@omnitron-dev/omnitron 0.1.1

package/dist/services/remote-ops.service.js

@@ -0,0 +1,132 @@
+/**
+ * RemoteOpsService — Reusable remote operations layer on @xec-sh/core
+ *
+ * Provides ping, SSH, and remote command execution for all omnitron subsystems.
+ * Built on ExecutionService which wraps @xec-sh/core ExecutionEngine.
+ *
+ * Used by: NodeManagerService, ProjectService, DeployService, DiscoveryService
+ */
+import { ExecutionService } from '../execution/execution.service.js';
+export const DEFAULT_CHECK_CONFIG = {
+    pingEnabled: true,
+    pingTimeout: 5_000,
+    sshTimeout: 10_000,
+    omnitronCheckTimeout: 15_000,
+};
+// =============================================================================
+// Service
+// =============================================================================
+export class RemoteOpsService {
+    exec;
+    constructor(logger) {
+        this.exec = new ExecutionService(logger);
+    }
+    // ===========================================================================
+    // Ping (ICMP)
+    // ===========================================================================
+    /**
+     * ICMP ping a host. Uses system `ping` command via @xec-sh/core.
+     * Returns latency in ms or null if unreachable.
+     */
+    async ping(host, timeoutMs = DEFAULT_CHECK_CONFIG.pingTimeout) {
+        const start = Date.now();
+        try {
+            const timeoutSec = Math.max(1, Math.ceil(timeoutMs / 1000));
+            // macOS: /sbin/ping -c count -W timeout(ms), Linux: /bin/ping -c count -W timeout(s)
+            // Use absolute paths — child processes may not have /sbin in PATH
+            const isMac = process.platform === 'darwin';
+            const pingBin = isMac ? '/sbin/ping' : '/bin/ping';
+            const cmd = isMac
+                ? `${pingBin} -c 1 -W ${timeoutMs} '${host}'`
+                : `${pingBin} -c 1 -W ${timeoutSec} '${host}'`;
+            const result = await this.exec.exec(cmd, { timeout: timeoutMs + 2000 });
+            if (result.exitCode === 0) {
+                const match = result.stdout.match(/time[=<](\d+\.?\d*)\s*ms/);
+                const latency = match ? parseFloat(match[1]) : Date.now() - start;
+                return { reachable: true, latencyMs: Math.round(latency * 100) / 100 };
+            }
+            return { reachable: false, latencyMs: null, error: 'Host unreachable' };
+        }
+        catch (err) {
+            return { reachable: false, latencyMs: null, error: err.message };
+        }
+    }
+    // ===========================================================================
+    // SSH
+    // ===========================================================================
+    /**
+     * Check SSH connectivity to a remote host.
+     * Executes `echo ok && uname -s -m -n` to verify connection and get OS info.
+     */
+    async checkSsh(target, timeoutMs = DEFAULT_CHECK_CONFIG.sshTimeout) {
+        const start = Date.now();
+        try {
+            const result = await this.exec.ssh(target, 'echo ok && uname -s -m -n', { timeout: timeoutMs });
+            const latency = Date.now() - start;
+            if (result.exitCode === 0 && result.stdout.includes('ok')) {
+                const lines = result.stdout.trim().split('\n');
+                const unameParts = (lines[1] ?? '').trim().split(/\s+/);
+                const sshResult = { connected: true, latencyMs: latency };
+                if (unameParts.length >= 3) {
+                    sshResult.os = { platform: unameParts[0].toLowerCase(), arch: unameParts[1], hostname: unameParts[2] };
+                }
+                return sshResult;
+            }
+            return { connected: false, latencyMs: latency, error: result.stderr || 'SSH command failed' };
+        }
+        catch (err) {
+            return { connected: false, latencyMs: Date.now() - start, error: err.message };
+        }
+    }
+    /**
+     * Execute a command on a remote host via SSH.
+     */
+    async sshExec(target, command, timeoutMs) {
+        return this.exec.ssh(target, command, timeoutMs ? { timeout: timeoutMs } : undefined);
+    }
+    // ===========================================================================
+    // Remote Omnitron Status
+    // ===========================================================================
+    /**
+     * Check if omnitron daemon is running on a remote node.
+     * Executes `omnitron status --json` via SSH.
+     */
+    async checkRemoteOmnitron(target, timeoutMs = DEFAULT_CHECK_CONFIG.omnitronCheckTimeout) {
+        try {
+            const result = await this.exec.ssh(target, 'omnitron status --json 2>/dev/null || echo "{"', { timeout: timeoutMs });
+            if (result.exitCode !== 0) {
+                return { connected: false };
+            }
+            try {
+                const info = JSON.parse(result.stdout.trim() || '{}');
+                return {
+                    connected: !!info.pid,
+                    version: info.version,
+                    pid: info.pid,
+                    uptime: info.uptime,
+                    role: info.role,
+                    os: info.os,
+                };
+            }
+            catch {
+                return { connected: false };
+            }
+        }
+        catch {
+            return { connected: false };
+        }
+    }
+    // ===========================================================================
+    // Local Execution (convenience)
+    // ===========================================================================
+    async localExec(command, timeoutMs) {
+        return this.exec.exec(command, timeoutMs ? { timeout: timeoutMs } : undefined);
+    }
+    // ===========================================================================
+    // Lifecycle
+    // ===========================================================================
+    async dispose() {
+        await this.exec.dispose?.();
+    }
+}
+//# sourceMappingURL=remote-ops.service.js.map

