@nio-cli/cli 0.3.6 → 0.4.0

package/.env.example

@@ -1,14 +1,73 @@
-# Database connection string 
-NIO_DATABASE_URL=postgres://user:senha@localhost:5432/nio_cli
+# Database connection string
+# CLI/MCP: role `nio_cli` (migration 0008) — SELECT em user_cli/auth_sessions,
+# escreve só em sessions/dependency_events/log_session/session_activity.
+NIO_DATABASE_URL=postgres://nio_cli_user:senha@localhost:5432/nio_cli
 
-# TLS — descomente e ponha "true" só se o banco exigir (gerenciado/nuvem).
+# Gateway: role `nio_gateway` — escreve em user_cli/auth_sessions/login_challenges/
+# auth_events/login_ip_events. Só o processo nio-gateway lê esta var; se ausente,
+# ele cai em NIO_DATABASE_URL (dev com um único role).
+# NIO_GATEWAY_DATABASE_URL=postgres://nio_gw_user:senha@localhost:5432/nio_cli
+
+# TLS — descomente e ponha "true" quando o banco tiver TLS (não use com Postgres
+# local sem SSL). Quando ligado, o certificado do servidor É VERIFICADO.
 # NIO_DATABASE_SSL=true
+# NIO_DATABASE_CA=/etc/ssl/nio/db-ca.pem
+# Último recurso — desliga a verificação de cert (expõe a MITM). Prefira NIO_DATABASE_CA:
+# NIO_DATABASE_SSL_INSECURE=1
 
 # Gateway — JWT (login v2). Sem prefixo NIO_ de propósito: segredo da equipe,
-# mesmo valor em toda máquina que roda o nio-gateway. Também é a chave do HMAC do OTP.
+# mesmo valor em toda máquina que roda o nio-gateway.
+# Mínimo 32 caracteres aleatórios. Gere com: `nio config setup` ou
+#   node -e "console.log(require('crypto').randomBytes(32).toString('base64url'))"
 JWT_SECRET=
 # JWT_EXPIRES_IN=12h
 
+# ── Endurecimento de cripto (ADR 0011) — tudo opcional, defaults = comportamento atual ──
+#
+# Pepper de senha: segredo de servidor combinado à senha antes do argon2. Um dump
+# do banco SEM ele não dá pra brute-forçar offline. MESMO valor em todo nó do
+# gateway. PERDER = reset de senha forçado dos usuários peppered — FAÇA BACKUP.
+# Formato: id:segredo[,id:segredo] — o de maior id é o atual (rotação: adiciona o
+# novo, o re-hash on login migra, depois remove o velho). Gere: openssl rand -base64 32
+# NIO_PEPPERS=1:troque-por-um-segredo-forte-de-32-ou-mais-chars
+#
+# Chave do HMAC do OTP — separa do JWT_SECRET. Default = JWT_SECRET.
+# OTP_HMAC_SECRET=
+#
+# Rotação de JWT sem derrubar sessão: JWT_SECRETS = kid:segredo[,kid:segredo].
+# A ÚLTIMA entrada assina os tokens novos; QUALQUER uma verifica. Token antigo
+# (sem kid) verifica contra JWT_SECRET. Fluxo: adiciona o kid novo no fim →
+# deploy → espera 12h (TTL do JWT) → remove o kid velho. Ausente = usa JWT_SECRET.
+# JWT_SECRETS=2026a:segredo-antigo-de-32+-chars,2026b:segredo-novo-de-32+-chars
+#
+# Params do argon2id — defaults = piso OWASP. Calibre na máquina do gateway com
+#   node scripts/argon2-calibrate.mjs        (ou `bun run argon2:calibrate`)
+# mire ~250-500 ms no hash. Subir só re-hasheia no próximo login (não é breaking).
+# NIO_ARGON2_MEMORY_MIB=19
+# NIO_ARGON2_TIME=2
+# NIO_ARGON2_PARALLELISM=1
+#
+# Auditoria de IP de login (ADR 0011 §F) — o gateway registra de quais IPs cada
+# usuário loga (visível em `nio security status`; retenção 90 d). SÓ registro,
+# não bloqueia. Ligue NIO_TRUST_PROXY=1 pra usar o X-Forwarded-For **apenas** se
+# o Kong for a ÚNICA entrada do gateway (senão o IP é forjável).
+# NIO_TRUST_PROXY=1
+
+# Trilha de auth persistente (ADR 0012) — `auth_events` guarda todo evento de auth
+# (login OK/falho, 2FA, mudanças de 2FA, logout). Retenção default 180 d.
+# NIO_AUTH_EVENTS_RETENTION_DAYS=180
+# No modo HOST (sem container), o stdout/stderr do gateway — incl. a trilha —
+# vai pra ~/.nio/gateway.log (chmod 600).
+#
+# Teto de sessões (dispositivos) ativas por usuário (SP-5). Login além disso
+# revoga as mais antigas. `nio logout --all` encerra todas de uma vez.
+# NIO_MAX_SESSIONS_PER_USER=5
+#
+# Checagem de senha vazada (SP-7): lista local (sempre) + Have I Been Pwned
+# (k-anonymity — só o prefixo do SHA-1 sai; falha de rede = ignora).
+# NIO_HIBP_DISABLE=1        # desliga o HIBP (ambiente sem saída pra internet)
+# NIO_HIBP_TIMEOUT_MS=1500
+
 # Bind do nio-gateway. Default 127.0.0.1 (loopback). Ponha 0.0.0.0 quando o Kong
 # roda em container e alcança o gateway via host.docker.internal.
 # NIO_GATEWAY_HOST=0.0.0.0
@@ -24,12 +83,16 @@ JWT_SECRET=
 # SMS_AUTH_HEADER=X-API-TOKEN: seu-token          # linha "Nome: valor"
 # SMS_BODY_TEMPLATE={"to":"{to}","message":"{text}"}   # JSON com {to}/{text}/{from}
 # SMS_FROM=NIO                                     # opcional, se o template usar {from}
+#
+# DEV: se SMS_ENDPOINT_URL for loopback (127.0.0.1/localhost — o mock
+# `bun run dev:sms-echo`), o gateway entra em "modo echo": NENHUM SMS real sai.
+# A CLI avisa e mostra o código direto; `nio security status` mostra o backend.
 
