ysk-server-core 1.0.0

package/dist/hosting/host-migrate/temp-key.js

@@ -0,0 +1,207 @@
+/**
+ * Ephemeral SSH key for migrate: generate on source, install pubkey on target via password once.
+ * Private key lives under dataDir/migrate/<jobId>/ssh/ — never in ysk.json.
+ */
+import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync, } from 'node:fs';
+import { join } from 'node:path';
+import { assertHonestOps, tl } from 'ysk-server-shared';
+import { generateSshKeyPair } from '../../security/ssh-identity/generate.js';
+import { migrateJobDir } from './types.js';
+import { runSshCommand, userAtHost, } from './transport.js';
+/**
+ * Generate ed25519 key pair under job migrate dir.
+ */
+export function createMigrateTempKey(input) {
+    const dir = join(migrateJobDir(input.dataDir, input.jobId), 'ssh');
+    mkdirSync(dir, { recursive: true });
+    try {
+        const pair = generateSshKeyPair({
+            algorithm: 'ed25519',
+            comment: `ysk-migrate-${input.jobId.slice(0, 8)}`,
+        });
+        const privateKeyPath = join(dir, 'id_ed25519');
+        const publicKeyPath = join(dir, 'id_ed25519.pub');
+        writeFileSync(privateKeyPath, pair.privateKey.endsWith('\n') ? pair.privateKey : pair.privateKey + '\n', { mode: 0o600 });
+        try {
+            chmodSync(privateKeyPath, 0o600);
+        }
+        catch {
+            /* */
+        }
+        writeFileSync(publicKeyPath, pair.publicKey.endsWith('\n') ? pair.publicKey : pair.publicKey + '\n', {
+            mode: 0o644,
+        });
+        return assertHonestOps({
+            ok: true,
+            apply_status: 'written',
+            notes: [tl('notes.auto.t0641', { v0: (pair.fingerprintSha256) })],
+            privateKeyPath,
+            publicKeyPath,
+            publicKey: pair.publicKey.trim(),
+            fingerprintSha256: pair.fingerprintSha256,
+        });
+    }
+    catch (e) {
+        return assertHonestOps({
+            ok: false,
+            apply_status: 'failed',
+            notes: [
+                tl('notes.auto.t0642', { v0: (e instanceof Error ? e.message : String(e)) }),
+            ],
+            privateKeyPath: '',
+            publicKeyPath: '',
+            publicKey: '',
+            fingerprintSha256: '',
+        });
+    }
+}
+/**
+ * Install public key on target using password auth (one-shot).
+ * Remote: mkdir ~/.ssh && append authorized_keys.
+ */
+export async function installTempKeyOnTarget(input) {
+    const pub = input.publicKey.trim();
+    if (!pub.startsWith('ssh-')) {
+        return assertHonestOps({
+            ok: false,
+            apply_status: 'failed',
+            notes: [tl('notes.auto.n1104')],
+        });
+    }
+    // Avoid shell injection: base64 the key for remote decode
+    const b64 = Buffer.from(pub + '\n', 'utf8').toString('base64');
+    const remote = [
+        'umask 077',
+        'mkdir -p ~/.ssh',
+        'touch ~/.ssh/authorized_keys',
+        `echo ${JSON.stringify(b64)} | base64 -d >> ~/.ssh/authorized_keys`,
+        'chmod 700 ~/.ssh',
+        'chmod 600 ~/.ssh/authorized_keys',
+        'echo YSK_KEY_INSTALLED',
+    ].join(' && ');
+    const r = await runSshCommand({
+        host: input.host,
+        endpoint: input.endpoint,
+        auth: { kind: 'password', password: input.password },
+        remoteCommand: remote,
+        timeoutMs: 30_000,
+        name: 'install-temp-key',
+    });
+    if (!r.ok)
+        return r;
+    if (!r.stdout.includes('YSK_KEY_INSTALLED') && !r.stderr.includes('YSK_KEY_INSTALLED')) {
+        // some ssh merge stdout
+        const combined = r.stdout + r.stderr;
+        if (!combined.includes('YSK_KEY_INSTALLED')) {
+            return assertHonestOps({
+                ok: false,
+                apply_status: 'failed',
+                notes: [
+                    tl('notes.auto.t0643', { v0: ((r.stdout || r.stderr).slice(0, 200)) }),
+                ],
+            });
+        }
+    }
+    return assertHonestOps({
+        ok: true,
+        apply_status: 'applied',
+        notes: [
+            tl('notes.auto.t0644', { v0: (userAtHost(input.endpoint)) }),
+        ],
+    });
+}
+/**
+ * Full flow: generate key + install with password → return identity auth for later phases.
