ysk-server-core 1.0.0

package/dist/security/ssh-2fa/store.js

@@ -0,0 +1,209 @@
+import { tl } from 'ysk-server-shared';
+/**
+ * SSH 2FA registry under dataDir/secrets/ssh/ssh-2fa.json
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from 'node:fs';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { encryptPrivateKey, decryptPrivateKey, resolveMasterKey, secretsSshDir } from '../ssh-identity/crypto.js';
+import { buildOtpAuthUrl, generateTotpSecret, verifyTotp } from '../totp.js';
+import { toPublicSsh2fa } from './types.js';
+function storePath(dataDir) {
+    return join(secretsSshDir(dataDir), 'ssh-2fa.json');
+}
+function loadAll(dataDir) {
+    const path = storePath(dataDir);
+    if (!existsSync(path))
+        return [];
+    try {
+        const raw = JSON.parse(readFileSync(path, 'utf8'));
+        return Array.isArray(raw.items) ? raw.items : [];
+    }
+    catch {
+        return [];
+    }
+}
+function saveAll(dataDir, items) {
+    mkdirSync(secretsSshDir(dataDir), { recursive: true });
+    const path = storePath(dataDir);
+    writeFileSync(path, JSON.stringify({ items }, null, 2), { mode: 0o600 });
+    try {
+        chmodSync(path, 0o600);
+    }
+    catch {
+        /* ignore */
+    }
+}
+function resolveBinding(db, input) {
+    let projectId = input.projectId?.trim() || undefined;
+    let linuxUser = input.linuxUser?.trim() || undefined;
+    let homeDir = input.homeDir?.trim() || undefined;
+    if (projectId && db) {
+        const p = db.snapshot.projects.find((x) => x.id === projectId);
+        if (!p)
+            return { error: tl('notes.auto.n0028') };
+        linuxUser = linuxUser || p.linux_user;
+        homeDir = homeDir || p.home_dir;
+    }
+    if (!linuxUser)
+        return { error: tl('notes.auto.n1564') };
+    if (!homeDir) {
+        // best-effort default
+        homeDir = `/home/${linuxUser}`;
+    }
+    return { projectId, linuxUser, homeDir };
+}
+export function listSsh2fa(dataDir, filter) {
+    let items = loadAll(dataDir).filter((i) => i.status !== 'retired');
+    if (filter?.projectId)
+        items = items.filter((i) => i.projectId === filter.projectId);
+    if (filter?.linuxUser)
+        items = items.filter((i) => i.linuxUser === filter.linuxUser);
+    return items.map(toPublicSsh2fa);
+}
+export function listSsh2faAll(dataDir) {
+    return loadAll(dataDir).map(toPublicSsh2fa);
+}
+export function getSsh2fa(dataDir, id) {
+    const row = loadAll(dataDir).find((i) => i.id === id);
+    return row ? toPublicSsh2fa(row) : null;
+}
+export function getSsh2faInternal(dataDir, id) {
+    return loadAll(dataDir).find((i) => i.id === id) ?? null;
+}
+/** Create enrollment with new secret (independent of panel). */
+export function enrollSsh2fa(dataDir, input, db) {
+    const binding = resolveBinding(db, input);
+    if ('error' in binding)
+        return { ok: false, notes: [binding.error] };
+    const existing = loadAll(dataDir).find((i) => i.linuxUser === binding.linuxUser && i.status !== 'retired');
+    if (existing) {
+        return {
+            ok: false,
+            notes: [tl('notes.auto.t0516', { v0: (binding.linuxUser), v1: (existing.id) })],
+            record: toPublicSsh2fa(existing)
+        };
+    }
+    let master;
+    try {
+        master = resolveMasterKey(dataDir);
+    }
+    catch (e) {
+        return { ok: false, notes: [e instanceof Error ? e.message : 'master key'] };
+    }
+    const secret = (input.secret?.trim() || generateTotpSecret()).replace(/\s/g, '');
+    const id = randomUUID();
+    const now = new Date().toISOString();
+    const label = binding.linuxUser;
+    const row = {
+        id,
+        linuxUser: binding.linuxUser,
