ysk-server-core 1.0.0

package/dist/files/shares.js

@@ -0,0 +1,136 @@
+/**
+ * Public file share links (ownCloud-style link share).
+ */
+import { ErrorCodes, YskError, tl } from 'ysk-server-shared';
+import { hashSharePassword, newShareToken, verifySharePasswordHash, } from './manager.js';
+function list(store) {
+    if (!Array.isArray(store.snapshot.file_shares)) {
+        store.snapshot.file_shares = [];
+    }
+    return store.snapshot.file_shares;
+}
+export function listFileShares(store, root) {
+    const all = list(store);
+    if (!root)
+        return all.map((s) => ({ ...s }));
+    return all.filter((s) => s.root === root).map((s) => ({ ...s }));
+}
+export function createFileShare(store, input) {
+    if (!input.path || input.path === '.') {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.needPath'), { httpStatus: 400 });
+    }
+    const modes = normalizeDownloadModes(input.downloadModes);
+    if (modes.includes('bt') && !input.infoHash && input.seedStatus !== 'pending') {
+        // Allow pending: torrent may be created just after row insert by caller
+    }
+    const row = {
+        id: newShareToken().slice(0, 12),
+        token: newShareToken(),
+        root: input.root,
+        path: input.path.replace(/\\/g, '/'),
+        passwordHash: input.password ? hashSharePassword(input.password) : undefined,
+        expiresAt: input.expiresAt,
+        createdAt: new Date().toISOString(),
+        createdBy: input.createdBy,
+        downloadCount: 0,
+        downloadModes: modes,
+        infoHash: input.infoHash,
+        magnetUri: input.magnetUri,
+        torrentRelPath: input.torrentRelPath,
+        seedStatus: input.seedStatus ?? (modes.includes('bt') ? 'pending' : 'none'),
+        seedNotes: input.seedNotes,
+    };
+    list(store).unshift(row);
+    store.persist();
+    return { ...row };
+}
+export function normalizeDownloadModes(raw) {
+    if (!raw)
+        return ['direct'];
+    if (typeof raw === 'string' && raw.trim().toLowerCase() === 'both') {
+        return ['direct', 'bt'];
+    }
+    const list = Array.isArray(raw)
+        ? raw
+        : String(raw)
+            .split(/[|,]/)
+            .map((s) => s.trim().toLowerCase());
+    const out = [];
+    for (const m of list) {
+        if (m === 'both') {
+            if (!out.includes('direct'))
+                out.push('direct');
+            if (!out.includes('bt'))
+                out.push('bt');
+            continue;
+        }
+        if ((m === 'direct' || m === 'bt') && !out.includes(m))
+            out.push(m);
+    }
+    return out.length ? out : ['direct'];
+}
+export function patchFileShare(store, id, patch) {
+    const items = list(store);
+    const row = items.find((s) => s.id === id || s.token === id);
+    if (!row)
+        return null;
+    Object.assign(row, patch, { id: row.id, token: row.token });
+    store.persist();
+    return { ...row };
+}
+export function getFileShareById(store, id) {
+    const row = list(store).find((s) => s.id === id || s.token === id) ?? null;
+    return row ? { ...row } : null;
+}
+export function deleteFileShare(store, id) {
+    const before = list(store).length;
+    store.snapshot.file_shares = list(store).filter((s) => s.id !== id && s.token !== id);
+    store.persist();
+    return list(store).length < before;
+}
+export function getShareByToken(store, token) {
+    const row = list(store).find((s) => s.token === token) ?? null;
+    if (!row)
+        return null;
+    if (row.expiresAt && new Date(row.expiresAt).getTime() < Date.now()) {
+        return null;
+    }
+    return { ...row };
+}
+export function verifySharePassword(row, password) {
+    if (!row.passwordHash)
+        return true;
+    if (!password)
+        return false;
+    return verifySharePasswordHash(row.passwordHash, password);
+}
+export function bumpShareDownload(store, token) {
+    const row = list(store).find((s) => s.token === token);
+    if (row) {
+        row.downloadCount = (row.downloadCount ?? 0) + 1;
+        store.persist();
+    }
+}
+export function listFavorites(store, root) {
+    if (!Array.isArray(store.snapshot.file_favorites))
+        store.snapshot.file_favorites = [];
+    const all = store.snapshot.file_favorites;
+    if (!root)
+        return all.map((f) => ({ ...f }));
+    return all.filter((f) => f.root === root).map((f) => ({ ...f }));
+}
+export function toggleFavorite(store, root, path) {
+    if (!Array.isArray(store.snapshot.file_favorites))
+        store.snapshot.file_favorites = [];
+    const all = store.snapshot.file_favorites;
+    const idx = all.findIndex((f) => f.root === root && f.path === path);
+    if (idx >= 0) {
+        all.splice(idx, 1);
+        store.persist();
+        return { favorited: false };
+    }
+    all.unshift({ root, path, createdAt: new Date().toISOString() });
+    store.persist();
+    return { favorited: true };
+}
+//# sourceMappingURL=shares.js.map

