ysk-server-core 1.0.0

package/dist/security/mfa/webauthn.js

@@ -0,0 +1,178 @@
+import { tl } from 'ysk-server-shared';
+/**
+ * WebAuthn / passkey (panel second factor) via @simplewebauthn/server v13.
+ */
+import { generateRegistrationOptions, verifyRegistrationResponse, generateAuthenticationOptions, verifyAuthenticationResponse, } from '@simplewebauthn/server';
+import { randomBytes } from 'node:crypto';
+const RP_NAME = 'YSK Server';
+function getRpID(origin) {
+    if (origin) {
+        try {
+            return new URL(origin).hostname;
+        }
+        catch {
+            /* */
+        }
+    }
+    return process.env.YSK_RP_ID || 'localhost';
+}
+function getOrigin(origin) {
+    return origin || process.env.YSK_ORIGIN || 'http://127.0.0.1:9173';
+}
+function loadBlob(db, userId) {
+    const raw = db.snapshot.settings[`webauthn.${userId}`];
+    if (!raw)
+        return { credentials: [] };
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return { credentials: [] };
+    }
+}
+function saveBlob(db, userId, blob) {
+    db.snapshot.settings[`webauthn.${userId}`] = JSON.stringify(blob);
+    db.persist();
+}
+export function listWebAuthnCredentials(db, userId) {
+    return loadBlob(db, userId).credentials.map((c) => ({
+        id: c.id,
+        name: c.name || 'Passkey',
+        created_at: c.created_at,
+        transports: c.transports,
+    }));
+}
+export async function beginWebAuthnRegistration(input) {
+    const blob = loadBlob(input.db, input.userId);
+    const options = await generateRegistrationOptions({
+        rpName: RP_NAME,
+        rpID: getRpID(input.origin),
+        userName: input.username,
+        userDisplayName: input.username,
+        userID: new TextEncoder().encode(input.userId),
+        attestationType: 'none',
+        excludeCredentials: blob.credentials.map((c) => ({
+            id: c.credentialID,
+            transports: c.transports,
+        })),
+        authenticatorSelection: {
+            residentKey: 'preferred',
+            userVerification: 'preferred',
+        },
+    });
+    blob.currentChallenge = options.challenge;
+    saveBlob(input.db, input.userId, blob);
+    return options;
+}
+export async function finishWebAuthnRegistration(input) {
+    const blob = loadBlob(input.db, input.userId);
+    if (!blob.currentChallenge) {
+        return { ok: false, notes: [tl('notes.auto.n1084')] };
+    }
+    let verification;
+    try {
+        verification = await verifyRegistrationResponse({
+            response: input.response,
+            expectedChallenge: blob.currentChallenge,
+            expectedOrigin: getOrigin(input.origin),
+            expectedRPID: getRpID(input.origin),
+            requireUserVerification: false,
+        });
+    }
+    catch (e) {
+        blob.currentChallenge = undefined;
+        saveBlob(input.db, input.userId, blob);
+        return {
+            ok: false,
+            notes: [e instanceof Error ? e.message : 'registration verify error'],
+        };
+    }
+    blob.currentChallenge = undefined;
+    if (!verification.verified || !verification.registrationInfo) {
+        saveBlob(input.db, input.userId, blob);
+        return { ok: false, notes: [tl('notes.auto.n0205')] };
+    }
+    const cred = verification.registrationInfo.credential;
+    const row = {
+        id: randomBytes(8).toString('hex'),
+        credentialID: cred.id,
+        credentialPublicKey: Buffer.from(cred.publicKey).toString('base64url'),
+        counter: cred.counter,
+        transports: cred.transports,
+        created_at: new Date().toISOString(),
+        name: input.name?.trim() || 'Passkey',
+    };
+    blob.credentials.push(row);
+    saveBlob(input.db, input.userId, blob);
+    return {
+        ok: true,
+        credential: { id: row.id, name: row.name },
+        notes: [tl('notes.auto.n0367')],
+    };
+}
+export async function beginWebAuthnAuthentication(input) {
+    const blob = loadBlob(input.db, input.userId);
+    if (!blob.credentials.length) {
+        return { ok: false, notes: [tl('notes.auto.n0712')] };
+    }
+    const options = await generateAuthenticationOptions({
+        rpID: getRpID(input.origin),
+        allowCredentials: blob.credentials.map((c) => ({
+            id: c.credentialID,
+            transports: c.transports,
+        })),
+        userVerification: 'preferred',
+    });
+    blob.currentChallenge = options.challenge;
+    saveBlob(input.db, input.userId, blob);
+    return { ok: true, options };
+}
+export async function finishWebAuthnAuthentication(input) {
+    const blob = loadBlob(input.db, input.userId);
+    if (!blob.currentChallenge) {
+        return { ok: false, notes: [tl('notes.auto.n1072')] };
+    }
+    const use = blob.credentials.find((c) => c.credentialID === input.response.id);
+    if (!use) {
+        return { ok: false, notes: [tl('notes.auto.n0964')] };
+    }
+    try {
+        const verification = await verifyAuthenticationResponse({
+            response: input.response,
+            expectedChallenge: blob.currentChallenge,
+            expectedOrigin: getOrigin(input.origin),
+            expectedRPID: getRpID(input.origin),
+            requireUserVerification: false,
+            credential: {
+                id: use.credentialID,
+                publicKey: Buffer.from(use.credentialPublicKey, 'base64url'),
+                counter: use.counter,
+                transports: use.transports,
+            },
+        });
+        blob.currentChallenge = undefined;
+        if (!verification.verified) {
+            saveBlob(input.db, input.userId, blob);
+            return { ok: false, notes: [tl('notes.auto.n0368')] };
+        }
+        use.counter = verification.authenticationInfo.newCounter;
+        saveBlob(input.db, input.userId, blob);
+        return { ok: true, notes: [tl('notes.auto.n0369')] };
+    }
+    catch (e) {
+        blob.currentChallenge = undefined;
+        saveBlob(input.db, input.userId, blob);
+        return {
+            ok: false,
+            notes: [e instanceof Error ? e.message : 'passkey verify error'],
+        };
+    }
+}
+export function deleteWebAuthnCredential(db, userId, credRowId) {
+    const blob = loadBlob(db, userId);
+    const before = blob.credentials.length;
+    blob.credentials = blob.credentials.filter((c) => c.id !== credRowId);
+    saveBlob(db, userId, blob);
+    return blob.credentials.length < before;
+}
+//# sourceMappingURL=webauthn.js.map

