ysk-server-core 1.0.0

package/dist/security/ssh-identity/store.d.ts

@@ -0,0 +1,51 @@
+import type { JsonStore } from '../../db/store.js';
+import type { SshIdentity, SshIdentityAlgorithm, SshIdentityBinding, SshIdentityPublic, SshIdentityPurpose } from './types.js';
+export type ListSshIdentitiesFilter = {
+    projectId?: string;
+    linuxUser?: string;
+    purpose?: SshIdentityPurpose;
+};
+export declare function listSshIdentities(dataDir: string, filter?: ListSshIdentitiesFilter): SshIdentityPublic[];
+export declare function getSshIdentity(dataDir: string, id: string): SshIdentityPublic | null;
+export declare function getSshIdentityInternal(dataDir: string, id: string): SshIdentity | null;
+export type CreateSshIdentityInput = {
+    name: string;
+    comment?: string;
+    algorithm?: SshIdentityAlgorithm;
+    purpose?: SshIdentityPurpose;
+    binding?: SshIdentityBinding;
+    createdBy?: string;
+    /** If true, include plaintext privateKey once in result */
+    revealPrivate?: boolean;
+};
+export type CreateSshIdentityResult = {
+    ok: boolean;
+    identity?: SshIdentityPublic;
+    /** One-time only when revealPrivate */
+    privateKey?: string;
+    masterKeySource?: string;
+    notes: string[];
+};
+export declare function createSshIdentity(dataDir: string, input: CreateSshIdentityInput, db?: JsonStore): CreateSshIdentityResult;
+export type ImportSshIdentityInput = {
+    name: string;
+    privateKey: string;
+    comment?: string;
+    purpose?: SshIdentityPurpose;
+    binding?: SshIdentityBinding;
+    createdBy?: string;
+    revealPrivate?: boolean;
+};
+export declare function importSshIdentity(dataDir: string, input: ImportSshIdentityInput, db?: JsonStore): CreateSshIdentityResult;
+export declare function exportSshIdentityPrivate(dataDir: string, id: string): {
+    ok: boolean;
+    privateKey?: string;
+    fingerprintSha256?: string;
+    notes: string[];
+};
+export declare function deleteSshIdentity(dataDir: string, id: string): {
+    ok: boolean;
+    notes: string[];
+};
+export declare function updateSshIdentityRecord(dataDir: string, id: string, patch: Partial<Pick<SshIdentity, 'name' | 'comment' | 'purpose' | 'binding' | 'install' | 'status' | 'lastVerifiedAt' | 'lastVerifyNote'>>): SshIdentityPublic | null;
+//# sourceMappingURL=store.d.ts.map

package/dist/security/ssh-identity/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/security/ssh-identity/store.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAOnD,OAAO,KAAK,EACV,WAAW,EACX,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAAE,MAAM,YAAY,CAAC;AA8BzC,MAAM,MAAM,uBAAuB,GAAG;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,kBAAkB,CAAC;CAC9B,CAAC;AAEF,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,uBAAuB,GAC/B,iBAAiB,EAAE,CAYrB;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAGpF;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAEtF;AAoBD,MAAM,MAAM,sBAAsB,GAAG;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,oBAAoB,CAAC;IACjC,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2DAA2D;IAC3D,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,uCAAuC;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC;AAEF,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,sBAAsB,EAC7B,EAAE,CAAC,EAAE,SAAS,GACb,uBAAuB,CAqDzB;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,sBAAsB,EAC7B,EAAE,CAAC,EAAE,SAAS,GACb,uBAAuB,CA6DzB;AAED,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,MAAM,GACT;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAgBnF;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,MAAM,GACT;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAUlC;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,OAAO,CACZ,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,gBAAgB,GAAG,gBAAgB,CAAC,CAC3H,GACA,iBAAiB,GAAG,IAAI,CAW1B"}

