry?: AllowlistEntry;
+    };
+    /**
+     * Assert tool is allowed; throws YskError on deny.
+     */
+    assertAllowed(tool: string): AllowlistEntry;
+}
+export declare function createDefaultAllowlist(): Allowlist;
+//# sourceMappingURL=allowlist.d.ts.map

package/dist/security/allowlist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowlist.d.ts","sourceRoot":"","sources":["../../src/security/allowlist.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAGlD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,QAAQ,CAAC;IACf,mEAAmE;IACnE,gBAAgB,EAAE,OAAO,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAyGD,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;gBAEzC,OAAO,GAAE,cAAc,EAAoB;IAIvD,kEAAkE;IAClE,IAAI,IAAI,cAAc,EAAE;IAIxB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAI7C;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG;QACtB,OAAO,EAAE,OAAO,CAAC;QACjB,gBAAgB,EAAE,OAAO,CAAC;QAC1B,IAAI,EAAE,QAAQ,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,cAAc,CAAC;KACxB;IA2BD;;OAEG;IACH,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc;CAU5C;AAED,wBAAgB,sBAAsB,IAAI,SAAS,CAElD"}

package/dist/security/allowlist.js

@@ -0,0 +1,167 @@
+/**
+ * Hard code-level Allowlist — LLM and agents cannot bypass this.
+ * Default posture: read-only; destructive tools require explicit listing + approval.
+ */
+import { ErrorCodes, YskError, tl } from 'ysk-server-shared';
+/** Default catalog: read-only tools allowed; destructive denied unless listed with approval */
+const DEFAULT_ENTRIES = [
+    {
+        tool: 'fs.read',
+        allowed: true,
+        risk: 'low',
+        requiresApproval: false,
+        description: tl('notes.auto.n1442'),
+        argsSchema: { path: 'string' },
+    },
+    {
+        tool: 'fs.list',
+        allowed: true,
+        risk: 'low',
+        requiresApproval: false,
+        description: tl('notes.auto.n0598'),
+        argsSchema: { path: 'string' },
+    },
+    {
+        tool: 'sys.info',
+        allowed: true,
+        risk: 'low',
+        requiresApproval: false,
+        description: tl('notes.auto.n1443'),
+    },
+    {
+        tool: 'process.list',
+        allowed: true,
+        risk: 'low',
+        requiresApproval: false,
+        description: tl('notes.auto.n0599'),
+    },
+    {
+        tool: 'service.status',
+        allowed: true,
+        risk: 'low',
+        requiresApproval: false,
+        description: tl('notes.auto.n1006'),
+        argsSchema: { name: 'string' },
+    },
+    {
+        tool: 'fs.write',
+        allowed: true,
+        risk: 'medium',
+        requiresApproval: true,
+        description: tl('notes.auto.n0678'),
+        argsSchema: { path: 'string', content: 'string' },
+    },
+    {
+        tool: 'service.restart',
+        allowed: true,
+        risk: 'high',
+        requiresApproval: true,
+        description: tl('notes.auto.n1512'),
+        argsSchema: { name: 'string' },
+    },
+    {
+        tool: 'pkg.install',
+        allowed: true,
+        risk: 'high',
+        requiresApproval: true,
+        description: tl('notes.auto.n0655'),
+        argsSchema: { name: 'string' },
+    },
+    {
+        tool: 'pkg.remove',
+        allowed: true,
+        risk: 'critical',
+        requiresApproval: true,
+        description: tl('notes.auto.n1298'),
+        argsSchema: { name: 'string' },
+    },
+    {
+        tool: 'fs.delete',
+        allowed: true,
+        risk: 'critical',
+        requiresApproval: true,
+        description: tl('notes.auto.n0601'),
+        argsSchema: { path: 'string' },
+    },
+    {
+        tool: 'shell.exec',
+        allowed: false,
+        risk: 'critical',
+        requiresApproval: true,
+        description: tl('notes.auto.n0517'),
+    },
+    {
+        tool: 'user.delete',
+        allowed: false,
+        risk: 'critical',
+        requiresApproval: true,
+        description: tl('notes.auto.n0602'),
+    },
+    {
+        tool: 'firewall.flush',
+        allowed: false,
+        risk: 'critical',
+        requiresApproval: true,
+        description: tl('notes.auto.n1053'),
+    },
+];
+export class Allowlist {
+    byTool;
+    constructor(entries = DEFAULT_ENTRIES) {
+        this.byTool = new Map(entries.map((e) => [e.tool, e]));
+    }
+    /** Return a copy of all known tool entries (schema discovery). */
+    list() {
+        return [...this.byTool.values()].map((e) => ({ ...e }));
+    }
+    get(tool) {
+        return this.byTool.get(tool);
+    }
+    /**
+     * Evaluate whether a tool invocation is allowed to proceed.
+     * Non-listed tools are denied (fail closed).
+     */
+    evaluate(tool) {
+        const entry = this.byTool.get(tool);
+        if (!entry) {
+            return {
+                allowed: false,
+                requiresApproval: false,
+                risk: 'critical',
+                reason: tl('notes.auto.t0020', { v0: (tool) }),
+            };
+        }
+        if (!entry.allowed) {
+            return {
+                allowed: false,
+                requiresApproval: entry.requiresApproval,
+                risk: entry.risk,
+                reason: tl('notes.auto.t0021', { v0: (tool) }),
+                entry,
+            };
+        }
+        return {
+            allowed: true,
+            requiresApproval: entry.requiresApproval,
+            risk: entry.risk,
+            entry,
+        };
+    }
+    /**
+     * Assert tool is allowed; throws YskError on deny.
+     */
+    assertAllowed(tool) {
+        const result = this.evaluate(tool);
+        if (!result.allowed || !result.entry) {
+            throw new YskError(ErrorCodes.ALLOWLIST_DENIED, result.reason ?? tl('notes.auto.n0778'), {
+                httpStatus: 403,
+                details: { tool },
+            });
+        }
+        return result.entry;
+    }
+}
+export function createDefaultAllowlist() {
+    return new Allowlist();
+}
+//# sourceMappingURL=allowlist.js.map

