@nio-cli/cli 0.3.7 → 0.6.0

package/dist/adapters/lang/vendor.js

@@ -3,6 +3,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import AdmZip from 'adm-zip';
 import { homePath } from '../../brand.js';
+import { codeloadZipUrl, fetchZipball, rejectSymlinks } from '../../lib/fetch-zipball.js';
 import { LANG_REPOS } from './repos.js';
 const DEFAULT_TIMEOUT_MS = 30_000;
 async function downloadRepo(spec, baseDir, opts) {
@@ -11,32 +12,26 @@ async function downloadRepo(spec, baseDir, opts) {
     if (!opts.force && existsSync(dest)) {
         return { ...base, status: 'cached' };
     }
-    const url = `https://codeload.github.com/${spec.repo}/zip/refs/heads/${spec.ref}`;
+    const url = codeloadZipUrl(spec.repo, spec.ref);
     const staging = join(tmpdir(), `nio-lang-${spec.dir}-${process.pid}-${Date.now()}`);
     const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-    const ac = new AbortController();
-    const timer = setTimeout(() => ac.abort(), timeoutMs);
     try {
-        const res = await fetch(url, { signal: ac.signal });
-        if (!res.ok)
-            throw new Error(`HTTP ${res.status} ao baixar ${url}`);
-        const buf = Buffer.from(await res.arrayBuffer());
+        const buf = await fetchZipball(url, { timeoutMs });
         rmSync(staging, { recursive: true, force: true });
         mkdirSync(staging, { recursive: true });
         new AdmZip(buf).extractAllTo(staging, true);
         const dirs = readdirSync(staging, { withFileTypes: true }).filter((e) => e.isDirectory());
         const root = dirs.length === 1 ? join(staging, dirs[0].name) : staging;
+        rejectSymlinks(root);
         rmSync(dest, { recursive: true, force: true });
         mkdirSync(dest, { recursive: true });
         cpSync(root, dest, { recursive: true });
         return { ...base, status: 'fetched' };
     }
     catch (err) {
-        const msg = ac.signal.aborted ? `timeout após ${timeoutMs}ms` : err.message;
-        return { ...base, status: existsSync(dest) ? 'cached' : 'failed', error: msg };
+        return { ...base, status: existsSync(dest) ? 'cached' : 'failed', error: err.message };
     }
     finally {
-        clearTimeout(timer);
         rmSync(staging, { recursive: true, force: true });
     }
 }

package/dist/adapters/lang/vendor.js.map

@@ -1 +1 @@
-{"version":3,"file":"vendor.js","sourceRoot":"","sources":["../../../src/adapters/lang/vendor.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,SAAS,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAiB,MAAM,YAAY,CAAC;AAEvD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAWlC,KAAK,UAAU,YAAY,CACzB,IAAc,EACd,OAAe,EACf,IAA6C;IAE7C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;IAE/D,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,GAAG,GAAG,+BAA+B,IAAI,CAAC,IAAI,mBAAmB,IAAI,CAAC,GAAG,EAAE,CAAC;IAClF,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,YAAY,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACpF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QAGjD,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1F,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAEvE,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAExC,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,SAAS,IAAI,CAAC,CAAC,CAAE,GAAa,CAAC,OAAO,CAAC;QACvF,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IACjF,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAMD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAA8D,EAAE;IAEhE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7C,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"vendor.js","sourceRoot":"","sources":["../../../src/adapters/lang/vendor.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,SAAS,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC1F,OAAO,EAAE,UAAU,EAAiB,MAAM,YAAY,CAAC;AAEvD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAWlC,KAAK,UAAU,YAAY,CACzB,IAAc,EACd,OAAe,EACf,IAA6C;IAE7C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;IAE/D,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,YAAY,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACpF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAGnD,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1F,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACvE,cAAc,CAAC,IAAI,CAAC,CAAC;QAErB,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAExC,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC;IACpG,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAMD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAA8D,EAAE;IAEhE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7C,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/adapters/pg/auth-event-repository.js

@@ -0,0 +1,30 @@
+import { query } from './client.js';
+const NAME_MAX = 128;
+const FAILURE_EVENTS = ['password_fail', '2fa_fail', '2fa_expired'];
+export function createAuthEventRepository() {
+    return {
+        async record(input) {
+            await query(`INSERT INTO auth_events (event, name, user_id, ip, trace_id, detail)
+         VALUES ($1, $2, $3, $4, $5, $6)`, [
+                input.event,
+                input.name ? input.name.slice(0, NAME_MAX) : null,
+                input.userId ?? null,
+                input.ip ?? null,
+                input.traceId ?? null,
+                input.detail ? JSON.stringify(input.detail) : null,
+            ]);
+        },
+        async recentFailures({ userId, name, limit = 5 }) {
+            const res = await query(`SELECT at, event, host(ip) AS ip FROM auth_events
+         WHERE event = ANY($1)
+           AND ( ($2::bigint IS NOT NULL AND user_id = $2) OR ($3::text IS NOT NULL AND name = $3) )
+         ORDER BY at DESC LIMIT $4`, [FAILURE_EVENTS, userId ?? null, name ?? null, limit]);
+            return res.rows.map((r) => ({ at: r.at, event: r.event, ip: r.ip }));
+        },
+        async pruneOlderThan(days) {
+            const res = await query(`DELETE FROM auth_events WHERE at < NOW() - ($1 || ' days')::interval`, [days]);
+            return res.rowCount ?? 0;
+        },
+    };
+}
+//# sourceMappingURL=auth-event-repository.js.map

package/dist/adapters/pg/auth-event-repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-event-repository.js","sourceRoot":"","sources":["../../../src/adapters/pg/auth-event-repository.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAGpC,MAAM,QAAQ,GAAG,GAAG,CAAC;AAGrB,MAAM,cAAc,GAAG,CAAC,eAAe,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;AAEpE,MAAM,UAAU,yBAAyB;IACvC,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,KAAqB;YAChC,MAAM,KAAK,CACT;yCACiC,EACjC;gBACE,KAAK,CAAC,KAAK;gBACX,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;gBACjD,KAAK,CAAC,MAAM,IAAI,IAAI;gBACpB,KAAK,CAAC,EAAE,IAAI,IAAI;gBAChB,KAAK,CAAC,OAAO,IAAI,IAAI;gBACrB,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;aACnD,CACF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE;YAE9C,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB;;;mCAG2B,EAC3B,CAAC,cAAc,EAAE,MAAM,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,KAAK,CAAC,CACtD,CAAC;YACF,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACpF,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,IAAI;YACvB,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,sEAAsE,EACtE,CAAC,IAAI,CAAC,CACP,CAAC;YACF,OAAO,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/adapters/pg/client.js

