@cogenta/fleet 0.1.0

package/dist/control/risk.js

@@ -0,0 +1,130 @@
+/**
+ * A critical CVE alone must outrank everything else this function can weigh
+ * — the lot's own literal acceptance criterion ("un site avec une CVE
+ * critique passe devant"). Values are real point contributions, not display
+ * labels; a single critical CVE (100) already exceeds the `critical` tier
+ * threshold below on its own.
+ */
+const CVE_URGENCY_POINTS = {
+    critical: 100,
+    high: 45,
+    medium: 15,
+    low: 4,
+};
+/** Points per drifted component, capped so a site with dozens of drifted plugins doesn't mathematically out-rank a single critical CVE — drift is real but genuinely less urgent than an exploitable vulnerability. */
+const DRIFT_POINTS = {
+    behind: 6,
+    different: 4,
+    ahead: 1,
+};
+const MAX_DRIFT_POINTS = 30;
+/** One unmatched-MFA admin account is a real, meaningful gap — scales with the real ratio, not just a flat penalty regardless of fleet size. */
+const MFA_GAP_POINTS_PER_ACCOUNT = 8;
+const TIER_THRESHOLDS = [
+    { tier: 'critical', min: 80 },
+    { tier: 'high', min: 35 },
+    { tier: 'medium', min: 10 },
+    { tier: 'low', min: 0 },
+];
+function tierFor(score) {
+    const found = TIER_THRESHOLDS.find((entry) => score >= entry.min);
+    return found?.tier ?? 'low';
+}
+/**
+ * Real, deterministic per-site score — never touches `snapshot`'s
+ * shape-only fields. `null` `snapshot` (a paired site that has never
+ * reported) is real risk in itself: an unresponsive/never-seen site is not
+ * "score zero, all clear."
+ */
+export function computeSiteRisk(site, snapshot, driftEntries) {
+    const reasons = [];
+    let score = 0;
+    if (snapshot === null) {
+        reasons.push({ code: 'cve', detail: 'no telemetry ever received', points: 20 });
+        score += 20;
+    }
+    else {
+        for (const cve of snapshot.payload.openCves) {
+            if (cve.status !== 'open')
+                continue;
+            const points = CVE_URGENCY_POINTS[cve.urgency];
+            reasons.push({ code: 'cve', detail: `${cve.id} (${cve.urgency}, open)`, points });
+            score += points;
+        }
+        const { count, mfaEnabledCount } = snapshot.payload.adminAccounts;
+        const withoutMfa = Math.max(0, count - mfaEnabledCount);
+        if (withoutMfa > 0) {
+            const points = Math.min(withoutMfa * MFA_GAP_POINTS_PER_ACCOUNT, 40);
+            reasons.push({
+                code: 'mfa-gap',
+                detail: `${withoutMfa}/${count} admin account(s) without MFA`,
+                points,
+            });
+            score += points;
+        }
+    }
+    const siteDrift = driftEntries.filter((entry) => entry.siteId === site.id);
+    if (siteDrift.length > 0) {
+        const driftPoints = Math.min(siteDrift.reduce((sum, entry) => sum + DRIFT_POINTS[entry.direction], 0), MAX_DRIFT_POINTS);
+        reasons.push({
+            code: 'version-drift',
+            detail: `${siteDrift.length} component(s) drifted from the fleet baseline`,
+            points: driftPoints,
+        });
+        score += driftPoints;
+    }
+    return {
+        siteId: site.id,
+        siteName: site.name,
+        client: site.client,
+        score,
+        tier: tierFor(score),
+        reasons,
+    };
+}
+/**
+ * Sorted highest-risk first — the dashboard's whole reason for existing
+ * ("tri par risque, pas par ordre alphabétique"). Ties break on site name,
+ * ascending, so the ordering is fully deterministic (never insertion order).
+ */
+export function rankSitesByRisk(sites) {
+    return sites
+        .map(({ site, snapshot, driftEntries }) => computeSiteRisk(site, snapshot, driftEntries))
+        .sort((a, b) => b.score - a.score || a.siteName.localeCompare(b.siteName));
+}
+const TIER_RANK = { critical: 3, high: 2, medium: 1, low: 0 };
+/**
+ * Real, composable query over an already-ranked list — designed for a
+ * hundred sites from the start ("## Pièges connus": "Concevoir directement
+ * pour cent"), not a client-side afterthought: a real O(n) predicate pass,
+ * the same shape a server-side query would use once a live control plane
+ * exists to run one against.
+ */
+export function filterRisks(risks, filter) {
+    const search = filter.search?.trim().toLowerCase();
+    return risks.filter((risk) => {
+        if (filter.client !== undefined && risk.client !== filter.client)
+            return false;
+        if (filter.minTier !== undefined && TIER_RANK[risk.tier] < TIER_RANK[filter.minTier])
+            return false;
+        if (search !== undefined && search !== '') {
+            const haystack = `${risk.siteName} ${risk.client ?? ''}`.toLowerCase();
+            if (!haystack.includes(search))
+                return false;
+        }
+        return true;
+    });
+}
+/** Real grouping by client — `null` (no client set) is its own real group, never dropped or merged into a fake "unknown" label. */
+export function groupRisksByClient(risks) {
+    const groups = new Map();
+    for (const risk of risks) {
+        const bucket = groups.get(risk.client);
+        if (bucket === undefined)
+            groups.set(risk.client, [risk]);
+        else
+            bucket.push(risk);
+    }
+    return groups;
+}
+//# sourceMappingURL=risk.js.map