package/dist/security/mfa/webauthn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn.js","sourceRoot":"","sources":["../../../src/security/mfa/webauthn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC;;GAEG;AAEH,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAiB1C,MAAM,OAAO,GAAG,YAAY,CAAC;AAE7B,SAAS,OAAO,CAAC,MAAe;IAC9B,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,KAAK;QACP,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,WAAW,CAAC;AAC9C,CAAC;AAED,SAAS,SAAS,CAAC,MAAe;IAChC,OAAO,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,uBAAuB,CAAC;AACrE,CAAC;AAED,SAAS,QAAQ,CAAC,EAAa,EAAE,MAAc;IAC7C,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,MAAM,EAAE,CAAC,CAAC;IACvD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,EAAa,EAAE,MAAc,EAAE,IAAsB;IACrE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClE,EAAE,CAAC,OAAO,EAAE,CAAC;AACf,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,EAAa,EAAE,MAAc;IACnE,OAAO,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClD,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,SAAS;QACzB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,UAAU,EAAE,CAAC,CAAC,UAAU;KACzB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAK/C;IACC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC;QAChD,MAAM,EAAE,OAAO;QACf,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QAC3B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,eAAe,EAAE,KAAK,CAAC,QAAQ;QAC/B,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QAC9C,eAAe,EAAE,MAAM;QACvB,kBAAkB,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/C,EAAE,EAAE,CAAC,CAAC,YAAY;YAClB,UAAU,EAAE,CAAC,CAAC,UAAU;SACzB,CAAC,CAAC;QACH,sBAAsB,EAAE;YACtB,WAAW,EAAE,WAAW;YACxB,gBAAgB,EAAE,WAAW;SAC9B;KACF,CAAC,CAAC;IACH,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,SAAS,CAAC;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACvC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAMhD;IACC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC3B,OAAO,EAAE,EAAE,EAAE,KAAc,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;IACjE,CAAC;IACD,IAAI,YAAY,CAAC;IACjB,IAAI,CAAC;QACH,YAAY,GAAG,MAAM,0BAA0B,CAAC;YAC9C,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,iBAAiB,EAAE,IAAI,CAAC,gBAAgB;YACxC,cAAc,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;YACvC,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;YACnC,uBAAuB,EAAE,KAAK;SAC/B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC;QAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACvC,OAAO;YACL,EAAE,EAAE,KAAc;YAClB,KAAK,EAAE,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B,CAAC;SACtE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC;IAClC,IAAI,CAAC,YAAY,CAAC,QAAQ,IAAI,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC;QAC7D,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACvC,OAAO,EAAE,EAAE,EAAE,KAAc,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;IACjE,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,gBAAgB,CAAC,UAAU,CAAC;IACtD,MAAM,GAAG,GAA0B;QACjC,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAClC,YAAY,EAAE,IAAI,CAAC,EAAE;QACrB,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QACtE,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,SAAS;KACtC,CAAC;IACF,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACvC,OAAO;QACL,EAAE,EAAE,IAAa;QACjB,UAAU,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;QAC1C,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;KAChC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAIjD;IACC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;QAC7B,OAAO,EAAE,EAAE,EAAE,KAAc,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;IACjE,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;QAClD,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QAC3B,gBAAgB,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7C,EAAE,EAAE,CAAC,CAAC,YAAY;YAClB,UAAU,EAAE,CAAC,CAAC,UAAU;SACzB,CAAC,CAAC;QACH,gBAAgB,EAAE,WAAW;KAC9B,CAAC,CAAC;IACH,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,SAAS,CAAC;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACvC,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,OAAO,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAKlD;IACC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;IACxD,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC/E,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC;YACtD,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,iBAAiB,EAAE,IAAI,CAAC,gBAAgB;YACxC,cAAc,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;YACvC,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;YACnC,uBAAuB,EAAE,KAAK;YAC9B,UAAU,EAAE;gBACV,EAAE,EAAE,GAAG,CAAC,YAAY;gBACpB,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,WAAW,CAAC;gBAC5D,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,UAAU,EAAE,GAAG,CAAC,UAAU;aAC3B;SACF,CAAC,CAAC;QACH,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC;QAClC,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACvC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;QACxD,CAAC;QACD,GAAG,CAAC,OAAO,GAAG,YAAY,CAAC,kBAAkB,CAAC,UAAU,CAAC;QACzD,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACvC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;IACvD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC;QAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACvC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC;SACjE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,EAAa,EACb,MAAc,EACd,SAAiB;IAEjB,MAAM,IAAI,GAAG,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;IACvC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;IACtE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAC3B,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,MAAM,CAAC;AAC1C,CAAC"}