@@ -1,3 +1,4 @@
+import { readFileSync } from 'node:fs';
 import { Pool } from 'pg';
 function readDatabaseUrl() {
     const url = process.env.NIO_DATABASE_URL?.trim();
@@ -10,16 +11,34 @@ function readDatabaseUrl() {
     }
     return url;
 }
-function readSslOption() {
-    const flag = process.env.NIO_DATABASE_SSL?.trim().toLowerCase();
-    if (flag === 'true' || flag === '1')
+function envFlag(name) {
+    const v = process.env[name]?.trim().toLowerCase();
+    return v === 'true' || v === '1';
+}
+export function readSslOption() {
+    if (!envFlag('NIO_DATABASE_SSL'))
+        return undefined;
+    if (envFlag('NIO_DATABASE_SSL_INSECURE')) {
+        console.error('[pg] AVISO: NIO_DATABASE_SSL_INSECURE=1 — TLS sem verificação de certificado. ' +
+            'A conexão com o banco fica vulnerável a MITM. Use NIO_DATABASE_CA em vez disso.');
         return { rejectUnauthorized: false };
-    return undefined;
+    }
+    const caPath = process.env.NIO_DATABASE_CA?.trim();
+    if (caPath) {
+        try {
+            return { rejectUnauthorized: true, ca: readFileSync(caPath, 'utf8') };
+        }
+        catch (err) {
+            throw new Error(`NIO_DATABASE_CA não pôde ser lido ("${caPath}"): ${err.message}`);
+        }
+    }
+    return { rejectUnauthorized: true };
 }
 let pool = null;
 export function getPool() {
     if (pool)
         return pool;
+    globalThis.__nioPgPoolOpen = true;
     pool = new Pool({
         connectionString: readDatabaseUrl(),
         ssl: readSslOption(),
@@ -69,6 +88,7 @@ export async function closePool() {
         return;
     const p = pool;
     pool = null;
+    globalThis.__nioPgPoolOpen = false;
     await p.end();
 }
 //# sourceMappingURL=client.js.map

package/dist/adapters/pg/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/adapters/pg/client.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,IAAI,EAA0D,MAAM,IAAI,CAAC;AAGlF,SAAS,eAAe;IACtB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC;IACjD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,uEAAuE;YACrE,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,gEAAgE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CACtF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAGD,SAAS,aAAa;IACpB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChE,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC;IAC1E,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,IAAI,IAAI,GAAgB,IAAI,CAAC;AAM7B,MAAM,UAAU,OAAO;IACrB,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAEtB,IAAI,GAAG,IAAI,IAAI,CAAC;QACd,gBAAgB,EAAE,eAAe,EAAE;QACnC,GAAG,EAAE,aAAa,EAAE;QACpB,GAAG,EAAE,EAAE;QACP,iBAAiB,EAAE,MAAM;QACzB,uBAAuB,EAAE,MAAM;KAChC,CAAC,CAAC;IAIH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QACvB,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAMD,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,IAAY,EACZ,MAA2B;IAE3B,OAAO,OAAO,EAAE,CAAC,KAAK,CAAI,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,OAAO,GAAG,iEAAiE,CAAC;AAMlF,MAAM,UAAU,MAAM,CAAC,CAAS;IAC9B,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACzB,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAI,EAAsC;IAC7E,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC/C,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,IAAI;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAiB,gBAAgB,CAAC,CAAC;QAC1D,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAGD,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,MAAM,CAAC,GAAG,IAAI,CAAC;IACf,IAAI,GAAG,IAAI,CAAC;IACZ,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC;AAChB,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/adapters/pg/client.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAA0D,MAAM,IAAI,CAAC;AAGlF,SAAS,eAAe;IACtB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC;IACjD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,uEAAuE;YACrE,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,gEAAgE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CACtF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAGD,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClD,OAAO,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,CAAC;AACnC,CAAC;AAYD,MAAM,UAAU,aAAa;IAC3B,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;QAAE,OAAO,SAAS,CAAC;IAEnD,IAAI,OAAO,CAAC,2BAA2B,CAAC,EAAE,CAAC;QACzC,OAAO,CAAC,KAAK,CACX,gFAAgF;YAC9E,iFAAiF,CACpF,CAAC;QACF,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IACnD,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,EAAE,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;QACxE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,uCAAuC,MAAM,OAAQ,GAAa,CAAC,OAAO,EAAE,CAC7E,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;AACtC,CAAC;AAED,IAAI,IAAI,GAAgB,IAAI,CAAC;AAM7B,MAAM,UAAU,OAAO;IACrB,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAMrB,UAAsC,CAAC,eAAe,GAAG,IAAI,CAAC;IAE/D,IAAI,GAAG,IAAI,IAAI,CAAC;QACd,gBAAgB,EAAE,eAAe,EAAE;QACnC,GAAG,EAAE,aAAa,EAAE;QACpB,GAAG,EAAE,EAAE;QACP,iBAAiB,EAAE,MAAM;QACzB,uBAAuB,EAAE,MAAM;KAChC,CAAC,CAAC;IAIH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QACvB,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAMD,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,IAAY,EACZ,MAA2B;IAE3B,OAAO,OAAO,EAAE,CAAC,KAAK,CAAI,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,OAAO,GAAG,iEAAiE,CAAC;AAMlF,MAAM,UAAU,MAAM,CAAC,CAAS;IAC9B,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACzB,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAI,EAAsC;IAC7E,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC/C,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,IAAI;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAiB,gBAAgB,CAAC,CAAC;QAC1D,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAGD,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,MAAM,CAAC,GAAG,IAAI,CAAC;IACf,IAAI,GAAG,IAAI,CAAC;IACX,UAAsC,CAAC,eAAe,GAAG,KAAK,CAAC;IAChE,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC;AAChB,CAAC"}