 # Client de IA (nio ai) — Headroom, proxy de compressão em container (ADR 0007).
 # NIO_HEADROOM_PORT=8787                                  # porta do proxy no host
 # NIO_HEADROOM_URL=http://127.0.0.1:8787/v1               # override total (o provider do OpenCode aponta pra cá)
 # NIO_HEADROOM_OPENAI_TARGET=https://opencode.ai/zen/v1   # upstream OpenAI-compatível (default: OpenCode Zen)
 
-# Debug / UI
+# Debug 
 # NIO_DEBUG=1      # log verboso [nio:debug] + stack trace completo nos erros
 # NIO_NO_ANIM=1    # logo Matrix sempre estático (sem a animação de chuva)

package/Dockerfile.gateway

@@ -1,12 +1,20 @@
-FROM node:20-slim
-# curl p/ o healthcheck do compose
+# Build reprodutível (auditoria M-2 + I-3a): um lockfile só (`bun.lock`), imagens
+# pinadas por digest. Multi-stage — o Bun resolve as deps com o lockfile
+# congelado; o runtime continua sendo Node (o alvo do projeto).
+
+# --- deps: instala node_modules de runtime a partir do bun.lock ---
+FROM oven/bun:1-slim@sha256:cb3bbbb08e13a4a2ff400f24c7a2a1d5efa83f6ef8544d52d95a519631e2fc61 AS deps
+WORKDIR /app
+COPY package.json bun.lock ./
+RUN bun install --frozen-lockfile --production
+
+# --- runtime: Node + curl (healthcheck do compose) ---
+FROM node:20-slim@sha256:2cf067cfed83d5ea958367df9f966191a942351a2df77d6f0193e162b5febfc0
 RUN apt-get update && apt-get install -y --no-install-recommends curl \
     && rm -rf /var/lib/apt/lists/*
 WORKDIR /app
-# dist já buildado (tsc) + manifesto; instala só deps de runtime.
-# npm install (não 'ci') porque o repo usa bun.lock, sem package-lock.json.
+COPY --from=deps /app/node_modules ./node_modules
 COPY package.json ./
 COPY dist ./dist
-RUN npm install --omit=dev --no-audit --no-fund
 EXPOSE 3000
 CMD ["node", "dist/gateway/index.js"]

package/dist/adapters/lang/vendor.js

@@ -3,6 +3,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import AdmZip from 'adm-zip';
 import { homePath } from '../../brand.js';
+import { codeloadZipUrl, fetchZipball, rejectSymlinks } from '../../lib/fetch-zipball.js';
 import { LANG_REPOS } from './repos.js';
 const DEFAULT_TIMEOUT_MS = 30_000;
 async function downloadRepo(spec, baseDir, opts) {
@@ -11,32 +12,26 @@ async function downloadRepo(spec, baseDir, opts) {
     if (!opts.force && existsSync(dest)) {
         return { ...base, status: 'cached' };
     }
-    const url = `https://codeload.github.com/${spec.repo}/zip/refs/heads/${spec.ref}`;
+    const url = codeloadZipUrl(spec.repo, spec.ref);
     const staging = join(tmpdir(), `nio-lang-${spec.dir}-${process.pid}-${Date.now()}`);
     const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-    const ac = new AbortController();
-    const timer = setTimeout(() => ac.abort(), timeoutMs);
     try {
-        const res = await fetch(url, { signal: ac.signal });
-        if (!res.ok)
-            throw new Error(`HTTP ${res.status} ao baixar ${url}`);
-        const buf = Buffer.from(await res.arrayBuffer());
+        const buf = await fetchZipball(url, { timeoutMs });
         rmSync(staging, { recursive: true, force: true });
         mkdirSync(staging, { recursive: true });
         new AdmZip(buf).extractAllTo(staging, true);
         const dirs = readdirSync(staging, { withFileTypes: true }).filter((e) => e.isDirectory());
         const root = dirs.length === 1 ? join(staging, dirs[0].name) : staging;
+        rejectSymlinks(root);
         rmSync(dest, { recursive: true, force: true });
         mkdirSync(dest, { recursive: true });
         cpSync(root, dest, { recursive: true });
         return { ...base, status: 'fetched' };
     }
     catch (err) {
-        const msg = ac.signal.aborted ? `timeout após ${timeoutMs}ms` : err.message;
-        return { ...base, status: existsSync(dest) ? 'cached' : 'failed', error: msg };
+        return { ...base, status: existsSync(dest) ? 'cached' : 'failed', error: err.message };
     }
     finally {
-        clearTimeout(timer);
         rmSync(staging, { recursive: true, force: true });
     }
 }

package/dist/adapters/lang/vendor.js.map

@@ -1 +1 @@
-{"version":3,"file":"vendor.js","sourceRoot":"","sources":["../../../src/adapters/lang/vendor.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,SAAS,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAiB,MAAM,YAAY,CAAC;AAEvD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAWlC,KAAK,UAAU,YAAY,CACzB,IAAc,EACd,OAAe,EACf,IAA6C;IAE7C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;IAE/D,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,GAAG,GAAG,+BAA+B,IAAI,CAAC,IAAI,mBAAmB,IAAI,CAAC,GAAG,EAAE,CAAC;IAClF,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,YAAY,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACpF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QAGjD,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1F,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAEvE,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAExC,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,SAAS,IAAI,CAAC,CAAC,CAAE,GAAa,CAAC,OAAO,CAAC;QACvF,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IACjF,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAMD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAA8D,EAAE;IAEhE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7C,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"vendor.js","sourceRoot":"","sources":["../../../src/adapters/lang/vendor.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,SAAS,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC1F,OAAO,EAAE,UAAU,EAAiB,MAAM,YAAY,CAAC;AAEvD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAWlC,KAAK,UAAU,YAAY,CACzB,IAAc,EACd,OAAe,EACf,IAA6C;IAE7C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;IAE/D,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,YAAY,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACpF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAGnD,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1F,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACvE,cAAc,CAAC,IAAI,CAAC,CAAC;QAErB,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAExC,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC;IACpG,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAMD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAA8D,EAAE;IAEhE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7C,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/adapters/pg/auth-event-repository.js