+        homeDir: binding.homeDir,
+        projectId: binding.projectId,
+        secretEnc: encryptPrivateKey(master.key, id, secret),
+        status: 'enrolled',
+        label,
+        fromPanel: Boolean(input.fromPanel),
+        notes: input.fromPanel
+            ? [tl('notes.auto.n1472')]
+            : [tl('notes.auto.n1240')],
+        createdAt: now,
+        updatedAt: now,
+        createdBy: input.createdBy
+    };
+    const items = loadAll(dataDir);
+    items.unshift(row);
+    saveAll(dataDir, items);
+    const notes = [...row.notes];
+    if (master.source === 'generated') {
+        notes.push(tl('notes.auto.t0517', { v0: (master.path ?? 'secrets/ssh/.master.key') }));
+    }
+    return {
+        ok: true,
+        record: toPublicSsh2fa(row),
+        secret,
+        otpauthUrl: buildOtpAuthUrl({
+            secret,
+            username: label,
+            issuer: 'YSK SSH'
+        }),
+        notes
+    };
+}
+export function confirmSsh2fa(dataDir, id, code) {
+    const items = loadAll(dataDir);
+    const idx = items.findIndex((i) => i.id === id);
+    if (idx < 0)
+        return { ok: false, notes: [tl('notes.ssh.registrationNotFound')] };
+    const row = items[idx];
+    try {
+        const master = resolveMasterKey(dataDir);
+        const secret = decryptPrivateKey(master.key, row.id, row.secretEnc);
+        if (!verifyTotp(secret, code)) {
+            return { ok: false, notes: [tl('notes.auto.n1608')] };
+        }
+    }
+    catch (e) {
+        return { ok: false, notes: [e instanceof Error ? e.message : 'decrypt failed'] };
+    }
+    items[idx] = {
+        ...row,
+        status: row.status === 'file_written' ? 'file_written' : 'confirmed',
+        confirmedAt: new Date().toISOString(),
+        updatedAt: new Date().toISOString(),
+        notes: [...row.notes, tl('notes.auto.n0195')]
+    };
+    saveAll(dataDir, items);
+    return { ok: true, record: toPublicSsh2fa(items[idx]), notes: [tl('notes.auto.n0794')] };
+}
+export function revealSsh2faSecret(dataDir, id) {
+    const row = getSsh2faInternal(dataDir, id);
+    if (!row)
+        return { ok: false, notes: [tl('notes.ssh.registrationNotFound')] };
+    try {
+        const master = resolveMasterKey(dataDir);
+        const secret = decryptPrivateKey(master.key, row.id, row.secretEnc);
+        return {
+            ok: true,
+            secret,
+            otpauthUrl: buildOtpAuthUrl({
+                secret,
+                username: row.label,
+                issuer: 'YSK SSH'
+            }),
+            notes: ['secret revealed — audit recommended']
+        };
+    }
+    catch (e) {
+        return { ok: false, notes: [e instanceof Error ? e.message : 'decrypt failed'] };
+    }
+}
+export function updateSsh2faStatus(dataDir, id, patch) {
+    const items = loadAll(dataDir);
+    const idx = items.findIndex((i) => i.id === id);
+    if (idx < 0)
+        return null;
+    const prev = items[idx];
+    items[idx] = {
+        ...prev,
+        ...patch,
+        notes: patch.notes ?? prev.notes,
+        updatedAt: new Date().toISOString()
+    };
+    saveAll(dataDir, items);
+    return toPublicSsh2fa(items[idx]);
+}
+export function retireSsh2fa(dataDir, id) {
+    const items = loadAll(dataDir);
+    const idx = items.findIndex((i) => i.id === id);
+    if (idx < 0)
+        return { ok: false, notes: [tl('notes.ssh.registrationNotFound')] };
+    items[idx] = {
+        ...items[idx],
+        status: 'retired',
+        updatedAt: new Date().toISOString()
+    };
+    saveAll(dataDir, items);
+    return { ok: true, notes: [tl('notes.auto.n0801')] };
+}
+//# sourceMappingURL=store.js.map

