ysk-server-core 1.0.0

package/dist/services/rbac-policy.js

@@ -0,0 +1,260 @@
+/**
+ * Role policy store: factory defaults, custom policies, one-click restore.
+ * Per-user grants/revokes live on StoreUser; this service owns role-level policy.
+ */
+import { ErrorCodes, YskError, computeEffectiveCapabilities, factoryRolePolicy, factoryRolePolicies, hasCapability, isCapabilityId, normalizeRolePolicy, resolveRolePolicy, SYSTEM_ROLES, tl, } from 'ysk-server-shared';
+export class RbacPolicyService {
+    db;
+    audit;
+    constructor(db, audit) {
+        this.db = db;
+        this.audit = audit;
+    }
+    /** All role policies currently in effect (+ dirty flags) */
+    listPolicies() {
+        return SYSTEM_ROLES.map((role) => {
+            const factory = factoryRolePolicy(role);
+            const stored = this.getStored(role);
+            const { policy, dirty } = resolveRolePolicy(role, stored);
+            return {
+                role,
+                policy,
+                dirty,
+                factory,
+            };
+        });
+    }
+    getEffectivePolicy(role) {
+        const stored = this.getStored(role);
+        return resolveRolePolicy(role, stored).policy;
+    }
+    /** Map for computeEffectiveCapabilities — only dirty customs override factory */
+    rolePolicyMap() {
+        const out = {};
+        for (const role of SYSTEM_ROLES) {
+            const stored = this.getStored(role);
+            const { policy, dirty } = resolveRolePolicy(role, stored);
+            if (dirty)
+                out[role] = policy;
+        }
+        return out;
+    }
+    effectiveForUser(user) {
+        return computeEffectiveCapabilities({
+            roles: user.roles,
+            rolePolicies: this.rolePolicyMap(),
+            grants: user.capability_grants,
+            revokes: user.capability_revokes,
+        });
+    }
+    actorCan(user, cap) {
+        return hasCapability(this.effectiveForUser(user), cap);
+    }
+    requireCapability(user, cap) {
+        if (!this.actorCan(user, cap)) {
+            throw new YskError(ErrorCodes.FORBIDDEN, tl('notes.needAdmin'), {
+                httpStatus: 403,
+                details: { capability: cap },
+            });
+        }
+    }
+    /**
+     * Ensure at least one non-suspended user has full admin factory caps.
+     * Call on boot and after policy mutations. Safe no-op when already healthy.
+     */
+    ensureFullPrivilegeHolder() {
+        const holders = this.db.snapshot.users.filter((u) => !u.suspended && this.actorCan(u, 'users.manage') && this.actorCan(u, 'rbac.policy'));
+        if (holders.length > 0) {
+            return { ok: true, repaired: false, username: holders[0]?.username };
+        }
+        // Repair: clear restrictive admin role policy + pick an admin user (or first user)
+        if (this.db.snapshot.rbac_policies?.admin) {
+            delete this.db.snapshot.rbac_policies.admin;
+        }
+        let target = this.db.snapshot.users.find((u) => !u.suspended && u.roles.includes('admin')) ??
+            this.db.snapshot.users.find((u) => !u.suspended) ??
