ysk-server-core 1.0.0

package/dist/security/api-keys.js

@@ -0,0 +1,99 @@
+/**
+ * Operator API access keys — token shown once at create; store only hash.
+ * Scopes: full | read (no-2fa-bypass read is still API key auth without session 2FA)
+ */
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';
+function hashToken(token) {
+    return createHash('sha256').update(token).digest('hex');
+}
+function mapKey(k) {
+    const scope = (k.scope === 'read' ? 'read' : 'full');
+    return {
+        id: String(k.id),
+        name: String(k.name ?? ''),
+        prefix: String(k.prefix ?? ''),
+        scope,
+        readOnly: scope === 'read' || k.read_only === true,
+        created_at: String(k.created_at ?? ''),
+        last_used_at: k.last_used_at ? String(k.last_used_at) : undefined,
+    };
+}
+export function listApiKeys(db, userId) {
+    const all = db.snapshot.api_keys ?? [];
+    const filtered = userId
+        ? all.filter((k) => String(k.user_id ?? '') === userId)
+        : all;
+    return filtered.map((k) => mapKey(k));
+}
+export function createApiKey(db, input) {
+    const name = input.name.trim() || 'api-key';
+    const scope = input.scope === 'read' ? 'read' : 'full';
+    const raw = `ysk_${randomBytes(24).toString('base64url')}`;
+    const prefix = raw.slice(0, 12);
+    const now = new Date().toISOString();
+    const row = {
+        id: randomUUID(),
+        name,
+        user_id: input.userId,
+        prefix,
+        token_hash: hashToken(raw),
+        scope,
+        read_only: scope === 'read',
+        created_at: now,
+    };
+    if (!db.snapshot.api_keys)
+        db.snapshot.api_keys = [];
+    db.snapshot.api_keys.unshift(row);
+    db.persist();
+    return {
+        key: mapKey(row),
+        token: raw,
+    };
+}
+export function deleteApiKey(db, id, opts) {
+    const keys = db.snapshot.api_keys ?? [];
+    const row = keys.find((k) => k.id === id);
+    if (!row)
+        return false;
+    if (opts?.ownerUserId && !opts.allowAny) {
+        if (String(row.user_id ?? '') !== opts.ownerUserId)
+            return false;
+    }
+    const before = keys.length;
+    db.snapshot.api_keys = keys.filter((k) => k.id !== id);
+    db.persist();
+    return (db.snapshot.api_keys ?? []).length < before;
+}
+/** Returns user_id + scope if token matches */
+export function verifyApiKeyDetailed(db, token) {
+    if (!token.startsWith('ysk_'))
+        return null;
+    const h = hashToken(token);
+    for (const k of db.snapshot.api_keys ?? []) {
+        const stored = String(k.token_hash ?? '');
+        try {
+            const a = Buffer.from(h, 'hex');
+            const b = Buffer.from(stored, 'hex');
+            if (a.length === b.length && timingSafeEqual(a, b)) {
+                k.last_used_at = new Date().toISOString();
+                db.persist();
+                const scope = k.scope === 'read' ? 'read' : 'full';
+                return {
+                    userId: String(k.user_id ?? ''),
+                    scope: scope,
+                    readOnly: scope === 'read' || k.read_only === true,
+                    keyId: String(k.id),
+                };
+            }
+        }
+        catch {
+            /* continue */
+        }
+    }
+    return null;
+}
+/** Returns user_id if token matches a key (legacy) */
+export function verifyApiKey(db, token) {
+    return verifyApiKeyDetailed(db, token)?.userId ?? null;
+}
+//# sourceMappingURL=api-keys.js.map

