ysk-server-core 1.0.0

package/dist/hosting/cdn/sites.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sites.d.ts","sourceRoot":"","sources":["../../../src/hosting/cdn/sites.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAGL,KAAK,WAAW,EAEhB,KAAK,UAAU,EACf,KAAK,WAAW,EAAM,MAAM,mBAAmB,CAAC;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAenD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,IAAI,CAAC,EAAE,WAAW,GAAG,MAAM,CAAC;IAC5B,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,GAAG,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IACrC,GAAG,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;CAClC,CAAC;AA8KF,wBAAgB,YAAY,CAAC,EAAE,EAAE,SAAS,GAAG,UAAU,EAAE,CAExD;AAED,wBAAgB,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAEvE;AAED,wBAAgB,aAAa,CAC3B,EAAE,EAAE,SAAS,EACb,KAAK,EAAE,kBAAkB,GACxB,UAAU,CA0EZ;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAMhE;AAED,wBAAgB,kBAAkB,CAChC,EAAE,EAAE,SAAS,EACb,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;IACL,YAAY,CAAC,EAAE,WAAW,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CAC3C,GACA,UAAU,CAcZ"}

package/dist/hosting/cdn/sites.js

@@ -0,0 +1,265 @@
+/**
+ * CDN site policy store (PR-C2).
+ * Sites describe domains/origin/edges/cache; apply is separate (render/fan-out).
+ */
+import { randomUUID } from 'node:crypto';
+import { ErrorCodes, YskError, tl } from 'ysk-server-shared';
+import { getCdnNode, listCdnNodes } from './nodes.js';
+const KEY = 'cdn_sites';
+const MAX = 50;
+const MODES = ['origin_pull', 'reverse_proxy', 'static_edge'];
+const STRATEGIES = [
+    'single',
+    'multi_a',
+    'failover',
+    'weighted',
+    'geo',
+];
+function loadAll(db) {
+    try {
+        return JSON.parse(db.snapshot.settings?.[KEY] ?? '[]');
+    }
+    catch {
+        return [];
+    }
+}
+function saveAll(db, sites) {
+    db.snapshot.settings[KEY] = JSON.stringify(sites.slice(0, MAX));
+    db.persist();
+}
+function assertName(name) {
+    const n = name.trim();
+    if (!n || n.length > 80) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n1300'), {
+            httpStatus: 400
+        });
+    }
+    return n;
+}
+function normalizeDomains(raw) {
+    const list = (raw ?? [])
+        .map((d) => String(d).trim().toLowerCase().replace(/\.$/, ''))
+        .filter(Boolean);
+    const uniq = [...new Set(list)];
+    if (!uniq.length) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n1341'), {
+            httpStatus: 400
+        });
+    }
+    for (const d of uniq) {
+        if (d.length > 253 || !/^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$/i.test(d)) {
+            throw new YskError(ErrorCodes.VALIDATION, tl('notes.tpl.domainInvalid', { domain: d }), {
+                httpStatus: 400
+            });
+        }
+    }
+    return uniq.slice(0, 20);
+}
+function normalizeMode(raw) {
+    const m = (raw ?? 'origin_pull').toLowerCase();
+    if (!MODES.includes(m)) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.t0696', { v0: (raw) }), {
+            httpStatus: 400
+        });
+    }
+    return m;
+}
+function normalizeOrigin(raw, prev) {
+    const kind = raw?.kind ?? prev?.kind ?? 'url';
+    if (kind !== 'project' && kind !== 'url') {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n0356'), {
+            httpStatus: 400
+        });
+    }
+    if (kind === 'project') {
+        const projectId = (raw?.projectId ?? prev?.projectId ?? '').trim();
+        if (!projectId) {
+            throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n0357'), {
+                httpStatus: 400
+            });
+        }
+        return {
+            kind: 'project',
+            projectId,
+            url: raw?.url ?? prev?.url,
+            sni: raw?.sni ?? prev?.sni
+        };
+    }
+    const url = (raw?.url ?? prev?.url ?? '').trim();
+    if (!url || !/^https?:\/\//i.test(url)) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n0358'), {
+            httpStatus: 400
+        });
+    }
+    return {
+        kind: 'url',
+        url,
+        sni: raw?.sni ?? prev?.sni
+    };
+}
+function normalizeEdges(db, ids, prev) {
+    const list = [...new Set((ids ?? prev ?? []).map((x) => String(x).trim()).filter(Boolean))];
+    if (!list.length) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n1340'), {
+            httpStatus: 400
+        });
+    }
+    for (const id of list) {
+        const n = getCdnNode(db, id);
+        if (!n) {
+            throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.t0697', { v0: (id) }), {
+                httpStatus: 400
+            });
+        }
+        if (!n.roles.includes('edge') && !n.roles.includes('origin')) {
+            // allow origin-only as temporary single-node; warn via roles still ok if has any role
+            // Strict: prefer edge role
+            if (!n.roles.includes('control')) {
+                throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.t0698', { v0: (n.name) }), { httpStatus: 400 });
+            }
+        }
+    }
+    return list.slice(0, 32);
+}
+function defaultDns(partial, prev) {
+    const strategy = (partial?.strategy ??