package/dist/security/ssh-2fa/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/security/ssh-2fa/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EAAE,MAAM,2BAA2B,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7E,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,SAAS,SAAS,CAAC,OAAe;IAChC,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,OAAO,CAAC,OAAe;IAC9B,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA+B,CAAC;QACjF,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,OAAe,EAAE,KAAqB;IACrD,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAChC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CACrB,EAAyB,EACzB,KAAmE;IAEnE,IAAI,SAAS,GAAG,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACrD,IAAI,SAAS,GAAG,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACrD,IAAI,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACjD,IAAI,SAAS,IAAI,EAAE,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;QAC/D,IAAI,CAAC,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACjD,SAAS,GAAG,SAAS,IAAI,CAAC,CAAC,UAAU,CAAC;QACtC,OAAO,GAAG,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC;IAClC,CAAC;IACD,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,CAAC;IACzD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,sBAAsB;QACtB,OAAO,GAAG,SAAS,SAAS,EAAE,CAAC;IACjC,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,MAG3C;IACC,IAAI,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;IACnE,IAAI,MAAM,EAAE,SAAS;QAAE,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,CAAC,CAAC;IACrF,IAAI,MAAM,EAAE,SAAS;QAAE,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,CAAC,CAAC;IACrF,OAAO,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAAe,EAAE,EAAU;IACnD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,OAAO,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,EAAU;IAC3D,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,CAAC;AAC3D,CAAC;AAWD,gEAAgE;AAChE,MAAM,UAAU,YAAY,CAC1B,OAAe,EACf,KAQC,EACD,EAAc;IAEd,MAAM,OAAO,GAAG,cAAc,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,OAAO,IAAI,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;IAErE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CACnE,CAAC;IACF,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAC/E,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC;SAAE,CAAC;IACvC,CAAC;IAED,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC;IAC/E,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACjF,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC;IAChC,MAAM,GAAG,GAAiB;QACxB,EAAE;QACF,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,iBAAiB,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC;QACpD,MAAM,EAAE,UAAU;QAClB,KAAK;QACL,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;QACnC,KAAK,EAAE,KAAK,CAAC,SAAS;YACpB,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;YAC1B,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;QAC5B,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,KAAK,CAAC,SAAS;KAAE,CAAC;IAE/B,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAExB,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,yBAAyB,CAAC,EAAE,CAAC,CAAC,CAAC;IACzF,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,cAAc,CAAC,GAAG,CAAC;QAC3B,MAAM;QACN,UAAU,EAAE,eAAe,CAAC;YAC1B,MAAM;YACN,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,SAAS;SAAE,CAAC;QACtB,KAAK;KAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,OAAe,EACf,EAAU,EACV,IAAY;IAEZ,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAChD,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,gCAAgC,CAAC,CAAC,EAAE,CAAC;IACjF,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAE,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QACpE,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;YAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;QACxD,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC;IACnF,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,GAAG;QACX,GAAG,GAAG;QACN,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW;QACpE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,KAAK,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC;KAAE,CAAC;IAClD,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACxB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,GAAG,CAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;AAC5F,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,EAAU;IAEV,MAAM,GAAG,GAAG,iBAAiB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,gCAAgC,CAAC,CAAC,EAAE,CAAC;IAC9E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QACpE,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM;YACN,UAAU,EAAE,eAAe,CAAC;gBAC1B,MAAM;gBACN,QAAQ,EAAE,GAAG,CAAC,KAAK;gBACnB,MAAM,EAAE,SAAS;aAAE,CAAC;YACtB,KAAK,EAAE,CAAC,qCAAqC,CAAC;SAAE,CAAC;IACrD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC;IACnF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,EAAU,EACV,KAEC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAChD,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAE,CAAC;IACzB,KAAK,CAAC,GAAG,CAAC,GAAG;QACX,GAAG,IAAI;QACP,GAAG,KAAK;QACR,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK;QAChC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAAE,CAAC;IACxC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACxB,OAAO,cAAc,CAAC,KAAK,CAAC,GAAG,CAAE,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,OAAe,EACf,EAAU;IAEV,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAChD,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,gCAAgC,CAAC,CAAC,EAAE,CAAC;IACjF,KAAK,CAAC,GAAG,CAAC,GAAG;QACX,GAAG,KAAK,CAAC,GAAG,CAAE;QACd,MAAM,EAAE,SAAyB;QACjC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAAE,CAAC;IACxC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACxB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC"}