package/dist/security/api-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../../src/security/api-keys.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAgBnF,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,MAAM,CAAC,CAA0B;IACxC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAgB,CAAC;IACpE,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAC1B,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;QAC9B,KAAK;QACL,QAAQ,EAAE,KAAK,KAAK,MAAM,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI;QAClD,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC;QACtC,YAAY,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;KAClE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAAa,EAAE,MAAe;IACxD,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,MAAM;QACrB,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAE,CAA0B,CAAC,OAAO,IAAI,EAAE,CAAC,KAAK,MAAM,CAAC;QACjF,CAAC,CAAC,GAAG,CAAC;IACR,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAA4B,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,EAAa,EACb,KAA4D;IAE5D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;IAC5C,MAAM,KAAK,GAAgB,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;IACpE,MAAM,GAAG,GAAG,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;IAC3D,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG;QACV,EAAE,EAAE,UAAU,EAAE;QAChB,IAAI;QACJ,OAAO,EAAE,KAAK,CAAC,MAAM;QACrB,MAAM;QACN,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC;QAC1B,KAAK;QACL,SAAS,EAAE,KAAK,KAAK,MAAM;QAC3B,UAAU,EAAE,GAAG;KAChB,CAAC;IACF,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ;QAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,GAAG,EAAE,CAAC;IACrD,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,EAAE,CAAC,OAAO,EAAE,CAAC;IACb,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,GAAyC,CAAC;QACtD,KAAK,EAAE,GAAG;KACX,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,EAAa,EACb,EAAU,EACV,IAAmD;IAEnD,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAiD,CAAC;IAC1F,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,IAAI,IAAI,EAAE,WAAW,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACxC,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,WAAW;YAAE,OAAO,KAAK,CAAC;IACnE,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,EAAE,CAAC,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,EAAE,CAAC,OAAO,EAAE,CAAC;IACb,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC;AACtD,CAAC;AASD,+CAA+C;AAC/C,MAAM,UAAU,oBAAoB,CAClC,EAAa,EACb,KAAa;IAEb,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAChC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACrC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBACnD,CAAC,CAAC,YAAY,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBAC1C,EAAE,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;gBACnD,OAAO;oBACL,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;oBAC/B,KAAK,EAAE,KAAoB;oBAC3B,QAAQ,EAAE,KAAK,KAAK,MAAM,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI;oBAClD,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpB,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,YAAY,CAAC,EAAa,EAAE,KAAa;IACvD,OAAO,oBAAoB,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,MAAM,IAAI,IAAI,CAAC;AACzD,CAAC"}

package/dist/security/approval.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Human-in-the-loop approval queue — persisted via ApprovalRepository when provided.
+ */
+import type { ApprovalStatus, RiskTier } from 'ysk-server-shared';
+import type { ApprovalRepository } from '../repositories/approval-repo.js';
+export interface ApprovalRecord {
+    id: string;
+    action: string;
+    risk: RiskTier;
+    requestedBy: string;
+    status: ApprovalStatus;
+    payload: unknown;
+    createdAt: string;
+    decidedAt?: string;
+    decidedBy?: string;
+}
+export declare class ApprovalQueue {
+    private readonly repo?;
+    private readonly memory;
+    constructor(repo?: ApprovalRepository | undefined);
+    request(input: {
+        action: string;
+        risk: RiskTier;
+        requestedBy: string;
+        payload?: unknown;
+    }): ApprovalRecord;
+    get(id: string): ApprovalRecord | undefined;
+    list(status?: ApprovalStatus): ApprovalRecord[];
+    approve(id: string, decidedBy: string): ApprovalRecord;
+    reject(id: string, decidedBy: string): ApprovalRecord;
+    markExecuted(id: string): ApprovalRecord;
+    assertApproved(id: string | undefined, action: string): void;
+    private decide;
+    private require;
+    private persist;
+}
+//# sourceMappingURL=approval.d.ts.map

package/dist/security/approval.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval.d.ts","sourceRoot":"","sources":["../../src/security/approval.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAGlE,OAAO,KAAK,EAAE,kBAAkB,EAAe,MAAM,kCAAkC,CAAC;AAExF,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,QAAQ,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,cAAc,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,aAAa;IAGZ,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;IAFlC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqC;gBAE/B,IAAI,CAAC,EAAE,kBAAkB,YAAA;IAEtD,OAAO,CAAC,KAAK,EAAE;QACb,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,QAAQ,CAAC;QACf,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,GAAG,cAAc;IAiBlB,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAS3C,IAAI,CAAC,MAAM,CAAC,EAAE,cAAc,GAAG,cAAc,EAAE;IAQ/C,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,cAAc;IAItD,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,cAAc;IAIrD,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,cAAc;IAcxC,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAiC5D,OAAO,CAAC,MAAM;IAad,OAAO,CAAC,OAAO;IAaf,OAAO,CAAC,OAAO;CAOhB"}