+            this.db.snapshot.users[0];
+        if (!target) {
+            return { ok: false, repaired: false };
+        }
+        if (!target.roles.includes('admin')) {
+            target.roles = ['admin', ...target.roles.filter((r) => r !== 'admin')];
+        }
+        // Clear revokes that could strip privilege (admin ignore revokes anyway)
+        delete target.capability_revokes;
+        // Ensure no empty grants weirdness
+        target.updated_at = new Date().toISOString();
+        this.db.persist();
+        this.audit?.append({
+            actor: 'system',
+            action: 'rbac.ensure_full_privilege',
+            resource: target.username,
+            detail: { userId: target.id, repaired: true },
+            ok: true,
+        });
+        return { ok: true, repaired: true, username: target.username };
+    }
+    setRolePolicy(role, input, actor) {
+        this.requireCapability(actor, 'rbac.policy');
+        if (!SYSTEM_ROLES.includes(role)) {
+            throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n1027'), { httpStatus: 400 });
+        }
+        // Admin system role is always full-open — refuse reductions; only restore/full factory allowed
+        if (role === 'admin') {
+            throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n0500'), {
+                httpStatus: 400,
+                details: {
+                    reason: 'admin_role_always_full',
+                    message: 'Admin role is locked to full factory capabilities; use restore or edit other roles.',
+                },
+            });
+        }
+        const next = normalizeRolePolicy(input);
+        const previewMap = { ...this.rolePolicyMap(), [role]: next };
+        this.assertNotLastPrivilegeLockout(actor, previewMap, null);
+        if (!this.db.snapshot.rbac_policies)
+            this.db.snapshot.rbac_policies = {};
+        this.db.snapshot.rbac_policies[role] = {
+            ...next,
+            updated_at: new Date().toISOString(),
+            updated_by: actor.username,
+        };
+        this.db.persist();
+        this.audit?.append({
+            actor: actor.username,
+            action: 'rbac.policy.update',
+            resource: role,
+            detail: { maxLevel: next.maxLevel, capabilities: next.capabilities },
+            ok: true,
+        });
+        return this.listPolicies().find((p) => p.role === role);
+    }
+    restoreRole(role, actor) {
+        this.requireCapability(actor, 'rbac.policy');
+        if (!SYSTEM_ROLES.includes(role)) {
+            throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n1027'), { httpStatus: 400 });
+        }
+        const previewMap = { ...this.rolePolicyMap() };
+        delete previewMap[role];
+        this.assertNotLastPrivilegeLockout(actor, previewMap, null);
+        if (this.db.snapshot.rbac_policies?.[role]) {
+            delete this.db.snapshot.rbac_policies[role];
+            this.db.persist();
+        }
+        this.audit?.append({
+            actor: actor.username,
+            action: 'rbac.policy.restore',
+            resource: role,
+            detail: {},
+            ok: true,
+        });
+        return this.listPolicies().find((p) => p.role === role);
+    }
+    restoreAllRoles(actor) {
+        this.requireCapability(actor, 'rbac.policy');
+        this.assertNotLastPrivilegeLockout(actor, {}, null);
+        this.db.snapshot.rbac_policies = {};
+        this.db.persist();
+        this.audit?.append({
+            actor: actor.username,
+            action: 'rbac.policy.restore_all',
+            detail: {},
+            ok: true,
+        });
+        return this.listPolicies();
+    }
+    /**
+     * Set per-user capability overrides. Caller must have users.manage.
+     */
+    setUserOverrides(userId, patch, actor) {
+        this.requireCapability(actor, 'users.manage');
+        const u = this.db.snapshot.users.find((x) => x.id === userId);
+        if (!u) {
+            throw new YskError(ErrorCodes.NOT_FOUND, tl('notes.auto.n0002'), { httpStatus: 404 });
+        }
+        // Never apply revokes to admin-role users — they stay full-open
+        if (u.roles.includes('admin') && patch.revokes !== undefined && patch.revokes !== null) {
+            const rev = patch.revokes.filter(Boolean);
+            if (rev.length > 0) {
+                throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n0500'), {
+                    httpStatus: 400,
+                    details: { reason: 'admin_user_no_revokes' },
+                });
+            }
+        }
+        const grants = patch.grants === null
+            ? []
+            : patch.grants !== undefined
+                ? patch.grants.filter((id) => isCapabilityId(id))
+                : (u.capability_grants ?? []);
+        const revokes = u.roles.includes('admin')
+            ? []
+            : patch.revokes === null
+                ? []
+                : patch.revokes !== undefined
+                    ? patch.revokes.filter((id) => isCapabilityId(id))
+                    : (u.capability_revokes ?? []);
+        this.assertNotLastPrivilegeLockout(actor, this.rolePolicyMap(), { userId, grants, revokes });
+        u.capability_grants = grants.length ? grants : undefined;
+        u.capability_revokes = revokes.length ? revokes : undefined;
+        if (!u.capability_grants)
+            delete u.capability_grants;
+        if (!u.capability_revokes)
+            delete u.capability_revokes;
+        u.updated_at = new Date().toISOString();
+        this.db.persist();
+        this.audit?.append({
+            actor: actor.username,
+            action: 'rbac.user_overrides.update',
+            resource: userId,
+            detail: { grants, revokes },
+            ok: true,
+        });
+        return { ...u };
+    }
+    restoreUserOverrides(userId, actor) {
+        return this.setUserOverrides(userId, { grants: null, revokes: null }, actor);
+    }
+    defaults() {
+        return {
+            version: factoryRolePolicy('admin').defaultsVersion,
+            roles: factoryRolePolicies(),
+        };
+    }
+    getStored(role) {
+        const raw = this.db.snapshot.rbac_policies?.[role];
+        if (!raw)
+            return undefined;
+        return normalizeRolePolicy(raw);
+    }
+    /**
+     * After a hypothetical change, at least one non-suspended user must still
+     * effectively hold users.manage AND rbac.policy.
