@omnitron-dev/omnitron 0.1.3 → 0.3.0

package/dist/services/remote-ops.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"remote-ops.service.js","sourceRoot":"","sources":["../../src/services/remote-ops.service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,gBAAgB,EAAmC,MAAM,mCAAmC,CAAC;AAoCtG,MAAM,CAAC,MAAM,oBAAoB,GAAoB;IACnD,WAAW,EAAE,IAAI;IACjB,WAAW,EAAE,KAAK;IAClB,UAAU,EAAE,MAAM;IAClB,oBAAoB,EAAE,MAAM;CAC7B,CAAC;AAEF,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF,MAAM,OAAO,gBAAgB;IACV,IAAI,CAAmB;IAExC,YAAY,MAAe;QACzB,IAAI,CAAC,IAAI,GAAG,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED,8EAA8E;IAC9E,cAAc;IACd,8EAA8E;IAE9E;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,SAAS,GAAG,oBAAoB,CAAC,WAAW;QACnE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC;YAC5D,qFAAqF;YACrF,kEAAkE;YAClE,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC;YAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;YACnD,MAAM,GAAG,GAAG,KAAK;gBACf,CAAC,CAAC,GAAG,OAAO,YAAY,SAAS,KAAK,IAAI,GAAG;gBAC7C,CAAC,CAAC,GAAG,OAAO,YAAY,UAAU,KAAK,IAAI,GAAG,CAAC;YAEjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,SAAS,GAAG,IAAI,EAAE,CAAC,CAAC;YAExE,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;gBAC9D,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;gBACnE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC;YACzE,CAAC;YACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;QAC1E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,MAAM;IACN,8EAA8E;IAE9E;;;OAGG;IACH,KAAK,CAAC,QAAQ,CAAC,MAAiB,EAAE,SAAS,GAAG,oBAAoB,CAAC,UAAU;QAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,2BAA2B,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YAChG,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YAEnC,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC/C,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACxD,MAAM,SAAS,GAAmB,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;gBAC1E,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;oBAC3B,SAAS,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAE,EAAE,CAAC;gBAC5G,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,IAAI,oBAAoB,EAAE,CAAC;QAChG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC;QAC5F,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,MAAiB,EAAE,OAAe,EAAE,SAAkB;QAClE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACxF,CAAC;IAED,8EAA8E;IAC9E,yBAAyB;IACzB,8EAA8E;IAE9E;;;OAGG;IACH,KAAK,CAAC,mBAAmB,CACvB,MAAiB,EACjB,SAAS,GAAG,oBAAoB,CAAC,oBAAoB;QAErD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAChC,MAAM,EACN,gDAAgD,EAChD,EAAE,OAAO,EAAE,SAAS,EAAE,CACvB,CAAC;YAEF,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YAC9B,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC;gBACtD,OAAO;oBACL,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG;oBACrB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,EAAE,EAAE,IAAI,CAAC,EAAE;iBACZ,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YAC9B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,gCAAgC;IAChC,8EAA8E;IAE9E,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,SAAkB;QACjD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACjF,CAAC;IAED,8EAA8E;IAC9E,YAAY;IACZ,8EAA8E;IAE9E,KAAK,CAAC,OAAO;QACX,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;IAC9B,CAAC;CACF"}
+{"version":3,"file":"remote-ops.service.js","sourceRoot":"","sources":["../../src/services/remote-ops.service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C,OAAO,EAAE,gBAAgB,EAAmC,MAAM,mCAAmC,CAAC;AAEtG,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAgCrE,MAAM,CAAC,MAAM,oBAAoB,GAAoB;IACnD,WAAW,EAAE,IAAI;IACjB,WAAW,EAAE,KAAK;IAClB,UAAU,EAAE,MAAM;IAClB,oBAAoB,EAAE,MAAM;IAC5B,WAAW,EAAE,EAAE;CAChB,CAAC;AAEF,gDAAgD;AAChD,MAAM,mBAAmB,GAAG;IAC1B,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;IAC5B,oBAAoB,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;IACtC,WAAW,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC;CACb,CAAC;AAEX;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAA+B;IAClE,MAAM,GAAG,GAAoB,EAAE,GAAG,oBAAoB,EAAE,CAAC;IACzD,GAAG,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,oBAAoB,CAAC,WAAW,CAAC;IACxE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAA4C,EAAE,CAAC;QAC9F,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACxH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gFAAgF;AAChF,kBAAkB;AAClB,gFAAgF;AAEhF,iFAAiF;AACjF,MAAM,SAAS,GAAG,iCAAiC,CAAC;AAEpD,wBAAwB;AACxB,MAAM,IAAI,GAAG,8CAA8C,CAAC;AAE5D,SAAS,MAAM,CAAC,KAAa;IAC3B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE;QAC/B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACvB,OAAO,CAAC,IAAI,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,0EAA0E;IAC1E,qEAAqE;IACrE,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC/C,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAEhF,6CAA6C;IAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1F,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,IAAI,MAAM,CAAC,WAAW,CAAC;YAAE,OAAO,WAAW,CAAC,WAAW,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACrF,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9B,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,UAAU,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,qEAAqE;QACrE,wEAAwE;QACxE,mEAAmE;QACnE,wEAAwE;QACxE,kEAAkE;QAClE,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CACb,gBAAgB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,oDAAoD,CAC1F,CAAC;QACJ,CAAC;QACD,OAAO,UAAU,CAAC,WAAW,EAAE,CAAC;IAClC,CAAC;IAED,MAAM,IAAI,KAAK,CACb,gBAAgB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,6DAA6D,CACnG,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF,MAAM,OAAO,gBAAgB;IACV,IAAI,CAAmB;IAExC,YAAY,MAAe;QACzB,IAAI,CAAC,IAAI,GAAG,