package/dist/security/approval.js

@@ -0,0 +1,152 @@
+/**
+ * Human-in-the-loop approval queue — persisted via ApprovalRepository when provided.
+ */
+import { ErrorCodes, YskError, tl } from 'ysk-server-shared';
+import { randomUUID } from 'node:crypto';
+export class ApprovalQueue {
+    repo;
+    memory = new Map();
+    constructor(repo) {
+        this.repo = repo;
+    }
+    request(input) {
+        const record = {
+            id: randomUUID(),
+            action: input.action,
+            risk: input.risk,
+            requestedBy: input.requestedBy,
+            status: 'pending',
+            payload: input.payload ?? {},
+            createdAt: new Date().toISOString()
+        };
+        if (this.repo) {
+            this.repo.insert(toRow(record));
+        }
+        else {
+            this.memory.set(record.id, record);
+        }
+        return { ...record };
+    }
+    get(id) {
+        if (this.repo) {
+            const row = this.repo.find(id);
+            return row ? fromRow(row) : undefined;
+        }
+        const r = this.memory.get(id);
+        return r ? { ...r } : undefined;
+    }
+    list(status) {
+        if (this.repo) {
+            return this.repo.list(status).map(fromRow);
+        }
+        const all = [...this.memory.values()];
+        return (status ? all.filter((r) => r.status === status) : all).map((r) => ({ ...r }));
+    }
+    approve(id, decidedBy) {
+        return this.decide(id, 'approved', decidedBy);
+    }
+    reject(id, decidedBy) {
+        return this.decide(id, 'rejected', decidedBy);
+    }
+    markExecuted(id) {
+        const record = this.require(id);
+        if (record.status !== 'approved') {
+            throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.t0012', { v0: (record.status) }), { httpStatus: 400 });
+        }
+        record.status = 'executed';
+        this.persist(record);
+        return { ...record };
+    }
+    assertApproved(id, action) {
+        if (!id) {
+            throw new YskError(ErrorCodes.APPROVAL_REQUIRED, tl('notes.auto.t0013', { v0: (action) }), { httpStatus: 403, details: { action } });
+        }
+        const record = this.get(id);
+        if (!record) {
+            throw new YskError(ErrorCodes.NOT_FOUND, tl('notes.approval.notFound', { id }), { httpStatus: 404 });
+        }
+        if (record.status === 'pending') {
+            throw new YskError(ErrorCodes.APPROVAL_PENDING, tl('notes.auto.n0670'), {
+                httpStatus: 403,
+                details: { id, action }
+            });
+        }
+        if (record.status === 'rejected') {
+            throw new YskError(ErrorCodes.APPROVAL_REJECTED, tl('notes.auto.n0672'), {
+                httpStatus: 403,
+                details: { id, action }
+            });
+        }
+        if (record.status !== 'approved' && record.status !== 'executed') {
+            throw new YskError(ErrorCodes.APPROVAL_REQUIRED, tl('notes.auto.t0014', { v0: (record.status) }), {
+                httpStatus: 403
+            });
+        }
+        if (record.action !== action) {
+            throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n0671'), {
+                httpStatus: 400,
+                details: { expected: action, got: record.action }
+            });
+        }
+    }
+    decide(id, status, decidedBy) {
+        const record = this.require(id);
+        if (record.status !== 'pending') {
+            throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.t0015', { v0: (record.status) }), {
+                httpStatus: 400
+            });
+        }
+        record.status = status;
+        record.decidedAt = new Date().toISOString();
+        record.decidedBy = decidedBy;
+        this.persist(record);
+        return { ...record };
+    }
+    require(id) {
+        const record = this.get(id);
+        if (!record) {
+            throw new YskError(ErrorCodes.NOT_FOUND, tl('notes.approval.notFound', { id }), { httpStatus: 404 });
+        }
+        // return mutable copy bound for persist — re-fetch into memory map if needed
+        if (!this.repo) {
+            return this.memory.get(id);
+        }
+        // for repo-backed, work on a mutable object then persist
+        return { ...record };
+    }
+    persist(record) {
+        if (this.repo) {
+            this.repo.updateStatus(record.id, record.status, record.decidedBy);
+        }
+        else {
+            this.memory.set(record.id, record);
+        }
+    }
+}
+function toRow(r) {
+    return {
+        id: r.id,
+        action: r.action,
+        risk: r.risk,
+        requested_by: r.requestedBy,
+        status: r.status,
+        payload: r.payload,
+        created_at: r.createdAt,
+        decided_at: r.decidedAt,
+        decided_by: r.decidedBy
+    };
+}
+function fromRow(r) {
+    return {
+        id: r.id,
+        action: r.action,
+        risk: r.risk,
+        requestedBy: r.requested_by,
+        status: r.status,
+        payload: r.payload,
+        createdAt: r.created_at,
+        decidedAt: r.decided_at,
+        decidedBy: r.decided_by
+    };
+}
+//# sourceMappingURL=approval.js.map

