ysk-server-core 1.0.0

package/dist/hosting/cloudflare-dns.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Cloudflare DNS API integration (Spec §4.8).
+ * Apply planned A/MX/TXT records when CF_API_TOKEN (or explicit token) is set.
+ * Never fakes success without a token or when API fails.
+ */
+import { type DnsRecordPlan } from './extras.js';
+import type { YskDatabase } from '../db/database.js';
+export type CfDnsRecordInput = {
+    type: string;
+    name: string;
+    content: string;
+    ttl?: number;
+    /** Cloudflare proxied flag — MX/TXT should be false (DNS only) */
+    proxied?: boolean;
+};
+export interface CloudflareApplyResult {
+    ok: boolean;
+    zoneId?: string;
+    zoneName: string;
+    planned: CfDnsRecordInput[];
+    created: Array<{
+        id: string;
+        type: string;
+        name: string;
+    }>;
+    skipped: string[];
+    errors: string[];
+    notes: string[];
+    requiresToken: boolean;
+    dryRun: boolean;
+}
+export type CfFetch = (url: string, init?: {
+    method?: string;
+    headers?: Record<string, string>;
+    body?: string;
+}) => Promise<{
+    ok: boolean;
+    status: number;
+    json: () => Promise<unknown>;
+}>;
+export declare function planToCloudflareRecords(plan: DnsRecordPlan, zone: string): CfDnsRecordInput[];
+/**
+ * Resolve zone id by name via Cloudflare API.
+ */
+export declare function resolveCloudflareZoneId(zoneName: string, token: string, fetchImpl?: CfFetch): Promise<string | null>;
+/**
+ * Apply DNS records to Cloudflare.
+ * dryRun / missing token → plan-only success (ok=true, requiresToken when no token).
+ * Live apply without token → fail-closed (ok=false).
+ */
+export declare function applyCloudflareDns(input: {
+    zone: string;
+    serverIp: string;
+    serverIpv6?: string;
+    mailHost?: string;
+    token?: string;
+    dryRun?: boolean;
+    fetchImpl?: CfFetch;
+    extraRecords?: CfDnsRecordInput[];
+}): Promise<CloudflareApplyResult>;
+/**
+ * Persist last apply result under dns_zones store.
+ */
+export declare function persistDnsZoneApply(db: YskDatabase, result: CloudflareApplyResult, actor: string): void;
+//# sourceMappingURL=cloudflare-dns.d.ts.map

package/dist/hosting/cloudflare-dns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-dns.d.ts","sourceRoot":"","sources":["../../src/hosting/cloudflare-dns.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAe,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,OAAO,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3D,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,aAAa,EAAE,OAAO,CAAC;IACvB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,MAAM,OAAO,GAAG,CACpB,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,KACxE,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC,CAAC;AAU5E,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,aAAa,EACnB,IAAI,EAAE,MAAM,GACX,gBAAgB,EAAE,CAuBpB;AAED;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,SAAS,GAAE,OAAsB,GAChC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAcxB;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,YAAY,CAAC,EAAE,gBAAgB,EAAE,CAAC;CACnC,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAyHjC;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,qBAAqB,EAC7B,KAAK,EAAE,MAAM,GACZ,IAAI,CAoBN"}