@@ -0,0 +1,30 @@
+import { query } from './client.js';
+const NAME_MAX = 128;
+const FAILURE_EVENTS = ['password_fail', '2fa_fail', '2fa_expired'];
+export function createAuthEventRepository() {
+    return {
+        async record(input) {
+            await query(`INSERT INTO auth_events (event, name, user_id, ip, trace_id, detail)
+         VALUES ($1, $2, $3, $4, $5, $6)`, [
+                input.event,
+                input.name ? input.name.slice(0, NAME_MAX) : null,
+                input.userId ?? null,
+                input.ip ?? null,
+                input.traceId ?? null,
+                input.detail ? JSON.stringify(input.detail) : null,
+            ]);
+        },
+        async recentFailures({ userId, name, limit = 5 }) {
+            const res = await query(`SELECT at, event, host(ip) AS ip FROM auth_events
+         WHERE event = ANY($1)
+           AND ( ($2::bigint IS NOT NULL AND user_id = $2) OR ($3::text IS NOT NULL AND name = $3) )
+         ORDER BY at DESC LIMIT $4`, [FAILURE_EVENTS, userId ?? null, name ?? null, limit]);
+            return res.rows.map((r) => ({ at: r.at, event: r.event, ip: r.ip }));
+        },
+        async pruneOlderThan(days) {
+            const res = await query(`DELETE FROM auth_events WHERE at < NOW() - ($1 || ' days')::interval`, [days]);
+            return res.rowCount ?? 0;
+        },
+    };
+}
+//# sourceMappingURL=auth-event-repository.js.map

package/dist/adapters/pg/auth-event-repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-event-repository.js","sourceRoot":"","sources":["../../../src/adapters/pg/auth-event-repository.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAGpC,MAAM,QAAQ,GAAG,GAAG,CAAC;AAGrB,MAAM,cAAc,GAAG,CAAC,eAAe,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;AAEpE,MAAM,UAAU,yBAAyB;IACvC,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,KAAqB;YAChC,MAAM,KAAK,CACT;yCACiC,EACjC;gBACE,KAAK,CAAC,KAAK;gBACX,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;gBACjD,KAAK,CAAC,MAAM,IAAI,IAAI;gBACpB,KAAK,CAAC,EAAE,IAAI,IAAI;gBAChB,KAAK,CAAC,OAAO,IAAI,IAAI;gBACrB,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;aACnD,CACF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE;YAE9C,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB;;;mCAG2B,EAC3B,CAAC,cAAc,EAAE,MAAM,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,KAAK,CAAC,CACtD,CAAC;YACF,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACpF,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,IAAI;YACvB,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,sEAAsE,EACtE,CAAC,IAAI,CAAC,CACP,CAAC;YACF,OAAO,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/adapters/pg/client.js

@@ -1,3 +1,4 @@
+import { readFileSync } from 'node:fs';
 import { Pool } from 'pg';
 function readDatabaseUrl() {
     const url = process.env.NIO_DATABASE_URL?.trim();
@@ -10,11 +11,28 @@ function readDatabaseUrl() {
     }
     return url;
 }
-function readSslOption() {
-    const flag = process.env.NIO_DATABASE_SSL?.trim().toLowerCase();
-    if (flag === 'true' || flag === '1')
+function envFlag(name) {
+    const v = process.env[name]?.trim().toLowerCase();
+    return v === 'true' || v === '1';
+}
+export function readSslOption() {
+    if (!envFlag('NIO_DATABASE_SSL'))
+        return undefined;
+    if (envFlag('NIO_DATABASE_SSL_INSECURE')) {
+        console.error('[pg] AVISO: NIO_DATABASE_SSL_INSECURE=1 — TLS sem verificação de certificado. ' +
+            'A conexão com o banco fica vulnerável a MITM. Use NIO_DATABASE_CA em vez disso.');
         return { rejectUnauthorized: false };
-    return undefined;
+    }
+    const caPath = process.env.NIO_DATABASE_CA?.trim();
+    if (caPath) {
+        try {
+            return { rejectUnauthorized: true, ca: readFileSync(caPath, 'utf8') };
+        }
+        catch (err) {
+            throw new Error(`NIO_DATABASE_CA não pôde ser lido ("${caPath}"): ${err.message}`);
+        }
+    }
+    return { rejectUnauthorized: true };
 }
 let pool = null;
 export function getPool() {