package/dist/files/shares.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shares.js","sourceRoot":"","sources":["../../src/files/shares.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAC,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,uBAAuB,GAExB,MAAM,cAAc,CAAC;AAEtB,SAAS,IAAI,CAAC,KAAgB;IAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/C,KAAK,CAAC,QAAQ,CAAC,WAAW,GAAG,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC,QAAQ,CAAC,WAA2C,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAgB,EAAE,IAAa;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IACxB,IAAI,CAAC,IAAI;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7C,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,KAAgB,EAChB,KAYC;IAED,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;QACtC,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,KAAK,GAAG,sBAAsB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC1D,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC9E,wEAAwE;IAC1E,CAAC;IACD,MAAM,GAAG,GAAoB;QAC3B,EAAE,EAAE,aAAa,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAChC,KAAK,EAAE,aAAa,EAAE;QACtB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;QACpC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;QAC5E,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,aAAa,EAAE,CAAC;QAChB,aAAa,EAAE,KAAK;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3E,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAiC,CAAC,CAAC;IACvD,KAAK,CAAC,OAAO,EAAE,CAAC;IAChB,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,GAA4C;IAE5C,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;QACnE,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAC7B,CAAC,CAAC,GAAG;QACL,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACR,KAAK,CAAC,MAAM,CAAC;aACb,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;YACjB,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAChD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,KAAgB,EAChB,EAAU,EACV,KAA+B;IAE/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IAC5D,KAAK,CAAC,OAAO,EAAE,CAAC;IAChB,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAgB,EAAE,EAAU;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,IAAI,IAAI,CAAC;IAC3E,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAgB,EAAE,EAAU;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IAClC,KAAK,CAAC,QAAQ,CAAC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAC7C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,EAAE,CACQ,CAAC;IAC/C,KAAK,CAAC,OAAO,EAAE,CAAC;IAChB,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAgB,EAAE,KAAa;IAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC;IAC/D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,GAAG,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAoB,EAAE,QAAiB;IACzE,IAAI,CAAC,GAAG,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,OAAO,uBAAuB,CAAC,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAgB,EAAE,KAAa;IAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IACvD,IAAI,GAAG,EAAE,CAAC;QACR,GAAG,CAAC,aAAa,GAAG,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACjD,KAAK,CAAC,OAAO,EAAE,CAAC;IAClB,CAAC;AACH,CAAC;AAID,MAAM,UAAU,aAAa,CAAC,KAAgB,EAAE,IAAa;IAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,KAAK,CAAC,QAAQ,CAAC,cAAc,GAAG,EAAE,CAAC;IACtF,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,cAA6C,CAAC;IACzE,IAAI,CAAC,IAAI;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7C,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,KAAgB,EAChB,IAAY,EACZ,IAAY;IAEZ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,KAAK,CAAC,QAAQ,CAAC,cAAc,GAAG,EAAE,CAAC;IACtF,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,cAA6C,CAAC;IACzE,MAAM,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACrE,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACnB,KAAK,CAAC,OAAO,EAAE,CAAC;QAChB,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IACD,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACjE,KAAK,CAAC,OAAO,EAAE,CAAC;IAChB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC7B,CAAC"}

