ysk-server-shared 1.0.0

package/dist/migrate.d.ts

@@ -0,0 +1,138 @@
+/**
+ * Host full-migrate contract (整機遷移).
+ * Inventory + job state shared by core, API, CLI, web.
+ */
+import type { OpsResultDto } from './ops.js';
+export type MigratePhase = 'inventory' | 'preflight' | 'package' | 'transfer' | 'bootstrap' | 'restore' | 'reapply' | 'verify' | 'done' | 'failed';
+export declare const MIGRATE_PHASES: readonly MigratePhase[];
+export type MigrateDbEngine = 'mysql' | 'mariadb' | 'postgres';
+export interface HostManifestProject {
+    id: string;
+    name: string;
+    home_dir: string;
+    linux_user: string;
+    linux_group?: string;
+    runtime: string;
+    domain?: string;
+    /** Numeric uid on source (when resolvable) */
+    uid?: number;
+    gid?: number;
+    /** Home exists on disk at inventory time */
+    homeExists: boolean;
+    bind_ip?: string;
+}
+export interface HostManifestDatabase {
+    engine: MigrateDbEngine;
+    name: string;
+    /** Registry row id if any */
+    id?: string;
+    username?: string;
+    /** Relative to dataDir after package phase */
+    dumpRelPath?: string;
+    bytes?: number;
+}
+export interface HostManifestRedis {
+    id: string;
+    name?: string;
+    /** Relative to dataDir after package phase */
+    rdbRelPath?: string;
+    bytes?: number;
+}
+export interface HostManifestMailbox {
+    id: string;
+    domain: string;
+    local: string;
+    maildirRelPath: string;
+    exists: boolean;
+}
+/**
+ * Complete source inventory for lossless host migration.
+ * version bumps only when fields are incompatible.
+ */
+export interface HostManifest {
+    version: 1;
+    createdAt: string;
+    source: {
+        hostname: string;
+        os: string;
+        arch: string;
+        dataDir: string;
+        yskVersion: string;
+        nodeVersion: string;
+    };
+    /** Entity counts from control-plane store (+ disk facts where noted) */
+    counts: Record<string, number>;
+    projects: HostManifestProject[];
+    databases: HostManifestDatabase[];
+    redis: HostManifestRedis[];
+    mailboxes: HostManifestMailbox[];
+    emailDomains: Array<{
+        id: string;
+        domain: string;
+    }>;
+    /**
+     * Software catalog ids needed on target (align with core SoftwareId strings).
+     * e.g. nginx, mysql-server, postfix, node, php
+     */
+    softwareNeeded: string[];
+    paths: {
+        dataDir: string;
+        /** Absolute project homes to rsync */
+        homes: string[];
+        /** Optional host paths (e.g. /etc/letsencrypt) */
+        optionalEtc: string[];
+        /** Relative paths under dataDir that must exist */
+        dataDirCritical: string[];
+    };
+    /** sha256 hex of key artifacts for post-transfer verify */
+    fingerprints: Record<string, string>;
+    /** Non-fatal issues operator must review */
+    warnings: string[];
+    /** Operator-chosen exclusion globs (not applied in inventory itself) */
+    exclusions: string[];
+    /** Domains / hostnames for DNS cutover checklist */
+    cutoverHostnames: string[];
+    /** Set after package phase completes dumps */
+    packagedAt?: string;
+}
+export interface MigrateJobStep {
+    id: string;
+    phase: MigratePhase;
+    name: string;
+    at: string;
+    result: OpsResultDto;
+}
+export interface MigrateJobTarget {
+    host: string;
+    port: number;
+    user: string;
+    /** Optional outbound identity vault id (never store password here) */
+    identityId?: string;
+}
+export interface MigrateJobVerify {
+    productionReady?: boolean;
+    mismatches: string[];
+    notes: string[];
+}
+/**
+ * Persistable migrate job (no secrets).
+ * Lives under `{dataDir}/migrate/{id}/job.json`.
+ */
+export interface MigrateJobDto {
+    id: string;
+    phase: MigratePhase;
+    target?: MigrateJobTarget;
+    /** Target dataDir (default /var/lib/ysk-server) */
+    targetDataDir: string;
+    forceWipeTarget?: boolean;
+    maintenanceAccepted?: boolean;
+    manifest?: HostManifest;
+    steps: MigrateJobStep[];
+    verify?: MigrateJobVerify;
+    createdAt: string;
+    updatedAt: string;
+    /** Last error summary */
+    lastError?: string;
+}
+export declare function isMigratePhase(v: unknown): v is MigratePhase;
+//# sourceMappingURL=migrate.d.ts.map

