ysk-server-core 1.0.0

package/dist/db/store.d.ts

@@ -0,0 +1,257 @@
+/**
+ * Durable JSON control-plane store (atomic writes).
+ * Used instead of native better-sqlite3 when the environment cannot load it.
+ * Provides real restart-safe persistence for users/sessions/projects/audit.
+ */
+import type { CapabilityId, SystemRole, ApprovalStatus, RiskTier, OperationLevel, HostingRuntime } from 'ysk-server-shared';
+export interface StoreUser {
+    id: string;
+    username: string;
+    password_hash: string;
+    password_salt: string;
+    roles: SystemRole[];
+    locale: string;
+    /** Package template id */
+    package_id?: string;
+    /** Suspended panel user */
+    suspended?: boolean;
+    /** Base32 TOTP secret when 2FA enrolled (plain or yskenc:v1:…) */
+    totp_secret?: string;
+    /** true only after user confirms a valid code */
+    totp_enabled?: boolean;
+    /** Last accepted TOTP time-step (anti-replay) */
+    totp_last_step?: number;
+    /** SHA-256 hashes of one-time recovery codes */
+    totp_recovery_hashes?: string[];
+    /** Per-user capability grants on top of role policy */
+    capability_grants?: CapabilityId[];
+    /** Per-user capability revokes */
+    capability_revokes?: CapabilityId[];
+    /**
+     * Force password change on next successful login flow.
+     * Set when bootstrap used a weak/default password.
+     */
+    must_change_password?: boolean;
+    created_at: string;
+    updated_at: string;
+}
+/** Persisted role policy override (null/missing role → factory) */
+export interface StoreRolePolicy {
+    maxLevel: OperationLevel;
+    capabilities: CapabilityId[];
+    defaultsVersion?: number;
+    updated_at?: string;
+    updated_by?: string;
+}
+/** Hosting package quotas (Hestia/DA style) */
+export interface StorePackage {
+    id: string;
+    name: string;
+    /** max projects / sites */
+    max_projects: number;
+    max_mailboxes: number;
+    max_databases: number;
+    /** disk MiB, 0 = unlimited */
+    disk_mb: number;
+    /** bandwidth MiB/month, 0 = unlimited */
+    bandwidth_mb: number;
+    allow_ssh: boolean;
+    allow_ftp: boolean;
+    notes?: string;
+    created_at: string;
+    updated_at: string;
+}
+export interface StoreSession {
+    /**
+     * Legacy plaintext token (migrated away on first use).
+     * New sessions only store token_hash + token_prefix.
+     */
+    token?: string;
+    /** SHA-256 hex of session bearer (preferred) */
+    token_hash?: string;
+    /** First 12 chars of plaintext for public session id / revoke */
+    token_prefix?: string;
+    user_id: string;
+    /** Absolute expiry (max lifetime) */
+    expires_at: string;
+    created_at: string;
+    /** Sliding idle activity */
+    last_seen_at?: string;
+    user_agent?: string;
+    ip?: string;
+    label?: string;
+}
+export interface StoreProject {
+    id: string;
+    name: string;
+    domain?: string;
+    /** Extra hostnames for server_name */
+    domain_aliases?: string[];
+    linux_user: string;
+    linux_group: string;
+    home_dir: string;
+    runtime: HostingRuntime;
+    runtime_version?: string;
+    env: 'staging' | 'production';
+    status: string;
+    nginx_config_path?: string;
+    os_provisioned: boolean;
+    /** Listen port for app process (Node/PHP-FPM proxy target) */
+    port?: number;
+    /** User-requested fixed process port (deploy prefers this when free) */
+    preferred_port?: number;
+    /** Running process pid when managed by control plane */
+    pid?: number;
+    pidfile?: string;
+    /** stopped | starting | running | unhealthy | failed */
+    process_status?: string;
+    /** Redirect HTTP→HTTPS when SSL conf published */
+    force_https?: boolean;
+    /** Emit HSTS when SSL conf published */
+    hsts?: boolean;
+    /** Whole-site 301 target URL (optional) */
+    site_redirect_url?: string;
+    /** HTTP basic auth user (optional) */
+    http_auth_user?: string;
+    http_auth_pass?: string;
+    /** Custom document root relative to home (default app/public or app) */
+    doc_root?: string;
+    /** Optional bind IP for nginx listen (empty = all) */
+    bind_ip?: string;
+    /**
+     * Real client IP provider override for this site.
+     * undefined / omit = inherit host default; 'none' = force off.
+     */
+    real_ip_provider?: string;
+    last_health?: Record<string, unknown>;
+    last_deploy_at?: string;
+    /** Git remote for deploy */
+    git_url?: string;
+    git_branch?: string;
+    git_commit?: string;