package/dist/adapters/pg/login-challenge-repository.js.map

@@ -1 +1 @@
-{"version":3,"file":"login-challenge-repository.js","sourceRoot":"","sources":["../../../src/adapters/pg/login-challenge-repository.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAe7D,MAAM,IAAI,GACR,yFAAyF,CAAC;AAG5F,MAAM,UAAU,aAAa,CAAC,EAAU;IACtC,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAsB;IACzD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;QAC3B,OAAO,EAAE,GAAG,CAAC,OAA2B;QACxC,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,OAAO,EAAE,GAAG,CAAC,OAAgB;QAC7B,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC9B,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B;IAC5C,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,KAA6B;YACxC,OAAO,eAAe,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;gBAClC,MAAM,EAAE,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;gBACxE,MAAM,EAAE,CAAC,KAAK,CACZ,yEAAyE,EACzE,CAAC,KAAK,CAAC,MAAM,CAAC,CACf,CAAC;gBACF,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,KAAK,CACxB;;uBAEa,IAAI,EAAE,EACnB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAC9E,CAAC;gBACF,OAAO,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;YAC5C,CAAC,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,EAAE;YACf,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpC,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,UAAU,IAAI,sCAAsC,EACpD,CAAC,EAAE,CAAC,CACL,CAAC;YACF,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxB,OAAO,GAAG,CAAC,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAChD,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,EAAE;YACxB,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;gBAAE,OAAO,CAAC,CAAC;YACjC,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,sFAAsF,EACtF,CAAC,EAAE,CAAC,CACL,CAAC;YACF,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,IAAI,CAAC,CAAC,CAAC;QAC5C,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,EAAE;YACd,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;gBAAE,OAAO;YAC/B,MAAM,KAAK,CACT,uFAAuF,EACvF,CAAC,EAAE,CAAC,CACL,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,aAAa;YACjB,MAAM,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACvE,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"login-challenge-repository.js","sourceRoot":"","sources":["../../../src/adapters/pg/login-challenge-repository.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAe7D,MAAM,IAAI,GACR,yFAAyF,CAAC;AAG5F,MAAM,UAAU,aAAa,CAAC,EAAU;IACtC,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAsB;IACzD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;QAC3B,OAAO,EAAE,GAAG,CAAC,OAA2B;QACxC,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,OAAO,EAAE,GAAG,CAAC,OAAqB;QAClC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC9B,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B;IAC5C,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,KAA6B;YACxC,OAAO,eAAe,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;gBAClC,MAAM,EAAE,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;gBACxE,MAAM,EAAE,CAAC,KAAK,CACZ,yEAAyE,EACzE,CAAC,KAAK,CAAC,MAAM,CAAC,CACf,CAAC;gBACF,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,KAAK,CACxB;;uBAEa,IAAI,EAAE,EACnB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAC9E,CAAC;gBACF,OAAO,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;YAC5C,CAAC,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,EAAE;YACf,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpC,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,UAAU,IAAI,sCAAsC,EACpD,CAAC,EAAE,CAAC,CACL,CAAC;YACF,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxB,OAAO,GAAG,CAAC,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAChD,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,EAAE;YACxB,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;gBAAE,OAAO,CAAC,CAAC;YACjC,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,sFAAsF,EACtF,CAAC,EAAE,CAAC,CACL,CAAC;YACF,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,IAAI,CAAC,CAAC,CAAC;QAC5C,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,EAAE;YACd,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;gBAAE,OAAO;YAC/B,MAAM,KAAK,CACT,uFAAuF,EACvF,CAAC,EAAE,CAAC,CACL,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,aAAa;YACjB,MAAM,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACvE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/adapters/pg/login-ip-repository.js

@@ -0,0 +1,26 @@
+import { query } from './client.js';
+const map = (r) => ({
+    ip: r.ip,
+    firstSeen: r.first_seen,
+    lastSeen: r.last_seen,
+    count: Number(r.count),
+});
+export function createLoginIpRepository() {
+    return {
+        async record(userId, ip) {
+            await query(`INSERT INTO login_ip_events (user_id, ip) VALUES ($1, $2)
+         ON CONFLICT (user_id, ip)
+         DO UPDATE SET last_seen = NOW(), count = login_ip_events.count + 1`, [userId, ip]);
+        },
+        async recent(userId, limit = 10) {
+            const res = await query(`SELECT host(ip) AS ip, first_seen, last_seen, count FROM login_ip_events
+         WHERE user_id = $1 ORDER BY last_seen DESC LIMIT $2`, [userId, limit]);
+            return res.rows.map(map);
+        },
+        async pruneOlderThan(days) {
+            const res = await query(`DELETE FROM login_ip_events WHERE last_seen < NOW() - ($1 || ' days')::interval`, [days]);
+            return res.rowCount ?? 0;
+        },
+    };
+}
+//# sourceMappingURL=login-ip-repository.js.map

package/dist/adapters/pg/login-ip-repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-ip-repository.js","sourceRoot":"","sources":["../../../src/adapters/pg/login-ip-repository.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AASpC,MAAM,GAAG,GAAG,CAAC,CAAM,EAAgB,EAAE,CAAC,CAAC;IACrC,EAAE,EAAE,CAAC,CAAC,EAAE;IACR,SAAS,EAAE,CAAC,CAAC,UAAU;IACvB,QAAQ,EAAE,CAAC,CAAC,SAAS;IACrB,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;CACvB,CAAC,CAAC;AAEH,MAAM,UAAU,uBAAuB;IACrC,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE;YACrB,MAAM,KAAK,CACT;;4EAEoE,EACpE,CAAC,MAAM,EAAE,EAAE,CAAC,CACb,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,GAAG,EAAE;YAC7B,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB;6DACqD,EACrD,CAAC,MAAM,EAAE,KAAK,CAAC,CAChB,CAAC;YACF,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,IAAI;YACvB,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,iFAAiF,EACjF,CAAC,IAAI,CAAC,CACP,CAAC;YACF,OAAO,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/adapters/pg/user-repository.js