+ */
+export async function bootstrapTempKeyAuth(input) {
+    const gen = createMigrateTempKey({
+        dataDir: input.dataDir,
+        jobId: input.jobId,
+    });
+    if (!gen.ok || !gen.privateKeyPath) {
+        return gen;
+    }
+    const inst = await installTempKeyOnTarget({
+        host: input.host,
+        endpoint: input.endpoint,
+        password: input.password,
+        publicKey: gen.publicKey,
+    });
+    if (!inst.ok) {
+        return assertHonestOps({
+            ok: false,
+            blocked: inst.blocked,
+            blockMessage: inst.blockMessage,
+            apply_status: inst.apply_status ?? 'failed',
+            notes: [...gen.notes, ...inst.notes],
+        });
+    }
+    return assertHonestOps({
+        ok: true,
+        apply_status: 'applied',
+        notes: [...gen.notes, ...inst.notes],
+        auth: { kind: 'identity', privateKeyPath: gen.privateKeyPath },
+        privateKeyPath: gen.privateKeyPath,
+    });
+}
+/** Remove temp key files (and optionally strip from target — call revoke separately). */
+export function destroyLocalTempKey(dataDir, jobId) {
+    const dir = join(migrateJobDir(dataDir, jobId), 'ssh');
+    if (!existsSync(dir)) {
+        return assertHonestOps({
+            ok: true,
+            apply_status: 'written',
+            notes: [tl('notes.auto.n1198')],
+        });
+    }
+    try {
+        rmSync(dir, { recursive: true, force: true });
+        return assertHonestOps({
+            ok: true,
+            apply_status: 'applied',
+            notes: [tl('notes.auto.n0739')],
+        });
+    }
+    catch (e) {
+        return assertHonestOps({
+            ok: false,
+            apply_status: 'failed',
+            notes: [tl('notes.auto.t0645', { v0: (e instanceof Error ? e.message : String(e)) })],
+        });
+    }
+}
+/**
+ * Best-effort: remove our public key line from target authorized_keys.
+ */
+export async function revokeTempKeyOnTarget(input) {
+    const pub = input.publicKey.trim();
+    const b64 = Buffer.from(pub, 'utf8').toString('base64');
+    const remote = [
+        `KEY=$(echo ${JSON.stringify(b64)} | base64 -d)`,
+        'if [ -f ~/.ssh/authorized_keys ]; then',
+        '  grep -vF "$KEY" ~/.ssh/authorized_keys > ~/.ssh/authorized_keys.ysk-tmp || true',
+        '  mv ~/.ssh/authorized_keys.ysk-tmp ~/.ssh/authorized_keys',
+        '  chmod 600 ~/.ssh/authorized_keys',
+        'fi',
+        'echo YSK_KEY_REVOKED',
+    ].join('\n');
+    return runSshCommand({
+        host: input.host,
+        endpoint: input.endpoint,
+        auth: input.auth,
+        remoteCommand: remote,
+        timeoutMs: 20_000,
+    });
+}
+export function readTempPublicKey(dataDir, jobId) {
+    const p = join(migrateJobDir(dataDir, jobId), 'ssh', 'id_ed25519.pub');
+    if (!existsSync(p))
+        return null;
+    try {
+        return readFileSync(p, 'utf8').trim();
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=temp-key.js.map

package/dist/hosting/host-migrate/temp-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"temp-key.js","sourceRoot":"","sources":["../../../src/hosting/host-migrate/temp-key.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,YAAY,EACZ,MAAM,EACN,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,eAAe,EAAE,EAAE,EAAC,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAGL,aAAa,EACb,UAAU,GACX,MAAM,gBAAgB,CAAC;AASxB;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAGpC;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IACnE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,kBAAkB,CAAC;YAC9B,SAAS,EAAE,SAAS;YACpB,OAAO,EAAE,eAAe,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;SAClD,CAAC,CAAC;QACH,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAC/C,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QAClD,aAAa,CACX,cAAc,EACd,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,EACzE,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;QACF,IAAI,CAAC;YACH,SAAS,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,KAAK;QACP,CAAC;QACD,aAAa,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,EAAE;YACnG,