+    /** App env vars written to .env */
+    env_vars?: Record<string, string>;
+    last_backup_path?: string;
+    last_backup_at?: string;
+    /** Disk soft quota MiB */
+    quota_mb?: number;
+    /** systemd MemoryMax e.g. 512M */
+    memory_max?: string;
+    /** systemd CPUQuota percent */
+    cpu_quota_percent?: number;
+    /** systemd TasksMax (process count cap) */
+    tasks_max?: number;
+    /** systemd LimitNOFILE */
+    limit_nofile?: number;
+    /** login shell (default /usr/sbin/nologin) */
+    shell?: string;
+    /** usermod -L lock */
+    account_locked?: boolean;
+    /** Last process deploy entry (server.js, main:app, ./app, …) */
+    deploy_entry?: string;
+    /** Last deploy operator notes (short, newest first, max ~8) */
+    last_deploy_notes?: string[];
+    /**
+     * Extra log scan dirs relative to home_dir (e.g. storage/logs, var/log).
+     * Always also scans logs/ and log/.
+     */
+    log_extra_dirs?: string[];
+    /** Panel user id that owns this project (package quota scope) */
+    owner_user_id?: string;
+    created_at: string;
+    updated_at: string;
+}
+export interface StoreApproval {
+    id: string;
+    action: string;
+    risk: RiskTier;
+    requested_by: string;
+    status: ApprovalStatus;
+    payload: unknown;
+    created_at: string;
+    decided_at?: string;
+    decided_by?: string;
+}
+export interface StoreAudit {
+    id: string;
+    actor: string;
+    action: string;
+    resource?: string;
+    detail: unknown;
+    ok: boolean;
+    created_at: string;
+}
+export interface StoreData {
+    version: number;
+    users: StoreUser[];
+    packages: StorePackage[];
+    sessions: StoreSession[];
+    projects: StoreProject[];
+    approvals: StoreApproval[];
+    audit_events: StoreAudit[];
+    settings: Record<string, string>;
+    agent_sessions: Array<Record<string, unknown>>;
+    agent_messages: Array<Record<string, unknown>>;
+    email_domains: Array<Record<string, unknown>>;
+    /** AI tasks Plan→Review→Execute */
+    ai_tasks: Array<Record<string, unknown>>;
+    playbook_runs: Array<Record<string, unknown>>;
+    update_jobs: Array<Record<string, unknown>>;
+    dns_zones: Array<Record<string, unknown>>;
+    firewall_rules: Array<Record<string, unknown>>;
+    certificates: Array<Record<string, unknown>>;
+    mailboxes: Array<Record<string, unknown>>;
+    /** Mail aliases / forwards / catch-all per domain */
+    email_aliases: Array<Record<string, unknown>>;
+    cron_jobs: Array<Record<string, unknown>>;
+    /** Managed control-plane resource registries (CRUD entities) */
+    nginx_sites: Array<Record<string, unknown>>;
+    ftp_accounts: Array<Record<string, unknown>>;
+    mysql_databases: Array<Record<string, unknown>>;
+    mysql_users: Array<Record<string, unknown>>;
+    postgres_databases: Array<Record<string, unknown>>;
+    postgres_users: Array<Record<string, unknown>>;
+    redis_instances: Array<Record<string, unknown>>;
+    dns_records: Array<Record<string, unknown>>;
+    /** Public file share links (ownCloud-style) */
+    file_shares: Array<Record<string, unknown>>;
+    /** File favorites paths per root */
+    file_favorites: Array<Record<string, unknown>>;
+    /** Panel API access keys (token hash) */
+    api_keys: Array<Record<string, unknown>>;
+    /**
+     * Role-level RBAC policy overrides. Missing role key → factory defaults.
+     * One-click restore deletes the role entry (or clears the whole map).
+     */
+    rbac_policies?: Partial<Record<SystemRole, StoreRolePolicy>>;
+    /** Remote backup destination settings */
+    backup_remote?: {
+        enabled: boolean;
+        kind: 'sftp' | 'local' | 's3';
+        host?: string;
+        port?: number;
+        username?: string;
+        /** path on remote or local extra mirror */
+        path?: string;
+        /** not ideal — store for MVP panel ops; prefer key later */
+        password?: string;
+        s3Bucket?: string;
+        s3Region?: string;
+        s3Endpoint?: string;
+        awsAccessKeyId?: string;
+        awsSecretAccessKey?: string;
+    };
+    /** Global backup exclusion globs */
+    backup_exclusions?: string[];
+}
+export declare class JsonStore {
+    private data;
+    private readonly path;
+    constructor(path: string);
+    get snapshot(): StoreData;
+    persist(): void;
+    close(): void;
+}
+/** Control-plane DB handle (JsonStore; sqlite/postgres backends subclass JsonStore). */
+export type YskDatabase = JsonStore;
+//# sourceMappingURL=store.d.ts.map