@@ -1,5 +1,10 @@
-import { hashPassword, verifyPassword } from '../../lib/auth/password.js';
+import { randomBytes } from 'node:crypto';
+import { hashPassword, needsRehash, verifyPassword, MIN_PASSWORD_LENGTH } from '../../lib/auth/password.js';
 import { query } from './client.js';
+let decoyHashPromise = null;
+function decoyHash() {
+    return (decoyHashPromise ??= hashPassword(`decoy-${randomBytes(16).toString('hex')}`).then((h) => h.phc));
+}
 function parseIps(raw) {
     if (!raw)
         return [];
@@ -23,48 +28,72 @@ export function mapUserRow(row) {
         timestampLastSession: row.timestamp_last_session,
     };
 }
-const COLS = 'id, name, password, timestamp_creation, timestamp_password_change, ' +
-    'auth_2, phone, backup_codes, timestamp_last_session, ips_using';
+const PUBLIC_COLS = 'id, name, password_pepper_id, timestamp_creation, timestamp_password_change, ' +
+    'auth_2, phone, backup_pepper_id, timestamp_last_session, ips_using';
+const FULL_COLS = `${PUBLIC_COLS}, password, backup_codes`;
 export function createUserRepository() {
     return {
         async findByName(name) {
-            const res = await query(`SELECT ${COLS} FROM user_cli WHERE name = $1`, [name]);
+            const res = await query(`SELECT ${PUBLIC_COLS} FROM user_cli WHERE name = $1`, [name]);
             const row = res.rows[0];
             return row ? mapUserRow(row) : null;
         },
         async findById(id) {
-            const res = await query(`SELECT ${COLS} FROM user_cli WHERE id = $1`, [id]);
+            const res = await query(`SELECT ${PUBLIC_COLS} FROM user_cli WHERE id = $1`, [id]);
             const row = res.rows[0];
             return row ? mapUserRow(row) : null;
         },
         async create(input) {
-            const passwordHash = await hashPassword(input.password);
-            const res = await query(`INSERT INTO user_cli (name, password) VALUES ($1, $2) RETURNING ${COLS}`, [input.name, passwordHash]);
+            if (input.password.length < MIN_PASSWORD_LENGTH) {
+                throw new Error(`Senha muito curta (mínimo ${MIN_PASSWORD_LENGTH} caracteres).`);
+            }
+            const { phc, pepperId } = await hashPassword(input.password);
+            const res = await query(`INSERT INTO user_cli (name, password, password_pepper_id) VALUES ($1, $2, $3) RETURNING ${PUBLIC_COLS}`, [input.name, phc, pepperId]);
             return mapUserRow(res.rows[0]);
         },
         async verifyCredentials(name, password) {
-            const res = await query(`SELECT ${COLS} FROM user_cli WHERE name = $1`, [name]);
+            const res = await query(`SELECT ${FULL_COLS} FROM user_cli WHERE name = $1`, [name]);
             const row = res.rows[0];
-            if (!row)
+            if (!row) {
+                await verifyPassword(await decoyHash(), password, 0);
+                return null;
+            }
+            const ok = await verifyPassword(row.password, password, row.password_pepper_id);
+            if (!ok)
                 return null;
-            const ok = await verifyPassword(row.password, password);
-            return ok ? mapUserRow(row) : null;
+            if (needsRehash(row.password, row.password_pepper_id)) {
+                try {
+                    const fresh = await hashPassword(password);
+                    await query('UPDATE user_cli SET password = $2, password_pepper_id = $3, timestamp_password_change = NOW() WHERE id = $1', [Number(row.id), fresh.phc, fresh.pepperId]);
+                }
+                catch {
+                }
+            }
+            return mapUserRow(row);
         },
         async touchLastSession(userId) {
             await query('UPDATE user_cli SET timestamp_last_session = NOW() WHERE id = $1', [userId]);
         },
-        async enable2fa(userId, phone, backupCodeHashes) {
-            await query('UPDATE user_cli SET auth_2 = TRUE, phone = $2, backup_codes = $3 WHERE id = $1', [userId, phone, backupCodeHashes]);
+        async updatePasswordHash(userId, phc, pepperId) {
+            await query('UPDATE user_cli SET password = $2, password_pepper_id = $3, timestamp_password_change = NOW() WHERE id = $1', [userId, phc, pepperId]);
+        },
+        async enable2fa(userId, phone, backupCodeHashes, backupPepperId) {
+            await query('UPDATE user_cli SET auth_2 = TRUE, phone = $2, backup_codes = $3, backup_pepper_id = $4 WHERE id = $1', [userId, phone, backupCodeHashes, backupPepperId]);
         },
         async disable2fa(userId) {
-            await query('UPDATE user_cli SET auth_2 = FALSE, phone = NULL, backup_codes = NULL WHERE id = $1', [userId]);
+            await query('UPDATE user_cli SET auth_2 = FALSE, phone = NULL, backup_codes = NULL, backup_pepper_id = 0 WHERE id = $1', [userId]);
         },
-        async updateBackupCodes(userId, joined) {
-            await query('UPDATE user_cli SET backup_codes = $2 WHERE id = $1', [userId, joined]);
+        async updateBackupCodes(userId, joined, pepperId) {
+            await query('UPDATE user_cli SET backup_codes = $2, backup_pepper_id = $3 WHERE id = $1', [
+                userId,
+                joined,
+                pepperId,
+            ]);
         },
         async getBackupCodes(userId) {
-            const res = await query('SELECT backup_codes FROM user_cli WHERE id = $1', [userId]);
-            return res.rows[0]?.backup_codes ?? null;
+            const res = await query('SELECT backup_codes, backup_pepper_id FROM user_cli WHERE id = $1', [userId]);
+            const row = res.rows[0];
+            return { codes: row?.backup_codes ?? null, pepperId: row?.backup_pepper_id ?? 0 };
         },
     };
 }