+        prev?.strategy ??
+        'multi_a');
+    if (!STRATEGIES.includes(strategy)) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.t0699', { v0: (strategy) }), {
+            httpStatus: 400
+        });
+    }
+    return {
+        zoneId: partial?.zoneId ?? prev?.zoneId,
+        strategy,
+        ttlHealthy: Math.max(30, Math.min(3600, partial?.ttlHealthy ?? prev?.ttlHealthy ?? 60)),
+        ttlUnhealthy: Math.max(10, Math.min(600, partial?.ttlUnhealthy ?? prev?.ttlUnhealthy ?? 30)),
+        minHealthyEdges: Math.max(1, Math.min(16, partial?.minHealthyEdges ?? prev?.minHealthyEdges ?? 1)),
+        geoMap: partial?.geoMap ?? prev?.geoMap,
+        geoSubdomains: partial?.geoSubdomains ?? prev?.geoSubdomains ?? false,
+        geoDefaultRegion: (partial?.geoDefaultRegion ?? prev?.geoDefaultRegion)?.trim() ||
+            undefined
+    };
+}
+function defaultCache(partial, prev) {
+    return {
+        enabled: partial?.enabled ?? prev?.enabled ?? true,
+        zoneSize: (partial?.zoneSize ?? prev?.zoneSize ?? '10m').trim() || '10m',
+        maxAge: (partial?.maxAge ?? prev?.maxAge ?? '10m').trim() || '10m',
+        bypassCookies: partial?.bypassCookies ?? prev?.bypassCookies ?? true,
+        bypassAuth: partial?.bypassAuth ?? prev?.bypassAuth ?? true
+    };
+}
+function defaultSsl(partial, prev) {
+    const mode = partial?.mode ?? prev?.mode ?? 'off';
+    if (!['off', 'le_http01', 'le_dns01', 'upload'].includes(mode)) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.t0700', { v0: (mode) }), {
+            httpStatus: 400
+        });
+    }
+    return {
+        mode,
+        certId: partial?.certId ?? prev?.certId
+    };
+}
+export function listCdnSites(db) {
+    return loadAll(db);
+}
+export function getCdnSite(db, id) {
+    return loadAll(db).find((s) => s.id === id) ?? null;
+}
+export function upsertCdnSite(db, input) {
+    const all = loadAll(db);
+    const id = input.id?.trim() || randomUUID();
+    const prev = all.find((s) => s.id === id);
+    if (!prev && all.length >= MAX) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.t0701', { v0: (MAX) }), {
+            httpStatus: 400
+        });
+    }
+    // Ensure at least one node exists for edge binding
+    if (!listCdnNodes(db).length) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n1380'), {
+            httpStatus: 400
+        });
+    }
+    let originShieldNodeId;
+    if (input.originShieldNodeId === null) {
+        originShieldNodeId = undefined;
+    }
+    else if (input.originShieldNodeId?.trim()) {
+        const sid = input.originShieldNodeId.trim();
+        const n = getCdnNode(db, sid);
+        if (!n) {
+            throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.t0702', { v0: (sid) }), {
+                httpStatus: 400
+            });
+        }
+        originShieldNodeId = sid;
+    }
+    else {
+        originShieldNodeId = prev?.originShieldNodeId;
+    }
+    const row = {
+        id,
+        name: assertName(input.name),
+        domains: normalizeDomains(input.domains ?? prev?.domains),
+        mode: normalizeMode(input.mode ?? prev?.mode),
+        origin: normalizeOrigin(input.origin, prev?.origin),
+        edgeNodeIds: normalizeEdges(db, input.edgeNodeIds, prev?.edgeNodeIds),
+        originShieldNodeId,
+        dns: defaultDns(input.dns, prev?.dns),
+        cache: defaultCache(input.cache, prev?.cache),
+        ssl: defaultSsl(input.ssl, prev?.ssl),
+        apply_status: prev?.apply_status ?? 'draft',
+        edge_status: prev?.edge_status ?? {}
+    };
+    // Shield must be one of the site edges
+    if (row.originShieldNodeId &&