package/dist/db/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/db/store.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,cAAc,EACd,QAAQ,EACR,cAAc,EACd,cAAc,EACf,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,0BAA0B;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2BAA2B;IAC3B,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iDAAiD;IACjD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,iDAAiD;IACjD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,uDAAuD;IACvD,iBAAiB,CAAC,EAAE,YAAY,EAAE,CAAC;IACnC,kCAAkC;IAClC,kBAAkB,CAAC,EAAE,YAAY,EAAE,CAAC;IACpC;;;OAGG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,mEAAmE;AACnE,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,cAAc,CAAC;IACzB,YAAY,EAAE,YAAY,EAAE,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,+CAA+C;AAC/C,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,8BAA8B;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,4BAA4B;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sCAAsC;IACtC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,cAAc,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,EAAE,SAAS,GAAG,YAAY,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,OAAO,CAAC;IACxB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wDAAwD;IACxD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kDAAkD;IAClD,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,wCAAwC;IACxC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,2CAA2C;IAC3C,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,sCAAsC;IACtC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,4BAA4B;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mCAAmC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0BAA0B;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+BAA+B;IAC/B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0BAA0B;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8CAA8C;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sBAAsB;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,+DAA+D;IAC/D,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,iEAAiE;IACjE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,QAAQ,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,cAAc,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,EAAE,EAAE,OAAO,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,YAAY,EAAE,UAAU,EAAE,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/C,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/C,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9C,mCAAmC;IACnC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACzC,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9C,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5C,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1C,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/C,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7C,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1C,qDAAqD;IACrD,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9C,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1C,gEAAgE;IAChE,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5C,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7C,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAChD,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5C,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/C,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAChD,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5C,+CAA+C;IAC/C,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5C,oCAAoC;IACpC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/C,yCAAyC;IACzC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACzC;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC;IAC7D,yCAAyC;IACzC,aAAa,CAAC,EAAE;QACd,OAAO,EAAE,OAAO,CAAC;QACjB,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;QAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,2CAA2C;QAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,4DAA4D;QAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;IACF,oCAAoC;IACpC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B;AAoCD,qBAAa,SAAS;IACpB,OAAO,CAAC,IAAI,CAAY;IACxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;gBAElB,IAAI,EAAE,MAAM;IA4CxB,IAAI,QAAQ,IAAI,SAAS,CAExB;IAED,OAAO,IAAI,IAAI;IAMf,KAAK,IAAI,IAAI;CAGd;AAED,wFAAwF;AACxF,MAAM,MAAM,WAAW,GAAG,SAAS,CAAC"}