+     */
+    assertNotLastPrivilegeLockout(_actor, rolePolicies, userOverride) {
+        const holders = this.db.snapshot.users.filter((u) => {
+            if (u.suspended)
+                return false;
+            const grants = userOverride && userOverride.userId === u.id
+                ? userOverride.grants
+                : u.capability_grants;
+            const revokes = userOverride && userOverride.userId === u.id
+                ? userOverride.revokes
+                : u.capability_revokes;
+            const caps = computeEffectiveCapabilities({
+                roles: u.roles,
+                rolePolicies,
+                grants,
+                revokes,
+            });
+            return hasCapability(caps, 'users.manage') && hasCapability(caps, 'rbac.policy');
+        });
+        if (holders.length === 0) {
+            throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n0500'), {
+                httpStatus: 400,
+                details: { reason: 'last_privilege_holder' },
+            });
+        }
+    }
+}
+//# sourceMappingURL=rbac-policy.js.map

package/dist/services/rbac-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac-policy.js","sourceRoot":"","sources":["../../src/services/rbac-policy.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,UAAU,EACV,QAAQ,EACR,4BAA4B,EAC5B,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,YAAY,EACZ,EAAE,GAKH,MAAM,mBAAmB,CAAC;AAiB3B,MAAM,OAAO,iBAAiB;IAET;IACA;IAFnB,YACmB,EAAe,EACf,KAAuB;QADvB,OAAE,GAAF,EAAE,CAAa;QACf,UAAK,GAAL,KAAK,CAAkB;IACvC,CAAC;IAEJ,4DAA4D;IAC5D,YAAY;QACV,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAC/B,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC1D,OAAO;gBACL,IAAI;gBACJ,MAAM;gBACN,KAAK;gBACL,OAAO;aACR,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,kBAAkB,CAAC,IAAgB;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACpC,OAAO,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC;IAChD,CAAC;IAED,iFAAiF;IACjF,aAAa;QACX,MAAM,GAAG,GAA4C,EAAE,CAAC;QACxD,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC1D,IAAI,KAAK;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;QAChC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,gBAAgB,CAAC,IAA2E;QAC1F,OAAO,4BAA4B,CAAC;YAClC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE;YAClC,MAAM,EAAE,IAAI,CAAC,iBAAiB;YAC9B,OAAO,EAAE,IAAI,CAAC,kBAAkB;SACjC,CAAC,CAAC;IACL,CAAC;IAED,QAAQ,CACN,IAA2E,EAC3E,GAAiB;QAEjB,OAAO,aAAa,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;IACzD,CAAC;IAED,iBAAiB,CACf,IAA2E,EAC3E,GAAiB;QAEjB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE;gBAC9D,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE;aAC7B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,yBAAyB;QAKvB,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAC3C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,cAAc,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,aAAa,CAAC,CAC3F,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QACvE,CAAC;QAED,mFAAmF;QACnF,IAAI,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC;QAC9C,CAAC;QACD,IAAI,MAAM,GACR,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC7E,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAChD,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACxC,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACpC,MAAM,CAAC,KAAK,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC;QACzE,CAAC;QACD,yEAAyE;QACzE,OAAO,MAAM,CAAC,kBAAkB,CAAC;QACjC,mCAAmC;QACnC,MAAM,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC7C,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;QAClB,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;YACjB,KAAK,EAAE,QAAQ;YACf,MAAM,EAAE,4BAA4B;YACpC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;YAC7C,EAAE,EAAE,IAAI;SACT,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IACjE,CAAC;IAED,aAAa,CACX,IAAgB,EAChB,KAA6D,EAC7D,KAAqI;QAErI,IAAI,CAAC,iBAAiB,CAAC,KAAkB,EAAE,aAAa,CAAC,CAAC;QAC1D,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACzF,CAAC;QAED,+FAA+F;QAC/F,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE;gBAChE,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE;oBACP,MAAM,EAAE,wBAAwB;oBAChC,OAAO,EAAE,qFAAqF;iBAC/F;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAExC,MAAM,UAAU,GAAG,EAAE,GAAG,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;QAC7D,IAAI,CAAC,6BAA6B,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;QAE5D,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,aAAa;YAAE,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,aAAa,GAAG,EAAE,CAAC;QACzE,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG;YACrC,GAAG,IAAI;YACP,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,UAAU,EAAE,KAAK,CAAC,QAAQ;SAC3B,CAAC;QACF,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;QAClB,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;YACjB,KAAK,EAAE,KAAK,CAAC,QAAQ;YACrB,MAAM,EAAE,oBAAoB;YAC5B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE;YACpE,EAAE,EAAE,IAAI;SACT,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAE,CAAC;IAC3D,CAAC;IAED,WAAW,CACT,IAAgB,EAChB,KAAqI;QAErI,IAAI,CAAC,iBAAiB,CAAC,KAAkB,EAAE,aAAa,CAAC,CAAC;QAC1D,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,UAAU,GAAG,EAAE,GAAG,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;QAC/C,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,CAAC,6BAA6B,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;QAE5D,IAAI,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;QACpB,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;YACjB,KAAK,EAAE,KAAK,CAAC,QAAQ;YACrB,MAAM,EAAE,qBAAqB;YAC7B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,EAAE;YACV,EAAE,EAAE,IAAI;SACT,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAE,CAAC;IAC3D,CAAC;IAED,eAAe,CAAC,KAMf;QACC,IAAI,CAAC,iBAAiB,CAAC,KAAkB,EAAE,aAAa,CAAC,CAAC;QAC1D,IAAI,CAAC,6BAA6B,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,aAAa,GAAG,EAAE,CAAC;QACpC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;QAClB,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;YACjB,KAAK,EAAE,KAAK,CAAC,QAAQ;YACrB,MAAM,EAAE,yBAAyB;YACjC,MAAM,EAAE,EAAE;YACV,EAAE,EAAE,IAAI;SACT,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,gBAAgB,CACd,MAAc,EACd,KAA8D,EAC9D,KAAqI;QAErI,IAAI,CAAC,iBAAiB,CAAC,KAAkB,EAAE,cAAc,CAAC,CAAC;QAC3D,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;QAC9D,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACxF,CAAC;QAED,gEAAgE;QAChE,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YACvF,MAAM,GAAG,GAAI,KAAK,CAAC,OAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACxD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnB,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE;oBAChE,UAAU,EAAE,GAAG;oBACf,OAAO,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE;iBAC7C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GACV,KAAK,CAAC,MAAM,KAAK,IAAI;YACnB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS;gBAC1B,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAsB,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;gBACrE,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,OAAO,GACX,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;YACvB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI;gBACtB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS;oBAC3B,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,EAAsB,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;oBACtE,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;QAEvC,IAAI,CAAC,6BAA6B,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE7F,CAAC,CAAC,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACzD,CAAC,CAAC,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5D,IAAI,CAAC,CAAC,CAAC,iBAAiB;YAAE,OAAO,CAAC,CAAC,iBAAiB,CAAC;QACrD,IAAI,CAAC,CAAC,CAAC,kBAAkB;YAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC;QACvD,CAAC,