package/dist/security/ssh-2fa/types.d.ts

@@ -0,0 +1,33 @@
+/**
+ * SSH login 2FA (TOTP via PAM) — independent of panel operator 2FA.
+ * Honest stages: enrolled → confirmed → file_written → pam_noted
+ */
+export type Ssh2faStatus = 'enrolled' | 'confirmed' | 'file_written' | 'retired' | 'error';
+export type Ssh2faRecord = {
+    id: string;
+    /** Linux login name */
+    linuxUser: string;
+    homeDir: string;
+    projectId?: string;
+    /** AES-GCM blob; never list/get after enroll without reveal */
+    secretEnc: string;
+    /** First time only in API responses when reveal */
+    status: Ssh2faStatus;
+    /** otpauth issuer label */
+    label: string;
+    filePath?: string;
+    writtenAt?: string;
+    confirmedAt?: string;
+    /** If true, secret was copied from panel operator (advanced) */
+    fromPanel?: boolean;
+    notes: string[];
+    createdAt: string;
+    updatedAt: string;
+    createdBy?: string;
+};
+/** Public list/get — no secretEnc */
+export type Ssh2faPublic = Omit<Ssh2faRecord, 'secretEnc'> & {
+    hasSecret: boolean;
+};
+export declare function toPublicSsh2fa(row: Ssh2faRecord): Ssh2faPublic;
+//# sourceMappingURL=types.d.ts.map

package/dist/security/ssh-2fa/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/security/ssh-2fa/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,MAAM,YAAY,GACpB,UAAU,GACV,WAAW,GACX,cAAc,GACd,SAAS,GACT,OAAO,CAAC;AAEZ,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,uBAAuB;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,MAAM,EAAE,YAAY,CAAC;IACrB,2BAA2B;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gEAAgE;IAChE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,qCAAqC;AACrC,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,GAAG;IAC3D,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,wBAAgB,cAAc,CAAC,GAAG,EAAE,YAAY,GAAG,YAAY,CAG9D"}

package/dist/security/ssh-2fa/types.js

@@ -0,0 +1,9 @@
+/**
+ * SSH login 2FA (TOTP via PAM) — independent of panel operator 2FA.
+ * Honest stages: enrolled → confirmed → file_written → pam_noted
+ */
+export function toPublicSsh2fa(row) {
+    const { secretEnc: _d, ...rest } = row;
+    return { ...rest, hasSecret: Boolean(_d) };
+}
+//# sourceMappingURL=types.js.map

package/dist/security/ssh-2fa/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/security/ssh-2fa/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAqCH,MAAM,UAAU,cAAc,CAAC,GAAiB;IAC9C,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;IACvC,OAAO,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;AAC7C,CAAC"}

package/dist/security/ssh-identity/crypto.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Master-key bootstrap + AES-256-GCM for SSH private keys at rest.
+ */
+export declare function secretsSshDir(dataDir: string): string;
+export declare function masterKeyPath(dataDir: string): string;
+/**
+ * Resolve 32-byte master key.
+ * Prefer YSK_SECRETS_KEY (base64 or hex or raw 32-byte string);
+ * else load or create dataDir/secrets/ssh/.master.key.
+ */
+export declare function resolveMasterKey(dataDir: string): {
+    key: Buffer;
+    source: 'env' | 'file' | 'generated';
+    path?: string;
+};
+/**
+ * Encrypt plaintext private key. AAD binds ciphertext to identity id.
+ * Format: base64(iv || authTag || ciphertext)
+ */
+export declare function encryptPrivateKey(masterKey: Buffer, identityId: string, privateKeyPem: string): string;
+export declare function decryptPrivateKey(masterKey: Buffer, identityId: string, privateKeyEnc: string): string;
+/** Constant-time compare for optional checks */
+export declare function safeEqualStr(a: string, b: string): boolean;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/security/ssh-identity/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../../src/security/ssh-identity/crypto.ts"],"names":[],"mappings":"AAAA;;GAEG;AAgBH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,WAAW,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAsCA;AAmBD;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,GACpB,MAAM,CAOR;AAED,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,GACpB,MAAM,CAYR;AAED,gDAAgD;AAChD,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAK1D"}