package/dist/hosting/cloudflare-dns.js

@@ -0,0 +1,206 @@
+/**
+ * Cloudflare DNS API integration (Spec §4.8).
+ * Apply planned A/MX/TXT records when CF_API_TOKEN (or explicit token) is set.
+ * Never fakes success without a token or when API fails.
+ */
+import { ErrorCodes, YskError, tl } from 'ysk-server-shared';
+import { planDnsZone } from './extras.js';
+const defaultFetch = async (url, init) => {
+    const res = await fetch(url, init);
+    return {
+        ok: res.ok,
+        status: res.status,
+        json: () => res.json()
+    };
+};
+export function planToCloudflareRecords(plan, zone) {
+    return plan.records.map((r) => {
+        const name = r.name === '@' ? zone : r.name.includes(zone) ? r.name : `${r.name}.${zone}`;
+        // MX value like "10 mail.example.com." — CF wants priority separate for MX
+        if (r.type === 'MX') {
+            const m = r.value.match(/^(\d+)\s+(.+?)\.?$/);
+            return {
+                type: 'MX',
+                name,
+                content: m ? m[2].replace(/\.$/, '') : r.value,
+                ttl: r.ttl,
+                proxied: false,
+                // store priority in content as CF API uses priority field — handled in apply
+                ...{ priority: m ? Number(m[1]) : 10 }
+            };
+        }
+        return {
+            type: r.type,
+            name,
+            content: r.value,
+            ttl: r.ttl,
+            // grey cloud default for hosting (Spec: MX/A often DNS-only)
+            proxied: false
+        };
+    });
+}
+/**
+ * Resolve zone id by name via Cloudflare API.
+ */
+export async function resolveCloudflareZoneId(zoneName, token, fetchImpl = defaultFetch) {
+    const url = `https://api.cloudflare.com/client/v4/zones?name=${encodeURIComponent(zoneName)}`;
+    const res = await fetchImpl(url, {
+        method: 'GET',
+        headers: {
+            Authorization: `Bearer ${token}`,
+            'Content-Type': 'application/json'
+        }
+    });
+    if (!res.ok)
+        return null;
+    const body = (await res.json());
+    const hit = body.result?.find((z) => z.name === zoneName);
+    return hit?.id ?? null;
+}
+/**
+ * Apply DNS records to Cloudflare.
+ * dryRun / missing token → plan-only success (ok=true, requiresToken when no token).
+ * Live apply without token → fail-closed (ok=false).
+ */
+export async function applyCloudflareDns(input) {
+    const zone = input.zone.trim().toLowerCase();
+    if (!zone || !input.serverIp) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.dns.needZoneServerIp'), { httpStatus: 400 });
+    }
+    const plan = planDnsZone({
+        zone,
+        serverIp: input.serverIp,
+        serverIpv6: input.serverIpv6,
+        mailHost: input.mailHost
+    });
+    const planned = [
+        ...planToCloudflareRecords(plan, zone),
+        ...(input.extraRecords ?? []),
+    ];
+    const token = input.token?.trim() ||
+        process.env.CF_API_TOKEN?.trim() ||
+        process.env.CLOUDFLARE_API_TOKEN?.trim() ||
+        '';
+    const notes = [...plan.providerHints];
+    const wantLive = input.dryRun !== true;
+    if (!token) {
+        notes.push(tl('notes.auto.n0980'));
+        // Explicit dry-run (or default plan): success with requiresToken. Live without token: fail-closed.
+        return {
+            ok: !wantLive,
+            zoneName: zone,
+            planned,
+            created: [],
+            skipped: planned.map((r) => `${r.type} ${r.name}`),
+            errors: wantLive ? ['missing Cloudflare API token'] : [],