package/dist/security/operation-level.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Map tool risk / allowlist entry to RBAC operation level.
+ */
+import type { OperationLevel, RiskTier } from 'ysk-server-shared';
+/**
+ * Convert a risk tier into the minimum RBAC operation level required.
+ */
+export declare function riskToOperationLevel(risk: RiskTier): OperationLevel;
+/**
+ * For write-ish tools that are low risk (e.g. future), still elevate past pure read
+ * when the tool name indicates mutation.
+ */
+export declare function toolImpliedLevel(tool: string, risk: RiskTier): OperationLevel;
+//# sourceMappingURL=operation-level.d.ts.map

package/dist/security/operation-level.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation-level.d.ts","sourceRoot":"","sources":["../../src/security/operation-level.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAElE;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,QAAQ,GAAG,cAAc,CAanE;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,cAAc,CAa7E"}

package/dist/security/operation-level.js

@@ -0,0 +1,39 @@
+/**
+ * Map tool risk / allowlist entry to RBAC operation level.
+ */
+/**
+ * Convert a risk tier into the minimum RBAC operation level required.
+ */
+export function riskToOperationLevel(risk) {
+    switch (risk) {
+        case 'low':
+            return 'read';
+        case 'medium':
+            return 'write-low';
+        case 'high':
+            return 'write-high';
+        case 'critical':
+            return 'destructive';
+        default:
+            return 'privilege';
+    }
+}
+/**
+ * For write-ish tools that are low risk (e.g. future), still elevate past pure read
+ * when the tool name indicates mutation.
+ */
+export function toolImpliedLevel(tool, risk) {
+    const fromRisk = riskToOperationLevel(risk);
+    if (tool.startsWith('fs.read') || tool.startsWith('fs.list') || tool.startsWith('sys.') || tool.startsWith('process.list') || tool.includes('.status')) {
+        return 'read';
+    }
+    if (tool.startsWith('fs.write') || tool.startsWith('service.restart') || tool.startsWith('pkg.')) {
+        // at least write-low / write-high depending on risk
+        return fromRisk === 'read' ? 'write-low' : fromRisk;
+    }
+    if (tool.includes('delete') || tool.includes('remove') || tool.includes('flush')) {
+        return fromRisk === 'read' || fromRisk === 'write-low' ? 'destructive' : fromRisk;
+    }
+    return fromRisk;
+}
+//# sourceMappingURL=operation-level.js.map