package/dist/security/approval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval.js","sourceRoot":"","sources":["../../src/security/approval.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAC,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAezC,MAAM,OAAO,aAAa;IAGK;IAFZ,MAAM,GAAG,IAAI,GAAG,EAA0B,CAAC;IAE5D,YAA6B,IAAyB;QAAzB,SAAI,GAAJ,IAAI,CAAqB;IAAG,CAAC;IAE1D,OAAO,CAAC,KAKP;QACC,MAAM,MAAM,GAAmB;YAC7B,EAAE,EAAE,UAAU,EAAE;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE;YAC5B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAAE,CAAC;QACxC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;IACvB,CAAC;IAED,GAAG,CAAC,EAAU;QACZ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/B,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxC,CAAC;QACD,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9B,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAClC,CAAC;IAED,IAAI,CAAC,MAAuB;QAC1B,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACtC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACxF,CAAC;IAED,OAAO,CAAC,EAAU,EAAE,SAAiB;QACnC,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,CAAC,EAAU,EAAE,SAAiB;QAClC,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAChD,CAAC;IAED,YAAY,CAAC,EAAU;QACrB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,MAAM,IAAI,QAAQ,CAChB,UAAU,CAAC,UAAU,EACrB,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAC/C,EAAE,UAAU,EAAE,GAAG,EAAE,CACpB,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC;QAC3B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrB,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;IACvB,CAAC;IAED,cAAc,CAAC,EAAsB,EAAE,MAAc;QACnD,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,IAAI,QAAQ,CAChB,UAAU,CAAC,iBAAiB,EAC5B,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EACxC,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,CACzC,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC,yBAAyB,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,gBAAgB,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE;gBACtE,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;aAAE,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,iBAAiB,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE;gBACvE,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;aAAE,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACjE,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,iBAAiB,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;gBAChG,UAAU,EAAE,GAAG;aAAE,CAAC,CAAC;QACvB,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE;gBAChE,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE;aAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,EAAU,EAAE,MAA+B,EAAE,SAAiB;QAC3E,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;gBACzF,UAAU,EAAE,GAAG;aAAE,CAAC,CAAC;QACvB,CAAC;QACD,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;QACvB,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrB,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;IACvB,CAAC;IAEO,OAAO,CAAC,EAAU;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC,yBAAyB,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,6EAA6E;QAC7E,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC;QAC9B,CAAC;QACD,yDAAyD;QACzD,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;IACvB,CAAC;IAEO,OAAO,CAAC,MAAsB;QACpC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACrE,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;CACF;AAED,SAAS,KAAK,CAAC,CAAiB;IAC9B,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,YAAY,EAAE,CAAC,CAAC,WAAW;QAC3B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,UAAU,EAAE,CAAC,CAAC,SAAS;QACvB,UAAU,EAAE,CAAC,CAAC,SAAS;QACvB,UAAU,EAAE,CAAC,CAAC,SAAS;KAAE,CAAC;AAC9B,CAAC;AAED,SAAS,OAAO,CAAC,CAAc;IAC7B,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,YAAY;QAC3B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,SAAS,EAAE,CAAC,CAAC,UAAU;KAAE,CAAC;AAC9B,CAAC"}