package/dist/control/risk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk.js","sourceRoot":"","sources":["../../src/control/risk.ts"],"names":[],"mappings":"AAoCA;;;;;;GAMG;AACH,MAAM,kBAAkB,GAA4B;IAClD,QAAQ,EAAE,GAAG;IACb,IAAI,EAAE,EAAE;IACR,MAAM,EAAE,EAAE;IACV,GAAG,EAAE,CAAC;CACP,CAAA;AAED,uNAAuN;AACvN,MAAM,YAAY,GAA4C;IAC5D,MAAM,EAAE,CAAC;IACT,SAAS,EAAE,CAAC;IACZ,KAAK,EAAE,CAAC;CACT,CAAA;AACD,MAAM,gBAAgB,GAAG,EAAE,CAAA;AAE3B,gJAAgJ;AAChJ,MAAM,0BAA0B,GAAG,CAAC,CAAA;AAEpC,MAAM,eAAe,GAAiE;IACpF,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,EAAE;IAC7B,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE;IACzB,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE;IAC3B,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE;CACxB,CAAA;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC,CAAA;IACjE,OAAO,KAAK,EAAE,IAAI,IAAI,KAAK,CAAA;AAC7B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAsB,EACtB,QAAkC,EAClC,YAAmC;IAEnC,MAAM,OAAO,GAAiB,EAAE,CAAA;IAChC,IAAI,KAAK,GAAG,CAAC,CAAA;IAEb,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAA;QAC/E,KAAK,IAAI,EAAE,CAAA;IACb,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC5C,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;gBAAE,SAAQ;YACnC,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAC9C,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,OAAO,SAAS,EAAE,MAAM,EAAE,CAAC,CAAA;YACjF,KAAK,IAAI,MAAM,CAAA;QACjB,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAA;QACjE,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,eAAe,CAAC,CAAA;QACvD,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,0BAA0B,EAAE,EAAE,CAAC,CAAA;YACpE,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,GAAG,UAAU,IAAI,KAAK,+BAA+B;gBAC7D,MAAM;aACP,CAAC,CAAA;YACF,KAAK,IAAI,MAAM,CAAA;QACjB,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,CAAC,CAAA;IAC1E,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAC1B,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,EACxE,gBAAgB,CACjB,CAAA;QACD,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,+CAA+C;YAC1E,MAAM,EAAE,WAAW;SACpB,CAAC,CAAA;QACF,KAAK,IAAI,WAAW,CAAA;IACtB,CAAC;IAED,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,QAAQ,EAAE,IAAI,CAAC,IAAI;QACnB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK;QACL,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC;QACpB,OAAO;KACR,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,KAIG;IAEH,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;SACxF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAA;AAC9E,CAAC;AAUD,MAAM,SAAS,GAA6B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAA;AAEvF;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,KAA0B,EAAE,MAAmB;IACzE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAClD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QAC3B,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;YAAE,OAAO,KAAK,CAAA;QAC9E,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC;YAClF,OAAO,KAAK,CAAA;QACd,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,WAAW,EAAE,CAAA;YACtE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,OAAO,KAAK,CAAA;QAC9C,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,mIAAmI;AACnI,MAAM,UAAU,kBAAkB,CAChC,KAA0B;IAE1B,MAAM,MAAM,GAAG,IAAI,GAAG,EAA6B,CAAA;IACnD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACtC,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;;YACpD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACxB,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/control/state.d.ts

@@ -0,0 +1,19 @@
+import { type DatabaseHandle } from '@cogenta/core';
+import type { TelemetryPayload } from '../agent/types.js';
+export interface TelemetrySnapshot {
+    readonly id: string;
+    readonly siteId: string;
+    readonly collectedAt: string;
+    readonly ingestedAt: string;
+    readonly payload: TelemetryPayload;
+}
+export interface SiteStateStore {
+    /** Records one verified snapshot for `siteId`, then prunes down to the retention limit — never called with an unverified payload (`./ingest.js` is the only real caller). */
+    recordSnapshot(siteId: string, payload: TelemetryPayload): Promise<TelemetrySnapshot>;
+    /** The most recent snapshot for one site, or `null` if none exists yet. Always scoped to exactly one `siteId` — there is no "latest across all sites" shape here. */
+    latest(siteId: string): Promise<TelemetrySnapshot | null>;
+    /** Every retained snapshot for one site, most recent first. Always scoped to exactly one `siteId`. */
+    history(siteId: string): Promise<readonly TelemetrySnapshot[]>;
+}
+export declare function createSiteStateStore(db: DatabaseHandle, now?: () => number, retain?: number): SiteStateStore;
+//# sourceMappingURL=state.d.ts.map

package/dist/control/state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../src/control/state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,cAAc,EAA4C,MAAM,eAAe,CAAA;AAC7F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAsBzD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAA;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B,6KAA6K;IAC7K,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;IACrF,qKAAqK;IACrK,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAA;IACzD,sGAAsG;IACtG,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC,CAAA;CAC/D;AAoBD,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,cAAc,EAClB,GAAG,GAAE,MAAM,MAAiB,EAC5B,MAAM,GAAE,MAAuB,GAC9B,cAAc,CA0ChB"}