package/dist/adapters/pg/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/adapters/pg/client.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,IAAI,EAA0D,MAAM,IAAI,CAAC;AAGlF,SAAS,eAAe;IACtB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC;IACjD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,uEAAuE;YACrE,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,gEAAgE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CACtF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAGD,SAAS,aAAa;IACpB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChE,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC;IAC1E,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,IAAI,IAAI,GAAgB,IAAI,CAAC;AAM7B,MAAM,UAAU,OAAO;IACrB,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAEtB,IAAI,GAAG,IAAI,IAAI,CAAC;QACd,gBAAgB,EAAE,eAAe,EAAE;QACnC,GAAG,EAAE,aAAa,EAAE;QACpB,GAAG,EAAE,EAAE;QACP,iBAAiB,EAAE,MAAM;QACzB,uBAAuB,EAAE,MAAM;KAChC,CAAC,CAAC;IAIH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QACvB,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAMD,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,IAAY,EACZ,MAA2B;IAE3B,OAAO,OAAO,EAAE,CAAC,KAAK,CAAI,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,OAAO,GAAG,iEAAiE,CAAC;AAMlF,MAAM,UAAU,MAAM,CAAC,CAAS;IAC9B,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACzB,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAI,EAAsC;IAC7E,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC/C,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,IAAI;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAiB,gBAAgB,CAAC,CAAC;QAC1D,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAGD,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,MAAM,CAAC,GAAG,IAAI,CAAC;IACf,IAAI,GAAG,IAAI,CAAC;IACZ,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC;AAChB,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/adapters/pg/client.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAA0D,MAAM,IAAI,CAAC;AAGlF,SAAS,eAAe;IACtB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC;IACjD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,uEAAuE;YACrE,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,gEAAgE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CACtF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAGD,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClD,OAAO,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,CAAC;AACnC,CAAC;AAYD,MAAM,UAAU,aAAa;IAC3B,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;QAAE,OAAO,SAAS,CAAC;IAEnD,IAAI,OAAO,CAAC,2BAA2B,CAAC,EAAE,CAAC;QACzC,OAAO,CAAC,KAAK,CACX,gFAAgF;YAC9E,iFAAiF,CACpF,CAAC;QACF,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IACnD,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,EAAE,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;QACxE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,uCAAuC,MAAM,OAAQ,GAAa,CAAC,OAAO,EAAE,CAC7E,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;AACtC,CAAC;AAED,IAAI,IAAI,GAAgB,IAAI,CAAC;AAM7B,MAAM,UAAU,OAAO;IACrB,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAEtB,IAAI,GAAG,IAAI,IAAI,CAAC;QACd,gBAAgB,EAAE,eAAe,EAAE;QACnC,GAAG,EAAE,aAAa,EAAE;QACpB,GAAG,EAAE,EAAE;QACP,iBAAiB,EAAE,MAAM;QACzB,uBAAuB,EAAE,MAAM;KAChC,CAAC,CAAC;IAIH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QACvB,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAMD,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,IAAY,EACZ,MAA2B;IAE3B,OAAO,OAAO,EAAE,CAAC,KAAK,CAAI,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,OAAO,GAAG,iEAAiE,CAAC;AAMlF,MAAM,UAAU,MAAM,CAAC,CAAS;IAC9B,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACzB,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAI,EAAsC;IAC7E,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC/C,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,IAAI;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAiB,gBAAgB,CAAC,CAAC;QAC1D,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAGD,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,MAAM,CAAC,GAAG,IAAI,CAAC;IACf,IAAI,GAAG,IAAI,CAAC;IACZ,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC;AAChB,CAAC"}

package/dist/adapters/pg/login-ip-repository.js

@@ -0,0 +1,26 @@
+import { query } from './client.js';
+const map = (r) => ({
+    ip: r.ip,
+    firstSeen: r.first_seen,
+    lastSeen: r.last_seen,
+    count: Number(r.count),
+});
+export function createLoginIpRepository() {
+    return {
+        async record(userId, ip) {
+            await query(`INSERT INTO login_ip_events (user_id, ip) VALUES ($1, $2)
+         ON CONFLICT (user_id, ip)
+         DO UPDATE SET last_seen = NOW(), count = login_ip_events.count + 1`, [userId, ip]);
+        },
+        async recent(userId, limit = 10) {
+            const res = await query(`SELECT host(ip) AS ip, first_seen, last_seen, count FROM login_ip_events
+         WHERE user_id = $1 ORDER BY last_seen DESC LIMIT $2`, [userId, limit]);
+            return res.rows.map(map);
+        },
+        async pruneOlderThan(days) {
+            const res = await query(`DELETE FROM login_ip_events WHERE last_seen < NOW() - ($1 || ' days')::interval`, [days]);
+            return res.rowCount ?? 0;
+        },
+    };
+}
+//# sourceMappingURL=login-ip-repository.js.map

package/dist/adapters/pg/login-ip-repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-ip-repository.js","sourceRoot":"","sources":["../../../src/adapters/pg/login-ip-repository.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AASpC,MAAM,GAAG,GAAG,CAAC,CAAM,EAAgB,EAAE,CAAC,CAAC;IACrC,EAAE,EAAE,CAAC,CAAC,EAAE;IACR,SAAS,EAAE,CAAC,CAAC,UAAU;IACvB,QAAQ,EAAE,CAAC,CAAC,SAAS;IACrB,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;CACvB,CAAC,CAAC;AAEH,MAAM,UAAU,uBAAuB;IACrC,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE;YACrB,MAAM,KAAK,CACT;;4EAEoE,EACpE,CAAC,MAAM,EAAE,EAAE,CAAC,CACb,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,GAAG,EAAE;YAC7B,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB;6DACqD,EACrD,CAAC,MAAM,EAAE,KAAK,CAAC,CAChB,CAAC;YACF,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,IAAI;YACvB,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,iFAAiF,EACjF,CAAC,IAAI,CAAC,CACP,CAAC;YACF,OAAO,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/adapters/pg/user-repository.js