package/dist/migrate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../src/migrate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAE7C,MAAM,MAAM,YAAY,GACpB,WAAW,GACX,WAAW,GACX,SAAS,GACT,UAAU,GACV,WAAW,GACX,SAAS,GACT,SAAS,GACT,QAAQ,GACR,MAAM,GACN,QAAQ,CAAC;AAEb,eAAO,MAAM,cAAc,EAAE,SAAS,YAAY,EAWxC,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,SAAS,GAAG,UAAU,CAAC;AAE/D,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,eAAe,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,6BAA6B;IAC7B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8CAA8C;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,CAAC,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE;QACN,QAAQ,EAAE,MAAM,CAAC;QACjB,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,SAAS,EAAE,oBAAoB,EAAE,CAAC;IAClC,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC3B,SAAS,EAAE,mBAAmB,EAAE,CAAC;IACjC,YAAY,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD;;;OAGG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,KAAK,EAAE;QACL,OAAO,EAAE,MAAM,CAAC;QAChB,sCAAsC;QACtC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,kDAAkD;QAClD,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,mDAAmD;QACnD,eAAe,EAAE,MAAM,EAAE,CAAC;KAC3B,CAAC;IACF,2DAA2D;IAC3D,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,wEAAwE;IACxE,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,oDAAoD;IACpD,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,8CAA8C;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,YAAY,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,YAAY,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,mDAAmD;IACnD,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,yBAAyB;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,cAAc,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,YAAY,CAE5D"}

package/dist/migrate.js

@@ -0,0 +1,20 @@
+/**
+ * Host full-migrate contract (整機遷移).
+ * Inventory + job state shared by core, API, CLI, web.
+ */
+export const MIGRATE_PHASES = [
+    'inventory',
+    'preflight',
+    'package',
+    'transfer',
+    'bootstrap',
+    'restore',
+    'reapply',
+    'verify',
+    'done',
+    'failed',
+];
+export function isMigratePhase(v) {
+    return typeof v === 'string' && MIGRATE_PHASES.includes(v);
+}
+//# sourceMappingURL=migrate.js.map

package/dist/migrate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.js","sourceRoot":"","sources":["../src/migrate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAgBH,MAAM,CAAC,MAAM,cAAc,GAA4B;IACrD,WAAW;IACX,WAAW;IACX,SAAS;IACT,UAAU;IACV,WAAW;IACX,SAAS;IACT,SAAS;IACT,QAAQ;IACR,MAAM;IACN,QAAQ;CACA,CAAC;AA0IX,MAAM,UAAU,cAAc,CAAC,CAAU;IACvC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAK,cAAoC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACpF,CAAC"}