package/dist/adapters/pg/user-repository.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-repository.js","sourceRoot":"","sources":["../../../src/adapters/pg/user-repository.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAiBpC,SAAS,QAAQ,CAAC,GAAkB;IAClC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAGD,MAAM,UAAU,UAAU,CAAC,GAAY;IACrC,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAClB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,KAAK,EAAE,GAAG,CAAC,MAAM;QACjB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;QACjC,iBAAiB,EAAE,GAAG,CAAC,kBAAkB;QACzC,uBAAuB,EAAE,GAAG,CAAC,yBAAyB;QACtD,oBAAoB,EAAE,GAAG,CAAC,sBAAsB;KACjD,CAAC;AACJ,CAAC;AAED,MAAM,IAAI,GACR,qEAAqE;IACrE,gEAAgE,CAAC;AAEnE,MAAM,UAAU,oBAAoB;IAClC,OAAO;QACL,KAAK,CAAC,UAAU,CAAC,IAAI;YACnB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAU,UAAU,IAAI,gCAAgC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;YACzF,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxB,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtC,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,EAAE;YACf,MAAM,GAAG,GAAG,MAAM,KAAK,CAAU,UAAU,IAAI,8BAA8B,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YACrF,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxB,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtC,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,KAAmB;YAC9B,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACxD,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,mEAAmE,IAAI,EAAE,EACzE,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,CAAC,CAC3B,CAAC;YACF,OAAO,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;QAClC,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ;YACpC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAU,UAAU,IAAI,gCAAgC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;YACzF,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACxD,OAAO,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACrC,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,MAAM;YAC3B,MAAM,KAAK,CAAC,kEAAkE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5F,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,gBAAgB;YAC7C,MAAM,KAAK,CACT,gFAAgF,EAChF,CAAC,MAAM,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAClC,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,MAAM;YACrB,MAAM,KAAK,CACT,qFAAqF,EACrF,CAAC,MAAM,CAAC,CACT,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM;YACpC,MAAM,KAAK,CAAC,qDAAqD,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACvF,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,MAAM;YACzB,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,iDAAiD,EACjD,CAAC,MAAM,CAAC,CACT,CAAC;YACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,IAAI,IAAI,CAAC;QAC3C,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"user-repository.js","sourceRoot":"","sources":["../../../src/adapters/pg/user-repository.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAC5G,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAOpC,IAAI,gBAAgB,GAA2B,IAAI,CAAC;AACpD,SAAS,SAAS;IAChB,OAAO,CAAC,gBAAgB,KAAK,YAAY,CAAC,SAAS,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAC5G,CAAC;AAuBD,SAAS,QAAQ,CAAC,GAAkB;IAClC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAGD,MAAM,UAAU,UAAU,CAAC,GAAY;IACrC,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAClB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,KAAK,EAAE,GAAG,CAAC,MAAM;QACjB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;QACjC,iBAAiB,EAAE,GAAG,CAAC,kBAAkB;QACzC,uBAAuB,EAAE,GAAG,CAAC,yBAAyB;QACtD,oBAAoB,EAAE,GAAG,CAAC,sBAAsB;KACjD,CAAC;AACJ,CAAC;AAGD,MAAM,WAAW,GACf,+EAA+E;IAC/E,oEAAoE,CAAC;AAEvE,MAAM,SAAS,GAAG,GAAG,WAAW,0BAA0B,CAAC;AAE3D,MAAM,UAAU,oBAAoB;IAClC,OAAO;QACL,KAAK,CAAC,UAAU,CAAC,IAAI;YACnB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAU,UAAU,WAAW,gCAAgC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;YAChG,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxB,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtC,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,EAAE;YACf,MAAM,GAAG,GAAG,MAAM,KAAK,CAAU,UAAU,WAAW,8BAA8B,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5F,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxB,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtC,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,KAAmB;YAE9B,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;gBAChD,MAAM,IAAI,KAAK,CAAC,6BAA6B,mBAAmB,eAAe,CAAC,CAAC;YACnF,CAAC;YACD,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC7D,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,2FAA2F,WAAW,EAAE,EACxG,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,CAC5B,CAAC;YACF,OAAO,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;QAClC,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ;YACpC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAc,UAAU,SAAS,gCAAgC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;YAClG,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,cAAc,CAAC,MAAM,SAAS,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;gBACrD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,kBAAkB,CAAC,CAAC;YAChF,IAAI,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YAGrB,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACtD,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;oBAC3C,MAAM,KAAK,CACT,6GAA6G,EAC7G,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,CAC5C,CAAC;gBACJ,CAAC;gBAAC,MAAM,CAAC;gBAET,CAAC;YACH,CAAC;YACD,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,MAAM;YAC3B,MAAM,KAAK,CAAC,kEAAkE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5F,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ;YAC5C,MAAM,KAAK,CACT,6GAA6G,EAC7G,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,CACxB,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc;YAC7D,MAAM,KAAK,CACT,uGAAuG,EACvG,CAAC,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAClD,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,MAAM;YACrB,MAAM,KAAK,CACT,2GAA2G,EAC3G,CAAC,MAAM,CAAC,CACT,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ;YAC9C,MAAM,KAAK,CAAC,4EAA4E,EAAE;gBACxF,MAAM;gBACN,MAAM;gBACN,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,MAAM;YACzB,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,mEAAmE,EACnE,CAAC,MAAM,CAAC,CACT,CAAC;YACF,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,YAAY,IAAI,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,gBAAgB,IAAI,CAAC,EAAE,CAAC;QACpF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/adapters/sms/whatsapp.js

@@ -0,0 +1,83 @@
+export function formatWhatsAppNumber(phone) {
+    return phone.replace(/^\+/, '');
+}
+export function buildPayload(phone, code, env = {}) {
+    const payload = {
+        messaging_product: 'whatsapp',
+        to: formatWhatsAppNumber(phone),
+        type: 'template',
+        template: {
+            name: env.templateName ?? 'autenticao',
+            language: { code: env.templateLanguage ?? 'pt_BR' },
+            components: [
+                {
+                    type: 'body',
+                    parameters: [{ type: 'text', text: code }],
+                },
+                {
+                    type: 'button',
+                    sub_type: 'url',
+                    index: '0',
+                    parameters: [{ type: 'text', text: code }],
+                },
+            ],
+        },
+    };
+    return JSON.stringify(payload);
+}
+function readEnv() {
+    return {
+        url: process.env.WHATSAPP_ENDPOINT_URL?.trim(),
+        token: process.env.WHATSAPP_TOKEN?.trim(),
+        templateName: process.env.WHATSAPP_TEMPLATE_NAME?.trim(),
+        templateLanguage: process.env.WHATSAPP_TEMPLATE_LANGUAGE?.trim(),
+    };
+}
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '::1', '[::1]', '0.0.0.0']);
+export function smsMode(env = readEnv()) {
+    if (!env.url || !env.token)
+        return 'unconfigured';
+    try {
+        return LOOPBACK_HOSTS.has(new URL(env.url).hostname) ? 'echo' : 'provider';
+    }
+    catch {
+        return 'provider';
+    }
+}
+export function smsProviderHost(env = readEnv()) {
+    if (!env.url)
+        return null;
+    try {
+        return new URL(env.url).hostname;
+    }
+    catch {
+        return null;
+    }
+}
+export function createWhatsAppSender(env = readEnv()) {
+    return {
+        async sendOtp(to, code) {
+            if (!env.url || !env.token) {
+                return { status: 'skipped', error: 'WHATSAPP_ENDPOINT_URL / WHATSAPP_TOKEN não configurados' };
+            }
+            const body = buildPayload(to, code, env);
+            try {
+                const res = await fetch(env.url, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${env.token}` },
+                    body,
+                    signal: AbortSignal.timeout(10_000),
+                });
+                if (!res.ok) {
+                    const detail = (await res.text().catch(() => '')).slice(0, 300);
+                    return { status: 'failed', error: `WhatsApp respondeu ${res.status} ${detail}`.trim() };
+                }
+                return { status: 'sent' };
+            }
+            catch (err) {
+                return { status: 'failed', error: err.message };
+            }
+        },
+    };
+}
+//# sourceMappingURL=whatsapp.js.map