+            notes,
+            requiresToken: true,
+            dryRun: true
+        };
+    }
+    if (input.dryRun) {
+        notes.push(tl('notes.auto.n0275'));
+        return {
+            ok: true,
+            zoneName: zone,
+            planned,
+            created: [],
+            skipped: planned.map((r) => `${r.type} ${r.name} (dry-run)`),
+            errors: [],
+            notes,
+            requiresToken: false,
+            dryRun: true
+        };
+    }
+    const fetchImpl = input.fetchImpl ?? defaultFetch;
+    const zoneId = await resolveCloudflareZoneId(zone, token, fetchImpl);
+    if (!zoneId) {
+        return {
+            ok: false,
+            zoneName: zone,
+            planned,
+            created: [],
+            skipped: [],
+            errors: [`Could not resolve Cloudflare zone id for ${zone}`],
+            notes,
+            requiresToken: false,
+            dryRun: false
+        };
+    }
+    const created = [];
+    const errors = [];
+    const skipped = [];
+    for (const rec of planned) {
+        const priority = rec.priority;
+        const body = {
+            type: rec.type,
+            name: rec.name,
+            content: rec.content,
+            ttl: rec.ttl ?? 300,
+            proxied: rec.proxied ?? false
+        };
+        if (rec.type === 'MX' && priority != null)
+            body.priority = priority;
+        const res = await fetchImpl(`https://api.cloudflare.com/client/v4/zones/${zoneId}/dns_records`, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${token}`,
+                'Content-Type': 'application/json'
+            },
+            body: JSON.stringify(body)
+        });
+        const json = (await res.json());
+        if (json.success && json.result?.id) {
+            created.push({ id: json.result.id, type: rec.type, name: rec.name });
+        }
+        else {
+            const msg = json.errors?.map((e) => e.message).filter(Boolean).join('; ') ||
+                `HTTP ${res.status}`;
+            // 81057 already exists — treat as skip ok
+            if (msg.toLowerCase().includes('already exists') || json.errors?.some((e) => e.code === 81057)) {
+                skipped.push(`${rec.type} ${rec.name}: already exists`);
+            }
+            else {
+                errors.push(`${rec.type} ${rec.name}: ${msg}`);
+            }
+        }
+    }
+    const ok = errors.length === 0;
+    notes.push(tl('notes.auto.t0140', { v0: (created.length), v1: (skipped.length), v2: (errors.length) }));
+    return {
+        ok,
+        zoneId,
+        zoneName: zone,
+        planned,
+        created,
+        skipped,
+        errors,
+        notes,
+        requiresToken: false,
+        dryRun: false
+    };
+}
+/**
+ * Persist last apply result under dns_zones store.
+ */
+export function persistDnsZoneApply(db, result, actor) {
+    const now = new Date().toISOString();
+    const row = {
+        id: `cf-${result.zoneName}`,
+        zone: result.zoneName,
+        provider: 'cloudflare',
+        zone_id: result.zoneId,
+        last_apply: result,
+        ok: result.ok,
+        actor,
+        updated_at: now,
+        created_at: now
+    };
+    db.snapshot.dns_zones = db.snapshot.dns_zones.filter((z) => String(z.zone) !== result.zoneName);
+    db.snapshot.dns_zones.unshift(row);
+    if (db.snapshot.dns_zones.length > 50) {
+        db.snapshot.dns_zones = db.snapshot.dns_zones.slice(0, 50);
+    }
+    db.persist();
+}
+//# sourceMappingURL=cloudflare-dns.js.map

