ysk-server-shared 1.0.0

package/dist/route-capabilities.js

@@ -0,0 +1,445 @@
+/**
+ * Mutating API routes → minimum capability (single source for server enforce).
+ * First matching rule wins. Unlisted mutating routes are not auto-gated here
+ * (handlers may still check explicitly; fail-closed for unknown is optional later).
+ */
+/**
+ * Critical write / destructive / privilege paths.
+ * Order: more specific patterns before broad ones.
+ */
+export const MUTATING_ROUTE_CAP_RULES = [
+    // —— Privilege (also enforced in handlers) ——
+    { methods: ['POST', 'PATCH', 'DELETE'], pattern: /^\/api\/v1\/users(\/|$)/, cap: 'users.manage' },
+    {
+        methods: ['POST'],
+        pattern: /^\/api\/v1\/users\/[^/]+\/impersonate$/,
+        cap: 'users.impersonate',
+    },
+    {
+        methods: ['POST', 'PUT', 'PATCH', 'DELETE'],
+        pattern: /^\/api\/v1\/packages(\/|$)/,
+        cap: 'packages.manage',
+    },
+    { methods: ['PUT', 'POST'], pattern: /^\/api\/v1\/rbac\//, cap: 'rbac.policy' },
+    { methods: ['POST'], pattern: /^\/api\/v1\/settings\/security$/, cap: 'security.policy' },
+    {
+        methods: ['POST'],
+        pattern: /^\/api\/v1\/settings\/host-browse$/,
+        cap: 'network.browse',
+        note: 'host browse panel settings (engine / chrome path)',
+    },
+    { methods: ['POST'], pattern: /^\/api\/v1\/settings\//, cap: 'settings.system' },
+    // —— Destructive ——
+    {
+        methods: ['POST'],
+        pattern: /^\/api\/v1\/backups\/restore$/,
+        cap: 'backups.restore',
+        note: 'tar restore',
+    },
+    {
+        methods: ['POST'],
+        pattern: /^\/api\/v1\/backups\/restic\/restore$/,
+        cap: 'backups.restore',
+    },
+    {
+        methods: ['POST'],
+        pattern: /^\/api\/v1\/backups\/control-plane\/restore$/,
+        cap: 'backups.restore',
+        note: 'control-plane store restore',
+    },
+    {
+        methods: ['DELETE'],
+        pattern: /^\/api\/v1\/projects\/[^/]+$/,
+        cap: 'projects.delete',
+    },
+    {
+        methods: ['POST'],
+        pattern: /^\/api\/v1\/system\/firewall\/(enable|deny|delete-deny|delete-rule)$/,
+        cap: 'firewall.flush',
+        note: 'high-impact firewall mutations',
+    },
+    {
+        methods: ['DELETE'],
+        pattern: /^\/api\/v1\/resources\/(mysql|mariadb|postgres)\/(databases|users)\//,
+        cap: 'db.drop',
+    },
+    {
+        methods: ['DELETE'],
+        pattern: /^\/api\/v1\/email\/domains\/[^/]+\/mailboxes\//,
+        cap: 'mail.write',
+    },
+    // —— Write-high ——
+    { methods: ['POST'], pattern: /^\/api\/v1\/updates\/apply$/, cap: 'updates.apply' },
+    { methods: ['POST'], pattern: /^\/api\/v1\/updates\/apply-batch$/, cap: 'updates.apply' },
+    { methods: ['POST'], pattern: /^\/api\/v1\/updates\/self\/apply$/, cap: 'updates.apply' },
+    {
+        methods: ['POST'],
+        pattern: /^\/api\/v1\/system\/services\/lifecycle$/,
+        cap: 'services.control',
+    },
+    {
+        methods: ['POST'],
+        pattern: /^\/api\/v1\/system\/.*\/(start|stop|restart|reload)$/,
+        cap: 'services.control',
+    },
+    {
+        methods: ['POST'],
+        pattern: /^\/api\/v1\/backups\/(run-all|restic\/run|schedule|control-plane)$/,
+        cap: 'backups.run',
+    },
+    { methods: ['POST'], pattern: /^\/api\/v1\/backups\/settings$/, cap: 'backups.run' },
+    { methods: ['DELETE'], pattern: /^\/api\/v1\/backups$/, cap: 'backups.run' },
+    {
+        methods: ['POST'],
+        pattern: /^\/api\/v1\/system\/firewall\/(apply|allow-port)$/,
+        cap: 'firewall.edit',
+    },
+    {
+        methods: ['POST'],
+        pattern: /^\/api\/v1\/hosting\/firewall\//,
+        cap: 'firewall.edit',
+    },
+    {
+        methods: ['POST'],
+        pattern: /^\/api\/v1\/system\/fail2ban\//,
+        cap: 'firewall.edit',
+    },
+    {
+        methods: ['POST'],
+        pattern: /^\/api\/v1\/dns\/.*\/(apply|reload|push|dnssec)/,
+        cap: 'dns.apply',
+    },
+    {
+        methods: ['POST', 'PUT', 'PATCH', 'DELETE'],
