ysk-server-core 1.0.0

package/dist/services/users-admin.js

@@ -0,0 +1,249 @@
+/**
+ * Admin user + package management (panel multi-user foundation).
+ */
+import { randomBytes, randomUUID } from 'node:crypto';
+import { ErrorCodes, YskError, tl } from 'ysk-server-shared';
+import { hashPassword } from './auth.js';
+export class UsersAdminService {
+    users;
+    sessions;
+    db;
+    audit;
+    constructor(users, sessions, db, audit) {
+        this.users = users;
+        this.sessions = sessions;
+        this.db = db;
+        this.audit = audit;
+    }
+    listUsers() {
+        return this.users.list().map((u) => ({
+            id: u.id,
+            username: u.username,
+            roles: [...u.roles],
+            locale: u.locale,
+            totpEnabled: Boolean(u.totp_enabled),
+            mustChangePassword: Boolean(u.must_change_password) || undefined,
+            packageId: u.package_id,
+            suspended: Boolean(u.suspended)
+        }));
+    }
+    createUser(input) {
+        const username = input.username.trim().toLowerCase();
+        if (!/^[a-z0-9._-]{2,32}$/.test(username)) {
+            throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n1248'), {
+                httpStatus: 400
+            });
+        }
+        if (input.password.length < 8) {
+            throw new YskError(ErrorCodes.VALIDATION, tl('notes.passwordMin8'), { httpStatus: 400 });
+        }
+        if (this.users.findByUsername(username)) {
+            throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.t0501', { v0: (username) }), { httpStatus: 409 });
+        }
+        const roles = (input.roles?.length ? input.roles : ['operator']);
+        if (roles.includes('admin') === false && roles.length === 0) {
+            roles.push('operator');
+        }
+        const salt = randomBytes(16).toString('hex');
+        const now = new Date().toISOString();
+        const user = {
+            id: randomUUID(),
+            username,
+            password_hash: hashPassword(input.password, salt),
+            password_salt: salt,
+            roles,
+            locale: input.locale ?? 'zh-HK',
+            package_id: input.packageId,
+            suspended: false,
+            created_at: now,
+            updated_at: now
+        };
+        this.users.insert(user);
+        this.audit?.append({
+            actor: input.actor,
+            action: 'users.create',
+            resource: username,
+            detail: { roles, packageId: input.packageId },
+            ok: true
+        });
+        return {
+            id: user.id,
+            username,
+            roles: [...roles],
+            locale: user.locale,
+            totpEnabled: false
+        };
+    }
+    updateUser(id, patch, actor) {
+        const existing = this.users.findById(id);
+        if (!existing) {
+            throw new YskError(ErrorCodes.NOT_FOUND, tl('notes.auto.n0002'), { httpStatus: 404 });
+        }
+        const upd = {};
+        if (patch.roles)
+            upd.roles = patch.roles;
+        if (patch.packageId === null)
+            upd.package_id = undefined;
+        else if (patch.packageId !== undefined)
+            upd.package_id = patch.packageId;
+        if (patch.suspended !== undefined)
+            upd.suspended = patch.suspended;
+        if (patch.password) {
+            if (patch.password.length < 8) {
+                throw new YskError(ErrorCodes.VALIDATION, tl('notes.passwordMin8'), { httpStatus: 400 });
+            }
+            const salt = randomBytes(16).toString('hex');
+            upd.password_salt = salt;
+            upd.password_hash = hashPassword(patch.password, salt);
+            upd.must_change_password = false;
+        }
+        const u = this.users.update(id, upd);
+        if (!u)
+            throw new YskError(ErrorCodes.NOT_FOUND, tl('notes.auto.n0002'), { httpStatus: 404 });
+        this.audit?.append({
+            actor,
+            action: 'users.update',
+            resource: id,
+            detail: { ...patch, password: patch.password ? '***' : undefined },
+            ok: true
+        });
+        return {
+            id: u.id,
+            username: u.username,
+            roles: [...u.roles],
+            locale: u.locale,
+            totpEnabled: Boolean(u.totp_enabled)
+        };
+    }
+    deleteUser(id, actor) {
+        const u = this.users.findById(id);
+        if (!u)
+            return false;
+        if (u.roles.includes('admin') && this.users.list().filter((x) => x.roles.includes('admin')).length <= 1) {