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED,8EAA8E;IAC9E,cAAc;IACd,8EAA8E;IAE9E;;;;;;;OAOG;IACH,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,SAAS,GAAG,oBAAoB,CAAC,WAAW;QACnE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC;QAC9E,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC;QAC5D,qFAAqF;QACrF,kEAAkE;QAClE,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;QACnD,MAAM,IAAI,GAAG,KAAK;YAChB,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;YAC9C,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC;QAE5E,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,GAAG,KAAK,CAAC,CAAC;QAE/D,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YACnE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC;QACzE,CAAC;QACD,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,kBAAkB;SACtD,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,MAAM;IACN,8EAA8E;IAE9E;;;;;;;;;;OAUG;IACH,KAAK,CAAC,QAAQ,CAAC,MAAiB,EAAE,SAAS,GAAG,oBAAoB,CAAC,UAAU;QAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,2DAA2D;YAC3D,oEAAoE;YACpE,uEAAuE;YACvE,6DAA6D;YAC7D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAChC,MAAM,EACN,uDAAuD,EACvD,EAAE,OAAO,EAAE,SAAS,EAAE,CACvB,CAAC;YACF,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YAEnC,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBACpE,MAAM,SAAS,GAAmB,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;gBAC1E,4CAA4C;gBAC5C,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC;gBACpD,IAAI,QAAQ,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;oBACjC,SAAS,CAAC,EAAE,GAAG;wBACb,QAAQ,EAAE,QAAQ,CAAC,WAAW,EAAE;wBAChC,IAAI;wBACJ,QAAQ;wBACR,OAAO,EAAE,OAAO,IAAI,EAAE;qBACvB,CAAC;gBACJ,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,oBAAoB,EAAE,CAAC;QAC3G,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC;QAC5F,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,MAAiB,EAAE,OAAe,EAAE,SAAkB;QAClE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACxF,CAAC;IAED,8EAA8E;IAC9E,yBAAyB;IACzB,8EAA8E;IAE9E;;;;;;;;OAQG;IACH,KAAK,CAAC,mBAAmB,CACvB,MAAiB,EACjB,SAAS,GAAG,oBAAoB,CAAC,oBAAoB;QAErD,IAAI,CAAC;YACH,qEAAqE;YACrE,oEAAoE;YACpE,4CAA4C;YAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAChC,MAAM,EACN,kBAAkB,CAChB,kDAAkD,aAAa,4CAA4C,CAC5G,EACD,EAAE,OAAO,EAAE,SAAS,EAAE,CACvB,CAAC;YAEF,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,0BAA0B,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC9G,CAAC;YACD,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;YACrD,CAAC;YAED,yDAAyD;YACzD,qEAAqE;YACrE,uEAAuE;YACvE,uEAAuE;YACvE,uEAAuE;YACvE,+BAA+B;YAC/B,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC;YACxD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC;YAC5E,CAAC;YACD,MAAM,MAAM,GAA8C,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACpF,IAAI,IAAI,CAAC,OAAO;gBAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;YAChD,IAAI,IAAI,CAAC,GAAG;gBAAE,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;YACpC,IAAI,IAAI,CAAC,MAAM;gBAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YAC7C,IAAI,IAAI,CAAC,IAAI;gBAAE,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YACvC,iEAAiE;YACjE,uEAAuE;YACvE,mEAAmE;YACnE,sEAAsE;YACtE,wDAAwD;YACxD,IAAI,CAAC,MAAM,CAAC,SAAS;gBAAE,MAAM,CAAC,KAAK,GAAG,WAAW,CAAC;YAClD,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,gCAAgC;IAChC,8EAA8E;IAE9E,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,SAAkB;QACjD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACjF,CAAC;IAED,8EAA8E;IAC9E,YAAY;IACZ,8EAA8E;IAE9E,KAAK,CAAC,OAAO;QACX,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;IAC9B,CAAC;CACF;AAED,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF;;;;;;;GAOG;AACH,SAAS,OAAO,CAAC,GAAW,EAAE,IAAc,EAAE,OAAe;IAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YAC/E,IAAI,QAAQ,GAAG,CAAC,CAAC;YACjB,IAAI,OAAO,GAAG,EAAE,CAAC;YACjB,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,CAAC,GAAG,GAA2E,CAAC;gBACtF,QAAQ,GAAG,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnD,IAAI,CAAC,CAAC,MAAM;oBAAE,OAAO,GAAG,mBAAmB,OAAO,IAAI,CAAC;qBAClD,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;oBAAE,OAAO,GAAG,GAAG,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;YACrE,CAAC;YACD,OAAO,CAAC;gBACN,MAAM,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;gBAC7B,MAAM,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,OAAO;gBACxC,QAAQ;gBACR,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;aAC7B,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAC/E,SAAS,SAAS,CAAC,IAAwB;IACzC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACpD,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC3C,CAAC"}

package/dist/services/remote-provisioner.d.ts

@@ -0,0 +1,122 @@
+/**
+ * Preparing a machine to run omnitron, whatever machine it is.
+ *
+ * Provisioning used to be one line for this: if `which node` came back empty,
+ * pipe `https://deb.nodesource.com/setup_22.x` into `bash` as root and run
+ * `apt-get install -y nodejs`, with `yum` and `apk` as `||` fallbacks. Three
+ * things wrong with that, in rising order of importance.
+ *
+ * It only works on Linux, and only on three of its families. A macOS node
+ * falls through every branch and fails on the last one.
+ *
+ * It adds a vendor package repository and its signing key to the host,
+ * permanently, as a side effect of asking for a slave. The machines this
+ * reaches are not blank — the host this path was first run against is
+ * running a Monero node, a Tor daemon and two VPN containers, with an uptime
+ * of 599 days.
+ *
+ * And the `||` chain reports the last failure, not the first. On a Debian
+ * host where the apt install fails, the error an operator reads is from
+ * `apk`, a package manager that host has never had.