package/dist/services/remote-ops.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-ops.service.js","sourceRoot":"","sources":["../../src/services/remote-ops.service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,gBAAgB,EAAmC,MAAM,mCAAmC,CAAC;AAoCtG,MAAM,CAAC,MAAM,oBAAoB,GAAoB;IACnD,WAAW,EAAE,IAAI;IACjB,WAAW,EAAE,KAAK;IAClB,UAAU,EAAE,MAAM;IAClB,oBAAoB,EAAE,MAAM;CAC7B,CAAC;AAEF,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF,MAAM,OAAO,gBAAgB;IACV,IAAI,CAAmB;IAExC,YAAY,MAAe;QACzB,IAAI,CAAC,IAAI,GAAG,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED,8EAA8E;IAC9E,cAAc;IACd,8EAA8E;IAE9E;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,SAAS,GAAG,oBAAoB,CAAC,WAAW;QACnE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC;YAC5D,qFAAqF;YACrF,kEAAkE;YAClE,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC;YAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;YACnD,MAAM,GAAG,GAAG,KAAK;gBACf,CAAC,CAAC,GAAG,OAAO,YAAY,SAAS,KAAK,IAAI,GAAG;gBAC7C,CAAC,CAAC,GAAG,OAAO,YAAY,UAAU,KAAK,IAAI,GAAG,CAAC;YAEjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,SAAS,GAAG,IAAI,EAAE,CAAC,CAAC;YAExE,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;gBAC9D,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;gBACnE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC;YACzE,CAAC;YACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;QAC1E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,MAAM;IACN,8EAA8E;IAE9E;;;OAGG;IACH,KAAK,CAAC,QAAQ,CAAC,MAAiB,EAAE,SAAS,GAAG,oBAAoB,CAAC,UAAU;QAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,2BAA2B,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YAChG,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YAEnC,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC/C,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACxD,MAAM,SAAS,GAAmB,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;gBAC1E,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;oBAC3B,SAAS,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAE,EAAE,CAAC;gBAC5G,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,IAAI,oBAAoB,EAAE,CAAC;QAChG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC;QAC5F,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,MAAiB,EAAE,OAAe,EAAE,SAAkB;QAClE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACxF,CAAC;IAED,8EAA8E;IAC9E,yBAAyB;IACzB,8EAA8E;IAE9E;;;OAGG;IACH,KAAK,CAAC,mBAAmB,CACvB,MAAiB,EACjB,SAAS,GAAG,oBAAoB,CAAC,oBAAoB;QAErD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAChC,MAAM,EACN,gDAAgD,EAChD,EAAE,OAAO,EAAE,SAAS,EAAE,CACvB,CAAC;YAEF,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YAC9B,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC;gBACtD,OAAO;oBACL,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG;oBACrB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,EAAE,EAAE,IAAI,CAAC,EAAE;iBACZ,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YAC9B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,gCAAgC;IAChC,8EAA8E;IAE9E,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,SAAkB;QACjD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACjF,CAAC;IAED,8EAA8E;IAC9E,YAAY;IACZ,8EAA8E;IAE9E,KAAK,CAAC,OAAO;QACX,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;IAC9B,CAAC;CACF"}