package/dist/hosting/cloudflare-dns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-dns.js","sourceRoot":"","sources":["../../src/hosting/cloudflare-dns.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAC,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAsB,MAAM,aAAa,CAAC;AA8B9D,MAAM,YAAY,GAAY,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IAChD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACnC,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,EAAsB;KAAE,CAAC;AACjD,CAAC,CAAC;AAEF,MAAM,UAAU,uBAAuB,CACrC,IAAmB,EACnB,IAAY;IAEZ,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC5B,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;QAC1F,2EAA2E;QAC3E,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;YAC9C,OAAO;gBACL,IAAI,EAAE,IAAI;gBACV,IAAI;gBACJ,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK;gBAC9C,GAAG,EAAE,CAAC,CAAC,GAAG;gBACV,OAAO,EAAE,KAAK;gBACd,6EAA6E;gBAC7E,GAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAA4B;aAA8C,CAAC;QACpH,CAAC;QACD,OAAO;YACL,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI;YACJ,OAAO,EAAE,CAAC,CAAC,KAAK;YAChB,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,6DAA6D;YAC7D,OAAO,EAAE,KAAK;SAAE,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,QAAgB,EAChB,KAAa,EACb,YAAqB,YAAY;IAEjC,MAAM,GAAG,GAAG,mDAAmD,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC9F,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QAC/B,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,cAAc,EAAE,kBAAkB;SAAE;KAAE,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAG7B,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IAC1D,OAAO,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KASxC;IACC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7C,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,4BAA4B,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC;QACvB,IAAI;QACJ,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;KAAE,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG;QACd,GAAG,uBAAuB,CAAC,IAAI,EAAE,IAAI,CAAC;QACtC,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC;KAC9B,CAAC;IACF,MAAM,KAAK,GACT,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE;QACnB,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE;QAChC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE;QACxC,EAAE,CAAC;IACL,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC;IAEvC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACnC,mGAAmG;QACnG,OAAO;YACL,EAAE,EAAE,CAAC,QAAQ;YACb,QAAQ,EAAE,IAAI;YACd,OAAO;YACP,OAAO,EAAE,EAAE;YACX,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YAClD,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,CAAC,EAAE;YACxD,KAAK;YACL,aAAa,EAAE,IAAI;YACnB,MAAM,EAAE,IAAI;SAAE,CAAC;IACnB,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACnC,OAAO;YACL,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE,IAAI;YACd,OAAO;YACP,OAAO,EAAE,EAAE;YACX,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,YAAY,CAAC;YAC5D,MAAM,EAAE,EAAE;YACV,KAAK;YACL,aAAa,EAAE,KAAK;YACpB,MAAM,EAAE,IAAI;SAAE,CAAC;IACnB,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,YAAY,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IACrE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,EAAE,EAAE,KAAK;YACT,QAAQ,EAAE,IAAI;YACd,OAAO;YACP,OAAO,EAAE,EAAE;YACX,OAAO,EAAE,EAAE;YACX,MAAM,EAAE,CAAC,4CAA4C,IAAI,EAAE,CAAC;YAC5D,KAAK;YACL,aAAa,EAAE,KAAK;YACpB,MAAM,EAAE,KAAK;SAAE,CAAC;IACpB,CAAC;IAED,MAAM,OAAO,GAAqC,EAAE,CAAC;IACrD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAI,GAA6B,CAAC,QAAQ,CAAC;QACzD,MAAM,IAAI,GAA4B;YACpC,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,GAAG;YACnB,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,KAAK;SAAE,CAAC;QAClC,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,QAAQ,IAAI,IAAI;YAAE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAEpE,MAAM,GAAG,GAAG,MAAM,SAAS,CACzB,8CAA8C,MAAM,cAAc,EAClE;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,cAAc,EAAE,kBAAkB;aAAE;YACtC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAAE,CAC/B,CAAC;QACF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAI7B,CAAC;QACF,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACvE,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GACP,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC7D,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;YACvB,0CAA0C;YAC1C,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBAC/F,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,kBAAkB,CAAC,CAAC;YAC1D,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;IAC/B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACxG,OAAO;QACL,EAAE;QACF,MAAM;QACN,QAAQ,EAAE,IAAI;QACd,OAAO;QACP,OAAO;QACP,OAAO;QACP,MAAM;QACN,KAAK;QACL,aAAa,EAAE,KAAK;QACpB,MAAM,EAAE,KAAK;KAAE,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CACjC,EAAe,EACf,MAA6B,EAC7B,KAAa;IAEb,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG;QACV,EAAE,EAAE,MAAM,MAAM,CAAC,QAAQ,EAAE;QAC3B,IAAI,EAAE,MAAM,CAAC,QAAQ;QACrB,QAAQ,EAAE,YAAY;QACtB,OAAO,EAAE,MAAM,CAAC,MAAM;QACtB,UAAU,EAAE,MAAM;QAClB,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,KAAK;QACL,UAAU,EAAE,GAAG;QACf,UAAU,EAAE,GAAG;KAAE,CAAC;IACpB,EAAE,CAAC,QAAQ,CAAC,SAAS,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAClD,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,QAAQ,CAC1C,CAAC;IACF,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACtC,EAAE,CAAC,QAAQ,CAAC,SAAS,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,EAAE,CAAC,OAAO,EAAE,CAAC;AACf,CAAC"}