package/dist/network.d.ts

@@ -0,0 +1,95 @@
+/**
+ * Host network snapshot + apply results — API contract.
+ */
+export interface NetAddressDto {
+    family: 'inet' | 'inet6';
+    local: string;
+    prefixlen: number;
+    scope?: string;
+    label?: string;
+    dynamic?: boolean;
+}
+export interface NetInterfaceDto {
+    name: string;
+    ifindex: number;
+    mac?: string;
+    mtu?: number;
+    operstate: string;
+    flags: string[];
+    linkType?: string;
+    addrs: NetAddressDto[];
+    stats?: {
+        rxBytes: number;
+        txBytes: number;
+        rxPackets: number;
+        txPackets: number;
+    };
+    isLoopback: boolean;
+    isDefaultEgress?: boolean;
+}
+export interface NetRouteDto {
+    dst: string;
+    gateway?: string;
+    dev?: string;
+    protocol?: string;
+    metric?: number;
+    scope?: string;
+    prefsrc?: string;
+}
+export interface NetworkSnapshotDto {
+    ok: boolean;
+    at: string;
+    interfaces: NetInterfaceDto[];
+    routes: NetRouteDto[];
+    dns: {
+        nameservers: string[];
+        search: string[];
+        source: string;
+        notes: string[];
+        mode?: 'networkmanager' | 'resolved' | 'static' | 'unknown';
+        canApply?: boolean;
+        connection?: string;
+        device?: string;
+        stubServers?: string[];
+        uplinkServers?: string[];
+        ignoreAutoDns?: boolean | null;
+        gatewayDns?: string;
+    };
+    backend: {
+        hasIp: boolean;
+        networkManager: string;
+        networkd: string;
+        canPersist: boolean;
+    };
+    caps: {
+        executeEnabled: boolean;
+        isRoot: boolean;
+        canMutate: boolean;
+    };
+    defaultGateway?: string;
+    defaultDev?: string;
+    notes: string[];
+    raw?: {
+        addr?: string;
+        route?: string;
+    };
+}
+/** Mutation result for network addr/route/dns (ops-like). */
+export interface NetApplyResultDto {
+    ok: boolean;
+    blocked?: boolean;
+    blockMessage?: string;
+    notes: string[];
+    executeEnabled?: boolean;
+    isRoot?: boolean;
+    ephemeral?: boolean;
+    persistent?: boolean;
+    interface?: string;
+}
+/** Aliases used by older web code */
+export type NetAddress = NetAddressDto;
+export type NetInterface = NetInterfaceDto;
+export type NetRoute = NetRouteDto;
+export type NetworkSnapshot = NetworkSnapshotDto;
+export type NetApplyResult = NetApplyResultDto;
+//# sourceMappingURL=network.d.ts.map

package/dist/network.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"network.d.ts","sourceRoot":"","sources":["../src/network.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE;QACN,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,UAAU,EAAE,OAAO,CAAC;IACpB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,OAAO,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,GAAG,EAAE;QACH,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,IAAI,CAAC,EAAE,gBAAgB,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;QAC5D,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QACvB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;QACzB,aAAa,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;QAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,OAAO,EAAE;QACP,KAAK,EAAE,OAAO,CAAC;QACf,cAAc,EAAE,MAAM,CAAC;QACvB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,OAAO,CAAC;KACrB,CAAC;IACF,IAAI,EAAE;QACJ,cAAc,EAAE,OAAO,CAAC;QACxB,MAAM,EAAE,OAAO,CAAC;QAChB,SAAS,EAAE,OAAO,CAAC;KACpB,CAAC;IACF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACzC;AAED,6DAA6D;AAC7D,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qCAAqC;AACrC,MAAM,MAAM,UAAU,GAAG,aAAa,CAAC;AACvC,MAAM,MAAM,YAAY,GAAG,eAAe,CAAC;AAC3C,MAAM,MAAM,QAAQ,GAAG,WAAW,CAAC;AACnC,MAAM,MAAM,eAAe,GAAG,kBAAkB,CAAC;AACjD,MAAM,MAAM,cAAc,GAAG,iBAAiB,CAAC"}

package/dist/network.js

@@ -0,0 +1,5 @@
+/**
+ * Host network snapshot + apply results — API contract.
+ */
+export {};
+//# sourceMappingURL=network.js.map