package/dist/control/state.js

@@ -0,0 +1,67 @@
+import { identifier, newId, sql } from '@cogenta/core';
+import { CONTROL_TABLES } from './tables.js';
+/** `@cogenta/core`'s `sql` tag has no built-in list helper — nested fragments splice correctly, so a left-fold of one-value fragments joined by `, ` produces real, individually-bound placeholders, never an inlined value. */
+function sqlList(values) {
+    return values.map((value) => sql `${value}`).reduce((acc, fragment) => sql `${acc}, ${fragment}`);
+}
+/**
+ * How many of a site's most recent telemetry snapshots the control plane
+ * keeps. "## Pièges connus" (`docs/lots/L8-flotte.md`): "La télémétrie qui
+ * grossit... Rétention et agrégation dès le départ" — a real, bounded number
+ * decided now rather than an unbounded table a later task has to notice and
+ * fix. 30 covers roughly a month of once-daily contact (the natural cadence
+ * for the fields this payload actually carries — CVE status, Core Web
+ * Vitals, backup results — none of which need finer-than-daily history for
+ * the dashboard/report tasks this lot still has ahead of it) without the
+ * unbounded growth the pitfall warns about. A real aggregation/rollup
+ * pipeline for longer-term trends is a later task's job, not this one's.
+ */
+const DEFAULT_RETAIN = 30;
+function toSnapshot(row) {
+    return {
+        id: row.id,
+        siteId: row.site_id,
+        collectedAt: row.collected_at,
+        ingestedAt: row.ingested_at,
+        payload: JSON.parse(row.payload_json),
+    };
+}
+export function createSiteStateStore(db, now = Date.now, retain = DEFAULT_RETAIN) {
+    const snapshots = identifier(CONTROL_TABLES.telemetrySnapshots, db.dialect);
+    return {
+        async recordSnapshot(siteId, payload) {
+            const id = newId(now);
+            const ingestedAt = new Date(now()).toISOString();
+            await db.query(sql `
+        insert into ${snapshots} (id, site_id, collected_at, ingested_at, payload_json)
+        values (${id}, ${siteId}, ${payload.collectedAt}, ${ingestedAt}, ${JSON.stringify(payload)})`);
+            // Bounded retention, enforced on every write, not a separate cron job
+            // a deployment could forget to schedule: delete anything for this site
+            // that falls outside its `retain` most-recent rows.
+            const keep = await db.query(sql `
+        select id from ${snapshots} where site_id = ${siteId}
+        order by collected_at desc limit ${retain}`);
+            const keepIds = keep.rows.map((row) => row.id);
+            if (keepIds.length > 0) {
+                await db.query(sql `
+          delete from ${snapshots}
+          where site_id = ${siteId} and id not in (${sqlList(keepIds)})`);
+            }
+            return { id, siteId, collectedAt: payload.collectedAt, ingestedAt, payload };
+        },
+        async latest(siteId) {
+            const result = await db.query(sql `
+        select id, site_id, collected_at, ingested_at, payload_json from ${snapshots}
+        where site_id = ${siteId} order by collected_at desc limit 1`);
+            const row = result.rows[0];
+            return row === undefined ? null : toSnapshot(row);
+        },
+        async history(siteId) {
+            const result = await db.query(sql `
+        select id, site_id, collected_at, ingested_at, payload_json from ${snapshots}
+        where site_id = ${siteId} order by collected_at desc`);
+            return result.rows.map(toSnapshot);
+        },
+    };
+}
+//# sourceMappingURL=state.js.map

package/dist/control/state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../../src/control/state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,UAAU,EAAE,KAAK,EAAoB,GAAG,EAAE,MAAM,eAAe,CAAA;AAE7F,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAE5C,gOAAgO;AAChO,SAAS,OAAO,CAAC,MAA0B;IACzC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAA,GAAG,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,GAAG,CAAA,GAAG,GAAG,KAAK,QAAQ,EAAE,CAAC,CAAA;AACjG,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,cAAc,GAAG,EAAE,CAAA;AA2BzB,SAAS,UAAU,CAAC,GAAgB;IAClC,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,MAAM,EAAE,GAAG,CAAC,OAAO;QACnB,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAqB;KAC1D,CAAA;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,EAAkB,EAClB,GAAG,GAAiB,IAAI,CAAC,GAAG,EAC5B,MAAM,GAAW,cAAc;IAE/B,MAAM,SAAS,GAAG,UAAU,CAAC,cAAc,CAAC,kBAAkB,EAAE,EAAE,CAAC,OAAO,CAAC,CAAA;IAE3E,OAAO;QACL,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO;YAClC,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAA;YACrB,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;YAChD,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;sBACF,SAAS;kBACb,EAAE,KAAK,MAAM,KAAK,OAAO,CAAC,WAAW,KAAK,UAAU,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAEhG,sEAAsE;YACtE,uEAAuE;YACvE,oDAAoD;YACpD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAiB,GAAG,CAAA;yBAC5B,SAAS,oBAAoB,MAAM;2CACjB,MAAM,EAAE,CAAC,CAAA;YAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC9C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;wBACF,SAAS;4BACL,MAAM,mBAAmB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YACnE,CAAC;YAED,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,CAAA;QAC9E,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAc,GAAG,CAAA;2EACuB,SAAS;0BAC1D,MAAM,qCAAqC,CAAC,CAAA;YAChE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAC1B,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QACnD,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,MAAM;YAClB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAc,GAAG,CAAA;2EACuB,SAAS;0BAC1D,MAAM,6BAA6B,CAAC,CAAA;YACxD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QACpC,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/control/tables.d.ts