package/dist/services/secrets.rpc-service.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Secrets RPC Service
+ *
+ * Netron RPC endpoints for encrypted secrets management.
+ * All endpoints require authentication (admin role).
+ */
+import type { SecretsService } from './secrets.service.js';
+export declare class SecretsRpcService {
+    private readonly secrets;
+    constructor(secrets: SecretsService);
+    /**
+     * Get a secret by key. Returns null if not found.
+     */
+    get(data: {
+        key: string;
+    }): Promise<{
+        key: string;
+        value: string | null;
+    }>;
+    /**
+     * Set a secret. Creates or updates the value.
+     */
+    set(data: {
+        key: string;
+        value: string;
+    }): Promise<{
+        success: boolean;
+    }>;
+    /**
+     * Delete a secret by key.
+     */
+    delete(data: {
+        key: string;
+    }): Promise<{
+        success: boolean;
+        existed: boolean;
+    }>;
+    /**
+     * List all secret keys (values are NOT returned for security).
+     */
+    list(): Promise<{
+        keys: string[];
+    }>;
+}
+//# sourceMappingURL=secrets.rpc-service.d.ts.map

package/dist/services/secrets.rpc-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.rpc-service.d.ts","sourceRoot":"","sources":["../../src/services/secrets.rpc-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,qBACa,iBAAiB;IAChB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,cAAc;IAEpD;;OAEG;IAEG,GAAG,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAKhF;;OAEG;IAEG,GAAG,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAK9E;;OAEG;IAEG,MAAM,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAKpF;;OAEG;IAEG,IAAI,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CAI1C"}

package/dist/services/secrets.rpc-service.js

@@ -0,0 +1,81 @@
+/**
+ * Secrets RPC Service
+ *
+ * Netron RPC endpoints for encrypted secrets management.
+ * All endpoints require authentication (admin role).
+ */
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Service, Public } from '@omnitron-dev/titan/decorators';
+import { ADMIN_ROLES } from '../shared/roles.js';
+let SecretsRpcService = class SecretsRpcService {
+    secrets;
+    constructor(secrets) {
+        this.secrets = secrets;
+    }
+    /**
+     * Get a secret by key. Returns null if not found.
+     */
+    async get(data) {
+        const value = await this.secrets.get(data.key);
+        return { key: data.key, value };
+    }
+    /**
+     * Set a secret. Creates or updates the value.
+     */
+    async set(data) {
+        await this.secrets.set(data.key, data.value);
+        return { success: true };
+    }
+    /**
+     * Delete a secret by key.
+     */
+    async delete(data) {
+        const existed = await this.secrets.delete(data.key);
+        return { success: true, existed };
+    }
+    /**
+     * List all secret keys (values are NOT returned for security).
+     */
+    async list() {
+        const keys = await this.secrets.list();
+        return { keys };
+    }
+};
+__decorate([
+    Public({ auth: { roles: ADMIN_ROLES } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], SecretsRpcService.prototype, "get", null);
+__decorate([
+    Public({ auth: { roles: ADMIN_ROLES } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], SecretsRpcService.prototype, "set", null);
+__decorate([
+    Public({ auth: { roles: ADMIN_ROLES } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], SecretsRpcService.prototype, "delete", null);
+__decorate([
+    Public({ auth: { roles: ADMIN_ROLES } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], SecretsRpcService.prototype, "list", null);
+SecretsRpcService = __decorate([
+    Service({ name: 'OmnitronSecrets' }),
+    __metadata("design:paramtypes", [Function])
+], SecretsRpcService);
+export { SecretsRpcService };
+//# sourceMappingURL=secrets.rpc-service.js.map

package/dist/services/secrets.rpc-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.rpc-service.js","sourceRoot":"","sources":["../../src/services/secrets.rpc-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;;;;;;;;;;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAI1C,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IACC;IAA7B,YAA6B,OAAuB;QAAvB,YAAO,GAAP,OAAO,CAAgB;IAAG,CAAC;IAExD;;OAEG;IAEG,AAAN,KAAK,CAAC,GAAG,CAAC,IAAqB;QAC7B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/C,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;IAED;;OAEG;IAEG,AAAN,KAAK,CAAC,GAAG,CAAC,IAAoC;QAC5C,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IAEG,AAAN,KAAK,CAAC,MAAM,CAAC,IAAqB;QAChC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACpC,CAAC;IAED;;OAEG;IAEG,AAAN,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACvC,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;CACF,CAAA;AA/BO;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;;;;4CAIxC;AAMK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;;;;4CAIxC;AAMK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;;;;+CAIxC;AAMK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;;;;6CAIxC;AArCU,iBAAiB;IAD7B,OAAO,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;;GACxB,iBAAiB,CAsC7B"}