@@ -1,5 +1,10 @@
-import { hashPassword, verifyPassword } from '../../lib/auth/password.js';
+import { randomBytes } from 'node:crypto';
+import { hashPassword, needsRehash, verifyPassword, MIN_PASSWORD_LENGTH } from '../../lib/auth/password.js';
 import { query } from './client.js';
+let decoyHashPromise = null;
+function decoyHash() {
+    return (decoyHashPromise ??= hashPassword(`decoy-${randomBytes(16).toString('hex')}`).then((h) => h.phc));
+}
 function parseIps(raw) {
     if (!raw)
         return [];
@@ -23,48 +28,72 @@ export function mapUserRow(row) {
         timestampLastSession: row.timestamp_last_session,
     };
 }
-const COLS = 'id, name, password, timestamp_creation, timestamp_password_change, ' +
-    'auth_2, phone, backup_codes, timestamp_last_session, ips_using';
+const PUBLIC_COLS = 'id, name, password_pepper_id, timestamp_creation, timestamp_password_change, ' +
+    'auth_2, phone, backup_pepper_id, timestamp_last_session, ips_using';
+const FULL_COLS = `${PUBLIC_COLS}, password, backup_codes`;
 export function createUserRepository() {
     return {
         async findByName(name) {
-            const res = await query(`SELECT ${COLS} FROM user_cli WHERE name = $1`, [name]);
+            const res = await query(`SELECT ${PUBLIC_COLS} FROM user_cli WHERE name = $1`, [name]);
             const row = res.rows[0];
             return row ? mapUserRow(row) : null;
         },
         async findById(id) {
-            const res = await query(`SELECT ${COLS} FROM user_cli WHERE id = $1`, [id]);
+            const res = await query(`SELECT ${PUBLIC_COLS} FROM user_cli WHERE id = $1`, [id]);
             const row = res.rows[0];
             return row ? mapUserRow(row) : null;
         },
         async create(input) {
-            const passwordHash = await hashPassword(input.password);
-            const res = await query(`INSERT INTO user_cli (name, password) VALUES ($1, $2) RETURNING ${COLS}`, [input.name, passwordHash]);
+            if (input.password.length < MIN_PASSWORD_LENGTH) {
+                throw new Error(`Senha muito curta (mínimo ${MIN_PASSWORD_LENGTH} caracteres).`);
+            }
+            const { phc, pepperId } = await hashPassword(input.password);
+            const res = await query(`INSERT INTO user_cli (name, password, password_pepper_id) VALUES ($1, $2, $3) RETURNING ${PUBLIC_COLS}`, [input.name, phc, pepperId]);
             return mapUserRow(res.rows[0]);
         },
         async verifyCredentials(name, password) {
-            const res = await query(`SELECT ${COLS} FROM user_cli WHERE name = $1`, [name]);
+            const res = await query(`SELECT ${FULL_COLS} FROM user_cli WHERE name = $1`, [name]);
             const row = res.rows[0];
-            if (!row)
+            if (!row) {
+                await verifyPassword(await decoyHash(), password, 0);
+                return null;
+            }
+            const ok = await verifyPassword(row.password, password, row.password_pepper_id);
+            if (!ok)
                 return null;
-            const ok = await verifyPassword(row.password, password);
-            return ok ? mapUserRow(row) : null;
+            if (needsRehash(row.password, row.password_pepper_id)) {
+                try {
+                    const fresh = await hashPassword(password);
+                    await query('UPDATE user_cli SET password = $2, password_pepper_id = $3, timestamp_password_change = NOW() WHERE id = $1', [Number(row.id), fresh.phc, fresh.pepperId]);
+                }
+                catch {
+                }
+            }
+            return mapUserRow(row);
         },
         async touchLastSession(userId) {
             await query('UPDATE user_cli SET timestamp_last_session = NOW() WHERE id = $1', [userId]);
         },
-        async enable2fa(userId, phone, backupCodeHashes) {
-            await query('UPDATE user_cli SET auth_2 = TRUE, phone = $2, backup_codes = $3 WHERE id = $1', [userId, phone, backupCodeHashes]);
+        async updatePasswordHash(userId, phc, pepperId) {
+            await query('UPDATE user_cli SET password = $2, password_pepper_id = $3, timestamp_password_change = NOW() WHERE id = $1', [userId, phc, pepperId]);
+        },
+        async enable2fa(userId, phone, backupCodeHashes, backupPepperId) {
+            await query('UPDATE user_cli SET auth_2 = TRUE, phone = $2, backup_codes = $3, backup_pepper_id = $4 WHERE id = $1', [userId, phone, backupCodeHashes, backupPepperId]);
         },
         async disable2fa(userId) {
-            await query('UPDATE user_cli SET auth_2 = FALSE, phone = NULL, backup_codes = NULL WHERE id = $1', [userId]);
+            await query('UPDATE user_cli SET auth_2 = FALSE, phone = NULL, backup_codes = NULL, backup_pepper_id = 0 WHERE id = $1', [userId]);
         },
-        async updateBackupCodes(userId, joined) {
-            await query('UPDATE user_cli SET backup_codes = $2 WHERE id = $1', [userId, joined]);
+        async updateBackupCodes(userId, joined, pepperId) {
+            await query('UPDATE user_cli SET backup_codes = $2, backup_pepper_id = $3 WHERE id = $1', [
+                userId,
+                joined,
+                pepperId,
+            ]);
         },
         async getBackupCodes(userId) {
-            const res = await query('SELECT backup_codes FROM user_cli WHERE id = $1', [userId]);
-            return res.rows[0]?.backup_codes ?? null;
+            const res = await query('SELECT backup_codes, backup_pepper_id FROM user_cli WHERE id = $1', [userId]);
+            const row = res.rows[0];
+            return { codes: row?.backup_codes ?? null, pepperId: row?.backup_pepper_id ?? 0 };
         },
     };
 }