package/dist/security/allowlist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowlist.js","sourceRoot":"","sources":["../../src/security/allowlist.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAC,MAAM,mBAAmB,CAAC;AAc5D,+FAA+F;AAC/F,MAAM,eAAe,GAAqB;IACxC;QACE,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,KAAK;QACX,gBAAgB,EAAE,KAAK;QACvB,WAAW,EAAE,EAAE,CAAC,kBAAkB,CAAC;QACnC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KAC/B;IACD;QACE,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,KAAK;QACX,gBAAgB,EAAE,KAAK;QACvB,WAAW,EAAE,EAAE,CAAC,kBAAkB,CAAC;QACnC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KAC/B;IACD;QACE,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,KAAK;QACX,gBAAgB,EAAE,KAAK;QACvB,WAAW,EAAE,EAAE,CAAC,kBAAkB,CAAC;KACpC;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,KAAK;QACX,gBAAgB,EAAE,KAAK;QACvB,WAAW,EAAE,EAAE,CAAC,kBAAkB,CAAC;KACpC;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,KAAK;QACX,gBAAgB,EAAE,KAAK;QACvB,WAAW,EAAE,EAAE,CAAC,kBAAkB,CAAC;QACnC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KAC/B;IACD;QACE,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,QAAQ;QACd,gBAAgB,EAAE,IAAI;QACtB,WAAW,EAAE,EAAE,CAAC,kBAAkB,CAAC;QACnC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE;KAClD;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,MAAM;QACZ,gBAAgB,EAAE,IAAI;QACtB,WAAW,EAAE,EAAE,CAAC,kBAAkB,CAAC;QACnC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KAC/B;IACD;QACE,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,MAAM;QACZ,gBAAgB,EAAE,IAAI;QACtB,WAAW,EAAE,EAAE,CAAC,kBAAkB,CAAC;QACnC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KAC/B;IACD;QACE,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,UAAU;QAChB,gBAAgB,EAAE,IAAI;QACtB,WAAW,EAAE,EAAE,CAAC,kBAAkB,CAAC;QACnC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KAC/B;IACD;QACE,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,UAAU;QAChB,gBAAgB,EAAE,IAAI;QACtB,WAAW,EAAE,EAAE,CAAC,kBAAkB,CAAC;QACnC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KAC/B;IACD;QACE,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,UAAU;QAChB,gBAAgB,EAAE,IAAI;QACtB,WAAW,EAAE,EAAE,CAAC,kBAAkB,CAAC;KACpC;IACD;QACE,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,UAAU;QAChB,gBAAgB,EAAE,IAAI;QACtB,WAAW,EAAE,EAAE,CAAC,kBAAkB,CAAC;KACpC;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,UAAU;QAChB,gBAAgB,EAAE,IAAI;QACtB,WAAW,EAAE,EAAE,CAAC,kBAAkB,CAAC;KACpC;CACF,CAAC;AAEF,MAAM,OAAO,SAAS;IACH,MAAM,CAA8B;IAErD,YAAY,UAA4B,eAAe;QACrD,IAAI,CAAC,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,kEAAkE;IAClE,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED;;;OAGG;IACH,QAAQ,CAAC,IAAY;QAOnB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,gBAAgB,EAAE,KAAK;gBACvB,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;aAC/C,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;gBACxC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,MAAM,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9C,KAAK;aACN,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE,IAAI;YACb,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK;SACN,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,IAAY;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACrC,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,kBAAkB,CAAC,EAAE;gBACvF,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,EAAE,IAAI,EAAE;aAClB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC;CACF;AAED,MAAM,UAAU,sBAAsB;IACpC,OAAO,IAAI,SAAS,EAAE,CAAC;AACzB,CAAC"}