package/dist/security/ssh-identity/store.js

@@ -0,0 +1,240 @@
+import { tl } from 'ysk-server-shared';
+/**
+ * SSH identity vault store under dataDir/secrets/ssh/identities.json
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from 'node:fs';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { decryptPrivateKey, encryptPrivateKey, resolveMasterKey, secretsSshDir } from './crypto.js';
+import { generateSshKeyPair, parseImportedPrivateKey } from './generate.js';
+import { toPublicIdentity } from './types.js';
+function identitiesPath(dataDir) {
+    return join(secretsSshDir(dataDir), 'identities.json');
+}
+function loadAll(dataDir) {
+    const path = identitiesPath(dataDir);
+    if (!existsSync(path))
+        return [];
+    try {
+        const raw = JSON.parse(readFileSync(path, 'utf8'));
+        return Array.isArray(raw.items) ? raw.items : [];
+    }
+    catch {
+        return [];
+    }
+}
+function saveAll(dataDir, items) {
+    const dir = secretsSshDir(dataDir);
+    mkdirSync(dir, { recursive: true });
+    const path = identitiesPath(dataDir);
+    writeFileSync(path, JSON.stringify({ items }, null, 2), { mode: 0o600 });
+    try {
+        chmodSync(path, 0o600);
+    }
+    catch {
+        /* ignore */
+    }
+}
+export function listSshIdentities(dataDir, filter) {
+    let items = loadAll(dataDir);
+    if (filter?.projectId) {
+        items = items.filter((i) => i.binding?.projectId === filter.projectId);
+    }
+    if (filter?.linuxUser) {
+        items = items.filter((i) => i.binding?.linuxUser === filter.linuxUser);
+    }
+    if (filter?.purpose) {
+        items = items.filter((i) => i.purpose === filter.purpose);
+    }
+    return items.map(toPublicIdentity);
+}
+export function getSshIdentity(dataDir, id) {
+    const row = loadAll(dataDir).find((i) => i.id === id);
+    return row ? toPublicIdentity(row) : null;
+}
+export function getSshIdentityInternal(dataDir, id) {
+    return loadAll(dataDir).find((i) => i.id === id) ?? null;
+}
+function resolveBinding(db, binding) {
+    if (!binding)
+        return undefined;
+    let projectId = binding.projectId?.trim() || undefined;
+    let linuxUser = binding.linuxUser?.trim() || undefined;
+    let homeDir = binding.homeDir?.trim() || undefined;
+    if (projectId && db) {
+        const p = db.snapshot.projects.find((x) => x.id === projectId);
+        if (p) {
+            linuxUser = linuxUser || p.linux_user;
+            homeDir = homeDir || p.home_dir;
+        }
+    }
+    return { projectId, linuxUser, homeDir };
+}
+export function createSshIdentity(dataDir, input, db) {
+    const name = input.name.trim();
+    if (!name) {
+        return { ok: false, notes: [tl('notes.auto.n0029')] };
+    }
+    const notes = [];
+    let master;
+    try {
+        master = resolveMasterKey(dataDir);
+    }
+    catch (e) {
+        return {
+            ok: false,
+            notes: [e instanceof Error ? e.message : 'master key unavailable']
+        };
+    }
+    if (master.source === 'generated') {
+        notes.push(tl('notes.auto.t0520', { v0: (master.path ?? 'secrets/ssh/.master.key') }));
+    }
+    else if (master.source === 'env') {
+        notes.push(tl('notes.auto.n0538'));
+    }
+    const pair = generateSshKeyPair({
+        algorithm: input.algorithm,
+        comment: input.comment ?? name
+    });
+    const id = randomUUID();
+    const now = new Date().toISOString();
+    const purpose = input.purpose ?? 'unbound';
+    const binding = resolveBinding(db, input.binding);
+    const row = {
+        id,
+        name,
+        comment: input.comment,
+        algorithm: pair.algorithm,
+        fingerprintSha256: pair.fingerprintSha256,
+        publicKey: pair.publicKey,
+        privateKeyEnc: encryptPrivateKey(master.key, id, pair.privateKey),
+        purpose,
+        binding,
+        status: 'stored',
+        createdAt: now,
+        updatedAt: now,
+        createdBy: input.createdBy
+    };
+    const items = loadAll(dataDir);
+    items.unshift(row);
+    saveAll(dataDir, items);
+    return {
+        ok: true,
+        identity: toPublicIdentity(row),
+        privateKey: input.revealPrivate ? pair.privateKey : undefined,
+        masterKeySource: master.source,
+        notes
+    };
+}
+export function importSshIdentity(dataDir, input, db) {
+    const name = input.name.trim();
+    if (!name)
+        return { ok: false, notes: [tl('notes.auto.n0029')] };
+    if (!input.privateKey?.trim())
+        return { ok: false, notes: [tl('notes.auto.n1568')] };
+    const notes = [];
+    let master;
+    try {
+        master = resolveMasterKey(dataDir);
+    }
+    catch (e) {
+        return {
+            ok: false,
+            notes: [e instanceof Error ? e.message : 'master key unavailable']
+        };
+    }
+    if (master.source === 'generated') {
+        notes.push(tl('notes.auto.t0521', { v0: (master.path ?? 'secrets/ssh/.master.key') }));
+    }
+    let pair;
+    try {
+        pair = parseImportedPrivateKey(input.privateKey);
+    }
+    catch (e) {
+        return { ok: false, notes: [e instanceof Error ? e.message : 'import failed'] };
+    }
+    // Dedup by fingerprint
+    const existing = loadAll(dataDir).find((i) => i.fingerprintSha256 === pair.fingerprintSha256);
+    if (existing) {
+        return {
+            ok: false,
+            notes: [tl('notes.auto.t0522', { v0: (existing.id), v1: (existing.name) })],
+            identity: toPublicIdentity(existing)
+        };
+    }
+    const id = randomUUID();
+    const now = new Date().toISOString();
+    const row = {
+        id,
+        name,
+        comment: input.comment,
+        algorithm: pair.algorithm,
+        fingerprintSha256: pair.fingerprintSha256,
+        publicKey: pair.publicKey,
+        privateKeyEnc: encryptPrivateKey(master.key, id, pair.privateKey),
+        purpose: input.purpose ?? 'unbound',
+        binding: resolveBinding(db, input.binding),
+        status: 'stored',
+        createdAt: now,
+        updatedAt: now,
+        createdBy: input.createdBy
+    };
+    const items = loadAll(dataDir);
+    items.unshift(row);
+    saveAll(dataDir, items);
+    return {
+        ok: true,
+        identity: toPublicIdentity(row),
+        privateKey: input.revealPrivate ? pair.privateKey : undefined,
+        masterKeySource: master.source,
+        notes
+    };
+}
+export function exportSshIdentityPrivate(dataDir, id) {
+    const row = getSshIdentityInternal(dataDir, id);
+    if (!row)
+        return { ok: false, notes: [tl('notes.ssh.identityNotFound')] };
+    try {
+        const master = resolveMasterKey(dataDir);
+        const privateKey = decryptPrivateKey(master.key, row.id, row.privateKeyEnc);
+        return {
+            ok: true,
+            privateKey,
+            fingerprintSha256: row.fingerprintSha256,
+            notes: ['private key exported — treat as secret; audit recommended']
+        };
+    }
+    catch (e) {
+        return {
+            ok: false,
+            notes: [e instanceof Error ? e.message : 'decrypt failed']
+        };
+    }
+}
+export function deleteSshIdentity(dataDir, id) {
+    const items = loadAll(dataDir);
+    const next = items.filter((i) => i.id !== id);
+    if (next.length === items.length) {
+        return { ok: false, notes: [tl('notes.ssh.identityNotFound')] };
+    }
+    saveAll(dataDir, next);
+    return {
+        ok: true,
+        notes: [tl('notes.auto.n0775')]
+    };
+}
+export function updateSshIdentityRecord(dataDir, id, patch) {
+    const items = loadAll(dataDir);
+    const idx = items.findIndex((i) => i.id === id);
+    if (idx < 0)
+        return null;
+    const prev = items[idx];
+    items[idx] = {
+        ...prev,
+        ...patch,
+        updatedAt: new Date().toISOString()
+    };
+    saveAll(dataDir, items);
+    return toPublicIdentity(items[idx]);
+}
+//# sourceMappingURL=store.js.map

