ysk-server-core 1.0.0

package/dist/hosting/nginx-ssl.js

@@ -0,0 +1,342 @@
+/**
+ * Nginx reverse proxy + Let’s Encrypt SSL config generation.
+ */
+import { ErrorCodes, YskError, tl } from 'ysk-server-shared';
+import { renderNginxRealIpBlock, } from './real-ip/index.js';
+function realIpSnippet(opts) {
+    return renderNginxRealIpBlock({
+        provider: opts.realIpProvider,
+        host: opts.realIpHost,
+        cloudflareRealIp: opts.cloudflareRealIp,
+    });
+}
+/** Build space-separated server_name from primary + aliases. */
+export function buildServerNameList(primary, aliases) {
+    const names = [primary, ...(aliases ?? [])]
+        .map((s) => (s ?? '').trim().toLowerCase())
+        .filter(Boolean);
+    const uniq = [...new Set(names)];
+    return uniq.join(' ') || 'localhost';
+}
+function sslLines(opts) {
+    if (!opts.ssl)
+        return '';
+    const primary = opts.serverName.split(/\s+/)[0] || 'localhost';
+    const cert = opts.sslCertificate ?? `/etc/letsencrypt/live/${primary}/fullchain.pem`;
+    const key = opts.sslCertificateKey ?? `/etc/letsencrypt/live/${primary}/privkey.pem`;
+    const hsts = opts.hsts
+        ? '\n  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;'
+        : '';
+    return `
+  ssl_certificate ${cert};
+  ssl_certificate_key ${key};
+  ssl_protocols TLSv1.2 TLSv1.3;${hsts}
+`.trim();
+}
+/** listen directives with optional bind IP (dual-stack when unbound). */
+export function nginxListenLines(opts) {
+    const ip = opts.bindIp?.trim();
+    if (ip) {
+        // IPv6 literal needs brackets: [2001:db8::1]:80
+        const isV6 = ip.includes(':') && !ip.startsWith('[');
+        const host = isV6 ? `[${ip}]` : ip;
+        const prefix = `${host}:`;
+        if (opts.ssl) {
+            return `listen ${prefix}443 ssl http2;\n  listen ${prefix}80;`;
+        }
+        return `listen ${prefix}80;`;
+    }
+    // Dual-stack public listeners (IPv4 + IPv6)
+    if (opts.ssl) {
+        return [
+            'listen 443 ssl http2;',
+            'listen [::]:443 ssl http2;',
+            'listen 80;',
+            'listen [::]:80;',
+        ].join('\n  ');
+    }
+    return 'listen 80;\n  listen [::]:80;';
+}
+function httpRedirectBlock(serverName, bindIp) {
+    const listen = nginxListenLines({ ssl: false, bindIp });
+    return `server {
+  ${listen}
+  server_name ${serverName};
+  return 301 https://$host$request_uri;
+}
+`;
+}
+/**
+ * Render an Nginx server block for reverse proxy.
+ */
+export function renderNginxProxy(config) {
+    if (!config.serverName || !config.upstream) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n1388'), {
+            httpStatus: 400,
+        });
+    }
+    const realIp = realIpSnippet({
+        cloudflareRealIp: config.cloudflareRealIp,
+        realIpProvider: config.realIpProvider,
+        realIpHost: config.realIpHost,
+    });
+    const force = Boolean(config.ssl && config.forceHttps);
+    const sslBlock = sslLines({
+        ssl: config.ssl,
+        sslCertificate: config.sslCertificate,
+        sslCertificateKey: config.sslCertificateKey,
+        serverName: config.serverName,
+        hsts: config.hsts,
+    });
+    const bindIp = config.bindIp;
+    const auth = authBasicBlock(config);
+    if (config.siteRedirectUrl?.trim()) {
+        return siteRedirectOnly({
+            serverName: config.serverName,
+            siteRedirectUrl: config.siteRedirectUrl.trim(),
+            ssl: config.ssl,
+            sslCertificate: config.sslCertificate,
+            sslCertificateKey: config.sslCertificateKey,
+            hsts: config.hsts,
+            bindIp,
+        });
+    }
+    if (force) {
+        const sslListen = nginxListenLines({ ssl: true, bindIp }).split('\n')[0];
+        return `${httpRedirectBlock(config.serverName, bindIp)}server {
+  ${sslListen}
+  server_name ${config.serverName};
+  ${sslBlock}
+  ${realIp}
+  ${auth}
+
+  location / {
+    proxy_pass ${config.upstream};
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+  }
+}
+`;
+    }
+    const listen = nginxListenLines({ ssl: config.ssl, bindIp });
+    return `server {
+  ${listen}
+  server_name ${config.serverName};
+  ${sslBlock}
+  ${realIp}
+  ${auth}
+
+  location / {
+    proxy_pass ${config.upstream};
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+  }
+}
+`;
+}
+/**
+ * Render Nginx server block for pure static site (root + try_files).