package/dist/security/capabilities-enforce.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Server-side capability enforcement helpers.
+ */
+import { type CapabilityId, type RolePolicy, type SystemRole } from 'ysk-server-shared';
+export interface CapabilityActor {
+    id?: string;
+    username?: string;
+    roles: SystemRole[];
+    capabilityGrants?: CapabilityId[] | string[];
+    capabilityRevokes?: CapabilityId[] | string[];
+}
+export declare function effectiveCapsFor(actor: CapabilityActor, rolePolicies?: Partial<Record<SystemRole, RolePolicy | null | undefined>>): CapabilityId[];
+export declare function actorCan(actor: CapabilityActor, cap: CapabilityId, rolePolicies?: Partial<Record<SystemRole, RolePolicy | null | undefined>>): boolean;
+/**
+ * Throw 403 if actor lacks capability.
+ */
+export declare function requireCapability(actor: CapabilityActor, cap: CapabilityId, rolePolicies?: Partial<Record<SystemRole, RolePolicy | null | undefined>>): void;
+//# sourceMappingURL=capabilities-enforce.d.ts.map

package/dist/security/capabilities-enforce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities-enforce.d.ts","sourceRoot":"","sources":["../../src/security/capabilities-enforce.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAML,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,UAAU,EAChB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,eAAe;IAC9B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,gBAAgB,CAAC,EAAE,YAAY,EAAE,GAAG,MAAM,EAAE,CAAC;IAC7C,iBAAiB,CAAC,EAAE,YAAY,EAAE,GAAG,MAAM,EAAE,CAAC;CAC/C;AAED,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,eAAe,EACtB,YAAY,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC,GACxE,YAAY,EAAE,CAOhB;AAED,wBAAgB,QAAQ,CACtB,KAAK,EAAE,eAAe,EACtB,GAAG,EAAE,YAAY,EACjB,YAAY,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC,GACxE,OAAO,CAET;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,eAAe,EACtB,GAAG,EAAE,YAAY,EACjB,YAAY,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC,GACxE,IAAI,CASN"}

package/dist/security/capabilities-enforce.js

@@ -0,0 +1,29 @@
+/**
+ * Server-side capability enforcement helpers.
+ */
+import { ErrorCodes, YskError, computeEffectiveCapabilities, hasCapability, tl, } from 'ysk-server-shared';
+export function effectiveCapsFor(actor, rolePolicies) {
+    return computeEffectiveCapabilities({
+        roles: actor.roles,
+        rolePolicies,
+        grants: actor.capabilityGrants,
+        revokes: actor.capabilityRevokes,
+    });
+}
+export function actorCan(actor, cap, rolePolicies) {
+    return hasCapability(effectiveCapsFor(actor, rolePolicies), cap);
+}
+/**
+ * Throw 403 if actor lacks capability.
+ */
+export function requireCapability(actor, cap, rolePolicies) {
+    if (!actorCan(actor, cap, rolePolicies)) {
+        throw new YskError(ErrorCodes.FORBIDDEN, tl('notes.needAdmin'), {
+            httpStatus: 403,
+            details: { capability: cap },
+            messageKey: 'errors.rbac.missingCapability',
+            messageParams: { capability: cap },
+        });
+    }
+}
+//# sourceMappingURL=capabilities-enforce.js.map

package/dist/security/capabilities-enforce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities-enforce.js","sourceRoot":"","sources":["../../src/security/capabilities-enforce.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,UAAU,EACV,QAAQ,EACR,4BAA4B,EAC5B,aAAa,EACb,EAAE,GAIH,MAAM,mBAAmB,CAAC;AAU3B,MAAM,UAAU,gBAAgB,CAC9B,KAAsB,EACtB,YAAyE;IAEzE,OAAO,4BAA4B,CAAC;QAClC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,YAAY;QACZ,MAAM,EAAE,KAAK,CAAC,gBAAgB;QAC9B,OAAO,EAAE,KAAK,CAAC,iBAAiB;KACjC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,QAAQ,CACtB,KAAsB,EACtB,GAAiB,EACjB,YAAyE;IAEzE,OAAO,aAAa,CAAC,gBAAgB,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,GAAG,CAAC,CAAC;AACnE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAsB,EACtB,GAAiB,EACjB,YAAyE;IAEzE,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE;YAC9D,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE;YAC5B,UAAU,EAAE,+BAA+B;YAC3C,aAAa,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE;SACnC,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/security/index.d.ts