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;QAClB,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;YACjB,KAAK,EAAE,KAAK,CAAC,QAAQ;YACrB,MAAM,EAAE,4BAA4B;YACpC,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;YAC3B,EAAE,EAAE,IAAI;SACT,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;IAClB,CAAC;IAED,oBAAoB,CAClB,MAAc,EACd,KAAqI;QAErI,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;IAC/E,CAAC;IAED,QAAQ;QACN,OAAO;YACL,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC,eAAe;YACnD,KAAK,EAAE,mBAAmB,EAAE;SAC7B,CAAC;IACJ,CAAC;IAEO,SAAS,CAAC,IAAgB;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,OAAO,mBAAmB,CAAC,GAAG,CAAqB,CAAC;IACtD,CAAC;IAED;;;OAGG;IACK,6BAA6B,CACnC,MAAoH,EACpH,YAAqD,EACrD,YAAwF;QAExF,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YAClD,IAAI,CAAC,CAAC,SAAS;gBAAE,OAAO,KAAK,CAAC;YAC9B,MAAM,MAAM,GACV,YAAY,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE;gBAC1C,CAAC,CAAC,YAAY,CAAC,MAAM;gBACrB,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC;YAC1B,MAAM,OAAO,GACX,YAAY,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE;gBAC1C,CAAC,CAAC,YAAY,CAAC,OAAO;gBACtB,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC;YAC3B,MAAM,IAAI,GAAG,4BAA4B,CAAC;gBACxC,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,YAAY;gBACZ,MAAM;gBACN,OAAO;aACR,CAAC,CAAC;YACH,OAAO,aAAa,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QACnF,CAAC,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE;gBAChE,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE;aAC7C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/dist/services/scheduler.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Lightweight in-process scheduler for protection probes + daily inventory hooks.
+ */
+export type ScheduledJob = {
+    id: string;
+    intervalMs: number;
+    lastRunAt?: string;
+    /** ISO — best-effort next fire (updated after each run / reschedule) */
+    nextRunAt?: string;
+    running: boolean;
+};
+export declare class Scheduler {
+    private timers;
+    private jobs;
+    /** Dynamic jobs: re-read interval after each tick */
+    private dynamicFns;
+    /**
+     * Register a recurring job. Immediate first run optional.
+     */
+    every(id: string, intervalMs: number, fn: () => void | Promise<void>, opts?: {
+        runImmediately?: boolean;
+    }): void;
+    /**
+     * Recurring job whose interval is re-read after every tick (e.g. panel-tunable).
+     */
+    everyDynamic(id: string, getIntervalMs: () => number, fn: () => void | Promise<void>, opts?: {
+        runImmediately?: boolean; /** Max interval clamp (default 7d; was 10m). */
+        maxIntervalMs?: number;
+    }): void;
+    stop(id: string): void;
+    stopAll(): void;
+    list(): ScheduledJob[];
+    get(id: string): ScheduledJob | undefined;
+}
+//# sourceMappingURL=scheduler.d.ts.map

package/dist/services/scheduler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scheduler.d.ts","sourceRoot":"","sources":["../../src/services/scheduler.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,qBAAa,SAAS;IACpB,OAAO,CAAC,MAAM,CAAqD;IACnE,OAAO,CAAC,IAAI,CAAmC;IAC/C,qDAAqD;IACrD,OAAO,CAAC,UAAU,CAGd;IAEJ;;OAEG;IACH,KAAK,CACH,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,EAC9B,IAAI,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,OAAO,CAAA;KAAE,GAClC,IAAI;IAgCP;;OAEG;IACH,YAAY,CACV,EAAE,EAAE,MAAM,EACV,aAAa,EAAE,MAAM,MAAM,EAC3B,EAAE,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,EAC9B,IAAI,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC,gDAAgD;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3G,IAAI;IAoDP,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAQtB,OAAO,IAAI,IAAI;IAIf,IAAI,IAAI,YAAY,EAAE;IAItB,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;CAI1C"}

package/dist/services/scheduler.js

@@ -0,0 +1,124 @@
+/**
+ * Lightweight in-process scheduler for protection probes + daily inventory hooks.