package/dist/security/operation-level.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation-level.js","sourceRoot":"","sources":["../../src/security/operation-level.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAc;IACjD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,KAAK;YACR,OAAO,MAAM,CAAC;QAChB,KAAK,QAAQ;YACX,OAAO,WAAW,CAAC;QACrB,KAAK,MAAM;YACT,OAAO,YAAY,CAAC;QACtB,KAAK,UAAU;YACb,OAAO,aAAa,CAAC;QACvB;YACE,OAAO,WAAW,CAAC;IACvB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,IAAc;IAC3D,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACvJ,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACjG,oDAAoD;QACpD,OAAO,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;IACtD,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACjF,OAAO,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC;IACpF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/security/password-policy.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Bootstrap / panel password policy — weak & default detection.
+ * Used by setup, login flags, readiness.
+ */
+/** Well-known insecure bootstrap passwords (never allow in production without override). */
+export declare const WEAK_PASSWORDS: Set<string>;
+export type PasswordPolicyResult = {
+    ok: boolean;
+    weak: boolean;
+    tooShort: boolean;
+    reasons: string[];
+};
+/** Minimum length for panel passwords */
+export declare const MIN_PASSWORD_LENGTH = 8;
+/**
+ * Validate a candidate panel password (setup / change).
+ * Returns ok=false when weak or too short.
+ */
+export declare function assessPassword(password: string): PasswordPolicyResult;
+/** True if password is the classic bootstrap default. */
+export declare function isBootstrapDefaultPassword(password: string): boolean;
+//# sourceMappingURL=password-policy.d.ts.map

package/dist/security/password-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-policy.d.ts","sourceRoot":"","sources":["../../src/security/password-policy.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,4FAA4F;AAC5F,eAAO,MAAM,cAAc,aAiB1B,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAAC;AAEF,yCAAyC;AACzC,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,oBAAoB,CAcrE;AAED,yDAAyD;AACzD,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEpE"}

package/dist/security/password-policy.js

@@ -0,0 +1,50 @@
+/**
+ * Bootstrap / panel password policy — weak & default detection.
+ * Used by setup, login flags, readiness.
+ */
+/** Well-known insecure bootstrap passwords (never allow in production without override). */
+export const WEAK_PASSWORDS = new Set([
+    'admin',
+    'password',
+    'password1',
+    '12345678',
+    '123456789',
+    'ysk',
+    'ysk-server',
+    'changeme',
+    'default',
+    'root',
+    'toor',
+    'passw0rd',
+    'admin123',
+    'admin1234',
+].map((s) => s.toLowerCase()));
+/** Minimum length for panel passwords */
+export const MIN_PASSWORD_LENGTH = 8;
+/**
+ * Validate a candidate panel password (setup / change).
+ * Returns ok=false when weak or too short.
+ */
+export function assessPassword(password) {
+    const reasons = [];
+    const p = password ?? '';
+    const tooShort = p.length < MIN_PASSWORD_LENGTH;
+    if (tooShort)
+        reasons.push(`min_length_${MIN_PASSWORD_LENGTH}`);
+    const weak = WEAK_PASSWORDS.has(p.toLowerCase()) || p.length > 0 && /^[0-9]+$/.test(p);
+    if (WEAK_PASSWORDS.has(p.toLowerCase()))
+        reasons.push('known_weak');
+    if (/^[0-9]+$/.test(p) && p.length > 0)
+        reasons.push('digits_only');
+    return {
+        ok: !tooShort && !weak,
+        weak: weak || tooShort,
+        tooShort,
+        reasons,
+    };
+}
+/** True if password is the classic bootstrap default. */
+export function isBootstrapDefaultPassword(password) {
+    return (password ?? '').toLowerCase() === 'admin';
+}
+//# sourceMappingURL=password-policy.js.map