package/dist/db/store.js

@@ -0,0 +1,100 @@
+/**
+ * Durable JSON control-plane store (atomic writes).
+ * Used instead of native better-sqlite3 when the environment cannot load it.
+ * Provides real restart-safe persistence for users/sessions/projects/audit.
+ */
+import { mkdirSync, readFileSync, renameSync, writeFileSync, existsSync } from 'node:fs';
+import { dirname } from 'node:path';
+const EMPTY = {
+    version: 3,
+    users: [],
+    packages: [],
+    sessions: [],
+    projects: [],
+    approvals: [],
+    audit_events: [],
+    settings: {},
+    agent_sessions: [],
+    agent_messages: [],
+    email_domains: [],
+    ai_tasks: [],
+    playbook_runs: [],
+    update_jobs: [],
+    dns_zones: [],
+    firewall_rules: [],
+    certificates: [],
+    mailboxes: [],
+    email_aliases: [],
+    cron_jobs: [],
+    nginx_sites: [],
+    ftp_accounts: [],
+    mysql_databases: [],
+    mysql_users: [],
+    postgres_databases: [],
+    postgres_users: [],
+    redis_instances: [],
+    dns_records: [],
+    file_shares: [],
+    file_favorites: [],
+    api_keys: [],
+};
+export class JsonStore {
+    data;
+    path;
+    constructor(path) {
+        this.path = path;
+        mkdirSync(dirname(path), { recursive: true });
+        if (existsSync(path)) {
+            this.data = { ...EMPTY, ...JSON.parse(readFileSync(path, 'utf8')) };
+            // ensure arrays / maps
+            this.data.users = this.data.users ?? [];
+            this.data.packages = this.data.packages ?? [];
+            this.data.sessions = this.data.sessions ?? [];
+            this.data.projects = this.data.projects ?? [];
+            this.data.backup_exclusions = this.data.backup_exclusions ?? [];
+            this.data.approvals = this.data.approvals ?? [];
+            this.data.audit_events = this.data.audit_events ?? [];
+            this.data.settings = this.data.settings ?? {};
+            this.data.agent_sessions = this.data.agent_sessions ?? [];
+            this.data.agent_messages = this.data.agent_messages ?? [];
+            this.data.email_domains = this.data.email_domains ?? [];
+            this.data.ai_tasks = this.data.ai_tasks ?? [];
+            this.data.playbook_runs = this.data.playbook_runs ?? [];
+            this.data.update_jobs = this.data.update_jobs ?? [];
+            this.data.dns_zones = this.data.dns_zones ?? [];
+            this.data.firewall_rules = this.data.firewall_rules ?? [];
+            this.data.certificates = this.data.certificates ?? [];
+            this.data.mailboxes = this.data.mailboxes ?? [];
+            this.data.email_aliases = this.data.email_aliases ?? [];
+            this.data.cron_jobs = this.data.cron_jobs ?? [];
+            this.data.nginx_sites = this.data.nginx_sites ?? [];
+            this.data.ftp_accounts = this.data.ftp_accounts ?? [];
+            this.data.mysql_databases = this.data.mysql_databases ?? [];
+            this.data.mysql_users = this.data.mysql_users ?? [];
+            this.data.postgres_databases = this.data.postgres_databases ?? [];
+            this.data.postgres_users = this.data.postgres_users ?? [];
+            this.data.redis_instances = this.data.redis_instances ?? [];
+            this.data.dns_records = this.data.dns_records ?? [];
+            this.data.file_shares = this.data.file_shares ?? [];
+            this.data.file_favorites = this.data.file_favorites ?? [];
+            this.data.api_keys = this.data.api_keys ?? [];
+            this.data.version = this.data.version ?? EMPTY.version;
+        }
+        else {
+            this.data = structuredClone(EMPTY);
+            this.persist();
+        }
+    }
+    get snapshot() {
+        return this.data;
+    }
+    persist() {
+        const tmp = `${this.path}.${process.pid}.tmp`;
+        writeFileSync(tmp, JSON.stringify(this.data, null, 2), 'utf8');
+        renameSync(tmp, this.path);
+    }
+    close() {
+        this.persist();
+    }
+}
+//# sourceMappingURL=store.js.map