+ */
+export class Scheduler {
+    timers = new Map();
+    jobs = new Map();
+    /** Dynamic jobs: re-read interval after each tick */
+    dynamicFns = new Map();
+    /**
+     * Register a recurring job. Immediate first run optional.
+     */
+    every(id, intervalMs, fn, opts) {
+        this.stop(id);
+        const job = {
+            id,
+            intervalMs,
+            running: false,
+            nextRunAt: new Date(Date.now() + intervalMs).toISOString(),
+        };
+        this.jobs.set(id, job);
+        const tick = async () => {
+            if (job.running)
+                return;
+            job.running = true;
+            try {
+                await fn();
+                job.lastRunAt = new Date().toISOString();
+            }
+            catch {
+                job.lastRunAt = new Date().toISOString();
+            }
+            finally {
+                job.running = false;
+                job.nextRunAt = new Date(Date.now() + job.intervalMs).toISOString();
+            }
+        };
+        if (opts?.runImmediately)
+            void tick();
+        const handle = setInterval(() => void tick(), intervalMs);
+        if (typeof handle === 'object' && 'unref' in handle) {
+            handle.unref?.();
+        }
+        this.timers.set(id, handle);
+    }
+    /**
+     * Recurring job whose interval is re-read after every tick (e.g. panel-tunable).
+     */
+    everyDynamic(id, getIntervalMs, fn, opts) {
+        this.stop(id);
+        this.dynamicFns.set(id, { fn, getIntervalMs });
+        const maxMs = opts?.maxIntervalMs ?? 7 * 24 * 60 * 60_000;
+        const clamp = (raw) => Math.max(5_000, Math.min(maxMs, Number.isFinite(raw) && raw > 0 ? raw : 120_000));
+        const arm = (runNow) => {
+            const ms = clamp(getIntervalMs() || 120_000);
+            const job = {
+                id,
+                intervalMs: ms,
+                running: false,
+                nextRunAt: new Date(Date.now() + (runNow ? 0 : ms)).toISOString(),
+                lastRunAt: this.jobs.get(id)?.lastRunAt,
+            };
+            this.jobs.set(id, job);
+            const prev = this.timers.get(id);
+            if (prev)
+                clearInterval(prev);
+            const tick = async () => {
+                const j = this.jobs.get(id);
+                if (!j || j.running)
+                    return;
+                j.running = true;
+                try {
+                    await fn();
+                    j.lastRunAt = new Date().toISOString();
+                }
+                catch {
+                    j.lastRunAt = new Date().toISOString();
+                }
+                finally {
+                    j.running = false;
+                    // re-arm with latest interval
+                    const nextMs = clamp(getIntervalMs() || 120_000);
+                    j.intervalMs = nextMs;
+                    j.nextRunAt = new Date(Date.now() + nextMs).toISOString();
+                    const old = this.timers.get(id);
+                    if (old)
+                        clearInterval(old);
+                    const h = setInterval(() => void tick(), nextMs);
+                    if (typeof h === 'object' && 'unref' in h)
+                        h.unref?.();
+                    this.timers.set(id, h);
+                }
+            };
+            if (runNow)
+                void tick();
+            else {
+                const h = setInterval(() => void tick(), ms);
+                if (typeof h === 'object' && 'unref' in h)
+                    h.unref?.();
+                this.timers.set(id, h);
+            }
+        };
+        arm(Boolean(opts?.runImmediately));
+    }
+    stop(id) {
+        const t = this.timers.get(id);
+        if (t)
+            clearInterval(t);
+        this.timers.delete(id);
+        this.jobs.delete(id);
+        this.dynamicFns.delete(id);
+    }
+    stopAll() {
+        for (const id of [...this.timers.keys()])
+            this.stop(id);
+    }
+    list() {
+        return [...this.jobs.values()].map((j) => ({ ...j }));
+    }