package/dist/adapters/sms/whatsapp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"whatsapp.js","sourceRoot":"","sources":["../../../src/adapters/sms/whatsapp.ts"],"names":[],"mappings":"AAcA,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC;AAGD,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,IAAY,EAAE,MAAmB,EAAE;IAC7E,MAAM,OAAO,GAAG;QACd,iBAAiB,EAAE,UAAU;QAC7B,EAAE,EAAE,oBAAoB,CAAC,KAAK,CAAC;QAC/B,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE;YACR,IAAI,EAAE,GAAG,CAAC,YAAY,IAAI,YAAY;YACtC,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,gBAAgB,IAAI,OAAO,EAAE;YACnD,UAAU,EAAE;gBACV;oBACE,IAAI,EAAE,MAAM;oBACZ,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;iBAC3C;gBACD;oBACE,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,KAAK;oBACf,KAAK,EAAE,GAAG;oBACV,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;iBAC3C;aACF;SACF;KACF,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AASD,SAAS,OAAO;IACd,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE;QAC9C,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE;QACzC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE;QACxD,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE;KACjE,CAAC;AACJ,CAAC;AAUD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AAGtF,MAAM,UAAU,OAAO,CAAC,MAAuB,OAAO,EAAE;IACtD,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK;QAAE,OAAO,cAAc,CAAC;IAClD,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,CAAC;IACpB,CAAC;AACH,CAAC;AAGD,MAAM,UAAU,eAAe,CAAC,MAAuB,OAAO,EAAE;IAC9D,IAAI,CAAC,GAAG,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAGD,MAAM,UAAU,oBAAoB,CAAC,MAAuB,OAAO,EAAE;IACnE,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,IAAY;YACpC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC3B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,yDAAyD,EAAE,CAAC;YACjG,CAAC;YACD,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACzC,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;oBAC/B,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,GAAG,CAAC,KAAK,EAAE,EAAE;oBACrF,IAAI;oBACJ,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;iBACpC,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;oBACZ,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;oBAChE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,sBAAsB,GAAG,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC1F,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YAC5B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC;YAC7D,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/app/ai-client.js

@@ -1,5 +1,5 @@
 import { spawn } from 'node:child_process';
-import { installOpencodeGlobal, NIO_OPERATOR_MODEL } from '../lib/clients/client-configs.js';
+import { installOpencodeGlobal, NIO_OPERATOR_MODEL, NIO_AI_BASE_URL } from '../lib/clients/client-configs.js';
 import { isBinaryInstalled } from '../lib/clients/client-install.js';
 import { c, sym } from '../lib/colors.js';
 import { dlog } from '../lib/debug.js';
@@ -12,7 +12,7 @@ export class HeadroomRequiredError extends Error {
 export async function ensureHeadroomAndWire() {
     try {
         installOpencodeGlobal([]);
-        dlog('opencode.json: provider direto (Headroom desativado), model =', NIO_OPERATOR_MODEL);
+        dlog('opencode.json: motor →', NIO_AI_BASE_URL, ', model =', NIO_OPERATOR_MODEL);
     }
     catch (err) {
         console.warn(`  ${c.yellow(sym.warn)} não gravei o opencode.json: ${err.message}`);

package/dist/app/ai-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"ai-client.js","sourceRoot":"","sources":["../../src/app/ai-client.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAC7F,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAOvC,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,MAAc;QACxB,KAAK,CAAC,wBAAwB,MAAM,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAcD,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,IAAI,CAAC;QACH,qBAAqB,CAAC,EAAE,CAAC,CAAC;QAC1B,IAAI,CAAC,+DAA+D,EAAE,kBAAkB,CAAC,CAAC;IAC5F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,gCAAiC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAChG,CAAC;AACH,CAAC;AAGD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAqC,EACrC,OAAqB,EAAE;IAEvB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,iBAAiB,CAAC;IAE1D,MAAM,qBAAqB,EAAE,CAAC;IAE9B,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,mEAAmE,CAC3F,CAAC;QACF,OAAO,GAAG,CAAC;IACb,CAAC;IAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,OAAO,CACnB,UAAU,EACV,CAAC,KAAK,EAAE,SAAS,EAAE,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,EACnD,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CACpC,CAAC;QACF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/C,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,OAAO,CAAC,KAAK,CAAC,uCAAuC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACpE,OAAO,CAAC,GAAG,CAAC,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"ai-client.js","sourceRoot":"","sources":["../../src/app/ai-client.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAC9G,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAOvC,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,MAAc;QACxB,KAAK,CAAC,wBAAwB,MAAM,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAaD,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,IAAI,CAAC;QACH,qBAAqB,CAAC,EAAE,CAAC,CAAC;QAC1B,IAAI,CAAC,wBAAwB,EAAE,eAAe,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,gCAAiC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAChG,CAAC;AACH,CAAC;AAGD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAqC,EACrC,OAAqB,EAAE;IAEvB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,iBAAiB,CAAC;IAE1D,MAAM,qBAAqB,EAAE,CAAC;IAE9B,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,mEAAmE,CAC3F,CAAC;QACF,OAAO,GAAG,CAAC;IACb,CAAC;IAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,OAAO,CACnB,UAAU,EACV,CAAC,KAAK,EAAE,SAAS,EAAE,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,EACnD,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CACpC,CAAC;QACF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/C,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,OAAO,CAAC,KAAK,CAAC,uCAAuC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACpE,OAAO,CAAC,GAAG,CAAC,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/brand.js