+        !row.edgeNodeIds.includes(row.originShieldNodeId)) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n0359'), { httpStatus: 400 });
+    }
+    // New domains/origin/edges reset overall status to draft if content-ish change
+    if (prev) {
+        const changed = prev.domains.join() !== row.domains.join() ||
+            prev.origin.url !== row.origin.url ||
+            prev.origin.projectId !== row.origin.projectId ||
+            prev.edgeNodeIds.join() !== row.edgeNodeIds.join() ||
+            prev.mode !== row.mode ||
+            JSON.stringify(prev.cache) !== JSON.stringify(row.cache);
+        if (changed && prev.apply_status === 'applied') {
+            row.apply_status = 'draft';
+            row.edge_status = {};
+        }
+    }
+    const next = [row, ...all.filter((s) => s.id !== id)];
+    saveAll(db, next);
+    return row;
+}
+export function deleteCdnSite(db, id) {
+    const all = loadAll(db);
+    const next = all.filter((s) => s.id !== id);
+    if (next.length === all.length)
+        return false;
+    saveAll(db, next);
+    return true;
+}
+export function patchCdnSiteStatus(db, id, patch) {
+    const site = getCdnSite(db, id);
+    if (!site) {
+        throw new YskError(ErrorCodes.NOT_FOUND, tl('notes.cdn.siteNotFound'), {
+            httpStatus: 404,
+            details: { id }
+        });
+    }
+    const updated = {
+        ...site,
+        apply_status: patch.apply_status ?? site.apply_status,
+        edge_status: patch.edge_status ?? site.edge_status
+    };
+    const all = loadAll(db).map((s) => (s.id === id ? updated : s));
+    saveAll(db, all);
+    return updated;
+}
+//# sourceMappingURL=sites.js.map

package/dist/hosting/cdn/sites.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sites.js","sourceRoot":"","sources":["../../../src/hosting/cdn/sites.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,UAAU,EACV,QAAQ,EAIW,EAAE,EAAC,MAAM,mBAAmB,CAAC;AAElD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAEtD,MAAM,GAAG,GAAG,WAAW,CAAC;AACxB,MAAM,GAAG,GAAG,EAAE,CAAC;AAEf,MAAM,KAAK,GAAkB,CAAC,aAAa,EAAE,eAAe,EAAE,aAAa,CAAC,CAAC;AAC7E,MAAM,UAAU,GAAqB;IACnC,QAAQ;IACR,SAAS;IACT,UAAU;IACV,UAAU;IACV,KAAK;CACN,CAAC;AAeF,SAAS,OAAO,CAAC,EAAa;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,CAAiB,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,EAAa,EAAE,KAAmB;IACjD,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAChE,EAAE,CAAC,OAAO,EAAE,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE;YAChE,UAAU,EAAE,GAAG;SAAE,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAc;IACtC,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;SACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;SAC7D,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE;YAChE,UAAU,EAAE,GAAG;SAAE,CAAC,CAAC;IACvB,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,mCAAmC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE;gBACtF,UAAU,EAAE,GAAG;aAAE,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,aAAa,CAAC,GAAY;IACjC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,aAAa,CAAC,CAAC,WAAW,EAAiB,CAAC;IAC9D,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;YAC/E,UAAU,EAAE,GAAG;SAAE,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,eAAe,CACtB,GAA0B,EAC1B,IAA2B;IAE3B,MAAM,IAAI,GAAG,GAAG,EAAE,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,KAAK,CAAC;IAC9C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACzC,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE;YAChE,UAAU,EAAE,GAAG;SAAE,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,SAAS,IAAI,IAAI,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACnE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE;gBAChE