@@ -0,0 +1,18 @@
+import { type DatabaseHandle } from '@cogenta/core';
+export declare const CONTROL_TABLES: {
+    readonly telemetrySnapshots: 'cogenta_fleet_telemetry_snapshots';
+    readonly commands: 'cogenta_fleet_commands';
+};
+/**
+ * Owned by `@cogenta/fleet`'s control-plane side, same `create table if not
+ * exists` pattern as `./enrollment/tables.ts`'s `ensureFleetTables` — no
+ * separate migration file. One row per ingested, verified telemetry
+ * snapshot, keyed strictly by `site_id` — there is no table, index or query
+ * shape anywhere in `@cogenta/fleet` that spans more than one site's rows at
+ * once (`./state.ts`'s real API only ever takes a single `siteId`), which is
+ * what "keyed and scoped per-site from day one, structurally" means in
+ * practice: not a convention a caller is expected to honour, a shape that
+ * makes a cross-site query awkward to even attempt.
+ */
+export declare function ensureControlTables(db: DatabaseHandle): Promise<void>;
+//# sourceMappingURL=tables.d.ts.map

package/dist/control/tables.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tables.d.ts","sourceRoot":"","sources":["../../src/control/tables.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,cAAc,EAKpB,MAAM,eAAe,CAAA;AAEtB,eAAO,MAAM,cAAc;aACzB,kBAAkB,EAAE,mCAAmC;aACvD,QAAQ,EAAE,wBAAwB;CAC1B,CAAA;AAqBV;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAyC3E"}

package/dist/control/tables.js

@@ -0,0 +1,58 @@
+import { identifier, sql, unsafeRaw, } from '@cogenta/core';
+export const CONTROL_TABLES = {
+    telemetrySnapshots: 'cogenta_fleet_telemetry_snapshots',
+    commands: 'cogenta_fleet_commands',
+};
+function textColumn(dialect, length) {
+    return unsafeRaw(dialect === 'sqlite' ? 'text' : `varchar(${length})`);
+}
+function longTextColumn(dialect) {
+    return unsafeRaw(dialect === 'sqlite' ? 'text' : 'text');
+}
+async function createIndexIfMissing(db, name, table, columns) {
+    await db
+        .query(sql `create index ${identifier(name, db.dialect)} on ${table} ${columns}`)
+        .catch(() => undefined); // already there — no portable "if not exists" for indexes
+}
+/**
+ * Owned by `@cogenta/fleet`'s control-plane side, same `create table if not
+ * exists` pattern as `./enrollment/tables.ts`'s `ensureFleetTables` — no
+ * separate migration file. One row per ingested, verified telemetry
+ * snapshot, keyed strictly by `site_id` — there is no table, index or query
+ * shape anywhere in `@cogenta/fleet` that spans more than one site's rows at
+ * once (`./state.ts`'s real API only ever takes a single `siteId`), which is
+ * what "keyed and scoped per-site from day one, structurally" means in
+ * practice: not a convention a caller is expected to honour, a shape that
+ * makes a cross-site query awkward to even attempt.
+ */
+export async function ensureControlTables(db) {
+    const d = db.dialect;
+    const t255 = textColumn(d, 255);
+    const payloadColumn = longTextColumn(d);
+    const snapshots = identifier(CONTROL_TABLES.telemetrySnapshots, d);
+    await db.query(sql `
+    create table if not exists ${snapshots} (
+      id ${t255} not null primary key,
+      site_id ${t255} not null,
+      collected_at ${t255} not null,
+      ingested_at ${t255} not null,
+      payload_json ${payloadColumn} not null
+    )`);
+    await createIndexIfMissing(db, 'cogenta_fleet_telemetry_snapshots_site', snapshots, sql `(site_id, collected_at)`);
+    // One row per queued command, strictly per-site (`site_id`) — the same
+    // structural per-site scoping as `telemetry_snapshots` above, mirrored for
+    // the opposite direction (control plane → site instead of site → control
+    // plane).
+    const commands = identifier(CONTROL_TABLES.commands, d);
+    await db.query(sql `
+    create table if not exists ${commands} (
+      id ${t255} not null primary key,
+      site_id ${t255} not null,
+      action ${t255} not null,
+      payload_json ${payloadColumn} not null,
+      queued_at ${t255} not null,
+      delivered_at ${t255}
+    )`);
+    await createIndexIfMissing(db, 'cogenta_fleet_commands_site', commands, sql `(site_id, delivered_at)`);
+}
+//# sourceMappingURL=tables.js.map

package/dist/control/tables.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tables.js","sourceRoot":"","sources":["../../src/control/tables.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,UAAU,EAEV,GAAG,EACH,SAAS,GACV,MAAM,eAAe,CAAA;AAEtB,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,kBAAkB,EAAE,mCAAmC;IACvD,QAAQ,EAAE,wBAAwB;CAC1B,CAAA;AAEV,SAAS,UAAU,CAAC,OAAwB,EAAE,MAAc;IAC1D,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,GAAG,CAAC,CAAA;AACxE,CAAC;AAED,SAAS,cAAc,CAAC,OAAwB;IAC9C,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;AAC1D,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,EAAkB,EAClB,IAAY,EACZ,KAAkB,EAClB,OAAoB;IAEpB,MAAM,EAAE;SACL,KAAK,CAAC,GAAG,CAAA,gBAAgB,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,IAAI,OAAO,EAAE,CAAC;SAC/E,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA,CAAC,0DAA0D;AACtF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EAAkB;IAC1D,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAA;IACpB,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC/B,MAAM,aAAa,GAAG,cAAc,CAAC,CAAC,CAAC,CAAA;IAEvC,MAAM,SAAS,GAAG,UAAU,CAAC,cAAc,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAA;IAClE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;iCACa,SAAS;WAC/B,IAAI;gBACC,IAAI;qBACC,IAAI;oBACL,IAAI;qBACH,aAAa;MAC5B,CAAC,CAAA;IACL,MAAM,oBAAoB,CACxB,EAAE,EACF,wCAAwC,EACxC,SAAS,EACT,GAAG,CAAA,yBAAyB,CAC7B,CAAA;IAED,uEAAuE;IACvE,2EAA2E;IAC3E,yEAAyE;IACzE,UAAU;IACV,MAAM,QAAQ,GAAG,UAAU,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;IACvD,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;iCACa,QAAQ;WAC9B,IAAI;gBACC,IAAI;eACL,IAAI;qBACE,aAAa;kBAChB,IAAI;qBACD,IAAI;MACnB,CAAC,CAAA;IACL,MAAM,oBAAoB,CACxB,EAAE,EACF,6BAA6B,EAC7B,QAAQ,EACR,GAAG,CAAA,yBAAyB,CAC7B,CAAA;AACH,CAAC"}