package/dist/files/versions.d.ts

@@ -0,0 +1,16 @@
+export type FileVersionMeta = {
+    id: string;
+    path: string;
+    createdAt: string;
+    bytes: number;
+    note?: string;
+};
+export declare function versionsRoot(sandboxRoot: string): string;
+export declare function snapshotFileVersion(sandboxRoot: string, absFile: string, relPath: string): FileVersionMeta | null;
+export declare function listFileVersions(sandboxRoot: string, relPath: string): FileVersionMeta[];
+export declare function restoreFileVersion(sandboxRoot: string, relPath: string, versionId: string, writeAbs: (content: Buffer) => void, currentAbs?: string): {
+    ok: boolean;
+    notes: string[];
+};
+export declare function readVersionBytes(sandboxRoot: string, relPath: string, versionId: string): Buffer | null;
+//# sourceMappingURL=versions.d.ts.map

package/dist/files/versions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"versions.d.ts","sourceRoot":"","sources":["../../src/files/versions.ts"],"names":[],"mappings":"AAyBA,MAAM,MAAM,eAAe,GAAG;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAIxD;AAED,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,eAAe,GAAG,IAAI,CA6BxB;AAED,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,eAAe,EAAE,CAaxF;AAED,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,EACnC,UAAU,CAAC,EAAE,MAAM,GAClB;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAclC;AAED,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,IAAI,CAKf"}

package/dist/files/versions.js

@@ -0,0 +1,90 @@
+import { tl } from 'ysk-server-shared';
+/**
+ * File version snapshots under .versions/<encoded-path>/
+ */
+import { mkdirSync, writeFileSync, readFileSync, readdirSync, existsSync, statSync, copyFileSync, rmSync, } from 'node:fs';
+import { join } from 'node:path';
+import { createHash } from 'node:crypto';
+const VERSIONS_DIR = '.versions';
+const MAX_VERSIONS = 20;
+function encodePath(relPath) {
+    return createHash('sha256').update(relPath.replace(/\\/g, '/')).digest('hex').slice(0, 24);
+}
+export function versionsRoot(sandboxRoot) {
+    const r = join(sandboxRoot, VERSIONS_DIR);
+    mkdirSync(r, { recursive: true });
+    return r;
+}
+export function snapshotFileVersion(sandboxRoot, absFile, relPath) {
+    if (!existsSync(absFile) || !statSync(absFile).isFile())
+        return null;
+    const st = statSync(absFile);
+    if (st.size > 20 * 1024 * 1024)
+        return null; // skip >20MB
+    const dir = join(versionsRoot(sandboxRoot), encodePath(relPath));
+    mkdirSync(dir, { recursive: true });
+    const id = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+    const dest = join(dir, id);
+    copyFileSync(absFile, dest);
+    const meta = {
+        id,
+        path: relPath.replace(/\\/g, '/'),
+        createdAt: new Date().toISOString(),
+        bytes: st.size,
+    };
+    writeFileSync(join(dir, `${id}.json`), JSON.stringify(meta), 'utf8');
+    // prune
+    const metas = listFileVersions(sandboxRoot, relPath);
+    if (metas.length > MAX_VERSIONS) {
+        for (const old of metas.slice(MAX_VERSIONS)) {
+            try {
+                rmSync(join(dir, old.id), { force: true });
+                rmSync(join(dir, `${old.id}.json`), { force: true });
+            }
+            catch {
+                /* ignore */
+            }
+        }
+    }
+    return meta;
+}
+export function listFileVersions(sandboxRoot, relPath) {
+    const dir = join(versionsRoot(sandboxRoot), encodePath(relPath));
+    if (!existsSync(dir))
+        return [];
+    const out = [];
+    for (const name of readdirSync(dir)) {
+        if (!name.endsWith('.json'))
+            continue;
+        try {
+            out.push(JSON.parse(readFileSync(join(dir, name), 'utf8')));
+        }
+        catch {
+            /* skip */
+        }
+    }
+    return out.sort((a, b) => (a.createdAt < b.createdAt ? 1 : -1));
+}
+export function restoreFileVersion(sandboxRoot, relPath, versionId, writeAbs, currentAbs) {
+    const safe = versionId.replace(/[^a-zA-Z0-9._-]/g, '');
+    const dir = join(versionsRoot(sandboxRoot), encodePath(relPath));
+    const src = join(dir, safe);
+    if (!existsSync(src)) {
+        return { ok: false, notes: [tl('notes.auto.n0865')] };
+    }
+    // snapshot current before restore
+    if (currentAbs && existsSync(currentAbs)) {
+        snapshotFileVersion(sandboxRoot, currentAbs, relPath);
+    }
+    const buf = readFileSync(src);
+    writeAbs(buf);
+    return { ok: true, notes: [tl('notes.auto.t0002', { v0: (safe) })] };
+}
+export function readVersionBytes(sandboxRoot, relPath, versionId) {
+    const safe = versionId.replace(/[^a-zA-Z0-9._-]/g, '');
+    const src = join(versionsRoot(sandboxRoot), encodePath(relPath), safe);
+    if (!existsSync(src))
+        return null;
+    return readFileSync(src);
+}
+//# sourceMappingURL=versions.js.map