package/dist/db/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/db/store.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAkQpC,MAAM,KAAK,GAAc;IACvB,OAAO,EAAE,CAAC;IACV,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE,EAAE;IACZ,QAAQ,EAAE,EAAE;IACZ,QAAQ,EAAE,EAAE;IACZ,SAAS,EAAE,EAAE;IACb,YAAY,EAAE,EAAE;IAChB,QAAQ,EAAE,EAAE;IACZ,cAAc,EAAE,EAAE;IAClB,cAAc,EAAE,EAAE;IAClB,aAAa,EAAE,EAAE;IACjB,QAAQ,EAAE,EAAE;IACZ,aAAa,EAAE,EAAE;IACjB,WAAW,EAAE,EAAE;IACf,SAAS,EAAE,EAAE;IACb,cAAc,EAAE,EAAE;IAClB,YAAY,EAAE,EAAE;IAChB,SAAS,EAAE,EAAE;IACb,aAAa,EAAE,EAAE;IACjB,SAAS,EAAE,EAAE;IACb,WAAW,EAAE,EAAE;IACf,YAAY,EAAE,EAAE;IAChB,eAAe,EAAE,EAAE;IACnB,WAAW,EAAE,EAAE;IACf,kBAAkB,EAAE,EAAE;IACtB,cAAc,EAAE,EAAE;IAClB,eAAe,EAAE,EAAE;IACnB,WAAW,EAAE,EAAE;IACf,WAAW,EAAE,EAAE;IACf,cAAc,EAAE,EAAE;IAClB,QAAQ,EAAE,EAAE;CACb,CAAC;AAEF,MAAM,OAAO,SAAS;IACZ,IAAI,CAAY;IACP,IAAI,CAAS;IAE9B,YAAY,IAAY;QACtB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YACpE,uBAAuB;YACvB,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;YAC9C,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;YAC9C,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;YAC9C,IAAI,CAAC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC;YAChE,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;YAChD,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;YACtD,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;YAC9C,IAAI,CAAC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC;YAC1D,IAAI,CAAC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC;YAC1D,IAAI,CAAC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;YACxD,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;YAC9C,IAAI,CAAC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;YACxD,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;YACpD,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;YAChD,IAAI,CAAC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC;YAC1D,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;YACtD,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;YAChD,IAAI,CAAC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;YACxD,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;YAChD,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;YACpD,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;YACtD,IAAI,CAAC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC;YAC5D,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;YACpD,IAAI,CAAC,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,IAAI,EAAE,CAAC;YAClE,IAAI,CAAC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC;YAC1D,IAAI,CAAC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC;YAC5D,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;YACpD,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;YACpD,IAAI,CAAC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC;YAC1D,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;YAC9C,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC;QACzD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,OAAO;QACL,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;QAC9C,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC/D,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;CACF"}

package/dist/email/autodiscover.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Generate Autodiscover / Autoconfig XML for mail clients.
+ */
+export declare function renderMozillaAutoconfig(opts: {
+    domain: string;
+    imapHost?: string;
+    smtpHost?: string;
+    imapPort?: number;
+    smtpPort?: number;
+}): string;
+export declare function renderOutlookAutodiscover(opts: {
+    domain: string;
+    email?: string;
+    imapHost?: string;
+    smtpHost?: string;
+}): string;
+//# sourceMappingURL=autodiscover.d.ts.map

package/dist/email/autodiscover.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"autodiscover.d.ts","sourceRoot":"","sources":["../../src/email/autodiscover.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,MAAM,CA4BT;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,MAAM,CAoCT"}