+ */
+function authBasicBlock(opts) {
+    if (!opts.authBasicUserFile)
+        return '';
+    return `
+  auth_basic "${opts.authBasicRealm ?? 'Restricted'}";
+  auth_basic_user_file ${opts.authBasicUserFile};
+`;
+}
+function siteRedirectOnly(opts) {
+    const target = opts.siteRedirectUrl.replace(/"/g, '');
+    const listen = nginxListenLines({ ssl: opts.ssl, bindIp: opts.bindIp });
+    const sslBlock = sslLines({
+        ssl: opts.ssl,
+        sslCertificate: opts.sslCertificate,
+        sslCertificateKey: opts.sslCertificateKey,
+        serverName: opts.serverName,
+        hsts: opts.hsts,
+    });
+    return `server {
+  ${listen}
+  server_name ${opts.serverName};
+  ${sslBlock}
+  return 301 ${target}$request_uri;
+}
+`;
+}
+export function renderNginxStatic(opts) {
+    if (!opts.serverName || !opts.docRoot) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n1389'), {
+            httpStatus: 400,
+        });
+    }
+    if (opts.siteRedirectUrl?.trim()) {
+        return siteRedirectOnly({
+            serverName: opts.serverName,
+            siteRedirectUrl: opts.siteRedirectUrl.trim(),
+            ssl: opts.ssl,
+            sslCertificate: opts.sslCertificate,
+            sslCertificateKey: opts.sslCertificateKey,
+            hsts: opts.hsts,
+            bindIp: opts.bindIp,
+        });
+    }
+    const realIp = realIpSnippet(opts);
+    const force = Boolean(opts.ssl && opts.forceHttps);
+    const sslBlock = sslLines({
+        ssl: opts.ssl,
+        sslCertificate: opts.sslCertificate,
+        sslCertificateKey: opts.sslCertificateKey,
+        serverName: opts.serverName,
+        hsts: opts.hsts,
+    });
+    const auth = authBasicBlock(opts);
+    const assetCache = opts.staticCache !== false;
+    const body = (listen) => `server {
+  ${listen}
+  server_name ${opts.serverName};
+  root ${opts.docRoot};
+  index index.html index.htm;
+  ${sslBlock}
+  ${realIp}
+  ${auth}
+
+  location / {
+    try_files $uri $uri/ /index.html;
+  }
+
+  location ~ /\\. {
+    deny all;
+  }
+
+  location ~* \\.(css|js|jpg|jpeg|png|gif|ico|svg|woff2?)$ {
+    ${assetCache ? 'expires 7d;\n    add_header Cache-Control "public";' : 'expires off;'}
+    try_files $uri =404;
+  }
+}
+`;
+    if (force) {
+        const sslListen = nginxListenLines({ ssl: true, bindIp: opts.bindIp }).split('\n')[0];
+        return `${httpRedirectBlock(opts.serverName, opts.bindIp)}${body(sslListen)}`;
+    }
+    const listen = nginxListenLines({ ssl: opts.ssl, bindIp: opts.bindIp });
+    return body(listen);
+}
+/**
+ * Render Nginx server block for PHP projects.