package/dist/enrollment/store.d.ts

@@ -0,0 +1,84 @@
+import { type DatabaseHandle } from '@cogenta/core';
+import { type ControlPlaneIdentity } from '../control/identity.js';
+export interface PairingToken {
+    /** The real bearer credential — returned once, at issuance, never recoverable afterward (only its hash is stored). */
+    readonly token: string;
+    readonly expiresAt: string;
+    /**
+     * The control plane's own real Ed25519 public key (`../control/identity.js`)
+     * — handed to the site at the same moment as the token, so it can verify
+     * every future signed command (task 6) without a second round trip. The
+     * reverse of the site's own public key, which the control plane only
+     * learns later, at consumption (`consumePairingToken`).
+     */
+    readonly controlPlanePublicKey: string;
+}
+export interface SiteRegistration {
+    readonly id: string;
+    readonly name: string;
+    /** Base64 SPKI Ed25519 public key the site submitted when it consumed its pairing token — every later mutually-authenticated exchange verifies against this. */
+    readonly publicKey: string;
+    readonly registeredAt: string;
+    readonly revoked: boolean;
+    readonly revokedAt: string | null;
+    /**
+     * Which agency client this site belongs to — real, minimal, optional (an
+     * agency running a single-client fleet has no reason to fill it in).
+     * `null` for a site enrolled without one. The one client concept this
+     * package has: needed for the dashboard's real "regroupement par client"
+     * (`docs/lots/L8-flotte.md`, "## Pièges connus"), which had nothing to
+     * group by before this field existed.
+     */
+    readonly client: string | null;
+}
+/**
+ * `consumePairingToken`'s outcome — a discriminated result, not a raw
+ * exception, following the same "already decided"/"expired"/"invalid" shape
+ * `@cogenta/channels`' linking codes and `@cogenta/plugins`' approval and
+ * registry-review flows already established this session: a caller (a real
+ * enrollment HTTP handler, once one exists) can render each case without
+ * parsing an error message.
+ */
+export type PairingConsumeResult = {
+    readonly ok: true;
+    readonly site: SiteRegistration;
+} | {
+    readonly ok: false;
+    readonly reason: 'invalid' | 'expired' | 'already_used';
+};
+export interface EnrollmentStore {
+    /**
+     * Real, single-use, time-limited — "## Appairage"'s exact requirement.
+     * `siteName` is fixed at issuance (an operator names the site they're
+     * about to pair, before handing the token to it), not supplied later by
+     * whoever presents the token — the token authorizes registering
+     * *this specific, pre-named* site, not an arbitrary one.
+     */
+    issuePairingToken(siteName: string, options?: {
+        ttlMs?: number;
+        client?: string;
+    }): Promise<PairingToken>;
+    /**
+     * The site's real Ed25519 public key, submitted at consumption time —
+     * this is the one moment a site's identity is established; every later
+     * contact authenticates against what gets recorded here.
+     */
+    consumePairingToken(token: string, sitePublicKey: string): Promise<PairingConsumeResult>;
+    revokeSite(siteId: string): Promise<void>;
+    isRevoked(siteId: string): Promise<boolean>;
+    getSite(siteId: string): Promise<SiteRegistration | null>;
+    /**
+     * Every currently-registered site's metadata (id/name/key/revocation
+     * state) — never anything content- or telemetry-shaped. Needed for real,
+     * fleet-wide operations (inventory/drift detection here; the dashboard and
+     * rollout campaigns later) that must enumerate sites without touching any
+     * per-site telemetry store, which structurally has no cross-site query at
+     * all (`../control/state.js`'s `SiteStateStore`) — this is the one real,
+     * narrow seam where "which sites exist" is legitimately fleet-wide.
+     */
+    listSites(): Promise<readonly SiteRegistration[]>;
+    /** The control plane's own public key — same value every `PairingToken` already carries, exposed directly for a caller that already has a site and needs to verify a command without re-deriving it from a stored token. */
+    getControlPlanePublicKey(): string;
+}
+export declare function createEnrollmentStore(db: DatabaseHandle, now?: () => number, controlPlaneIdentity?: ControlPlaneIdentity): EnrollmentStore;
+//# sourceMappingURL=store.d.ts.map