package/dist/security/ssh-identity/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/security/ssh-identity/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAO5E,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,SAAS,cAAc,CAAC,OAAe;IACrC,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,iBAAiB,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,OAAO,CAAC,OAAe;IAC9B,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA8B,CAAC;QAChF,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,OAAe,EAAE,KAAoB;IACpD,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACnC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACrC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;AACH,CAAC;AAQD,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,MAAgC;IAEhC,IAAI,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,MAAM,EAAE,SAAS,EAAE,CAAC;QACtB,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,KAAK,MAAM,CAAC,SAAS,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,MAAM,EAAE,SAAS,EAAE,CAAC;QACtB,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,KAAK,MAAM,CAAC,SAAS,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;QACpB,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,EAAU;IACxD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,OAAO,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,EAAU;IAChE,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,CAAC;AAC3D,CAAC;AAED,SAAS,cAAc,CACrB,EAAyB,EACzB,OAA4B;IAE5B,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,SAAS,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACvD,IAAI,SAAS,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACvD,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACnD,IAAI,SAAS,IAAI,EAAE,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;QAC/D,IAAI,CAAC,EAAE,CAAC;YACN,SAAS,GAAG,SAAS,IAAI,CAAC,CAAC,UAAU,CAAC;YACtC,OAAO,GAAG,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAC3C,CAAC;AAsBD,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,KAA6B,EAC7B,EAAc;IAEd,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;IACxD,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC;SAAE,CAAC;IACzE,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,yBAAyB,CAAC,EAAE,CAAC,CAAC,CAAC;IACzF,CAAC;SAAM,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,IAAI,GAAG,kBAAkB,CAAC;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;KAAE,CAAC,CAAC;IACpC,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,SAAS,CAAC;IAC3C,MAAM,OAAO,GAAG,cAAc,CAAC,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAElD,MAAM,GAAG,GAAgB;QACvB,EAAE;QACF,IAAI;QACJ,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,aAAa,EAAE,iBAAiB,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC;QACjE,OAAO;QACP,OAAO;QACP,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,KAAK,CAAC,SAAS;KAAE,CAAC;IAE/B,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAExB,OAAO;QACL,EAAE,EAAE,IAAI;QACR,QAAQ,EAAE,gBAAgB,CAAC,GAAG,CAAC;QAC/B,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;QAC7D,eAAe,EAAE,MAAM,CAAC,MAAM;QAC9B,KAAK;KAAE,CAAC;AACZ,CAAC;AAYD,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,KAA6B,EAC7B,EAAc;IAEd,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;IACjE,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;IAErF,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC;SAAE,CAAC;IACzE,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,yBAAyB,CAAC,EAAE,CAAC,CAAC,CAAC;IACzF,CAAC;IAED,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QACH,IAAI,GAAG,uBAAuB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC;IAClF,CAAC;IAED,uBAAuB;IACvB,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB,KAAK,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC9F,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3E,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,CAAC;SAAE,CAAC;IAC3C,CAAC;IAED,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,GAAG,GAAgB;QACvB,EAAE;QACF,IAAI;QACJ,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,aAAa,EAAE,iBAAiB,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC;QACjE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,SAAS;QACnC,OAAO,EAAE,cAAc,CAAC,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC;QAC1C,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,KAAK,CAAC,SAAS;KAAE,CAAC;IAE/B,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAExB,OAAO;QACL,EAAE,EAAE,IAAI;QACR,QAAQ,EAAE,gBAAgB,CAAC,GAAG,CAAC;QAC/B,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;QAC7D,eAAe,EAAE,MAAM,CAAC,MAAM;QAC9B,KAAK;KAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,OAAe,EACf,EAAU;IAEV,MAAM,GAAG,GAAG,sBAAsB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,4BAA4B,CAAC,CAAC,EAAE,CAAC;IAC1E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;QAC5E,OAAO;YACL,EAAE,EAAE,IAAI;YACR,UAAU;YACV,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,KAAK,EAAE,CAAC,2DAA2D,CAAC;SAAE,CAAC;IAC3E,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC;SAAE,CAAC;IACjE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,EAAU;IAEV,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9C,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,4BAA4B,CAAC,CAAC,EAAE,CAAC;IAClE,CAAC;IACD,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACvB,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;KAAE,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAe,EACf,EAAU,EACV,KAEC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAChD,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAE,CAAC;IACzB,KAAK,CAAC,GAAG,CAAC,GAAG;QACX,GAAG,IAAI;QACP,GAAG,KAAK;QACR,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAAE,CAAC;IACxC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACxB,OAAO,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAE,CAAC,CAAC;AACvC,CAAC"}