+ * Topology (required): Internet → Nginx → Apache backend → PHP-FPM.
+ * Does NOT fastcgi directly to FPM — Apache owns DocumentRoot + .php handler.
+ */
+export function renderNginxPhpFpm(opts) {
+    if (!opts.serverName) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n1390'), {
+            httpStatus: 400,
+        });
+    }
+    const upstream = (opts.apacheUpstream || '').trim() ||
+        // lazy import-free default matching runtime.apacheBackendUpstream()
+        `http://${process.env.YSK_APACHE_BACKEND_BIND || '127.0.0.1'}:${process.env.YSK_APACHE_BACKEND_PORT || '8080'}`;
+    // Reuse proxy renderer — PHP front is reverse-proxy to Apache
+    return renderNginxProxy({
+        serverName: opts.serverName,
+        upstream,
+        ssl: Boolean(opts.ssl),
+        cloudflareRealIp: Boolean(opts.cloudflareRealIp),
+        sslCertificate: opts.sslCertificate,
+        sslCertificateKey: opts.sslCertificateKey,
+        forceHttps: opts.forceHttps,
+        hsts: opts.hsts,
+        siteRedirectUrl: opts.siteRedirectUrl,
+        authBasicUserFile: opts.authBasicUserFile,
+        authBasicRealm: opts.authBasicRealm,
+        bindIp: opts.bindIp,
+        realIpProvider: opts.realIpProvider,
+        realIpHost: opts.realIpHost,
+    });
+}
+/**
+ * Best-effort purge of common nginx cache dirs + reload.
+ * Honest: needs EXECUTE; may no-op if dirs empty.
+ */
+export async function purgeNginxCache(input) {
+    if (!input.host.executeEnabled()) {
+        return {
+            ok: false,
+            blocked: true,
+            notes: [tl('notes.auto.n1131')],
+        };
+    }
+    const r = await input.host.runCommand([
+        'bash',
+        '-c',
+        'rm -rf /var/cache/nginx/* /var/lib/nginx/cache/* /var/cache/nginx/proxy_temp/* 2>/dev/null; nginx -t 2>&1 && systemctl reload nginx 2>&1; echo EXIT:$?',
+    ], { timeoutMs: 30_000 });
+    const out = `${r.stdout || ''}${r.stderr || ''}`;
+    const ok = r.exitCode === 0 && !/nginx: configuration file .+ test failed/i.test(out);
+    return {
+        ok,
+        notes: [
+            ok
+                ? tl('notes.auto.n0751')
+                : tl('notes.auto.t0109', { v0: (out.slice(0, 400)) }),
+            tl('notes.auto.n1207') + (ok ? 'applied（best-effort）' : 'failed'),
+        ],
+    };
+}
+/** Suspended site: refuse traffic with 503. */
+export function renderNginxSuspended(serverName) {
+    return `server {
+  listen 80;
+  server_name ${serverName};
+  return 503;
+}
+`;
+}
+/**
+ * Build certbot command plan for Let’s Encrypt.