package/dist/security/ssh-identity/crypto.js

@@ -0,0 +1,109 @@
+/**
+ * Master-key bootstrap + AES-256-GCM for SSH private keys at rest.
+ */
+import { createCipheriv, createDecipheriv, createHash, randomBytes, timingSafeEqual, } from 'node:crypto';
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+const ALGO = 'aes-256-gcm';
+const KEY_LEN = 32;
+const IV_LEN = 12;
+export function secretsSshDir(dataDir) {
+    return join(dataDir, 'secrets', 'ssh');
+}
+export function masterKeyPath(dataDir) {
+    return join(secretsSshDir(dataDir), '.master.key');
+}
+/**
+ * Resolve 32-byte master key.
+ * Prefer YSK_SECRETS_KEY (base64 or hex or raw 32-byte string);
+ * else load or create dataDir/secrets/ssh/.master.key.
+ */
+export function resolveMasterKey(dataDir) {
+    const env = process.env.YSK_SECRETS_KEY?.trim();
+    if (env) {
+        const key = decodeKeyMaterial(env);
+        if (key.length !== KEY_LEN) {
+            throw new Error(`YSK_SECRETS_KEY must decode to ${KEY_LEN} bytes (got ${key.length}); use base64 or 64-char hex`);
+        }
+        return { key, source: 'env' };
+    }
+    const dir = secretsSshDir(dataDir);
+    mkdirSync(dir, { recursive: true });
+    const path = masterKeyPath(dataDir);
+    if (existsSync(path)) {
+        const raw = readFileSync(path);
+        // file may be raw 32 bytes or base64 text
+        let key;
+        if (raw.length === KEY_LEN) {
+            key = raw;
+        }
+        else {
+            key = decodeKeyMaterial(raw.toString('utf8').trim());
+        }
+        if (key.length !== KEY_LEN) {
+            throw new Error(`Invalid master key file ${path}: expected ${KEY_LEN} bytes`);
+        }
+        return { key, source: 'file', path };
+    }
+    const key = randomBytes(KEY_LEN);
+    writeFileSync(path, key, { mode: 0o400 });
+    try {
+        chmodSync(path, 0o400);
+    }
+    catch {
+        /* ignore */
+    }
+    return { key, source: 'generated', path };
+}
+function decodeKeyMaterial(s) {
+    if (/^[0-9a-fA-F]{64}$/.test(s)) {
+        return Buffer.from(s, 'hex');
+    }
+    try {
+        const b = Buffer.from(s, 'base64');
+        if (b.length === KEY_LEN)
+            return b;
+    }
+    catch {
+        /* fall through */
+    }
+    // derive from passphrase-like string (stable, not ideal but usable in dev)
+    if (s.length > 0 && s.length !== KEY_LEN) {
+        return createHash('sha256').update(s).digest();
+    }
+    return Buffer.from(s, 'utf8');
+}
+/**
+ * Encrypt plaintext private key. AAD binds ciphertext to identity id.
+ * Format: base64(iv || authTag || ciphertext)
+ */
+export function encryptPrivateKey(masterKey, identityId, privateKeyPem) {
+    const iv = randomBytes(IV_LEN);
+    const cipher = createCipheriv(ALGO, masterKey, iv);
+    cipher.setAAD(Buffer.from(identityId, 'utf8'));
+    const enc = Buffer.concat([cipher.update(privateKeyPem, 'utf8'), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return Buffer.concat([iv, tag, enc]).toString('base64');
+}
+export function decryptPrivateKey(masterKey, identityId, privateKeyEnc) {
+    const buf = Buffer.from(privateKeyEnc, 'base64');
+    if (buf.length < IV_LEN + 16 + 1) {
+        throw new Error('Invalid privateKeyEnc blob');
+    }
+    const iv = buf.subarray(0, IV_LEN);
+    const tag = buf.subarray(IV_LEN, IV_LEN + 16);
+    const data = buf.subarray(IV_LEN + 16);
+    const decipher = createDecipheriv(ALGO, masterKey, iv);
+    decipher.setAAD(Buffer.from(identityId, 'utf8'));
+    decipher.setAuthTag(tag);
+    return Buffer.concat([decipher.update(data), decipher.final()]).toString('utf8');
+}
+/** Constant-time compare for optional checks */
+export function safeEqualStr(a, b) {
+    const ba = Buffer.from(a);
+    const bb = Buffer.from(b);
+    if (ba.length !== bb.length)
+        return false;
+    return timingSafeEqual(ba, bb);
+}
+//# sourceMappingURL=crypto.js.map