package/dist/email/autodiscover.js

@@ -0,0 +1,70 @@
+/**
+ * Generate Autodiscover / Autoconfig XML for mail clients.
+ */
+export function renderMozillaAutoconfig(opts) {
+    const imap = opts.imapHost ?? `mail.${opts.domain}`;
+    const smtp = opts.smtpHost ?? `mail.${opts.domain}`;
+    const imapPort = opts.imapPort ?? 993;
+    const smtpPort = opts.smtpPort ?? 587;
+    return `<?xml version="1.0" encoding="UTF-8"?>
+<clientConfig version="1.1">
+  <emailProvider id="${opts.domain}">
+    <domain>${opts.domain}</domain>
+    <displayName>${opts.domain} Mail</displayName>
+    <displayShortName>${opts.domain}</displayShortName>
+    <incomingServer type="imap">
+      <hostname>${imap}</hostname>
+      <port>${imapPort}</port>
+      <socketType>SSL</socketType>
+      <authentication>password-cleartext</authentication>
+      <username>%EMAILADDRESS%</username>
+    </incomingServer>
+    <outgoingServer type="smtp">
+      <hostname>${smtp}</hostname>
+      <port>${smtpPort}</port>
+      <socketType>STARTTLS</socketType>
+      <authentication>password-cleartext</authentication>
+      <username>%EMAILADDRESS%</username>
+    </outgoingServer>
+  </emailProvider>
+</clientConfig>
+`;
+}
+export function renderOutlookAutodiscover(opts) {
+    const email = opts.email ?? `user@${opts.domain}`;
+    const imap = opts.imapHost ?? `mail.${opts.domain}`;
+    const smtp = opts.smtpHost ?? `mail.${opts.domain}`;
+    return `<?xml version="1.0" encoding="utf-8"?>
+<Autodiscover xmlns="http://schemas.microsoft.com/exchange/autodiscover/responseschema/2006">
+  <Response xmlns="http://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a">
+    <Account>
+      <AccountType>email</AccountType>
+      <Action>settings</Action>
+      <Protocol>
+        <Type>IMAP</Type>
+        <Server>${imap}</Server>
+        <Port>993</Port>
+        <DomainRequired>off</DomainRequired>
+        <LoginName>${email}</LoginName>
+        <SPA>off</SPA>
+        <SSL>on</SSL>
+        <AuthRequired>on</AuthRequired>
+      </Protocol>
+      <Protocol>
+        <Type>SMTP</Type>
+        <Server>${smtp}</Server>
+        <Port>587</Port>
+        <DomainRequired>off</DomainRequired>
+        <LoginName>${email}</LoginName>
+        <SPA>off</SPA>
+        <Encryption>TLS</Encryption>
+        <AuthRequired>on</AuthRequired>
+        <UsePOPAuth>on</UsePOPAuth>
+        <SMTPLast>off</SMTPLast>
+      </Protocol>
+    </Account>
+  </Response>
+</Autodiscover>
+`;
+}
+//# sourceMappingURL=autodiscover.js.map

package/dist/email/autodiscover.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"autodiscover.js","sourceRoot":"","sources":["../../src/email/autodiscover.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,UAAU,uBAAuB,CAAC,IAMvC;IACC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC;IACtC,OAAO;;uBAEc,IAAI,CAAC,MAAM;cACpB,IAAI,CAAC,MAAM;mBACN,IAAI,CAAC,MAAM;wBACN,IAAI,CAAC,MAAM;;kBAEjB,IAAI;cACR,QAAQ;;;;;;kBAMJ,IAAI;cACR,QAAQ;;;;;;;CAOrB,CAAC;AACF,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,IAKzC;IACC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;IAClD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;IACpD,OAAO;;;;;;;;kBAQS,IAAI;;;qBAGD,KAAK;;;;;;;kBAOR,IAAI;;;qBAGD,KAAK;;;;;;;;;;CAUzB,CAAC;AACF,CAAC"}