+ */
+export function planLetsEncrypt(plan) {
+    if (!plan.domain || !plan.email) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n1249'), {
+            httpStatus: 400,
+        });
+    }
+    if (plan.provider === 'upload') {
+        return {
+            commands: [],
+            notes: [tl('notes.auto.n0792')],
+        };
+    }
+    const isWildcard = plan.domain.startsWith('*.');
+    const useDns01 = plan.challenge === 'dns-01' || isWildcard;
+    // Wildcard requires dns-01; include apex + wildcard when operator requests *.example.com
+    const names = isWildcard
+        ? [`-d ${plan.domain.slice(2)} -d ${plan.domain}`]
+        : [`-d ${plan.domain}`];
+    const challenge = useDns01
+        ? `certbot certonly --manual --preferred-challenges dns ${names.join(' ')} --email ${plan.email} --agree-tos --non-interactive`
+        : `certbot --nginx -d ${plan.domain} --email ${plan.email} --agree-tos --non-interactive --redirect`;
+    return {
+        commands: useDns01 ? [challenge] : [challenge, 'systemctl reload nginx'],
+        notes: useDns01
+            ? [
+                tl('notes.auto.n0208'),
+                tl('notes.auto.n1217'),
+                tl('notes.auto.n0177'),
+            ]
+            : [
+                'Requires root and port 80/443 reachable for http-01',
+                'Renewal via certbot.timer',
+            ],
+    };
+}
+//# sourceMappingURL=nginx-ssl.js.map

package/dist/hosting/nginx-ssl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nginx-ssl.js","sourceRoot":"","sources":["../../src/hosting/nginx-ssl.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EACL,sBAAsB,GAGvB,MAAM,oBAAoB,CAAC;AAU5B,SAAS,aAAa,CAAC,IAAqB;IAC1C,OAAO,sBAAsB,CAAC;QAC5B,QAAQ,EAAE,IAAI,CAAC,cAAc;QAC7B,IAAI,EAAE,IAAI,CAAC,UAAU;QACrB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;KACxC,CAAC,CAAC;AACL,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,mBAAmB,CAAC,OAAgB,EAAE,OAAkB;IACtE,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;SACxC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAC1C,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IACjC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC;AACvC,CAAC;AAED,SAAS,QAAQ,CAAC,IAMjB;IACC,IAAI,CAAC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACzB,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,IAAI,yBAAyB,OAAO,gBAAgB,CAAC;IACrF,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,IAAI,yBAAyB,OAAO,cAAc,CAAC;IACrF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI;QACpB,CAAC,CAAC,wFAAwF;QAC1F,CAAC,CAAC,EAAE,CAAC;IACP,OAAO;oBACW,IAAI;wBACA,GAAG;kCACO,IAAI;CACrC,CAAC,IAAI,EAAE,CAAC;AACT,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,gBAAgB,CAAC,IAGhC;IACC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IAC/B,IAAI,EAAE,EAAE,CAAC;QACP,gDAAgD;QAChD,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC;QAC1B,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,OAAO,UAAU,MAAM,4BAA4B,MAAM,KAAK,CAAC;QACjE,CAAC;QACD,OAAO,UAAU,MAAM,KAAK,CAAC;IAC/B,CAAC;IACD,4CAA4C;IAC5C,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,OAAO;YACL,uBAAuB;YACvB,4BAA4B;YAC5B,YAAY;YACZ,iBAAiB;SAClB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,+BAA+B,CAAC;AACzC,CAAC;AAED,SAAS,iBAAiB,CAAC,UAAkB,EAAE,MAAe;IAC5D,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACxD,OAAO;IACL,MAAM;gBACM,UAAU;;;CAGzB,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAwB;IACvD,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC3C,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE;YAChE,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC;QAC3B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,cAAc,EAAG,MAA6C,CAAC,cAAc;QAC7E,UAAU,EAAG,MAA6C,CAAC,UAAU;KACtE,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,QAAQ,CAAC;QACxB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,IAAI,EAAE,MAAM,CAAC,IAAI;KAClB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAE7B,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAEpC,IAAI,MAAM,CAAC,eAAe,EAAE,IAAI,EAAE,EAAE,CAAC;QACnC,OAAO,gBAAgB,CAAC;YACtB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,eAAe,EAAE,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE;YAC9C,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,SAAS,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACzE,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC;IACtD,SAAS;gBACG,MAAM,CAAC,UAAU;IAC7B,QAAQ;IACR,MAAM;IACN,IAAI;;;iBAGS,MAAM,CAAC,QAAQ;;;;;;;;;;CAU/B,CAAC;IACA,CAAC;IAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7D,OAAO;IACL,MAAM;gBACM,MAAM,CAAC,UAAU;IAC7B,QAAQ;IACR,MAAM;IACN,IAAI;;;iBAGS,MAAM,CAAC,QAAQ;;;;;;;;;;CAU/B,CAAC;AACF,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,IAGvB;IACC,IAAI,CAAC,IAAI,CAAC,iBAAiB;QAAE,OAAO,EAAE,CAAC;IACvC,OAAO;gBACO,IAAI,CAAC,cAAc,IAAI,YAAY;yBAC1B,IAAI,CAAC,iBAAiB;CAC9C,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,IAQzB;IACC,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,QAAQ,CAAC;QACxB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;KAChB,CAAC,CAAC;IACH,OAAO;IACL,MAAM;gBACM,IAAI,CAAC,UAAU;IAC3B,QAAQ;eACG,MAAM;;CAEpB,CAAC;AACF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,IAemB;IAEnB,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE;YAChE,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,EAAE,CAAC;QACjC,OAAO,gBAAgB,CAAC;YACtB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,eAAe,EAAE,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE;YAC5C,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,QAAQ,CAAC;QACxB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;KAChB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC;IAE9C,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC;IAC/B,MAAM;gBACM,IAAI,CAAC,UAAU;SACtB,IAAI,CAAC,OAAO;;IAEjB,QAAQ;IACR,MAAM;IACN,IAAI;;;;;;;;;;;MAWF,UAAU,CAAC,CAAC,CAAC,qDAAqD,CAAC,CAAC,CAAC,cAAc;;;;CAIxF,CAAC;IAEA,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,SAAS,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACtF,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;IAChF,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACxE,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAkBmB;IAEnB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACrB,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE;YAChE,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,QAAQ,GACZ,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAClC,oEAAoE;QACpE,UAAU,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,MAAM,EAAE,CAAC;IAElH,8DAA8D;IAC9D,OAAO,gBAAgB,CAAC;QACtB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,QAAQ;QACR,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QACtB,gBAAgB,EAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC;QAChD,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,UAAU,EAAE,IAAI,CAAC,UAAU;KACU,CAAC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAErC;IACC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QACjC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;SAChC,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CACnC;QACE,MAAM;QACN,IAAI;QACJ,wJAAwJ;KACzJ,EACD,EAAE,SAAS,EAAE,MAAM,EAAE,CACtB,CAAC;IACF,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;IACjD,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,2CAA2C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtF,OAAO;QACL,EAAE;QACF,KAAK,EAAE;YACL,EAAE;gBACA,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC;gBACxB,CAAC,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YACvD,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,QAAQ,CAAC;SAClE;KACF,CAAC;AACJ,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,oBAAoB,CAAC,UAAkB;IACrD,OAAO;;gBAEO,UAAU;;;CAGzB,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,IAAiB;IAC/C,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAChC,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE;YAChE,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO;YACL,QAAQ,EAAE,EAAE;YACZ,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;SAChC,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,UAAU,CAAC;IAC3D,yFAAyF;IACzF,MAAM,KAAK,GAAG,UAAU;QACtB,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QAClD,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1B,MAAM,SAAS,GAAG,QAAQ;QACxB,CAAC,CAAC,wDAAwD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,KAAK,gCAAgC;QAC/H,CAAC,CAAC,sBAAsB,IAAI,CAAC,MAAM,YAAY,IAAI,CAAC,KAAK,2CAA2C,CAAC;IACvG,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,wBAAwB,CAAC;QACxE,KAAK,EAAE,QAAQ;YACb,CAAC,CAAC;gBACE,EAAE,CAAC,kBAAkB,CAAC;gBACtB,EAAE,CAAC,kBAAkB,CAAC;gBACtB,EAAE,CAAC,kBAAkB,CAAC;aACvB;YACH,CAAC,CAAC;gBACE,qDAAqD;gBACrD,2BAA2B;aAC5B;KACN,CAAC;AACJ,CAAC"}

package/dist/hosting/nginx-sync.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Write / sync nginx configs managed under dataDir to optional system path.