+ *
+ * What replaces it: ask the host what it is, decide what is missing, and do
+ * the smallest set of things that fixes it — reporting each one. The runtime
+ * comes from nodejs.org as a tarball unpacked under the omnitron prefix,
+ * which works identically on every Linux and macOS, needs no repository, and
+ * is undone by deleting one directory. The package manager is used only for
+ * the two tools that fetch and unpack it, and only when they are missing.
+ *
+ * Built on `@xec-sh/core`: its SSH adapter carries the credentials, and
+ * `quoteForShell`/`dialectFor` do the quoting for the dialect the target
+ * actually speaks rather than assuming a POSIX shell.
+ */
+/** The default runtime a prepared node gets when it has none. */
+export declare const DEFAULT_NODE_VERSION = "22.14.0";
+/** Where omnitron puts things it installed itself. */
+export declare const OMNITRON_PREFIX = "/opt/omnitron";
+export type PackageManager = 'apt' | 'dnf' | 'yum' | 'apk' | 'pacman' | 'zypper' | 'brew';
+/** Node's own naming for the platforms it publishes builds for. */
+export type NodePlatform = 'linux' | 'darwin';
+export type NodeArch = 'x64' | 'arm64' | 'armv7l' | 'ppc64le' | 's390x';
+export interface PlatformFacts {
+    /** `uname -s`, lowercased. `unknown` when the host did not answer. */
+    readonly os: NodePlatform | 'unknown';
+    /** Node's name for the machine architecture, or null when unrecognised. */
+    readonly arch: NodeArch | null;
+    /** `ID` from /etc/os-release — `ubuntu`, `alpine`, `fedora`… */
+    readonly distro: string | null;
+    /** The first package manager found on PATH, in the order this host prefers. */
+    readonly packageManager: PackageManager | null;
+    /** True when the SSH user is root. */
+    readonly isRoot: boolean;
+    /** True when `sudo` exists and can be used without a password. */
+    readonly passwordlessSudo: boolean;
+    /** Versions of what is already installed, absent when it is not. */
+    readonly node: string | null;
+    readonly bun: string | null;
+    readonly npm: string | null;
+    readonly omnitron: string | null;
+    /** Tools the install path itself needs. */
+    readonly hasCurl: boolean;
+    readonly hasTar: boolean;
+}
+/**
+ * One command that answers every question above.
+ *
+ * A single round trip on purpose: each of these is a sub-second question and
+ * an SSH round trip to a host on another continent is not. The old code paid
+ * one per probe.
+ *
+ * Every line is `key=value`, and a missing value means "not present" rather
+ * than "the question failed" — the command cannot fail as a whole, so the
+ * caller's own error handling stays the thing that reports unreachable hosts.
+ */
+export declare const PLATFORM_PROBE: string;
+/** Parse the probe's output. Anything unanswered stays absent. */
+export declare function parsePlatformProbe(stdout: string): PlatformFacts;
+export interface ProvisionStep {
+    /** What this step achieves, in the operator's terms. */
+    readonly what: string;
+    /** The command, ready for the remote shell. */
+    readonly command: string;
+    /** How long it may take. Package installs and downloads are not instant. */
+    readonly timeoutMs: number;
+    /**
+     * Changes the host's package configuration — an apt/dnf/brew install.
+     * Reported separately because it is the part an operator may want to
+     * know about on a machine that is already doing something else.
+     */
+    readonly touchesPackageManager?: boolean;
+}
+export interface ProvisionPlan {
+    readonly steps: readonly ProvisionStep[];
+    /** Empty when nothing is needed, which is the common case on a re-run. */
+    readonly nothingToDo: boolean;
+    /** Set when the host cannot be prepared at all, and why. */
+    readonly refusal?: string;
+}
+export interface ProvisionRequirements {
+    /** Node version to install when the host has no runtime. */
+    readonly nodeVersion?: string;
+    /** Install prefix for what omnitron puts on the machine. */
+    readonly prefix?: string;
+    /** Allow using the host's package manager for missing tools. Default true. */
+    readonly usePackageManager?: boolean;
+}
+/**
+ * Decide what a host needs.
+ *
+ * Pure, so the decision can be read and tested without a machine: given the
+ * same facts it produces the same plan, and the plan is a list of commands a
+ * person can look at before anything runs.
+ */
+export declare function planProvisioning(facts: PlatformFacts, requirements?: ProvisionRequirements): ProvisionPlan;
+/**
+ * A one-line summary of what a plan will change, for a log or a console.
+ *
+ * Exists because "provisioning failed" and "provisioning did nothing" and
+ * "provisioning replaced this machine's Node" all used to look the same from
+ * outside.
+ */
+export declare function describePlan(plan: ProvisionPlan): string;
+//# sourceMappingURL=remote-provisioner.d.ts.map

package/dist/services/remote-provisioner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-provisioner.d.ts","sourceRoot":"","sources":["../../src/services/remote-provisioner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAIH,iEAAiE;AACjE,eAAO,MAAM,oBAAoB,YAAY,CAAC;AAE9C,sDAAsD;AACtD,eAAO,MAAM,eAAe,kBAAkB,CAAC;AAM/C,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE1F,mEAAmE;AACnE,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,QAAQ,CAAC;AAC9C,MAAM,MAAM,QAAQ,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC;AAExE,MAAM,WAAW,aAAa;IAC5B,sEAAsE;IACtE,QAAQ,CAAC,EAAE,EAAE,YAAY,GAAG,SAAS,CAAC;IACtC,2EAA2E;IAC3E,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC/B,gEAAgE;IAChE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,+EAA+E;IAC/E,QAAQ,CAAC,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IAC/C,sCAAsC;IACtC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,kEAAkE;IAClE,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,2CAA2C;IAC3C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,cAAc,QAcf,CAAC;AAeb,kEAAkE;AAClE,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,CA2BhE;AAMD,MAAM,WAAW,aAAa;IAC5B,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,+CAA+C;IAC/C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;CAC1C;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,CAAC;IACzC,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,4DAA4D;IAC5D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,8EAA8E;IAC9E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;CACtC;AAcD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,aAAa,EACpB,YAAY,GAAE,qBAA0B,GACvC,aAAa,CA4If;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAIxD"}

package/dist/services/remote-provisioner.js

@@ -0,0 +1,258 @@
+/**
+ * Preparing a machine to run omnitron, whatever machine it is.