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,OAAO,eAAe,CAAC;YACrB,EAAE,EAAE,IAAI;YACR,YAAY,EAAE,SAAS;YACvB,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;YACjE,cAAc;YACd,aAAa;YACb,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE;YAChC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;SAC1C,CAAmC,CAAC;IACvC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,eAAe,CAAC;YACrB,EAAE,EAAE,KAAK;YACT,YAAY,EAAE,QAAQ;YACtB,KAAK,EAAE;gBACL,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7E;YACD,cAAc,EAAE,EAAE;YAClB,aAAa,EAAE,EAAE;YACjB,SAAS,EAAE,EAAE;YACb,iBAAiB,EAAE,EAAE;SACtB,CAAmC,CAAC;IACvC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAK5C;IACC,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,OAAO,eAAe,CAAC;YACrB,EAAE,EAAE,KAAK;YACT,YAAY,EAAE,QAAQ;YACtB,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;SAChC,CAAC,CAAC;IACL,CAAC;IACD,0DAA0D;IAC1D,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG;QACb,WAAW;QACX,iBAAiB;QACjB,8BAA8B;QAC9B,QAAQ,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,wCAAwC;QACnE,kBAAkB;QAClB,kCAAkC;QAClC,wBAAwB;KACzB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEf,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC;QAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;QACpD,aAAa,EAAE,MAAM;QACrB,SAAS,EAAE,MAAM;QACjB,IAAI,EAAE,kBAAkB;KACzB,CAAC,CAAC;IAEH,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,CAAC,CAAC;IACpB,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACvF,wBAAwB;QACxB,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QACrC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC5C,OAAO,eAAe,CAAC;gBACrB,EAAE,EAAE,KAAK;gBACT,YAAY,EAAE,QAAQ;gBACtB,KAAK,EAAE;oBACL,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;iBACvE;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,eAAe,CAAC;QACrB,EAAE,EAAE,IAAI;QACR,YAAY,EAAE,SAAS;QACvB,KAAK,EAAE;YACL,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;SAC7D;KACF,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAM1C;IACC,MAAM,GAAG,GAAG,oBAAoB,CAAC;QAC/B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;QACnC,OAAO,GAAG,CAAC;IACb,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC;QACxC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,OAAO,eAAe,CAAC;YACrB,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,QAAQ;YAC3C,KAAK,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;SACrC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,eAAe,CAAC;QACrB,EAAE,EAAE,IAAI;QACR,YAAY,EAAE,SAAS;QACvB,KAAK,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QACpC,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE;QAC9D,cAAc,EAAE,GAAG,CAAC,cAAc;KACnC,CAAsE,CAAC;AAC1E,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,mBAAmB,CAAC,OAAe,EAAE,KAAa;IAChE,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,eAAe,CAAC;YACrB,EAAE,EAAE,IAAI;YACR,YAAY,EAAE,SAAS;YACvB,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;SAChC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,OAAO,eAAe,CAAC;YACrB,EAAE,EAAE,IAAI;YACR,YAAY,EAAE,SAAS;YACvB,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;SAChC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,eAAe,CAAC;YACrB,EAAE,EAAE,KAAK;YACT,YAAY,EAAE,QAAQ;YACtB,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SACtF,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAK3C;IACC,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG;QACb,cAAc,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,eAAe;QAChD,wCAAwC;QACxC,mFAAmF;QACnF,4DAA4D;QAC5D,oCAAoC;QACpC,IAAI;QACJ,sBAAsB;KACvB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,OAAO,aAAa,CAAC;QACnB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,aAAa,EAAE,MAAM;QACrB,SAAS,EAAE,MAAM;KAClB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,KAAa;IAEb,MAAM,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACvE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/hosting/host-migrate/transfer.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Transfer phase: rsync dataDir + project homes + optional /etc paths to target.
+ * Requires package phase dumps already under dataDir (included in dataDir rsync).