package/dist/services/secrets.service.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Secrets Service — Encrypted Secrets Storage
+ *
+ * Stores secrets (API keys, DB passwords, signing keys) encrypted at rest
+ * in a JSON file using AES-256-GCM.
+ *
+ * Key derivation: scrypt(passphrase + machineId, salt, 64) → 32-byte key
+ * Encryption: AES-256-GCM with random IV per encryption
+ * Storage: ~/.omnitron/secrets.enc (JSON envelope with salt, iv, ciphertext, tag)
+ *
+ * Zero external dependencies — uses Node.js native crypto.
+ */
+export declare class SecretsService {
+    private readonly filePath;
+    private passphrase;
+    private cache;
+    constructor(filePath: string, passphrase: string);
+    /**
+     * Get a secret by key.
+     * Returns null if the key doesn't exist or the secrets file is missing.
+     */
+    get(key: string): Promise<string | null>;
+    /**
+     * Set a secret. Creates or updates the value for the given key.
+     * Writes the encrypted file immediately.
+     */
+    set(key: string, value: string): Promise<void>;
+    /**
+     * Delete a secret by key.
+     * Returns true if the key existed and was deleted.
+     */
+    delete(key: string): Promise<boolean>;
+    /**
+     * List all secret keys (values are NOT returned).
+     */
+    list(): Promise<string[]>;
+    /**
+     * Rotate the encryption key by re-encrypting with a new passphrase.
+     * The old passphrase must match the current encryption.
+     */
+    rotate(oldPassphrase: string, newPassphrase: string): Promise<void>;
+    /**
+     * Check if the secrets file exists.
+     */
+    exists(): boolean;
+    private deriveKey;
+    private encrypt;
+    private decrypt;
+    private load;
+    private save;
+    /**
+     * Get a stable machine identifier for key derivation.
+     * Falls back to hostname if machine-id is unavailable.
+     */
+    private getMachineId;
+}
+//# sourceMappingURL=secrets.service.d.ts.map

package/dist/services/secrets.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.service.d.ts","sourceRoot":"","sources":["../../src/services/secrets.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAoDH,qBAAa,cAAc;IAIvB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,UAAU;IAJpB,OAAO,CAAC,KAAK,CAA2B;gBAGrB,QAAQ,EAAE,MAAM,EACzB,UAAU,EAAE,MAAM;IAO5B;;;OAGG;IACG,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAK9C;;;OAGG;IACG,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMpD;;;OAGG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ3C;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAK/B;;;OAGG;IACG,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAczE;;OAEG;IACH,MAAM,IAAI,OAAO;YAQH,SAAS;YAOT,OAAO;YAqBP,OAAO;YAmBP,IAAI;YAwBJ,IAAI;IAiBlB;;;OAGG;YACW,YAAY;CA+B3B"}