+        pattern: /^\/api\/v1\/dns\/(zones|records)/,
+        cap: 'dns.apply',
+    },
+    {
+        methods: ['POST'],
+        pattern: /^\/api\/v1\/hosting\/dns\//,
+        cap: 'dns.apply',
+    },
+    {
+        methods: ['POST'],
+        pattern: /^\/api\/v1\/ssl\/(issue|renew|apply)/,
+        cap: 'ssl.issue',
+    },
+    { methods: ['POST'], pattern: /^\/api\/v1\/system\/ssl\/apply$/, cap: 'ssl.issue' },
+    { methods: ['POST'], pattern: /^\/api\/v1\/ssl\/upload$/, cap: 'ssl.upload' },
+    {
+        methods: ['POST'],
+        pattern: /^\/api\/v1\/projects\/[^/]+\/publish-nginx$/,
+        cap: 'publish.apply',
+    },
+    {
+        methods: ['POST'],
+        pattern: /^\/api\/v1\/hosting\/nginx\/sync$/,
+        cap: 'publish.apply',
+    },
+    {
+        methods: ['POST'],
+        pattern: /^\/api\/v1\/system\/email\/apply$/,
+        cap: 'mail.apply',
+    },
+    {
+        methods: ['POST'],
+        pattern: /^\/api\/v1\/email\/(bootstrap|webmail\/apply|dovecot-passdb|queue\/flush)/,
+        cap: 'mail.apply',
+    },
+    {
+        methods: ['POST'],
+        pattern: /^\/api\/v1\/system\/db\/(mysql|mariadb|postgres|redis)\/console\/apply$/,
+        cap: 'mysql.console.write',
+    },
+    {
+        methods: ['POST'],
+        pattern: /^\/api\/v1\/system\/(php|db)\/.*\/(apply|settings\/apply)$/,
+        cap: 'runtime.tuning',
+    },
+    {
+        methods: ['POST', 'PUT'],
+        pattern: /^\/api\/v1\/hosting\/(php|runtimes)\//,
+        cap: 'runtime.tuning',
+    },
+    {
+        methods: ['POST'],
+        pattern: /^\/api\/v1\/defense\//,
+        cap: 'firewall.edit',
+    },
+    // —— Write-low ——
+    { methods: ['POST'], pattern: /^\/api\/v1\/projects$/, cap: 'projects.write' },
+    { methods: ['POST'], pattern: /^\/api\/v1\/wizard\/create$/, cap: 'projects.write' },
+    {
+        methods: ['POST', 'PATCH'],
+        pattern: /^\/api\/v1\/projects\/[^/]+/,
+        cap: 'projects.write',
+    },
+    {
+        methods: ['POST', 'PATCH', 'DELETE'],
+        pattern: /^\/api\/v1\/email\/domains/,
+        cap: 'mail.write',
+    },
+    {
+        methods: ['POST'],
+        pattern: /^\/api\/v1\/hosting\/db\/.*provision$/,
+        cap: 'db.write',
+    },
+    {
+        methods: ['POST', 'PUT', 'PATCH'],
+        pattern: /^\/api\/v1\/resources\/(mysql|mariadb|postgres|redis)\//,
+        cap: 'db.write',
+    },
+    {
+        methods: ['POST', 'PUT', 'PATCH', 'DELETE'],
+        pattern: /^\/api\/v1\/cron/,
+        cap: 'cron.manage',
+    },
+    {
+        methods: ['POST', 'PUT', 'PATCH', 'DELETE'],
+        pattern: /^\/api\/v1\/files\//,
+        cap: 'files.project',
+    },
+    // resources / CDN / agents / tools / SSL residual
+    {
+        methods: ['DELETE'],
+        pattern: /^\/api\/v1\/resources\//,
+        cap: 'db.drop',
+    },
+    {
+        methods: ['POST', 'PUT', 'PATCH'],
+        pattern: /^\/api\/v1\/cdn\//,
+        cap: 'publish.apply',
+    },
+    {
+        methods: ['POST'],
+        pattern: /^\/api\/v1\/ssl\//,
+        cap: 'ssl.issue',
+    },
+    {
+        methods: ['POST'],
+        pattern: /^\/api\/v1\/agents\//,
+        cap: 'runtime.tuning',
+    },
+    {
+        methods: ['POST'],
+        pattern: /^\/api\/v1\/tools\/execute$/,
+        cap: 'services.control',
+        note: 'tool execute baseline; finer RBAC still in tool-executor',
+    },
+    {
+        methods: ['POST', 'DELETE'],
+        pattern: /^\/api\/v1\/auth\/api-keys/,
+        cap: 'security.api_keys.admin',
+    },
+    // —— B1 audit fill: previously unlisted mutating surfaces ——
+    {
+        methods: ['POST', 'PUT', 'PATCH', 'DELETE'],
+        pattern: /^\/api\/v1\/approvals\//,
+        cap: 'approvals.respond',
+    },
+    {
+        methods: ['POST', 'PUT', 'PATCH', 'DELETE'],
+        pattern: /^\/api\/v1\/db\//,
+        cap: 'db.write',
+        note: 'db clusters / temp users / adminer — drop still matched earlier DELETE rules',
+    },
+    {
+        methods: ['POST', 'PUT', 'PATCH', 'DELETE'],
+        pattern: /^\/api\/v1\/vpn\//,
+        cap: 'network.vpn',