,UAAU,EAAE,GAAG;aAAE,CAAC,CAAC;QACvB,CAAC;QACD,OAAO;YACL,IAAI,EAAE,SAAS;YACf,SAAS;YACT,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,IAAI,EAAE,GAAG;YAC1B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,IAAI,EAAE,GAAG;SAAE,CAAC;IACjC,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,IAAI,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE;YAChE,UAAU,EAAE,GAAG;SAAE,CAAC,CAAC;IACvB,CAAC;IACD,OAAO;QACL,IAAI,EAAE,KAAK;QACX,GAAG;QACH,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,IAAI,EAAE,GAAG;KAAE,CAAC;AACjC,CAAC;AAED,SAAS,cAAc,CACrB,EAAa,EACb,GAAyB,EACzB,IAAe;IAEf,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5F,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE;YAChE,UAAU,EAAE,GAAG;SAAE,CAAC,CAAC;IACvB,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC7B,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE;gBAC9E,UAAU,EAAE,GAAG;aAAE,CAAC,CAAC;QACvB,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7D,sFAAsF;YACtF,2BAA2B;YAC3B,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,QAAQ,CAChB,UAAU,CAAC,UAAU,EACrB,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EACxC,EAAE,UAAU,EAAE,GAAG,EAAE,CACpB,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,UAAU,CACjB,OAAoC,EACpC,IAAwB;IAExB,MAAM,QAAQ,GAAG,CAAC,OAAO,EAAE,QAAQ;QACjC,IAAI,EAAE,QAAQ;QACd,SAAS,CAAmB,CAAC;IAC/B,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE;YACpF,UAAU,EAAE,GAAG;SAAE,CAAC,CAAC;IACvB,CAAC;IACD,OAAO;QACL,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,IAAI,EAAE,MAAM;QACvC,QAAQ;QACR,UAAU,EAAE,IAAI,CAAC,GAAG,CAClB,EAAE,EACF,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,IAAI,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC,CAC9D;QACD,YAAY,EAAE,IAAI,CAAC,GAAG,CACpB,EAAE,EACF,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,YAAY,IAAI,IAAI,EAAE,YAAY,IAAI,EAAE,CAAC,CACjE;QACD,eAAe,EAAE,IAAI,CAAC,GAAG,CACvB,CAAC,EACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,eAAe,IAAI,IAAI,EAAE,eAAe,IAAI,CAAC,CAAC,CACrE;QACD,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,IAAI,EAAE,MAAM;QACvC,aAAa,EACX,OAAO,EAAE,aAAa,IAAI,IAAI,EAAE,aAAa,IAAI,KAAK;QACxD,gBAAgB,EACd,CAAC,OAAO,EAAE,gBAAgB,IAAI,IAAI,EAAE,gBAAgB,CAAC,EAAE,IAAI,EAAE;YAC7D,SAAS;KAAE,CAAC;AAClB,CAAC;AAED,SAAS,YAAY,CACnB,OAAsC,EACtC,IAA0B;IAE1B,OAAO;QACL,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,IAAI,EAAE,OAAO,IAAI,IAAI;QAClD,QAAQ,EAAE,CAAC,OAAO,EAAE,QAAQ,IAAI,IAAI,EAAE,QAAQ,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK;QACxE,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,IAAI,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK;QAClE,aAAa,EAAE,OAAO,EAAE,aAAa,IAAI,IAAI,EAAE,aAAa,IAAI,IAAI;QACpE,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,IAAI,EAAE,UAAU,IAAI,IAAI;KAAE,CAAC;AAClE,CAAC;AAED,SAAS,UAAU,CACjB,OAAoC,EACpC,IAAwB;IAExB,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,KAAK,CAAC;IAClD,IAAI,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;YAChF,UAAU,EAAE,GAAG;SAAE,CAAC,CAAC;IACvB,CAAC;IACD,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,IAAI,EAAE,MAAM;KAAE,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,EAAa;IACxC,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,EAAa,EAAE,EAAU;IAClD,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,EAAa,EACb,KAAyB;IAEzB,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;IACxB,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,UAAU,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC/B,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;YAC/E,UAAU,EAAE,GAAG;SAAE,CAAC,CAAC;IACvB,CAAC;IAED,mDAAmD;IACnD,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE;YAChE,UAAU,EAAE,GAAG;SAAE,CAAC,CAAC;IACvB,CAAC