package/dist/security/ssh-identity/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../../src/security/ssh-identity/crypto.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,WAAW,EACX,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,IAAI,GAAG,aAAa,CAAC;AAC3B,MAAM,OAAO,GAAG,EAAE,CAAC;AACnB,MAAM,MAAM,GAAG,EAAE,CAAC;AAElB,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,OAAO,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAK9C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IAChD,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,kCAAkC,OAAO,eAAe,GAAG,CAAC,MAAM,8BAA8B,CACjG,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACnC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAC/B,0CAA0C;QAC1C,IAAI,GAAW,CAAC;QAChB,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAC3B,GAAG,GAAG,GAAG,CAAC;QACZ,CAAC;aAAM,CAAC;YACN,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,cAAc,OAAO,QAAQ,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACjC,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAS;IAClC,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO;YAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,kBAAkB;IACpB,CAAC;IACD,2EAA2E;IAC3E,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QACzC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACjD,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAAiB,EACjB,UAAkB,EAClB,aAAqB;IAErB,MAAM,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAClF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,SAAiB,EACjB,UAAkB,EAClB,aAAqB;IAErB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IACjD,IAAI,GAAG,CAAC,MAAM,GAAG,MAAM,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,EAAE,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IACvD,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACnF,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,YAAY,CAAC,CAAS,EAAE,CAAS;IAC/C,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC"}

package/dist/security/ssh-identity/generate.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Generate / parse OpenSSH key material via ssh-keygen (Linux control plane).
+ */
+import type { SshIdentityAlgorithm } from './types.js';
+export type GeneratedKeyPair = {
+    algorithm: SshIdentityAlgorithm;
+    privateKey: string;
+    publicKey: string;
+    fingerprintSha256: string;
+};
+export declare function fingerprintFromPublicKey(publicKey: string): string;
+export declare function publicKeyFromPrivate(privateKey: string): string;
+export declare function generateSshKeyPair(input: {
+    algorithm?: SshIdentityAlgorithm;
+    comment?: string;
+}): GeneratedKeyPair;
+export declare function parseImportedPrivateKey(privateKeyRaw: string): GeneratedKeyPair;
+//# sourceMappingURL=generate.d.ts.map

package/dist/security/ssh-identity/generate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../../src/security/ssh-identity/generate.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,oBAAoB,CAAC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;CAC3B,CAAC;AAqBF,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CASlE;AAED,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAwB/D;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,SAAS,CAAC,EAAE,oBAAoB,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,gBAAgB,CA2BnB;AAED,wBAAgB,uBAAuB,CAAC,aAAa,EAAE,MAAM,GAAG,gBAAgB,CAc/E"}

