build: ship pre-built API bundle; images copy output instead of installing

- API: `pnpm build` bundles dist/ into apps/api/.output (esbuild), with Linux musl native packages for sharp and argon2 kept alongside - docker/api.Dockerfile copies that output; no pnpm install on the server - add dist/migrate.js (prisma migrate deploy equivalent, same _prisma_migrations table and lock) so the Prisma CLI is not needed at runtime - pnpm-workspace: supportedArchitectures for linux/x64/musl - admin: apps/admin/.env.production sets VITE_SITE_URL for the production build - drop NPM_REGISTRY / SITE_URL build args from compose and .env.example - gitignore: anchor node_modules rules so pre-built node_modules are committed - README: describe the pre-built deploy flow Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
2026-10-24 14:41:31 +03:30
parent ee8258556d
commit 10e453e4be
692 changed files with 303601 additions and 147 deletions
@@ -0,0 +1,104 @@
+/* auto-generated by NAPI-RS */
+/* eslint-disable */
+export declare const enum Algorithm {
+  /**
+   * Optimizes against GPU cracking attacks but vulnerable to side-channels.
+   * Accesses the memory array in a password dependent order, reducing the possibility of time–memory tradeoff (TMTO) attacks.
+   */
+  Argon2d = 0,
+  /**
+   * Optimized to resist side-channel attacks.
+   * Accesses the memory array in a password independent order, increasing the possibility of time-memory tradeoff (TMTO) attacks.
+   */
+  Argon2i = 1,
+  /**
+   * Default value, this is the default algorithm for normative recommendations.
+   * Hybrid that mixes Argon2i and Argon2d passes.
+   * Uses the Argon2i approach for the first half pass over memory and Argon2d approach for subsequent passes. This effectively places it in the “middle” between the other two: it doesn’t provide as good TMTO/GPU cracking resistance as Argon2d, nor as good of side-channel resistance as Argon2i, but overall provides the most well-rounded approach to both classes of attacks.
+   */
+  Argon2id = 2
+}
+
+export declare function hash(password: string | Uint8Array, options?: Options | undefined | null, abortSignal?: AbortSignal | undefined | null): Promise<string>
+
+export declare function hashRaw(password: string | Uint8Array, options?: Options | undefined | null, abortSignal?: AbortSignal | undefined | null): Promise<Buffer>
+
+export declare function hashRawSync(password: string | Uint8Array, options?: Options | undefined | null): Buffer
+
+export declare function hashSync(password: string | Uint8Array, options?: Options | undefined | null): string
+
+export interface Options {
+  /**
+   * The amount of memory to be used by the hash function, in kilobytes. Each thread will have a memory pool of this size. Note that large values for highly concurrent usage will cause starvation and thrashing if your system memory gets full.
+   *
+   * Value is an integer in decimal (1 to 10 digits), between 1 and (2^32)-1.
+   *
+   * The default value is 19456, meaning a pool of 19 MiB per thread.
+   */
+  memoryCost?: number
+  /**
+   * The time cost is the amount of passes (iterations) used by the hash function. It increases hash strength at the cost of time required to compute.
+   *
+   * Value is an integer in decimal (1 to 10 digits), between 1 and (2^32)-1.
+   *
+   * The default value is 2.
+   */
+  timeCost?: number
+  /**
+   * The hash length is the length of the hash function output in bytes. Note that the resulting hash is encoded with Base 64, so the digest will be ~1/3 longer.
+   *
+   * The default value is 32, which produces raw hashes of 32 bytes or digests of 43 characters.
+   */
+  outputLen?: number
+  /**
+   * The amount of threads to compute the hash on. Each thread has a memory pool with memoryCost size. Note that changing it also changes the resulting hash.
+   *
+   * Value is an integer in decimal (1 to 3 digits), between 1 and 255.
+   *
+   * The default value is 1, meaning a single thread is used.
+   */
+  parallelism?: number
+  algorithm?: Algorithm
+  version?: Version
+  secret?: Uint8Array
+  salt?: Uint8Array
+}
+
+export interface ParsedHashOptions {
+  algorithm: Algorithm
+  version: Version
+  /** Memory cost in kibibytes (`m=` in the PHC string). */
+  memoryCost: number
+  /** Time cost / number of passes (`t=` in the PHC string). */
+  timeCost: number
+  /** Degree of parallelism (`p=` in the PHC string). */
+  parallelism: number
+  /** Length of the raw hash output in bytes. */
+  outputLen: number
+  /**
+   * Byte length of the decoded salt. This package generates 16-byte salts;
+   * older hashes may carry shorter ones.
+   */
+  saltLen: number
+}
+
+/**
+ * Parses an encoded argon2 hash string (PHC format) and returns the parameters
+ * it was created with. Useful for "needs rehash" checks: compare the returned
+ * parameters against your current policy and rehash when they differ.
+ */
+export declare function parseOptions(hashed: string | Uint8Array): ParsedHashOptions
+
+export declare function verify(hashed: string | Uint8Array, password: string | Uint8Array, options?: Options | undefined | null, abortSignal?: AbortSignal | undefined | null): Promise<boolean>
+
+export declare function verifySync(hashed: string | Uint8Array, password: string | Uint8Array, options?: Options | undefined | null): boolean
+
+export declare const enum Version {
+  /** Version 16 (0x10 in hex) */
+  V0x10 = 0,
+  /**
+   * Default value
+   * Version 19 (0x13 in hex)
+   */
+  V0x13 = 1
+}