package/dist/services/secrets.service.js

@@ -0,0 +1,211 @@
+/**
+ * Secrets Service — Encrypted Secrets Storage
+ *
+ * Stores secrets (API keys, DB passwords, signing keys) encrypted at rest
+ * in a JSON file using AES-256-GCM.
+ *
+ * Key derivation: scrypt(passphrase + machineId, salt, 64) → 32-byte key
+ * Encryption: AES-256-GCM with random IV per encryption
+ * Storage: ~/.omnitron/secrets.enc (JSON envelope with salt, iv, ciphertext, tag)
+ *
+ * Zero external dependencies — uses Node.js native crypto.
+ */
+import { createCipheriv, createDecipheriv, randomBytes, scrypt, } from 'node:crypto';
+import { promisify } from 'node:util';
+import { readFile, writeFile, mkdir } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+const scryptAsync = promisify(scrypt);
+// =============================================================================
+// Constants
+// =============================================================================
+const ALGORITHM = 'aes-256-gcm';
+const KEY_LENGTH = 32; // 256 bits
+const SALT_LENGTH = 32;
+const IV_LENGTH = 16;
+// scrypt parameters are controlled via Node's defaults (N=16384, r=8, p=1)
+// which match our production requirements. Custom tuning can be added
+// by passing options to scryptAsync if needed in the future.
+// =============================================================================
+// Service
+// =============================================================================
+export class SecretsService {
+    filePath;
+    passphrase;
+    cache = null;
+    constructor(filePath, passphrase) {
+        this.filePath = filePath;
+        this.passphrase = passphrase;
+    }
+    // ===========================================================================
+    // Public API
+    // ===========================================================================
+    /**
+     * Get a secret by key.
+     * Returns null if the key doesn't exist or the secrets file is missing.
+     */
+    async get(key) {
+        const secrets = await this.load();
+        return secrets[key] ?? null;
+    }
+    /**
+     * Set a secret. Creates or updates the value for the given key.
+     * Writes the encrypted file immediately.
+     */
+    async set(key, value) {
+        const secrets = await this.load();
+        secrets[key] = value;
+        await this.save(secrets);
+    }
+    /**
+     * Delete a secret by key.
+     * Returns true if the key existed and was deleted.
+     */
+    async delete(key) {
+        const secrets = await this.load();
+        if (!(key in secrets))
+            return false;
+        delete secrets[key];
+        await this.save(secrets);
+        return true;
+    }
+    /**
+     * List all secret keys (values are NOT returned).
+     */
+    async list() {
+        const secrets = await this.load();
+        return Object.keys(secrets);
+    }
+    /**
+     * Rotate the encryption key by re-encrypting with a new passphrase.
+     * The old passphrase must match the current encryption.
+     */
+    async rotate(oldPassphrase, newPassphrase) {
+        // Decrypt with old passphrase
+        const oldService = new SecretsService(this.filePath, oldPassphrase);
+        const secrets = await oldService.load();
+        // Re-encrypt with new passphrase
+        const newService = new SecretsService(this.filePath, newPassphrase);
+        await newService.save(secrets);
+        // Update our own passphrase reference
+        this.passphrase = newPassphrase;
+        this.cache = secrets;
+    }
+    /**
+     * Check if the secrets file exists.
+     */
+    exists() {
+        return existsSync(this.filePath);
+    }
+    // ===========================================================================
+    // Encryption / Decryption
+    // ===========================================================================
+    async deriveKey(salt) {
+        // Combine passphrase with machine-id for additional binding
+        const machineId = await this.getMachineId();
+        const combined = `${this.passphrase}:${machineId}`;
+        return scryptAsync(combined, salt, KEY_LENGTH);
+    }
+    async encrypt(data) {
+        const salt = randomBytes(SALT_LENGTH);
+        const iv = randomBytes(IV_LENGTH);
+        const key = await this.deriveKey(salt);
+        const cipher = createCipheriv(ALGORITHM, key, iv);
+        const plaintext = JSON.stringify(data);
+        let ciphertext = cipher.update(plaintext, 'utf8', 'hex');
+        ciphertext += cipher.final('hex');
+        const tag = cipher.getAuthTag();
+        return {
+            version: 1,
+            salt: salt.toString('hex'),
+            iv: iv.toString('hex'),
+            ciphertext,
+            tag: tag.toString('hex'),
+        };
+    }
+    async decrypt(envelope) {
+        const salt = Buffer.from(envelope.salt, 'hex');
+        const iv = Buffer.from(envelope.iv, 'hex');
+        const tag = Buffer.from(envelope.tag, 'hex');
+        const key = await this.deriveKey(salt);
+        const decipher = createDecipheriv(ALGORITHM, key, iv);
+        decipher.setAuthTag(tag);
+        let plaintext = decipher.update(envelope.ciphertext, 'hex', 'utf8');
+        plaintext += decipher.final('utf8');
+        return JSON.parse(plaintext);
+    }
+    // ===========================================================================
+    // Persistence
+    // ===========================================================================
+    async load() {
+        if (this.cache)
+            return this.cache;
+        if (!existsSync(this.filePath)) {
+            this.cache = {};
+            return this.cache;
+        }
+        try {
+            const raw = await readFile(this.filePath, 'utf8');
+            const envelope = JSON.parse(raw);
+            if (envelope.version !== 1) {
+                throw new Error(`Unsupported secrets envelope version: ${envelope.version}`);
+            }
+            this.cache = await this.decrypt(envelope);
+            return this.cache;
+        }
+        catch (err) {
+            if (err.message.includes('Unsupported'))
+                throw err;
+            throw new Error(`Failed to decrypt secrets file: ${err.message}. Wrong passphrase?`, { cause: err });
+        }
+    }
+    async save(secrets) {
+        // Ensure directory exists
+        const dir = path.dirname(this.filePath);
+        await mkdir(dir, { recursive: true });
+        const envelope = await this.encrypt(secrets);
+        await writeFile(this.filePath, JSON.stringify(envelope, null, 2), {
+            mode: 0o600, // Owner-only read/write
+        });
+        this.cache = secrets;
+    }
+    // ===========================================================================
+    // Machine ID
+    // ===========================================================================
+    /**
+     * Get a stable machine identifier for key derivation.
+     * Falls back to hostname if machine-id is unavailable.
+     */
+    async getMachineId() {
+        try {
+            // Linux: /etc/machine-id
+            const { readFile: readFs } = await import('node:fs/promises');
+            try {
+                const id = await readFs('/etc/machine-id', 'utf8');
+                if (id.trim())
+                    return id.trim();
+            }
+            catch {
+                // Not Linux
+            }
+            // macOS: IOPlatformUUID via system_profiler
+            try {
+                const { execSync } = await import('node:child_process');
+                const output = execSync('ioreg -rd1 -c IOPlatformExpertDevice | grep IOPlatformUUID', { encoding: 'utf8', timeout: 5000 });
+                const match = output.match(/"IOPlatformUUID"\s*=\s*"([^"]+)"/);
+                if (match?.[1])
+                    return match[1];
+            }
+            catch {
+                // Not macOS or command failed
+            }
+            // Fallback: hostname
+            const os = await import('node:os');
+            return os.hostname();
+        }
+        catch {
+            return 'omnitron-default-machine-id';
+        }
+    }
+}
+//# sourceMappingURL=secrets.service.js.map