package/dist/hosting/database.d.ts

@@ -0,0 +1,27 @@
+/**
+ * MySQL/MariaDB + Redis management plans (pure orchestration).
+ */
+export interface DatabasePlan {
+    kind: 'mysql' | 'mariadb' | 'redis';
+    commands: string[];
+    notes: string[];
+    connectionHint?: Record<string, string | number>;
+}
+/**
+ * Plan creation of a MySQL/MariaDB database + user with limited grants.
+ */
+export declare function planMysqlDatabase(input: {
+    dbName: string;
+    username: string;
+    host?: string;
+    privileges?: string;
+}): DatabasePlan;
+/**
+ * Plan a Redis logical DB / instance binding for a project.
+ */
+export declare function planRedisBinding(input: {
+    projectId: string;
+    dbIndex: number;
+    maxmemoryMb?: number;
+}): DatabasePlan;
+//# sourceMappingURL=database.d.ts.map

package/dist/hosting/database.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"database.d.ts","sourceRoot":"","sources":["../../src/hosting/database.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC;IACpC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;CAClD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,YAAY,CAef;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,YAAY,CAef"}

package/dist/hosting/database.js

@@ -0,0 +1,51 @@
+/**
+ * MySQL/MariaDB + Redis management plans (pure orchestration).
+ */
+import { ErrorCodes, YskError, tl } from 'ysk-server-shared';
+/**
+ * Plan creation of a MySQL/MariaDB database + user with limited grants.
+ */
+export function planMysqlDatabase(input) {
+    assertIdent(input.dbName, 'dbName');
+    assertIdent(input.username, 'username');
+    const host = input.host ?? 'localhost';
+    const privileges = input.privileges ?? 'SELECT,INSERT,UPDATE,DELETE,CREATE,INDEX,ALTER';
+    return {
+        kind: 'mysql',
+        commands: [
+            `CREATE DATABASE IF NOT EXISTS \`${input.dbName}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;`,
+            `CREATE USER IF NOT EXISTS '${input.username}'@'${host}' IDENTIFIED BY '***';`,
+            `GRANT ${privileges} ON \`${input.dbName}\`.* TO '${input.username}'@'${host}';`,
+            'FLUSH PRIVILEGES;',
+        ],
+        notes: [tl('notes.auto.n0669'), tl('notes.auto.n1556')],
+        connectionHint: { database: input.dbName, user: input.username, host }
+    };
+}
+/**
+ * Plan a Redis logical DB / instance binding for a project.
+ */
+export function planRedisBinding(input) {
+    if (!Number.isInteger(input.dbIndex) || input.dbIndex < 0 || input.dbIndex > 15) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n0169'), {
+            httpStatus: 400
+        });
+    }
+    const maxmem = input.maxmemoryMb ?? 64;
+    return {
+        kind: 'redis',
+        commands: [
+            `# Bind project ${input.projectId} to Redis DB ${input.dbIndex}`,
+            `CONFIG SET maxmemory-policy allkeys-lru`,
+            `# Optional dedicated instance memory hint: ${maxmem}mb`,
+        ],
+        notes: [tl('notes.auto.n1599'), tl('notes.auto.n0927')],
+        connectionHint: { db: input.dbIndex, maxmemoryMb: maxmem }
+    };
+}
+function assertIdent(value, field) {
+    if (!/^[a-zA-Z][a-zA-Z0-9_]{0,63}$/.test(value)) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.fieldInvalid', { field, value }), { httpStatus: 400 });
+    }
+}
+//# sourceMappingURL=database.js.map

package/dist/hosting/database.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database.js","sourceRoot":"","sources":["../../src/hosting/database.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAC,MAAM,mBAAmB,CAAC;AAS5D;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAKjC;IACC,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACpC,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,WAAW,CAAC;IACvC,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,gDAAgD,CAAC;IACxF,OAAO;QACL,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE;YACR,mCAAmC,KAAK,CAAC,MAAM,sDAAsD;YACrG,8BAA8B,KAAK,CAAC,QAAQ,MAAM,IAAI,wBAAwB;YAC9E,SAAS,UAAU,SAAS,KAAK,CAAC,MAAM,YAAY,KAAK,CAAC,QAAQ,MAAM,IAAI,IAAI;YAChF,mBAAmB;SACpB;QACD,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC;QACvD,cAAc,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE;KAAE,CAAC;AAC7E,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAIhC;IACC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,GAAG,EAAE,EAAE,CAAC;QAChF,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE;YAChE,UAAU,EAAE,GAAG;SAAE,CAAC,CAAC;IACvB,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC;IACvC,OAAO;QACL,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE;YACR,kBAAkB,KAAK,CAAC,SAAS,gBAAgB,KAAK,CAAC,OAAO,EAAE;YAChE,yCAAyC;YACzC,8CAA8C,MAAM,IAAI;SACzD;QACD,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC;QACvD,cAAc,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE;KAAE,CAAC;AACjE,CAAC;AAED,SAAS,WAAW,CAAC,KAAa,EAAE,KAAa;IAC/C,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7G,CAAC;AACH,CAAC"}