@@ -0,0 +1,14 @@
+export * from './allowlist.js';
+export * from './approval.js';
+export * from './rbac.js';
+export * from './capabilities-enforce.js';
+export * from './sandbox.js';
+export * from './tool-executor.js';
+export * from './operation-level.js';
+export * from './totp.js';
+export * from './api-keys.js';
+export * from './ssh-identity/index.js';
+export * from './ssh-2fa/index.js';
+export * from './mfa/index.js';
+export * from './password-policy.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/security/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,WAAW,CAAC;AAC1B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC"}

package/dist/security/index.js

@@ -0,0 +1,14 @@
+export * from './allowlist.js';
+export * from './approval.js';
+export * from './rbac.js';
+export * from './capabilities-enforce.js';
+export * from './sandbox.js';
+export * from './tool-executor.js';
+export * from './operation-level.js';
+export * from './totp.js';
+export * from './api-keys.js';
+export * from './ssh-identity/index.js';
+export * from './ssh-2fa/index.js';
+export * from './mfa/index.js';
+export * from './password-policy.js';
+//# sourceMappingURL=index.js.map

package/dist/security/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,WAAW,CAAC;AAC1B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC"}

package/dist/security/mfa/backup-export.d.ts

@@ -0,0 +1,30 @@
+import type { UserRow } from '../../repositories/user-repo.js';
+export type TotpBackupPayload = {
+    v: 1;
+    userId: string;
+    username: string;
+    exportedAt: string;
+    totpSecret: string;
+    recoveryRemaining: number;
+    note: string;
+};
+export declare function exportTotpBackup(input: {
+    dataDir: string;
+    user: UserRow;
+}): {
+    ok: boolean;
+    blob?: string;
+    notes: string[];
+};
+export declare function importTotpBackupPreview(input: {
+    dataDir: string;
+    userId: string;
+    blob: string;
+}): {
+    ok: boolean;
+    payload?: Omit<TotpBackupPayload, 'totpSecret'> & {
+        totpSecret: '***';
+    };
+    notes: string[];
+};
+//# sourceMappingURL=backup-export.d.ts.map

package/dist/security/mfa/backup-export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-export.d.ts","sourceRoot":"","sources":["../../../src/security/mfa/backup-export.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iCAAiC,CAAC;AAG/D,MAAM,MAAM,iBAAiB,GAAG;IAC9B,CAAC,EAAE,CAAC,CAAC;IACL,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;CACf,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAiClD;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,GAAG;QAAE,UAAU,EAAE,KAAK,CAAA;KAAE,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAoB5G"}

package/dist/security/mfa/backup-export.js

@@ -0,0 +1,57 @@
+import { tl } from 'ysk-server-shared';
+/**
+ * Encrypted break-glass backup of panel 2FA material (operator-held).
+ * Format: ysk2fabak:v1:<base64(iv|tag|json)>
+ */
+import { encryptPrivateKey, decryptPrivateKey, resolveMasterKey } from '../ssh-identity/crypto.js';
+import { decryptTotpSecret } from './totp-crypto.js';
+export function exportTotpBackup(input) {
+    if (!input.user.totp_enabled || !input.user.totp_secret) {
+        return { ok: false, notes: [tl('notes.auto.n0951')] };
+    }
+    try {
+        const secret = decryptTotpSecret(input.dataDir, input.user.id, input.user.totp_secret);
+        const payload = {
+            v: 1,
+            userId: input.user.id,
+            username: input.user.username,
+            exportedAt: new Date().toISOString(),
+            totpSecret: secret,
+            recoveryRemaining: (input.user.totp_recovery_hashes ?? []).length,
+            note: tl('notes.auto.n1536'),
+        };
+        const { key } = resolveMasterKey(input.dataDir);
+        const enc = encryptPrivateKey(key, `totp-bak:${input.user.id}`, JSON.stringify(payload));
+        return {
+            ok: true,
+            blob: `ysk2fabak:v1:${enc}`,
+            notes: [tl('notes.auto.n0789')],
+        };
+    }
+    catch (e) {
+        return { ok: false, notes: [e instanceof Error ? e.message : 'export failed'] };
+    }
+}
+export function importTotpBackupPreview(input) {
+    if (!input.blob.startsWith('ysk2fabak:v1:')) {
+        return { ok: false, notes: [tl('notes.auto.n1112')] };
+    }
+    try {
+        const enc = input.blob.slice('ysk2fabak:v1:'.length);
+        const { key } = resolveMasterKey(input.dataDir);
+        const json = decryptPrivateKey(key, `totp-bak:${input.userId}`, enc);
+        const p = JSON.parse(json);
+        return {
+            ok: true,
+            payload: {
+                ...p,
+                totpSecret: '***',
+            },
+            notes: [tl('notes.auto.n1351')],
+        };
+    }
+    catch (e) {
+        return { ok: false, notes: [e instanceof Error ? e.message : 'decrypt failed'] };
+    }
+}
+//# sourceMappingURL=backup-export.js.map