+            throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n0500'), { httpStatus: 400 });
+        }
+        const ok = this.users.delete(id);
+        this.audit?.append({
+            actor,
+            action: 'users.delete',
+            resource: id,
+            detail: { username: u.username },
+            ok
+        });
+        return ok;
+    }
+    /**
+     * Impersonate: issue a short-lived session for target user.
+     * Authorization is enforced at the route layer via `users.impersonate` capability
+     * (factory default: admin only). This method assumes the caller is authorized.
+     */
+    impersonate(targetUserId, actor) {
+        const target = this.users.findById(targetUserId);
+        if (!target) {
+            throw new YskError(ErrorCodes.NOT_FOUND, tl('notes.auto.n0002'), { httpStatus: 404 });
+        }
+        if (target.suspended) {
+            throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n1277'), { httpStatus: 400 });
+        }
+        const token = randomBytes(24).toString('hex');
+        const expiresAt = new Date(Date.now() + 2 * 60 * 60 * 1000).toISOString();
+        this.sessions.insert({
+            token,
+            user_id: target.id,
+            expires_at: expiresAt,
+            created_at: new Date().toISOString()
+        });
+        this.audit?.append({
+            actor: actor.username,
+            action: 'users.impersonate',
+            resource: target.username,
+            detail: { targetId: target.id },
+            ok: true
+        });
+        return {
+            token,
+            expiresAt,
+            user: {
+                id: target.id,
+                username: target.username,
+                roles: [...target.roles],
+                locale: target.locale,
+                totpEnabled: Boolean(target.totp_enabled)
+            }
+        };
+    }
+    listPackages() {
+        return (this.db.snapshot.packages ?? []).map((p) => ({ ...p }));
+    }
+    createPackage(input, actor) {
+        const name = input.name.trim();
+        if (!name) {
+            throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n1395'), { httpStatus: 400 });
+        }
+        const now = new Date().toISOString();
+        const row = {
+            id: randomUUID(),
+            name,
+            max_projects: input.maxProjects ?? 10,
+            max_mailboxes: input.maxMailboxes ?? 50,
+            max_databases: input.maxDatabases ?? 20,
+            disk_mb: input.diskMb ?? 10240,
+            bandwidth_mb: input.bandwidthMb ?? 0,
+            allow_ssh: input.allowSsh ?? false,
+            allow_ftp: input.allowFtp ?? true,
+            notes: input.notes,
+            created_at: now,
+            updated_at: now
+        };
+        if (!this.db.snapshot.packages)
+            this.db.snapshot.packages = [];
+        this.db.snapshot.packages.unshift(row);
+        this.db.persist();
+        this.audit?.append({
+            actor,
+            action: 'packages.create',
+            resource: row.id,
+            detail: { name },
+            ok: true
+        });
+        return { ...row };
+    }
+    updatePackage(id, patch, actor) {
+        const p = (this.db.snapshot.packages ?? []).find((x) => x.id === id);
+        if (!p) {
+            throw new YskError(ErrorCodes.NOT_FOUND, tl('notes.auto.n0863'), { httpStatus: 404 });
+        }
+        Object.assign(p, patch, { updated_at: new Date().toISOString() });
+        this.db.persist();
+        this.audit?.append({
+            actor,
+            action: 'packages.update',
+            resource: id,
+            detail: patch,
+            ok: true
+        });
+        return { ...p };
+    }
+    deletePackage(id, actor) {
+        const subscribers = this.users.list().filter((u) => u.package_id === id).length;
+        if (subscribers > 0) {
+            throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n1395'), {
+                httpStatus: 400,
+                details: { reason: 'package_has_subscribers', subscribers },
+            });
+        }
+        const before = (this.db.snapshot.packages ?? []).length;
+        this.db.snapshot.packages = (this.db.snapshot.packages ?? []).filter((p) => p.id !== id);
+        this.db.persist();
+        const ok = (this.db.snapshot.packages ?? []).length < before;
+        this.audit?.append({
+            actor,
+            action: 'packages.delete',
+            resource: id,
+            detail: { ok },
+            ok
+        });
+        return ok;
+    }
+}
+//# sourceMappingURL=users-admin.js.map