package/dist/services/secrets.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.service.js","sourceRoot":"","sources":["../../src/services/secrets.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,MAAM,GACP,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;AAuBtC,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,UAAU,GAAG,EAAE,CAAC,CAAC,WAAW;AAClC,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,2EAA2E;AAC3E,sEAAsE;AACtE,6DAA6D;AAE7D,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF,MAAM,OAAO,cAAc;IAIN;IACT;IAJF,KAAK,GAAsB,IAAI,CAAC;IAExC,YACmB,QAAgB,EACzB,UAAkB;QADT,aAAQ,GAAR,QAAQ,CAAQ;QACzB,eAAU,GAAV,UAAU,CAAQ;IACzB,CAAC;IAEJ,8EAA8E;IAC9E,aAAa;IACb,8EAA8E;IAE9E;;;OAGG;IACH,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClC,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa;QAClC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACrB,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QACpC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;QACpB,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI;QACR,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,aAAqB,EAAE,aAAqB;QACvD,8BAA8B;QAC9B,MAAM,UAAU,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC;QAExC,iCAAiC;QACjC,MAAM,UAAU,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QACpE,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE/B,sCAAsC;QACtC,IAAI,CAAC,UAAU,GAAG,aAAa,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,OAAO,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED,8EAA8E;IAC9E,0BAA0B;IAC1B,8EAA8E;IAEtE,KAAK,CAAC,SAAS,CAAC,IAAY;QAClC,4DAA4D;QAC5D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,UAAU,IAAI,SAAS,EAAE,CAAC;QACnD,OAAO,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAoB,CAAC;IACpE,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,IAAgB;QACpC,MAAM,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;QACtC,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;QAClC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAEvC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAEvC,IAAI,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACzD,UAAU,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEhC,OAAO;YACL,OAAO,EAAE,CAAC;YACV,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC1B,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;YACtB,UAAU;YACV,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;SACzB,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,QAAyB;QAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/C,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAEvC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACtD,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAEzB,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACpE,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpC,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAe,CAAC;IAC7C,CAAC;IAED,8EAA8E;IAC9E,cAAc;IACd,8EAA8E;IAEtE,KAAK,CAAC,IAAI;QAChB,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC;QAElC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;YAEpD,IAAI,QAAQ,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/E,CAAC;YAED,IAAI,CAAC,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC1C,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;gBAAE,MAAM,GAAG,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,mCAAoC,GAAa,CAAC,OAAO,qBAAqB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAClH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,OAAmB;QACpC,0BAA0B;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEtC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;YAChE,IAAI,EAAE,KAAK,EAAE,wBAAwB;SACtC,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC;IACvB,CAAC;IAED,8EAA8E;IAC9E,aAAa;IACb,8EAA8E;IAE9E;;;OAGG;IACK,KAAK,CAAC,YAAY;QACxB,IAAI,CAAC;YACH,yBAAyB;YACzB,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAC9D,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;gBACnD,IAAI,EAAE,CAAC,IAAI,EAAE;oBAAE,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;YAED,4CAA4C;YAC5C,IAAI,CAAC;gBACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;gBACxD,MAAM,MAAM,GAAG,QAAQ,CACrB,4DAA4D,EAC5D,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CACpC,CAAC;gBACF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;gBAC/D,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;oBAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,8BAA8B;YAChC,CAAC;YAED,qBAAqB;YACrB,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;YACnC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,6BAA6B,CAAC;QACvC,CAAC;IACH,CAAC;CACF"}