package/dist/enrollment/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/enrollment/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,cAAc,EAA0B,MAAM,eAAe,CAAA;AAC3E,OAAO,EAAE,KAAK,oBAAoB,EAAgC,MAAM,wBAAwB,CAAA;AAOhG,MAAM,WAAW,YAAY;IAC3B,sHAAsH;IACtH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B;;;;;;OAMG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAA;CACvC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,gKAAgK;IAChK,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,cAAc,CAAA;CAAE,CAAA;AAEnF,MAAM,WAAW,eAAe;IAC9B;;;;;;OAMG;IACH,iBAAiB,CACf,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAC5C,OAAO,CAAC,YAAY,CAAC,CAAA;IACxB;;;;OAIG;IACH,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;IACxF,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzC,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC3C,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAA;IACzD;;;;;;;;OAQG;IACH,SAAS,IAAI,OAAO,CAAC,SAAS,gBAAgB,EAAE,CAAC,CAAA;IACjD,4NAA4N;IAC5N,wBAAwB,IAAI,MAAM,CAAA;CACnC;AAiCD,wBAAgB,qBAAqB,CACnC,EAAE,EAAE,cAAc,EAClB,GAAG,GAAE,MAAM,MAAiB,EAC5B,oBAAoB,GAAE,oBAAqD,GAC1E,eAAe,CA8EjB"}

package/dist/enrollment/store.js

@@ -0,0 +1,81 @@
+import { identifier, newId, sql } from '@cogenta/core';
+import { generateControlPlaneIdentity } from '../control/identity.js';
+import { FLEET_TABLES } from './tables.js';
+import { generatePairingToken, hashPairingToken } from './tokens.js';
+/** Default: long enough for an operator to copy a token into a site's config, short enough that a forgotten token stops mattering on its own. */
+const DEFAULT_TTL_MS = 15 * 60 * 1000;
+function toSite(row) {
+    return {
+        id: row.id,
+        name: row.name,
+        publicKey: row.public_key,
+        registeredAt: row.registered_at,
+        revoked: row.revoked_at !== null,
+        revokedAt: row.revoked_at,
+        client: row.client,
+    };
+}
+export function createEnrollmentStore(db, now = Date.now, controlPlaneIdentity = generateControlPlaneIdentity()) {
+    const tokens = identifier(FLEET_TABLES.pairingTokens, db.dialect);
+    const sites = identifier(FLEET_TABLES.sites, db.dialect);
+    return {
+        async issuePairingToken(siteName, options = {}) {
+            const token = generatePairingToken();
+            const expiresAt = new Date(now() + (options.ttlMs ?? DEFAULT_TTL_MS)).toISOString();
+            const client = options.client ?? null;
+            await db.query(sql `
+        insert into ${tokens} (id, token_hash, site_name, expires_at, consumed_at, site_id, client)
+        values (${newId(now)}, ${hashPairingToken(token)}, ${siteName}, ${expiresAt}, ${null}, ${null}, ${client})`);
+            return { token, expiresAt, controlPlanePublicKey: controlPlaneIdentity.publicKey };
+        },
+        async consumePairingToken(token, sitePublicKey) {
+            const hash = hashPairingToken(token);
+            const result = await db.query(sql `select id, token_hash, site_name, expires_at, consumed_at, site_id, client from ${tokens} where token_hash = ${hash}`);
+            const row = result.rows[0];
+            if (row === undefined)
+                return { ok: false, reason: 'invalid' };
+            if (row.consumed_at !== null)
+                return { ok: false, reason: 'already_used' };
+            if (new Date(row.expires_at).getTime() <= now())
+                return { ok: false, reason: 'expired' };
+            const siteId = newId(now);
+            const registeredAt = new Date(now()).toISOString();
+            await db.query(sql `
+        insert into ${sites} (id, name, public_key, registered_at, revoked_at, client)
+        values (${siteId}, ${row.site_name}, ${sitePublicKey}, ${registeredAt}, ${null}, ${row.client})`);
+            await db.query(sql `update ${tokens} set consumed_at = ${registeredAt}, site_id = ${siteId} where id = ${row.id}`);
+            return {
+                ok: true,
+                site: {
+                    id: siteId,
+                    name: row.site_name,
+                    publicKey: sitePublicKey,
+                    registeredAt,
+                    revoked: false,
+                    revokedAt: null,
+                    client: row.client,
+                },
+            };
+        },
+        async revokeSite(siteId) {
+            await db.query(sql `update ${sites} set revoked_at = ${new Date(now()).toISOString()} where id = ${siteId} and revoked_at is null`);
+        },
+        async isRevoked(siteId) {
+            const site = await this.getSite(siteId);
+            return site?.revoked ?? false;
+        },
+        async getSite(siteId) {
+            const result = await db.query(sql `select id, name, public_key, registered_at, revoked_at, client from ${sites} where id = ${siteId}`);
+            const row = result.rows[0];
+            return row === undefined ? null : toSite(row);
+        },
+        async listSites() {
+            const result = await db.query(sql `select id, name, public_key, registered_at, revoked_at, client from ${sites} order by registered_at asc`);
+            return result.rows.map(toSite);
+        },
+        getControlPlanePublicKey() {
+            return controlPlaneIdentity.publicKey;
+        },
+    };
+}
+//# sourceMappingURL=store.js.map