package/dist/adapters/pg/user-repository.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-repository.js","sourceRoot":"","sources":["../../../src/adapters/pg/user-repository.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAiBpC,SAAS,QAAQ,CAAC,GAAkB;IAClC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAGD,MAAM,UAAU,UAAU,CAAC,GAAY;IACrC,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAClB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,KAAK,EAAE,GAAG,CAAC,MAAM;QACjB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;QACjC,iBAAiB,EAAE,GAAG,CAAC,kBAAkB;QACzC,uBAAuB,EAAE,GAAG,CAAC,yBAAyB;QACtD,oBAAoB,EAAE,GAAG,CAAC,sBAAsB;KACjD,CAAC;AACJ,CAAC;AAED,MAAM,IAAI,GACR,qEAAqE;IACrE,gEAAgE,CAAC;AAEnE,MAAM,UAAU,oBAAoB;IAClC,OAAO;QACL,KAAK,CAAC,UAAU,CAAC,IAAI;YACnB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAU,UAAU,IAAI,gCAAgC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;YACzF,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxB,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtC,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,EAAE;YACf,MAAM,GAAG,GAAG,MAAM,KAAK,CAAU,UAAU,IAAI,8BAA8B,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YACrF,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxB,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtC,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,KAAmB;YAC9B,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACxD,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,mEAAmE,IAAI,EAAE,EACzE,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,CAAC,CAC3B,CAAC;YACF,OAAO,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;QAClC,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ;YACpC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAU,UAAU,IAAI,gCAAgC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;YACzF,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACxD,OAAO,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACrC,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,MAAM;YAC3B,MAAM,KAAK,CAAC,kEAAkE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5F,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,gBAAgB;YAC7C,MAAM,KAAK,CACT,gFAAgF,EAChF,CAAC,MAAM,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAClC,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,MAAM;YACrB,MAAM,KAAK,CACT,qFAAqF,EACrF,CAAC,MAAM,CAAC,CACT,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM;YACpC,MAAM,KAAK,CAAC,qDAAqD,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACvF,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,MAAM;YACzB,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,iDAAiD,EACjD,CAAC,MAAM,CAAC,CACT,CAAC;YACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,IAAI,IAAI,CAAC;QAC3C,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"user-repository.js","sourceRoot":"","sources":["../../../src/adapters/pg/user-repository.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAC5G,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAOpC,IAAI,gBAAgB,GAA2B,IAAI,CAAC;AACpD,SAAS,SAAS;IAChB,OAAO,CAAC,gBAAgB,KAAK,YAAY,CAAC,SAAS,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAC5G,CAAC;AAuBD,SAAS,QAAQ,CAAC,GAAkB;IAClC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAGD,MAAM,UAAU,UAAU,CAAC,GAAY;IACrC,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAClB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,KAAK,EAAE,GAAG,CAAC,MAAM;QACjB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;QACjC,iBAAiB,EAAE,GAAG,CAAC,kBAAkB;QACzC,uBAAuB,EAAE,GAAG,CAAC,yBAAyB;QACtD,oBAAoB,EAAE,GAAG,CAAC,sBAAsB;KACjD,CAAC;AACJ,CAAC;AAGD,MAAM,WAAW,GACf,+EAA+E;IAC/E,oEAAoE,CAAC;AAEvE,MAAM,SAAS,GAAG,GAAG,WAAW,0BAA0B,CAAC;AAE3D,MAAM,UAAU,oBAAoB;IAClC,OAAO;QACL,KAAK,CAAC,UAAU,CAAC,IAAI;YACnB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAU,UAAU,WAAW,gCAAgC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;YAChG,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxB,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtC,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,EAAE;YACf,MAAM,GAAG,GAAG,MAAM,KAAK,CAAU,UAAU,WAAW,8BAA8B,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5F,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxB,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtC,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,KAAmB;YAE9B,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;gBAChD,MAAM,IAAI,KAAK,CAAC,6BAA6B,mBAAmB,eAAe,CAAC,CAAC;YACnF,CAAC;YACD,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC7D,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,2FAA2F,WAAW,EAAE,EACxG,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,CAC5B,CAAC;YACF,OAAO,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;QAClC,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ;YACpC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAc,UAAU,SAAS,gCAAgC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;YAClG,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,cAAc,CAAC,MAAM,SAAS,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;gBACrD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,kBAAkB,CAAC,CAAC;YAChF,IAAI,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YAGrB,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACtD,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;oBAC3C,MAAM,KAAK,CACT,6GAA6G,EAC7G,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,CAC5C,CAAC;gBACJ,CAAC;gBAAC,MAAM,CAAC;gBAET,CAAC;YACH,CAAC;YACD,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,MAAM;YAC3B,MAAM,KAAK,CAAC,kEAAkE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5F,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ;YAC5C,MAAM,KAAK,CACT,6GAA6G,EAC7G,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,CACxB,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc;YAC7D,MAAM,KAAK,CACT,uGAAuG,EACvG,CAAC,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAClD,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,MAAM;YACrB,MAAM,KAAK,CACT,2GAA2G,EAC3G,CAAC,MAAM,CAAC,CACT,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ;YAC9C,MAAM,KAAK,CAAC,4EAA4E,EAAE;gBACxF,MAAM;gBACN,MAAM;gBACN,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,MAAM;YACzB,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,mEAAmE,EACnE,CAAC,MAAM,CAAC,CACT,CAAC;YACF,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,YAAY,IAAI,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,gBAAgB,IAAI,CAAC,EAAE,CAAC;QACpF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/adapters/sms/http-generic.js