+        note: 'VPN server/client mutations',
+    },
+    {
+        methods: ['POST', 'PUT', 'PATCH', 'DELETE'],
+        pattern: /^\/api\/v1\/vnc\//,
+        cap: 'network.vnc',
+        note: 'VNC server/client mutations',
+    },
+    {
+        methods: ['POST', 'PUT', 'PATCH', 'DELETE'],
+        pattern: /^\/api\/v1\/network\//,
+        cap: 'settings.system',
+    },
+    {
+        methods: ['POST', 'PUT', 'PATCH', 'DELETE'],
+        pattern: /^\/api\/v1\/hosting\//,
+        cap: 'projects.write',
+        note: 'generic hosting mutations; specific dns/nginx rules above win first',
+    },
+    {
+        methods: ['POST', 'PUT', 'PATCH', 'DELETE'],
+        pattern: /^\/api\/v1\/fleet\//,
+        cap: 'services.control',
+    },
+    {
+        methods: ['POST', 'PUT', 'PATCH', 'DELETE'],
+        pattern: /^\/api\/v1\/migrate/,
+        cap: 'settings.system',
+    },
+    {
+        methods: ['POST', 'PUT', 'PATCH', 'DELETE'],
+        pattern: /^\/api\/v1\/ai\//,
+        cap: 'settings.system',
+        note: 'AI task / RCA mutations — privilege for control-plane AI',
+    },
+    {
+        methods: ['POST', 'PUT', 'PATCH', 'DELETE'],
+        pattern: /^\/api\/v1\/ssh\//,
+        cap: 'security.policy',
+    },
+    {
+        methods: ['POST'],
+        pattern: /^\/api\/v1\/terminal\//,
+        cap: 'settings.system',
+        note: 'browser terminal tickets — privilege shell access',
+    },
+    {
+        methods: ['POST', 'PUT', 'PATCH', 'DELETE'],
+        pattern: /^\/api\/v1\/host-browse\//,
+        cap: 'network.browse',
+        note: 'host-mediated proxy browser sessions',
+    },
+    {
+        methods: ['POST', 'PUT', 'PATCH', 'DELETE'],
+        pattern: /^\/api\/v1\/sftp\//,
+        cap: 'files.project',
+    },
+    {
+        methods: ['POST', 'DELETE'],
+        pattern: /^\/api\/v1\/logs\//,
+        cap: 'logs.purge',
+    },
+    {
+        methods: ['POST'],
+        pattern: /^\/api\/v1\/updates\//,
+        cap: 'updates.apply',
+        note: 'inventory refresh is POST; apply already matched more specific',
+    },
+    {
+        methods: ['POST'],
+        pattern: /^\/api\/v1\/system\//,
+        cap: 'settings.system',
+        note: 'fallback for unlisted system mutations',
+    },
+    /**
+     * Last-resort: any other mutating /api/v1/* not listed above.
+     * Fail-closed for unknown write surface (agents / future routes must add a rule).
+     * Public auth paths are skipped in enforceMutatingRouteCaps.
+     */
+    {
+        methods: ['POST', 'PUT', 'PATCH', 'DELETE'],
+        pattern: /^\/api\/v1\//,
+        cap: 'settings.system',
+        note: 'B1 fail-closed fallback — prefer a specific rule above',
+    },
+];
+/** Resolve capability for a mutating request, or null if no rule. */
+export function matchMutatingRouteCap(method, pathname) {
+    const m = method.toUpperCase();
+    if (m !== 'POST' && m !== 'PUT' && m !== 'PATCH' && m !== 'DELETE') {
+        return null;
+    }
+    // Impersonate is POST under users — must win over users.manage blanket
+    if (m === 'POST' && /^\/api\/v1\/users\/[^/]+\/impersonate$/.test(pathname)) {
+        return 'users.impersonate';
+    }
+    // Project delete must win over projects.write blanket
+    if (m === 'DELETE' && /^\/api\/v1\/projects\/[^/]+$/.test(pathname)) {
+        return 'projects.delete';
+    }
+    // Publish nginx is write-high, not mere projects.write
+    if (m === 'POST' && /^\/api\/v1\/projects\/[^/]+\/publish-nginx$/.test(pathname)) {
+        return 'publish.apply';
+    }
+    // SSL upload is write-low (before generic ssl.issue)
+    if (m === 'POST' && pathname === '/api/v1/ssl/upload') {
+        return 'ssl.upload';
+    }
+    for (const rule of MUTATING_ROUTE_CAP_RULES) {
+        if (!rule.methods.includes(m))
+            continue;
+        if (rule.pattern.test(pathname))
+            return rule.cap;
+    }
+    return null;
+}
+/**
+ * Nav / feature key → capabilities required to *see* the item (any-of).
+ * Empty / missing → any authenticated user (read surfaces).