package/dist/network.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"network.js","sourceRoot":"","sources":["../src/network.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/dist/ops-i18n.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Localized ops helpers — blocked / notes / honesty keys.
+ */
+import { type OpsResultDto, type OpsResultInput } from './ops.js';
+/** True if string looks like an i18n key we own (ops.* / errors.* / common.*). */
+export declare function looksLikeI18nKey(s: string): boolean;
+/**
+ * Translate a note if it is a known key; otherwise return as-is
+ * (legacy free-text / already localized).
+ */
+export declare function translateNote(note: string, locale?: string | null, params?: Record<string, string | number | boolean | null | undefined>): string;
+export declare function translateNotes(notes: string[] | readonly string[] | undefined, locale?: string | null): string[];
+/** Standard blocked-for-EXECUTE result (localized). */
+export declare function opsBlockedNeedExecute(extra?: Partial<OpsResultInput> & Record<string, unknown>): OpsResultDto & Record<string, unknown>;
+export declare function opsBlockedNeedRoot(extra?: Partial<OpsResultInput> & Record<string, unknown>): OpsResultDto & Record<string, unknown>;
+export declare function opsBlockedNeedExecuteRoot(extra?: Partial<OpsResultInput> & Record<string, unknown>): OpsResultDto & Record<string, unknown>;
+/** Localize honesty/fields on an ops-shaped object before send. */
+export declare function localizeOpsResult<T extends OpsResultInput>(result: T, locale?: string | null): T & OpsResultDto;
+//# sourceMappingURL=ops-i18n.d.ts.map

package/dist/ops-i18n.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ops-i18n.d.ts","sourceRoot":"","sources":["../src/ops-i18n.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAmB,KAAK,YAAY,EAAE,KAAK,cAAc,EAAE,MAAM,UAAU,CAAC;AAKnF,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,EACtB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC,GACpE,MAAM,CAQR;AAED,wBAAgB,cAAc,CAC5B,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,EAC/C,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GACrB,MAAM,EAAE,CAGV;AAED,uDAAuD;AACvD,wBAAgB,qBAAqB,CACnC,KAAK,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACxD,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAexC;AAED,wBAAgB,kBAAkB,CAChC,KAAK,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACxD,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWxC;AAED,wBAAgB,yBAAyB,CACvC,KAAK,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACxD,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAYxC;AAED,mEAAmE;AACnE,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,cAAc,EACxD,MAAM,EAAE,CAAC,EACT,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GACrB,CAAC,GAAG,YAAY,CAUlB"}

package/dist/ops-i18n.js

@@ -0,0 +1,85 @@
+/**
+ * Localized ops helpers — blocked / notes / honesty keys.
+ */
+import { assertHonestOps } from './ops.js';
+import { tl } from './i18n/request-locale.js';
+import { t } from './i18n/t.js';
+import { getLocale } from './i18n/request-locale.js';
+/** True if string looks like an i18n key we own (ops.* / errors.* / common.*). */
+export function looksLikeI18nKey(s) {
+    return /^(ops|errors|common|auth)\.[a-zA-Z0-9_.]+$/.test(s.trim());
+}
+/**
+ * Translate a note if it is a known key; otherwise return as-is
+ * (legacy free-text / already localized).
+ */
+export function translateNote(note, locale, params) {
+    const n = note.trim();
+    if (!n)
+        return note;
+    if (looksLikeI18nKey(n)) {
+        const out = t(locale ?? getLocale(), n, params);
+        return out === n ? note : out;
+    }
+    return note;
+}
+export function translateNotes(notes, locale) {
+    if (!notes?.length)
+        return [];
+    return notes.map((n) => translateNote(String(n), locale));
+}
+/** Standard blocked-for-EXECUTE result (localized). */
+export function opsBlockedNeedExecute(extra) {
+    const msg = tl('ops.blocked.needExecute');
+    const extraNotes = extra?.notes
+        ? translateNotes(extra.notes)
+        : [];
+    const { notes: _n, ...rest } = extra ?? {};
+    return assertHonestOps({
+        ok: false,
+        blocked: true,
+        requiresExecute: true,
+        apply_status: 'blocked',
+        blockMessage: extra?.blockMessage ?? msg,
+        ...rest,
+        notes: extraNotes.length ? [...extraNotes, msg] : [msg],
+    });
+}
+export function opsBlockedNeedRoot(extra) {
+    const msg = tl('ops.blocked.needRoot');
+    return assertHonestOps({
+        ok: false,
+        blocked: true,
+        requiresRoot: true,
+        apply_status: 'blocked',
+        blockMessage: msg,
+        notes: [msg],
+        ...extra,
+    });
+}
+export function opsBlockedNeedExecuteRoot(extra) {
+    const msg = tl('ops.blocked.needExecuteRoot');
+    return assertHonestOps({
+        ok: false,
+        blocked: true,
+        requiresExecute: true,
+        requiresRoot: true,
+        apply_status: 'blocked',
+        blockMessage: msg,
+        notes: [msg],
+        ...extra,
+    });
+}
+/** Localize honesty/fields on an ops-shaped object before send. */
+export function localizeOpsResult(result, locale) {
+    const loc = locale ?? getLocale();
+    const honest = assertHonestOps(result);
+    return {
+        ...honest,
+        blockMessage: honest.blockMessage
+            ? translateNote(honest.blockMessage, loc)
+            : honest.blockMessage,
+        notes: translateNotes(honest.notes, loc),
+    };
+}
+//# sourceMappingURL=ops-i18n.js.map