+ *
+ * Provisioning used to be one line for this: if `which node` came back empty,
+ * pipe `https://deb.nodesource.com/setup_22.x` into `bash` as root and run
+ * `apt-get install -y nodejs`, with `yum` and `apk` as `||` fallbacks. Three
+ * things wrong with that, in rising order of importance.
+ *
+ * It only works on Linux, and only on three of its families. A macOS node
+ * falls through every branch and fails on the last one.
+ *
+ * It adds a vendor package repository and its signing key to the host,
+ * permanently, as a side effect of asking for a slave. The machines this
+ * reaches are not blank — the host this path was first run against is
+ * running a Monero node, a Tor daemon and two VPN containers, with an uptime
+ * of 599 days.
+ *
+ * And the `||` chain reports the last failure, not the first. On a Debian
+ * host where the apt install fails, the error an operator reads is from
+ * `apk`, a package manager that host has never had.
+ *
+ * What replaces it: ask the host what it is, decide what is missing, and do
+ * the smallest set of things that fixes it — reporting each one. The runtime
+ * comes from nodejs.org as a tarball unpacked under the omnitron prefix,
+ * which works identically on every Linux and macOS, needs no repository, and
+ * is undone by deleting one directory. The package manager is used only for
+ * the two tools that fetch and unpack it, and only when they are missing.
+ *
+ * Built on `@xec-sh/core`: its SSH adapter carries the credentials, and
+ * `quoteForShell`/`dialectFor` do the quoting for the dialect the target
+ * actually speaks rather than assuming a POSIX shell.
+ */
+import { quoteForShell } from '@xec-sh/core';
+/** The default runtime a prepared node gets when it has none. */
+export const DEFAULT_NODE_VERSION = '22.14.0';
+/** Where omnitron puts things it installed itself. */
+export const OMNITRON_PREFIX = '/opt/omnitron';
+/**
+ * One command that answers every question above.
+ *
+ * A single round trip on purpose: each of these is a sub-second question and
+ * an SSH round trip to a host on another continent is not. The old code paid
+ * one per probe.
+ *
+ * Every line is `key=value`, and a missing value means "not present" rather
+ * than "the question failed" — the command cannot fail as a whole, so the
+ * caller's own error handling stays the thing that reports unreachable hosts.
+ */
+export const PLATFORM_PROBE = [
+    'echo "os=$(uname -s 2>/dev/null | tr "[:upper:]" "[:lower:]")"',
+    'echo "machine=$(uname -m 2>/dev/null)"',
+    'echo "distro=$(. /etc/os-release 2>/dev/null && echo "$ID")"',
+    'echo "uid=$(id -u 2>/dev/null)"',
+    'echo "sudo=$(command -v sudo >/dev/null 2>&1 && sudo -n true 2>/dev/null && echo yes)"',
+    'for p in apt-get dnf yum apk pacman zypper brew; do command -v $p >/dev/null 2>&1 && echo "pm=$p" && break; done',
+    'echo "node=$(node --version 2>/dev/null)"',
+    'echo "bun=$(bun --version 2>/dev/null)"',
+    'echo "npm=$(npm --version 2>/dev/null)"',
+    'echo "omnitron=$(omnitron --version 2>/dev/null | head -1)"',
+    'command -v curl >/dev/null 2>&1 && echo "curl=yes"',
+    'command -v tar >/dev/null 2>&1 && echo "tar=yes"',
+    'true',
+].join('; ');
+/** `uname -m` spellings → the architecture name Node publishes under. */
+const ARCH_BY_MACHINE = {
+    x86_64: 'x64', amd64: 'x64',
+    aarch64: 'arm64', arm64: 'arm64',
+    armv7l: 'armv7l',
+    ppc64le: 'ppc64le',
+    s390x: 's390x',
+};
+const PACKAGE_MANAGERS = {
+    'apt-get': 'apt', dnf: 'dnf', yum: 'yum', apk: 'apk', pacman: 'pacman', zypper: 'zypper', brew: 'brew',
+};
+/** Parse the probe's output. Anything unanswered stays absent. */
+export function parsePlatformProbe(stdout) {
+    const values = new Map();
+    for (const line of stdout.split('\n')) {
+        const at = line.indexOf('=');
+        if (at <= 0)
+            continue;
+        const value = line.slice(at + 1).trim();
+        if (value)
+            values.set(line.slice(0, at).trim(), value);
+    }
+    const os = values.get('os');
+    const machine = values.get('machine');
+    const uid = values.get('uid');
+    return {
+        os: os === 'linux' || os === 'darwin' ? os : 'unknown',
+        arch: (machine ? ARCH_BY_MACHINE[machine] : undefined) ?? null,
+        distro: values.get('distro') ?? null,
+        packageManager: PACKAGE_MANAGERS[values.get('pm') ?? ''] ?? null,
+        isRoot: uid === '0',
+        passwordlessSudo: values.get('sudo') === 'yes',
+        node: values.get('node') ?? null,
+        bun: values.get('bun') ?? null,
+        npm: values.get('npm') ?? null,
+        omnitron: values.get('omnitron') ?? null,
+        hasCurl: values.get('curl') === 'yes',
+        hasTar: values.get('tar') === 'yes',
+    };
+}
+/** How each package manager installs a package non-interactively. */
+const INSTALL_COMMAND = {
+    apt: (p) => `DEBIAN_FRONTEND=noninteractive apt-get update -qq && DEBIAN_FRONTEND=noninteractive apt-get install -y -qq ${p}`,
+    dnf: (p) => `dnf install -y -q ${p}`,
+    yum: (p) => `yum install -y -q ${p}`,
+    apk: (p) => `apk add --no-cache ${p}`,
+    pacman: (p) => `pacman -Sy --noconfirm ${p}`,
+    zypper: (p) => `zypper --non-interactive install ${p}`,
+    // Homebrew refuses to run as root, and the SSH user owns its own prefix.