package/dist/services/users-admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"users-admin.js","sourceRoot":"","sources":["../../src/services/users-admin.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAC,MAAM,mBAAmB,CAAC;AAM5D,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,MAAM,OAAO,iBAAiB;IAET;IACA;IACA;IACA;IAJnB,YACmB,KAAqB,EACrB,QAA2B,EAC3B,EAAe,EACf,KAAuB;QAHvB,UAAK,GAAL,KAAK,CAAgB;QACrB,aAAQ,GAAR,QAAQ,CAAmB;QAC3B,OAAE,GAAF,EAAE,CAAa;QACf,UAAK,GAAL,KAAK,CAAkB;IACvC,CAAC;IAEJ,SAAS;QACP,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACnC,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;YACnB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC;YACpC,kBAAkB,EAAE,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,SAAS;YAChE,SAAS,EAAE,CAAC,CAAC,UAAU;YACvB,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;SAAE,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,UAAU,CAAC,KAOV;QACC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrD,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE;gBAChE,UAAU,EAAE,GAAG;aAAE,CAAC,CAAC;QACvB,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,oBAAoB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAiB,CAAC;QACjF,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5D,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACzB,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG;YACX,EAAE,EAAE,UAAU,EAAE;YAChB,QAAQ;YACR,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC;YACjD,aAAa,EAAE,IAAI;YACnB,KAAK;YACL,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,OAAO;YAC/B,UAAU,EAAE,KAAK,CAAC,SAAS;YAC3B,SAAS,EAAE,KAAK;YAChB,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,GAAG;SAAE,CAAC;QACpB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;YACjB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,cAAc;YACtB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;YAC7C,EAAE,EAAE,IAAI;SAAE,CAAC,CAAC;QACd,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,QAAQ;YACR,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,WAAW,EAAE,KAAK;SAAE,CAAC;IACzB,CAAC;IAED,UAAU,CACR,EAAU,EACV,KAKC,EACD,KAAa;QAEb,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,GAAG,GAA4C,EAAE,CAAC;QACxD,IAAI,KAAK,CAAC,KAAK;YAAE,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QACzC,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI;YAAE,GAAG,CAAC,UAAU,GAAG,SAAS,CAAC;aACpD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;YAAE,GAAG,CAAC,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC;QACzE,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;YAAE,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QACnE,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACnB,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,oBAAoB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC7C,GAAG,CAAC,aAAa,GAAG,IAAI,CAAC;YACzB,GAAG,CAAC,aAAa,GAAG,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACvD,GAAG,CAAC,oBAAoB,GAAG,KAAK,CAAC;QACnC,CAAC;QACD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9F,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;YACjB,KAAK;YACL,MAAM,EAAE,cAAc;YACtB,QAAQ,EAAE,EAAE;YACZ,MAAM,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE;YAClE,EAAE,EAAE,IAAI;SAAE,CAAC,CAAC;QACd,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;YACnB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC;SAAE,CAAC;IAC3C,CAAC;IAED,UAAU,CAAC,EAAU,EAAE,KAAa;QAClC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACrB,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACxG,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;YACjB,KAAK;YACL,MAAM,EAAE,cAAc;YACtB,QAAQ,EAAE,EAAE;YACZ,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE;YAChC,EAAE;SAAE,CAAC,CAAC;QACR,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;;OAIG;IACH,WAAW,CACT,YAAoB,EACpB,KAA4D;QAE5D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1E,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YACnB,KAAK;YACL,OAAO,EAAE,MAAM,CAAC,EAAE;YAClB,UAAU,EAAE,SAAS;YACrB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;YACjB,KAAK,EAAE,KAAK,CAAC,QAAQ;YACrB,MAAM,EAAE,mBAAmB;YAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE;YAC/B,EAAE,EAAE,IAAI;SAAE,CAAC,CAAC;QACd,OAAO;YACL,KAAK;YACL,SAAS;YACT,IAAI,EAAE;gBACJ,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;gBACxB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;aAAE;SAAE,CAAC;IACpD,CAAC;IAED,YAAY;QACV,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,aAAa,CACX,KAUC,EACD,KAAa;QAEb,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,GAAG,GAAiB;YACxB,EAAE,EAAE,UAAU,EAAE;YAChB,IAAI;YACJ,YAAY,EAAE,KAAK,CAAC,WAAW,IAAI,EAAE;YACrC,aAAa,EAAE,KAAK,CAAC,YAAY,IAAI,EAAE;YACvC,aAAa,EAAE,KAAK,CAAC,YAAY,IAAI,EAAE;YACvC,OAAO,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK;YAC9B,YAAY,EAAE,KAAK,CAAC,WAAW,IAAI,CAAC;YACpC,SAAS,EAAE,KAAK,CAAC,QAAQ,IAAI,KAAK;YAClC,SAAS,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;YACjC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,GAAG;SAAE,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ;YAAE,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,GAAG,EAAE,CAAC;QAC/D,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;QAClB,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;YACjB,KAAK;YACL,MAAM,EAAE,iBAAiB;YACzB,QAAQ,EAAE,GAAG,CAAC,EAAE;YAChB,MAAM,EAAE,EAAE,IAAI,EAAE;YAChB,EAAE,EAAE,IAAI;SAAE,CAAC,CAAC;QACd,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC;IACpB,CAAC;IAED,aAAa,CACX,EAAU,EACV,KAaC,EACD,KAAa;QAEb,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;QAClB,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;YACjB,KAAK;YACL,MAAM,EAAE,iBAAiB;YACzB,QAAQ,EAAE,EAAE;YACZ,MAAM,EAAE,KAAK;YACb,EAAE,EAAE,IAAI;SAAE,CAAC,CAAC;QACd,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;IAClB,CAAC;IAED,aAAa,CAAC,EAAU,EAAE,KAAa;QACrC,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QAChF,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE;gBAChE,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE,WAAW,EAAE;aAC5D,CAAC,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACxD,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACzF,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC;QAC7D,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;YACjB,KAAK;YACL,MAAM,EAAE,iBAAiB;YACzB,QAAQ,EAAE,EAAE;YACZ,MAAM,EAAE,EAAE,EAAE,EAAE;YACd,EAAE;SAAE,CAAC,CAAC;QACR,OAAO,EAAE,CAAC;IACZ,CAAC;CACF"}