package/dist/ops-i18n.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ops-i18n.js","sourceRoot":"","sources":["../src/ops-i18n.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,eAAe,EAA0C,MAAM,UAAU,CAAC;AACnF,OAAO,EAAE,EAAE,EAAE,MAAM,0BAA0B,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,aAAa,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAErD,kFAAkF;AAClF,MAAM,UAAU,gBAAgB,CAAC,CAAS;IACxC,OAAO,4CAA4C,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,MAAsB,EACtB,MAAqE;IAErE,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,SAAS,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QAChD,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;IAChC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,KAA+C,EAC/C,MAAsB;IAEtB,IAAI,CAAC,KAAK,EAAE,MAAM;QAAE,OAAO,EAAE,CAAC;IAC9B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,qBAAqB,CACnC,KAAyD;IAEzD,MAAM,GAAG,GAAG,EAAE,CAAC,yBAAyB,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,KAAK,EAAE,KAAK;QAC7B,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,KAAiB,CAAC;QACzC,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,IAAI,EAAE,CAAC;IAC3C,OAAO,eAAe,CAAC;QACrB,EAAE,EAAE,KAAK;QACT,OAAO,EAAE,IAAI;QACb,eAAe,EAAE,IAAI;QACrB,YAAY,EAAE,SAAS;QACvB,YAAY,EAAG,KAAK,EAAE,YAAmC,IAAI,GAAG;QAChE,GAAG,IAAI;QACP,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;KACxD,CAA2C,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,KAAyD;IAEzD,MAAM,GAAG,GAAG,EAAE,CAAC,sBAAsB,CAAC,CAAC;IACvC,OAAO,eAAe,CAAC;QACrB,EAAE,EAAE,KAAK;QACT,OAAO,EAAE,IAAI;QACb,YAAY,EAAE,IAAI;QAClB,YAAY,EAAE,SAAS;QACvB,YAAY,EAAE,GAAG;QACjB,KAAK,EAAE,CAAC,GAAG,CAAC;QACZ,GAAG,KAAK;KACT,CAA2C,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAAyD;IAEzD,MAAM,GAAG,GAAG,EAAE,CAAC,6BAA6B,CAAC,CAAC;IAC9C,OAAO,eAAe,CAAC;QACrB,EAAE,EAAE,KAAK;QACT,OAAO,EAAE,IAAI;QACb,eAAe,EAAE,IAAI;QACrB,YAAY,EAAE,IAAI;QAClB,YAAY,EAAE,SAAS;QACvB,YAAY,EAAE,GAAG;QACjB,KAAK,EAAE,CAAC,GAAG,CAAC;QACZ,GAAG,KAAK;KACT,CAA2C,CAAC;AAC/C,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,iBAAiB,CAC/B,MAAS,EACT,MAAsB;IAEtB,MAAM,GAAG,GAAG,MAAM,IAAI,SAAS,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACvC,OAAO;QACL,GAAG,MAAM;QACT,YAAY,EAAE,MAAM,CAAC,YAAY;YAC/B,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC;YACzC,CAAC,CAAC,MAAM,CAAC,YAAY;QACvB,KAAK,EAAE,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC;KACrB,CAAC;AACxB,CAAC"}