package/dist/security/ssh-identity/generate.js

@@ -0,0 +1,102 @@
+/**
+ * Generate / parse OpenSSH key material via ssh-keygen (Linux control plane).
+ */
+import { mkdtempSync, readFileSync, rmSync, writeFileSync, chmodSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { spawnSync } from 'node:child_process';
+function runSshKeygen(args, opts) {
+    const r = spawnSync('ssh-keygen', args, {
+        encoding: 'utf8',
+        input: opts?.input,
+        timeout: 30_000,
+    });
+    return {
+        ok: r.status === 0,
+        stdout: r.stdout ?? '',
+        stderr: r.stderr ?? '',
+        status: r.status,
+    };
+}
+export function fingerprintFromPublicKey(publicKey) {
+    const r = runSshKeygen(['-lf', '-', '-E', 'sha256'], { input: publicKey.trim() + '\n' });
+    if (!r.ok) {
+        throw new Error(`ssh-keygen -lf failed: ${(r.stderr || r.stdout).slice(0, 200)}`);
+    }
+    // e.g. "256 SHA256:xxxx comment (ED25519)"
+    const m = r.stdout.trim().match(/SHA256:[A-Za-z0-9+/=]+/);
+    if (!m)
+        throw new Error(`Cannot parse fingerprint from: ${r.stdout.slice(0, 120)}`);
+    return m[0];
+}
+export function publicKeyFromPrivate(privateKey) {
+    const dir = mkdtempSync(join(tmpdir(), 'ysk-ssh-'));
+    const keyPath = join(dir, 'id');
+    try {
+        writeFileSync(keyPath, privateKey.endsWith('\n') ? privateKey : privateKey + '\n', {
+            mode: 0o600,
+        });
+        try {
+            chmodSync(keyPath, 0o600);
+        }
+        catch {
+            /* ignore */
+        }
+        const r = runSshKeygen(['-y', '-f', keyPath]);
+        if (!r.ok) {
+            throw new Error(`ssh-keygen -y failed: ${(r.stderr || r.stdout).slice(0, 200)}`);
+        }
+        return r.stdout.trim();
+    }
+    finally {
+        try {
+            rmSync(dir, { recursive: true, force: true });
+        }
+        catch {
+            /* ignore */
+        }
+    }
+}
+export function generateSshKeyPair(input) {
+    const algorithm = input.algorithm ?? 'ed25519';
+    const dir = mkdtempSync(join(tmpdir(), 'ysk-ssh-gen-'));
+    const keyPath = join(dir, 'id');
+    try {
+        const args = algorithm === 'rsa-4096'
+            ? ['-t', 'rsa', '-b', '4096', '-f', keyPath, '-N', '', '-q']
+            : ['-t', 'ed25519', '-f', keyPath, '-N', '', '-q'];
+        if (input.comment) {
+            args.push('-C', input.comment);
+        }
+        const r = runSshKeygen(args);
+        if (!r.ok) {
+            throw new Error(`ssh-keygen generate failed: ${(r.stderr || r.stdout).slice(0, 200)}`);
+        }
+        const privateKey = readFileSync(keyPath, 'utf8');
+        const publicKey = readFileSync(`${keyPath}.pub`, 'utf8').trim();
+        const fingerprintSha256 = fingerprintFromPublicKey(publicKey);
+        return { algorithm, privateKey, publicKey, fingerprintSha256 };
+    }
+    finally {
+        try {
+            rmSync(dir, { recursive: true, force: true });
+        }
+        catch {
+            /* ignore */
+        }
+    }
+}
+export function parseImportedPrivateKey(privateKeyRaw) {
+    const privateKey = privateKeyRaw.trim() + (privateKeyRaw.endsWith('\n') ? '' : '\n');
+    if (!privateKey.includes('PRIVATE KEY') &&
+        !privateKey.includes('OPENSSH PRIVATE KEY')) {
+        throw new Error('Expected OpenSSH/PEM private key (BEGIN … PRIVATE KEY)');
+    }
+    const publicKey = publicKeyFromPrivate(privateKey);
+    const fingerprintSha256 = fingerprintFromPublicKey(publicKey);
+    const algorithm = publicKey.startsWith('ssh-rsa')
+        ? 'rsa-4096'
+        : 'ed25519';
+    return { algorithm, privateKey, publicKey, fingerprintSha256 };
+}
+//# sourceMappingURL=generate.js.map