package/dist/email/deliverability.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Deliverability ops pack — unified checklist for operators.
+ * Never claims global inbox delivery; PTR / Port 25 / reputation stay external.
+ */
+import { type EmailExternalTodo } from 'ysk-server-shared';
+import { type LiveCheckResult } from './live-checks.js';
+import { type WarmupPlan } from './warmup.js';
+export type DeliverabilityCheckId = 'mx' | 'spf' | 'dkim' | 'dmarc' | 'ptr' | 'port25' | 'dnsbl' | 'relay' | 'warmup';
+export type DeliverabilityItem = {
+    id: DeliverabilityCheckId | string;
+    title: string;
+    ok: boolean | null;
+    /** ready | warn | blocked | external | unknown */
+    level: 'ready' | 'warn' | 'blocked' | 'external' | 'unknown';
+    detail: string;
+    /** Operator action — never auto-fixed by panel when external */
+    owner: 'panel' | 'dns_provider' | 'vps_provider' | 'operator';
+    fixHint?: string;
+};
+export type DeliverabilityReport = {
+    at: string;
+    domain: string;
+    serverIp: string;
+    mailHostname: string;
+    /** 0–100 composite from live health; DNSBL may reduce score */
+    score: number;
+    /** Explicit honesty banner keys / strings */
+    honesty: string[];
+    items: DeliverabilityItem[];
+    externalTodos: EmailExternalTodo[];
+    warmup: WarmupPlan;
+    live: LiveCheckResult;
+    relayConfigured: boolean;
+    /** true only when all panel-checkable items are ready AND no hard blocks */
+    panelReady: boolean;
+    /** Never true for "guaranteed worldwide delivery" */
+    deliveryGuaranteed: false;
+};
+/**
+ * Full deliverability pack for one mail domain (live DNS/network + checklist).
+ */
+export declare function buildDeliverabilityReport(input: {
+    domain: string;
+    serverIp: string;
+    serverIpv6?: string;
+    mailHostname?: string;
+    dkimPublicKey: string;
+    dkimSelector?: string;
+    dataDir?: string;
+    ptrOkStored?: boolean;
+    port25Stored?: boolean;
+    dnsApplied?: boolean;
+    dmarcPresent?: boolean;
+}): Promise<DeliverabilityReport>;
+//# sourceMappingURL=deliverability.d.ts.map

package/dist/email/deliverability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deliverability.d.ts","sourceRoot":"","sources":["../../src/email/deliverability.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAM,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE/D,OAAO,EAAsB,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,EAAmB,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAG/D,MAAM,MAAM,qBAAqB,GAC7B,IAAI,GACJ,KAAK,GACL,MAAM,GACN,OAAO,GACP,KAAK,GACL,QAAQ,GACR,OAAO,GACP,OAAO,GACP,QAAQ,CAAC;AAEb,MAAM,MAAM,kBAAkB,GAAG;IAC/B,EAAE,EAAE,qBAAqB,GAAG,MAAM,CAAC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,OAAO,GAAG,IAAI,CAAC;IACnB,kDAAkD;IAClD,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,KAAK,EAAE,OAAO,GAAG,cAAc,GAAG,cAAc,GAAG,UAAU,CAAC;IAC9D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,KAAK,EAAE,MAAM,CAAC;IACd,6CAA6C;IAC7C,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,aAAa,EAAE,iBAAiB,EAAE,CAAC;IACnC,MAAM,EAAE,UAAU,CAAC;IACnB,IAAI,EAAE,eAAe,CAAC;IACtB,eAAe,EAAE,OAAO,CAAC;IACzB,4EAA4E;IAC5E,UAAU,EAAE,OAAO,CAAC;IACpB,qDAAqD;IACrD,kBAAkB,EAAE,KAAK,CAAC;CAC3B,CAAC;AAyBF;;GAEG;AACH,wBAAsB,yBAAyB,CAAC,KAAK,EAAE;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAqIhC"}