+ */
+export const FEATURE_NAV_CAPS = {
+    users: ['users.manage', 'packages.manage', 'rbac.policy'],
+    backups: ['backups.read', 'backups.run', 'backups.restore'],
+    updates: ['updates.read', 'updates.apply'],
+    services: ['services.read', 'services.control'],
+    protection: ['firewall.read', 'firewall.edit', 'firewall.flush'],
+    security: ['users.self', 'security.policy', 'security.api_keys.admin'],
+    // nested defense tools
+    firewall: ['firewall.read', 'firewall.edit', 'firewall.flush'],
+    fail2ban: ['firewall.read', 'firewall.edit', 'firewall.flush'],
+    // system admin-ish
+    systemd: ['services.read', 'services.control', 'settings.system'],
+    migrate: ['settings.system', 'backups.restore'],
+    agents: ['services.read', 'services.control', 'runtime.tuning'],
+    cdn: ['publish.apply', 'projects.read'],
+    rbac: ['rbac.policy', 'users.manage'],
+    terminal: ['settings.system', 'services.control'],
+    hostBrowse: ['network.browse'],
+    vpn: ['network.vpn', 'firewall.edit'],
+    vnc: ['network.vnc', 'firewall.edit'],
+};
+/** Path prefix → any-of caps (for SPA route guard). Longer prefixes win. */
+export const PATH_CAP_GUARDS = [
+    { prefix: '/users', caps: ['users.manage', 'packages.manage', 'rbac.policy'] },
+    { prefix: '/backups', caps: ['backups.read', 'backups.run', 'backups.restore'] },
+    { prefix: '/updates', caps: ['updates.read', 'updates.apply'] },
+    { prefix: '/services', caps: ['services.read', 'services.control'] },
+    {
+        prefix: '/protection/firewall',
+        caps: ['firewall.read', 'firewall.edit', 'firewall.flush'],
+    },
+    {
+        prefix: '/protection/fail2ban',
+        caps: ['firewall.read', 'firewall.edit', 'firewall.flush'],
+    },
+    {
+        prefix: '/protection',
+        caps: ['firewall.read', 'firewall.edit', 'firewall.flush'],
+    },
+    { prefix: '/system/migrate', caps: ['settings.system', 'backups.restore'] },
+    { prefix: '/system/unit', caps: ['services.control', 'settings.system'] },
+    { prefix: '/system/readiness', caps: ['dashboard.read', 'settings.system'] },
+    { prefix: '/terminal', caps: ['settings.system', 'services.control'] },
+    { prefix: '/browse', caps: ['network.browse'] },
+    { prefix: '/vpn', caps: ['network.vpn'] },
+    { prefix: '/vnc', caps: ['network.vnc'] },
+    { prefix: '/agents', caps: ['services.read', 'services.control', 'runtime.tuning'] },
+    { prefix: '/cdn', caps: ['publish.apply', 'projects.read'] },
+];
+/** True if actor may see a feature nav item. */
+export function canSeeFeature(featureKey, effective) {
+    const need = FEATURE_NAV_CAPS[featureKey];
+    if (!need || need.length === 0)
+        return true;
+    const has = (id) => effective instanceof Set ? effective.has(id) : effective.includes(id);
+    return need.some((c) => has(c));
+}
+/** SPA path guard — null means no special gate. */
+export function capsRequiredForPath(pathname) {
+    let best = null;
+    for (const g of PATH_CAP_GUARDS) {
+        if (pathname === g.prefix || pathname.startsWith(`${g.prefix}/`)) {
+            if (!best || g.prefix.length > best.prefix.length)
+                best = g;
+        }
+    }
+    return best?.caps ?? null;
+}
+export function canAccessPath(pathname, effective) {
+    const need = capsRequiredForPath(pathname);
+    if (!need)
+        return true;
+    const has = (id) => effective instanceof Set ? effective.has(id) : effective.includes(id);
+    return need.some((c) => has(c));
+}
+//# sourceMappingURL=route-capabilities.js.map

package/dist/route-capabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-capabilities.js","sourceRoot":"","sources":["../src/route-capabilities.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAaH;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAA4B;IAC/D,8CAA8C;IAC9C,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,GAAG,EAAE,cAAc,EAAE;IACjG;QACE,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,OAAO,EAAE,wCAAwC;QACjD,GAAG,EAAE,mBAAmB;KACzB;IACD;QACE,OAAO,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC;QAC3C,OAAO,EAAE,4BAA4B;QACrC,GAAG,EAAE,iBAAiB;KACvB;IACD,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,oBAAoB,EAAE,GAAG,EAAE,aAAa,EAAE;IAC/E,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,iCAAiC,EAAE,GAAG,EAAE,iBAAiB,EAAE;IACzF;QACE,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,OAAO,EAAE,oCAAoC;QAC7C,GAAG,EAAE,gBAAgB;QACrB,IAAI,EAAE,mDAAmD;KAC1D;IACD,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,GAAG,EAAE,iBAAiB,EAAE;IAEhF,oBAAoB;IACpB;QACE,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,OAAO,EAAE,+BAA+B;QACxC,GAAG,EAAE,iBAAiB;QACtB,IAAI,EAAE,aAAa;KACpB;IACD;QACE,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,OAAO,EAAE,uCAAuC;QAChD,GAAG,EAAE,iBAAiB;KACvB;IACD;QACE,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,OAAO,EAAE,8CAA8C;QACvD,GAAG,EAAE,iBAAiB;QACtB,IAAI,EAAE,6BAA