package/dist/security/api-keys.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Operator API access keys — token shown once at create; store only hash.
+ * Scopes: full | read (no-2fa-bypass read is still API key auth without session 2FA)
+ */
+import type { JsonStore } from '../db/store.js';
+export type ApiKeyScope = 'full' | 'read';
+export interface ApiKeyPublic {
+    id: string;
+    name: string;
+    prefix: string;
+    scope: ApiKeyScope;
+    /** When true, key is read-only and cannot call mutating routes (enforced at middleware) */
+    readOnly: boolean;
+    created_at: string;
+    last_used_at?: string;
+}
+export declare function listApiKeys(db: JsonStore, userId?: string): ApiKeyPublic[];
+export declare function createApiKey(db: JsonStore, input: {
+    name: string;
+    userId: string;
+    scope?: ApiKeyScope;
+}): {
+    key: ApiKeyPublic;
+    token: string;
+};
+export declare function deleteApiKey(db: JsonStore, id: string, opts?: {
+    ownerUserId?: string;
+    allowAny?: boolean;
+}): boolean;
+export type VerifiedApiKey = {
+    userId: string;
+    scope: ApiKeyScope;
+    readOnly: boolean;
+    keyId: string;
+};
+/** Returns user_id + scope if token matches */
+export declare function verifyApiKeyDetailed(db: JsonStore, token: string): VerifiedApiKey | null;
+/** Returns user_id if token matches a key (legacy) */
+export declare function verifyApiKey(db: JsonStore, token: string): string | null;
+//# sourceMappingURL=api-keys.d.ts.map

package/dist/security/api-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-keys.d.ts","sourceRoot":"","sources":["../../src/security/api-keys.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,CAAC;AAE1C,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,WAAW,CAAC;IACnB,2FAA2F;IAC3F,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAmBD,wBAAgB,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,YAAY,EAAE,CAM1E;AAED,wBAAgB,YAAY,CAC1B,EAAE,EAAE,SAAS,EACb,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,WAAW,CAAA;CAAE,GAC3D;IAAE,GAAG,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAuBtC;AAED,wBAAgB,YAAY,CAC1B,EAAE,EAAE,SAAS,EACb,EAAE,EAAE,MAAM,EACV,IAAI,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GAClD,OAAO,CAWT;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,WAAW,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,+CAA+C;AAC/C,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,SAAS,EACb,KAAK,EAAE,MAAM,GACZ,cAAc,GAAG,IAAI,CAwBvB;AAED,sDAAsD;AACtD,wBAAgB,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAExE"}