@@ -15,7 +15,7 @@ export const brand = {
     envPrefix: 'NIO',
     patPrefix: 'nio_',
     skillsRepo: 'hugoreiis12-png/NIO-SKILLS-',
-    skillsRef: 'main',
+    skillsRef: '11980256cff5c261740e0abd0c549da9b1da3d95',
     skillsPackage: '@nio-cli/skills',
     toolPrefix: 'nos_',
     cliToolPrefix: 'nio_',

package/dist/brand.js.map

@@ -1 +1 @@
-{"version":3,"file":"brand.js","sourceRoot":"","sources":["../src/brand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAYjC,MAAM,CAAC,MAAM,KAAK,GAAG;IAGnB,IAAI,EAAE,KAAK;IAEX,WAAW,EAAE,KAAK;IAElB,eAAe,EAAE,KAAK;IAGtB,SAAS,EAAE,iBAAiB;IAE5B,UAAU,EAAE,UAAU;IAEtB,WAAW,EAAE,cAAc;IAE3B,UAAU,EAAE,SAAS;IAErB,YAAY,EAAE,KAAK;IAOnB,MAAM,EAAE,EAAE;IAIV,WAAW,EAAE,MAAM;IAEnB,iBAAiB,EAAE,UAAU;IAI7B,SAAS,EAAE,KAAK;IAMhB,SAAS,EAAE,MAAM;IAIjB,UAAU,EAAE,6BAA6B;IACzC,SAAS,EAAE,MAAM;IAEjB,aAAa,EAAE,iBAAiB;IAIhC,UAAU,EAAE,MAAM;IAElB,aAAa,EAAE,MAAM;CACb,CAAC;AASX,MAAM,CAAC,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,eAAe,CAAC,CAAC;AAGvE,MAAM,UAAU,QAAQ,CAAC,GAAG,KAAe;IACzC,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,CAAC;AACtD,CAAC;AAGD,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,OAAO,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;AACtC,CAAC;AAGD,MAAM,UAAU,GAAG,CAAC,IAAY;IAC9B,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AACpC,CAAC"}
+{"version":3,"file":"brand.js","sourceRoot":"","sources":["../src/brand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAYjC,MAAM,CAAC,MAAM,KAAK,GAAG;IAGnB,IAAI,EAAE,KAAK;IAEX,WAAW,EAAE,KAAK;IAElB,eAAe,EAAE,KAAK;IAGtB,SAAS,EAAE,iBAAiB;IAE5B,UAAU,EAAE,UAAU;IAEtB,WAAW,EAAE,cAAc;IAE3B,UAAU,EAAE,SAAS;IAErB,YAAY,EAAE,KAAK;IAOnB,MAAM,EAAE,EAAE;IAIV,WAAW,EAAE,MAAM;IAEnB,iBAAiB,EAAE,UAAU;IAI7B,SAAS,EAAE,KAAK;IAMhB,SAAS,EAAE,MAAM;IAIjB,UAAU,EAAE,6BAA6B;IAWzC,SAAS,EAAE,0CAA0C;IAErD,aAAa,EAAE,iBAAiB;IAIhC,UAAU,EAAE,MAAM;IAElB,aAAa,EAAE,MAAM;CACb,CAAC;AASX,MAAM,CAAC,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,eAAe,CAAC,CAAC;AAGvE,MAAM,UAAU,QAAQ,CAAC,GAAG,KAAe;IACzC,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,CAAC;AACtD,CAAC;AAGD,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,OAAO,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;AACtC,CAAC;AAGD,MAAM,UAAU,GAAG,CAAC,IAAY;IAC9B,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AACpC,CAAC"}

package/dist/cli/commands/ai.js

@@ -46,11 +46,11 @@ async function runAi() {
 export function registerAiCommand(program) {
     const ai = program
         .command("ai")
-        .description("Abre a interface NIO da sessão ativa (Headroom + opencode serve + Ink)")
+        .description("Abre a interface NIO da sessão ativa (opencode serve headless + chat Ink)")
         .action(runAi);
     ai
         .command("status")
-        .description("Estado do Headroom (proxy obrigatório do client de IA)")
+        .description("Estado do Headroom (proxy de compressão — desativado por ADR 0010, dormente)")
         .action(async () => {
         const up = await headroomHealthy();
         console.log(`${up ? c.green(sym.ok) : c.red(sym.err)} Headroom ${c.dim(HEADROOM_URL)} — ${up ? "no ar" : "fora"}`);

package/dist/cli/commands/ai.js.map

@@ -1 +1 @@
-{"version":3,"file":"ai.js","sourceRoot":"","sources":["../../../src/cli/commands/ai.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACvC,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAC9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAI/D,KAAK,UAAU,oBAAoB;IACjC,MAAM,MAAM,GAAG,MAAM,WAAW,EAAE,CAAC;IACnC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC/F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,OAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,uBAAuB,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,oBAAqB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM;YACpF,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,yBAAyB,CAAC,GAAG,CACvD,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,KAAK;IAClB,MAAM,OAAO,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;QAC9D,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;YACzC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAClD,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,4BAA4B,KAAK,CAAC,IAAI,0CAA0C,CAAC,CAAC,CAAC;YACvG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAgB;IAChD,MAAM,EAAE,GAAG,OAAO;SACf,OAAO,CAAC,IAAI,CAAC;SACb,WAAW,CAAC,wEAAwE,CAAC;SACrF,MAAM,CAAC,KAAK,CAAC,CAAC;IAEjB,EAAE;SACC,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,wDAAwD,CAAC;SACrE,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CACT,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CACtG,CAAC;QACF,IAAI,CAAC,EAAE;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,IAAI,uBAAuB,CAAC,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"ai.js","sourceRoot":"","sources":["../../../src/cli/commands/ai.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACvC,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAC9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAI/D,KAAK,UAAU,oBAAoB;IACjC,MAAM,MAAM,GAAG,MAAM,WAAW,EAAE,CAAC;IACnC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC/F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,OAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,uBAAuB,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,oBAAqB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM;YACpF,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,yBAAyB,CAAC,GAAG,CACvD,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,KAAK;IAClB,MAAM,OAAO,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;QAC9D,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;YACzC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAClD,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,4BAA4B,KAAK,CAAC,IAAI,0CAA0C,CAAC,CAAC,CAAC;YACvG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAgB;IAChD,MAAM,EAAE,GAAG,OAAO;SACf,OAAO,CAAC,IAAI,CAAC;SACb,WAAW,CAAC,2EAA2E,CAAC;SACxF,MAAM,CAAC,KAAK,CAAC,CAAC;IAEjB,EAAE;SACC,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,8EAA8E,CAAC;SAC3F,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CACT,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CACtG,CAAC;QACF,IAAI,CAAC,EAAE;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,IAAI,uBAAuB,CAAC,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/cli/commands/auth.js