+    brew: (p) => `brew install ${p}`,
+};
+/**
+ * Decide what a host needs.
+ *
+ * Pure, so the decision can be read and tested without a machine: given the
+ * same facts it produces the same plan, and the plan is a list of commands a
+ * person can look at before anything runs.
+ */
+export function planProvisioning(facts, requirements = {}) {
+    const nodeVersion = requirements.nodeVersion ?? DEFAULT_NODE_VERSION;
+    const prefix = requirements.prefix ?? OMNITRON_PREFIX;
+    const usePackageManager = requirements.usePackageManager ?? true;
+    const dialect = 'posix';
+    const q = (v) => quoteForShell(v, dialect);
+    if (facts.os === 'unknown') {
+        return {
+            steps: [],
+            nothingToDo: false,
+            refusal: 'Could not tell what operating system this host runs — `uname -s` answered nothing. ' +
+                'Omnitron prepares Linux and macOS hosts.',
+        };
+    }
+    if (!facts.arch) {
+        return {
+            steps: [],
+            nothingToDo: false,
+            refusal: 'This host reports a machine architecture omnitron has no runtime build for.',
+        };
+    }
+    // Root, or sudo that does not stop to ask. A provisioning run cannot answer
+    // a password prompt, and a step that hangs on one is worse than a refusal.
+    const elevated = facts.isRoot || facts.passwordlessSudo;
+    const sudo = facts.isRoot ? '' : 'sudo ';
+    const steps = [];
+    const hasRuntime = Boolean(facts.node ?? facts.bun);
+    if (!hasRuntime) {
+        const missingTools = [!facts.hasCurl ? 'curl' : null, !facts.hasTar ? 'tar' : null].filter((t) => t !== null);
+        if (missingTools.length > 0) {
+            if (!usePackageManager) {
+                return {
+                    steps: [],
+                    nothingToDo: false,
+                    refusal: `This host needs ${missingTools.join(' and ')} to fetch a runtime, and installing packages was not allowed.`,
+                };
+            }
+            if (!facts.packageManager) {
+                return {
+                    steps: [],
+                    nothingToDo: false,
+                    refusal: `This host has no ${missingTools.join(' or ')}, and no package manager omnitron recognises to install ` +
+                        `them with. Install ${missingTools.join(' and ')} and try again.`,
+                };
+            }
+            if (!elevated && facts.packageManager !== 'brew') {
+                return {
+                    steps: [],
+                    nothingToDo: false,
+                    refusal: `Installing ${missingTools.join(' and ')} needs root, and this session is neither root nor able to ` +
+                        `use sudo without a password.`,
+                };
+            }
+            const install = INSTALL_COMMAND[facts.packageManager](missingTools.join(' '));
+            steps.push({
+                what: `install ${missingTools.join(' and ')} with ${facts.packageManager}`,
+                command: facts.packageManager === 'brew' ? install : `${sudo}sh -c ${q(install)}`,
+                timeoutMs: 300_000,
+                touchesPackageManager: true,
+            });
+        }
+        // The runtime itself: an official build, unpacked where omnitron keeps
+        // what it installed. No repository, no package database, and removing
+        // the prefix removes it.
+        const dir = `node-v${nodeVersion}-${facts.os}-${facts.arch}`;
+        const url = `https://nodejs.org/dist/v${nodeVersion}/${dir}.tar.gz`;
+        const runtimeRoot = `${prefix}/runtime`;
+        // Put the runtime on PATH without deleting anything.
+        //
+        // `ln -sf` replaces whatever is at the destination, and on a machine that
+        // is already doing something else that is a file somebody else put there.
+        // A host reaches this step only when `node --version` answered nothing,
+        // which usually means the path is empty — but "usually" is not the same
+        // as "always": a broken install leaves a real binary that does not run,
+        // and `-f` would delete it.
+        //
+        // So each link is made only where there is nothing, or where what is
+        // there is a symlink we can point elsewhere. A host that has a real file
+        // in the way keeps it, and the runtime is still installed and usable by
+        // its absolute path.
+        const link = (name) => `if [ ! -e /usr/local/bin/${name} ] || [ -L /usr/local/bin/${name} ]; then ` +
+            `${sudo}ln -sfn ${q(`${runtimeRoot}/bin/${name}`)} /usr/local/bin/${name}; fi`;
+        steps.push({
+            what: `install Node.js v${nodeVersion} into ${runtimeRoot}`,
+            command: `${sudo}mkdir -p ${q(runtimeRoot)} && ` +
+                `curl -fsSL ${q(url)} | ${sudo}tar -xz -C ${q(runtimeRoot)} --strip-components=1 && ` +
+                `${link('node')} && ${link('npm')} && ${link('npx')}`,
+            timeoutMs: 600_000,
+        });
+    }
+    if (!facts.omnitron) {
+        // `npm install -g` puts the CLI in its own prefix's `bin`, and that is
+        // not always on PATH. For the runtime installed above it is
+        // `/opt/omnitron/runtime/bin`, which is on nobody's.
+        //
+        // Measured twice on the test host, and the second time is the instructive
+        // one. First run: node, npm and npx linked and working, `omnitron
+        // --version` answering 0.2.0 by absolute path, and `omnitron up` failing
+        // with `command not found`. So a link was added — conditioned on "we
+        // installed the runtime", on the reasoning that a host with its own Node
+        // has its own global prefix already on PATH. Second run: the runtime WAS
+        // ours, from the first run, so the host now looked like one that had
+        // always had Node, the condition was false, and the same
+        // `command not found` came back.