package/dist/files/versions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"versions.js","sourceRoot":"","sources":["../../src/files/versions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC;;GAEG;AAEH,OAAO,EACL,SAAS,EACT,aAAa,EACb,YAAY,EACZ,WAAW,EACX,UAAU,EACV,QAAQ,EACR,YAAY,EACZ,MAAM,GACP,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,YAAY,GAAG,WAAW,CAAC;AACjC,MAAM,YAAY,GAAG,EAAE,CAAC;AAExB,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC7F,CAAC;AAUD,MAAM,UAAU,YAAY,CAAC,WAAmB;IAC9C,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IAC1C,SAAS,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,WAAmB,EACnB,OAAe,EACf,OAAe;IAEf,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE;QAAE,OAAO,IAAI,CAAC;IACrE,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,EAAE,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,aAAa;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IACjE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC3B,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAoB;QAC5B,EAAE;QACF,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;QACjC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,KAAK,EAAE,EAAE,CAAC,IAAI;KACf,CAAC;IACF,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IACrE,QAAQ;IACR,MAAM,KAAK,GAAG,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACrD,IAAI,KAAK,CAAC,MAAM,GAAG,YAAY,EAAE,CAAC;QAChC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC3C,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,WAAmB,EAAE,OAAe;IACnE,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IACjE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAoB,CAAC,CAAC;QACjF,CAAC;QAAC,MAAM,CAAC;YACP,UAAU;QACZ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,WAAmB,EACnB,OAAe,EACf,SAAiB,EACjB,QAAmC,EACnC,UAAmB;IAEnB,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;IACxD,CAAC;IACD,kCAAkC;IAClC,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACzC,mBAAmB,CAAC,WAAW,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC9B,QAAQ,CAAC,GAAG,CAAC,CAAC;IACd,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,WAAmB,EACnB,OAAe,EACf,SAAiB;IAEjB,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;IACvE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC"}

package/dist/files/webdav.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Minimal WebDAV settings + PROPFIND XML helpers (managed under panel).
+ * Real PROPFIND/PUT handlers live in server controller; this is control-plane config.
+ */
+import type { JsonStore } from '../db/store.js';
+/** Fixed Basic username for WebDAV (password = issued token). */
+export declare const WEBDAV_USERNAME = "ysk";
+export type WebDavSettings = {
+    enabled: boolean;
+    /** path prefix e.g. /webdav */
+    mountPath: string;
+    /** bcrypt-less token hash for Basic password (token is the password; user=ysk) */
+    tokenHash?: string;
+    /** last issued token id (not the secret) */
+    tokenId?: string;
+    updated_at?: string;
+};
+export declare function getWebDavSettings(db: JsonStore): WebDavSettings;
+export declare function setWebDavSettings(db: JsonStore, patch: Partial<WebDavSettings>): WebDavSettings;
+/** Issue new access token; returns plaintext once. */
+export declare function issueWebDavToken(db: JsonStore): {
+    settings: WebDavSettings;
+    token: string;
+    notes: string[];
+};
+export declare function verifyWebDavToken(db: JsonStore, password: string): boolean;
+/**
+ * Parse HTTP Basic credentials. Username must be WEBDAV_USERNAME.
+ * Returns false if header missing/malformed or user/password wrong.
+ */
+export declare function verifyWebDavBasicAuth(db: JsonStore, authorizationHeader: string | undefined): boolean;
+export declare function buildPropfindResponse(input: {
+    href: string;
+    entries: Array<{
+        name: string;
+        href: string;
+        isDir: boolean;
+        size: number;
+        mtime: string;
+    }>;
+}): string;
+//# sourceMappingURL=webdav.d.ts.map