package/dist/skills/index.d.ts

@@ -0,0 +1,3 @@
+export * from './task-planner.js';
+export * from './playbooks.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/skills/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/skills/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC"}

package/dist/skills/index.js

@@ -0,0 +1,3 @@
+export * from './task-planner.js';
+export * from './playbooks.js';
+//# sourceMappingURL=index.js.map

package/dist/skills/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/skills/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC"}

package/dist/skills/playbooks.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Built-in emergency / ops playbooks — structured steps only (allowlisted tools).
+ */
+export interface PlaybookStep {
+    tool: string;
+    args: Record<string, unknown>;
+    description: string;
+}
+export interface Playbook {
+    id: string;
+    name: string;
+    description: string;
+    emergency: boolean;
+    steps: PlaybookStep[];
+}
+export declare const BUILTIN_PLAYBOOKS: Playbook[];
+export declare function listPlaybooks(): Playbook[];
+export declare function getPlaybook(id: string): Playbook;
+export interface PlaybookRun {
+    id: string;
+    playbookId: string;
+    actor: string;
+    status: 'pending' | 'running' | 'completed' | 'failed';
+    results: Array<{
+        tool: string;
+        ok: boolean;
+        detail: unknown;
+    }>;
+    created_at: string;
+}
+export declare function startPlaybookRun(playbookId: string, actor: string): PlaybookRun;
+//# sourceMappingURL=playbooks.d.ts.map

package/dist/skills/playbooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"playbooks.d.ts","sourceRoot":"","sources":["../../src/skills/playbooks.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,YAAY,EAAE,CAAC;CACvB;AAED,eAAO,MAAM,iBAAiB,EAAE,QAAQ,EA4HvC,CAAC;AAeF,wBAAgB,aAAa,IAAI,QAAQ,EAAE,CAE1C;AAED,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,QAAQ,CAMhD;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IACvD,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC/D,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,WAAW,CAU/E"}