@@ -21,6 +21,27 @@ function readEnv() {
         from: process.env.SMS_FROM?.trim(),
     };
 }
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '::1', '[::1]', '0.0.0.0']);
+export function smsMode(env = readEnv()) {
+    if (!env.url || !env.bodyTemplate)
+        return 'unconfigured';
+    try {
+        return LOOPBACK_HOSTS.has(new URL(env.url).hostname) ? 'echo' : 'provider';
+    }
+    catch {
+        return 'provider';
+    }
+}
+export function smsProviderHost(env = readEnv()) {
+    if (!env.url)
+        return null;
+    try {
+        return new URL(env.url).hostname;
+    }
+    catch {
+        return null;
+    }
+}
 export function createHttpSmsSender(env = readEnv()) {
     return {
         async send(to, text) {

package/dist/adapters/sms/http-generic.js.map

@@ -1 +1 @@
-{"version":3,"file":"http-generic.js","sourceRoot":"","sources":["../../../src/adapters/sms/http-generic.ts"],"names":[],"mappings":"AAOA,MAAM,UAAU,eAAe,CAAC,IAAwB;IACtD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACrB,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AACjE,CAAC;AAGD,MAAM,UAAU,UAAU,CACxB,QAAgB,EAChB,IAAiD;IAEjD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1D,OAAO,QAAQ;SACZ,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;SAChC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SACpC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;AAChD,CAAC;AASD,SAAS,OAAO;IACd,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE;QACzC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE;QAC/C,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE;QACnD,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE;KACnC,CAAC;AACJ,CAAC;AAGD,MAAM,UAAU,mBAAmB,CAAC,MAAc,OAAO,EAAE;IACzD,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,EAAU,EAAE,IAAY;YACjC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;gBAClC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,uDAAuD,EAAE,CAAC;YAC/F,CAAC;YACD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YACxE,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;oBAC/B,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE;oBACnF,IAAI;oBACJ,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;iBACpC,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;oBACZ,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;oBAChE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,sBAAsB,GAAG,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC1F,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YAC5B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC;YAC7D,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"http-generic.js","sourceRoot":"","sources":["../../../src/adapters/sms/http-generic.ts"],"names":[],"mappings":"AAOA,MAAM,UAAU,eAAe,CAAC,IAAwB;IACtD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACrB,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AACjE,CAAC;AAGD,MAAM,UAAU,UAAU,CACxB,QAAgB,EAChB,IAAiD;IAEjD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1D,OAAO,QAAQ;SACZ,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;SAChC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SACpC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;AAChD,CAAC;AASD,SAAS,OAAO;IACd,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE;QACzC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE;QAC/C,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE;QACnD,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE;KACnC,CAAC;AACJ,CAAC;AASD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AAGtF,MAAM,UAAU,OAAO,CAAC,MAAc,OAAO,EAAE;IAC7C,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY;QAAE,OAAO,cAAc,CAAC;IACzD,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,CAAC;IACpB,CAAC;AACH,CAAC;AAGD,MAAM,UAAU,eAAe,CAAC,MAAc,OAAO,EAAE;IACrD,IAAI,CAAC,GAAG,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAGD,MAAM,UAAU,mBAAmB,CAAC,MAAc,OAAO,EAAE;IACzD,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,EAAU,EAAE,IAAY;YACjC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;gBAClC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,uDAAuD,EAAE,CAAC;YAC/F,CAAC;YACD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YACxE,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;oBAC/B,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE;oBACnF,IAAI;oBACJ,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;iBACpC,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;oBACZ,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;oBAChE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,sBAAsB,GAAG,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC1F,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YAC5B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC;YAC7D,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/brand.js

@@ -15,7 +15,7 @@ export const brand = {
     envPrefix: 'NIO',
     patPrefix: 'nio_',
     skillsRepo: 'hugoreiis12-png/NIO-SKILLS-',
-    skillsRef: 'main',
+    skillsRef: '11980256cff5c261740e0abd0c549da9b1da3d95',
     skillsPackage: '@nio-cli/skills',
     toolPrefix: 'nos_',
     cliToolPrefix: 'nio_',

package/dist/brand.js.map

@@ -1 +1 @@
-{"version":3,"file":"brand.js","sourceRoot":"","sources":["../src/brand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAYjC,MAAM,CAAC,MAAM,KAAK,GAAG;IAGnB,IAAI,EAAE,KAAK;IAEX,WAAW,EAAE,KAAK;IAElB,eAAe,EAAE,KAAK;IAGtB,SAAS,EAAE,iBAAiB;IAE5B,UAAU,EAAE,UAAU;IAEtB,WAAW,EAAE,cAAc;IAE3B,UAAU,EAAE,SAAS;IAErB,YAAY,EAAE,KAAK;IAOnB,MAAM,EAAE,EAAE;IAIV,WAAW,EAAE,MAAM;IAEnB,iBAAiB,EAAE,UAAU;IAI7B,SAAS,EAAE,KAAK;IAMhB,SAAS,EAAE,MAAM;IAIjB,UAAU,EAAE,6BAA6B;IACzC,SAAS,EAAE,MAAM;IAEjB,aAAa,EAAE,iBAAiB;IAIhC,UAAU,EAAE,MAAM;IAElB,aAAa,EAAE,MAAM;CACb,CAAC;AASX,MAAM,CAAC,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,eAAe,CAAC,CAAC;AAGvE,MAAM,UAAU,QAAQ,CAAC,GAAG,KAAe;IACzC,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,CAAC;AACtD,CAAC;AAGD,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,OAAO,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;AACtC,CAAC;AAGD,MAAM,UAAU,GAAG,CAAC,IAAY;IAC9B,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AACpC,CAAC"}
+{"version":3,"file":"brand.js","sourceRoot":"","sources":["../src/brand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAYjC,MAAM,CAAC,MAAM,KAAK,GAAG;IAGnB,IAAI,EAAE,KAAK;IAEX,WAAW,EAAE,KAAK;IAElB,eAAe,EAAE,KAAK;IAGtB,SAAS,EAAE,iBAAiB;IAE5B,UAAU,EAAE,UAAU;IAEtB,WAAW,EAAE,cAAc;IAE3B,UAAU,EAAE,SAAS;IAErB,YAAY,EAAE,KAAK;IAOnB,MAAM,EAAE,EAAE;IAIV,WAAW,EAAE,MAAM;IAEnB,iBAAiB,EAAE,UAAU;IAI7B,SAAS,EAAE,KAAK;IAMhB,SAAS,EAAE,MAAM;IAIjB,UAAU,EAAE,6BAA6B;IAWzC,SAAS,EAAE,0CAA0C;IAErD,aAAa,EAAE,iBAAiB;IAIhC,UAAU,EAAE,MAAM;IAElB,aAAa,EAAE,MAAM;CACb,CAAC;AASX,MAAM,CAAC,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,eAAe,CAAC,CAAC;AAGvE,MAAM,UAAU,QAAQ,CAAC,GAAG,KAAe;IACzC,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,CAAC;AACtD,CAAC;AAGD,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,OAAO,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;AACtC,CAAC;AAGD,MAAM,UAAU,GAAG,CAAC,IAAY;IAC9B,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AACpC,CAAC"}