+ */
+import type { HostExecutor } from '../host/executor.js';
+export interface NginxSyncResult {
+    sourceDir: string;
+    targetDir: string | null;
+    files: string[];
+    copied: string[];
+    tested: boolean;
+    testOutput?: string;
+    notes: string[];
+    /** false when nginx -t failed after system copy was requested */
+    ok: boolean;
+    blocked?: boolean;
+    requiresExecute?: boolean;
+}
+/**
+ * Ensure managed nginx conf dir exists; optionally copy to system sites and nginx -t.
+ */
+export declare function syncNginxConfigs(opts: {
+    dataDir: string;
+    /** e.g. /etc/nginx/conf.d — only used when executeEnabled + writable */
+    systemConfDir?: string;
+    host: HostExecutor;
+    dryRun?: boolean;
+}): Promise<NginxSyncResult>;
+/**
+ * Write a single server block into managed conf.d.
+ * If Defense Center limits are active, inject YSK_DEFENSE include marker.
+ */
+export declare function writeManagedNginxConf(dataDir: string, filename: string, content: string): string;
+export declare function listManagedNginxConfs(dataDir: string): Array<{
+    name: string;
+    path: string;
+    bytes: number;
+}>;
+//# sourceMappingURL=nginx-sync.d.ts.map

package/dist/hosting/nginx-sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nginx-sync.d.ts","sourceRoot":"","sources":["../../src/hosting/nginx-sync.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGxD,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,iEAAiE;IACjE,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,GAAG,OAAO,CAAC,eAAe,CAAC,CAwG3B;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAchG;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAS3G"}

package/dist/hosting/nginx-sync.js

@@ -0,0 +1,141 @@
+/**
+ * Write / sync nginx configs managed under dataDir to optional system path.
+ */
+import { copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { ErrorCodes, YskError, tl } from 'ysk-server-shared';
+import { injectDefenseLimitsIntoConf } from './defense/nginx-limits.js';
+/**
+ * Ensure managed nginx conf dir exists; optionally copy to system sites and nginx -t.
+ */
+export async function syncNginxConfigs(opts) {
+    const sourceDir = join(opts.dataDir, 'nginx', 'conf.d');
+    mkdirSync(sourceDir, { recursive: true });
+    // always write a managed main include snippet for documentation
+    const managedMain = join(opts.dataDir, 'nginx', 'ysk-managed.conf');
+    writeFileSync(managedMain, `# Generated by YSK Server — include from main nginx.conf:\n# include ${sourceDir}/*.conf;\n`, 'utf8');
+    const files = existsSync(sourceDir)
+        ? readdirSync(sourceDir).filter((f) => f.endsWith('.conf'))
+        : [];
+    const includes = existsSync(sourceDir)
+        ? readdirSync(sourceDir).filter((f) => f.endsWith('.inc'))
+        : [];
+    const notes = [
+        tl('notes.nginx.managedDir', { path: sourceDir }),
+        tl('notes.nginx.includeHint', { path: sourceDir }),
+    ];
+    const copied = [];
+    const targetDir = opts.systemConfDir ?? null;
+    if (opts.dryRun) {
+        return {
+            sourceDir,
+            targetDir,
+            files,
+            copied: [],
+            tested: false,
+            notes: [...notes, tl('notes.auto.n1014')],
+            ok: true
+        };
+    }
+    let blocked = false;
+    if (targetDir && opts.host.executeEnabled()) {
+        mkdirSync(targetDir, { recursive: true });
+        for (const f of files) {
+            const src = join(sourceDir, f);
+            const dest = join(targetDir, `ysk-${f}`);
+            copyFileSync(src, dest);
+            copied.push(dest);
+        }
+        // Defense / shared includes (server-context snippets)
+        for (const f of includes) {
+            const src = join(sourceDir, f);
+            // Keep stable name for ysk-defense-limits.inc so vhosts can include it
+            const dest = join(targetDir, f.startsWith('ysk-') ? f : `ysk-${f}`);
+            copyFileSync(src, dest);
+            copied.push(dest);
+        }
+        // Drop orphan project vhosts left after delete/recreate (same server_name → 502)
+        try {
+            const managedSet = new Set(files.map((f) => `ysk-${f}`));
+            for (const f of readdirSync(targetDir)) {