+        //
+        // The condition was the wrong question. What matters is not where the
+        // runtime came from but whether the CLI can be run by name — so that is
+        // what is asked, after the install, on the host. `npm prefix -g` answers
+        // where it actually went, whoever's npm it is; the link is made only if
+        // the name is still unreachable, and only over nothing or a symlink.
+        const linkCli = ` && if ! command -v omnitron >/dev/null 2>&1; then ` +
+            `OMNI_BIN="$(npm prefix -g)/bin/omnitron"; ` +
+            `if [ -x "$OMNI_BIN" ] && { [ ! -e /usr/local/bin/omnitron ] || [ -L /usr/local/bin/omnitron ]; }; then ` +
+            `${sudo}ln -sfn "$OMNI_BIN" /usr/local/bin/omnitron; fi; fi`;
+        steps.push({
+            what: 'install the omnitron CLI',
+            command: `${sudo}npm install -g --no-fund --no-audit @omnitron-dev/omnitron${linkCli}`,
+            timeoutMs: 600_000,
+        });
+    }
+    return { steps, nothingToDo: steps.length === 0 };
+}
+/**
+ * A one-line summary of what a plan will change, for a log or a console.
+ *
+ * Exists because "provisioning failed" and "provisioning did nothing" and
+ * "provisioning replaced this machine's Node" all used to look the same from
+ * outside.
+ */
+export function describePlan(plan) {
+    if (plan.refusal)
+        return plan.refusal;
+    if (plan.nothingToDo)
+        return 'nothing to install — the host already has what omnitron needs';
+    return plan.steps.map((s) => s.what).join('; ');
+}
+//# sourceMappingURL=remote-provisioner.js.map

package/dist/services/remote-provisioner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-provisioner.js","sourceRoot":"","sources":["../../src/services/remote-provisioner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,aAAa,EAAqB,MAAM,cAAc,CAAC;AAEhE,iEAAiE;AACjE,MAAM,CAAC,MAAM,oBAAoB,GAAG,SAAS,CAAC;AAE9C,sDAAsD;AACtD,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAAC;AAmC/C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,gEAAgE;IAChE,wCAAwC;IACxC,8DAA8D;IAC9D,iCAAiC;IACjC,wFAAwF;IACxF,kHAAkH;IAClH,2CAA2C;IAC3C,yCAAyC;IACzC,yCAAyC;IACzC,6DAA6D;IAC7D,oDAAoD;IACpD,kDAAkD;IAClD,MAAM;CACP,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,yEAAyE;AACzE,MAAM,eAAe,GAA6B;IAChD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;IAC3B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO;IAChC,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;IAClB,KAAK,EAAE,OAAO;CACf,CAAC;AAEF,MAAM,gBAAgB,GAAmC;IACvD,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM;CACvG,CAAC;AAEF,kEAAkE;AAClE,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI,CAAC;YAAE,SAAS;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,KAAK;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAE9B,OAAO;QACL,EAAE,EAAE,EAAE,KAAK,OAAO,IAAI,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;QACtD,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,IAAI;QAC9D,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI;QACpC,cAAc,EAAE,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI;QAChE,MAAM,EAAE,GAAG,KAAK,GAAG;QACnB,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK;QAC9C,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI;QAChC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI;QAC9B,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI;QAC9B,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI;QACxC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK;QACrC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK;KACpC,CAAC;AACJ,CAAC;AAsCD,qEAAqE;AACrE,MAAM,eAAe,GAAqD;IACxE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,8GAA8G,CAAC,EAAE;IAC7H,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,EAAE;IACpC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,EAAE;IACpC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,EAAE;IACrC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,0BAA0B,CAAC,EAAE;IAC5C,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,oCAAoC,CAAC,EAAE;IACtD,yEAAyE;IACzE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,EAAE;CACjC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAoB,EACpB,YAAY,GAA0B,EAAE;IAExC,MAAM,WAAW,GAAG,YAAY,CAAC,WAAW,IAAI,oBAAoB,CAAC;IACrE,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,IAAI,eAAe,CAAC;IACtD,MAAM,iBAAiB,GAAG,YAAY,CAAC,iBAAiB,IAAI,IAAI,CAAC;IACjE,MAAM,OAAO,GAAiB,OAAO,CAAC;IACtC,MAAM,CAAC,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAEnD,IAAI,KAAK,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO;YACL,KAAK,EAAE,EAAE;YACT,WAAW,EAAE,KAAK;YAClB,OAAO,EACL,qFAAqF;gBACrF,0CAA0C;SAC7C,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAChB,OAAO;YACL,KAAK,EAAE,EAAE;YACT,WAAW,EAAE,KAAK;YAClB,OAAO,EAAE,6EAA6E;SACvF,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,2EAA2E;IAC3E,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC;IACxD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IAEzC,MAAM,KAAK,GAAoB,EAAE,CAAC;IAClC,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;IAEpD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CACxF,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAC/B,CAAC;QAEF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