package/dist/security/mfa/backup-export.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-export.js","sourceRoot":"","sources":["../../../src/security/mfa/backup-export.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC;;;GAGG;AAEH,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAEnG,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAYrD,MAAM,UAAU,gBAAgB,CAAC,KAGhC;IACC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,iBAAiB,CAC9B,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,IAAI,CAAC,EAAE,EACb,KAAK,CAAC,IAAI,CAAC,WAAW,CACvB,CAAC;QACF,MAAM,OAAO,GAAsB;YACjC,CAAC,EAAE,CAAC;YACJ,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE;YACrB,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ;YAC7B,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,UAAU,EAAE,MAAM;YAClB,iBAAiB,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC,MAAM;YACjE,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC;SAC7B,CAAC;QACF,MAAM,EAAE,GAAG,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,iBAAiB,CAC3B,GAAG,EACH,YAAY,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAC3B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CACxB,CAAC;QACF,OAAO;YACL,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,gBAAgB,GAAG,EAAE;YAC3B,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;SAChC,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC;IAClF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAIvC;IACC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,EAAE,GAAG,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,EAAE,YAAY,KAAK,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QACrE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAsB,CAAC;QAChD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,OAAO,EAAE;gBACP,GAAG,CAAC;gBACJ,UAAU,EAAE,KAAK;aAClB;YACD,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;SAChC,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC;IACnF,CAAC;AACH,CAAC"}

package/dist/security/mfa/fail2ban-jails.d.ts

@@ -0,0 +1,10 @@
+export declare function buildYskLoginFilter(): string;
+export declare function buildYskLoginJail(opts?: {
+    logpath?: string;
+}): string;
+export declare function buildSshdJailHint(): string;
+export declare function writeFail2banSnippets(dataDir: string): {
+    written: string[];
+    notes: string[];
+};
+//# sourceMappingURL=fail2ban-jails.d.ts.map

package/dist/security/mfa/fail2ban-jails.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fail2ban-jails.d.ts","sourceRoot":"","sources":["../../../src/security/mfa/fail2ban-jails.ts"],"names":[],"mappings":"AAQA,wBAAgB,mBAAmB,IAAI,MAAM,CAY5C;AAED,wBAAgB,iBAAiB,CAAC,IAAI,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAerE;AAED,wBAAgB,iBAAiB,IAAI,MAAM,CAW1C;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG;IACtD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CAsBA"}