package/dist/skills/playbooks.js

@@ -0,0 +1,164 @@
+/**
+ * Built-in emergency / ops playbooks — structured steps only (allowlisted tools).
+ */
+import { randomUUID } from 'node:crypto';
+import { ErrorCodes, YskError, tl } from 'ysk-server-shared';
+export const BUILTIN_PLAYBOOKS = [
+    {
+        id: 'discover-host',
+        name: 'Host discovery',
+        description: 'Read-only host inventory',
+        emergency: false,
+        steps: [
+            { tool: 'sys.info', args: {}, description: 'Collect system info' },
+            { tool: 'process.list', args: {}, description: 'List processes' },
+        ],
+    },
+    {
+        id: 'nginx-health',
+        name: 'Nginx health check',
+        description: 'Check nginx service status',
+        emergency: false,
+        steps: [
+            { tool: 'service.status', args: { name: 'nginx' }, description: 'Query nginx active state' },
+        ],
+    },
+    {
+        id: 'nginx-restart',
+        name: 'Nginx restart (high risk)',
+        description: 'Restart nginx after approval',
+        emergency: true,
+        steps: [
+            { tool: 'service.status', args: { name: 'nginx' }, description: 'Pre-check status' },
+            { tool: 'service.restart', args: { name: 'nginx' }, description: 'Restart nginx' },
+            { tool: 'service.status', args: { name: 'nginx' }, description: 'Post-check status' },
+        ],
+    },
+    {
+        id: 'local-llm-ops-only',
+        name: 'Local LLM ops only',
+        description: 'Emergency discovery under protection mode',
+        emergency: true,
+        steps: [
+            { tool: 'sys.info', args: {}, description: 'Local system facts' },
+            { tool: 'fs.read', args: { path: '/etc/os-release' }, description: 'OS release' },
+        ],
+    },
+    {
+        id: 'disk-pressure',
+        name: 'Disk pressure check',
+        description: 'Read-only disk usage via df',
+        emergency: false,
+        steps: [
+            { tool: 'sys.info', args: {}, description: 'Host facts' },
+            { tool: 'fs.read', args: { path: '/proc/mounts' }, description: 'Mount table' },
+        ],
+    },
+    {
+        id: 'mail-stack-status',
+        name: 'Mail stack status',
+        description: 'Check postfix + dovecot units',
+        emergency: false,
+        steps: [
+            { tool: 'service.status', args: { name: 'postfix' }, description: 'Postfix' },
+            { tool: 'service.status', args: { name: 'dovecot' }, description: 'Dovecot' },
+        ],
+    },
+    {
+        id: 'security-units',
+        name: 'Security units',
+        description: 'fail2ban + sshd status (read-only)',
+        emergency: false,
+        steps: [
+            { tool: 'service.status', args: { name: 'fail2ban' }, description: 'fail2ban' },
+            { tool: 'service.status', args: { name: 'ssh' }, description: 'sshd (ssh unit)' },
+        ],
+    },
+    {
+        id: 'web-stack-status',
+        name: 'Web stack status',
+        description: 'nginx + php-fpm probe',
+        emergency: false,
+        steps: [
+            { tool: 'service.status', args: { name: 'nginx' }, description: 'Nginx' },
+            { tool: 'service.status', args: { name: 'php8.2-fpm' }, description: 'PHP-FPM 8.2' },
+        ],
+    },
+    {
+        id: 'emergency-read-only',
+        name: 'Emergency read-only sweep',
+        description: 'Protection-safe facts only',
+        emergency: true,
+        steps: [
+            { tool: 'sys.info', args: {}, description: 'sys.info' },
+            { tool: 'process.list', args: {}, description: 'processes' },
+            { tool: 'fs.read', args: { path: '/etc/os-release' }, description: 'os-release' },
+        ],
+    },
+    {
+        id: 'backup-health',
+        name: 'Backup readiness',
+        description: 'Check disk + list processes before backup window',
+        emergency: false,
+        steps: [
+            { tool: 'sys.info', args: {}, description: 'Host capacity' },
+            { tool: 'service.status', args: { name: 'ysk-server' }, description: 'Panel unit' },
+        ],
+    },
+    {
+        id: 'db-stack-status',
+        name: 'Database stack status',
+        description: 'mysql/mariadb/redis/postgres units',
+        emergency: false,
+        steps: [
+            { tool: 'service.status', args: { name: 'mysql' }, description: 'MySQL' },
+            { tool: 'service.status', args: { name: 'mariadb' }, description: 'MariaDB' },
+            { tool: 'service.status', args: { name: 'redis-server' }, description: 'Redis' },
+            { tool: 'service.status', args: { name: 'postgresql' }, description: 'PostgreSQL' },
+        ],
+    },
+    {
+        id: 'ssl-nginx-check',
+        name: 'SSL + Nginx check',
+        description: 'nginx status before cert ops',
+        emergency: false,
+        steps: [
+            { tool: 'service.status', args: { name: 'nginx' }, description: 'Nginx' },
+            { tool: 'fs.read', args: { path: '/etc/nginx/nginx.conf' }, description: 'nginx.conf head check' },
+        ],
+    },
+];
+function localizePlaybook(p) {
+    const nameKey = `playbooks.${p.id}.name`;
+    const descKey = `playbooks.${p.id}.description`;
+    const name = tl(nameKey);
+    const description = tl(descKey);
+    return {
+        ...p,
+        name: name !== nameKey ? name : p.name,
+        description: description !== descKey ? description : p.description,
+        steps: p.steps.map((s) => ({ ...s })),
+    };
+}
+export function listPlaybooks() {
+    return BUILTIN_PLAYBOOKS.map(localizePlaybook);
+}
+export function getPlaybook(id) {
+    const p = BUILTIN_PLAYBOOKS.find((x) => x.id === id);
+    if (!p) {
+        throw new YskError(ErrorCodes.NOT_FOUND, tl('notes.auto.t0022', { v0: (id) }), { httpStatus: 404 });
+    }
+    return localizePlaybook(p);
+}
+export function startPlaybookRun(playbookId, actor) {
+    getPlaybook(playbookId);
+    return {
+        id: randomUUID(),
+        playbookId,
+        actor,
+        status: 'pending',
+        results: [],
+        created_at: new Date().toISOString(),
+    };
+}
+//# sourceMappingURL=playbooks.js.map