+ */
+import type { HostManifest, MigrateJobDto, OpsResultDto } from 'ysk-server-shared';
+import type { HostExecutor } from '../../host/executor.js';
+import { type MigrateSshAuth, type MigrateSshEndpoint } from './transport.js';
+export type TransferItemResult = {
+    id: string;
+    kind: 'mkdir' | 'dataDir' | 'home' | 'optionalEtc' | 'verify';
+    ok: boolean;
+    notes: string[];
+    blocked?: boolean;
+};
+export type TransferResult = OpsResultDto & {
+    items: TransferItemResult[];
+    targetDataDir: string;
+};
+/**
+ * Ensure remote parent directories exist.
+ */
+export declare function ensureRemoteDirs(input: {
+    host: HostExecutor;
+    endpoint: MigrateSshEndpoint;
+    auth: MigrateSshAuth;
+    dirs: string[];
+}): Promise<OpsResultDto>;
+/**
+ * Sample verify: compare ysk.json sha256 source vs target.
+ */
+export declare function verifyRemoteYskJson(input: {
+    host: HostExecutor;
+    endpoint: MigrateSshEndpoint;
+    auth: MigrateSshAuth;
+    localDataDir: string;
+    targetDataDir: string;
+    expectedSha?: string;
+}): Promise<OpsResultDto & {
+    localSha?: string;
+    remoteSha?: string;
+}>;
+/**
+ * Rsync full migrate payload to target.
+ */
+export declare function transferMigratePayload(input: {
+    host: HostExecutor;
+    dataDir: string;
+    job: MigrateJobDto;
+    manifest: HostManifest;
+    endpoint: MigrateSshEndpoint;
+    auth: MigrateSshAuth;
+    targetDataDir?: string;
+    /** Also rsync optionalEtc from manifest (e.g. /etc/letsencrypt) */
+    includeOptionalEtc?: boolean;
+    dryRun?: boolean;
+}): Promise<TransferResult>;
+//# sourceMappingURL=transfer.d.ts.map

package/dist/hosting/host-migrate/transfer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transfer.d.ts","sourceRoot":"","sources":["../../../src/hosting/host-migrate/transfer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEnF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAK3D,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,kBAAkB,EAGX,MAAM,gBAAgB,CAAC;AAErC,MAAM,MAAM,kBAAkB,GAAG;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,aAAa,GAAG,QAAQ,CAAC;IAC9D,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,YAAY,GAAG;IAC1C,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAUF;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE;IAC5C,IAAI,EAAE,YAAY,CAAC;IACnB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB,GAAG,OAAO,CAAC,YAAY,CAAC,CAkBxB;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,IAAI,EAAE,YAAY,CAAC;IACnB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,IAAI,EAAE,cAAc,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,YAAY,GAAG;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA8CpE;AAED;;GAEG;AACH,wBAAsB,sBAAsB,CAAC,KAAK,EAAE;IAClD,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,aAAa,CAAC;IACnB,QAAQ,EAAE,YAAY,CAAC;IACvB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,IAAI,EAAE,cAAc,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,GAAG,OAAO,CAAC,cAAc,CAAC,CAkS1B"}

package/dist/hosting/host-migrate/transfer.js

@@ -0,0 +1,408 @@
+/**
+ * Transfer phase: rsync dataDir + project homes + optional /etc paths to target.
+ * Requires package phase dumps already under dataDir (included in dataDir rsync).
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { join } from 'node:path';
+import { assertHonestOps, tl } from 'ysk-server-shared';
+import { appendMigrateStep, setMigratePhase, writeMigrateProgress } from './job-store.js';
+import { rsyncToRemote, runSshCommand, userAtHost } from './transport.js';
+function sha256Local(path) {
+    try {
+        return createHash('sha256').update(readFileSync(path)).digest('hex');
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Ensure remote parent directories exist.
+ */
+export async function ensureRemoteDirs(input) {
+    const list = input.dirs
+        .filter(Boolean)
+        .map((d) => JSON.stringify(d))
+        .join(' ');
+    if (!list) {
+        return assertHonestOps({
+            ok: true,
+            apply_status: 'written',
+            notes: [tl('notes.auto.n1201')]
+        });
+    }
+    return runSshCommand({
+        host: input.host,
+        endpoint: input.endpoint,
+        auth: input.auth,
+        remoteCommand: `mkdir -p ${list} && echo YSK_MKDIR_OK`,
+        timeoutMs: 30_000,
+        name: 'mkdir-remote'
+    });
+}
+/**
+ * Sample verify: compare ysk.json sha256 source vs target.