+                // Only project linux_user confs: ysk-ysks_xxxxxxxx.conf
+                if (!/^ysk-ysks_[a-z0-9]+\.conf$/i.test(f))
+                    continue;
+                if (managedSet.has(f))
+                    continue;
+                const orphan = join(targetDir, f);
+                unlinkSync(orphan);
+                notes.push(tl('notes.nginx.removedOrphan', { path: orphan }));
+            }
+        }
+        catch (e) {
+            const msg = e instanceof Error ? e.message : String(e);
+            notes.push(tl('notes.nginx.orphanCleanupFailed', { detail: msg.slice(0, 120) }));
+        }
+        notes.push(tl('notes.auto.t0427', { v0: (copied.length) }));
+    }
+    else if (targetDir) {
+        notes.push(tl('notes.auto.n1148'));
+        blocked = true;
+    }
+    let tested = false;
+    let testOutput;
+    if (opts.host.executeEnabled() && opts.host.pathExists('/usr/sbin/nginx')) {
+        const r = await opts.host.runCommand(['nginx', '-t'], { timeoutMs: 10_000 });
+        tested = r.exitCode === 0;
+        testOutput = `${r.stdout}\n${r.stderr}`.trim();
+        notes.push(tested ? tl('notes.nginx.configOk') : tl('notes.tpl.nginxConfigFailed', { detail: testOutput || tl('notes.tpl.unknownError') }));
+    }
+    else {
+        notes.push(tl('notes.auto.n0791'));
+    }
+    // ok: managed write always succeeds; system path blocked or nginx -t fail → not ok
+    const ok = blocked
+        ? false
+        : copied.length > 0
+            ? tested || !opts.host.pathExists('/usr/sbin/nginx')
+            : true;
+    return {
+        sourceDir,
+        targetDir,
+        files,
+        copied,
+        tested,
+        testOutput,
+        notes,
+        ok,
+        blocked: blocked || undefined,
+        requiresExecute: blocked || undefined
+    };
+}
+/**
+ * Write a single server block into managed conf.d.
+ * If Defense Center limits are active, inject YSK_DEFENSE include marker.
+ */
+export function writeManagedNginxConf(dataDir, filename, content) {
+    if (!filename.endsWith('.conf')) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n1017'), { httpStatus: 400 });
+    }
+    const dir = join(dataDir, 'nginx', 'conf.d');
+    mkdirSync(dir, { recursive: true });
+    const path = join(dir, filename);
+    let body = content;
+    const limitsInc = join(dir, 'ysk-defense-limits.inc');
+    if (existsSync(limitsInc) && /server\s*\{/.test(body) && !body.includes('BEGIN YSK_DEFENSE')) {
+        body = injectDefenseLimitsIntoConf(body);
+    }
+    writeFileSync(path, body, 'utf8');
+    return path;
+}
+export function listManagedNginxConfs(dataDir) {
+    const dir = join(dataDir, 'nginx', 'conf.d');
+    if (!existsSync(dir))
+        return [];
+    return readdirSync(dir)
+        .filter((f) => f.endsWith('.conf'))
+        .map((name) => {
+        const path = join(dir, name);
+        return { name, path, bytes: Buffer.byteLength(readFileSync(path)) };
+    });
+}
+//# sourceMappingURL=nginx-sync.js.map

package/dist/hosting/nginx-sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nginx-sync.js","sourceRoot":"","sources":["../../src/hosting/nginx-sync.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAC,MAAM,mBAAmB,CAAC;AAE5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAgBxE;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAMtC;IACC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACxD,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,gEAAgE;IAChE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,kBAAkB,CAAC,CAAC;IACpE,aAAa,CACX,WAAW,EACX,wEAAwE,SAAS,YAAY,EAC7F,MAAM,CACP,CAAC;IAEF,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC;QACjC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3D,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC;QACpC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1D,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,KAAK,GAAa;QACtB,EAAE,CAAC,wBAAwB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACjD,EAAE,CAAC,yBAAyB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;KACnD,CAAC;IACF,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC;IAE7C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO;YACL,SAAS;YACT,SAAS;YACT,KAAK;YACL,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC;YACzC,EAAE,EAAE,IAAI;SAAE,CAAC;IACf,CAAC;IAED,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QAC5C,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YACzC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QACD,sDAAsD;QACtD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YAC/B,uEAAuE;YACvE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACpE,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QACD,iFAAiF;QACjF,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YACzD,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvC,wDAAwD;gBACxD,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC,CAAC;oBAAE,SAAS;gBACrD,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;oBAAE,SAAS;gBAChC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;gBAClC,UAAU,CAAC,MAAM,CAAC,CAAC;gBACnB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,2BAA2B,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACnF,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9D,CAAC;SAAM,IAAI,SAAS,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACnC,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IAED,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,UAA8B,CAAC;IACnC,IAAI,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC1E,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7E,MAAM,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC;QAC1B,UAAU,GAAG,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QAC/C,KAAK,CAAC,IAAI,CACR,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,6BAA6B,EAAE,EAAE,MAAM,EAAE,UAAU,IAAI,EAAE,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAChI,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,mFAAmF;IACnF,MAAM,EAAE,GAAG,OAAO;QAChB,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YACjB,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC;YACpD,CAAC,CAAC,IAAI,CAAC;IAEX,OAAO;QACL,SAAS;QACT,SAAS;QACT,KAAK;QACL,MAAM;QACN,MAAM;QACN,UAAU;QACV,KAAK;QACL,EAAE;QACF,OAAO,EAAE,OAAO,IAAI,SAAS;QAC7B,eAAe,EAAE,OAAO,IAAI,SAAS;KAAE,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAE,QAAgB,EAAE,OAAe;IACtF,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC7C,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACjC,IAAI,IAAI,GAAG,OAAO,CAAC;IACnB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;IACtD,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC7F,IAAI,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IACD,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,OAAO,WAAW,CAAC,GAAG,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;SAClC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7B,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;IACtE,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/hosting/node-apply.d.ts

@@ -0,0 +1,32 @@
+import { selectNodeRuntime } from './runtime.js';
+import type { HostExecutor } from '../host/executor.js';
+export interface NodeApplyResult {
+    envPath: string;
+    unitPath: string;
+    appDir: string;
+    runtime: ReturnType<typeof selectNodeRuntime>;
+    enabled: boolean;
+    notes: string[];
+}
+/**
+ * Write env file + systemd unit for a project under dataDir.
+ */
+export declare function applyNodeHosting(input: {
+    dataDir: string;
+    projectId: string;
+    projectName: string;
+    linuxUser: string;
+    homeDir: string;
+    nodeVersion: string;
+    entry?: string;
+    port?: number;
+    env?: Record<string, string>;
+    host: HostExecutor;
+    enableService?: boolean;
+    /** Override binary (defaults to runtime plan path; use process.execPath for real spawn) */
+    nodeBinary?: string;
+    memoryMax?: string;
+    cpuQuotaPercent?: number;
+    limitNOFILE?: number;
+}): Promise<NodeApplyResult>;
+//# sourceMappingURL=node-apply.d.ts.map

package/dist/hosting/node-apply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-apply.d.ts","sourceRoot":"","sources":["../../src/hosting/node-apply.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,iBAAiB,EAAyB,MAAM,cAAc,CAAC;AACxE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC;IAC9C,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,IAAI,EAAE,YAAY,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,2FAA2F;IAC3F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,eAAe,CAAC,CAkF3B"}