+    get(id) {
+        const j = this.jobs.get(id);
+        return j ? { ...j } : undefined;
+    }
+}
+//# sourceMappingURL=scheduler.js.map

package/dist/services/scheduler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scheduler.js","sourceRoot":"","sources":["../../src/services/scheduler.ts"],"names":[],"mappings":"AAAA;;GAEG;AAWH,MAAM,OAAO,SAAS;IACZ,MAAM,GAAG,IAAI,GAAG,EAA0C,CAAC;IAC3D,IAAI,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC/C,qDAAqD;IAC7C,UAAU,GAAG,IAAI,GAAG,EAGzB,CAAC;IAEJ;;OAEG;IACH,KAAK,CACH,EAAU,EACV,UAAkB,EAClB,EAA8B,EAC9B,IAAmC;QAEnC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACd,MAAM,GAAG,GAAiB;YACxB,EAAE;YACF,UAAU;YACV,OAAO,EAAE,KAAK;YACd,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE;SAC3D,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAEvB,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;YACtB,IAAI,GAAG,CAAC,OAAO;gBAAE,OAAO;YACxB,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,EAAE,EAAE,CAAC;gBACX,GAAG,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC3C,CAAC;oBAAS,CAAC;gBACT,GAAG,CAAC,OAAO,GAAG,KAAK,CAAC;gBACpB,GAAG,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;YACtE,CAAC;QACH,CAAC,CAAC;QAEF,IAAI,IAAI,EAAE,cAAc;YAAE,KAAK,IAAI,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC;QAC1D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;YACnD,MAAyB,CAAC,KAAK,EAAE,EAAE,CAAC;QACvC,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,YAAY,CACV,EAAU,EACV,aAA2B,EAC3B,EAA8B,EAC9B,IAA4G;QAE5G,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACd,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,IAAI,EAAE,aAAa,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;QAC1D,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,EAAE,CAC5B,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACpF,MAAM,GAAG,GAAG,CAAC,MAAe,EAAE,EAAE;YAC9B,MAAM,EAAE,GAAG,KAAK,CAAC,aAAa,EAAE,IAAI,OAAO,CAAC,CAAC;YAC7C,MAAM,GAAG,GAAiB;gBACxB,EAAE;gBACF,UAAU,EAAE,EAAE;gBACd,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE;gBACjE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,SAAS;aACxC,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACvB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACjC,IAAI,IAAI;gBAAE,aAAa,CAAC,IAAI,CAAC,CAAC;YAE9B,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;gBACtB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC5B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO;oBAAE,OAAO;gBAC5B,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC;gBACjB,IAAI,CAAC;oBACH,MAAM,EAAE,EAAE,CAAC;oBACX,CAAC,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBACzC,CAAC;gBAAC,MAAM,CAAC;oBACP,CAAC,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBACzC,CAAC;wBAAS,CAAC;oBACT,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC;oBAClB,8BAA8B;oBAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,EAAE,IAAI,OAAO,CAAC,CAAC;oBACjD,CAAC,CAAC,UAAU,GAAG,MAAM,CAAC;oBACtB,CAAC,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;oBAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAChC,IAAI,GAAG;wBAAE,aAAa,CAAC,GAAG,CAAC,CAAC;oBAC5B,MAAM,CAAC,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;oBACjD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC;wBAAG,CAAoB,CAAC,KAAK,EAAE,EAAE,CAAC;oBAC3E,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC,CAAC;YAEF,IAAI,MAAM;gBAAE,KAAK,IAAI,EAAE,CAAC;iBACnB,CAAC;gBACJ,MAAM,CAAC,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC7C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC;oBAAG,CAAoB,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC3E,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YACzB,CAAC;QACH,CAAC,CAAC;QACF,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,CAAC,EAAU;QACb,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC;YAAE,aAAa,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO;QACL,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,GAAG,CAAC,EAAU;QACZ,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAClC,CAAC;CACF"}

package/dist/services/users-admin.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Admin user + package management (panel multi-user foundation).