package/dist/email/deliverability.js

@@ -0,0 +1,135 @@
+/**
+ * Deliverability ops pack — unified checklist for operators.
+ * Never claims global inbox delivery; PTR / Port 25 / reputation stay external.
+ */
+import { tl } from 'ysk-server-shared';
+import { buildExternalTodos } from './dns-records.js';
+import { runLiveEmailChecks } from './live-checks.js';
+import { planEmailWarmup } from './warmup.js';
+import { loadSmtpRelaySettings } from './relay.js';
+function itemFromLive(id, title, check, owner, fixHint) {
+    const ok = check.ok;
+    let level = 'unknown';
+    if (ok === true)
+        level = 'ready';
+    else if (ok === false)
+        level = owner === 'vps_provider' || owner === 'dns_provider' ? 'external' : 'blocked';
+    else
+        level = 'warn';
+    return {
+        id,
+        title,
+        ok,
+        level,
+        detail: check.detail,
+        owner,
+        fixHint,
+    };
+}
+/**
+ * Full deliverability pack for one mail domain (live DNS/network + checklist).
+ */
+export async function buildDeliverabilityReport(input) {
+    const domain = input.domain.trim().toLowerCase();
+    const mailHostname = (input.mailHostname ?? `mail.${domain}`).trim().toLowerCase();
+    const serverIp = input.serverIp.trim();
+    const live = await runLiveEmailChecks({
+        domain,
+        serverIp,
+        mailHostname,
+        dkimPublicKey: input.dkimPublicKey,
+        dkimSelector: input.dkimSelector,
+    });
+    const externalTodos = buildExternalTodos({
+        domain,
+        mailHostname,
+        ptrOk: live.ptr.ok,
+        port25Open: live.port25.ok === true,
+        dnsApplied: live.mx.ok && live.spf.ok && live.dkim.ok,
+        dmarcPresent: live.dmarc.ok,
+    });
+    let relayConfigured = false;
+    if (input.dataDir) {
+        try {
+            const r = loadSmtpRelaySettings(input.dataDir);
+            relayConfigured = Boolean(r?.host);
+        }
+        catch {
+            relayConfigured = false;
+        }
+    }
+    const warmup = planEmailWarmup({
+        domain,
+        serverIp,
+        isNewIp: !live.ptr.ok || live.port25.ok === false,
+    });
+    const items = [
+        itemFromLive('mx', tl('email.deliv.mx'), live.mx, 'dns_provider', tl('email.deliv.mxFix')),
+        itemFromLive('spf', tl('email.deliv.spf'), live.spf, 'dns_provider', tl('email.deliv.spfFix')),
+        itemFromLive('dkim', tl('email.deliv.dkim'), live.dkim, 'dns_provider', tl('email.deliv.dkimFix')),
+        itemFromLive('dmarc', tl('email.deliv.dmarc'), live.dmarc, 'dns_provider', tl('email.deliv.dmarcFix')),
+        itemFromLive('ptr', tl('email.deliv.ptr'), live.ptr, 'vps_provider', tl('email.deliv.ptrFix')),
+        itemFromLive('port25', tl('email.deliv.port25'), live.port25, 'vps_provider', live.port25.ok ? undefined : tl('email.deliv.port25Fix')),
+        itemFromLive('dnsbl', tl('email.deliv.dnsbl'), live.dnsbl, 'operator', live.dnsbl.ok ? undefined : tl('email.deliv.dnsblFix')),
+        {
+            id: 'relay',
+            title: tl('email.deliv.relay'),
+            ok: live.port25.ok === true ? true : relayConfigured,
+            level: live.port25.ok === true
+                ? 'ready'
+                : relayConfigured
+                    ? 'ready'
+                    : 'warn',
+            detail: live.port25.ok === true
+                ? tl('email.deliv.relayOptional')
+                : relayConfigured
+                    ? tl('email.deliv.relayPresent')
+                    : tl('email.deliv.relayMissing'),
+            owner: 'operator',
+            fixHint: tl('email.deliv.relayFix'),
+        },
+        {
+            id: 'warmup',
+            title: tl('email.deliv.warmup'),
+            ok: true,
+            level: 'ready',
+            detail: tl('email.deliv.warmupDetail', {
+                phases: warmup.phases.length,
+                day1: warmup.phases[0]?.maxMessagesPerDay ?? '—',
+            }),
+            owner: 'operator',
+            fixHint: tl('email.deliv.warmupFix'),
+        },
+    ];
+    const honesty = [
+        tl('email.deliv.honesty1'),
+        tl('email.deliv.honesty2'),
+        tl('email.deliv.honesty3'),
+        live.port25.ok === false
+            ? tl('email.deliv.honestyPortBlocked')
+            : tl('email.deliv.honestyPortOk'),
+    ];
+    const hardBlocks = items.filter((i) => i.ok === false &&
+        (i.id === 'mx' || i.id === 'spf' || i.id === 'dkim' || i.id === 'dnsbl'));
+    const panelReady = hardBlocks.length === 0 &&
+        live.mx.ok &&
+        live.spf.ok &&
+        live.dkim.ok &&
+        live.dnsbl.ok;
+    return {
+        at: new Date().toISOString(),
+        domain,
+        serverIp,
+        mailHostname,
+        score: live.health.score,
+        honesty,
+        items,
+        externalTodos,
+        warmup,
+        live,
+        relayConfigured,
+        panelReady,
+        deliveryGuaranteed: false,
+    };
+}
+//# sourceMappingURL=deliverability.js.map