;IAED,IAAI,kBAAsC,CAAC;IAC3C,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;QACtC,kBAAkB,GAAG,SAAS,CAAC;IACjC,CAAC;SAAM,IAAI,KAAK,CAAC,kBAAkB,EAAE,IAAI,EAAE,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;gBAC/E,UAAU,EAAE,GAAG;aAAE,CAAC,CAAC;QACvB,CAAC;QACD,kBAAkB,GAAG,GAAG,CAAC;IAC3B,CAAC;SAAM,CAAC;QACN,kBAAkB,GAAG,IAAI,EAAE,kBAAkB,CAAC;IAChD,CAAC;IAED,MAAM,GAAG,GAAe;QACtB,EAAE;QACF,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC;QAC5B,OAAO,EAAE,gBAAgB,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,EAAE,OAAO,CAAC;QACzD,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,EAAE,IAAI,CAAC;QAC7C,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC;QACnD,WAAW,EAAE,cAAc,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,WAAW,CAAC;QACrE,kBAAkB;QAClB,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC;QACrC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC;QAC7C,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC;QACrC,YAAY,EAAE,IAAI,EAAE,YAAY,IAAI,OAAO;QAC3C,WAAW,EAAE,IAAI,EAAE,WAAW,IAAI,EAAE;KAAE,CAAC;IAEzC,uCAAuC;IACvC,IACE,GAAG,CAAC,kBAAkB;QACtB,CAAC,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,kBAAkB,CAAC,EACjD,CAAC;QACD,MAAM,IAAI,QAAQ,CAChB,UAAU,CAAC,UAAU,EACrB,EAAE,CAAC,kBAAkB,CAAC,EACtB,EAAE,UAAU,EAAE,GAAG,EAAE,CACpB,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,OAAO,GACX,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE;YAC1C,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG;YAClC,IAAI,CAAC,MAAM,CAAC,SAAS,KAAK,GAAG,CAAC,MAAM,CAAC,SAAS;YAC9C,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE;YAClD,IAAI,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI;YACtB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,OAAO,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/C,GAAG,CAAC,YAAY,GAAG,OAAO,CAAC;YAC3B,GAAG,CAAC,WAAW,GAAG,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAClB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,EAAa,EAAE,EAAU;IACrD,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;IACxB,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5C,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAClB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,EAAa,EACb,EAAU,EACV,KAGC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAChC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC,wBAAwB,CAAC,EAAE;YACrE,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,EAAE,EAAE,EAAE;SAAE,CAAC,CAAC;IACvB,CAAC;IACD,MAAM,OAAO,GAAe;QAC1B,GAAG,IAAI;QACP,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY;QACrD,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW;KAAE,CAAC;IACvD,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACjB,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/hosting/cdn/ssl.d.ts

@@ -0,0 +1,82 @@
+/**
+ * CDN SSL: resolve certs, LE issue (http-01), distribute PEM to edges (PR-C6).
+ * Honesty: certbot success ≠ all edges TLS-ready until distribute+reload.
+ */
+import { type ApplyStatus, type CdnSiteDto } from 'ysk-server-shared';
+import type { JsonStore } from '../../db/store.js';
+import type { HostExecutor } from '../../host/executor.js';
+import { type CdnEdgeSslPaths } from './edge-render.js';
+import { type CdnFanOutResult } from './fan-out.js';
+export type CdnCertResolve = {
+    ok: boolean;
+    domain: string;
+    fullchain: string;
+    privkey: string;
+    provider: 'upload' | 'letsencrypt' | 'unknown';
+    certId?: string;
+    notes: string[];
+};
+/** Edge-local cert directory */
+export declare function edgeCertDir(siteId: string): string;
+export declare function edgeSslPaths(siteId: string): CdnEdgeSslPaths;
+/**
+ * Resolve source certificate files for a CDN site.