package/dist/hosting/datadir-perms.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Harden panel dataDir mode so other users cannot read control-plane JSON.
+ * Target mode: 0750 (owner rwx, group rx, other none).
+ */
+export declare const DATADIR_HARDENED_MODE = 488;
+export declare function dataDirMode(dataDir: string): number | null;
+/** True when other has read or write on dataDir (needs harden). */
+export declare function dataDirNeedsHarden(dataDir: string): boolean;
+/**
+ * chmod dataDir to 0750. Does not chown (panel must already own the path).
+ */
+export declare function hardenDataDirPerms(dataDir: string): {
+    ok: boolean;
+    path: string;
+    before?: string;
+    after?: string;
+    notes: string[];
+};
+//# sourceMappingURL=datadir-perms.d.ts.map

package/dist/hosting/datadir-perms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"datadir-perms.d.ts","sourceRoot":"","sources":["../../src/hosting/datadir-perms.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,eAAO,MAAM,qBAAqB,MAAQ,CAAC;AAE3C,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAO1D;AAED,mEAAmE;AACnE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAI3D;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG;IACnD,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CA0BA"}

package/dist/hosting/datadir-perms.js

@@ -0,0 +1,55 @@
+/**
+ * Harden panel dataDir mode so other users cannot read control-plane JSON.
+ * Target mode: 0750 (owner rwx, group rx, other none).
+ */
+import { chmodSync, existsSync, statSync } from 'node:fs';
+export const DATADIR_HARDENED_MODE = 0o750;
+export function dataDirMode(dataDir) {
+    try {
+        if (!existsSync(dataDir))
+            return null;
+        return statSync(dataDir).mode & 0o777;
+    }
+    catch {
+        return null;
+    }
+}
+/** True when other has read or write on dataDir (needs harden). */
+export function dataDirNeedsHarden(dataDir) {
+    const mode = dataDirMode(dataDir);
+    if (mode == null)
+        return false;
+    return (mode & 0o007) !== 0;
+}
+/**
+ * chmod dataDir to 0750. Does not chown (panel must already own the path).
+ */
+export function hardenDataDirPerms(dataDir) {
+    const notes = [];
+    if (!dataDir || dataDir === '/' || dataDir === '.') {
+        return { ok: false, path: dataDir, notes: ['invalid dataDir'] };
+    }
+    if (!existsSync(dataDir)) {
+        return { ok: false, path: dataDir, notes: ['dataDir missing'] };
+    }
+    try {
+        const before = dataDirMode(dataDir);
+        const beforeStr = before != null ? before.toString(8) : '?';
+        chmodSync(dataDir, DATADIR_HARDENED_MODE);
+        const after = dataDirMode(dataDir);
+        const afterStr = after != null ? after.toString(8) : '?';
+        notes.push(`chmod ${beforeStr} → ${afterStr}`);
+        const stillOpen = after != null && (after & 0o007) !== 0;
+        if (stillOpen) {
+            notes.push('mode still allows other access — check filesystem ACLs/mount options');
+            return { ok: false, path: dataDir, before: beforeStr, after: afterStr, notes };
+        }
+        return { ok: true, path: dataDir, before: beforeStr, after: afterStr, notes };
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        notes.push(msg);
+        return { ok: false, path: dataDir, notes };
+    }
+}
+//# sourceMappingURL=datadir-perms.js.map