+ */
+export async function verifyRemoteYskJson(input) {
+    const localPath = join(input.localDataDir, 'ysk.json');
+    const localSha = input.expectedSha ?? sha256Local(localPath);
+    if (!localSha) {
+        return assertHonestOps({
+            ok: false,
+            apply_status: 'failed',
+            notes: [tl('notes.auto.n0998')]
+        });
+    }
+    const remotePath = JSON.stringify(join(input.targetDataDir, 'ysk.json'));
+    const r = await runSshCommand({
+        host: input.host,
+        endpoint: input.endpoint,
+        auth: input.auth,
+        remoteCommand: `sha256sum ${remotePath} 2>/dev/null | awk '{print $1}'; echo YSK_SHA_DONE`,
+        timeoutMs: 60_000
+    });
+    if (!r.ok) {
+        return assertHonestOps({
+            ok: false,
+            blocked: r.blocked,
+            apply_status: r.apply_status ?? 'failed',
+            notes: [tl('notes.auto.n1272'), ...r.notes],
+            localSha
+        });
+    }
+    const remoteSha = (r.stdout || '')
+        .split('\n')
+        .map((l) => l.trim())
+        .find((l) => /^[a-f0-9]{64}$/i.test(l));
+    if (!remoteSha) {
+        return assertHonestOps({
+            ok: false,
+            apply_status: 'failed',
+            notes: [tl('notes.auto.t0618', { v0: ((r.stdout || '').slice(0, 120)) })],
+            localSha
+        });
+    }
+    const ok = remoteSha.toLowerCase() === localSha.toLowerCase();
+    return assertHonestOps({
+        ok,
+        apply_status: ok ? 'applied' : 'failed',
+        notes: [
+            ok
+                ? tl('notes.auto.t0619', { v0: (localSha.slice(0, 12)) })
+                : tl('notes.auto.t0620', { v0: (localSha.slice(0, 12)), v1: (remoteSha.slice(0, 12)) }),
+        ],
+        localSha,
+        remoteSha
+    });
+}
+/**
+ * Rsync full migrate payload to target.
+ */
+export async function transferMigratePayload(input) {
+    const items = [];
+    const targetDataDir = input.targetDataDir ?? input.job.targetDataDir ?? '/var/lib/ysk-server';
+    const dataDir = input.dataDir;
+    if (!input.host.executeEnabled()) {
+        return assertHonestOps({
+            ok: false,
+            blocked: true,
+            requiresExecute: true,
+            blockMessage: tl('notes.auto.n0036'),
+            notes: [tl('notes.auto.n0455')],
+            items: [],
+            targetDataDir
+        });
+    }
+    if (!input.manifest.packagedAt && !input.dryRun) {
+        // Soft warning only if dumps empty — still allow transfer of control plane
+        // Hard rule from design: package failure blocks transfer; missing packagedAt is warning
+        items.push({
+            id: 'package-check',
+            kind: 'verify',
+            ok: true,
+            notes: [tl('notes.auto.n1430')]
+        });
+    }
+    setMigratePhase(dataDir, input.job, 'transfer');
+    writeMigrateProgress(dataDir, input.job.id, {
+        phase: 'transfer',
+        status: 'starting',
+        target: userAtHost(input.endpoint)
+    });
+    // 1) mkdir
+    const homeParents = [
+        ...new Set(input.manifest.paths.homes
+            .map((h) => h.replace(/\/[^/]+\/?$/, '') || '/home')
+            .filter(Boolean)),
+    ];
+    const mkdir = await ensureRemoteDirs({
+        host: input.host,
+        endpoint: input.endpoint,
+        auth: input.auth,
+        dirs: [targetDataDir, ...homeParents, '/home']
+    });
+    items.push({
+        id: 'mkdir',
+        kind: 'mkdir',
+        ok: mkdir.ok,
+        notes: mkdir.notes,
+        blocked: mkdir.blocked
+    });
+    appendMigrateStep(dataDir, input.job, {
+        phase: 'transfer',
+        name: 'mkdir-remote',
+        result: {
+            ok: mkdir.ok,
+            blocked: mkdir.blocked,
+            apply_status: mkdir.apply_status,
+            notes: mkdir.notes
+        }
+    });
+    if (!mkdir.ok) {
+        setMigratePhase(dataDir, input.job, 'failed', tl('notes.auto.n1477'));
+        return assertHonestOps({
+            ok: false,
+            blocked: mkdir.blocked,
+            apply_status: mkdir.apply_status ?? 'failed',