package/dist/skills/playbooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"playbooks.js","sourceRoot":"","sources":["../../src/skills/playbooks.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAC,MAAM,mBAAmB,CAAC;AAgB5D,MAAM,CAAC,MAAM,iBAAiB,GAAe;IAC3C;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,0BAA0B;QACvC,SAAS,EAAE,KAAK;QAChB,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,EAAE,qBAAqB,EAAE;YAClE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,EAAE,gBAAgB,EAAE;SAClE;KACF;IACD;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EAAE,4BAA4B;QACzC,SAAS,EAAE,KAAK;QAChB,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,0BAA0B,EAAE;SAC7F;KACF;IACD;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,2BAA2B;QACjC,WAAW,EAAE,8BAA8B;QAC3C,SAAS,EAAE,IAAI;QACf,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE;YACpF,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE;YAClF,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE;SACtF;KACF;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EAAE,2CAA2C;QACxD,SAAS,EAAE,IAAI;QACf,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,EAAE,oBAAoB,EAAE;YACjE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE;SAClF;KACF;IACD;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EAAE,6BAA6B;QAC1C,SAAS,EAAE,KAAK;QAChB,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE;YACzD,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE;SAChF;KACF;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,+BAA+B;QAC5C,SAAS,EAAE,KAAK;QAChB,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE;YAC7E,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE;SAC9E;KACF;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,oCAAoC;QACjD,SAAS,EAAE,KAAK;QAChB,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE;YAC/E,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,iBAAiB,EAAE;SAClF;KACF;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,uBAAuB;QACpC,SAAS,EAAE,KAAK;QAChB,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE;YACzE,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE;SACrF;KACF;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,IAAI,EAAE,2BAA2B;QACjC,WAAW,EAAE,4BAA4B;QACzC,SAAS,EAAE,IAAI;QACf,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE;YACvD,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE;YAC5D,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE;SAClF;KACF;IACD;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,kDAAkD;QAC/D,SAAS,EAAE,KAAK;QAChB,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE;YAC5D,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE;SACpF;KACF;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,uBAAuB;QAC7B,WAAW,EAAE,oCAAoC;QACjD,SAAS,EAAE,KAAK;QAChB,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE;YACzE,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE;YAC7E,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE;YAChF,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE;SACpF;KACF;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,8BAA8B;QAC3C,SAAS,EAAE,KAAK;QAChB,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE;YACzE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,EAAE,WAAW,EAAE,uBAAuB,EAAE;SACnG;KACF;CACF,CAAC;AAEF,SAAS,gBAAgB,CAAC,CAAW;IACnC,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,EAAE,OAAO,CAAC;IACzC,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,EAAE,cAAc,CAAC;IAChD,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;IACzB,MAAM,WAAW,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;IAChC,OAAO;QACL,GAAG,CAAC;QACJ,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;QACtC,WAAW,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW;QAClE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,iBAAiB,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAAU;IACpC,MAAM,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,gBAAgB,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC;AAWD,MAAM,UAAU,gBAAgB,CAAC,UAAkB,EAAE,KAAa;IAChE,WAAW,CAAC,UAAU,CAAC,CAAC;IACxB,OAAO;QACL,EAAE,EAAE,UAAU,EAAE;QAChB,UAAU;QACV,KAAK;QACL,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,EAAE;QACX,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrC,CAAC;AACJ,CAAC"}