package/dist/security/mfa/fail2ban-jails.js

@@ -0,0 +1,71 @@
+import { tl } from 'ysk-server-shared';
+/**
+ * Fail2ban jail / filter snippets for panel login + sshd (honest: written under dataDir).
+ */
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+export function buildYskLoginFilter() {
+    return [
+        '# YSK Server — filter for panel login failures (journal or log file)',
+        '# Install: /etc/fail2ban/filter.d/ysk-login.conf',
+        '[Definition]',
+        'failregex = ^.*auth\\.login.*ok["\']?\\s*:\\s*false.*$',
+        tl('notes.auto.n0050'),
+        tl('notes.auto.n0051'),
+        '            ^.*"reason"\\s*:\\s*"totp".*$',
+        'ignoreregex =',
+        '',
+    ].join('\n');
+}
+export function buildYskLoginJail(opts) {
+    const logpath = opts?.logpath || '/var/log/ysk-server/auth.log';
+    return [
+        '# YSK Server — jail for panel brute force',
+        '# Install: /etc/fail2ban/jail.d/ysk-login.conf',
+        '[ysk-login]',
+        'enabled = true',
+        'filter = ysk-login',
+        `logpath = ${logpath}`,
+        'maxretry = 8',
+        'findtime = 15m',
+        'bantime = 1h',
+        'backend = auto',
+        '',
+    ].join('\n');
+}
+export function buildSshdJailHint() {
+    return [
+        '# Ensure sshd jail is enabled (distro default often present):',
+        '# /etc/fail2ban/jail.local',
+        '[sshd]',
+        'enabled = true',
+        'maxretry = 5',
+        'findtime = 10m',
+        'bantime = 1h',
+        '',
+    ].join('\n');
+}
+export function writeFail2banSnippets(dataDir) {
+    const dir = join(dataDir, 'security', 'fail2ban');
+    mkdirSync(dir, { recursive: true });
+    const files = {
+        'ysk-login.filter.conf': buildYskLoginFilter(),
+        'ysk-login.jail.conf': buildYskLoginJail(),
+        'sshd.jail.hint.conf': buildSshdJailHint(),
+    };
+    const written = [];
+    for (const [name, body] of Object.entries(files)) {
+        const p = join(dir, name);
+        writeFileSync(p, body, 'utf8');
+        written.push(p);
+    }
+    return {
+        written,
+        notes: [
+            tl('notes.auto.n1203'),
+            tl('notes.auto.n1348'),
+            tl('notes.auto.n0366'),
+        ],
+    };
+}
+//# sourceMappingURL=fail2ban-jails.js.map

package/dist/security/mfa/fail2ban-jails.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fail2ban-jails.js","sourceRoot":"","sources":["../../../src/security/mfa/fail2ban-jails.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,UAAU,mBAAmB;IACjC,OAAO;QACL,sEAAsE;QACtE,kDAAkD;QAClD,cAAc;QACd,wDAAwD;QACxD,EAAE,CAAC,kBAAkB,CAAC;QACtB,EAAE,CAAC,kBAAkB,CAAC;QACtB,2CAA2C;QAC3C,eAAe;QACf,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAA2B;IAC3D,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,IAAI,8BAA8B,CAAC;IAChE,OAAO;QACL,2CAA2C;QAC3C,gDAAgD;QAChD,aAAa;QACb,gBAAgB;QAChB,oBAAoB;QACpB,aAAa,OAAO,EAAE;QACtB,cAAc;QACd,gBAAgB;QAChB,cAAc;QACd,gBAAgB;QAChB,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO;QACL,+DAA+D;QAC/D,4BAA4B;QAC5B,QAAQ;QACR,gBAAgB;QAChB,cAAc;QACd,gBAAgB;QAChB,cAAc;QACd,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAe;IAInD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IAClD,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG;QACZ,uBAAuB,EAAE,mBAAmB,EAAE;QAC9C,qBAAqB,EAAE,iBAAiB,EAAE;QAC1C,qBAAqB,EAAE,iBAAiB,EAAE;KAC3C,CAAC;IACF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC1B,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO;QACL,OAAO;QACP,KAAK,EAAE;YACL,EAAE,CAAC,kBAAkB,CAAC;YACtB,EAAE,CAAC,kBAAkB,CAAC;YACtB,EAAE,CAAC,kBAAkB,CAAC;SACvB;KACF,CAAC;AACJ,CAAC"}

package/dist/security/mfa/index.d.ts

@@ -0,0 +1,9 @@
+export * from './rate-limit.js';
+export * from './recovery-codes.js';
+export * from './totp-crypto.js';
+export * from './step-up.js';
+export * from './remember-device.js';
+export * from './fail2ban-jails.js';
+export * from './backup-export.js';
+export * from './webauthn.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/security/mfa/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/security/mfa/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,eAAe,CAAC"}

package/dist/security/mfa/index.js

@@ -0,0 +1,9 @@
+export * from './rate-limit.js';
+export * from './recovery-codes.js';
+export * from './totp-crypto.js';
+export * from './step-up.js';
+export * from './remember-device.js';
+export * from './fail2ban-jails.js';
+export * from './backup-export.js';
+export * from './webauthn.js';
+//# sourceMappingURL=index.js.map

package/dist/security/mfa/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/security/mfa/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,eAAe,CAAC"}