+            notes: [tl('notes.auto.n0450'), ...mkdir.notes],
+            items,
+            targetDataDir
+        });
+    }
+    // 2) dataDir
+    writeMigrateProgress(dataDir, input.job.id, {
+        phase: 'transfer',
+        status: 'rsync-dataDir'
+    });
+    if (!existsSync(dataDir)) {
+        items.push({
+            id: 'dataDir',
+            kind: 'dataDir',
+            ok: false,
+            notes: [tl('notes.auto.t0621', { v0: (dataDir) })]
+        });
+        setMigratePhase(dataDir, input.job, 'failed', tl('notes.auto.n0243'));
+        return assertHonestOps({
+            ok: false,
+            apply_status: 'failed',
+            notes: [tl('notes.auto.t0622', { v0: (dataDir) })],
+            items,
+            targetDataDir
+        });
+    }
+    const dataRsync = await rsyncToRemote({
+        host: input.host,
+        endpoint: input.endpoint,
+        auth: input.auth,
+        localPath: dataDir,
+        remotePath: targetDataDir,
+        dryRun: input.dryRun,
+        timeoutMs: 3_600_000
+    });
+    items.push({
+        id: 'dataDir',
+        kind: 'dataDir',
+        ok: dataRsync.ok,
+        notes: dataRsync.notes,
+        blocked: dataRsync.blocked
+    });
+    appendMigrateStep(dataDir, input.job, {
+        phase: 'transfer',
+        name: 'rsync-dataDir',
+        result: {
+            ok: dataRsync.ok,
+            blocked: dataRsync.blocked,
+            apply_status: dataRsync.apply_status,
+            notes: dataRsync.notes
+        }
+    });
+    if (!dataRsync.ok) {
+        setMigratePhase(dataDir, input.job, 'failed', tl('notes.auto.n0421'));
+        return assertHonestOps({
+            ok: false,
+            blocked: dataRsync.blocked,
+            apply_status: dataRsync.apply_status ?? 'failed',
+            blockMessage: dataRsync.blockMessage,
+            notes: [tl('notes.auto.n0449'), ...dataRsync.notes],
+            items,
+            targetDataDir
+        });
+    }
+    // 3) homes (skip those already under dataDir to avoid double-copy noise)
+    const dataResolved = dataDir.replace(/\/$/, '');
+    let homeIdx = 0;
+    for (const home of input.manifest.paths.homes) {
+        homeIdx += 1;
+        if (!existsSync(home)) {
+            items.push({
+                id: `home:${home}`,
+                kind: 'home',
+                ok: true,
+                notes: [tl('notes.auto.t0623', { v0: (home) })]
+            });
+            continue;
+        }
+        if (home === dataResolved || home.startsWith(dataResolved + '/')) {
+            items.push({
+                id: `home:${home}`,
+                kind: 'home',
+                ok: true,
+                notes: [tl('notes.auto.t0624', { v0: (home) })]
+            });
+            continue;
+        }
+        writeMigrateProgress(dataDir, input.job.id, {
+            phase: 'transfer',
+            status: 'rsync-home',
+            home,
+            index: homeIdx,
+            total: input.manifest.paths.homes.length
+        });
+        const hr = await rsyncToRemote({
+            host: input.host,
+            endpoint: input.endpoint,
+            auth: input.auth,
+            localPath: home,
+            remotePath: home,
+            dryRun: input.dryRun,
+            timeoutMs: 3_600_000
+        });
+        items.push({
+            id: `home:${home}`,
+            kind: 'home',
+            ok: hr.ok,
+            notes: hr.notes,
+            blocked: hr.blocked
+        });
+        appendMigrateStep(dataDir, input.job, {
+            phase: 'transfer',
+            name: `rsync-home:${home}`,
+            result: {
+                ok: hr.ok,
+                blocked: hr.blocked,
+                apply_status: hr.apply_status,
+                notes: hr.notes
+            }
+        });
+        if (!hr.ok) {
+            setMigratePhase(dataDir, input.job, 'failed', tl('notes.auto.t0625', { v0: (home) }));
+            return assertHonestOps({
+                ok: false,
+                blocked: hr.blocked,
+                apply_status: hr.apply_status ?? 'failed',