package/dist/skills/task-planner.d.ts

@@ -0,0 +1,74 @@
+/**
+ * AI task pipeline: natural language → planned tool steps → review → execute via allowlist.
+ * LLM text is never executed directly.
+ */
+import type { RiskTier } from 'ysk-server-shared';
+import type { Allowlist } from '../security/allowlist.js';
+import type { LlmGateway } from '../llm/gateway.js';
+export type TaskStepStatus = 'planned' | 'approved' | 'rejected' | 'executed' | 'failed' | 'skipped';
+export interface TaskStep {
+    id: string;
+    tool: string;
+    args: Record<string, unknown>;
+    risk: RiskTier;
+    requiresApproval: boolean;
+    status: TaskStepStatus;
+    result?: unknown;
+    error?: string;
+}
+export interface AiTask {
+    id: string;
+    prompt: string;
+    status: 'planning' | 'awaiting_review' | 'running' | 'completed' | 'failed' | 'cancelled';
+    steps: TaskStep[];
+    planSummary: string;
+    created_at: string;
+    updated_at: string;
+    actor: string;
+}
+export interface TaskStore {
+    save(task: AiTask): void;
+    get(id: string): AiTask | undefined;
+    list(): AiTask[];
+}
+/**
+ * Heuristic planner when LLM unavailable — maps common intents to allowlisted tools.
+ */
+export declare function planStepsFromPrompt(prompt: string, allowlist: Allowlist): {
+    summary: string;
+    steps: Omit<TaskStep, 'id' | 'status'>[];
+};
+/**
+ * Create a task in awaiting_review (or auto-run dry plan only).
+ */
+export declare function createAiTask(input: {
+    prompt: string;
+    actor: string;
+    allowlist: Allowlist;
+    store: TaskStore;
+}): AiTask;
+/**
+ * Optional LLM enrichment of plan summary (never trusts model for tools list alone).
+ */
+export declare function enrichPlanWithLlm(task: AiTask, llm: LlmGateway): Promise<AiTask>;
+/**
+ * Approve all planned steps (human review).
+ */
+export declare function approveTaskSteps(task: AiTask, store: TaskStore): AiTask;
+/**
+ * Build RCA report structure from host facts + optional LLM prose.
+ */
+export declare function buildRcaReport(input: {
+    title: string;
+    facts: Record<string, unknown>;
+    llmNote?: string;
+}): {
+    id: string;
+    title: string;
+    facts: Record<string, unknown>;
+    hypotheses: string[];
+    recommendedActions: string[];
+    untrustedLlmNote?: string;
+    created_at: string;
+};
+//# sourceMappingURL=task-planner.d.ts.map

package/dist/skills/task-planner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-planner.d.ts","sourceRoot":"","sources":["../../src/skills/task-planner.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAElD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;AAErG,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,EAAE,QAAQ,CAAC;IACf,gBAAgB,EAAE,OAAO,CAAC;IAC1B,MAAM,EAAE,cAAc,CAAC;IACvB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,MAAM;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,UAAU,GAAG,iBAAiB,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAC;IAC1F,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACpC,IAAI,IAAI,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,GAAG;IACzE,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,GAAG,QAAQ,CAAC,EAAE,CAAC;CAC1C,CAsEA;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,SAAS,CAAC;IACrB,KAAK,EAAE,SAAS,CAAC;CAClB,GAAG,MAAM,CAsBT;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,UAAU,GACd,OAAO,CAAC,MAAM,CAAC,CAsBjB;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,MAAM,CAQvE;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG;IACF,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;CACpB,CAyBA"}