package/dist/enrollment/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/enrollment/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,eAAe,CAAA;AAC3E,OAAO,EAA6B,4BAA4B,EAAE,MAAM,wBAAwB,CAAA;AAChG,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAEpE,iJAAiJ;AACjJ,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAqGrC,SAAS,MAAM,CAAC,GAAY;IAC1B,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,OAAO,EAAE,GAAG,CAAC,UAAU,KAAK,IAAI;QAChC,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,MAAM,EAAE,GAAG,CAAC,MAAM;KACnB,CAAA;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,EAAkB,EAClB,GAAG,GAAiB,IAAI,CAAC,GAAG,EAC5B,oBAAoB,GAAyB,4BAA4B,EAAE;IAE3E,MAAM,MAAM,GAAG,UAAU,CAAC,YAAY,CAAC,aAAa,EAAE,EAAE,CAAC,OAAO,CAAC,CAAA;IACjE,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,CAAA;IAExD,OAAO;QACL,KAAK,CAAC,iBAAiB,CAAC,QAAQ,EAAE,OAAO,GAAG,EAAE;YAC5C,MAAM,KAAK,GAAG,oBAAoB,EAAE,CAAA;YACpC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,cAAc,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;YACnF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,CAAA;YACrC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;sBACF,MAAM;kBACV,KAAK,CAAC,GAAG,CAAC,KAAK,gBAAgB,CAAC,KAAK,CAAC,KAAK,QAAQ,KAAK,SAAS,KAAK,IAAI,KAAK,IAAI,KAAK,MAAM,GAAG,CAAC,CAAA;YAC9G,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,qBAAqB,EAAE,oBAAoB,CAAC,SAAS,EAAE,CAAA;QACpF,CAAC;QAED,KAAK,CAAC,mBAAmB,CAAC,KAAK,EAAE,aAAa;YAC5C,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;YACpC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B,GAAG,CAAA,mFAAmF,MAAM,uBAAuB,IAAI,EAAE,CAC1H,CAAA;YACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAC1B,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;YAC9D,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAA;YAC1E,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,IAAI,GAAG,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;YAExF,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAA;YACzB,MAAM,YAAY,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;YAClD,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;sBACF,KAAK;kBACT,MAAM,KAAK,GAAG,CAAC,SAAS,KAAK,aAAa,KAAK,YAAY,KAAK,IAAI,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,CAAA;YACnG,MAAM,EAAE,CAAC,KAAK,CACZ,GAAG,CAAA,UAAU,MAAM,sBAAsB,YAAY,eAAe,MAAM,eAAe,GAAG,CAAC,EAAE,EAAE,CAClG,CAAA;YAED,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE;oBACJ,EAAE,EAAE,MAAM;oBACV,IAAI,EAAE,GAAG,CAAC,SAAS;oBACnB,SAAS,EAAE,aAAa;oBACxB,YAAY;oBACZ,OAAO,EAAE,KAAK;oBACd,SAAS,EAAE,IAAI;oBACf,MAAM,EAAE,GAAG,CAAC,MAAM;iBACnB;aACF,CAAA;QACH,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,MAAM;YACrB,MAAM,EAAE,CAAC,KAAK,CACZ,GAAG,CAAA,UAAU,KAAK,qBAAqB,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,eAAe,MAAM,yBAAyB,CACnH,CAAA;QACH,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,MAAM;YACpB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;YACvC,OAAO,IAAI,EAAE,OAAO,IAAI,KAAK,CAAA;QAC/B,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,MAAM;YAClB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B,GAAG,CAAA,uEAAuE,KAAK,eAAe,MAAM,EAAE,CACvG,CAAA;YACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAC1B,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC/C,CAAC;QAED,KAAK,CAAC,SAAS;YACb,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B,GAAG,CAAA,uEAAuE,KAAK,6BAA6B,CAC7G,CAAA;YACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAChC,CAAC;QAED,wBAAwB;YACtB,OAAO,oBAAoB,CAAC,SAAS,CAAA;QACvC,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/enrollment/tables.d.ts

@@ -0,0 +1,20 @@
+import { type DatabaseHandle } from '@cogenta/core';
+export declare const FLEET_TABLES: {
+    readonly pairingTokens: 'cogenta_fleet_pairing_tokens';
+    readonly sites: 'cogenta_fleet_sites';
+};
+/**
+ * Owned by `@cogenta/fleet`, `create table if not exists` pattern exactly as
+ * `@cogenta/plugins`'s `ensurePluginTables`/`@cogenta/channels`'s
+ * `ensureChannelTables` — no separate migration file.
+ *
+ * `pairing_tokens` holds only the token's SHA-256 hash — never the token
+ * itself, same discipline as `@cogenta/auth`'s session tokens and
+ * `@cogenta/channels`'s linking codes; a leaked table hands out nothing
+ * usable. `sites` is the real, persistent registration a consumed token
+ * produces — the control plane's own record of "this public key is site X",
+ * which every later task (télémétrie, commandes signées) authenticates
+ * against.
+ */
+export declare function ensureFleetTables(db: DatabaseHandle): Promise<void>;
+//# sourceMappingURL=tables.d.ts.map

package/dist/enrollment/tables.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tables.d.ts","sourceRoot":"","sources":["../../src/enrollment/tables.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,cAAc,EAKpB,MAAM,eAAe,CAAA;AAEtB,eAAO,MAAM,YAAY;aACvB,aAAa,EAAE,8BAA8B;aAC7C,KAAK,EAAE,qBAAqB;CACpB,CAAA;AAiBV;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA6BzE"}