package/dist/ops.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Shared ops / apply honesty contract.
+ * Single source of truth for written | applied | blocked across API, core, web.
+ */
+/**
+ * Control-plane apply lifecycle (honest; never mark applied without host success).
+ * - planned / pending_execute: resource draft awaiting EXECUTE (legacy resource CRUD)
+ */
+export type ApplyStatus = 'draft' | 'written' | 'planned' | 'pending_execute' | 'applied' | 'blocked' | 'failed' | 'partial';
+/**
+ * Standard operator mutation result.
+ * Rules:
+ * - ok && blocked is forbidden
+ * - apply_status === 'applied' implies ok && !blocked
+ * - notes always preferred over raw shell homework in UI
+ */
+export interface OpsResultDto {
+    ok: boolean;
+    apply_status?: ApplyStatus;
+    blocked?: boolean;
+    blockMessage?: string;
+    requiresExecute?: boolean;
+    requiresRoot?: boolean;
+    notes: string[];
+    written?: string[];
+    /** Optional resource / process facts for panels */
+    url?: string;
+    port?: number;
+    pid?: number;
+    processStatus?: string;
+}
+export type OpsResultInput = Partial<OpsResultDto> & {
+    ok?: boolean;
+    notes?: string[] | readonly string[];
+};
+/**
+ * Normalize ops result honesty.
+ *
+ * Hard rule: `blocked: true` never coexists with `ok: true` or `applied`.
+ * Soft flags `requiresExecute` / `requiresRoot` alone do **not** flip ok when
+ * `apply_status` is `written` / `draft` / `partial` (control-plane success).
+ * Missing notes → [].
+ */
+export declare function assertHonestOps<T extends OpsResultInput>(result: T): T & OpsResultDto;
+/** @deprecated use assertHonestOps */
+export declare const normalizeOpsHonesty: typeof assertHonestOps;
+export declare function isApplyStatus(v: unknown): v is ApplyStatus;
+//# sourceMappingURL=ops.d.ts.map

package/dist/ops.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ops.d.ts","sourceRoot":"","sources":["../src/ops.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;GAGG;AACH,MAAM,MAAM,WAAW,GACnB,OAAO,GACP,SAAS,GACT,SAAS,GACT,iBAAiB,GACjB,SAAS,GACT,SAAS,GACT,QAAQ,GACR,SAAS,CAAC;AAEd;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,YAAY,CAAC,EAAE,WAAW,CAAC;IAC3B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,mDAAmD;IACnD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC,GAAG;IACnD,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,CAAC;CACtC,CAAC;AAOF;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,cAAc,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,YAAY,CA8CrF;AAED,sCAAsC;AACtC,eAAO,MAAM,mBAAmB,wBAAkB,CAAC;AAEnD,wBAAgB,aAAa,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,WAAW,CAW1D"}