package/dist/security/password-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-policy.js","sourceRoot":"","sources":["../../src/security/password-policy.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,4FAA4F;AAC5F,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,GAAG,CACnC;IACE,OAAO;IACP,UAAU;IACV,WAAW;IACX,UAAU;IACV,WAAW;IACX,KAAK;IACL,YAAY;IACZ,UAAU;IACV,SAAS;IACT,MAAM;IACN,MAAM;IACN,UAAU;IACV,UAAU;IACV,WAAW;CACZ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAC9B,CAAC;AASF,yCAAyC;AACzC,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,CAAC,GAAG,QAAQ,IAAI,EAAE,CAAC;IACzB,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,GAAG,mBAAmB,CAAC;IAChD,IAAI,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,cAAc,mBAAmB,EAAE,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvF,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACpE,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACpE,OAAO;QACL,EAAE,EAAE,CAAC,QAAQ,IAAI,CAAC,IAAI;QACtB,IAAI,EAAE,IAAI,IAAI,QAAQ;QACtB,QAAQ;QACR,OAAO;KACR,CAAC;AACJ,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,0BAA0B,CAAC,QAAgB;IACzD,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC;AACpD,CAAC"}

package/dist/security/rbac.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Three-axis RBAC: role × resource scope × operation level.
+ */
+import type { OperationLevel, ResourceScope, SystemRole } from 'ysk-server-shared';
+export interface RbacDecision {
+    allowed: boolean;
+    reason?: string;
+}
+/**
+ * Check whether a role may perform an operation at the given scope.
+ * Project-scoped destructive ops still require operator+; agents are capped at write-low.
+ */
+export declare function checkRbac(role: SystemRole, scope: ResourceScope, level: OperationLevel): RbacDecision;
+/**
+ * True if role may at least reach the given level.
+ */
+export declare function roleCan(role: SystemRole, level: OperationLevel): boolean;
+//# sourceMappingURL=rbac.d.ts.map

package/dist/security/rbac.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.d.ts","sourceRoot":"","sources":["../../src/security/rbac.ts"],"names":[],"mappings":"AACA;;GAEG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAmBnF,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAgB,SAAS,CACvB,IAAI,EAAE,UAAU,EAChB,KAAK,EAAE,aAAa,EACpB,KAAK,EAAE,cAAc,GACpB,YAAY,CA8Bd;AAED;;GAEG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAExE"}

package/dist/security/rbac.js

@@ -0,0 +1,58 @@
+import { tl } from 'ysk-server-shared';
+/** Privilege rank: higher can do everything lower can */
+const LEVEL_RANK = {
+    read: 1,
+    'write-low': 2,
+    'write-high': 3,
+    destructive: 4,
+    privilege: 5,
+};
+/** Max operation level permitted per role (global default) */
+const ROLE_MAX_LEVEL = {
+    admin: 'privilege',
+    operator: 'write-high',
+    viewer: 'read',
+    agent: 'write-low',
+};
+/**
+ * Check whether a role may perform an operation at the given scope.
+ * Project-scoped destructive ops still require operator+; agents are capped at write-low.
+ */
+export function checkRbac(role, scope, level) {
+    const max = ROLE_MAX_LEVEL[role];
+    if (!max) {
+        return { allowed: false, reason: tl('notes.auto.t0016', { v0: (role) }) };
+    }
+    if (LEVEL_RANK[level] > LEVEL_RANK[max]) {
+        return {
+            allowed: false,
+            reason: tl('notes.auto.t0017', { v0: (role), v1: (level), v2: (max) }),
+        };
+    }
+    // Viewers cannot write on any scope
+    if (role === 'viewer' && level !== 'read') {
+        return { allowed: false, reason: tl('notes.auto.n1027') };
+    }
+    // Agents cannot operate at global privilege scope for high ops
+    if (role === 'agent' && scope.kind === 'global' && LEVEL_RANK[level] >= LEVEL_RANK['write-high']) {
+        return {
+            allowed: false,
+            reason: tl('notes.auto.n0075'),
+        };
+    }
+    // Project scope requires an id for non-global
+    if ((scope.kind === 'project' || scope.kind === 'server') && !scope.id && level !== 'read') {
+        return {
+            allowed: false,
+            reason: tl('notes.auto.t0018', { v0: (scope.kind) }),
+        };
+    }
+    return { allowed: true };
+}
+/**
+ * True if role may at least reach the given level.
+ */
+export function roleCan(role, level) {
+    return LEVEL_RANK[level] <= LEVEL_RANK[ROLE_MAX_LEVEL[role]];
+}
+//# sourceMappingURL=rbac.js.map