package/dist/security/ssh-identity/types.d.ts

@@ -0,0 +1,43 @@
+/**
+ * SSH identity vault — encrypted private keys for Linux user / panel outbound use.
+ * Distinct from inbound authorized_keys (sftp-keys).
+ */
+export type SshIdentityAlgorithm = 'ed25519' | 'rsa-4096';
+export type SshIdentityPurpose = 'user_outbound' | 'panel_outbound' | 'unbound';
+export type SshIdentityStatus = 'stored' | 'installed' | 'verified' | 'missing_on_disk' | 'retired' | 'error';
+export type SshIdentityBinding = {
+    projectId?: string;
+    linuxUser?: string;
+    homeDir?: string;
+};
+export type SshIdentityInstall = {
+    /** Absolute path of private key on disk when installed */
+    path?: string;
+    publicPath?: string;
+    installedAt?: string;
+    mode?: string;
+};
+/** Stored record (private always encrypted). */
+export type SshIdentity = {
+    id: string;
+    name: string;
+    comment?: string;
+    algorithm: SshIdentityAlgorithm;
+    fingerprintSha256: string;
+    publicKey: string;
+    /** AES-256-GCM ciphertext (base64); never return to UI list/get */
+    privateKeyEnc: string;
+    purpose: SshIdentityPurpose;
+    binding?: SshIdentityBinding;
+    install?: SshIdentityInstall;
+    status: SshIdentityStatus;
+    lastVerifiedAt?: string;
+    lastVerifyNote?: string;
+    createdAt: string;
+    updatedAt: string;
+    createdBy?: string;
+};
+/** API / CLI list view — no private material */
+export type SshIdentityPublic = Omit<SshIdentity, 'privateKeyEnc'>;
+export declare function toPublicIdentity(row: SshIdentity): SshIdentityPublic;
+//# sourceMappingURL=types.d.ts.map