package/dist/ops.js

@@ -0,0 +1,73 @@
+/**
+ * Shared ops / apply honesty contract.
+ * Single source of truth for written | applied | blocked across API, core, web.
+ */
+function asNotes(notes) {
+    if (!notes)
+        return [];
+    return Array.isArray(notes) ? notes.map(String) : [];
+}
+/**
+ * Normalize ops result honesty.
+ *
+ * Hard rule: `blocked: true` never coexists with `ok: true` or `applied`.
+ * Soft flags `requiresExecute` / `requiresRoot` alone do **not** flip ok when
+ * `apply_status` is `written` / `draft` / `partial` (control-plane success).
+ * Missing notes → [].
+ */
+export function assertHonestOps(result) {
+    const notes = asNotes(result.notes);
+    const hardBlocked = result.blocked === true;
+    let ok = typeof result.ok === 'boolean' ? result.ok : !hardBlocked;
+    let apply_status = result.apply_status;
+    const nextNotes = [...notes];
+    if (hardBlocked && ok) {
+        ok = false;
+        // Stable i18n keys — localize at sendOpsResult / localizeOpsResult
+        if (!nextNotes.some((n) => n.includes('ops.honesty.blockedNotOk') || n.includes('誠實校正'))) {
+            nextNotes.push('ops.honesty.blockedNotOk');
+        }
+        if (apply_status === 'applied' || !apply_status)
+            apply_status = 'blocked';
+    }
+    if (apply_status === 'applied' && hardBlocked) {
+        ok = false;
+        apply_status = 'blocked';
+        if (!nextNotes.some((n) => n.includes('ops.honesty') || n.includes('誠實校正'))) {
+            nextNotes.push('ops.honesty.blockedNotApplied');
+        }
+    }
+    // Claimed applied but ok=false → demote
+    if (apply_status === 'applied' && !ok) {
+        apply_status = hardBlocked ? 'blocked' : 'failed';
+        if (!nextNotes.some((n) => n.includes('ops.honesty') || n.includes('ok=false'))) {
+            nextNotes.push('ops.honesty.okFalseNotApplied');
+        }
+    }
+    // Claimed applied while soft-gated without host success flag: only if blocked already handled
+    // written + requiresExecute is valid (dataDir written; system not applied)
+    return {
+        ...result,
+        ok,
+        blocked: hardBlocked ? true : result.blocked,
+        requiresExecute: result.requiresExecute,
+        requiresRoot: result.requiresRoot,
+        blockMessage: result.blockMessage,
+        apply_status,
+        notes: nextNotes,
+        written: result.written ? [...result.written] : result.written,
+    };
+}
+/** @deprecated use assertHonestOps */
+export const normalizeOpsHonesty = assertHonestOps;
+export function isApplyStatus(v) {
+    return (v === 'draft' ||
+        v === 'written' ||
+        v === 'planned' ||
+        v === 'pending_execute' ||
+        v === 'applied' ||
+        v === 'blocked' ||
+        v === 'failed' ||
+        v === 'partial');
+}
+//# sourceMappingURL=ops.js.map

package/dist/ops.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ops.js","sourceRoot":"","sources":["../src/ops.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA4CH,SAAS,OAAO,CAAC,KAA8B;IAC7C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAA2B,MAAS;IACjE,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC;IAC5C,IAAI,EAAE,GAAG,OAAO,MAAM,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;IACnE,IAAI,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;IACvC,MAAM,SAAS,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;IAE7B,IAAI,WAAW,IAAI,EAAE,EAAE,CAAC;QACtB,EAAE,GAAG,KAAK,CAAC;QACX,mEAAmE;QACnE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACzF,SAAS,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,YAAY,KAAK,SAAS,IAAI,CAAC,YAAY;YAAE,YAAY,GAAG,SAAS,CAAC;IAC5E,CAAC;IAED,IAAI,YAAY,KAAK,SAAS,IAAI,WAAW,EAAE,CAAC;QAC9C,EAAE,GAAG,KAAK,CAAC;QACX,YAAY,GAAG,SAAS,CAAC;QACzB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC5E,SAAS,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,wCAAwC;IACxC,IAAI,YAAY,KAAK,SAAS,IAAI,CAAC,EAAE,EAAE,CAAC;QACtC,YAAY,GAAG,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;QAClD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YAChF,SAAS,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,8FAA8F;IAC9F,2EAA2E;IAE3E,OAAO;QACL,GAAG,MAAM;QACT,EAAE;QACF,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO;QAC5C,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,YAAY;QACZ,KAAK,EAAE,SAAS;QAChB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO;KAC3C,CAAC;AACxB,CAAC;AAED,sCAAsC;AACtC,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAAC;AAEnD,MAAM,UAAU,aAAa,CAAC,CAAU;IACtC,OAAO,CACL,CAAC,KAAK,OAAO;QACb,CAAC,KAAK,SAAS;QACf,CAAC,KAAK,SAAS;QACf,CAAC,KAAK,iBAAiB;QACvB,CAAC,KAAK,SAAS;QACf,CAAC,KAAK,SAAS;QACf,CAAC,KAAK,QAAQ;QACd,CAAC,KAAK,SAAS,CAChB,CAAC;AACJ,CAAC"}