package/dist/security/rbac.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.js","sourceRoot":"","sources":["../../src/security/rbac.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAOvC,yDAAyD;AACzD,MAAM,UAAU,GAAmC;IACjD,IAAI,EAAE,CAAC;IACP,WAAW,EAAE,CAAC;IACd,YAAY,EAAE,CAAC;IACf,WAAW,EAAE,CAAC;IACd,SAAS,EAAE,CAAC;CACb,CAAC;AAEF,8DAA8D;AAC9D,MAAM,cAAc,GAAuC;IACzD,KAAK,EAAE,WAAW;IAClB,QAAQ,EAAE,YAAY;IACtB,MAAM,EAAE,MAAM;IACd,KAAK,EAAE,WAAW;CACnB,CAAC;AAOF;;;GAGG;AACH,MAAM,UAAU,SAAS,CACvB,IAAgB,EAChB,KAAoB,EACpB,KAAqB;IAErB,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;IAC5E,CAAC;IACD,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;SACvE,CAAC;IACJ,CAAC;IACD,oCAAoC;IACpC,IAAI,IAAI,KAAK,QAAQ,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,CAAC;IAC5D,CAAC;IACD,+DAA+D;IAC/D,IAAI,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjG,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC;SAC/B,CAAC;IACJ,CAAC;IACD,8CAA8C;IAC9C,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QAC3F,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;SACrD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,OAAO,CAAC,IAAgB,EAAE,KAAqB;IAC7D,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC"}

package/dist/security/sandbox.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Kernel Sandbox policy planner — pure orchestration (no real nsenter/seccomp apply here).
+ */
+export interface SandboxPolicy {
+    /** Linux user the process should run as */
+    runAsUser?: string;
+    /** Allowed filesystem roots */
+    allowedPaths: string[];
+    /** Network allowed? */
+    network: boolean;
+    /** Max CPU percent hint */
+    cpuPercent?: number;
+    /** Max memory MB */
+    memoryMb?: number;
+    /** Seccomp profile name */
+    seccompProfile: 'default' | 'strict' | 'unconfined';
+}
+export interface SandboxPlan {
+    policy: SandboxPolicy;
+    /** Concrete commands that would be used on a real host (not executed here) */
+    commands: string[];
+    notes: string[];
+}
+/**
+ * Build a sandbox execution plan for a constrained command.
+ */
+export declare function planSandbox(command: string[], overrides?: Partial<SandboxPolicy>): SandboxPlan;
+/**
+ * Validate that a path is within allowed roots.
+ * Empty / whitespace roots are ignored (never treat as filesystem root).
+ * Uses boundary-safe prefix (`root + '/'`) so `/var` does not match `/var-evil`.
+ */
+export declare function pathAllowed(path: string, allowedPaths: string[]): boolean;
+//# sourceMappingURL=sandbox.d.ts.map

package/dist/security/sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../src/security/sandbox.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,MAAM,WAAW,aAAa;IAC5B,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+BAA+B;IAC/B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,uBAAuB;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,2BAA2B;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oBAAoB;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2BAA2B;IAC3B,cAAc,EAAE,SAAS,GAAG,QAAQ,GAAG,YAAY,CAAC;CACrD;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,aAAa,CAAC;IACtB,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAUD;;GAEG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,MAAM,EAAE,EACjB,SAAS,GAAE,OAAO,CAAC,aAAa,CAAM,GACrC,WAAW,CA4Bb;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,OAAO,CAUzE"}