package/dist/security/ssh-identity/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/security/ssh-identity/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,UAAU,CAAC;AAE1D,MAAM,MAAM,kBAAkB,GAAG,eAAe,GAAG,gBAAgB,GAAG,SAAS,CAAC;AAEhF,MAAM,MAAM,iBAAiB,GACzB,QAAQ,GACR,WAAW,GACX,UAAU,GACV,iBAAiB,GACjB,SAAS,GACT,OAAO,CAAC;AAEZ,MAAM,MAAM,kBAAkB,GAAG;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,0DAA0D;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,gDAAgD;AAChD,MAAM,MAAM,WAAW,GAAG;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,oBAAoB,CAAC;IAChC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,kBAAkB,CAAC;IAC5B,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,MAAM,EAAE,iBAAiB,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,gDAAgD;AAChD,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;AAEnE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,WAAW,GAAG,iBAAiB,CAGpE"}

package/dist/security/ssh-identity/types.js

@@ -0,0 +1,9 @@
+/**
+ * SSH identity vault — encrypted private keys for Linux user / panel outbound use.
+ * Distinct from inbound authorized_keys (sftp-keys).
+ */
+export function toPublicIdentity(row) {
+    const { privateKeyEnc: _drop, ...pub } = row;
+    return pub;
+}
+//# sourceMappingURL=types.js.map

package/dist/security/ssh-identity/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/security/ssh-identity/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAoDH,MAAM,UAAU,gBAAgB,CAAC,GAAgB;IAC/C,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,GAAG,EAAE,GAAG,GAAG,CAAC;IAC7C,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/security/tool-executor.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Secure tool execution: Protection → Allowlist → RBAC → Approval → HostExecutor.
+ * Never returns fake executed:true without real host work for mutating tools.
+ */
+import type { ResourceScope, SystemRole, ToolCallRequest, ToolCallResult } from 'ysk-server-shared';
+import type { Allowlist } from './allowlist.js';
+import type { ApprovalQueue } from './approval.js';
+import type { ProtectionState } from '../services/protection.js';
+import { type HostExecutor } from '../host/executor.js';
+import type { AuditRepository } from '../repositories/audit-repo.js';
+export interface ToolExecutorOptions {
+    allowlist: Allowlist;
+    approvals: ApprovalQueue;
+    actor: string;
+    roles?: SystemRole[];
+    scope?: ResourceScope;
+    protection?: ProtectionState;
+    host: HostExecutor;
+    audit?: AuditRepository;
+    /** dataDir is always an allowed FS root for tools */
+    dataDir?: string;
+    /**
+     * Additional absolute roots for fs.read/list/write/delete.
+     * Fail-closed: if neither dataDir nor fsRoots is set, fs.* tools refuse.
+     */
+    fsRoots?: string[];
+}
+/**
+ * Evaluate and execute a tool call against the real host when permitted.
+ */
+export declare function executeToolCall(req: ToolCallRequest, opts: ToolExecutorOptions, approvalId?: string): Promise<ToolCallResult>;
+/** Resolve allowed roots for tool filesystem ops (fail-closed when empty). */
+export declare function toolFsRoots(opts: Pick<ToolExecutorOptions, 'dataDir' | 'fsRoots'>): string[];
+/**
+ * Ensure tool path is inside at least one allowed root (boundary-safe).
+ * Returns resolved absolute path.
+ */
+export declare function assertToolFsPath(rawPath: string, roots: string[]): string;
+//# sourceMappingURL=tool-executor.d.ts.map

package/dist/security/tool-executor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-executor.d.ts","sourceRoot":"","sources":["../../src/security/tool-executor.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAEV,aAAa,EACb,UAAU,EACV,eAAe,EACf,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAG5C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAGnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAiB,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAWrE,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,SAAS,CAAC;IACrB,SAAS,EAAE,aAAa,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;IACrB,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,IAAI,EAAE,YAAY,CAAC;IACnB,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;GAEG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,mBAAmB,EACzB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,cAAc,CAAC,CA0GzB;AAED,8EAA8E;AAC9E,wBAAgB,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,mBAAmB,EAAE,SAAS,GAAG,SAAS,CAAC,GAAG,MAAM,EAAE,CAQ5F;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EAAE,GACd,MAAM,CA4BR"}