package/dist/route-capabilities.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Mutating API routes → minimum capability (single source for server enforce).
+ * First matching rule wins. Unlisted mutating routes are not auto-gated here
+ * (handlers may still check explicitly; fail-closed for unknown is optional later).
+ */
+import type { CapabilityId } from './capabilities.js';
+export type RouteCapRule = {
+    methods: ReadonlyArray<'POST' | 'PUT' | 'PATCH' | 'DELETE'>;
+    /** Full path match (no query). */
+    pattern: RegExp;
+    cap: CapabilityId;
+    /** Optional human note for docs / tests */
+    note?: string;
+};
+/**
+ * Critical write / destructive / privilege paths.
+ * Order: more specific patterns before broad ones.
+ */
+export declare const MUTATING_ROUTE_CAP_RULES: readonly RouteCapRule[];
+/** Resolve capability for a mutating request, or null if no rule. */
+export declare function matchMutatingRouteCap(method: string, pathname: string): CapabilityId | null;
+/**
+ * Nav / feature key → capabilities required to *see* the item (any-of).
+ * Empty / missing → any authenticated user (read surfaces).
+ */
+export declare const FEATURE_NAV_CAPS: Readonly<Record<string, readonly CapabilityId[]>>;
+/** Path prefix → any-of caps (for SPA route guard). Longer prefixes win. */
+export declare const PATH_CAP_GUARDS: ReadonlyArray<{
+    prefix: string;
+    caps: readonly CapabilityId[];
+}>;
+/** True if actor may see a feature nav item. */
+export declare function canSeeFeature(featureKey: string, effective: readonly CapabilityId[] | Set<string>): boolean;
+/** SPA path guard — null means no special gate. */
+export declare function capsRequiredForPath(pathname: string): readonly CapabilityId[] | null;
+export declare function canAccessPath(pathname: string, effective: readonly CapabilityId[] | Set<string>): boolean;
+//# sourceMappingURL=route-capabilities.d.ts.map

package/dist/route-capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-capabilities.d.ts","sourceRoot":"","sources":["../src/route-capabilities.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,aAAa,CAAC,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC,CAAC;IAC5D,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,YAAY,CAAC;IAClB,2CAA2C;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,EAAE,SAAS,YAAY,EAyU3D,CAAC;AAEF,qEAAqE;AACrE,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,YAAY,GAAG,IAAI,CA0BrB;AAED;;;GAGG;AACH,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAC,CAoB9E,CAAC;AAEF,4EAA4E;AAC5E,eAAO,MAAM,eAAe,EAAE,aAAa,CAAC;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,SAAS,YAAY,EAAE,CAAC;CAC/B,CA0BA,CAAC;AAEF,gDAAgD;AAChD,wBAAgB,aAAa,CAC3B,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,SAAS,YAAY,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,GAC/C,OAAO,CAMT;AAED,mDAAmD;AACnD,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,YAAY,EAAE,GAAG,IAAI,CAQpF;AAED,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,SAAS,YAAY,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,GAC/C,OAAO,CAMT"}