package/dist/services/slave-storage.service.d.ts

@@ -0,0 +1,69 @@
+/**
+ * SlaveStorageService — SQLite-backed local storage for slave daemons
+ *
+ * Slave daemons run WITHOUT PostgreSQL/Docker. All local data is stored
+ * in a single SQLite database using Kysely through titan-database.
+ *
+ * Tables:
+ *   - metrics_raw: time-series metrics (cpu, memory, rpc, custom)
+ *   - sync_buffer: WAL for slave→master data replication
+ *   - logs: structured log entries (buffered locally)
+ *
+ * Location: ~/.omnitron/data/slave.db
+ *
+ * Features:
+ *   - WAL mode for concurrent reads/writes
+ *   - Auto-creates tables on first use
+ *   - Used by: titan-metrics (SQLiteMetricsStorage), SyncService, LogCollector
+ *   - Zero Docker dependency
+ */
+import { Kysely } from 'kysely';
+import type { ILogger } from '@omnitron-dev/titan/module/logger';
+export interface SlaveDatabase {
+    metrics_raw: {
+        id: number;
+        timestamp: number;
+        nodeId: string | null;
+        app: string;
+        name: string;
+        value: number;
+        labels: string | null;
+    };
+    sync_buffer: {
+        id: number;
+        category: string;
+        payload: string;
+        createdAt: string;
+        syncedAt: string | null;
+    };
+    logs: {
+        id: string;
+        timestamp: string;
+        nodeId: string | null;
+        app: string;
+        level: string;
+        message: string;
+        labels: string | null;
+        traceId: string | null;
+        spanId: string | null;
+        metadata: string | null;
+    };
+}
+export declare class SlaveStorageService {
+    private readonly logger;
+    private readonly dbPath;
+    private db;
+    private initialized;
+    constructor(logger: ILogger, dbPath?: string);
+    /**
+     * Get the Kysely instance (lazy-creates on first access).
+     * Returns a typed Kysely<SlaveDatabase> ready for queries.
+     */
+    getDb(): Promise<Kysely<SlaveDatabase>>;
+    /**
+     * Close the database connection.
+     */
+    dispose(): Promise<void>;
+    private createTables;
+}
+//# sourceMappingURL=slave-storage.service.d.ts.map

package/dist/services/slave-storage.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slave-storage.service.d.ts","sourceRoot":"","sources":["../../src/services/slave-storage.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,EAAE,MAAM,EAAsB,MAAM,QAAQ,CAAC;AACpD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mCAAmC,CAAC;AAUjE,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE;QACX,EAAE,EAAE,MAAM,CAAC;QACX,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;KACvB,CAAC;IACF,WAAW,EAAE;QACX,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;KACzB,CAAC;IACF,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;KACzB,CAAC;CACH;AAMD,qBAAa,mBAAmB;IAK5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IALzB,OAAO,CAAC,EAAE,CAAsC;IAChD,OAAO,CAAC,WAAW,CAAS;gBAGT,MAAM,EAAE,OAAO,EACf,MAAM,GAAE,MAAwB;IAGnD;;;OAGG;IACG,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IA4B7C;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;YAWhB,YAAY;CA2D3B"}