package/dist/files/webdav.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webdav.d.ts","sourceRoot":"","sources":["../../src/files/webdav.ts"],"names":[],"mappings":"AACA;;;GAGG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAGhD,iEAAiE;AACjE,eAAO,MAAM,eAAe,QAAQ,CAAC;AAErC,MAAM,MAAM,cAAc,GAAG;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAIF,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,SAAS,GAAG,cAAc,CAU/D;AAED,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,SAAS,EACb,KAAK,EAAE,OAAO,CAAC,cAAc,CAAC,GAC7B,cAAc,CAKhB;AAED,sDAAsD;AACtD,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,SAAS,GAAG;IAC/C,QAAQ,EAAE,cAAc,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CAiBA;AAED,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAY1E;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,EAAE,EAAE,SAAS,EACb,mBAAmB,EAAE,MAAM,GAAG,SAAS,GACtC,OAAO,CAcT;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC7F,GAAG,MAAM,CA4BT"}

package/dist/files/webdav.js

@@ -0,0 +1,116 @@
+import { tl } from 'ysk-server-shared';
+import { randomBytes, createHash, timingSafeEqual } from 'node:crypto';
+/** Fixed Basic username for WebDAV (password = issued token). */
+export const WEBDAV_USERNAME = 'ysk';
+const KEY = 'webdav_settings';
+export function getWebDavSettings(db) {
+    const raw = db.snapshot.settings?.[KEY];
+    if (!raw) {
+        return { enabled: false, mountPath: '/webdav' };
+    }
+    try {
+        return { enabled: false, mountPath: '/webdav', ...JSON.parse(raw) };
+    }
+    catch {
+        return { enabled: false, mountPath: '/webdav' };
+    }
+}
+export function setWebDavSettings(db, patch) {
+    const next = { ...getWebDavSettings(db), ...patch, updated_at: new Date().toISOString() };
+    db.snapshot.settings[KEY] = JSON.stringify(next);
+    db.persist();
+    return { ...next };
+}
+/** Issue new access token; returns plaintext once. */
+export function issueWebDavToken(db) {
+    const token = randomBytes(24).toString('base64url');
+    const tokenHash = createHash('sha256').update(token).digest('hex');
+    const tokenId = randomBytes(4).toString('hex');
+    const settings = setWebDavSettings(db, {
+        enabled: true,
+        tokenHash,
+        tokenId,
+    });
+    return {
+        settings,
+        token,
+        notes: [
+            tl('notes.auto.n0748'),
+            tl('notes.auto.n0471'),
+        ],
+    };
+}
+export function verifyWebDavToken(db, password) {
+    const s = getWebDavSettings(db);
+    if (!s.enabled || !s.tokenHash || !password)
+        return false;
+    const h = createHash('sha256').update(password).digest('hex');
+    try {
+        const a = Buffer.from(h, 'utf8');
+        const b = Buffer.from(String(s.tokenHash), 'utf8');
+        if (a.length !== b.length)
+            return false;
+        return timingSafeEqual(a, b);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Parse HTTP Basic credentials. Username must be WEBDAV_USERNAME.
+ * Returns false if header missing/malformed or user/password wrong.
+ */
+export function verifyWebDavBasicAuth(db, authorizationHeader) {
+    const auth = authorizationHeader ?? '';
+    if (!auth.startsWith('Basic '))
+        return false;
+    try {
+        const decoded = Buffer.from(auth.slice(6), 'base64').toString('utf8');
+        const colon = decoded.indexOf(':');
+        if (colon < 0)
+            return false;
+        const user = decoded.slice(0, colon);
+        const pass = decoded.slice(colon + 1);
+        if (user !== WEBDAV_USERNAME)
+            return false;
+        return verifyWebDavToken(db, pass);
+    }
+    catch {
+        return false;
+    }
+}
+export function buildPropfindResponse(input) {
+    const rows = input.entries
+        .map((e) => `
+  <D:response>
+    <D:href>${escapeXml(e.href)}</D:href>
+    <D:propstat>
+      <D:prop>
+        <D:displayname>${escapeXml(e.name)}</D:displayname>
+        <D:getcontentlength>${e.isDir ? 0 : e.size}</D:getcontentlength>
+        <D:getlastmodified>${escapeXml(e.mtime)}</D:getlastmodified>
+        <D:resourcetype>${e.isDir ? '<D:collection/>' : ''}</D:resourcetype>
+      </D:prop>
+      <D:status>HTTP/1.1 200 OK</D:status>
+    </D:propstat>
+  </D:response>`)
+        .join('');
+    return `<?xml version="1.0" encoding="utf-8"?>
+<D:multistatus xmlns:D="DAV:">
+  <D:response>
+    <D:href>${escapeXml(input.href)}</D:href>
+    <D:propstat>
+      <D:prop><D:resourcetype><D:collection/></D:resourcetype></D:prop>
+      <D:status>HTTP/1.1 200 OK</D:status>
+    </D:propstat>
+  </D:response>${rows}
+</D:multistatus>`;
+}
+function escapeXml(s) {
+    return s
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;');
+}
+//# sourceMappingURL=webdav.js.map