package/dist/cli/commands/auth.js

@@ -3,16 +3,22 @@ import { brand } from "../../brand.js";
 import { animateMatrixLogo } from "../../matrix-logo.js";
 import { startSpinner } from "../../lib/spinner.js";
 import { c, sym } from "../../lib/colors.js";
-import { createUserRepository } from "../../adapters/pg/user-repository.js";
-import { gatewayLogin, gatewayLogout, gatewayVerify2fa, } from "../../lib/auth/gateway-client.js";
+import { MIN_PASSWORD_LENGTH } from "../../lib/auth/password.js";
+import { gatewayLogin, gatewayLogout, gatewayLogoutAll, gatewayRegister, gatewayVerify2fa, } from "../../lib/auth/gateway-client.js";
 import { loadSession, saveSession, clearSession } from "../../lib/auth/session-store.js";
 import { ensureConfig } from "../../lib/auth/nio-config.js";
 import { ensureGatewayRunning } from "../../lib/auth/gateway-process.js";
 import { continueChain } from "../flows/onboarding.js";
 import { box, cmd } from "../../lib/colors.js";
 import { authCopy } from "../copy.js";
-async function resolveSecondFactor(challengeId, phoneHint) {
-    console.log(`  ${c.dim(`código enviado por SMS para ${phoneHint}`)}`);
+async function resolveSecondFactor(challengeId, phoneHint, sms) {
+    if (sms?.smsMode === "echo") {
+        console.log(`  ${c.yellow(sym.warn)} modo echo (dev) — nenhum SMS real foi enviado` +
+            (sms.devCode ? `. Código: ${c.bold(sms.devCode)}` : " (veja ~/.nio/sms-echo-last.json)"));
+    }
+    else {
+        console.log(`  ${c.dim(`código enviado por SMS para ${phoneHint}`)}`);
+    }
     let type = "otp";
     for (let attempt = 0; attempt < 4; attempt++) {
         const code = (await input({
@@ -32,7 +38,6 @@ async function resolveSecondFactor(challengeId, phoneHint) {
     }
     return null;
 }
-const MIN_PASSWORD_LENGTH = 8;
 async function requireGateway() {
     const result = await ensureGatewayRunning();
     if (result.ok)
@@ -60,7 +65,10 @@ export async function runLogin() {
             session = result;
         }
         else {
-            const s = await resolveSecondFactor(result.challengeId, result.phoneHint);
+            const s = await resolveSecondFactor(result.challengeId, result.phoneHint, {
+                smsMode: result.smsMode,
+                devCode: result.devCode,
+            });
             if (!s) {
                 console.error(`${c.red(sym.err)} 2º fator não concluído.`);
                 process.exit(1);
@@ -87,6 +95,7 @@ export async function runLogin() {
 }
 export async function runRegister() {
     await ensureConfig({ interactive: true });
+    await requireGateway();
     const name = await input({
         message: authCopy.register.namePrompt,
         validate: (v) => v.trim().length > 0 || authCopy.register.nameInvalid,
@@ -96,17 +105,11 @@ export async function runRegister() {
         mask: "*",
         validate: (v) => v.length >= MIN_PASSWORD_LENGTH || authCopy.register.passwordInvalid,
     });
-    const repo = createUserRepository();
     const spinner = startSpinner("Criando usuário...");
     try {
-        const existing = await repo.findByName(name.trim());
-        if (existing) {
-            spinner.fail(`Usuário "${name.trim()}" já existe.`);
-            process.exit(1);
-        }
-        const user = await repo.create({ name: name.trim(), password: pass });
+        const user = await gatewayRegister(name.trim(), pass);
         spinner.stop();
-        console.log(`${c.green(sym.ok)} Usuário criado: ${user.name} (id ${user.id})`);
+        console.log(`${c.green(sym.ok)} Usuário criado: ${user.name} (id ${user.userId})`);
     }
     catch (err) {
         spinner.fail(`Falha ao criar usuário: ${err.message}`);
@@ -118,7 +121,7 @@ export async function runRegister() {
 function registerRegisterCommand(program) {
     program
         .command("register")
-        .description("Cria um novo usuário no banco (user_cli) e já entra (login)")
+        .description("Cria um novo usuário via nio-gateway e já entra (login)")
         .action(async () => {
         await runRegister();
         await continueChain({ from: "command" });
@@ -137,17 +140,21 @@ function registerLogoutCommand(program) {
     program
         .command("logout")
         .description("Encerra a sessão local e revoga a auth_session no banco")
-        .action(async () => {
+        .option("--all", "Revoga TODAS as sessões do usuário (todos os dispositivos)")
+        .action(async (opts) => {
         const session = await loadSession();
         if (session) {
             try {
-                await gatewayLogout(session.sessionId);
+                if (opts.all)
+                    await gatewayLogoutAll(session.token);
+                else
+                    await gatewayLogout(session.sessionId, session.token);
             }
             catch {
             }
         }
         await clearSession();
-        console.log("Sessão removida.");
+        console.log(opts.all ? "Todas as sessões foram encerradas." : "Sessão removida.");
     });
 }
 function registerWhoamiCommand(program) {