+ */
+import type { SystemRole, UserDto } from 'ysk-server-shared';
+import type { UserRepository } from '../repositories/user-repo.js';
+import type { AuditRepository } from '../repositories/audit-repo.js';
+import type { SessionRepository } from '../repositories/session-repo.js';
+import type { YskDatabase } from '../db/database.js';
+import type { StorePackage } from '../db/store.js';
+export declare class UsersAdminService {
+    private readonly users;
+    private readonly sessions;
+    private readonly db;
+    private readonly audit?;
+    constructor(users: UserRepository, sessions: SessionRepository, db: YskDatabase, audit?: AuditRepository | undefined);
+    listUsers(): Array<UserDto & {
+        packageId?: string;
+        suspended?: boolean;
+    }>;
+    createUser(input: {
+        username: string;
+        password: string;
+        roles?: SystemRole[];
+        packageId?: string;
+        locale?: string;
+        actor: string;
+    }): UserDto;
+    updateUser(id: string, patch: {
+        roles?: SystemRole[];
+        packageId?: string | null;
+        suspended?: boolean;
+        password?: string;
+    }, actor: string): UserDto;
+    deleteUser(id: string, actor: string): boolean;
+    /**
+     * Impersonate: issue a short-lived session for target user.
+     * Authorization is enforced at the route layer via `users.impersonate` capability
+     * (factory default: admin only). This method assumes the caller is authorized.
+     */
+    impersonate(targetUserId: string, actor: {
+        id: string;
+        username: string;
+        roles: SystemRole[];
+    }): {
+        token: string;
+        user: UserDto;
+        expiresAt: string;
+    };
+    listPackages(): StorePackage[];
+    createPackage(input: {
+        name: string;
+        maxProjects?: number;
+        maxMailboxes?: number;
+        maxDatabases?: number;
+        diskMb?: number;
+        bandwidthMb?: number;
+        allowSsh?: boolean;
+        allowFtp?: boolean;
+        notes?: string;
+    }, actor: string): StorePackage;
+    updatePackage(id: string, patch: Partial<Pick<StorePackage, 'name' | 'max_projects' | 'max_mailboxes' | 'max_databases' | 'disk_mb' | 'bandwidth_mb' | 'allow_ssh' | 'allow_ftp' | 'notes'>>, actor: string): StorePackage;
+    deletePackage(id: string, actor: string): boolean;
+}
+//# sourceMappingURL=users-admin.d.ts.map

package/dist/services/users-admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"users-admin.d.ts","sourceRoot":"","sources":["../../src/services/users-admin.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAE7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAGnD,qBAAa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAHN,KAAK,EAAE,cAAc,EACrB,QAAQ,EAAE,iBAAiB,EAC3B,EAAE,EAAE,WAAW,EACf,KAAK,CAAC,EAAE,eAAe,YAAA;IAG1C,SAAS,IAAI,KAAK,CAAC,OAAO,GAAG;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAYzE,UAAU,CAAC,KAAK,EAAE;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;QACrB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO;IA4CX,UAAU,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QACL,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;QACrB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,EACD,KAAK,EAAE,MAAM,GACZ,OAAO;IAmCV,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAgB9C;;;;OAIG;IACH,WAAW,CACT,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,UAAU,EAAE,CAAA;KAAE,GAC3D;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;IAgCtD,YAAY,IAAI,YAAY,EAAE;IAI9B,aAAa,CACX,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,EACD,KAAK,EAAE,MAAM,GACZ,YAAY;IA+Bf,aAAa,CACX,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,OAAO,CACZ,IAAI,CACF,YAAY,EACV,MAAM,GACN,cAAc,GACd,eAAe,GACf,eAAe,GACf,SAAS,GACT,cAAc,GACd,WAAW,GACX,WAAW,GACX,OAAO,CACV,CACF,EACD,KAAK,EAAE,MAAM,GACZ,YAAY;IAgBf,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;CAoBlD"}