package/dist/files/webdav.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webdav.js","sourceRoot":"","sources":["../../src/files/webdav.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAOvC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE,iEAAiE;AACjE,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC;AAarC,MAAM,GAAG,GAAG,iBAAiB,CAAC;AAE9B,MAAM,UAAU,iBAAiB,CAAC,EAAa;IAC7C,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IAClD,CAAC;IACD,IAAI,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAoB,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IAClD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,EAAa,EACb,KAA8B;IAE9B,MAAM,IAAI,GAAG,EAAE,GAAG,iBAAiB,CAAC,EAAE,CAAC,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IAC1F,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACjD,EAAE,CAAC,OAAO,EAAE,CAAC;IACb,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;AACrB,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,gBAAgB,CAAC,EAAa;IAK5C,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,EAAE,EAAE;QACrC,OAAO,EAAE,IAAI;QACb,SAAS;QACT,OAAO;KACR,CAAC,CAAC;IACH,OAAO;QACL,QAAQ;QACR,KAAK;QACL,KAAK,EAAE;YACL,EAAE,CAAC,kBAAkB,CAAC;YACtB,EAAE,CAAC,kBAAkB,CAAC;SACvB;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,EAAa,EAAE,QAAgB;IAC/D,MAAM,CAAC,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACxC,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,EAAa,EACb,mBAAuC;IAEvC,MAAM,IAAI,GAAG,mBAAmB,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtE,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACtC,IAAI,IAAI,KAAK,eAAe;YAAE,OAAO,KAAK,CAAC;QAC3C,OAAO,iBAAiB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAGrC;IACC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO;SACvB,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CAAC;;cAEC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;;;yBAGN,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;8BACZ,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;6BACrB,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;0BACrB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE;;;;gBAI1C,CACX;SACA,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,OAAO;;;cAGK,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;;;;;iBAKlB,IAAI;iBACJ,CAAC;AAClB,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,CAAC;SACL,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC"}