package/dist/security/sandbox.js

@@ -0,0 +1,62 @@
+/**
+ * Kernel Sandbox policy planner — pure orchestration (no real nsenter/seccomp apply here).
+ */
+import { ErrorCodes, YskError, tl } from 'ysk-server-shared';
+const DEFAULT_POLICY = {
+    allowedPaths: ['/tmp', '/var/lib/ysk-server'],
+    network: false,
+    cpuPercent: 50,
+    memoryMb: 512,
+    seccompProfile: 'default',
+};
+/**
+ * Build a sandbox execution plan for a constrained command.
+ */
+export function planSandbox(command, overrides = {}) {
+    if (!command.length) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n1051'), {
+            httpStatus: 400,
+        });
+    }
+    const policy = { ...DEFAULT_POLICY, ...overrides };
+    if (policy.seccompProfile === 'unconfined' && !policy.runAsUser) {
+        throw new YskError(ErrorCodes.SANDBOX_VIOLATION, tl('notes.auto.n1592'), { httpStatus: 400 });
+    }
+    const commands = [];
+    if (policy.runAsUser) {
+        commands.push(`runuser -u ${policy.runAsUser} -- ${command.join(' ')}`);
+    }
+    else {
+        commands.push(command.join(' '));
+    }
+    const notes = [
+        `network=${policy.network}`,
+        `seccomp=${policy.seccompProfile}`,
+        `paths=${policy.allowedPaths.join(',')}`,
+    ];
+    if (policy.memoryMb)
+        notes.push(`memoryMb=${policy.memoryMb}`);
+    if (policy.cpuPercent)
+        notes.push(`cpuPercent=${policy.cpuPercent}`);
+    return { policy, commands, notes };
+}
+/**
+ * Validate that a path is within allowed roots.
+ * Empty / whitespace roots are ignored (never treat as filesystem root).
+ * Uses boundary-safe prefix (`root + '/'`) so `/var` does not match `/var-evil`.
+ */
+export function pathAllowed(path, allowedPaths) {
+    if (!path || typeof path !== 'string' || path.includes('\0'))
+        return false;
+    const normalized = path.replace(/\/+$/, '') || '/';
+    return allowedPaths.some((root) => {
+        if (!root || typeof root !== 'string' || !root.trim())
+            return false;
+        const r = root.replace(/\/+$/, '') || '/';
+        // Bare `/` would allow everything — require explicit single-root policy
+        if (r === '/')
+            return normalized === '/';
+        return normalized === r || normalized.startsWith(r + '/');
+    });
+}
+//# sourceMappingURL=sandbox.js.map

package/dist/security/sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../src/security/sandbox.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAC,MAAM,mBAAmB,CAAC;AAwB5D,MAAM,cAAc,GAAkB;IACpC,YAAY,EAAE,CAAC,MAAM,EAAE,qBAAqB,CAAC;IAC7C,OAAO,EAAE,KAAK;IACd,UAAU,EAAE,EAAE;IACd,QAAQ,EAAE,GAAG;IACb,cAAc,EAAE,SAAS;CAC1B,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,WAAW,CACzB,OAAiB,EACjB,YAAoC,EAAE;IAEtC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE;YAChE,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAkB,EAAE,GAAG,cAAc,EAAE,GAAG,SAAS,EAAE,CAAC;IAClE,IAAI,MAAM,CAAC,cAAc,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QAChE,MAAM,IAAI,QAAQ,CAChB,UAAU,CAAC,iBAAiB,EAC5B,EAAE,CAAC,kBAAkB,CAAC,EACtB,EAAE,UAAU,EAAE,GAAG,EAAE,CACpB,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC,cAAc,MAAM,CAAC,SAAS,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,KAAK,GAAG;QACZ,WAAW,MAAM,CAAC,OAAO,EAAE;QAC3B,WAAW,MAAM,CAAC,cAAc,EAAE;QAClC,SAAS,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;KACzC,CAAC;IACF,IAAI,MAAM,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC/D,IAAI,MAAM,CAAC,UAAU;QAAE,KAAK,CAAC,IAAI,CAAC,cAAc,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IACrE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,YAAsB;IAC9D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3E,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;IACnD,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QAChC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,KAAK,CAAC;QACpE,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;QAC1C,wEAAwE;QACxE,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,UAAU,KAAK,GAAG,CAAC;QACzC,OAAO,UAAU,KAAK,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/security/ssh-2fa/index.d.ts

@@ -0,0 +1,4 @@
+export * from './types.js';
+export * from './store.js';
+export * from './install.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/security/ssh-2fa/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/security/ssh-2fa/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC"}

package/dist/security/ssh-2fa/index.js

@@ -0,0 +1,4 @@
+export * from './types.js';
+export * from './store.js';
+export * from './install.js';
+//# sourceMappingURL=index.js.map

package/dist/security/ssh-2fa/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/security/ssh-2fa/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC"}