6B;KACpC;IACD;QACE,OAAO,EAAE,CAAC,QAAQ,CAAC;QACnB,OAAO,EAAE,8BAA8B;QACvC,GAAG,EAAE,iBAAiB;KACvB;IACD;QACE,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,OAAO,EAAE,sEAAsE;QAC/E,GAAG,EAAE,gBAAgB;QACrB,IAAI,EAAE,gCAAgC;KACvC;IACD;QACE,OAAO,EAAE,CAAC,QAAQ,CAAC;QACnB,OAAO,EAAE,sEAAsE;QAC/E,GAAG,EAAE,SAAS;KACf;IACD;QACE,OAAO,EAAE,CAAC,QAAQ,CAAC;QACnB,OAAO,EAAE,gDAAgD;QACzD,GAAG,EAAE,YAAY;KAClB;IAED,mBAAmB;IACnB,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,GAAG,EAAE,eAAe,EAAE;IACnF,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,GAAG,EAAE,eAAe,EAAE;IACzF,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,GAAG,EAAE,eAAe,EAAE;IACzF;QACE,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,OAAO,EAAE,0CAA0C;QACnD,GAAG,EAAE,kBAAkB;KACxB;IACD;QACE,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,OAAO,EAAE,sDAAsD;QAC/D,GAAG,EAAE,kBAAkB;KACxB;IACD;QACE,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,OAAO,EAAE,oEAAoE;QAC7E,GAAG,EAAE,aAAa;KACnB;IACD,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,gCAAgC,EAAE,GAAG,EAAE,aAAa,EAAE;IACpF,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,GAAG,EAAE,aAAa,EAAE;IAC5E;QACE,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,OAAO,EAAE,mDAAmD;QAC5D,GAAG,EAAE,eAAe;KACrB;IACD;QACE,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,OAAO,EAAE,iCAAiC;QAC1C,GAAG,EAAE,eAAe;KACrB;IACD;QACE,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,OAAO,EAAE,gCAAgC;QACzC,GAAG,EAAE,eAAe;KACrB;IACD;QACE,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,OAAO,EAAE,iDAAiD;QAC1D,GAAG,EAAE,WAAW;KACjB;IACD;QACE,OAAO,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC;QAC3C,OAAO,EAAE,kCAAkC;QAC3C,GAAG,EAAE,WAAW;KACjB;IACD;QACE,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,OAAO,EAAE,4BAA4B;QACrC,GAAG,EAAE,WAAW;KACjB;IACD;QACE,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,OAAO,EAAE,sCAAsC;QAC/C,GAAG,EAAE,WAAW;KACjB;IACD,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,iCAAiC,EAAE,GAAG,EAAE,WAAW,EAAE;IACnF,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,GAAG,EAAE,YAAY,EAAE;IAC7E;QACE,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,OAAO,EAAE,6CAA6C;QACtD,GAAG,EAAE,eAAe;KACrB;IACD;QACE,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,OAAO,EAAE,mCAAmC;QAC5C,GAAG,EAAE,eAAe;KACrB;IACD;QACE,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,OAAO,EAAE,mCAAmC;QAC5C,GAAG,EAAE,YAAY;KAClB;IACD;QACE,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,OAAO,EAAE,2EAA2E;QACpF,GAAG,EAAE,YAAY;KAClB;IACD;QACE,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,OAAO,EAAE,yEAAyE;QAClF,GAAG,EAAE,qBAAqB;KAC3B;IACD;QACE,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,OAAO,EAAE,4DAA4D;QACrE,GAAG,EAAE,gBAAgB;KACtB;IACD;QACE,OAAO,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;QACxB,OAAO,EAAE,uCAAuC;QAChD,GAAG,EAAE,gBAAgB;KACtB;IACD;QACE,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,OAAO,EAAE,uBAAuB;QAChC,GAAG,EAAE,eAAe;KACrB;IAED,kBAAkB;IAClB,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,GAAG,EAAE,gBAAgB,EAAE;IAC9E,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,GAAG,EAAE,gBAAgB,EAAE;IACpF;QACE,OAAO,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;QAC1B,OAAO,EAAE,6BAA6B;QACtC,GAAG,EAAE,gBAAgB;KACtB;IACD;QACE,OAAO,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;QACpC,OAAO,EAAE,4BAA4B;QACrC,GAAG,EAAE,YAAY;KAClB;IACD;QACE,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,OAAO,EAAE,uCAAuC;QAChD,GAAG,EAAE,UAAU;KAChB;IACD;QACE,OAAO,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC;QACjC,OAAO,EAAE,yDAAyD;QAClE,GAAG,EAAE,UAAU;KAChB;IACD;QACE,OAAO,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC;QAC3C,OAAO,EAAE,kBAAkB;QAC3B,GAAG,EAAE,aAAa;KACnB;IACD;QACE,OAAO,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC;QAC3C,OAAO,EAAE,qBAAqB;QAC9B,GAAG,EAAE,eAAe;KACrB;IACD,kDAAkD;IAClD;QACE,OAAO,EAAE,CAAC,QAAQ,CAAC;QACnB,OAAO,EAAE,yBAAyB;QAClC,GAAG,EAAE,SAAS;KACf;IACD;QACE,OAAO,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC;QACjC,OAAO,EAAE,mBAAmB;QAC5B,GAAG,EAAE,eAAe;KACrB;IACD;QACE,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,OAAO,EAAE,mBAAmB;QAC5B,GAAG,EAAE,WAAW;KACjB;IACD;QACE,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,OAAO,EAAE,sBAAsB;QAC/B,GAAG,EAAE,gBAAgB;KACtB;IACD;QACE,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,OAAO,EAAE,6BAA6B;QACtC,GAAG,EAAE,kBAAkB;QACvB,IAAI,EAAE,0DAA0D;KACjE;IACD;QACE,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;QAC3B,OAAO,EAAE,4BAA4B;QACrC,GAAG,EAAE,yBAAyB;KAC/B;IAED,6DAA6D;IAC7D;QACE,OAAO,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC;QAC3C,OAAO,EAAE,yBAAyB;QAClC,GAAG,EAAE,mBAAmB;KACzB;IACD;QACE,OAAO,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC;QAC3C,OAAO,EAAE,kBAAkB;QAC3B,GAAG,EAAE,UAAU;QACf,IAAI,EAAE,8EAA8E;KACrF;IACD;QACE,OAAO,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC;QAC3C,OAAO,EAAE,mBAAmB;QAC5B,GAAG,EAAE,aAAa;QAClB,IAAI,EAAE,6BAA6B;KACpC;IACD;QACE,OAAO,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC;QAC3C,OAAO,EAAE,mBAAmB;QAC5B,GAAG,EAAE,aAAa;QAClB,IAAI,EAAE,6BAA6B;KACpC;IACD;QACE,OAAO,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC;QAC3C,OAAO,EAAE,uBAAuB;QAChC,GAAG,EAAE,iBAAiB;KACvB;IACD;QACE,OAAO,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC;QAC3C,OAAO,EAAE,uBAAuB;QAChC,GAAG,EAAE,gBAAgB;QACrB,IAAI,EAAE,qEAAqE;KAC5E;IACD;QACE,OAAO,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC;QAC3C,OAAO,EAAE,qBAAqB;QAC9B,GAAG,EAAE,kBAAkB;KACxB;IACD;QACE,OAAO,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC;QAC3C,OAAO,EAAE,qBAAqB;QAC9B,GAAG,EAAE,iBAAiB;KACvB;IACD;QACE,OAAO,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC;QAC3C,OAAO,EAAE,kBAAkB;QAC3B,GAAG,EAAE,iBAAiB;QACtB,IAAI,EAAE,0DAA0D;KACjE;IACD;QACE,OAAO,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC;QAC3C,OAAO,EAAE,mBAAmB;QAC5B,GAAG,EAAE,iBAAiB;KACvB;IACD;QACE,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,OAAO,EAAE,wBAAwB;QACjC,GAAG,EAAE,iBAAiB;QACtB,IAAI,EAAE,mDAAmD;KAC1D;IACD;QACE,OAAO,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC;QAC3C,OAAO,EAAE,2BAA2B;QACpC,GAAG,EAAE,gBAAgB;QACrB,IAAI,EAAE,sCAAsC;KAC7C;IACD;QACE,OAAO,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC;QAC3C,OAAO,EAAE,oBAAoB;QAC7B,GAAG,EAAE,eAAe;KACrB;IACD;QACE,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;QAC3B,OAAO,EAAE,oBAAoB;QAC7B,GAAG,EAAE,YAAY;KAClB;IACD;QACE,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,OAAO,EAAE,uBAAuB;QAChC,GAAG,EAAE,eAAe;QACpB,IAAI,EAAE,gEAAgE;KACvE;IACD;QACE,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,OAAO,EAAE,sBAAsB;QAC/B,GAAG,EAAE,iBAAiB;QACtB,IAAI,EAAE,wCAAwC;KAC/C;IACD;;;;OAIG;IACH;QACE,OAAO,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC;QAC3C,OAAO,EAAE,cAAc;QACvB,GAAG,EAAE,iBAAiB;QACtB,IAAI,EAAE,wDAAwD;KAC/D;CACF,CAAC;AAEF,qEAAqE;AACrE,MAAM,UAAU,qBAAqB,CACnC,MAAc,EACd,QAAgB;IAEhB,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,uEAAuE;IACvE,IAAI,CAAC,KAAK,MAAM,IAAI,wCAAwC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5E,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IACD,sDAAsD;IACtD,IAAI,CAAC,KAAK,QAAQ,IAAI,8BAA8B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpE,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,uDAAuD;IACvD,IAAI,CAAC,KAAK,MAAM,IAAI,6CAA6C,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjF,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,qDAAqD;IACrD,IAAI,CAAC,KAAK,MAAM,IAAI,QAAQ,KAAK,oBAAoB,EAAE,CAAC;QACtD,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,wBAAwB,EAAE,CAAC;QAC5C,IAAI,CAAE,IAAI,CAAC,OAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,SAAS;QAC/D,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAsD;IACjF,KAAK,EAAE,CAAC,cAAc,EAAE,iBAAiB,EAAE,aAAa,CAAC;IACzD,OAAO,EAAE,CAAC,cAAc,EAAE,aAAa,EAAE,iBAAiB,CAAC;IAC3D,OAAO,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC;IAC1C,QAAQ,EAAE,CAAC,eAAe,EAAE,kBAAkB,CAAC;IAC/C,UAAU,EAAE,CAAC,eAAe,EAAE,eAAe,EAAE,gBAAgB,CAAC;IAChE,QAAQ,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,yBAAyB,CAAC;IACtE,uBAAuB;IACvB,QAAQ,EAAE,CAAC,eAAe,EAAE,eAAe,EAAE,gBAAgB,CAAC;IAC9D,QAAQ,EAAE,CAAC,eAAe,EAAE,eAAe,EAAE,gBAAgB,CAAC;IAC9D,mBAAmB;IACnB,OAAO,EAAE,CAAC,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,CAAC;IACjE,OAAO,EAAE,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;IAC/C,MAAM,EAAE,CAAC,eAAe,EAAE,kBAAkB,EAAE,gBAAgB,CAAC;IAC/D,GAAG,EAAE,CAAC,eAAe,EAAE,eAAe,CAAC;IACvC,IAAI,EAAE,CAAC,aAAa,EAAE,cAAc,CAAC;IACrC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;IACjD,UAAU,EAAE,CAAC,gBAAgB,CAAC;IAC9B,GAAG,EAAE,CAAC,aAAa,EAAE,eAAe,CAAC;IACrC,GAAG,EAAE,CAAC,aAAa,EAAE,eAAe,CAAC;CACtC,CAAC;AAEF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,eAAe,GAGvB;IACH,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,cAAc,EAAE,iBAAiB,EAAE,aAAa,CAAC,EAAE;IAC9E,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,cAAc,EAAE,aAAa,EAAE,iBAAiB,CAAC,EAAE;IAChF,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC,EAAE;IAC/D,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,eAAe,EAAE,kBAAkB,CAAC,EAAE;IACpE;QACE,MAAM,EAAE,sBAAsB;QAC9B,IAAI,EAAE,CAAC,eAAe,EAAE,eAAe,EAAE,gBAAgB,CAAC;KAC3D;IACD;QACE,MAAM,EAAE,sBAAsB;QAC9B,IAAI,EAAE,CAAC,eAAe,EAAE,eAAe,EAAE,gBAAgB,CAAC;KAC3D;IACD;QACE,MAAM,EAAE,aAAa;QACrB,IAAI,EAAE,CAAC,eAAe,EAAE,eAAe,EAAE,gBAAgB,CAAC;KAC3D;IACD,EAAE,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,EAAE;IAC3E,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,EAAE;IACzE,EAAE,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,EAAE;IAC5E,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,EAAE;IACtE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,gBAAgB,CAAC,EAAE;IAC/C,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,aAAa,CAAC,EAAE;IACzC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,aAAa,CAAC,EAAE;IACzC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,eAAe,