,OAAO;oBACL,KAAK,EAAE,EAAE;oBACT,WAAW,EAAE,KAAK;oBAClB,OAAO,EACL,mBAAmB,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,+DAA+D;iBAC/G,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;gBAC1B,OAAO;oBACL,KAAK,EAAE,EAAE;oBACT,WAAW,EAAE,KAAK;oBAClB,OAAO,EACL,oBAAoB,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,0DAA0D;wBACvG,sBAAsB,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB;iBACpE,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,cAAc,KAAK,MAAM,EAAE,CAAC;gBACjD,OAAO;oBACL,KAAK,EAAE,EAAE;oBACT,WAAW,EAAE,KAAK;oBAClB,OAAO,EACL,cAAc,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,4DAA4D;wBACpG,8BAA8B;iBACjC,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9E,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,WAAW,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,CAAC,cAAc,EAAE;gBAC1E,OAAO,EAAE,KAAK,CAAC,cAAc,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,SAAS,CAAC,CAAC,OAAO,CAAC,EAAE;gBACjF,SAAS,EAAE,OAAO;gBAClB,qBAAqB,EAAE,IAAI;aAC5B,CAAC,CAAC;QACL,CAAC;QAED,uEAAuE;QACvE,sEAAsE;QACtE,yBAAyB;QACzB,MAAM,GAAG,GAAG,SAAS,WAAW,IAAI,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7D,MAAM,GAAG,GAAG,4BAA4B,WAAW,IAAI,GAAG,SAAS,CAAC;QACpE,MAAM,WAAW,GAAG,GAAG,MAAM,UAAU,CAAC;QACxC,qDAAqD;QACrD,EAAE;QACF,0EAA0E;QAC1E,0EAA0E;QAC1E,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,4BAA4B;QAC5B,EAAE;QACF,qEAAqE;QACrE,yEAAyE;QACzE,wEAAwE;QACxE,qBAAqB;QACrB,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAC5B,4BAA4B,IAAI,6BAA6B,IAAI,WAAW;YAC5E,GAAG,IAAI,WAAW,CAAC,CAAC,GAAG,WAAW,QAAQ,IAAI,EAAE,CAAC,mBAAmB,IAAI,MAAM,CAAC;QAEjF,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,oBAAoB,WAAW,SAAS,WAAW,EAAE;YAC3D,OAAO,EACL,GAAG,IAAI,YAAY,CAAC,CAAC,WAAW,CAAC,MAAM;gBACvC,cAAc,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,cAAc,CAAC,CAAC,WAAW,CAAC,2BAA2B;gBACrF,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE;YACvD,SAAS,EAAE,OAAO;SACnB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpB,uEAAuE;QACvE,4DAA4D;QAC5D,qDAAqD;QACrD,EAAE;QACF,0EAA0E;QAC1E,kEAAkE;QAClE,yEAAyE;QACzE,qEAAqE;QACrE,yEAAyE;QACzE,yEAAyE;QACzE,qEAAqE;QACrE,yDAAyD;QACzD,iCAAiC;QACjC,EAAE;QACF,sEAAsE;QACtE,wEAAwE;QACxE,yEAAyE;QACzE,wEAAwE;QACxE,qEAAqE;QACrE,MAAM,OAAO,GACX,qDAAqD;YACrD,4CAA4C;YAC5C,yGAAyG;YACzG,GAAG,IAAI,qDAAqD,CAAC;QAE/D,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,GAAG,IAAI,6DAA6D,OAAO,EAAE;YACtF,SAAS,EAAE,OAAO;SACnB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;AACpD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,IAAmB;IAC9C,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC;IACtC,IAAI,IAAI,CAAC,WAAW;QAAE,OAAO,+DAA+D,CAAC;IAC7F,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAClD,CAAC"}

package/dist/services/secrets.rpc-service.d.ts

@@ -5,9 +5,26 @@
  * All endpoints require authentication (admin role).
  */
 import type { SecretsService } from './secrets.service.js';
-export declare class SecretsRpcService {
+import type { IOmnitronSecretsService } from '../shared/dto/services.js';
+export declare class SecretsRpcService implements IOmnitronSecretsService {
     private readonly secrets;
-    constructor(secrets: SecretsService);
+    /**
+     * The audit trail, when this daemon has one.
+     *
+     * The vault is the one surface where READING is worth recording: a
+     * value that leaves here can be used anywhere, and the only account of
+     * who took it is this row.
+     */
+    private readonly audit?;
+    constructor(secrets: SecretsService, 
+    /**
+     * The audit trail, when this daemon has one.
+     *
+     * The vault is the one surface where READING is worth recording: a
+     * value that leaves here can be used anywhere, and the only account of
+     * who took it is this row.
+     */
+    audit?: import('./audit.service.js').AuditService | undefined);
     /**
      * Get a secret by key. Returns null if not found.
      */
@@ -26,6 +43,38 @@ export declare class SecretsRpcService {
     }): Promise<{
         success: boolean;
     }>;
+    /**
+     * Make a secret here and keep it — random bytes of the given length, in the
+     * given encoding — and answer with its name only.
+     *
+     * For a key nobody should have to type or paste: a secret set with `set`
+     * has passed through a terminal, an argument list and a clipboard first. A
+     * key that already exists is refused rather than replaced — it is somebody's
+     * secret, and whatever it protects would be lost with it; `delete` first,
+     * on purpose, if that is the intent.
+     */
+    generate(data: {
+        key: string;
+        bytes?: number;
+        encoding?: 'base64' | 'base64url' | 'hex';
+    }): Promise<{
+        key: string;
+        bytes: number;
+        encoding: 'base64' | 'base64url' | 'hex';
+    }>;
+    /**
+     * A second key holding the same secret, made here — the answer names the
+     * two keys, never the value. See `SecretsService.copy`.
+     *
+     * Recorded as what it is: a read of `from` whose value went to `to`.
+     */
+    copy(data: {
+        from: string;
+        to: string;
+    }): Promise<{
+        from: string;
+        to: string;
+    }>;
     /**
      * Delete a secret by key.