package/dist/host/executor.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Local host executor — real filesystem / process operations.
+ * High-risk commands only run when explicitly allowed by policy layer.
+ */
+export interface RunResult {
+    stdout: string;
+    stderr: string;
+    exitCode: number;
+    argv: string[];
+    dryRun: boolean;
+}
+/** Live output callback for long installs (apt, curl, …). */
+export type CommandChunkHandler = (chunk: {
+    stream: 'stdout' | 'stderr';
+    text: string;
+}) => void;
+export type RunCommandOpts = {
+    dryRun?: boolean;
+    timeoutMs?: number;
+    cwd?: string;
+    /** When set, use spawn and stream chunks as they arrive (line-ish). */
+    onChunk?: CommandChunkHandler;
+    /** Abort long installs (SSE client disconnect / cancel). */
+    signal?: AbortSignal;
+};
+export interface HostExecutor {
+    readFile(path: string): Promise<string>;
+    listDir(path: string): Promise<string[]>;
+    writeFile(path: string, content: string): Promise<void>;
+    deletePath(path: string): Promise<void>;
+    mkdirp(path: string): Promise<void>;
+    sysInfo(): Promise<Record<string, unknown>>;
+    serviceStatus(name: string): Promise<RunResult>;
+    runCommand(argv: string[], opts?: RunCommandOpts): Promise<RunResult>;
+    pathExists(path: string): boolean;
+    isRoot(): boolean;
+    executeEnabled(): boolean;
+}
+export interface LocalHostExecutorOptions {
+    /** When false, mutating runCommand refuses unless dryRun */
+    executeEnabled?: boolean;
+    /** Restrict writes to these roots (fail closed outside) */
+    allowedWriteRoots?: string[];
+}
+/**
+ * Real local executor used by control plane tools.
+ */
+export declare class LocalHostExecutor implements HostExecutor {
+    private readonly executeOn;
+    private readonly writeRoots;
+    constructor(opts?: LocalHostExecutorOptions);
+    isRoot(): boolean;
+    executeEnabled(): boolean;
+    pathExists(path: string): boolean;
+    readFile(path: string): Promise<string>;
+    listDir(path: string): Promise<string[]>;
+    writeFile(path: string, content: string): Promise<void>;
+    deletePath(path: string): Promise<void>;
+    mkdirp(path: string): Promise<void>;
+    sysInfo(): Promise<Record<string, unknown>>;
+    serviceStatus(name: string): Promise<RunResult>;
+    runCommand(argv: string[], opts?: RunCommandOpts): Promise<RunResult>;
+    private isUnderWriteRoots;
+    private assertWritable;
+}
+/**
+ * Boundary-safe path containment (resolve + prefix). Prevents `/tmp/../etc` escaping
+ * string-prefix roots.
+ */
+export declare function pathUnderRoot(root: string, target: string): boolean;
+/**
+ * True when argv requires YSK_EXECUTE.
+ * Fail-closed: unknown binaries / free-form shell default to mutating.
+ * Exported for unit tests and security audits.
+ */
+export declare function commandRequiresExecute(argv: string[]): boolean;
+/**
+ * Spawn process and stream stdout/stderr as line-oriented chunks.
+ * Used for long runtime installs so the panel can show live progress.
+ */
+export declare function runCommandStreaming(argv: string[], opts: {
+    timeoutMs: number;
+    cwd?: string;
+    onChunk: CommandChunkHandler;
+    signal?: AbortSignal;
+}): Promise<RunResult>;
+/** Append a line to audit file (best-effort side channel). */
+export declare function appendHostLog(logPath: string, line: string): void;
+export declare function fileStatSafe(path: string): {
+    size: number;
+    isFile: boolean;
+} | null;
+//# sourceMappingURL=executor.d.ts.map

package/dist/host/executor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../src/host/executor.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAoBH,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,6DAA6D;AAC7D,MAAM,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE;IACxC,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;CACd,KAAK,IAAI,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAC9B,4DAA4D;IAC5D,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,CAAC;AAEF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACzC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5C,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAChD,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACtE,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAClC,MAAM,IAAI,OAAO,CAAC;IAClB,cAAc,IAAI,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,wBAAwB;IACvC,4DAA4D;IAC5D,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,2DAA2D;IAC3D,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED;;GAEG;AACH,qBAAa,iBAAkB,YAAW,YAAY;IACpD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAU;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAW;gBAE1B,IAAI,GAAE,wBAA6B;IAO/C,MAAM,IAAI,OAAO;IAIjB,cAAc,IAAI,OAAO;IAIzB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI3B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAWvC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAWxC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBvD,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAavC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBnC,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAqB3C,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAS/C,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,GAAE,cAAmB,GAAG,OAAO,CAAC,SAAS,CAAC;IAiD/E,OAAO,CAAC,iBAAiB;IAKzB,OAAO,CAAC,cAAc;CASvB;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAUnE;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAE9D;AAkaD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE;IACJ,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,mBAAmB,CAAC;IAC7B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,GACA,OAAO,CAAC,SAAS,CAAC,CAwHpB;AAED,8DAA8D;AAC9D,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAOjE;AAOD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAOnF"}