+                notes: [tl('notes.auto.t0626', { v0: (home) }), ...hr.notes],
+                items,
+                targetDataDir
+            });
+        }
+    }
+    // 4) optional etc
+    if (input.includeOptionalEtc !== false) {
+        for (const etc of input.manifest.paths.optionalEtc) {
+            if (!existsSync(etc)) {
+                items.push({
+                    id: `etc:${etc}`,
+                    kind: 'optionalEtc',
+                    ok: true,
+                    notes: [tl('notes.auto.t0627', { v0: (etc) })]
+                });
+                continue;
+            }
+            const er = await rsyncToRemote({
+                host: input.host,
+                endpoint: input.endpoint,
+                auth: input.auth,
+                localPath: etc,
+                remotePath: etc,
+                dryRun: input.dryRun,
+                timeoutMs: 1_800_000
+            });
+            items.push({
+                id: `etc:${etc}`,
+                kind: 'optionalEtc',
+                ok: er.ok,
+                notes: er.notes,
+                blocked: er.blocked
+            });
+            appendMigrateStep(dataDir, input.job, {
+                phase: 'transfer',
+                name: `rsync-etc:${etc}`,
+                result: {
+                    ok: er.ok,
+                    blocked: er.blocked,
+                    apply_status: er.apply_status,
+                    notes: er.notes
+                }
+            });
+            // optional etc failure is non-fatal (LE may re-issue)
+            if (!er.ok) {
+                items[items.length - 1].notes.push(tl('notes.auto.n0354'));
+            }
+        }
+    }
+    // 5) verify ysk.json (skip pure dry-run)
+    if (!input.dryRun) {
+        writeMigrateProgress(dataDir, input.job.id, {
+            phase: 'transfer',
+            status: 'verify-ysk-json'
+        });
+        const expected = input.manifest.fingerprints['dataDir/ysk.json'] ?? sha256Local(join(dataDir, 'ysk.json'));
+        const v = await verifyRemoteYskJson({
+            host: input.host,
+            endpoint: input.endpoint,
+            auth: input.auth,
+            localDataDir: dataDir,
+            targetDataDir,
+            expectedSha: expected
+        });
+        items.push({
+            id: 'verify-ysk-json',
+            kind: 'verify',
+            ok: v.ok,
+            notes: v.notes,
+            blocked: v.blocked
+        });
+        appendMigrateStep(dataDir, input.job, {
+            phase: 'transfer',
+            name: 'verify-ysk-json',
+            result: {
+                ok: v.ok,
+                blocked: v.blocked,
+                apply_status: v.apply_status,
+                notes: v.notes
+            }
+        });
+        if (!v.ok) {
+            setMigratePhase(dataDir, input.job, 'failed', tl('notes.auto.n0480'));
+            return assertHonestOps({
+                ok: false,
+                apply_status: 'failed',
+                notes: [tl('notes.auto.n0454'), ...v.notes],
+                items,
+                targetDataDir
+            });
+        }
+    }
+    writeMigrateProgress(dataDir, input.job.id, {
+        phase: 'transfer',
+        status: 'done'
+    });
+    const hardFail = items.some((i) => !i.ok &&
+        i.kind !== 'optionalEtc' &&
+        i.id !== 'package-check');
+    // optionalEtc failures already noted as non-fatal; package-check is warning
+    return assertHonestOps({
+        ok: !hardFail,
+        apply_status: input.dryRun ? 'written' : hardFail ? 'failed' : 'applied',
+        notes: [
+            hardFail
+                ? tl('notes.auto.n0453')
+                : tl('notes.auto.t0628', { v0: (userAtHost(input.endpoint)), v1: (targetDataDir) }),
+            `homes ${input.manifest.paths.homes.length} · optionalEtc ${input.manifest.paths.optionalEtc.length}`,
+            ...items.filter((i) => !i.ok).flatMap((i) => i.notes),
+        ],
+        items,
+        targetDataDir
+    });
+}
+//# sourceMappingURL=transfer.js.map