+ */
+export declare function resolveCdnSiteCertificate(input: {
+    db: JsonStore;
+    dataDir: string;
+    site: CdnSiteDto;
+}): CdnCertResolve;
+/**
+ * Copy fullchain+privkey to every edge; re-render TLS conf; optional fan-out.
+ */
+export declare function distributeCdnSiteSsl(input: {
+    db: JsonStore;
+    host: HostExecutor;
+    dataDir: string;
+    siteId: string;
+    /** Also fan-out nginx conf + reload (default true) */
+    applyNginx?: boolean;
+    skipDraining?: boolean;
+    edgeNodeId?: string;
+    /** Pass-through for fleet-only edges */
+    enqueue?: import('./fleet-payload.js').CdnFleetEnqueueFn;
+}): Promise<CdnFanOutResult & {
+    cert?: CdnCertResolve;
+}>;
+/**
+ * Prepare ACME HTTP conf (webroot) and fan-out — step before certbot.
+ */
+export declare function prepareCdnSiteAcme(input: {
+    db: JsonStore;
+    host: HostExecutor;
+    dataDir: string;
+    siteId: string;
+    enqueue?: import('./fleet-payload.js').CdnFleetEnqueueFn;
+}): Promise<CdnFanOutResult>;
+/**
+ * Issue Let’s Encrypt (http-01 preferred) on control plane, then distribute.
+ */
+export declare function issueCdnSiteLetsEncrypt(input: {
+    db: JsonStore;
+    host: HostExecutor;
+    dataDir: string;
+    siteId: string;
+    email: string;
+    /** default true: run certbot when EXECUTE */
+    run?: boolean;
+    /** After issue, distribute to edges (default true) */
+    distribute?: boolean;
+    enqueue?: import('./fleet-payload.js').CdnFleetEnqueueFn;
+}): Promise<{
+    ok: boolean;
+    apply_status: ApplyStatus;
+    siteId: string;
+    notes: string[];
+    commands: string[];
+    executed?: boolean;
+    distribute?: CdnFanOutResult;
+    blocked?: boolean;
+    requiresExecute?: boolean;
+}>;
+//# sourceMappingURL=ssl.d.ts.map

package/dist/hosting/cdn/ssl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssl.d.ts","sourceRoot":"","sources":["../../../src/hosting/cdn/ssl.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,EAGL,KAAK,WAAW,EAEhB,KAAK,UAAU,EAAM,MAAM,mBAAmB,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAK3D,OAAO,EAEL,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAwC,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AAI1F,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,QAAQ,GAAG,aAAa,GAAG,SAAS,CAAC;IAC/C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC;AAEF,gCAAgC;AAChC,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,CAO5D;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,EAAE,EAAE,SAAS,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,UAAU,CAAC;CAClB,GAAG,cAAc,CA2EjB;AAoFD;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE;IAChD,EAAE,EAAE,SAAS,CAAC;IACd,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,OAAO,CAAC,EAAE,OAAO,oBAAoB,EAAE,iBAAiB,CAAC;CAC1D,GAAG,OAAO,CAAC,eAAe,GAAG;IAAE,IAAI,CAAC,EAAE,cAAc,CAAA;CAAE,CAAC,CA+QvD;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,EAAE,EAAE,SAAS,CAAC;IACd,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,oBAAoB,EAAE,iBAAiB,CAAC;CAC1D,GAAG,OAAO,CAAC,eAAe,CAAC,CAmC3B;AAED;;GAEG;AACH,wBAAsB,uBAAuB,CAAC,KAAK,EAAE;IACnD,EAAE,EAAE,SAAS,CAAC;IACd,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,6CAA6C;IAC7C,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,sDAAsD;IACtD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,oBAAoB,EAAE,iBAAiB,CAAC;CAC1D,GAAG,OAAO,CAAC;IACV,EAAE,EAAE,OAAO,CAAC;IACZ,YAAY,EAAE,WAAW,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAC,CAkHD"}