@@ -3,27 +3,33 @@ import { brand } from "../../brand.js";
 import { animateMatrixLogo } from "../../matrix-logo.js";
 import { startSpinner } from "../../lib/spinner.js";
 import { c, sym } from "../../lib/colors.js";
-import { createUserRepository } from "../../adapters/pg/user-repository.js";
-import { gatewayLogin, gatewayLogout, gatewayVerify2fa, } from "../../lib/auth/gateway-client.js";
+import { MIN_PASSWORD_LENGTH } from "../../lib/auth/password.js";
+import { gatewayLogin, gatewayLogout, gatewayLogoutAll, gatewayRegister, gatewayVerify2fa, } from "../../lib/auth/gateway-client.js";
 import { loadSession, saveSession, clearSession } from "../../lib/auth/session-store.js";
 import { ensureConfig } from "../../lib/auth/nio-config.js";
 import { ensureGatewayRunning } from "../../lib/auth/gateway-process.js";
 import { continueChain } from "../flows/onboarding.js";
 import { box, cmd } from "../../lib/colors.js";
 import { authCopy } from "../copy.js";
-async function resolveSecondFactor(challengeId, phoneHint) {
-    console.log(`  ${c.dim(`código enviado por SMS para ${phoneHint}`)}`);
+async function resolveSecondFactor(challengeId, phoneHint, sms) {
+    if (sms?.smsMode === "echo") {
+        console.log(`  ${c.yellow(sym.warn)} modo echo (dev) — nenhum WhatsApp real foi enviado` +
+            (sms.devCode ? `. Código: ${c.bold(sms.devCode)}` : " (veja ~/.nio/whatsapp-echo-last.json)"));
+    }
+    else {
+        console.log(`  ${c.dim(`código enviado por WhatsApp para ${phoneHint}`)}`);
+    }
     let type = "otp";
     for (let attempt = 0; attempt < 4; attempt++) {
         const code = (await input({
-            message: type === "otp" ? "Código de confirmação (SMS)" : "Código de backup",
+            message: type === "otp" ? "Código de confirmação (WhatsApp)" : "Código de backup",
             validate: (v) => v.trim().length > 0 || "obrigatório",
         })).trim();
         const res = await gatewayVerify2fa(challengeId, code, type);
         if (res.ok)
             return res;
         if (res.requiresBackupCode) {
-            console.log(`  ${c.yellow(sym.warn)} tentativas de SMS esgotadas — use um código de backup.`);
+            console.log(`  ${c.yellow(sym.warn)} tentativas de código esgotadas — use um código de backup.`);
             type = "backup";
             continue;
         }
@@ -32,7 +38,6 @@ async function resolveSecondFactor(challengeId, phoneHint) {
     }
     return null;
 }
-const MIN_PASSWORD_LENGTH = 8;
 async function requireGateway() {
     const result = await ensureGatewayRunning();
     if (result.ok)
@@ -60,7 +65,10 @@ export async function runLogin() {
             session = result;
         }
         else {
-            const s = await resolveSecondFactor(result.challengeId, result.phoneHint);
+            const s = await resolveSecondFactor(result.challengeId, result.phoneHint, {
+                smsMode: result.smsMode,
+                devCode: result.devCode,
+            });
             if (!s) {
                 console.error(`${c.red(sym.err)} 2º fator não concluído.`);
                 process.exit(1);
@@ -87,6 +95,7 @@ export async function runLogin() {
 }
 export async function runRegister() {
     await ensureConfig({ interactive: true });
+    await requireGateway();
     const name = await input({
         message: authCopy.register.namePrompt,
         validate: (v) => v.trim().length > 0 || authCopy.register.nameInvalid,
@@ -96,17 +105,11 @@ export async function runRegister() {
         mask: "*",
         validate: (v) => v.length >= MIN_PASSWORD_LENGTH || authCopy.register.passwordInvalid,
     });
-    const repo = createUserRepository();
     const spinner = startSpinner("Criando usuário...");
     try {
-        const existing = await repo.findByName(name.trim());
-        if (existing) {
-            spinner.fail(`Usuário "${name.trim()}" já existe.`);
-            process.exit(1);
-        }
-        const user = await repo.create({ name: name.trim(), password: pass });
+        const user = await gatewayRegister(name.trim(), pass);
         spinner.stop();
-        console.log(`${c.green(sym.ok)} Usuário criado: ${user.name} (id ${user.id})`);
+        console.log(`${c.green(sym.ok)} Usuário criado: ${user.name} (id ${user.userId})`);
     }
     catch (err) {
         spinner.fail(`Falha ao criar usuário: ${err.message}`);
@@ -118,7 +121,7 @@ export async function runRegister() {
 function registerRegisterCommand(program) {
     program
         .command("register")
-        .description("Cria um novo usuário no banco (user_cli) e já entra (login)")
+        .description("Cria um novo usuário via nio-gateway e já entra (login)")
         .action(async () => {
         await runRegister();
         await continueChain({ from: "command" });
@@ -137,17 +140,21 @@ function registerLogoutCommand(program) {
     program
         .command("logout")
         .description("Encerra a sessão local e revoga a auth_session no banco")
-        .action(async () => {
+        .option("--all", "Revoga TODAS as sessões do usuário (todos os dispositivos)")
+        .action(async (opts) => {
         const session = await loadSession();
         if (session) {
             try {
-                await gatewayLogout(session.sessionId);
+                if (opts.all)
+                    await gatewayLogoutAll(session.token);
+                else
+                    await gatewayLogout(session.sessionId, session.token);
             }
             catch {
             }
         }
         await clearSession();
-        console.log("Sessão removida.");
+        console.log(opts.all ? "Todas as sessões foram encerradas." : "Sessão removida.");
     });
 }
 function registerWhoamiCommand(program) {