      */

package/dist/services/secrets.rpc-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.rpc-service.d.ts","sourceRoot":"","sources":["../../src/services/secrets.rpc-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,qBACa,iBAAiB;IAChB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,cAAc;IAEpD;;OAEG;IAEG,GAAG,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAKhF;;OAEG;IAEG,GAAG,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAK9E;;OAEG;IAEG,MAAM,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAKpF;;OAEG;IAEG,IAAI,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CAI1C"}
+{"version":3,"file":"secrets.rpc-service.d.ts","sourceRoot":"","sources":["../../src/services/secrets.rpc-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEzE,qBACa,iBAAkB,YAAW,uBAAuB;IAE7D,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IATzB,YACmB,OAAO,EAAE,cAAc;IACxC;;;;;;OAMG;IACc,KAAK,CAAC,EAAE,OAAO,oBAAoB,EAAE,YAAY,GAAG,SAAS,EAC5E;IAEJ;;OAEG;IAEG,GAAG,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAS/E;IAED;;OAEG;IAEG,GAAG,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAK7E;IAED;;;;;;;;;OASG;IAEG,QAAQ,CAAC,IAAI,EAAE;QACnB,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,QAAQ,GAAG,WAAW,GAAG,KAAK,CAAC;KAC3C,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,QAAQ,GAAG,WAAW,GAAG,KAAK,CAAA;KAAE,CAAC,CAkBpF;IAED;;;;;OAKG;IAEG,IAAI,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAMpF;IAED;;OAEG;IAEG,MAAM,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CASnF;IAED;;OAEG;IAEG,IAAI,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAGxC;CACF"}

package/dist/services/secrets.rpc-service.js

@@ -17,14 +17,30 @@ import { Service, Public } from '@omnitron-dev/titan/decorators';
 import { ADMIN_ROLES } from '../shared/roles.js';
 let SecretsRpcService = class SecretsRpcService {
     secrets;
-    constructor(secrets) {
+    audit;
+    constructor(secrets, 
+    /**
+     * The audit trail, when this daemon has one.
+     *
+     * The vault is the one surface where READING is worth recording: a
+     * value that leaves here can be used anywhere, and the only account of
+     * who took it is this row.
+     */
+    audit) {
         this.secrets = secrets;
+        this.audit = audit;
     }
     /**
      * Get a secret by key. Returns null if not found.
      */
     async get(data) {
         const value = await this.secrets.get(data.key);
+        await this.audit?.record({
+            action: 'secret.read',
+            resourceType: 'secret',
+            resourceId: data.key,
+            details: { found: value !== null },
+        });
         return { key: data.key, value };
     }
     /**
@@ -32,13 +48,64 @@ let SecretsRpcService = class SecretsRpcService {
      */
     async set(data) {
         await this.secrets.set(data.key, data.value);
+        // The KEY, never the value — see `scrubDetails`.
+        await this.audit?.record({ action: 'secret.set', resourceType: 'secret', resourceId: data.key });
         return { success: true };
     }
+    /**
+     * Make a secret here and keep it — random bytes of the given length, in the
+     * given encoding — and answer with its name only.
+     *
+     * For a key nobody should have to type or paste: a secret set with `set`
+     * has passed through a terminal, an argument list and a clipboard first. A
+     * key that already exists is refused rather than replaced — it is somebody's
+     * secret, and whatever it protects would be lost with it; `delete` first,
+     * on purpose, if that is the intent.
+     */
+    async generate(data) {
+        const key = data.key?.trim();
+        if (!key)
+            throw new Error('A secret needs a key');
+        const bytes = data.bytes ?? 32;
+        if (!Number.isInteger(bytes) || bytes < 16 || bytes > 1024) {
+            throw new Error(`--bytes must be a whole number from 16 to 1024, not ${String(data.bytes)}`);
+        }
+        const encoding = data.encoding ?? 'base64';
+        if (!['base64', 'base64url', 'hex'].includes(encoding)) {
+            throw new Error(`--encoding must be base64, base64url or hex, not ${String(data.encoding)}`);
+        }
+        if ((await this.secrets.get(key)) !== null) {
+            throw new Error(`The vault already holds '${key}' — nothing was generated. Delete it first if replacing it is the intent`);
+        }
+        const { randomBytes } = await import('node:crypto');
+        await this.secrets.set(key, randomBytes(bytes).toString(encoding));
+        await this.audit?.record({ action: 'secret.generate', resourceType: 'secret', resourceId: key, details: { bytes, encoding } });
+        return { key, bytes, encoding };
+    }
+    /**
+     * A second key holding the same secret, made here — the answer names the
+     * two keys, never the value. See `SecretsService.copy`.
+     *
+     * Recorded as what it is: a read of `from` whose value went to `to`.
+     */
+    async copy(data) {
+        const from = data.from?.trim() ?? '';
+        const to = data.to?.trim() ?? '';
+        await this.secrets.copy(from, to);
+        await this.audit?.record({ action: 'secret.copy', resourceType: 'secret', resourceId: to, details: { from } });
+        return { from, to };
+    }
     /**
      * Delete a secret by key.
      */
     async delete(data) {
         const existed = await this.secrets.delete(data.key);
+        await this.audit?.record({
+            action: 'secret.delete',
+            resourceType: 'secret',
+            resourceId: data.key,
+            details: { existed },
+        });
         return { success: true, existed };
     }
     /**
@@ -61,6 +128,18 @@ __decorate([
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", Promise)
 ], SecretsRpcService.prototype, "set", null);
+__decorate([
+    Public({ auth: { roles: ADMIN_ROLES } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], SecretsRpcService.prototype, "generate", null);
+__decorate([
+    Public({ auth: { roles: ADMIN_ROLES } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], SecretsRpcService.prototype, "copy", null);
 __decorate([
     Public({ auth: { roles: ADMIN_ROLES } }),
     __metadata("design:type", Function),
@@ -75,7 +154,7 @@ __decorate([
 ], SecretsRpcService.prototype, "list", null);
 SecretsRpcService = __decorate([
     Service({ name: 'OmnitronSecrets' }),
-    __metadata("design:paramtypes", [Function])
+    __metadata("design:paramtypes", [Function, Object])
 ], SecretsRpcService);
 export { SecretsRpcService };
 //# sourceMappingURL=secrets.rpc-service.js.map