package/dist/enrollment/tables.js

@@ -0,0 +1,55 @@
+import { identifier, sql, unsafeRaw, } from '@cogenta/core';
+export const FLEET_TABLES = {
+    pairingTokens: 'cogenta_fleet_pairing_tokens',
+    sites: 'cogenta_fleet_sites',
+};
+function textColumn(dialect, length) {
+    return unsafeRaw(dialect === 'sqlite' ? 'text' : `varchar(${length})`);
+}
+async function createIndexIfMissing(db, name, table, columns) {
+    await db
+        .query(sql `create index ${identifier(name, db.dialect)} on ${table} ${columns}`)
+        .catch(() => undefined); // already there — no portable "if not exists" for indexes
+}
+/**
+ * Owned by `@cogenta/fleet`, `create table if not exists` pattern exactly as
+ * `@cogenta/plugins`'s `ensurePluginTables`/`@cogenta/channels`'s
+ * `ensureChannelTables` — no separate migration file.
+ *
+ * `pairing_tokens` holds only the token's SHA-256 hash — never the token
+ * itself, same discipline as `@cogenta/auth`'s session tokens and
+ * `@cogenta/channels`'s linking codes; a leaked table hands out nothing
+ * usable. `sites` is the real, persistent registration a consumed token
+ * produces — the control plane's own record of "this public key is site X",
+ * which every later task (télémétrie, commandes signées) authenticates
+ * against.
+ */
+export async function ensureFleetTables(db) {
+    const d = db.dialect;
+    const t255 = textColumn(d, 255);
+    const t1024 = textColumn(d, 1024);
+    const tokens = identifier(FLEET_TABLES.pairingTokens, d);
+    await db.query(sql `
+    create table if not exists ${tokens} (
+      id ${t255} not null primary key,
+      token_hash ${t255} not null,
+      site_name ${t255} not null,
+      expires_at ${t255} not null,
+      consumed_at ${t255},
+      site_id ${t255},
+      client ${t255}
+    )`);
+    await createIndexIfMissing(db, 'cogenta_fleet_pairing_tokens_hash', tokens, sql `(token_hash)`);
+    const sites = identifier(FLEET_TABLES.sites, d);
+    await db.query(sql `
+    create table if not exists ${sites} (
+      id ${t255} not null primary key,
+      name ${t255} not null,
+      public_key ${t1024} not null,
+      registered_at ${t255} not null,
+      revoked_at ${t255},
+      client ${t255}
+    )`);
+    await createIndexIfMissing(db, 'cogenta_fleet_sites_client', sites, sql `(client)`);
+}
+//# sourceMappingURL=tables.js.map

package/dist/enrollment/tables.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tables.js","sourceRoot":"","sources":["../../src/enrollment/tables.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,UAAU,EAEV,GAAG,EACH,SAAS,GACV,MAAM,eAAe,CAAA;AAEtB,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,aAAa,EAAE,8BAA8B;IAC7C,KAAK,EAAE,qBAAqB;CACpB,CAAA;AAEV,SAAS,UAAU,CAAC,OAAwB,EAAE,MAAc;IAC1D,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,GAAG,CAAC,CAAA;AACxE,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,EAAkB,EAClB,IAAY,EACZ,KAAkB,EAClB,OAAoB;IAEpB,MAAM,EAAE;SACL,KAAK,CAAC,GAAG,CAAA,gBAAgB,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,IAAI,OAAO,EAAE,CAAC;SAC/E,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA,CAAC,0DAA0D;AACtF,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EAAkB;IACxD,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAA;IACpB,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC/B,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;IAEjC,MAAM,MAAM,GAAG,UAAU,CAAC,YAAY,CAAC,aAAa,EAAE,CAAC,CAAC,CAAA;IACxD,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;iCACa,MAAM;WAC5B,IAAI;mBACI,IAAI;kBACL,IAAI;mBACH,IAAI;oBACH,IAAI;gBACR,IAAI;eACL,IAAI;MACb,CAAC,CAAA;IACL,MAAM,oBAAoB,CAAC,EAAE,EAAE,mCAAmC,EAAE,MAAM,EAAE,GAAG,CAAA,cAAc,CAAC,CAAA;IAE9F,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IAC/C,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;iCACa,KAAK;WAC3B,IAAI;aACF,IAAI;mBACE,KAAK;sBACF,IAAI;mBACP,IAAI;eACR,IAAI;MACb,CAAC,CAAA;IACL,MAAM,oBAAoB,CAAC,EAAE,EAAE,4BAA4B,EAAE,KAAK,EAAE,GAAG,CAAA,UAAU,CAAC,CAAA;AACpF,CAAC"}

package/dist/enrollment/tokens.d.ts

@@ -0,0 +1,4 @@
+export declare function generatePairingToken(): string;
+/** Stored hashed, exactly like a session token — a leaked table hands out nothing usable. */
+export declare function hashPairingToken(token: string): string;
+//# sourceMappingURL=tokens.d.ts.map

package/dist/enrollment/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/enrollment/tokens.ts"],"names":[],"mappings":"AAcA,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,6FAA6F;AAC7F,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEtD"}

package/dist/enrollment/tokens.js

@@ -0,0 +1,20 @@
+import { createHash, randomBytes } from 'node:crypto';
+/**
+ * 32 random bytes (256 bits), base64url — the same shape as
+ * `@cogenta/auth`'s session tokens (`sessions.ts`'s `TOKEN_BYTES`), not the
+ * shorter 8-character human-typed code `@cogenta/channels`' linking flow
+ * uses (L6 task 2). A pairing token is copy-pasted into a site's own
+ * configuration during enrollment, never hand-typed character by character
+ * into a chat app — there's no reason to shrink its alphabet for
+ * readability, and every bit of entropy here defends a real, if short-lived,
+ * bearer credential: whoever presents it gets to register a site.
+ */
+const TOKEN_BYTES = 32;
+export function generatePairingToken() {
+    return randomBytes(TOKEN_BYTES).toString('base64url');
+}
+/** Stored hashed, exactly like a session token — a leaked table hands out nothing usable. */
+export function hashPairingToken(token) {
+    return createHash('sha256').update(token).digest('base64url');
+}
+//# sourceMappingURL=tokens.js.map

package/dist/enrollment/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/enrollment/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAErD;;;;;;;;;GASG;AACH,MAAM,WAAW,GAAG,EAAE,CAAA;AAEtB,MAAM,UAAU,oBAAoB;IAClC,OAAO,WAAW,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AACvD,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;AAC/D,CAAC"}