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,EAAE;IACpF,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,eAAe,EAAE,eAAe,CAAC,EAAE;CAC7D,CAAC;AAEF,gDAAgD;AAChD,MAAM,UAAU,aAAa,CAC3B,UAAkB,EAClB,SAAgD;IAEhD,MAAM,IAAI,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,EAAE,CACzB,SAAS,YAAY,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAkB,CAAC,CAAC;IACxF,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,IAAI,IAAI,GAA4C,IAAI,CAAC;IACzD,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;QAChC,IAAI,QAAQ,KAAK,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjE,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM;gBAAE,IAAI,GAAG,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,QAAgB,EAChB,SAAgD;IAEhD,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,EAAE,CACzB,SAAS,YAAY,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAkB,CAAC,CAAC;IACxF,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC"}

package/dist/service-exposure.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Service network exposure — desired firewall state for managed services.
+ * SSOT types + comment helpers shared by core + web.
+ */
+import { type ServicePortProto } from './service-ports.js';
+/** How the service should be reachable from the network. */
+export type ExposureMode = 'private' | 'public' | 'restricted';
+export type ServicePortBinding = {
+    /** e.g. listen | pasv | http | api — used in UFW comment role segment */
+    role: string;
+    /** Single port "21" or UFW range "30000:30100" */
+    port: string;
+    proto: ServicePortProto;
+};
+export type ServiceExposureDesired = {
+    serviceId: string;
+    mode: ExposureMode;
+    ports: ServicePortBinding[];
+    /** restricted only — IP or CIDR allowlist */
+    allowFrom?: string[];
+    /** L2: ISO country codes (optional, future) */
+    allowCountries?: string[];
+    /**
+     * User has confirmed exposure for privateRecommended services.
+     * When false and default is private, start may return needsExposureDecision.
+     */
+    decided?: boolean;
+    updatedAt: string;
+};
+export type ServiceExposureStore = {
+    version: 1;
+    services: Record<string, ServiceExposureDesired>;
+};
+export type SyncReason = 'start' | 'apply' | 'port-change' | 'manual' | 'stop';
+export type ExposureDecision = 'keep-private' | 'public' | 'restricted';
+/** UFW comment prefix for managed service rules */
+export declare const YSK_SVC_COMMENT_PREFIX = "ysk-svc";
+/** Sanitize serviceId / role for UFW comments. */
+export declare function sanitizeSvcToken(raw: string): string;
+/**
+ * Full comment: `ysk-svc:<serviceId>:<role>`
+ * Used on every allow rule so port-change can delete by prefix.
+ */
+export declare function yskSvcComment(serviceId: string, role: string): string;
+/** Prefix matching all rules for a service: `ysk-svc:<serviceId>:` */
+export declare function yskSvcCommentPrefix(serviceId: string): string;
+export declare function isValidServiceId(id: string): boolean;
+/** Default mode from catalog: privateRecommended → private, else public. */
+export declare function defaultExposureMode(serviceId: string): ExposureMode;
+/** Default port bindings from YSK_SERVICE_PORTS catalog. */
+export declare function defaultPortsForService(serviceId: string): ServicePortBinding[];
+export declare function normalizePortBinding(raw: Partial<ServicePortBinding>): ServicePortBinding | null;
+export declare function normalizeExposureMode(raw: unknown): ExposureMode;
+//# sourceMappingURL=service-exposure.d.ts.map

package/dist/service-exposure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-exposure.d.ts","sourceRoot":"","sources":["../src/service-exposure.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE9E,4DAA4D;AAC5D,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,QAAQ,GAAG,YAAY,CAAC;AAE/D,MAAM,MAAM,kBAAkB,GAAG;IAC/B,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,gBAAgB,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,YAAY,CAAC;IACnB,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,+CAA+C;IAC/C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,OAAO,GAAG,aAAa,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE/E,MAAM,MAAM,gBAAgB,GAAG,cAAc,GAAG,QAAQ,GAAG,YAAY,CAAC;AAExE,mDAAmD;AACnD,eAAO,MAAM,sBAAsB,YAAY,CAAC;AAIhD,kDAAkD;AAClD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAQpD;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAErE;AAED,sEAAsE;AACtE,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,4EAA4E;AAC5E,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,YAAY,CAMnE;AAED,4DAA4D;AAC5D,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,kBAAkB,EAAE,CAO9E;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,kBAAkB,GAAG,IAAI,CAQhG;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,YAAY,CAIhE"}

package/dist/service-exposure.js

@@ -0,0 +1,67 @@
+/**
+ * Service network exposure — desired firewall state for managed services.