package/dist/security/ssh-identity/generate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate.js","sourceRoot":"","sources":["../../../src/security/ssh-identity/generate.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACtF,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAU/C,SAAS,YAAY,CAAC,IAAc,EAAE,IAAyB;IAM7D,MAAM,CAAC,GAAG,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE;QACtC,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,IAAI,EAAE,KAAK;QAClB,OAAO,EAAE,MAAM;KAChB,CAAC,CAAC;IACH,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC;QAClB,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE;QACtB,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE;QACtB,MAAM,EAAE,CAAC,CAAC,MAAM;KACjB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,SAAiB;IACxD,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IACzF,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,2CAA2C;IAC3C,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC1D,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACpF,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AACd,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,UAAkB;IACrD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC;QACH,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,GAAG,IAAI,EAAE;YACjF,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,IAAI,CAAC;YACH,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;QACD,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAGlC;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,SAAS,CAAC;IAC/C,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,IAAI,GACR,SAAS,KAAK,UAAU;YACtB,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC;YAC5D,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QACvD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QACD,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,OAAO,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAChE,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;QAC9D,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;IACjE,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,aAAqB;IAC3D,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACrF,IACE,CAAC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC;QACnC,CAAC,UAAU,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAC3C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,SAAS,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACnD,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAyB,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC;QACrE,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,SAAS,CAAC;IACd,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;AACjE,CAAC"}

package/dist/security/ssh-identity/index.d.ts

@@ -0,0 +1,7 @@
+export * from './types.js';
+export * from './crypto.js';
+export * from './generate.js';
+export * from './store.js';
+export * from './install.js';
+export * from './ops.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/security/ssh-identity/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/security/ssh-identity/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,UAAU,CAAC"}

package/dist/security/ssh-identity/index.js

@@ -0,0 +1,7 @@
+export * from './types.js';
+export * from './crypto.js';
+export * from './generate.js';
+export * from './store.js';
+export * from './install.js';
+export * from './ops.js';
+//# sourceMappingURL=index.js.map

package/dist/security/ssh-identity/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/security/ssh-identity/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,UAAU,CAAC"}

package/dist/security/ssh-identity/install.d.ts

@@ -0,0 +1,37 @@
+import type { HostExecutor } from '../../host/executor.js';
+import { type SshIdentityPublic } from './types.js';
+export type InstallSshIdentityResult = {
+    ok: boolean;
+    dryRun: boolean;
+    applied: boolean;
+    blocked: boolean;
+    requiresRoot: boolean;
+    requiresExecute: boolean;
+    plannedPath?: string;
+    plannedPublicPath?: string;
+    identity?: SshIdentityPublic;
+    notes: string[];
+};
+export declare function installSshIdentity(input: {
+    dataDir: string;
+    id: string;
+    apply?: boolean;
+    host?: HostExecutor;
+    isRoot?: boolean;
+    executeEnabled?: boolean;
+}): Promise<InstallSshIdentityResult>;
+export declare function uninstallSshIdentity(input: {
+    dataDir: string;
+    id: string;
+    apply?: boolean;
+    purgeFiles?: boolean;
+}): Promise<InstallSshIdentityResult>;
+/** Materialize private key to panel path for -i use (idempotent install for panel purpose). */
+export declare function materializeIdentityKeyFile(dataDir: string, id: string): {
+    ok: boolean;
+    path?: string;
+    notes: string[];
+};
+/** ssh/scp argv fragment: -i path -o IdentitiesOnly=yes -o BatchMode=yes */
+export declare function buildSshIdentityArgs(privateKeyPath: string): string[];
+//# sourceMappingURL=install.d.ts.map

package/dist/security/ssh-identity/install.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../../../src/security/ssh-identity/install.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAO3D,OAAO,EAAoB,KAAK,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEtE,MAAM,MAAM,wBAAwB,GAAG;IACrC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,EAAE,OAAO,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC;AAqBF,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAyIpC;AAED,wBAAsB,oBAAoB,CAAC,KAAK,EAAE;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CA4EpC;AAED,+FAA+F;AAC/F,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,MAAM,GACT;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAsBjD;AAED,4EAA4E;AAC5E,wBAAgB,oBAAoB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAWrE"}