package/dist/hosting/datadir-perms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"datadir-perms.js","sourceRoot":"","sources":["../../src/hosting/datadir-perms.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAE1D,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAE3C,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC;IAC/B,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAOhD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;QACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC;IAClE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,SAAS,GAAG,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC5D,SAAS,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACzD,KAAK,CAAC,IAAI,CAAC,SAAS,SAAS,MAAM,QAAQ,EAAE,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,SAAS,EAAE,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,sEAAsE,CAAC,CAAC;YACnF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACjF,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAChF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC7C,CAAC;AACH,CAAC"}

package/dist/hosting/db-browser-project.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Create a PHP project that hosts Adminer or phpMyAdmin (DB browser).
+ * Used from MySQL/MariaDB “Adminer entry” — real project lifecycle + goLive.
+ */
+import { type ProjectDto } from 'ysk-server-shared';
+import type { HostExecutor } from '../host/executor.js';
+import type { ProjectService } from './project-service.js';
+import type { ProjectOpsService } from './project-ops.js';
+export type DbBrowserTool = 'adminer' | 'phpmyadmin';
+export declare function normalizeDbBrowserTool(raw: unknown): DbBrowserTool;
+export declare function defaultDbBrowserProjectName(tool: DbBrowserTool, engine?: string): string;
+/**
+ * Download Adminer or phpMyAdmin into project document root (app/public).
+ */
+export declare function installDbBrowserIntoProject(input: {
+    host: HostExecutor;
+    homeDir: string;
+    /** Absolute public dir; default home/app/public */
+    docRoot?: string;
+    tool: DbBrowserTool;
+    download?: boolean;
+}): Promise<{
+    ok: boolean;
+    notes: string[];
+    written: string[];
+    entryFile: string;
+}>;
+/** Write/refresh config.inc.php, tmp/, .user.ini for cookie login over HTTP. */
+export declare function ensurePhpMyAdminRuntimeFiles(docRoot: string): {
+    written: string[];
+    notes: string[];
+};
+/**
+ * Managed phpMyAdmin config — cookie auth to local MySQL/MariaDB.
+ * HTTP-safe: ForceSSL off, writable TempDir (session cookies fail without it).
+ */
+export declare function buildPhpMyAdminConfigInc(blowfishSecret: string): string;
+/**
+ * Create PHP project + install Adminer/phpMyAdmin + goLive (deploy + nginx).
+ */
+export declare function createDbBrowserProject(input: {
+    projects: ProjectService;
+    projectOps: ProjectOpsService;
+    host: HostExecutor;
+    actor: string;
+    actorUserId?: string;
+    /** Project display name — unique */
+    name: string;
+    domain: string;
+    tool: DbBrowserTool;
+    download?: boolean;
+    /** engine hint for default naming only */
+    engine?: string;
+}): Promise<{
+    ok: boolean;
+    project?: ProjectDto;
+    projectId?: string;
+    urlHint?: string;
+    notes: string[];
+    written: string[];
+    blocked?: boolean;
+    blockMessage?: string;
+    requiresExecute?: boolean;
+    requiresRoot?: boolean;
+    apply_status: 'applied' | 'written' | 'blocked' | 'failed';
+}>;
+//# sourceMappingURL=db-browser-project.d.ts.map

package/dist/hosting/db-browser-project.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-browser-project.d.ts","sourceRoot":"","sources":["../../src/hosting/db-browser-project.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,EAAwB,KAAK,UAAU,EAAM,MAAM,mBAAmB,CAAC;AAC9E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAG1D,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,YAAY,CAAC;AAUrD,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG,aAAa,CAIlE;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAKxF;AAED;;GAEG;AACH,wBAAsB,2BAA2B,CAAC,KAAK,EAAE;IACvD,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,aAAa,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA4GlF;AAED,gFAAgF;AAChF,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,MAAM,GAAG;IAC7D,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CA4BA;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAyBvE;AASD;;GAEG;AACH,wBAAsB,sBAAsB,CAAC,KAAK,EAAE;IAClD,QAAQ,EAAE,cAAc,CAAC;IACzB,UAAU,EAAE,iBAAiB,CAAC;IAC9B,IAAI,EAAE,YAAY,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,aAAa,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC;IACV,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE,UAAU,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,YAAY,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;CAC5D,CAAC,CAmGD"}