+ * SSOT types + comment helpers shared by core + web.
+ */
+import { YSK_SERVICE_PORTS } from './service-ports.js';
+/** UFW comment prefix for managed service rules */
+export const YSK_SVC_COMMENT_PREFIX = 'ysk-svc';
+const SAFE_ID = /^[a-zA-Z0-9][a-zA-Z0-9._-]{0,47}$/;
+/** Sanitize serviceId / role for UFW comments. */
+export function sanitizeSvcToken(raw) {
+    const s = String(raw ?? '')
+        .trim()
+        .toLowerCase()
+        .replace(/[^a-z0-9._-]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .slice(0, 48);
+    return s || 'unknown';
+}
+/**
+ * Full comment: `ysk-svc:<serviceId>:<role>`
+ * Used on every allow rule so port-change can delete by prefix.
+ */
+export function yskSvcComment(serviceId, role) {
+    return `${YSK_SVC_COMMENT_PREFIX}:${sanitizeSvcToken(serviceId)}:${sanitizeSvcToken(role)}`;
+}
+/** Prefix matching all rules for a service: `ysk-svc:<serviceId>:` */
+export function yskSvcCommentPrefix(serviceId) {
+    return `${YSK_SVC_COMMENT_PREFIX}:${sanitizeSvcToken(serviceId)}:`;
+}
+export function isValidServiceId(id) {
+    return SAFE_ID.test(String(id ?? '').trim());
+}
+/** Default mode from catalog: privateRecommended → private, else public. */
+export function defaultExposureMode(serviceId) {
+    const sid = String(serviceId ?? '').trim();
+    const ports = YSK_SERVICE_PORTS.filter((p) => p.service === sid);
+    if (ports.length === 0)
+        return 'public';
+    if (ports.some((p) => p.privateRecommended))
+        return 'private';
+    return 'public';
+}
+/** Default port bindings from YSK_SERVICE_PORTS catalog. */
+export function defaultPortsForService(serviceId) {
+    const sid = String(serviceId ?? '').trim();
+    return YSK_SERVICE_PORTS.filter((p) => p.service === sid).map((p) => ({
+        role: p.id,
+        port: p.port,
+        proto: p.proto,
+    }));
+}
+export function normalizePortBinding(raw) {
+    const role = sanitizeSvcToken(String(raw.role ?? 'listen'));
+    const port = String(raw.port ?? '').trim();
+    if (!port)
+        return null;
+    const protoRaw = String(raw.proto ?? 'tcp').toLowerCase();
+    const proto = protoRaw === 'udp' ? 'udp' : protoRaw === 'both' || protoRaw === 'any' ? 'both' : 'tcp';
+    return { role, port, proto };
+}
+export function normalizeExposureMode(raw) {
+    const s = String(raw ?? '').toLowerCase();
+    if (s === 'private' || s === 'restricted' || s === 'public')
+        return s;
+    return 'public';
+}
+//# sourceMappingURL=service-exposure.js.map

package/dist/service-exposure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-exposure.js","sourceRoot":"","sources":["../src/service-exposure.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,iBAAiB,EAAyB,MAAM,oBAAoB,CAAC;AAsC9E,mDAAmD;AACnD,MAAM,CAAC,MAAM,sBAAsB,GAAG,SAAS,CAAC;AAEhD,MAAM,OAAO,GAAG,mCAAmC,CAAC;AAEpD,kDAAkD;AAClD,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;SACxB,IAAI,EAAE;SACN,WAAW,EAAE;SACb,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC;SAC9B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,IAAI,SAAS,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,IAAY;IAC3D,OAAO,GAAG,sBAAsB,IAAI,gBAAgB,CAAC,SAAS,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;AAC9F,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,mBAAmB,CAAC,SAAiB;IACnD,OAAO,GAAG,sBAAsB,IAAI,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,EAAU;IACzC,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,mBAAmB,CAAC,SAAiB;IACnD,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC,CAAC;IACjE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACxC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,sBAAsB,CAAC,SAAiB;IACtD,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpE,IAAI,EAAE,CAAC,CAAC,EAAE;QACV,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAgC;IACnE,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,QAAQ,CAAC,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1D,MAAM,KAAK,GACT,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;IAC1F,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAAY;IAChD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1C,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,YAAY,IAAI,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IACtE,OAAO,QAAQ,CAAC;AAClB,CAAC"}