package/dist/security/ssh-2fa/install.d.ts

@@ -0,0 +1,93 @@
+import type { HostExecutor } from '../../host/executor.js';
+import type { Ssh2faPublic } from './types.js';
+/**
+ * google-authenticator file format (libpam-google-authenticator).
+ * First line: base32 secret; " lines are options; trailing digits = scratch codes (optional).
+ */
+/**
+ * @param scratchCodes optional emergency 8-digit codes (pam consumes once)
+ */
+export declare function buildGoogleAuthenticatorFile(secret: string, scratchCodes?: string[]): string;
+export declare function generateScratchCodes(count?: number): string[];
+export declare function buildPamSshSnippet(): string;
+export declare function buildSshdTotpHints(): string;
+/**
+ * Per-user strict Match: publickey then TOTP; password off.
+ * Only list users that already have .google_authenticator written.
+ */
+export declare function buildSshdStrictMatchSnippet(linuxUsers: string[]): string;
+export declare const SSHD_STRICT_SNIPPET_NAME = "98-ysk-ssh-2fa-strict.conf";
+/** Project SFTP-style users (ysks_ or ysk_ prefix) — exclude from strict Match by default. */
+export declare function isSftpOnlyStyleUser(linuxUser: string): boolean;
+export declare function planSsh2faStrictSnippet(input: {
+    linuxUsers: string[];
+    /** must remain outside Match for rescue */
+    recoveryUsers?: string[];
+    /** include project SFTP users (default false) */
+    includeSftpUsers?: boolean;
+}): {
+    ok: boolean;
+    snippet: string;
+    users: string[];
+    notes: string[];
+    blocked?: boolean;
+};
+export declare function applySshdStrictSnippet(input: {
+    dataDir: string;
+    host: HostExecutor;
+    linuxUsers: string[];
+    recoveryUsers?: string[];
+    apply?: boolean;
+    executeEnabled?: boolean;
+}): Promise<{
+    ok: boolean;
+    dryRun: boolean;
+    applied: boolean;
+    blocked: boolean;
+    snippet: string;
+    notes: string[];
+    written?: string[];
+}>;
+export type InstallSsh2faResult = {
+    ok: boolean;
+    dryRun: boolean;
+    applied: boolean;
+    blocked: boolean;
+    requiresRoot: boolean;
+    requiresExecute: boolean;
+    plannedPath?: string;
+    record?: Ssh2faPublic;
+    notes: string[];
+    pamSnippet?: string;
+    sshdHints?: string;
+    /** one-time on successful apply */
+    scratchCodes?: string[];
+};
+export declare function installSsh2faFile(input: {
+    dataDir: string;
+    id: string;
+    apply?: boolean;
+    host?: HostExecutor;
+    executeEnabled?: boolean;
+}): Promise<InstallSsh2faResult>;
+export declare function uninstallSsh2faFile(input: {
+    dataDir: string;
+    id: string;
+    apply?: boolean;
+    retire?: boolean;
+}): Promise<InstallSsh2faResult>;
+/** Host probe: package + pam file presence (read-only hints). */
+export type Ssh2faHostHealth = {
+    notes: string[];
+    /** traffic light for UI */
+    lights: {
+        package: 'green' | 'yellow' | 'red';
+        pam: 'green' | 'yellow' | 'red';
+        kbdInteractive: 'green' | 'yellow' | 'red';
+    };
+    pamModule?: boolean;
+    pamConfigured?: boolean;
+    kbdInteractive?: boolean;
+};
+export declare function probeSsh2faHost(host: HostExecutor): Promise<Ssh2faHostHealth>;
+//# sourceMappingURL=install.d.ts.map

package/dist/security/ssh-2fa/install.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../../../src/security/ssh-2fa/install.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAM3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAG/C;;;GAGG;AACH;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,MAAM,EAAE,GACtB,MAAM,CAcR;AAED,wBAAgB,oBAAoB,CAAC,KAAK,SAAI,GAAG,MAAM,EAAE,CAMxD;AAED,wBAAgB,kBAAkB,IAAI,MAAM,CAS3C;AAED,wBAAgB,kBAAkB,IAAI,MAAM,CAU3C;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,MAAM,CAsBxE;AAED,eAAO,MAAM,wBAAwB,+BAA+B,CAAC;AAErE,8FAA8F;AAC9F,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,2CAA2C;IAC3C,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,iDAAiD;IACjD,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,GAAG;IACF,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAwCA;AAED,wBAAsB,sBAAsB,CAAC,KAAK,EAAE;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;IACnB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,GAAG,OAAO,CAAC;IACV,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC,CA+DD;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,EAAE,OAAO,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mCAAmC;IACnC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB,CAAC;AAEF,wBAAsB,iBAAiB,CAAC,KAAK,EAAE;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAwJ/B;AAED,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA4D/B;AAED,iEAAiE;AACjE,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,2BAA2B;IAC3B,MAAM,EAAE;QACN,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,KAAK,CAAC;QACpC,GAAG,EAAE,OAAO,GAAG,QAAQ,GAAG,KAAK,CAAC;QAChC,cAAc,EAAE,OAAO,GAAG,QAAQ,GAAG,KAAK,CAAC;KAC5C,CAAC;IACF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF,wBAAsB,eAAe,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAsDnF"}